Fix isOnline() to fall back to HTTP HEAD when DNS fails behind proxy

In enterprise proxy environments, the client machine may not resolve
external DNS directly — DNS resolution is handled by the proxy server.
The existing DNS-only check in isOnline() would incorrectly report the
machine as offline, causing unnecessary fallback to cached/offline installs.

When DNS resolution fails and the axios client is available, isOnline()
now attempts a lightweight HEAD request to www.microsoft.com through the
auto-detected (or manually configured) proxy. This ensures connectivity
is correctly detected in proxy environments while keeping DNS as the
fast-path for non-proxy setups.

Refactors GetProxyAgentIfNeeded by extracting proxy resolution into a
standalone getProxyAgent method that does not depend on IAcquisitionWorkerContext.
This allows isOnline and other callers without a full context to reuse
the same proxy detection logic without duplication.

Fixes #2594

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: nagilson

vscode-dotnet-runtime-library/src/Utils/WebRequestWorkerSingleton.ts

@@ -281,7 +281,7 @@ export class WebRequestWorkerSingleton
         // ... 100 ms is there as a default to prevent the dns resolver from throwing a runtime error if the user sets timeoutSeconds to 0.
 
         const dnsResolver = new dns.promises.Resolver({ timeout: expectedDNSResolutionTimeMs });
-        const couldConnect = await dnsResolver.resolve(microsoftServerHostName).then(() =>
+        const dnsOnline = await dnsResolver.resolve(microsoftServerHostName).then(() =>
         {
             return true;
         }).catch((error: any) =>
@@ -290,7 +290,47 @@ export class WebRequestWorkerSingleton
             return false;
         });
 
-        return couldConnect;
+        if (dnsOnline)
+        {
+            return true;
+        }
+
+        // DNS failed — but in proxy environments, the proxy handles DNS resolution, so direct DNS lookups may fail
+        // even though HTTP connectivity works fine. Fall back to a lightweight HEAD request through the proxy-configured client.
+        if (this.client)
+        {
+            const httpFallbackTimeoutMs = Math.max(timeoutSec * 1000, 2000);
+            const proxyAgent = await this.getProxyAgent(undefined, eventStream);
+
+            const headOptions: object = {
+                timeout: httpFallbackTimeoutMs,
+                cache: false,
+                validateStatus: () => true, // Any HTTP response means we're online, even 4xx/5xx
+                ...(proxyAgent !== null && { proxy: false }),
+                ...(proxyAgent !== null && { httpsAgent: proxyAgent }),
+            };
+
+            const headOnline = await this.client.head(`https://${microsoftServerHostName}`, headOptions)
+                .then(() =>
+                {
+                    return true; // Any response at all means we have connectivity
+                })
+                .catch(() =>
+                {
+                    return false;
+                });
+
+            if (headOnline)
+            {
+                eventStream.post(new OfflineDetectionLogicTriggered(new EventCancellationError('DnsFailedButHttpSucceeded',
+                    `DNS resolution failed but HTTP HEAD request succeeded. This may indicate a proxy is handling DNS.`),
+                    `DNS failed but HTTP connectivity confirmed via HEAD request to ${microsoftServerHostName}.`));
+            }
+
+            return headOnline;
+        }
+
+        return false;
     }
     /**
      *
@@ -321,11 +361,22 @@ export class WebRequestWorkerSingleton
     }
 
     private async GetProxyAgentIfNeeded(ctx: IAcquisitionWorkerContext): Promise<HttpsProxyAgent<string> | null>
+    {
+        return this.getProxyAgent(ctx.proxyUrl, ctx.eventStream);
+    }
+
+    /**
+     * Resolves a proxy agent from the manual proxy URL or auto-detected system proxy settings.
+     * Decoupled from IAcquisitionWorkerContext so it can be used by isOnline and other callers that don't have a full context.
+     */
+    private async getProxyAgent(manualProxyUrl?: string, eventStream?: IEventStream): Promise<HttpsProxyAgent<string> | null>
     {
         try
         {
+            const hasManualProxy = manualProxyUrl ? manualProxyUrl !== '""' : false;
+
             let discoveredProxy = '';
-            if (!this.proxySettingConfiguredManually(ctx))
+            if (!hasManualProxy)
             {
                 const autoDetectProxies = await getProxySettings();
                 if (autoDetectProxies?.https)
@@ -338,17 +389,17 @@ export class WebRequestWorkerSingleton
                 }
             }
 
-            if (this.proxySettingConfiguredManually(ctx) || discoveredProxy)
+            if (hasManualProxy || discoveredProxy)
             {
-                const finalProxy = ctx?.proxyUrl && ctx?.proxyUrl !== '""' && ctx?.proxyUrl !== '' ? ctx.proxyUrl : discoveredProxy;
-                ctx.eventStream.post(new ProxyUsed(`Utilizing the Proxy : Manual ? ${ctx?.proxyUrl}, Automatic: ${discoveredProxy}, Decision : ${finalProxy}`))
+                const finalProxy = manualProxyUrl && manualProxyUrl !== '""' && manualProxyUrl !== '' ? manualProxyUrl : discoveredProxy;
+                eventStream?.post(new ProxyUsed(`Utilizing the Proxy : Manual ? ${manualProxyUrl}, Automatic: ${discoveredProxy}, Decision : ${finalProxy}`))
                 const proxyAgent = new HttpsProxyAgent(finalProxy);
                 return proxyAgent;
             }
         }
         catch (error: any)
         {
-            ctx.eventStream.post(new SuppressedAcquisitionError(error, `The proxy lookup failed, most likely due to limited registry access. Skipping automatic proxy lookup.`));
+            eventStream?.post(new SuppressedAcquisitionError(error, `The proxy lookup failed, most likely due to limited registry access. Skipping automatic proxy lookup.`));
         }
 
         return null;
@@ -485,11 +536,6 @@ If you're on a proxy and disable registry access, you must set the proxy in our
         }
     }
 
-    private proxySettingConfiguredManually(ctx: IAcquisitionWorkerContext): boolean
-    {
-        return ctx?.proxyUrl ? ctx?.proxyUrl !== '""' : false;
-    }
-
     private timeoutMsFromCtx(ctx: IAcquisitionWorkerContext): number
     {
         return ctx?.timeoutSeconds * 1000;

vscode-dotnet-runtime-library/src/test/unit/WebRequestWorker.test.ts

@@ -5,13 +5,17 @@
 import * as chai from 'chai';
 
 import * as chaiAsPromised from 'chai-as-promised';
+import * as http from 'http';
+import * as https from 'https';
+import * as dns from 'dns';
 import * as path from 'path';
 import { DotnetCoreAcquisitionWorker } from '../../Acquisition/DotnetCoreAcquisitionWorker';
 import { IInstallScriptAcquisitionWorker } from '../../Acquisition/IInstallScriptAcquisitionWorker';
 import
 {
     DotnetFallbackInstallScriptUsed,
     DotnetInstallScriptAcquisitionError,
+    OfflineDetectionLogicTriggered,
     WebRequestTime,
 } from '../../EventStream/EventStreamEvents';
 import
@@ -127,3 +131,148 @@ suite('WebRequestWorker Unit Tests', function ()
     });
 });
 
+/**
+ * Helper that intercepts all outbound HTTP/HTTPS requests and DNS lookups to simulate a fully offline machine.
+ * Blocks at the http/https.request level which is what axios uses internally.
+ * Returns a restore function that undoes the patching.
+ */
+function simulateOffline(): () => void
+{
+    const originalHttpsRequest = https.request;
+    const originalHttpRequest = http.request;
+    const originalDnsResolve = dns.promises.Resolver.prototype.resolve;
+
+    // Block all HTTPS requests
+    (https as any).request = function (...args: any[])
+    {
+        const req = new http.ClientRequest('https://localhost:1');
+        process.nextTick(() => req.destroy(new Error('simulateOffline: HTTPS request blocked')));
+        return req;
+    };
+
+    // Block all HTTP requests
+    (http as any).request = function (...args: any[])
+    {
+        const req = new http.ClientRequest('http://localhost:1');
+        process.nextTick(() => req.destroy(new Error('simulateOffline: HTTP request blocked')));
+        return req;
+    };
+
+    // Block DNS resolution
+    dns.promises.Resolver.prototype.resolve = function ()
+    {
+        return Promise.reject(new Error('simulateOffline: DNS blocked'));
+    } as any;
+
+    return () =>
+    {
+        (https as any).request = originalHttpsRequest;
+        (http as any).request = originalHttpRequest;
+        dns.promises.Resolver.prototype.resolve = originalDnsResolve;
+    };
+}
+
+/**
+ * Helper that blocks only DNS resolution but allows TCP/TLS connections through.
+ * Simulates a proxy environment where DNS doesn't resolve locally but HTTP works.
+ */
+function simulateDnsOnlyFailure(): () => void
+{
+    const originalDnsResolve = dns.promises.Resolver.prototype.resolve;
+
+    dns.promises.Resolver.prototype.resolve = function ()
+    {
+        return Promise.reject(new Error('simulateDnsOnlyFailure: DNS blocked'));
+    } as any;
+
+    return () =>
+    {
+        dns.promises.Resolver.prototype.resolve = originalDnsResolve;
+    };
+}
+
+suite('isOnline Connectivity Detection Tests', function ()
+{
+    this.afterEach(async () =>
+    {
+        // Reset the singleton so each test gets a fresh instance
+        (WebRequestWorkerSingleton as any).instance = undefined;
+    });
+
+    test('isOnline returns false when fully offline (DNS + HTTP both blocked)', async () =>
+    {
+        const eventStream = new MockEventStream();
+
+        // Reset singleton so the new instance is created while network is blocked
+        (WebRequestWorkerSingleton as any).instance = undefined;
+
+        const restoreNetwork = simulateOffline();
+        try
+        {
+            const result = await WebRequestWorkerSingleton.getInstance().isOnline(5, eventStream);
+            assert.isFalse(result, 'Should report offline when all network is blocked');
+
+            const offlineEvent = eventStream.events.find(event => event instanceof OfflineDetectionLogicTriggered);
+            assert.exists(offlineEvent, 'Should log an offline detection event for the DNS failure');
+        }
+        finally
+        {
+            restoreNetwork();
+        }
+    }).timeout(15000);
+
+    test('isOnline returns true when DNS fails but HTTP succeeds (proxy environment)', async () =>
+    {
+        const eventStream = new MockEventStream();
+        const restoreNetwork = simulateDnsOnlyFailure();
+        try
+        {
+            const result = await WebRequestWorkerSingleton.getInstance().isOnline(5, eventStream);
+            assert.isTrue(result, 'Should report online when DNS fails but HTTP HEAD succeeds');
+
+            const dnsFailEvent = eventStream.events.find(event =>
+                event instanceof OfflineDetectionLogicTriggered &&
+                event.supplementalMessage.includes('DNS resolution failed'));
+            assert.exists(dnsFailEvent, 'Should log a DNS failure event');
+
+            const httpSuccessEvent = eventStream.events.find(event =>
+                event instanceof OfflineDetectionLogicTriggered &&
+                event.supplementalMessage.includes('HTTP connectivity confirmed'));
+            assert.exists(httpSuccessEvent, 'Should log that HTTP fallback succeeded');
+        }
+        finally
+        {
+            restoreNetwork();
+        }
+    }).timeout(15000);
+
+    test('isOnline returns true when DNS succeeds (normal environment)', async () =>
+    {
+        const eventStream = new MockEventStream();
+        const result = await WebRequestWorkerSingleton.getInstance().isOnline(5, eventStream);
+        assert.isTrue(result, 'Should report online when DNS resolves successfully');
+    }).timeout(15000);
+
+    test('isOnline returns false when DOTNET_INSTALL_TOOL_OFFLINE env var is set', async () =>
+    {
+        const eventStream = new MockEventStream();
+        const originalEnv = process.env.DOTNET_INSTALL_TOOL_OFFLINE;
+        process.env.DOTNET_INSTALL_TOOL_OFFLINE = '1';
+        try
+        {
+            const result = await WebRequestWorkerSingleton.getInstance().isOnline(5, eventStream);
+            assert.isFalse(result, 'Should report offline when DOTNET_INSTALL_TOOL_OFFLINE=1');
+        }
+        finally
+        {
+            if (originalEnv === undefined)
+            {
+                delete process.env.DOTNET_INSTALL_TOOL_OFFLINE;
+            }
+            else
+            {
+                process.env.DOTNET_INSTALL_TOOL_OFFLINE = originalEnv;
+            }
+        }
+    }).timeout(5000);
+});