fix(sandbox): set CLOUDSDK_PROXY_TYPE=http (was invalid "https") (#237)

* fix(sandbox): set CLOUDSDK_PROXY_TYPE=http (was invalid "https")

gcloud rejects CLOUDSDK_PROXY_TYPE=https with:
  Invalid value for property [proxy/type]: The proxy type property
  value [https] is not valid. Possible values: [http, http_no_tunnel,
  socks4, socks5].

The proxy/type setting names the protocol the proxy itself speaks, not
the traffic it tunnels. The sandbox proxy at httpProxyPort is an HTTP
CONNECT proxy (HTTPS_PROXY is already set to http://localhost:<port>
for the same reason), so "http" is the correct value.

Adds a unit test for generateProxyEnvVars covering this.

Fixes #151

* ci: revert bun to 1.3.1

The 1.3.13 bump exposed two new flakes (linux/x86-64 reset() bridge exit
delivery; linux/arm64 http.Server listen/address race in
configurable-proxy-ports). Reverting to 1.3.1 until those are addressed
upstream. The spawnAsync test changes from #243 remain — they are
correct on both versions.

.github/workflows/integration-tests.yml

@@ -40,7 +40,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.3.13
+          bun-version: 1.3.1
 
       - name: Install system dependencies (Linux)
         if: matrix.os == 'linux'

src/sandbox/sandbox-utils.ts

@@ -381,10 +381,13 @@ export function generateProxyEnvVars(
     // AWS CLI - uses standard HTTPS_PROXY (v2 supports it well)
     // AWS CLI v2 respects HTTPS_PROXY which we already set above
 
-    // Google Cloud SDK - has specific proxy settings
-    // Use HTTPS proxy to match other HTTP-based tools
+    // Google Cloud SDK - has specific proxy settings.
+    // proxy/type names the protocol the *proxy* speaks, not the traffic it
+    // tunnels. Our HTTP CONNECT proxy carries TLS to Google APIs, so the
+    // correct value is "http" (gcloud only accepts http, http_no_tunnel,
+    // socks4, socks5; "https" is rejected at startup).
     if (httpProxyPort) {
-      envVars.push(`CLOUDSDK_PROXY_TYPE=https`)
+      envVars.push(`CLOUDSDK_PROXY_TYPE=http`)
       envVars.push(`CLOUDSDK_PROXY_ADDRESS=localhost`)
       envVars.push(`CLOUDSDK_PROXY_PORT=${httpProxyPort}`)
     }

test/sandbox/proxy-env-vars.test.ts

@@ -0,0 +1,22 @@
+import { describe, it, expect } from 'bun:test'
+import { generateProxyEnvVars } from '../../src/sandbox/sandbox-utils.js'
+
+describe('generateProxyEnvVars', () => {
+  it('sets CLOUDSDK_PROXY_TYPE to http (gcloud rejects "https")', () => {
+    // gcloud's proxy/type only accepts http, http_no_tunnel, socks4, socks5.
+    // Our local proxy is an HTTP CONNECT proxy regardless of the traffic it
+    // tunnels, so the value must be "http" — see issue #151.
+    const env = generateProxyEnvVars(3128, 1080)
+
+    expect(env).toContain('CLOUDSDK_PROXY_TYPE=http')
+    expect(env).toContain('CLOUDSDK_PROXY_ADDRESS=localhost')
+    expect(env).toContain('CLOUDSDK_PROXY_PORT=3128')
+    expect(env).not.toContain('CLOUDSDK_PROXY_TYPE=https')
+  })
+
+  it('omits CLOUDSDK_PROXY_* when no HTTP proxy port is configured', () => {
+    const env = generateProxyEnvVars(undefined, 1080)
+
+    expect(env.some(v => v.startsWith('CLOUDSDK_PROXY_'))).toBe(false)
+  })
+})