fix(local proxy): route every Cursor-host request through the local backend so unmatched paths use the configured outbound proxy - #433
Open
rittachaos wants to merge 4 commits into
Conversation
added 4 commits
September 8, 2026 10:55
…ckend hudsucker's default pass-through dials the official Cursor upstream (api2.cursor.sh) directly, ignoring the configured outbound proxy. On networks with proxied-only egress each such dial hangs for ~75s, stalling skills/agent-store syncs and quantizing tool rounds to 75s multiples. Rewrite every Cursor-host request to the local backend so unmatched paths fall through to the router fallback proxy::forward, which honors the configured outbound proxy. Tab paths in explicit Direct mode keep their original pass-through.
…ev mode tauri-build sets cfg(dev) unless the tauri custom-protocol feature is enabled. Plain `cargo build --release` without it compiled the app in dev mode: console routed to the Vite dev server (frontend 502, blank window) and the harness never auto-enabled the hudsucker proxy. Official `tauri build` enables this feature implicitly; mirror it for local release builds.
hudsucker forwards every request, including CONNECT, through handle_request before should_intercept_connect decides on MITM. Because hyper's Uri::host() returns api2.cursor.sh for authority-form CONNECT URIs, the catch-all routing rewrite also rewrote CONNECTs to the local backend, so interception saw 127.0.0.1 and disabled TLS MITM for every Cursor-host connection (clients got plain-HTTP 400s / EPROTO instead of a TLS handshake). Skip CONNECT requests so interception keeps working; only post-MITM inner requests are routed locally.
Endpoints the official upstream deterministically rejects for accounts without the corresponding cloud features (legacy /agent/v1/run probe 404, agent-store/background-composer mints 400, tab file sync 404, ws-reachability 404) used to be forwarded upstream, re-producing the rejection over the network every time. On proxied-only egress networks that forwarding was also what used to hang ~75s. Answer these paths in CursorRelay with the same status Cursor already tolerates, so the request never leaves the machine and Cursor keeps its existing fallbacks (gRPC RunSSE after the /agent/v1/run probe, local agent stores after MintAgentStoreToken).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
问题
hudsucker 对未命中白名单的
*.cursor.sh请求(如 skills sync / agent-store-sync)会由 hyper Connector 直连官方上游 api2.cursor.sh,无视任何代理配置。在仅允许代理出网的网络上,每次直连都会挂死约 75s(macOS connect 超时),表现为工具 round 被量化成 75s 整数倍、exec 日志周期性出现 502 / deadline_exceeded。修复
server/src/local_app/proxy.rs— 把所有 Cursor-host 请求改写指向本地后端,白名单外的路径经 router fallbackproxy::forward转发(使用 DB 配置的 outbound proxy);仅保留 Tab Direct 模式的原始直连旁路。这样 hudsucker 不再产生任何对官方上游的直连。Uri::host()对 authority-form CONNECT URI 也返回 cursor 域名,若改写会把should_intercept_connect看到的 authority 变成 127.0.0.1,导致所有 Cursor-host 连接失去 TLS MITM。apps/desktop/src-tauri/Cargo.toml— 为 tauri 增加custom-protocolfeature:tauri-build 仅在未启用该 feature 时输出cfg(dev),裸cargo build --release会以 dev 模式编译(前端路由到 Vite 代理、代理不会自动启用)。tauri build隐含该 feature,此处仅为本地 release 构建对齐官方行为。验证(实测)
风险