xxoingr 8c42340ea4 test(netclient): pin the stream dialer's proxy boundary ...

NewStreamDialer is how SSH reaches a remote host under the user's proxy
(remote/attach), and none of dialer.go was exercised: netclient sat at
47% against a 47.2% floor on a declared-sensitive path.

Four tests drive it against fake proxies on loopback:
- an http proxy gets CONNECT to the target with Proxy-Authorization, and
  the credentials never also travel as Authorization;
- a proxy that answers 407 yields an error, not an open stream;
- an https proxy sees a TLS handshake first, so CONNECT and credentials
  never cross in cleartext;
- a SOCKS5 proxy gets username/password auth and the target by name.

Each fails when the matching guard in dialer.go is removed. The
netclient floor rises from 47.2 to 65.8.

2026-10-25 23:54:17 +08:00

..

baseline.json

test(netclient): pin the stream dialer's proxy boundary

2026-10-25 23:54:17 +08:00

main_test.go

refactor: the kernel's packages live in the layer they belong to

2026-09-23 18:28:21 -07:00

main.go

refactor: the kernel's packages live in the layer they belong to

2026-09-23 18:28:21 -07:00