@rikcodes/teamclaude 1.1.19-rik.1 → 1.1.19-rik.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rikcodes/teamclaude",
-  "version": "1.1.19-rik.1",
+  "version": "1.1.19-rik.2",
   "description": "Multi-account proxy for Claude Code and Codex: pools Claude Max, ChatGPT/Codex, API-key and third-party backend accounts, and rotates on quota",
   "type": "module",
   "main": "src/index.js",

package/src/claude-env.js

@@ -26,11 +26,50 @@ export function validPort(port) {
   return n;
 }
 
+// The loopback entries every launched client gets. They keep the client's own
+// localhost traffic out of the proxy: a forward to loopback is refused
+// (forward-target.js), so a client that proxied it would get a 403 instead of
+// its own dev server.
+export const LOOPBACK_NO_PROXY = ['localhost', '127.0.0.1', '::1'];
+
+/** True if `value` names `*` — "proxy nothing" — among its entries. */
+export function bypassesAllHosts(value) {
+  return String(value ?? '').split(',').some((entry) => entry.trim() === '*');
+}
+
+/**
+ * The NO_PROXY a launched client gets: ours, plus whatever the operator had.
+ *
+ * Replacing theirs broke the case the list exists for. A local dev host is
+ * rarely spelled `localhost` — `*.test` and friends resolve to 127.0.0.1
+ * through a local resolver — so with only our three entries the client proxies
+ * it, the proxy refuses the loopback forward, and the client retries the 403 on
+ * a loop. Their entries are kept verbatim (a leading dot or a `host:port` is
+ * theirs to mean), deduped case-insensitively, ours first.
+ *
+ * `*` is the one entry dropped: it routes every host around the proxy,
+ * api.anthropic.com included, which silently turns the launch into a direct run
+ * — no rotation, the operator's own quota. `--no-mitm` is how that is asked for.
+ */
+export function mergeNoProxy(...inherited) {
+  const seen = new Set();
+  const out = [];
+  const entries = inherited.flatMap((value) => String(value ?? '').split(','));
+  for (const entry of [...LOOPBACK_NO_PROXY, ...entries]) {
+    const host = entry.trim();
+    if (!host || host === '*' || seen.has(host.toLowerCase())) continue;
+    seen.add(host.toLowerCase());
+    out.push(host);
+  }
+  return out.join(',');
+}
+
 // Build the shell `export` lines that point Claude Code — or any tool that
 // spawns it, e.g. an agent multiplexer — at the proxy. This is the same
 // environment `teamclaude run` sets up, but emitted for `eval "$(teamclaude
 // env)"` instead of launching claude directly. Pure and side-effect free so it
-// can be unit-tested; the caller resolves the port, cert path, and holdSeconds.
+// can be unit-tested; the caller resolves the port, cert path, holdSeconds and
+// the NO_PROXY the invoking shell already had.
 //
 // MITM (forward-proxy) mode is the default, matching `teamclaude run`: it routes
 // ALL of claude's traffic through the proxy — even hardcoded api.anthropic.com
@@ -101,7 +140,7 @@ export function buildCustomModelVars(customModels) {
   return vars;
 }
 
-export function buildClaudeEnvLines({ port, useMitm = true, caPath = null, holdSeconds = 0, account = null, proxyApiKey = '', customModels = null }) {
+export function buildClaudeEnvLines({ port, useMitm = true, caPath = null, holdSeconds = 0, account = null, proxyApiKey = '', customModels = null, inheritedNoProxy = null }) {
   const lines = [];
   const pin = (account || '').trim();
   // The port is interpolated unquoted into URLs the shell evals, so it has to
@@ -111,13 +150,16 @@ export function buildClaudeEnvLines({ port, useMitm = true, caPath = null, holdS
   if (useMitm) {
     const userinfo = pin ? `${encodePinComponent(pin)}:${encodePinComponent(proxyApiKey || '')}@` : '';
     const proxyUrl = `http://${userinfo}127.0.0.1:${port}`;
+    const noProxy = mergeNoProxy(inheritedNoProxy);
     lines.push(
       `export HTTPS_PROXY=${proxyUrl}`,
       `export HTTP_PROXY=${proxyUrl}`,
       `export https_proxy=${proxyUrl}`,
       `export http_proxy=${proxyUrl}`,
-      'export NO_PROXY=localhost,127.0.0.1,::1',
-      'export no_proxy=localhost,127.0.0.1,::1',
+      // Quoted like the CA path below: the value now carries whatever the
+      // operator's own NO_PROXY held, and this line is eval'd.
+      `export NO_PROXY=${shellQuote(noProxy)}`,
+      `export no_proxy=${shellQuote(noProxy)}`,
     );
     // Quoted: the path is under $HOME (or XDG_CONFIG_HOME), which can carry a
     // space or a quote, and this line is eval'd.

package/src/index.js

@@ -39,7 +39,7 @@ import { autoUpdate, checkForUpdate, currentVersion, runUpdate, installKind, PKG
 import { renderStatus, formatPercent } from './status-renderer.js';
 import { sanitizeText } from './safe-text.js';
 import { ClientUsageTracker, UsageDimensionTracker } from './client-usage.js';
-import { buildClaudeEnvLines, buildCustomModelAgents, buildCustomModelSettings, buildCustomModelVars, encodePinComponent } from './claude-env.js';
+import { buildClaudeEnvLines, buildCustomModelAgents, buildCustomModelSettings, buildCustomModelVars, bypassesAllHosts, encodePinComponent, mergeNoProxy } from './claude-env.js';
 import { serviceKind, installService, uninstallService, serviceStatus, renderService, logPath } from './service.js';
 import { formatTerminalTitle, titleSequence, TITLE_STACK_PUSH, TITLE_STACK_POP } from './terminal-title.js';
 import { getUpstreamProxy, describeProxy, describeSelfProxy } from './upstream-proxy.js';
@@ -953,6 +953,9 @@ async function envCommand() {
       port, useMitm, caPath, holdSeconds: config.holdSeconds,
       account, proxyApiKey: config.proxy?.apiKey || '',
       customModels: config.customModels,
+      // The shell doing the eval keeps its own NO_PROXY entries; re-running is
+      // idempotent, since the merged value is what it will have next time.
+      inheritedNoProxy: [process.env.NO_PROXY, process.env.no_proxy].filter(Boolean).join(','),
     });
   } catch (err) {
     // A bad proxy.port. Nothing reaches stdout: the shell is eval'ing it.
@@ -1032,7 +1035,13 @@ async function runCommand() {
         : '';
       const proxyUrl = `http://${userinfo}127.0.0.1:${port}`;
       env.HTTPS_PROXY = env.HTTP_PROXY = env.https_proxy = env.http_proxy = proxyUrl;
-      env.NO_PROXY = env.no_proxy = 'localhost,127.0.0.1,::1';
+      // Keep the operator's own NO_PROXY and add ours — see mergeNoProxy. Both
+      // spellings are read: a tool that set only one still meant it.
+      const inheritedNoProxy = [process.env.NO_PROXY, process.env.no_proxy];
+      env.NO_PROXY = env.no_proxy = mergeNoProxy(...inheritedNoProxy);
+      if (inheritedNoProxy.some(bypassesAllHosts)) {
+        console.error('[TeamClaude] NO_PROXY=* ignored: it would send api.anthropic.com around the proxy (no rotation). Use --no-mitm for a direct launch.');
+      }
       env.NODE_EXTRA_CA_CERTS = caPath;
       if (tcAcct) console.error(`[TeamClaude] Pinned to account "${tcAcct}" (TC_ACCT)`);
       else if (pinnedBase) {