send agent traffic through squid once its hive announces it

hive-priv/src/container_config.rs

@@ -409,6 +409,20 @@ fn render_hive_facts(facts: &HiveFacts) -> Result<String> {
             253,
             &|b: u8| dns(b) || matches!(b, b':' | b'/'),
         ),
+        // `<ipv4>:<port>`.
+        (
+            "HIVE_SQUID_PROXY",
+            facts.squid_proxy.as_ref(),
+            21,
+            &|b: u8| b.is_ascii_digit() || matches!(b, b'.' | b':'),
+        ),
+        // `host,host`: bare names and addresses.
+        (
+            "HIVE_EGRESS_NO_PROXY",
+            facts.egress_no_proxy.as_ref(),
+            4096,
+            &|b: u8| dns(b) || b == b',',
+        ),
     ] {
         let Some(value) = value else { continue };
         if value.is_empty() || value.len() > max_len || !value.bytes().all(allowed) {
@@ -803,6 +817,59 @@ mod tests {
         );
     }
 
+    /// The egress facts: the proxy as `<ip>:<port>`, and the hosts that skip it.
+    #[test]
+    fn hive_facts_render_the_egress_proxy() {
+        let facts = HiveFacts {
+            squid_proxy: Some("10.42.0.1:3128".to_owned()),
+            egress_no_proxy: Some("10.42.0.1,pr1ma.example.test,forge.example.test".to_owned()),
+            ..HiveFacts::default()
+        };
+        assert_eq!(
+            render_hive_facts(&facts).unwrap(),
+            "HIVE_SQUID_PROXY=10.42.0.1:3128\n\
+             HIVE_EGRESS_NO_PROXY=10.42.0.1,pr1ma.example.test,forge.example.test\n"
+        );
+    }
+
+    /// Neither egress fact may carry a second assignment, a space, a quote or a
+    /// URL: the agent builds its proxy URL and `NO_PROXY` from them.
+    #[test]
+    fn hive_facts_refuse_bad_egress_values() {
+        for bad in [
+            "",
+            "10.42.0.1:3128\nHIVE_AGENT_NATS_URL=x",
+            "http://10.42.0.1:3128",
+            "10.42.0.1:3128 ",
+            "u:p@10.42.0.1:3128",
+        ] {
+            let facts = HiveFacts {
+                squid_proxy: Some(bad.to_owned()),
+                ..HiveFacts::default()
+            };
+            assert!(
+                render_hive_facts(&facts).is_err(),
+                "{bad:?} must be refused"
+            );
+        }
+        for bad in [
+            "",
+            "a.test,b.test\nPATH=/x",
+            "a.test b.test",
+            "\"a.test\"",
+            "$(x)",
+        ] {
+            let facts = HiveFacts {
+                egress_no_proxy: Some(bad.to_owned()),
+                ..HiveFacts::default()
+            };
+            assert!(
+                render_hive_facts(&facts).is_err(),
+                "{bad:?} must be refused"
+            );
+        }
+    }
+
     /// The claude path is a top-level store path or nothing, and neither
     /// value may carry generator syntax.
     #[test]