Serve PAC file to selectively proxy only watched hosts

[waldekmastykarz]

Currently, when Dev Proxy runs as a system proxy, all HTTP/HTTPS traffic flows through it. Dev Proxy filters requests internally based on urlsToWatch, but unrelated traffic still takes the detour through the proxy. This can cause issues with services that are sensitive to proxying (e.g., Azure Functions startup, Teams auth) and adds unnecessary latency to non-watched traffic.

Proposal: Have Dev Proxy serve a PAC (Proxy Auto-Config) file that routes only watched hosts through the proxy. All other traffic goes direct.

How it would work:

1. Dev Proxy generates a FindProxyForURL() script from the configured urlsToWatch hosts
2. Serves it at an endpoint like http://127.0.0.1:{port}/proxy.pac with MIME type application/x-ns-proxy-autoconfig
3. Instead of setting the system HTTP/HTTPS proxy, sets the system's auto-config URL to point to this PAC file
   • macOS: networksetup -setautoproxyurl <service> http://127.0.0.1:{port}/proxy.pac
   • Windows: set AutoConfigURL registry key or use the proxy library equivalent

Example generated PAC file for urlsToWatch: ["https://graph.microsoft.com/*", "https://api.contoso.com/*"]:

function FindProxyForURL(url, host) {
  if (shExpMatch(host, "graph.microsoft.com") ||
      shExpMatch(host, "api.contoso.com")) {
    return "PROXY 127.0.0.1:8000";
  }
  return "DIRECT";
}

Limitations:

• PAC files operate at the host level, not URL-path level. Fine-grained URL matching still happens inside the proxy as it does today.
• Linux doesn't have a standard system-wide auto-config URL mechanism (same limitation as the current system proxy setup).

Benefits:

• Non-watched traffic never touches the proxy — faster, fewer side effects
• Could resolve issues with Azure Functions, Teams auth, and other services that break when proxied
• Minimal implementation surface — Dev Proxy already has an API controller and already toggles system proxy settings

Derived from #1368.

[waldekmastykarz]

Important consideration: existing PAC file conflicts

A machine can only have one auto-proxy configuration URL per network interface (one slot on macOS via networksetup -setautoproxyurl, one AutoConfigURL on Windows). If a developer is on a corporate network that already uses a PAC file for routing through a company proxy, Dev Proxy replacing it with its own PAC URL would break corporate proxy routing.

At minimum, Dev Proxy would need to:

1. Save the existing PAC/auto-proxy URL before overwriting it, and restore it on shutdown (same pattern as the current system proxy toggle)

Ideally:
2. Merge rules — fetch the existing PAC file, incorporate its routing rules into the generated one so corporate traffic still routes through the corporate proxy while watched URLs route through Dev Proxy

Option 2 is non-trivial (the existing PAC file is arbitrary JavaScript), but option 1 is the baseline — consistent with how Dev Proxy already saves/restores system proxy settings today.