fix(desktop): proxy ACP binary downloads

Pass the desktop proxy-aware reqwest client into binary archive downloads and support SOCKS-only macOS system proxy configurations.

Co-authored-by: Codex (GPT 5.5) <codex@openai.com>

Author: phodal

apps/desktop/src-tauri/Cargo.toml

@@ -37,7 +37,7 @@ routa-server = { path = "../../../crates/routa-server" }
 
 # Async runtime (needed for Tauri integration)
 tokio = { version = "1", features = ["full"] }
-reqwest = { version = "0.12", features = ["json"] }
+reqwest = { version = "0.12", features = ["json", "socks"] }
 
 [dev-dependencies]
 axum = "0.8.8"

apps/desktop/src-tauri/src/lib.rs

@@ -277,9 +277,10 @@ async fn install_acp_agent(
                 .get_binary_info(&platform)
                 .ok_or_else(|| format!("No binary available for platform: {platform}"))?;
 
+            let http_client = build_http_client()?;
             let exe_path = state
                 .binary_manager
-                .install_binary(&agent_id, &version, binary_info)
+                .install_binary_with_client(&http_client, &agent_id, &version, binary_info)
                 .await?;
 
             state

apps/desktop/src-tauri/src/system_proxy.rs

@@ -24,7 +24,7 @@ struct ProxySettings {
 }
 
 impl ProxySettings {
-    fn url(&self) -> Option<String> {
+    fn url(&self, scheme: &str) -> Option<String> {
         if !self.enabled {
             return None;
         }
@@ -36,14 +36,15 @@ impl ProxySettings {
         } else {
             host.to_string()
         };
-        Some(format!("http://{authority}:{port}"))
+        Some(format!("{scheme}://{authority}:{port}"))
     }
 }
 
-/// Parse the output of `scutil --proxy`, preferring HTTPS over HTTP settings.
+/// Parse `scutil --proxy`, preferring HTTPS, then HTTP, then SOCKS settings.
 fn parse_macos_system_proxy(output: &str) -> Option<String> {
     let mut https = ProxySettings::default();
     let mut http = ProxySettings::default();
+    let mut socks = ProxySettings::default();
 
     for line in output.lines() {
         let Some((key, value)) = line.trim().split_once(" : ") else {
@@ -58,11 +59,17 @@ fn parse_macos_system_proxy(output: &str) -> Option<String> {
             "HTTPEnable" => http.enabled = value == "1",
             "HTTPProxy" => http.host = Some(value.to_string()),
             "HTTPPort" => http.port = value.parse().ok(),
+            "SOCKSEnable" => socks.enabled = value == "1",
+            "SOCKSProxy" => socks.host = Some(value.to_string()),
+            "SOCKSPort" => socks.port = value.parse().ok(),
             _ => {}
         }
     }
 
-    https.url().or_else(|| http.url())
+    https
+        .url("http")
+        .or_else(|| http.url("http"))
+        .or_else(|| socks.url("socks5h"))
 }
 
 #[cfg(target_os = "macos")]
@@ -150,4 +157,21 @@ mod tests {
             Some("http://[::1]:6152".to_string())
         );
     }
+
+    #[test]
+    fn falls_back_to_enabled_socks_proxy() {
+        let output = r#"
+<dictionary> {
+  HTTPEnable : 0
+  HTTPSEnable : 0
+  SOCKSEnable : 1
+  SOCKSPort : 1080
+  SOCKSProxy : 127.0.0.1
+}
+"#;
+
+        let proxy_url = parse_macos_system_proxy(output).expect("parse SOCKS proxy");
+        assert_eq!(proxy_url, "socks5h://127.0.0.1:1080");
+        reqwest::Proxy::all(proxy_url).expect("SOCKS proxy feature is enabled");
+    }
 }

crates/routa-core/src/acp/binary_manager.rs

@@ -37,6 +37,22 @@ impl AcpBinaryManager {
         agent_id: &str,
         version: &str,
         binary_info: &BinaryInfo,
+    ) -> Result<PathBuf, String> {
+        let http_client = reqwest::Client::new();
+        self.install_binary_with_client(&http_client, agent_id, version, binary_info)
+            .await
+    }
+
+    /// Download and install a binary agent with a caller-provided HTTP client.
+    ///
+    /// Runtime adapters can use this to preserve transport concerns such as
+    /// system proxy configuration without coupling them into the core domain.
+    pub async fn install_binary_with_client(
+        &self,
+        http_client: &reqwest::Client,
+        agent_id: &str,
+        version: &str,
+        binary_info: &BinaryInfo,
     ) -> Result<PathBuf, String> {
         // Get or create a lock for this agent
         let lock = {
@@ -75,7 +91,7 @@ impl AcpBinaryManager {
 
         // Download the archive
         let archive_path = self
-            .download_archive(&binary_info.archive, &download_dir)
+            .download_archive_with_client(http_client, &binary_info.archive, &download_dir)
             .await?;
 
         // Extract the archive
@@ -103,10 +119,17 @@ impl AcpBinaryManager {
     }
 
     /// Download an archive from a URL.
-    async fn download_archive(&self, url: &str, download_dir: &Path) -> Result<PathBuf, String> {
+    async fn download_archive_with_client(
+        &self,
+        http_client: &reqwest::Client,
+        url: &str,
+        download_dir: &Path,
+    ) -> Result<PathBuf, String> {
         tracing::info!("[AcpBinaryManager] Downloading from {}", url);
 
-        let response = reqwest::get(url)
+        let response = http_client
+            .get(url)
+            .send()
             .await
             .map_err(|e| format!("Failed to download: {e}"))?;
 
@@ -331,3 +354,76 @@ impl AcpBinaryManager {
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use reqwest::header::{HeaderMap, HeaderValue};
+    use tokio::io::{AsyncReadExt, AsyncWriteExt};
+
+    use super::AcpBinaryManager;
+    use crate::acp::AcpPaths;
+
+    #[tokio::test]
+    async fn download_archive_uses_caller_provided_http_client() {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("bind test server");
+        let address = listener.local_addr().expect("read test server address");
+        let server = tokio::spawn(async move {
+            let (mut socket, _) = listener.accept().await.expect("accept request");
+            let mut request = Vec::new();
+            let mut chunk = [0; 1024];
+            while !request.windows(4).any(|bytes| bytes == b"\r\n\r\n") {
+                let read = socket.read(&mut chunk).await.expect("read request");
+                if read == 0 {
+                    break;
+                }
+                request.extend_from_slice(&chunk[..read]);
+            }
+            let request = String::from_utf8_lossy(&request);
+            let (status, body) = if request
+                .to_ascii_lowercase()
+                .contains("x-routa-test-client: configured")
+            {
+                ("200 OK", "binary")
+            } else {
+                ("403 Forbidden", "missing client header")
+            };
+            let response = format!(
+                "HTTP/1.1 {status}\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",
+                body.len()
+            );
+            socket
+                .write_all(response.as_bytes())
+                .await
+                .expect("write response");
+        });
+
+        let mut headers = HeaderMap::new();
+        headers.insert(
+            "x-routa-test-client",
+            HeaderValue::from_static("configured"),
+        );
+        let http_client = reqwest::Client::builder()
+            .default_headers(headers)
+            .build()
+            .expect("build configured client");
+        let temp_dir = tempfile::tempdir().expect("create download directory");
+        let manager = AcpBinaryManager::new(AcpPaths::new());
+
+        let archive = manager
+            .download_archive_with_client(
+                &http_client,
+                &format!("http://{address}/agent.bin"),
+                temp_dir.path(),
+            )
+            .await
+            .expect("download archive");
+
+        assert_eq!(
+            tokio::fs::read(archive).await.expect("read archive"),
+            b"binary"
+        );
+        server.await.expect("join test server");
+    }
+}