Release 3.8.2.3: cheaper poll I/O, batched macOS sysproxy, no Connect Clone.

Trust corebin cache without Stat; batch networksetup; ActiveProxyURI instead of Config.Clone.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/sysproxy/darwin.go

@@ -13,12 +13,12 @@ import (
 )
 
 type darwinController struct {
-	mu      sync.Mutex
-	enabled bool
-	host    string
-	httpPort string
+	mu        sync.Mutex
+	enabled   bool
+	host      string
+	httpPort  string
 	socksPort string
-	services []string
+	services  []string
 }
 
 func newPlatform() Controller { return &darwinController{} }
@@ -47,32 +47,25 @@ func (c *darwinController) Enable(httpHostPort string) error {
 		return fmt.Errorf("sysproxy: no network services")
 	}
 
+	// One bash process for all networksetup calls (was 6 execs × N services).
+	// setwebproxy / setsecurewebproxy / setsocksfirewallproxy also turn the proxy on.
+	var b strings.Builder
+	b.WriteString("set -e\n")
 	for _, svc := range services {
-		if err := runNetworkSetup("-setwebproxy", svc, host, port); err != nil {
-			return err
-		}
-		if err := runNetworkSetup("-setsecurewebproxy", svc, host, port); err != nil {
-			return err
-		}
-		if err := runNetworkSetup("-setsocksfirewallproxy", svc, host, socks); err != nil {
-			return err
-		}
-		if err := runNetworkSetup("-setwebproxystate", svc, "on"); err != nil {
-			return err
-		}
-		if err := runNetworkSetup("-setsecurewebproxystate", svc, "on"); err != nil {
-			return err
-		}
-		if err := runNetworkSetup("-setsocksfirewallproxystate", svc, "on"); err != nil {
-			return err
-		}
+		q := shellQuote(svc)
+		fmt.Fprintf(&b, "networksetup -setwebproxy %s %s %s\n", q, shellQuote(host), shellQuote(port))
+		fmt.Fprintf(&b, "networksetup -setsecurewebproxy %s %s %s\n", q, shellQuote(host), shellQuote(port))
+		fmt.Fprintf(&b, "networksetup -setsocksfirewallproxy %s %s %s\n", q, shellQuote(host), shellQuote(socks))
+	}
+	if err := runBash(b.String()); err != nil {
+		return err
 	}
 
 	c.enabled = true
 	c.host = host
 	c.httpPort = port
 	c.socksPort = socks
-	c.services = services
+	c.services = append([]string(nil), services...)
 	return nil
 }
 
@@ -88,7 +81,8 @@ func (c *darwinController) Disable() error {
 func (c *darwinController) ForceDisable() error {
 	c.mu.Lock()
 	defer c.mu.Unlock()
-	return c.disableServices(nil)
+	svcs := c.services
+	return c.disableServices(svcs)
 }
 
 func (c *darwinController) disableServices(services []string) error {
@@ -99,21 +93,23 @@ func (c *darwinController) disableServices(services []string) error {
 			return err
 		}
 	}
-	var first error
-	for _, svc := range services {
-		for _, args := range [][]string{
-			{"-setwebproxystate", svc, "off"},
-			{"-setsecurewebproxystate", svc, "off"},
-			{"-setsocksfirewallproxystate", svc, "off"},
-		} {
-			if err := runNetworkSetup(args...); err != nil && first == nil {
-				first = err
-			}
-		}
+	if len(services) == 0 {
+		c.enabled = false
+		c.services = nil
+		return nil
 	}
+	var b strings.Builder
+	b.WriteString("set +e\n") // best-effort: turn off what we can
+	for _, svc := range services {
+		q := shellQuote(svc)
+		fmt.Fprintf(&b, "networksetup -setwebproxystate %s off\n", q)
+		fmt.Fprintf(&b, "networksetup -setsecurewebproxystate %s off\n", q)
+		fmt.Fprintf(&b, "networksetup -setsocksfirewallproxystate %s off\n", q)
+	}
+	err := runBash(b.String())
 	c.enabled = false
 	c.services = nil
-	return first
+	return err
 }
 
 func (c *darwinController) Enabled() bool {
@@ -142,11 +138,15 @@ func listNetworkServices() ([]string, error) {
 	return services, sc.Err()
 }
 
-func runNetworkSetup(args ...string) error {
-	cmd := exec.Command("networksetup", args...)
+func runBash(script string) error {
+	cmd := exec.Command("/bin/bash", "-c", script)
 	out, err := cmd.CombinedOutput()
 	if err != nil {
-		return fmt.Errorf("networksetup %v: %w (%s)", args, err, strings.TrimSpace(string(out)))
+		return fmt.Errorf("networksetup batch: %w (%s)", err, strings.TrimSpace(string(out)))
 	}
 	return nil
 }
+
+func shellQuote(s string) string {
+	return "'" + strings.ReplaceAll(s, "'", `'\''`) + "'"
+}