Repository navigation
fix(agent): pass proxy, TLS trust and CLAUDE_ settings to the agent CLI - #820
Merged
Merged
Conversation
Live report: `claude -p "say hi"` worked in the operator's shell, but
every `cw -q ... -claude --fast` worker failed with "Failed to
authenticate. API Error: 403 Request not allowed". The shell reaches the
API through a proxy (HTTPS_PROXY and friends). buildAgentChildEnv built
the agent child env from buildChildEnv (PATH + HOME + expose under the
default/readonly profiles) plus provider-key prefixes and USER, so the
proxy vars were dropped and the vendor CLI went direct and was refused.
buildAgentChildEnv (the one place both the serial and batch agent spawns
use) now also forwards, when set, not denied by the policy, and not in
CW_NEVER_FORWARD_ENV:
- HTTP_PROXY, HTTPS_PROXY, ALL_PROXY, NO_PROXY and their lowercase forms
(curl/Node/undici/Rust clients read either case);
- NODE_EXTRA_CA_CERTS (claude, gemini are Node CLIs), SSL_CERT_FILE and
SSL_CERT_DIR (OpenSSL / rustls-native-certs, e.g. codex). A TLS-
intercepting proxy needs its CA trusted. REQUESTS_CA_BUNDLE left out:
no shipped wrapper's vendor is a Python requests client;
- the CLAUDE_ prefix (CLAUDE_CONFIG_DIR, CLAUDE_CODE_*), which the claude
CLI reads for its login/config, like ANTHROPIC_ already was. codex
(CODEX_), gemini (GEMINI_/GOOGLE_), opencode/deepseek (DEEPSEEK_ etc.)
already had their prefixes; no other prefix added.
Credentials: a proxy URL can hold a user:password. The agent child must
reach its API anyway, and these vars go only to the delegated agent CLI
the operator configured. Values are never recorded: the `forwarded` list
feeding the worker.agent-env trust-audit event stays names only. An
explicit policy deny still wins (exact name).
buildChildEnv is unchanged: non-agent backends (node/bun/shell/container)
keep their stricter env; they do not call a remote model API.
Default bytes change only in the worker.agent-env audit event's names
list, and only when such vars are set. Shipped as a fix under the
operator's fix-everything request for 0.3.3 (row added to the intent
table); docs/sandbox-profiles.7.md and docs/security-trust-hardening.7.md
updated.
Test: test/shell/execution-backend/agent-child-env-proxy.test.mjs fails
on the old dist ("HTTPS_PROXY forwarded with its value") and passes now.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NpzNqRDJFpBt4cSyYjhbV3
coo1white
marked this pull request as ready for review
October 17, 2026 20:11
coo1white
enabled auto-merge
October 17, 2026 20:11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Capability
A user who reaches the model API through a proxy can now run
cw -q … -claude. Found in the operator's 0.3.3 acceptance run:claude -p "say hi"worked in their shell, but every CW worker failed withFailed to authenticate. API Error: 403 Request not allowed, because CW strippedHTTPS_PROXYand friends from the agent child env and the CLI connected directly.Implementation
buildAgentChildEnvinsrc/shell/execution-backend/agent.ts(the one env builder for both the serial and the batch agent spawn) now also forwards, when set:HTTP_PROXY,HTTPS_PROXY,ALL_PROXY,NO_PROXYand their lowercase forms (clients read one case or the other);NODE_EXTRA_CA_CERTS,SSL_CERT_FILE,SSL_CERT_DIR(a TLS-intercepting proxy needs its CA trusted);CLAUDE_prefix (CLAUDE_CONFIG_DIR,CLAUDE_CODE_*), likeANTHROPIC_already is.A policy
denystill wins by exact name;CW_NEVER_FORWARD_ENVnames are never forwarded; theforwardedlist (and so theworker.agent-envaudit event) stays names only, never values.buildChildEnv(non-agent backends) is unchanged. A proxy URL can carry a password, but the agent must reach its API anyway and these go only to the agent CLI the operator configured.Docs:
docs/sandbox-profiles.7.md(new in 0.3.3),docs/security-trust-hardening.7.md(audit names list), and a row in the 0.3.3 table ofproject/docs/intent/2026-10-16-release-gate-ci.md(default bytes change only in that audit event's names list, only when such vars are set).Tests
New
test/shell/execution-backend/agent-child-env-proxy.test.mjs: all 11 proxy/CA names andCLAUDE_CONFIG_DIRforwarded with values and named inforwarded; no value text inforwarded;SECRET_THINGnot forwarded;CW_RELEASE_VERDICT_PRIVKEY/CW_WORKBENCH_TOKENnever forwarded;deny: ["HTTPS_PROXY","CLAUDE_CONFIG_DIR"]strips both. Fails before (HTTPS_PROXY forwarded with its value), passes after.build, check, test:unit 144/144, test:gate 277/277, citation, growth, index, purity, lang, onramp check, release:check: pass. Conformance 86/88 (only the known sandbox-only
report-doctor/report-fix).Risk
Low. Only the agent backend's child env gains these names, only when set in the parent.
Generated by Claude Code