[hsdfat]

Closes #746 (the remaining User-Agent part).

What changed

• RuntimeEnvContext.HttpClient returns a client whose transport sets vfox/<version> on every request that carries no User-Agent of its own. All of vfox's own requests already go through this client, so this covers the registry index, the registry and manifestUrl manifests, the plugin downloads, and vfox upgrade, without touching each call site.
• Sdk.Download sets the agent of the plugin's own requests (vfox/<version> vfox-<plugin>/<plugin version>) when the headers from PreInstall carry none. The check goes through http.Header, so a user-agent in any case from PreInstall still wins.
• The string is built by one helper, util.UserAgent. luai.ComputeUserAgent now calls it, because internal/env may not import internal/plugin.

Before, HttpClient returned http.DefaultClient when no proxy is set. It now returns a new client over http.DefaultTransport, so the connection pool is the same and the shared default client is not modified.

Not changed: util.Downloader.Download, which uses http.DefaultClient and which nothing calls.

Tests

• TestHttpClient_SendsVfoxUserAgent (internal/env) and TestSdk_Download_UserAgent (internal/sdk) fail on main with server saw User-Agent "Go-http-client/1.1" and pass with the change.
• TestUserAgent and TestWithDefaultUserAgent (internal/shared/util) cover the helper, including that the caller's request is not modified.
• go test ./... passes except internal/shared/printer, where TestSelect_Show times out on my machine without a terminal; it does the same on main.
• go vet ./... passes, and GOOS=windows go vet on the three packages I touched. I did not run the tests on Windows.

@ManasBhole asked about this part on 2026-11-05. I did not find a branch or a pull request for it, so I went ahead; if you have work in progress, say so and I will step back.

[codecov]

Codecov Report

❌ Patch coverage is 81.48148% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 56.62%. Comparing base (1635ffd) to head (802984d).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/manager.go	45.45%	3 Missing and 3 partials ⚠️
cmd/commands/upgrade.go	0.00%	3 Missing ⚠️
internal/plugin/luai/context.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #757      +/-   ##
==========================================
+ Coverage   56.26%   56.62%   +0.36%     
==========================================
  Files         115      116       +1     
  Lines        8574     8595      +21     
==========================================
+ Hits         4824     4867      +43     
+ Misses       3287     3263      -24     
- Partials      463      465       +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[linghengqian]

The approach looks right to me. CI is green, and the new tests fail on main with Go-http-client/1.1 and pass here.

Please address these before merging:

1. Run gofmt -w internal/env/context_test.go. The file was already unformatted before this PR, and the differences are all in existing test code (lines 36 to 163), none in your new lines. AGENTS.md asks for gofmt -w on changed Go files.

2. In TestWithDefaultUserAgent (internal/shared/util/useragent_test.go:78), one resp.Body.Read into a 64-byte buffer does not guarantee the whole body, and the error is ignored. io.ReadAll would match TestHttpClient_SendsVfoxUserAgent and avoid the flake.

3. Add a test for the proxy branch of HttpClient(). Codecov reports those lines as uncovered. A local check shows that with Proxy.Enable set, the request goes through the proxy and the proxy receives User-Agent: vfox/1.0.13. Please make that a test next to TestHttpClient_SendsVfoxUserAgent: start an httptest server as the proxy, set Proxy: &config.Proxy{Enable: true, Url: proxy.URL}, request an http:// URL on a host that never has to resolve (the request stops at the proxy), and assert the request line and the header the proxy receives.

4. Fix the nil return in HttpClient() in this PR. It returns nil when proxy.url does not parse (internal/env/context.go:84), and all five callers use the result directly: manager.go lines 389, 451 and 670, sdk.go in Download, and upgrade.go line 139. A malformed proxy URL in config.yaml therefore makes the next network request panic. The bug predates this PR, but this PR rewrites the function and keeps the nil return. Please fix it here rather than in a follow-up.

   Suggested change:

   • Make HttpClient() return (*http.Client, error).
   • Wrap the parse error with util.RedactError, for example return nil, fmt.Errorf("invalid proxy url: %w", util.RedactError(err)). url.Parse errors contain the URL, which can carry a password, and AGENTS.md requires this redaction for url.Parse errors.
   • Propagate the error at each of the five call sites, and update TestHttpClient_SendsVfoxUserAgent for the new signature.
   • Add TestHttpClient_InvalidProxyURL in internal/env. It should check that an error comes back and that the error does not contain the password.
   • Add TestSdk_Download_InvalidProxyURL in internal/sdk. It should check that Download returns an error instead of panicking. On this branch that test panics with a nil pointer dereference, so it also serves as the failing regression test AGENTS.md asks for before a fix.

[hsdfat]

Thanks for the review. All four are in 802984d:

1. Ran gofmt -w internal/env/context_test.go.
2. TestWithDefaultUserAgent now reads the body with io.ReadAll and checks the error.
3. Added TestHttpClient_SendsVfoxUserAgentThroughProxy: an httptest server acts as the proxy, the request goes to http://vfox.invalid/index.json, and the test checks the request URI and the User-Agent the proxy receives.
4. HttpClient() now returns (*http.Client, error). The parse error is wrapped as invalid proxy url: %w with util.RedactError, and the five callers return it. Added TestHttpClient_InvalidProxyURL (error returned, no password in it) and TestSdk_Download_InvalidProxyURL, which panics with a nil pointer dereference without the fix.

I ran go build ./... and the tests of internal/env, internal/sdk, internal/shared/util, internal and cmd/....

[linghengqian]

LGTM