feat(model): add configurable http/https/socks5 proxy support

[AnnatarHe]

Summary

Adds a proxy config block. Every outbound HTTP request from the CLI and daemon now goes through one shared, proxy-aware transport.

proxy:
  url: socks5h://user:pass@127.0.0.1:7890   # http, https, socks5, socks5h
  noProxy: ["localhost", ".corp.example.com", "10.0.0.0/8"]

Behaviour

• Schemes: http, https, socks5 and socks5h, all native to net/http. A bare host:port means http://. SOCKS4 is rejected with a clear error.
• noProxy: uses NO_PROXY rules via golang.org/x/net/http/httpproxy (domain suffix, CIDR, *.domain). Loopback always skips the proxy.
• Precedence: the config proxy overrides the environment variables. If it is unset or invalid, the HTTP(S)_PROXY / NO_PROXY environment variables apply. An invalid URL logs a warning and never aborts the CLI.
• Local override: config.local.* can override the proxy.
• Password masking: shelltime config view redacts proxy passwords.
• Daemon: logs proxy enabled (redacted) at startup. Changing the proxy requires a daemon restart.

Implementation

• New model/http_client.go: ConfigureProxy, NewHTTPClient (otel-wrapped), HTTPTransport(), ParseProxyURL and RedactProxyURL.
• Call sites now on the shared transport: SendHTTPRequestJSON (and therefore SendGraphQLRequest and all their callers), handshake, updater, AI suggest stream, bash-preexec download, and the Anthropic and Codex usage fetchers in the daemon.
• Startup: both cmd/cli and cmd/daemon call ConfigureProxy right after reading config.
• Dependencies: golang.org/x/net moves from indirect to direct, same version.
• Docs: new "Network Proxy" section in docs/CONFIG.md, plus README and CLAUDE.md notes.

Known limitations

The uptrace OTEL exporter (enableMetrics) and the bunx/npx ccusage subprocess only honour the environment variables. These are documented rather than handled with os.Setenv, which would leak into child processes, and npm/bun don't understand SOCKS.

Test plan

• model/http_client_test.go: scheme validation, redaction, nil/invalid config keeps the transport, noProxy and loopback selection, end-to-end through an httptest HTTP proxy, and end-to-end through an in-test SOCKS5 server (hostname resolved by the proxy)
• Config parsing tests (YAML with local override, TOML, unset) and the merge test
• config view redaction test
• Smoke-tested the built binary with a throwaway HOME: config view masks the password, and socks4:// logs the fallback warning
• Remaining commands/daemon failures are unrelated: the same socket tests fail on main
• Manual test against a real HTTP proxy (mitmproxy) and a real SOCKS5 proxy (ssh -D)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[codecov]

Codecov Report

❌ Patch coverage is 92.59259% with 4 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
model/http_client.go	95.34%	1 Missing and 1 partial ⚠️
daemon/codex_ratelimit.go	0.00%	1 Missing ⚠️
model/shell.bash.go	0.00%	1 Missing ⚠️

Flag	Coverage Δ
unittests	79.48% <92.59%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
commands/config_view.go	85.39% <100.00%> (+0.33%)	⬆️
daemon/anthropic_ratelimit.go	76.38% <100.00%> (ø)
model/ai_service.go	88.37% <100.00%> (ø)
model/api.base.go	88.46% <100.00%> (-0.29%)	⬇️
model/config.go	94.63% <100.00%> (+0.07%)	⬆️
model/handshake.go	76.47% <100.00%> (-0.68%)	⬇️
model/updater.go	74.39% <100.00%> (-0.21%)	⬇️
daemon/codex_ratelimit.go	81.97% <0.00%> (ø)
model/shell.bash.go	61.76% <0.00%> (ø)
model/http_client.go	95.34% <95.34%> (ø)

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.