Ask a real Mac the questions the proxy rules rest on

[DarkPoesidon]

Closes the biggest piece of unverified reasoning left over from #66 and #69 — without needing a Mac.

The problem

Two claims about networksetup hold up this package's rules, and Apple documents neither:

1. Does the server address survive switching the proxy off? This is what the comment on Satisfies asserts.
2. Can the bypass list be read back at all? This is why Verify stopped comparing it in Verify only what the machine can be asked to report, and act only when it must #69.

Both were settled by reading behaviour out of our own source, because there is no Mac here to try them on. That reasoning shipped in v1.0.19.

The idea

CI already runs this package's tests on macos-latest. A hosted runner is a real Mac, and it has passwordless sudo. So it can simply be asked.

The test sets a proxy, switches it off, reads it back, and reports which way the machine actually behaves:

this Mac KEEPS the address when the proxy is switched off: ...

or

this Mac CLEARS the address when the proxy is switched off: ...

Checked either way round

Satisfies does not read the address when the target is off, so it is correct whichever answer comes back. What would be wrong is the comment explaining it — and the next person to touch this would be reasoning from a false premise. The test logs what it found so that premise is on the record rather than in someone's head.

The other direction is covered too: a proxy that really is configured has to verify. That path has always worked in the field — users' proxies were being set, which is how the fault behind all of this was reported — so a failure there means the rule drifted away from the machine rather than the machine surprising us. That is exactly the regression #69 fixed, and this is what would have caught it.

Safety

• It reconfigures the machine's own network settings, so it does not run unless asked for by name (WHITEVPN_SYSPROXY_INTEGRATION=1). Nobody's laptop should have its proxy changed by go test ./....
• The restore is registered before the first change and runs whatever the test does — pass, fail or panic.
• It drives networksetup through sudo, not through Apply, which asks for the password with osascript and would hang with nobody there to answer.
• An ephemeral runner is the only place where being wrong about the restore costs nothing.

What this does not do

It does not exercise the administrator prompt, the banner, or the app end to end — those still need a human at a Mac. It settles the two mechanical facts underneath them, which is the part that was guessed.

🤖 Generated with Claude Code