feat: add HTTP CONNECT proxy support (HTTPS_PROXY)

[mjdaly]

Summary

• Adds ProxyChannel subclass of grpclib.client.Channel that tunnels gRPC connections through an HTTP CONNECT proxy
• Adds grpc_proxy config setting (MODAL_GRPC_PROXY env var) with fallback to standard HTTPS_PROXY / https_proxy environment variables
• Only applies to HTTPS connections; HTTP and Unix socket connections bypass the proxy

Motivation

Modal's Python client uses grpclib (pure-Python async gRPC) which calls asyncio.loop.create_connection() directly — with zero HTTP proxy support. Users behind corporate proxies or firewalls cannot connect to api.modal.com:443.

Approach

grpclib's Channel has no custom connection factory parameter. ProxyChannel overrides _create_connection() to:

1. Open raw TCP to the proxy
2. Send HTTP CONNECT handshake (with optional Basic auth)
3. Validate 200 response
4. Pass the tunneled socket to loop.create_connection(ssl=..., sock=...) for TLS + H2

Configuration priority

MODAL_GRPC_PROXY > TOML grpc_proxy > HTTPS_PROXY > https_proxy > None

Files changed

File	Change
modal/config.py	Added grpc_proxy setting + HTTPS_PROXY env var fallback + docstring
modal/_utils/grpc_utils.py	Added ProxyChannel class, modified create_channel() to use it
test/proxy_channel_test.py	15 tests covering config priority, channel routing, CONNECT handshake, auth, error handling

Test plan

• Config priority: MODAL_GRPC_PROXY > HTTPS_PROXY > https_proxy > None (4 tests)
• Channel routing: ProxyChannel for https+proxy, standard Channel for http/unix/no-proxy (4 tests)
• ProxyChannel construction: URL parsing, auth encoding, default port (3 tests)
• CONNECT handshake: correct request format, auth header, 407 rejection, connection closed (4 tests)
• Existing config tests pass (no regression)

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Touches connection setup for all HTTPS gRPC calls and relies on grpclib private attributes, so regressions could impact client connectivity in proxied and non-proxied environments.

Overview
Adds HTTP CONNECT proxy support for HTTPS gRPC by introducing ProxyChannel and routing create_channel() through it when grpc_proxy/proxy env vars are set, while honoring NO_PROXY (including IPv6 and port-specific matching) and performing basic validation to avoid CONNECT header injection.

Introduces a new grpc_proxy configuration option (MODAL_GRPC_PROXY) with fallback to HTTPS_PROXY/https_proxy, redacts proxy credentials in modal config show, and adds a comprehensive test suite covering config precedence, proxy bypass rules, CONNECT handshake behavior, and edge cases.

^{Written by Cursor Bugbot for commit 7b27b2d. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}