fix: propagate sandbox proxy environment aliases

Centralize sandbox subprocess environment setup and include lowercase all_proxy/no_proxy aliases alongside uppercase proxy aliases and CA bundle variables.

RED->GREEN: tests/test_session_entries.py failed before build_sandbox_environment existed; now 5 passed. Full suite: 181 passed, 2 warnings.

strix/runtime/session_manager.py

@@ -26,6 +26,11 @@ logger = logging.getLogger(__name__)
 
 # In-container Caido sidecar port (matches the image's caido-cli bind).
 _CONTAINER_CAIDO_PORT = 48080
+_CONTAINER_CAIDO_SCHEME = "http"
+_CONTAINER_CAIDO_HOST = "127.0.0.1"
+_HOST_GATEWAY_NAME = "host.docker.internal"
+_NO_PROXY_VALUE = "localhost,127.0.0.1"
+_CA_BUNDLE_PATH = "/etc/ssl/certs/ca-certificates.crt"
 
 
 _SESSION_CACHE: dict[str, dict[str, Any]] = {}
@@ -35,6 +40,28 @@ _WORKSPACE_ROOT = "/workspace"
 
 _PROTECTED_METADATA_NAMES = (".git", ".agents", ".codex")
 
+def _container_caido_url() -> str:
+    return f"{_CONTAINER_CAIDO_SCHEME}://{_CONTAINER_CAIDO_HOST}:{_CONTAINER_CAIDO_PORT}"
+
+
+def build_sandbox_environment() -> dict[str, str]:
+    """Return environment variables inherited by sandbox subprocesses."""
+    container_caido_url = _container_caido_url()
+    return {
+        "PYTHONUNBUFFERED": "1",
+        "HOST_GATEWAY": _HOST_GATEWAY_NAME,
+        "http_proxy": container_caido_url,
+        "https_proxy": container_caido_url,
+        "HTTP_PROXY": container_caido_url,
+        "HTTPS_PROXY": container_caido_url,
+        "ALL_PROXY": container_caido_url,
+        "all_proxy": container_caido_url,
+        "NO_PROXY": _NO_PROXY_VALUE,
+        "no_proxy": _NO_PROXY_VALUE,
+        "REQUESTS_CA_BUNDLE": _CA_BUNDLE_PATH,
+        "SSL_CERT_FILE": _CA_BUNDLE_PATH,
+    }
+
 
 def _host_identity_env() -> dict[str, str]:
     # Read the platform through a local so it is not narrowed to whichever OS is
@@ -297,20 +324,10 @@ async def create_or_reuse(
     # picks up these env vars automatically. ``NO_PROXY`` keeps the
     # agent-browser CDP daemon's localhost traffic from looping back
     # through Caido.
-    container_caido_url = f"http://127.0.0.1:{_CONTAINER_CAIDO_PORT}"
+    container_caido_url = _container_caido_url()
     manifest = Manifest(
         entries=entries,
-        environment=Environment(
-            value={
-                "PYTHONUNBUFFERED": "1",
-                "HOST_GATEWAY": "host.docker.internal",
-                **_host_identity_env(),
-                "http_proxy": container_caido_url,
-                "https_proxy": container_caido_url,
-                "ALL_PROXY": container_caido_url,
-                "NO_PROXY": "localhost,127.0.0.1",
-            },
-        ),
+        environment=Environment(value={**build_sandbox_environment(), **_host_identity_env()}),
     )
 
     logger.info(

tests/test_session_entries.py

@@ -18,9 +18,15 @@ from strix.runtime.session_manager import (
     build_extra_file_bind_mounts,
     build_extra_file_entries,
     build_manifest_entries,
+    build_sandbox_environment,
 )
 
 
+EXPECTED_CAIDO_URL = "http://127.0.0.1:48080"
+EXPECTED_CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt"
+EXPECTED_NO_PROXY = "localhost,127.0.0.1"
+
+
 def _source(subdir: str, path: str, *, protect_metadata: bool = False) -> dict[str, Any]:
     return {"source_path": path, "workspace_subdir": subdir, "protect_metadata": protect_metadata}
 
@@ -334,3 +340,18 @@ def test_only_bind_mount_capable_backends_are_registered_as_such() -> None:
     finally:
         _BACKENDS.pop("e2b", None)
         _BIND_MOUNT_BACKENDS.discard("e2b")
+
+
+def test_sandbox_environment_exports_proxy_and_ca_aliases() -> None:
+    env = build_sandbox_environment()
+
+    assert env["http_proxy"] == EXPECTED_CAIDO_URL
+    assert env["https_proxy"] == EXPECTED_CAIDO_URL
+    assert env["HTTP_PROXY"] == EXPECTED_CAIDO_URL
+    assert env["HTTPS_PROXY"] == EXPECTED_CAIDO_URL
+    assert env["ALL_PROXY"] == EXPECTED_CAIDO_URL
+    assert env["all_proxy"] == EXPECTED_CAIDO_URL
+    assert env["NO_PROXY"] == EXPECTED_NO_PROXY
+    assert env["no_proxy"] == EXPECTED_NO_PROXY
+    assert env["REQUESTS_CA_BUNDLE"] == EXPECTED_CA_BUNDLE
+    assert env["SSL_CERT_FILE"] == EXPECTED_CA_BUNDLE