feat(http): centralize HTTP client with proxy and custom-CA support (#1686)

Track B of
[voidzero-dev/setup-vp#73](voidzero-dev/setup-vp#73)
— makes `vp` work through Socket Firewall Free (sfw) and other
TLS-intercepting proxies.

## What

- **New `vite_shared::shared_http_client()`**: process-wide
`reqwest::Client` that honors `HTTPS_PROXY` / `HTTP_PROXY` / `NO_PROXY`,
picks up macOS System Settings / Windows registry proxies
(`system-proxy` feature), loads custom CAs from `SSL_CERT_FILE` and
`NODE_EXTRA_CA_CERTS` (additive, Node-style), and has connect + request
timeouts. `VP_INSECURE_TLS` (truthy only — `1`/`true`/`yes`/`on`) is a
diagnostic escape hatch with a loud warning.
- **All `reqwest::get` / `reqwest::Client::new()` call sites** in
`vite_install` and `vite_js_runtime` routed through the shared client.
- **`vite_shared::format_error_chain`**: walks `Error::source()` so
users see `... invalid peer certificate: UnknownIssuer` instead of the
opaque `error sending request for url`. Wired into both `Error::Reqwest`
variants and the four `DownloadFailed { reason }` sites.
- **New `install-e2e-test-sfw` CI job** (Linux / macOS / Windows):
downloads upstream `sfw`, runs `sfw vp i -g pnpm@…` + `sfw vp install`
against a fresh `vitejs/vite` clone. Gated on the `test: sfw` label for
PRs; unconditional on push-to-main. `VP_INSECURE_TLS=1` is scoped to the
Linux entry only (workaround for
[SocketDev/sfw-free#30](SocketDev/sfw-free#30)
/ [#43](SocketDev/sfw-free#43) —
present-but-empty EKU rejected by rustls).

## Out of scope / follow-ups

- Switch to `rustls-native-certs` so OS-installed CAs work without env
vars — Track B step 5, separate PR.
- Drop `vp_insecure_tls` from the Linux matrix once SocketDev/sfw-free
ships the EKU fix (one-line change).

Refs voidzero-dev/setup-vp#73

Author: fengmk2

.github/workflows/ci.yml

@@ -889,6 +889,131 @@ jobs:
             echo ""
           done
 
+  install-e2e-test-sfw:
+    name: Local CLI `vp install` E2E test (Socket Firewall Free)
+    needs:
+      - download-previous-rolldown-binaries
+    # Run if: not a PR (push-to-main / workflow_dispatch), OR PR has 'test: sfw' label.
+    # Heavy job (3 OSes × real registry traffic) — gated to avoid running on every PR.
+    if: >-
+      github.event_name != 'pull_request' ||
+      contains(github.event.pull_request.labels.*.name, 'test: sfw')
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+            sfw_asset: sfw-free-linux-x86_64
+            vp_bin: vp
+            # Only Linux needs the TLS-bypass: the ubuntu-latest runner
+            # doesn't preinstall Node 22.18 into vp's cache, so vp's HttpClient
+            # (rustls) fetches `nodejs.org/.../SHASUMS256.txt` through sfw and
+            # hits the upstream EKU bug. macOS/Windows runners ship Node in
+            # vp's cache already, so vp never calls its HttpClient through sfw
+            # in this test — leave the verification on there.
+            vp_insecure_tls: '1'
+          - os: namespace-profile-mac-default
+            target: aarch64-apple-darwin
+            sfw_asset: sfw-free-macos-arm64
+            vp_bin: vp
+            vp_insecure_tls: ''
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+            sfw_asset: sfw-free-windows-x86_64.exe
+            # On Windows vp ships as `vp.exe`; sfw spawns its child process
+            # directly without applying PATHEXT, so the bare `vp` lookup fails.
+            vp_bin: vp.exe
+            vp_insecure_tls: ''
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
+      - uses: ./.github/actions/clone
+
+      - name: Setup Dev Drive
+        if: runner.os == 'Windows'
+        uses: samypr100/setup-dev-drive@30f0f98ae5636b2b6501e181dfb3631b9974818d # v4.0.0
+        with:
+          drive-size: 12GB
+          drive-format: ReFS
+          env-mapping: |
+            CARGO_HOME,{{ DEV_DRIVE }}/.cargo
+            RUSTUP_HOME,{{ DEV_DRIVE }}/.rustup
+
+      - uses: oxc-project/setup-rust@68c3199c5339f965e6e163924c3c450773eba42b # main (pending v1.0.17 — Swatinem/rust-cache v2.9.1 for node24)
+        with:
+          save-cache: ${{ github.ref_name == 'main' }}
+          cache-key: install-e2e-test-sfw-${{ matrix.os }}
+          target-dir: ${{ runner.os == 'Windows' && format('{0}/target', env.DEV_DRIVE) || '' }}
+
+      - uses: oxc-project/setup-node@ab97f03642370d79a7e96dd286bd02a1be40e0ba # v1.3.0
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: rolldown-binaries
+          path: ./rolldown/packages/rolldown/src
+          merge-multiple: true
+
+      - name: Build with upstream
+        uses: ./.github/actions/build-upstream
+        with:
+          target: ${{ matrix.target }}
+
+      - name: Build CLI
+        run: |
+          pnpm bootstrap-cli:ci
+          # Mirror the per-OS path form used by the `test` job (ci.yml ~L266):
+          # GITHUB_PATH on Windows needs a Windows-style path, otherwise child
+          # processes spawned by tools like sfw (which use CreateProcess and
+          # not bash's PATH munging) can't resolve `vp.exe`.
+          if [[ "$RUNNER_OS" == "Windows" ]]; then
+            echo "$USERPROFILE\.vite-plus\bin" >> $GITHUB_PATH
+          else
+            echo "$HOME/.vite-plus/bin" >> $GITHUB_PATH
+          fi
+
+      - name: Download sfw
+        run: |
+          set -euo pipefail
+          mkdir -p "$RUNNER_TEMP/sfw-bin"
+          # `--remove-on-error` (curl 7.83+) prevents leaving a zero-byte file
+          # on failure so the next step's `sfw --version` fails clearly rather
+          # than with "exec format error" on an empty binary.
+          curl --fail --location --remove-on-error --retry 3 --retry-delay 2 \
+            --output "$RUNNER_TEMP/sfw-bin/sfw${{ runner.os == 'Windows' && '.exe' || '' }}" \
+            "https://github.com/SocketDev/sfw-free/releases/latest/download/${{ matrix.sfw_asset }}"
+          if [[ "${{ runner.os }}" != "Windows" ]]; then
+            chmod +x "$RUNNER_TEMP/sfw-bin/sfw"
+          fi
+          echo "$RUNNER_TEMP/sfw-bin" >> "$GITHUB_PATH"
+
+      - name: Verify sfw on PATH
+        run: sfw --version
+
+      - name: Run `sfw vp install` against a real repo
+        # TODO(SocketDev/sfw-free#30, SocketDev/sfw-free#43): drop `vp_insecure_tls`
+        # from the Linux matrix entry once sfw ships the EKU fix. Verified
+        # against sfw v1.11.0 (releases/latest as of 2026-05-28): on Linux,
+        # vp's HTTPS request to nodejs.org through sfw still fails with
+        # "invalid peer certificate: UnknownIssuer" because sfw's CA carries a
+        # present-but-empty Extended Key Usage extension that rustls rejects.
+        # macOS/Windows runners cache Node 22.18 in vp's directory, so vp
+        # doesn't call its HttpClient through sfw — leaving TLS verification
+        # enabled there gives us coverage that the bypass *isn't* used on
+        # those platforms.
+        env:
+          VP_INSECURE_TLS: ${{ matrix.vp_insecure_tls }}
+        run: |
+          set -euo pipefail
+          # Force the registry-fetch path: install a pinned pnpm globally so
+          # vp downloads it (and therefore traverses sfw) rather than reusing
+          # whatever's preinstalled on the runner.
+          sfw "${{ matrix.vp_bin }}" i -g pnpm@9.15.0
+          # Then exercise `vp install` inside a real repo, also through sfw.
+          git clone --depth 1 https://github.com/vitejs/vite.git "$RUNNER_TEMP/vite"
+          cd "$RUNNER_TEMP/vite"
+          sfw "${{ matrix.vp_bin }}" install --no-frozen-lockfile
+
   done:
     runs-on: ubuntu-latest
     if: always()
@@ -899,6 +1024,9 @@ jobs:
       - cli-e2e-test
       - cli-e2e-test-musl
       - cli-snap-test
+      # Skipped on unlabeled PRs; counted on push-to-main and labeled PRs.
+      # `contains(needs.*.result, 'failure')` ignores "skipped" results.
+      - install-e2e-test-sfw
     steps:
       - run: exit 1
         # Thank you, next https://github.com/vercel/next.js/blob/canary/.github/workflows/build_and_test.yml#L379

Cargo.lock

@@ -21,6 +21,7 @@ serde_yml = { workspace = true }
 thiserror = { workspace = true }
 tokio = { workspace = true }
 vite_path = { workspace = true }
+vite_shared = { workspace = true }
 vite_str = { workspace = true }
 vite_workspace = { workspace = true }
 wax = { workspace = true }

crates/vite_error/Cargo.toml

@@ -106,7 +106,12 @@ pub enum Error {
     #[error(transparent)]
     Semver(#[from] semver::Error),
 
-    #[error(transparent)]
+    // `#[error("{}", ...)]` not `transparent`: surface the full `source()`
+    // chain (TLS handshake → UnknownIssuer, hyper IO errors, etc.) instead of
+    // just reqwest's top-level "error sending request for url (...)" message.
+    // Keeps `From<reqwest::Error>` and `source()` semantics intact, so 404
+    // detection via `e.status()` at call sites still works.
+    #[error("{}", vite_shared::format_error_chain(.0))]
     Reqwest(#[from] reqwest::Error),
 
     #[error(transparent)]

crates/vite_error/src/lib.rs

@@ -59,9 +59,9 @@ impl HttpClient {
     }
 
     async fn get(&self, url: &str) -> Result<Response, Error> {
-        vite_shared::ensure_tls_provider();
+        let client = vite_shared::shared_http_client();
 
-        let response = (|| async { reqwest::get(url).await?.error_for_status() })
+        let response = (|| async { client.get(url).send().await?.error_for_status() })
             .retry(
                 ExponentialBuilder::default()
                     .with_jitter()

crates/vite_install/src/request.rs

@@ -37,19 +37,22 @@ pub async fn download_file(
     target_path: &AbsolutePath,
     message: &str,
 ) -> Result<(), Error> {
-    vite_shared::ensure_tls_provider();
+    let client = vite_shared::shared_http_client();
 
     tracing::debug!("Downloading {url} to {target_path:?}");
 
-    let response = (|| async { reqwest::get(url).await?.error_for_status() })
+    let response = (|| async { client.get(url).send().await?.error_for_status() })
         .retry(
             ExponentialBuilder::default()
                 .with_jitter()
                 .with_min_delay(Duration::from_millis(500))
                 .with_max_times(3),
         )
         .await
-        .map_err(|e| Error::DownloadFailed { url: url.into(), reason: vite_str::format!("{e}") })?;
+        .map_err(|e| Error::DownloadFailed {
+            url: url.into(),
+            reason: vite_shared::format_error_chain(&e).into(),
+        })?;
 
     // Get Content-Length for progress bar
     let total_size = response.content_length();
@@ -113,19 +116,22 @@ pub async fn download_file(
 /// Download text content from a URL with retry logic
 #[expect(clippy::disallowed_types, reason = "HTTP response body is a String")]
 pub async fn download_text(url: &str) -> Result<String, Error> {
-    vite_shared::ensure_tls_provider();
+    let client = vite_shared::shared_http_client();
 
     tracing::debug!("Downloading text from {url}");
 
-    let content = (|| async { reqwest::get(url).await?.text().await })
+    let content = (|| async { client.get(url).send().await?.error_for_status()?.text().await })
         .retry(
             ExponentialBuilder::default()
                 .with_jitter()
                 .with_min_delay(Duration::from_millis(500))
                 .with_max_times(3),
         )
         .await
-        .map_err(|e| Error::DownloadFailed { url: url.into(), reason: vite_str::format!("{e}") })?;
+        .map_err(|e| Error::DownloadFailed {
+            url: url.into(),
+            reason: vite_shared::format_error_chain(&e).into(),
+        })?;
 
     Ok(content)
 }
@@ -138,12 +144,11 @@ pub async fn fetch_with_cache_headers(
     url: &str,
     if_none_match: Option<&str>,
 ) -> Result<CachedFetchResponse, Error> {
-    vite_shared::ensure_tls_provider();
+    let client = vite_shared::shared_http_client();
 
     tracing::debug!("Fetching with cache headers from {url}");
 
     let response = (|| async {
-        let client = reqwest::Client::new();
         let mut request = client.get(url);
 
         if let Some(etag) = if_none_match {
@@ -159,7 +164,10 @@ pub async fn fetch_with_cache_headers(
             .with_max_times(3),
     )
     .await
-    .map_err(|e| Error::DownloadFailed { url: url.into(), reason: vite_str::format!("{e}") })?;
+    .map_err(|e| Error::DownloadFailed {
+        url: url.into(),
+        reason: vite_shared::format_error_chain(&e).into(),
+    })?;
 
     // Check for 304 Not Modified
     if response.status() == reqwest::StatusCode::NOT_MODIFIED {
@@ -182,10 +190,10 @@ pub async fn fetch_with_cache_headers(
         .and_then(|v| v.to_str().ok())
         .and_then(parse_max_age);
 
-    let body = response
-        .text()
-        .await
-        .map_err(|e| Error::DownloadFailed { url: url.into(), reason: vite_str::format!("{e}") })?;
+    let body = response.text().await.map_err(|e| Error::DownloadFailed {
+        url: url.into(),
+        reason: vite_shared::format_error_chain(&e).into(),
+    })?;
 
     Ok(CachedFetchResponse { body: Some(body), etag, max_age, not_modified: false })
 }

crates/vite_js_runtime/src/download.rs

@@ -58,8 +58,13 @@ pub enum Error {
     #[error(transparent)]
     Io(#[from] std::io::Error),
 
-    /// HTTP request error
-    #[error(transparent)]
+    /// HTTP request error.
+    ///
+    /// Surface the full `source()` chain (TLS handshake / connect / hyper
+    /// IO) rather than reqwest's top-level message only. Body-streaming
+    /// failures inside `download_file` propagate via `?` into this variant,
+    /// so the chain has to be exposed here — not at the call site.
+    #[error("{}", vite_shared::format_error_chain(.0))]
     Reqwest(#[from] reqwest::Error),
 
     /// Join error from tokio