Evaluate PAC URLs Returned by CFNetworkCopyProxiesForURL

Your application asks CFNetwork how to reach a website and gets a URL ending in .pac. Putting that hostname into the socket connection is a wrong turn: it identifies a configuration script.

CFNetworkCopyProxiesForURL returns an ordered array of dictionaries for the target URL. Inspect kCFProxyTypeKey before reading endpoint fields. A dictionary of type kCFProxyTypeAutoConfigurationURL supplies kCFProxyAutoConfigurationURLKey, which requires another evaluation step.

1. Obtain the current system proxy settings and ask for routes to the actual destination URL.
2. When a result refers to a PAC URL, evaluate that script for the same destination.
3. Read the resulting candidate types and endpoints. An HTTP proxy, a SOCKS proxy and a direct route require different connection handling.
4. Preserve candidate order when applying the permitted failure and fallback behavior.

CFNetworkExecuteProxyAutoConfigurationURL downloads and evaluates the script asynchronously. Its immediate return value is a run loop source. Schedule that source; the callback supplies the evaluation result or error after the work completes. Creating the source and immediately reading an empty result variable does not wait for anything. Invalidate the source if the operation must be cancelled.

Keep the target URL attached to the lookup. A PAC script can choose different routes for two hosts, so storing one resolved proxy as the answer for every subsequent destination changes the script's policy. Likewise, a direct candidate is an explicit route, not a missing proxy hostname.

These APIs are useful when a custom transport must interpret system settings. They do not implement the subsequent proxy protocol for that transport, and the lookup does not retrieve passwords from the Keychain. On macOS, match the proxy credential in Keychain separately.