Fix bedrock DNS resolution when behind a corporate proxy

.changeset/itchy-moles-thank.md

@@ -0,0 +1,5 @@
+---
+"zoo-code": patch
+---
+
+Fix bedrock DNS resolution when behind corporate proxy

src/api/providers/__tests__/bedrock.spec.ts

@@ -18,6 +18,22 @@ vi.mock("@aws-sdk/credential-providers", () => {
 	return { fromIni: mockFromIni }
 })
 
+vi.mock("../../../utils/networkProxy", () => ({
+	getSystemProxyUrl: vi.fn().mockReturnValue(undefined),
+}))
+
+vi.mock("@smithy/node-http-handler", () => ({
+	NodeHttpHandler: vi.fn(),
+}))
+
+vi.mock("http-proxy-agent", () => ({
+	HttpProxyAgent: vi.fn(),
+}))
+
+vi.mock("https-proxy-agent", () => ({
+	HttpsProxyAgent: vi.fn(),
+}))
+
 // Mock BedrockRuntimeClient and ConverseStreamCommand
 vi.mock("@aws-sdk/client-bedrock-runtime", () => {
 	const mockSend = vi.fn().mockResolvedValue({
@@ -46,10 +62,18 @@ import {
 } from "@roo-code/types"
 
 import type { Anthropic } from "@anthropic-ai/sdk"
+import { getSystemProxyUrl } from "../../../utils/networkProxy"
+import { NodeHttpHandler } from "@smithy/node-http-handler"
+import { HttpProxyAgent } from "http-proxy-agent"
+import { HttpsProxyAgent } from "https-proxy-agent"
 
 // Get access to the mocked functions
 const mockConverseStreamCommand = vi.mocked(ConverseStreamCommand)
 const mockBedrockRuntimeClient = vi.mocked(BedrockRuntimeClient)
+const mockGetSystemProxyUrl = vi.mocked(getSystemProxyUrl)
+const mockNodeHttpHandler = vi.mocked(NodeHttpHandler)
+const mockHttpProxyAgent = vi.mocked(HttpProxyAgent)
+const mockHttpsProxyAgent = vi.mocked(HttpsProxyAgent)
 
 describe("AwsBedrockHandler", () => {
 	let handler: AwsBedrockHandler
@@ -118,6 +142,95 @@ describe("AwsBedrockHandler", () => {
 		})
 	})
 
+	describe("proxy configuration", () => {
+		afterEach(() => {
+			mockGetSystemProxyUrl.mockReturnValue(undefined)
+		})
+
+		it("should configure NodeHttpHandler with HttpProxyAgent and HttpsProxyAgent when proxy URL is set", () => {
+			mockGetSystemProxyUrl.mockReturnValue("http://proxy.corp.local:3128")
+
+			new AwsBedrockHandler({
+				apiModelId: "anthropic.claude-3-5-sonnet-20241022-v2:0",
+				awsAccessKey: "test-access-key",
+				awsSecretKey: "test-secret-key",
+				awsRegion: "us-east-1",
+			})
+
+			// Verify both proxy agents were created with the correct URL
+			expect(mockHttpProxyAgent).toHaveBeenCalledWith("http://proxy.corp.local:3128")
+			expect(mockHttpsProxyAgent).toHaveBeenCalledWith("http://proxy.corp.local:3128")
+
+			// Verify NodeHttpHandler was created with both agents
+			expect(mockNodeHttpHandler).toHaveBeenCalledWith(
+				expect.objectContaining({
+					httpAgent: expect.anything(),
+					httpsAgent: expect.anything(),
+					requestTimeout: 0,
+				}),
+			)
+
+			// Verify requestHandler was set on BedrockRuntimeClient config
+			expect(mockBedrockRuntimeClient).toHaveBeenLastCalledWith(
+				expect.objectContaining({ requestHandler: expect.anything() }),
+			)
+		})
+
+		it("should not create a proxy requestHandler when no proxy is configured", () => {
+			new AwsBedrockHandler({
+				apiModelId: "anthropic.claude-3-5-sonnet-20241022-v2:0",
+				awsAccessKey: "test-access-key",
+				awsSecretKey: "test-secret-key",
+				awsRegion: "us-east-1",
+			})
+
+			expect(mockNodeHttpHandler).not.toHaveBeenCalled()
+			expect(mockBedrockRuntimeClient.mock.lastCall?.[0]?.requestHandler).toBeUndefined()
+		})
+
+		it("should apply proxy for API key authentication", () => {
+			mockGetSystemProxyUrl.mockReturnValue("http://proxy.corp.local:3128")
+
+			new AwsBedrockHandler({
+				apiModelId: "anthropic.claude-3-5-sonnet-20241022-v2:0",
+				awsUseApiKey: true,
+				awsApiKey: "test-api-key",
+				awsRegion: "us-east-1",
+			})
+
+			expect(mockNodeHttpHandler).toHaveBeenCalledWith(
+				expect.objectContaining({
+					httpsAgent: expect.anything(),
+					requestTimeout: 0,
+				}),
+			)
+		})
+
+		it("should pass a custom endpoint to getSystemProxyUrl for NO_PROXY matching", () => {
+			new AwsBedrockHandler({
+				apiModelId: "anthropic.claude-3-5-sonnet-20241022-v2:0",
+				awsAccessKey: "test-access-key",
+				awsSecretKey: "test-secret-key",
+				awsRegion: "us-east-1",
+				awsBedrockEndpoint: "https://bedrock.vpce.internal",
+				awsBedrockEndpointEnabled: true,
+			})
+
+			expect(mockGetSystemProxyUrl).toHaveBeenCalledWith("https://bedrock.vpce.internal")
+		})
+
+		it("should pass undefined to getSystemProxyUrl when no custom endpoint is set", () => {
+			new AwsBedrockHandler({
+				apiModelId: "anthropic.claude-3-5-sonnet-20241022-v2:0",
+				awsAccessKey: "test-access-key",
+				awsSecretKey: "test-secret-key",
+				awsRegion: "us-east-1",
+			})
+
+			expect(mockGetSystemProxyUrl).toHaveBeenCalledWith(undefined)
+		})
+	})
+
 	describe("region mapping and cross-region inference", () => {
 		describe("getPrefixForRegion", () => {
 			it("should return correct prefix for US regions", () => {

src/api/providers/bedrock.ts

@@ -10,9 +10,12 @@ import {
 	ToolConfiguration,
 	ToolChoice,
 } from "@aws-sdk/client-bedrock-runtime"
+import { NodeHttpHandler } from "@smithy/node-http-handler"
 import OpenAI from "openai"
 import { fromIni } from "@aws-sdk/credential-providers"
 import { Anthropic } from "@anthropic-ai/sdk"
+import { HttpProxyAgent } from "http-proxy-agent"
+import { HttpsProxyAgent } from "https-proxy-agent"
 
 import {
 	type ModelInfo,
@@ -44,6 +47,7 @@ import { convertToBedrockConverseMessages as sharedConverter } from "../transfor
 import { getModelParams } from "../transform/model-params"
 import { shouldUseReasoningBudget } from "../../shared/api"
 import { normalizeToolSchema } from "../../utils/json-schema"
+import { getSystemProxyUrl } from "../../utils/networkProxy"
 import type { SingleCompletionHandler, ApiHandlerCreateMessageMetadata, CompletePromptOptions } from "../index"
 
 /************************************************************************************
@@ -294,6 +298,25 @@ export class AwsBedrockHandler extends BaseProvider implements SingleCompletionH
 			}
 		}
 
+		// When a corporate proxy is configured, Node resolves DNS locally before tunneling,
+		// causing ENOTFOUND for endpoints that only the proxy can reach. HttpProxyAgent and
+		// HttpsProxyAgent use CONNECT tunneling so the proxy handles DNS resolution instead.
+		//
+		// A custom endpoint (e.g. a VPC endpoint) is passed so NO_PROXY can bypass the proxy
+		// for directly-reachable hosts. For the default managed endpoint we don't reconstruct
+		// the hostname (the AWS SDK resolves it internally, and it varies by partition), so the
+		// proxy always applies there.
+		const proxyUrl = getSystemProxyUrl(
+			typeof clientConfig.endpoint === "string" ? clientConfig.endpoint : undefined,
+		)
+		if (proxyUrl) {
+			clientConfig.requestHandler = new NodeHttpHandler({
+				httpAgent: new HttpProxyAgent(proxyUrl),
+				httpsAgent: new HttpsProxyAgent(proxyUrl),
+				requestTimeout: 0,
+			})
+		}
+
 		this.client = new BedrockRuntimeClient(clientConfig)
 	}
 

src/package.json

@@ -461,6 +461,7 @@
 		"@anthropic-ai/vertex-sdk": "^0.19.0",
 		"@aws-sdk/client-bedrock-runtime": "^3.922.0",
 		"@aws-sdk/credential-providers": "^3.922.0",
+		"@smithy/node-http-handler": "^4.0.0",
 		"@google/genai": "^1.29.1",
 		"@lmstudio/sdk": "^1.1.1",
 		"@mistralai/mistralai": "^1.9.18",
@@ -486,6 +487,8 @@
 		"get-folder-size": "^5.0.0",
 		"global-agent": "^3.0.0",
 		"google-auth-library": "^10.2.0",
+		"http-proxy-agent": "^7.0.0",
+		"https-proxy-agent": "^7.0.0",
 		"gray-matter": "^4.0.3",
 		"i18next": "^25.0.0",
 		"ignore": "^7.0.3",