fix(menubar): support installer HTTP proxies

[sleicht]

Summary

Add proxy-aware downloads to the menubar installer so corporate networks can install the macOS menubar app through standard proxy environment variables.

Context

codeburn menubar downloads release metadata, the app zip, and checksum from GitHub. Company networks may block direct GitHub access and require traffic through an HTTP proxy.

Closes #473

Changes

• Route menubar installer network calls through an Undici ProxyAgent when proxy env vars are set.
• Honour HTTPS_PROXY / https_proxy for HTTPS requests, falling back to HTTP_PROXY / http_proxy.
• Honour NO_PROXY / no_proxy for host and domain bypass.
• Add tests for proxy selection and NO_PROXY bypass.

Key Implementation Details

The PR uses undici@^7.27.2 rather than v8 because the project supports Node >=22.13.0 and Undici v8 requires Node >=22.19.0.

Testing

npm test -- run tests/menubar-installer.test.ts
npx tsc --noEmit

Both commands passed locally on the clean PR branch.

npm run build remains blocked in this environment by network failure in scripts/bundle-litellm.mjs before compilation.

[iamtoruk]

Thanks for this, proxy support is genuinely useful and the implementation is clean. The env var precedence and the NO_PROXY matching look right, and using a per-request dispatcher instead of setGlobalDispatcher is the right call.

One thing to sort before merge: the package-lock entry for undici resolved to a private registry rather than the public npm one:

"resolved": "https://artifactory.gcp.sanet17.ch/artifactory/api/npm/sanitas-npm/undici/-/undici-7.27.2.tgz"

Looks like npm picked that up from your company proxy during install. It would break npm ci for anyone who cannot reach that host (CI, other contributors), and it leaks your internal registry URL into the repo. The integrity hash matches the real public undici@7.27.2, so the package itself is fine, it just needs to resolve from registry.npmjs.org.

Could you regenerate the lockfile against the public registry and recommit? Roughly:

npm install --registry=https://registry.npmjs.org/

Minor and not blocking: a quick codeburn menubar run on a normal network would be good to confirm the switch to undici's fetch did not change the non-proxy download path, since the tests cover proxy resolution but not the actual download.

Thanks again for the contribution.

[sleicht]

Thank you for the review, @iamtoruk. I fixed the lock file and rebased onto main.