Help should indicate --proxy/--no-proxy require ProxyCommandLineOptions, or --no-proxy should have a lower-friction escape path

[starSumi]

Brief description of your issue

winget upgrade --help lists both --proxy and --no-proxy, but using --no-proxy can fail before the command runs:

This feature needs to be enabled by administrators. To enable it, run "winget settings --enable ProxyCommandLineOptions" as administrator.

This is especially confusing when the user is trying --no-proxy because the configured proxy is broken.

Steps to reproduce

Run:

winget upgrade --help

Observe that help lists:

--proxy      Sets a proxy to use for this execution
--no-proxy   Disables proxy use for this execution

Then run:

winget upgrade --id Microsoft.PowerShell --source winget --accept-package-agreements --accept-source-agreements --disable-interactivity --no-proxy

Observed on winget v1.28.240:

此功能需要由管理员启用。若要启用它，请以管理员身份运行 “winget settings --enable ProxyCommandLineOptions”。

Expected behavior

Either:

• Help should annotate --proxy and --no-proxy as requiring ProxyCommandLineOptions, or hide them until enabled.
• The blocked-option error should explicitly say the option is recognized but disabled by admin setting or policy.
• Or --no-proxy should have a lower-friction escape path than arbitrary --proxy, while still respecting Group Policy.

Actual behavior

The option appears as a normal supported command-line option in help, but the command exits with an admin-setting gate before execution.

Source-level triage

Local checkout: microsoft/winget-cli at 5eb96e8.

Relevant paths:

• src/AppInstallerCLICore/Argument.cpp
  • maps Proxy to --proxy
  • maps NoProxy to --no-proxy
  • appends both as common args
  • gates both behind ProxyCommandLineOptions
• src/AppInstallerCLICore/Command.cpp
  • validates all command/common args
  • throws disabled policy / admin setting messages
• src/AppInstallerCommonCore/AdminSettings.cpp
  • ProxyCommandLineOptions defaults to false
• src/AppInstallerSharedLib/GroupPolicy.cpp
  • maps EnableWindowsPackageManagerProxyCommandLineOptions
• src/AppInstallerCLIPackage/Shared/Strings/en-us/winget.resw
  • contains help text and admin-enable error text
• doc/specs/#190 - Proxy Support.md
  • says --no-proxy disables a default proxy
  • also says both args are disabled by default and must be enabled by admin

Suggested fix direction

Smallest UX fix:

• Update help text for --proxy and --no-proxy to mention that they require ProxyCommandLineOptions.
• Improve the admin-setting error to say which option was blocked and whether the block came from admin setting vs Group Policy.

Larger design option:

• Split arbitrary proxy selection from proxy bypass.
• Keep arbitrary --proxy gated.
• Consider allowing --no-proxy by default unless an enterprise policy explicitly enforces proxy use.

Related issues / PRs

• Proxy support for non-admin users, under admin supervision #6090: proxy support for non-admin users, under admin supervision
• System proxy support #6219: system proxy support
• Add spec for proxy support #4152: proxy support spec
• Add support for proxies #190 #4203: proxy support implementation

This issue is intentionally scoped to help/error UX and recovery clarity. It is not asking for broad non-admin proxy control in the same issue.