From aa211209546b5f04ae72686488e5636b1ba17663 Mon Sep 17 00:00:00 2001
From: Codex <codex@noreply.local>
Date: Mon, 29 Jun 2026 08:18:52 +0000
Subject: [PATCH] fix: route sentinel source mirror through host proxy

---
 scripts/src/hwlab-node-web-sentinel-cicd.ts   | 31 ++++++++++++++++---
 .../src/hwlab-node-web-sentinel-p5-observe.ts |  1 +
 2 files changed, 27 insertions(+), 5 deletions(-)

diff --git a/scripts/src/hwlab-node-web-sentinel-cicd.ts b/scripts/src/hwlab-node-web-sentinel-cicd.ts
index 245d3175..026ff16d 100644
--- a/scripts/src/hwlab-node-web-sentinel-cicd.ts
+++ b/scripts/src/hwlab-node-web-sentinel-cicd.ts
@@ -1416,8 +1416,31 @@ function sentinelSourceMirrorSshSetupShellLines(state: SentinelCicdState): strin
   const serviceName = nonEmptyString(proxy.serviceName);
   const namespace = nonEmptyString(proxy.namespace);
   const port = typeof proxy.port === "number" && Number.isFinite(proxy.port) ? proxy.port : null;
+  const hostRouteProxyUrl = nonEmptyString(proxy.proxyUrl);
   const noProxy = Array.isArray(proxy.noProxy) ? proxy.noProxy.filter((item): item is string => typeof item === "string" && item.length > 0).join(",") : "";
-  const useProxy = serviceName !== null && namespace !== null && port !== null;
+  let proxyHost: string | null = null;
+  let proxyPort: number | null = null;
+  let proxyUrl: string | null = null;
+  if (serviceName !== null && namespace !== null && port !== null) {
+    proxyHost = `${serviceName}.${namespace}.svc.cluster.local`;
+    proxyPort = port;
+    proxyUrl = `http://${proxyHost}:${proxyPort}`;
+  } else if (hostRouteProxyUrl !== null) {
+    try {
+      const parsed = new URL(hostRouteProxyUrl);
+      const parsedPort = Number.parseInt(parsed.port || "80", 10);
+      if ((parsed.protocol === "http:" || parsed.protocol === "https:") && parsed.hostname.length > 0 && Number.isInteger(parsedPort)) {
+        proxyHost = parsed.hostname;
+        proxyPort = parsedPort;
+        proxyUrl = hostRouteProxyUrl;
+      }
+    } catch {
+      proxyHost = null;
+      proxyPort = null;
+      proxyUrl = null;
+    }
+  }
+  const useProxy = proxyHost !== null && proxyPort !== null && proxyUrl !== null;
   if (!useProxy) {
     return [
       "mkdir -p /root/.ssh",
@@ -1436,14 +1459,12 @@ function sentinelSourceMirrorSshSetupShellLines(state: SentinelCicdState): strin
       "unset GIT_SSH_COMMAND",
     ];
   }
-  const proxyHost = `${serviceName}.${namespace}.svc.cluster.local`;
-  const proxyUrl = `http://${proxyHost}:${port}`;
-  const proxyCommand = `ProxyCommand=node /tmp/sentinel-github-proxy-connect.cjs ${proxyHost} ${port} %h %p`;
+  const proxyCommand = `ProxyCommand=node /tmp/sentinel-github-proxy-connect.cjs ${proxyHost} ${proxyPort} %h %p`;
   return [
     "mkdir -p /root/.ssh",
     "cp /git-ssh/ssh-privatekey /root/.ssh/id_rsa",
     "chmod 0400 /root/.ssh/id_rsa",
-    `printf '%s\\n' ${shellQuote(`sentinel source-mirror-egress-proxy host=${proxyHost} port=${port} transport=ssh ssh=GIT_SSH-wrapper source=yaml`)} >&2`,
+    `printf '%s\\n' ${shellQuote(`sentinel source-mirror-egress-proxy host=${proxyHost} port=${proxyPort} transport=ssh ssh=GIT_SSH-wrapper source=yaml`)} >&2`,
     `export HTTP_PROXY=${shellQuote(proxyUrl)}`,
     `export HTTPS_PROXY=${shellQuote(proxyUrl)}`,
     `export ALL_PROXY=${shellQuote(proxyUrl)}`,
diff --git a/scripts/src/hwlab-node-web-sentinel-p5-observe.ts b/scripts/src/hwlab-node-web-sentinel-p5-observe.ts
index 3068a615..8b976453 100644
--- a/scripts/src/hwlab-node-web-sentinel-p5-observe.ts
+++ b/scripts/src/hwlab-node-web-sentinel-p5-observe.ts
@@ -21,6 +21,7 @@ import {
   record,
   recordTarget,
   secretSourcePaths,
+  sentinelCliSuffix,
   shellQuote,
   short,
   stringAt,