ALL_PROXY=socks5h:// only works for SOCKS5-aware apps (curl, git). Apps like opencode that only check HTTP_PROXY/HTTPS_PROXY were not using the proxy at all, causing DNS resolution failures. Now sets both: - ALL_PROXY=socks5h://host:42052 (SOCKS5 with proxy-side DNS) - HTTP_PROXY=http://host:42051 (HTTP CONNECT proxy) The HTTP CONNECT proxy on port 42051 resolves DNS server-side, so apps that don't speak SOCKS5 still get proper DNS resolution through the proxy.