fix(app): don't connect to localhost through vpn

2 files changed, 36 insertions, 3 deletions

diff --git a/packages/desktop/src-tauri/src/lib.rs b/packages/desktop/src-tauri/src/lib.rs
index e086acd93..dab98f4a0 100644
--- a/packages/desktop/src-tauri/src/lib.rs
+++ b/packages/desktop/src-tauri/src/lib.rs
@@ -328,7 +328,15 @@ pub fn run() {
                 .hidden_title(true);
 
             #[cfg(windows)]
-            let window_builder = window_builder.decorations(false);
+            let window_builder = window_builder
+                // Some VPNs set a global/system proxy that WebView2 applies even for loopback
+                // connections, which breaks the app's localhost sidecar server.
+                // Note: when setting additional args, we must re-apply wry's default
+                // `--disable-features=...` flags.
+                .additional_browser_args(
+                    "--proxy-bypass-list=<-loopback> --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection",
+                )
+                .decorations(false);
 
             let window = window_builder.build().expect("Failed to create window");
 
@@ -525,4 +533,4 @@ async fn spawn_local_server(
             break Ok(child);
         }
     }
-}
\ No newline at end of file
+}
diff --git a/packages/desktop/src-tauri/src/main.rs b/packages/desktop/src-tauri/src/main.rs
index e3be4a44d..9ffee8aa5 100644
--- a/packages/desktop/src-tauri/src/main.rs
+++ b/packages/desktop/src-tauri/src/main.rs
@@ -52,7 +52,32 @@ fn configure_display_backend() -> Option<String> {
 }
 
 fn main() {
-    unsafe { std::env::set_var("NO_PROXY", "127.0.0.1,localhost,::1") };
+    // Ensure loopback connections are never sent through proxy settings.
+    // Some VPNs/proxies set HTTP_PROXY/HTTPS_PROXY/ALL_PROXY without excluding localhost.
+    const LOOPBACK: [&str; 3] = ["127.0.0.1", "localhost", "::1"];
+
+    let upsert = |key: &str| {
+        let mut items = std::env::var(key)
+            .unwrap_or_default()
+            .split(',')
+            .map(|v| v.trim())
+            .filter(|v| !v.is_empty())
+            .map(|v| v.to_string())
+            .collect::<Vec<_>>();
+
+        for host in LOOPBACK {
+            if items.iter().any(|v| v.eq_ignore_ascii_case(host)) {
+                continue;
+            }
+            items.push(host.to_string());
+        }
+
+        // Safety: called during startup before any threads are spawned.
+        unsafe { std::env::set_var(key, items.join(",")) };
+    };
+
+    upsert("NO_PROXY");
+    upsert("no_proxy");
 
     #[cfg(target_os = "linux")]
     {