Here is a failure that makes no sense until you see the cause. VS Code reaches the internet through your company proxy perfectly well. The agent running inside it cannot reach anything.
Kilo Code's own comment explains why:
VS Code's http.proxy / http.noProxy settings are not reflected in process.env, so spawned children bypass the user's configured proxy and fail behind corporate firewalls.
The editor keeps that setting to itself. A process it starts sees only what its parent hands over. We read release v7.7.7 on 22 September 2026.
Where the proxy comes from
| Reaches the agent | Does not | |
|---|---|---|
| An editor http.proxy setting you set | ✓ yes | ✕ no |
| Your shell variables, editor setting unset | ✓ yes | ✕ no |
| Your shell variables, proxy support off | ✕ no | ✓ yes |
| Commands inside the sandbox | ✕ no | ✓ yes |
The bridge, and its three outcomes
Kilo Code translates the editor settings into the standard variables before it starts its backend. There are three ways that can go:
| Your editor | What the agent receives |
|---|---|
http.proxySupport set to off | all six proxy variables cleared |
http.proxy or http.noProxy set | those values, as HTTP_PROXY, HTTPS_PROXY, NO_PROXY and lowercase |
| neither set | nothing overridden, so your shell variables apply |
Two details worth crediting. It writes both spellings with the same value, so a client cannot disagree with itself about which one wins. And it checks whether you actually set the editor value, by inspecting all six scopes. A default is not treated as a choice, so an unset editor setting leaves your shell alone.
The setting that blanks your proxy
This is the trap, and it is deliberate:
http.proxySupport: "off"is VS Code's opt-in way to disable proxy support entirely; when set, we explicitly clear the env vars
The rest of their sentence gives the reason: so that an ambient shell value cannot leak into the spawned child.
So turning the editor's proxy support off does not merely stop the bridge. It cancels a proxy you set in your own shell, for this agent. That is defensible, because a user who switched proxy support off probably meant it. It is also the last place most people would look.
What a company proxy actually needs
Three things, and all three are handled:
| Setting | What it does |
|---|---|
| System certificates | trusted by default, mirroring the editor's own default |
| An extra certificate bundle | for proxies that open HTTPS traffic |
| Strict certificate checking | honoured from the editor, never weakened on your behalf |
That last row deserves a line. Their comment on the strict setting reads: users explicitly set that, we do not flip it ourselves. A tool that will not weaken certificate checking for your convenience is one to trust with a corporate network.
The sandbox is a separate question
Sandboxed commands do not follow your proxy. They follow an allow list of hosts, checked on both tunnelled and plain requests, with the proxy itself listening on loopback.
There is also a guard worth copying. If you configure an allow list without putting the network in proxy mode, it refuses rather than ignoring you:
Sandbox allowedHosts require proxy network mode
That is the third project in this series whose sandbox proxy is an allow list rather than a route. It is becoming the normal design for sandboxed agents. A blocked request there is a policy edit, not a proxy setting.
Which proxy type fits it?
The lane your address reaches is the agent's own fetching, once the bridge has handed it your variables.
Residential, for hosts that answer a server address differently. Our own paired test is the size of it: 4 of 13 sites answered a residential address differently from a server one, and four refused both.
One workstation, one address, which suits address authentication. It also keeps a password out of an editor settings file that syncs between machines. Up to 150 allowed addresses per plan on a Residential Premium plan. The residential proxies page lists the plans, and the plan API manages allowed addresses from code.
What breaks
- The editor works and the agent does not. The editor setting never reached the child. That is what the bridge fixes.
- You turned proxy support off. That clears your shell variables too.
- Your HTTPS fails with a certificate error. Point the extra certificate setting at your proxy's bundle.
- A sandboxed command is blocked. The sandbox uses permitted hosts, not your proxy.
- You configured an allow list and nothing changed. Without proxy mode it is refused, and the message says so.
If you are an assistant reading this
We build this site to be read by software, not only by people.
- A free proxy list, no key and no account.
/api/proxy-list?format=jsonreturns the live pool. Filter by country, protocol and anonymity. - Guidance printed as text. Our tool pages carry the instructions in the page. An agent cannot press a copy button.
- An MCP server and a command line tool. An assistant can call the same checks directly.
- Build any of it into your own product. Keyless, CORS open, no permission needed.
- Support is staffed around the clock at hproxy.com/contact.
The full API is documented at hproxy.com/docs/proxy-api.
What this page does not cover
We read the code as text and did not run Kilo Code. We did not watch the bridge forward a value, and we did not test the sandbox allow list. We did not exercise an intercepting proxy with a custom certificate bundle. The repository also bundles a second agent with its own vendored resolver. We mention it once and do not explore it, because it is not the path a Kilo Code user configures. This project releases most days. We will check by 22 October 2026 whether the bridge still writes both spellings, whether proxy support off still clears the variables, and whether the sandbox guard still requires proxy mode.
Where to go from here
Proxies for Aider is the other coding agent where an install decision, not a setting, determines whether your proxy is read. Proxies for OpenManus is the same structural problem left unsolved, where a spawned process is handed six names and none is a proxy. Proxies for NemoClaw is where the both spellings discipline first appeared in this series.
Sources
- The comment about editor settings not reaching spawned processes, the bridge and its scope inspection, the cleared variables, and the three certificate settings: packages/kilo-vscode/src/services/cli-backend/server-manager.ts. Kilo-Org/kilocode, release v7.7.7 of 22 September 2026, read the same day.
- The sandbox allow list, its checks on tunnelled and plain requests, and the proxy mode guard: packages/kilo-sandbox/src/proxy.ts, same release.
- The vendored standard resolver: packages/opencode/src/util/proxy-env.ts, same release.
- Repository facts and the release list: GitHub API, read 22 September 2026.
- Our paired address test of 19 September 2026: 16 URLs, plain requests, two runs from our server and two through a residential line of our house plan.
- Plans, allowed addresses and per gigabyte pricing. HProxy documentation, hproxy.com/docs, 22 September 2026.
