hx-cli 0.2.14__tar.gz → 0.2.15__tar.gz

{hx_cli-0.2.14 → hx_cli-0.2.15}/CHANGELOG.md

@@ -28,6 +28,28 @@ the project follows [semantic versioning](https://semver.org/).
 
 ---
 
+## [0.2.15] - 2026-10-04
+
+### Changed
+
+- `/login` and `hx auth login` list the accounts as OpenAI, Claude, OpenRouter, Devin. At the
+  `hx auth login` menu, Enter still picks OpenRouter.
+
+### Fixed
+
+- `/login claude-code` behind a network whose TLS inspection signs with a certificate not
+  valid for servers ("unsupported certificate purpose") now gives Claude Code's reason and
+  the fix: have the network fixed or exempted, or set `HX_SSL_NO_VERIFY=1` meanwhile. It
+  used to give the whole sign-in URL and no fix. Turns and HX's own requests that fail the
+  same way give the same advice, not "add the CA", which is trusted already.
+- A `HX_CA_BUNDLE`, `SSL_CERT_FILE` or `REQUESTS_CA_BUNDLE` that names a file holding no
+  certificates no longer crashes HX at startup. HX says so and verifies against the system
+  trust store, and does not hand the file to Claude Code.
+- A wrapped error notice no longer shows a bright green background under every line after
+  the first.
+
+---
+
 ## [0.2.14] - 2026-10-04
 
 ### Added
@@ -879,7 +901,8 @@ First release, published to PyPI as [`hx-cli`](https://pypi.org/project/hx-cli/)
 - `/configure` and `hx auth` for the OpenRouter key, `hx upgrade` for
   self-update, and `install.sh` bootstrapping uv with a pinned Python.
 
-[Unreleased]: https://github.com/aletisunil/hx/compare/v0.2.14...HEAD
+[Unreleased]: https://github.com/aletisunil/hx/compare/v0.2.15...HEAD
+[0.2.15]: https://github.com/aletisunil/hx/compare/v0.2.14...v0.2.15
 [0.2.14]: https://github.com/aletisunil/hx/compare/v0.2.13...v0.2.14
 [0.2.13]: https://github.com/aletisunil/hx/compare/v0.2.12...v0.2.13
 [0.2.12]: https://github.com/aletisunil/hx/compare/v0.2.11...v0.2.12

{hx_cli-0.2.14 → hx_cli-0.2.15}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: hx-cli
-Version: 0.2.14
+Version: 0.2.15
 Summary: HX - an agent harness for the terminal
 Project-URL: Homepage, https://hx.sunilaleti.dev
 Project-URL: Documentation, https://hx.sunilaleti.dev
@@ -335,7 +335,13 @@ export HX_CA_BUNDLE=/path/to/corp-ca.pem   # SSL_CERT_FILE and REQUESTS_CA_BUNDL
 `HX_SSL_NO_VERIFY=1` turns verification off entirely; it prints a warning at
 startup every session, because it is not a fix. A TLS failure is reported in
 one line - `/model` and the startup notice both name the certificate problem
-rather than reporting an empty catalogue with no cause.
+rather than reporting an empty catalogue with no cause. A file that holds no
+certificates is ignored, with a startup notice that says so.
+
+"Unsupported certificate purpose" (or "unsuitable") is different: the CA is
+trusted, but the proxy signs with a certificate that is not valid for servers,
+so no CA setting fixes it. The network has to fix that certificate or exempt
+the service from inspection; until then only `HX_SSL_NO_VERIFY=1` gets through.
 
 The same settings cover the `claude-code` route, whose requests Claude Code
 makes with its own TLS stack: HX passes `HX_CA_BUNDLE` on to it as

{hx_cli-0.2.14 → hx_cli-0.2.15}/README.md

@@ -294,7 +294,13 @@ export HX_CA_BUNDLE=/path/to/corp-ca.pem   # SSL_CERT_FILE and REQUESTS_CA_BUNDL
 `HX_SSL_NO_VERIFY=1` turns verification off entirely; it prints a warning at
 startup every session, because it is not a fix. A TLS failure is reported in
 one line - `/model` and the startup notice both name the certificate problem
-rather than reporting an empty catalogue with no cause.
+rather than reporting an empty catalogue with no cause. A file that holds no
+certificates is ignored, with a startup notice that says so.
+
+"Unsupported certificate purpose" (or "unsuitable") is different: the CA is
+trusted, but the proxy signs with a certificate that is not valid for servers,
+so no CA setting fixes it. The network has to fix that certificate or exempt
+the service from inspection; until then only `HX_SSL_NO_VERIFY=1` gets through.
 
 The same settings cover the `claude-code` route, whose requests Claude Code
 makes with its own TLS stack: HX passes `HX_CA_BUNDLE` on to it as

{hx_cli-0.2.14 → hx_cli-0.2.15}/src/hx/__init__.py

@@ -1,5 +1,5 @@
 """HX - an agent harness for the terminal."""
 
-__version__ = "0.2.14"
+__version__ = "0.2.15"
 
 __all__ = ["__version__"]

{hx_cli-0.2.14 → hx_cli-0.2.15}/src/hx/auth/claude_code.py

@@ -290,6 +290,22 @@ def login_terminal() -> int:
 
 
 _URL = re.compile(r"https://\S+")
+_PASTE_PROMPT = re.compile(r"^.*Paste code[^>]*>\s*")
+_FAILED = re.compile(r"^Login failed:\s*", re.IGNORECASE)
+
+
+def _failure(output: list[str]) -> str | None:
+    """Why ``claude auth login`` failed: its last line of its own, ``unsupported
+    certificate purpose`` from ``Login failed: unsupported certificate purpose``.
+
+    Not the URL it printed before - the screen already showed that, and it is
+    wider than the notice - nor the paste prompt the reason is printed after.
+    """
+    for line in reversed(output):
+        line = _FAILED.sub("", _PASTE_PROMPT.sub("", line)).strip()
+        if line and not _URL.search(line):
+            return line
+    return None
 
 
 class LoginFailed(Exception):
@@ -361,8 +377,8 @@ async def login_interactive(interaction: LoginInteraction) -> LoginStatus:
     forget_status()
 
     if code != 0:
-        tail = " ".join(line.strip() for line in output[-3:] if line.strip())
-        raise LoginFailed(f"`claude auth login` failed: {tail or f'exit {code}'}")
+        reason = _failure(output) or f"exit {code}"
+        raise LoginFailed(net.with_tls_hint(f"`claude auth login` failed: {reason}"))
     current = await status_async(fresh=True)
     if current is None or not current.logged_in:
         raise LoginFailed("Claude Code still reports no login.")

{hx_cli-0.2.14 → hx_cli-0.2.15}/src/hx/cli.py

@@ -1432,8 +1432,10 @@ def _choose_provider() -> str:
     print("Sign in to:")
     for index, spec in enumerate(registry.SPECS, start=1):
         print(f"  {index}  {spec.label}")
+    # Enter still means OpenRouter, wherever it sits in the list.
+    default = str(next(i for i, s in enumerate(registry.SPECS, start=1) if s.id == OPENROUTER))
     try:
-        choice = input("Choice [1]: ").strip() or "1"
+        choice = input(f"Choice [{default}]: ").strip() or default
     except (EOFError, KeyboardInterrupt):
         print()
         return OPENROUTER

{hx_cli-0.2.14 → hx_cli-0.2.15}/src/hx/net.py

@@ -41,11 +41,38 @@ _TRUTHY = frozenset({"1", "true", "yes", "on"})
 
 
 def ca_bundle() -> Path | None:
-    """The CA bundle the environment names, if it points at a real file."""
+    """The CA bundle the environment names, if it points at a file of certificates."""
+    named = _named_bundle()
+    if named is None or _load_error(named[1]) is not None:
+        return None
+    return named[1]
+
+
+def _named_bundle() -> tuple[str, Path] | None:
+    """The first of :data:`CA_BUNDLE_VARS` that names a real file, and that file."""
     for name in CA_BUNDLE_VARS:
         raw = (os.environ.get(name) or "").strip()
         if raw and Path(raw).expanduser().is_file():
-            return Path(raw).expanduser()
+            return name, Path(raw).expanduser()
+    return None
+
+
+def _load_error(path: Path) -> str | None:
+    """Why ``path`` cannot serve as a CA bundle - a DER file, a key, an empty
+    file - or ``None`` when it can. Asked again only when the file changes."""
+    try:
+        stat = path.stat()
+    except OSError as exc:
+        return exc.strerror or str(exc)
+    return _load_error_of(path, stat.st_mtime_ns, stat.st_size)
+
+
+@lru_cache(maxsize=4)
+def _load_error_of(path: Path, mtime_ns: int, size: int) -> str | None:
+    try:
+        ssl.create_default_context(cafile=str(path))
+    except (ssl.SSLError, OSError, ValueError) as exc:
+        return _flatten(getattr(exc, "reason", None) or str(exc))
     return None
 
 
@@ -80,6 +107,15 @@ def tls_notice() -> str | None:
     """One line for the startup transcript when TLS is not stock."""
     if verification_disabled():
         return f"{NO_VERIFY_VAR} is set: TLS certificates are not being verified."
+    named = _named_bundle()
+    if named is not None and (error := _load_error(named[1])) is not None:
+        # Ignored, as OpenSSL and Node ignore a CA file they cannot read: failing
+        # to start would cost every route, the ones this file is not for too.
+        name, path = named
+        return (
+            f"{name} names {path}, which holds no usable CA certificates ({error}). "
+            f"Verifying TLS against the system trust store instead."
+        )
     bundle = ca_bundle()
     return f"Verifying TLS against {bundle}." if bundle is not None else None
 
@@ -108,13 +144,29 @@ _CERT_FAILURE = re.compile(
     r"certificate verif"
     r"|self[- ]signed certificate"
     r"|unable to (?:get local issuer|verify the first) certificate"
-    r"|UNABLE_TO_VERIFY_LEAF_SIGNATURE|UNABLE_TO_GET_ISSUER_CERT|SELF_SIGNED_CERT_IN_CHAIN",
+    r"|UNABLE_TO_VERIFY_LEAF_SIGNATURE|UNABLE_TO_GET_ISSUER_CERT|SELF_SIGNED_CERT_IN_CHAIN"
+    r"|certificate purpose|INVALID_PURPOSE",
     re.IGNORECASE,
 )
 
+_WRONG_PURPOSE = re.compile(r"(?:unsupported|unsuitable) certificate purpose|INVALID_PURPOSE")
+"""A chain the client does trust, but with a certificate in it - typically the
+issuing CA of a network that intercepts TLS - that may not serve as a TLS
+server's: OpenSSL says "unsuitable", the BoringSSL in Claude Code "unsupported"."""
+
 
-def tls_hint() -> str:
-    """What to do about a certificate the client would not trust."""
+def tls_hint(reason: str = "") -> str:
+    """What to do about a certificate the client would not accept.
+
+    ``reason`` is the client's own words, when there are any: a certificate of
+    the wrong purpose is already trusted, so adding its CA again changes nothing.
+    """
+    if _WRONG_PURPOSE.search(reason):
+        return (
+            "Your network intercepts TLS with a certificate that is not valid for servers. "
+            "Ask its administrator to fix that certificate or to exclude this service from "
+            f"inspection; until then, {NO_VERIFY_VAR}=1 turns verification off."
+        )
     bundle = ca_bundle()
     if bundle is not None:
         return (
@@ -130,7 +182,7 @@ def tls_hint() -> str:
 def with_tls_hint(message: str) -> str:
     """``message``, followed by :func:`tls_hint` when it reports a certificate
     failure - in any client's words: OpenSSL's, Node's, Claude Code's."""
-    hint = tls_hint()
+    hint = tls_hint(message)
     if not _CERT_FAILURE.search(message) or hint in message:
         return message
     return f"{message.rstrip().rstrip('.')}. {hint}"
@@ -156,7 +208,8 @@ def describe(exc: BaseException) -> str:
                 or getattr(err, "reason", None)
                 or "certificate verify failed"
             )
-            return f"TLS certificate verification failed ({_flatten(reason)}). {tls_hint()}"
+            reason = _flatten(reason)
+            return f"TLS certificate verification failed ({reason}). {tls_hint(reason)}"
         if isinstance(err, ssl.SSLError):
             return f"TLS handshake failed: {_flatten(err.reason or str(err))}."
     if isinstance(exc, httpx.TimeoutException):

{hx_cli-0.2.14 → hx_cli-0.2.15}/src/hx/providers/registry.py

@@ -145,13 +145,7 @@ def _build_claude_code(
 
 
 SPECS: tuple[ProviderSpec, ...] = (
-    ProviderSpec(
-        id=OPENROUTER,
-        label="OpenRouter API key",
-        kind=AuthKind.API_KEY,
-        namespace=None,
-        build=_build_openrouter,
-    ),
+    # In the order /login and `hx auth login` offer them.
     ProviderSpec(
         id=CODEX,
         label="OpenAI (ChatGPT Plus/Pro)",
@@ -159,13 +153,6 @@ SPECS: tuple[ProviderSpec, ...] = (
         namespace=f"{CODEX}/",
         build=_build_codex,
     ),
-    ProviderSpec(
-        id=DEVIN,
-        label="Devin (personal or Enterprise)",
-        kind=AuthKind.SUBSCRIPTION,
-        namespace=f"{DEVIN}/",
-        build=_build_devin,
-    ),
     ProviderSpec(
         id=CLAUDE_CODE,
         label="Claude (Pro/Max, via Claude Code)",
@@ -173,6 +160,20 @@ SPECS: tuple[ProviderSpec, ...] = (
         namespace=f"{CLAUDE_CODE}/",
         build=_build_claude_code,
     ),
+    ProviderSpec(
+        id=OPENROUTER,
+        label="OpenRouter API key",
+        kind=AuthKind.API_KEY,
+        namespace=None,
+        build=_build_openrouter,
+    ),
+    ProviderSpec(
+        id=DEVIN,
+        label="Devin (personal or Enterprise)",
+        kind=AuthKind.SUBSCRIPTION,
+        namespace=f"{DEVIN}/",
+        build=_build_devin,
+    ),
 )
 
 BY_ID: dict[str, ProviderSpec] = {spec.id: spec for spec in SPECS}

{hx_cli-0.2.14 → hx_cli-0.2.15}/src/hx/term/ansi.py

@@ -266,6 +266,13 @@ def active_background(text: str) -> str:
                     # Truncated. Nothing legible to re-open, and consuming the
                     # rest would be a guess at parameters that never arrived.
                     break
+            elif code == 38 and index + 1 < len(codes):
+                # A foreground's parameters are not codes: the 102 of
+                # 38;2;204;102;102 would otherwise open a bright green background.
+                span = 3 if codes[index + 1] == 5 else 5 if codes[index + 1] == 2 else 0
+                if not span or index + span > len(codes):
+                    break
+                index += span - 1
             index += 1
     return current
 

{hx_cli-0.2.14 → hx_cli-0.2.15}/tests/e2e/fake_claude.py

@@ -11,6 +11,7 @@ State lives in ``$E2E_CLAUDE_DIR``:
   test starts; ``cursor`` says how far it has been read;
 * ``auth.json`` - what ``claude auth status`` reports (absent: signed out);
 * ``status_delay`` - seconds ``claude auth status`` takes to answer;
+* ``login_error`` - why ``claude auth login`` fails, whatever code is pasted;
 * ``version`` and ``models.json`` - which Claude Code this is: what
   ``--version`` prints and the models ``initialize`` lists (absent: 2.1.205
   and :data:`MODELS`);
@@ -130,8 +131,13 @@ def auth(args: list[str]) -> int:
         sys.stdout.write("Paste code here if prompted > ")
         sys.stdout.flush()
         code = sys.stdin.readline().strip()
-        if code != "good-code":
-            print("\nLogin failed: invalid code")
+        failure = STATE / "login_error"
+        if failure.exists() or code != "good-code":
+            # On the prompt's line, as Claude Code 2.1 prints it when stdin is a pipe.
+            reason = (
+                failure.read_text() if failure.exists() else "Request failed with status code 400"
+            )
+            print(f"Login failed: {reason}")
             return 1
         path.write_text(
             json.dumps(

{hx_cli-0.2.14 → hx_cli-0.2.15}/tests/e2e/test_claude_code.py

@@ -15,6 +15,8 @@ import time
 from pathlib import Path
 from typing import Any
 
+import trustme
+
 from tests.e2e import stub as openrouter
 from tests.e2e.conftest import HX, FakeClaude
 from tests.e2e.test_print import png
@@ -497,6 +499,13 @@ CERT_FAILURE = (
 """What Claude Code 2.1 reports when its connection meets a CA it does not trust."""
 
 
+def corporate_ca(hx: HX) -> Path:
+    """A network's CA certificate, as a PEM file HX can load."""
+    path = hx.root / "corp-ca.pem"
+    trustme.CA(organization_name="Corp").cert_pem.write_to_path(str(path))
+    return path
+
+
 def test_corporate_tls_settings_reach_claude_code(
     hx: HX, claude: FakeClaude, project: Path
 ) -> None:
@@ -505,8 +514,7 @@ def test_corporate_tls_settings_reach_claude_code(
     Node's switch, and Claude Code's own certificate settings survive the scrub - while
     everything that moves billing off the subscription is still dropped."""
     (project / "a.txt").write_text("alpha=17\n")
-    bundle = hx.root / "corp-ca.pem"
-    bundle.write_text("-----BEGIN CERTIFICATE-----\nnot parsed by the fake\n")
+    bundle = corporate_ca(hx)
     claude.login()
     claude.use()
     claude.script(calls(("Read", {"file_path": "a.txt"})), say("alpha is 17."))
@@ -558,6 +566,18 @@ def test_corporate_tls_settings_reach_claude_code(
     assert not any(name.startswith("NODE_") for name in env)
     assert not any(name.startswith("CLAUDE_CODE_CLIENT") for name in env)
 
+    # A bundle that holds no certificates - a DER file, a stale path's leftovers - is said
+    # out loud and left out, as OpenSSL and Node leave it: HX starts and verifies against
+    # the system store, and Claude Code is not handed a file it cannot read either.
+    broken = hx.root / "broken-ca.pem"
+    broken.write_text("-----BEGIN CERTIFICATE-----\nnot a certificate\n")
+    claude.script(say("Still verifying."))
+    result = hx.run("-p", "hello", env={"SSL_CERT_FILE": str(broken)}, check=True)
+    assert result.stdout == "Still verifying.\n"
+    assert f"SSL_CERT_FILE names {broken}, which holds no usable CA certificates" in result.stderr
+    assert "Verifying TLS against the system trust store instead." in result.stderr
+    assert "NODE_EXTRA_CA_CERTS" not in claude.spawns(tools=True)[-1]["env"]
+
 
 def test_a_certificate_failure_says_how_to_fix_it(hx: HX, claude: FakeClaude) -> None:
     """Claude Code refusing the network's CA names HX's fix after its own words; with a
@@ -573,8 +593,7 @@ def test_a_certificate_failure_says_how_to_fix_it(hx: HX, claude: FakeClaude) ->
         "system trust store or set HX_CA_BUNDLE to its PEM file."
     ) in result.stderr
 
-    bundle = hx.root / "corp-ca.pem"
-    bundle.write_text("-----BEGIN CERTIFICATE-----\n")
+    bundle = corporate_ca(hx)
     claude.script({"error": CERT_FAILURE}, say("Through the proxy now."))
     term = hx.tui(env={"HX_CA_BUNDLE": str(bundle)})
     term.submit("hello")
@@ -654,6 +673,64 @@ def test_signing_in_from_the_tui(hx: HX, claude: FakeClaude) -> None:
     assert json.loads((claude.state / "auth.json").read_text())["loggedIn"] is True
 
 
+WRONG_PURPOSE_HINT = (
+    "Your network intercepts TLS with a certificate that is not valid for servers. Ask its "
+    "administrator to fix that certificate or to exclude this service from inspection; until "
+    "then, HX_SSL_NO_VERIFY=1 turns verification off."
+)
+
+
+def test_a_network_that_breaks_sign_in_says_why_and_what_to_do(hx: HX, claude: FakeClaude) -> None:
+    """Behind TLS inspection whose certificate may not serve a TLS server, Claude Code's sign-in
+    fails after the code is pasted. The notice gives Claude Code's reason and the fix - not the
+    sign-in URL, which the dialog showed already - and not "add the CA", which is already
+    trusted. Once the network is fixed, signing in again lists the subscription's models; a
+    turn that meets the same network says the same."""
+    bundle = corporate_ca(hx)
+    (claude.state / "login_error").write_text("unsupported certificate purpose")
+    term = hx.tui(env={"HX_CA_BUNDLE": str(bundle)})
+    term.submit("/login claude-code")
+    term.wait_for("https://claude.example/oauth/authorize")
+    term.paste("good-code")
+    term.press("enter")
+    term.wait_for(lambda screen: "verificationoff." in "".join(screen.split()))
+    solid = "".join(term.text().split())
+    expected = "Sign-infailed:`claudeauthlogin`failed:unsupportedcertificatepurpose."
+    assert "".join(f"{expected}{WRONG_PURPOSE_HINT}".split()) in solid
+    assert "claude.example/oauth" not in solid
+    assert "Pastecode" not in solid
+    assert "holdstheCA" not in solid
+    # Wrapped, the notice keeps its colour and nothing else: its foreground's 102 once
+    # opened a bright green background under every line after the first.
+    notice = [y for y, row in enumerate(term.text().split("\n")) if "intercepts TLS" in row]
+    assert notice
+    with term._lock:
+        filled = {term.screen.buffer[notice[0]][x].bg for x in range(term.columns)}
+    assert filled == {"default"}
+    term.snapshot("sign-in refused by the network")
+
+    (claude.state / "login_error").unlink()
+    term.submit("/login claude-code")
+    term.wait_for("https://claude.example/oauth/authorize")
+    term.paste("good-code")
+    term.press("enter")
+    term.wait_for("Claude Code signed in (e2e@example.com, max plan)")
+    term.submit("/model")
+    term.paste("anthropic", newline="")
+    term.wait_for("claude-code/claude-sonnet-5")
+    term.snapshot("subscription models after signing in")
+    term.press("esc")
+
+    # Claude Code 2.1.289's words, measured behind such a proxy.
+    claude.use()
+    claude.script({"error": "API Error: Unable to connect to API (INVALID_PURPOSE)"})
+    result = hx.run("-p", "hello", env={"HX_CA_BUNDLE": str(bundle)})
+    assert result.returncode != 0
+    assert (
+        f"Claude Code: API Error: Unable to connect to API (INVALID_PURPOSE). {WRONG_PURPOSE_HINT}"
+    ) in result.stderr
+
+
 def test_a_subagent_gets_its_own_process_while_the_parent_waits(
     hx: HX, claude: FakeClaude, project: Path
 ) -> None:

{hx_cli-0.2.14 → hx_cli-0.2.15}/tests/e2e/test_cli.py

@@ -77,10 +77,9 @@ def test_every_tag_has_a_changelog_section(hx: HX) -> None:
 def test_auth_reports_where_the_key_comes_from(hx: HX) -> None:
     """`hx auth` masks the key and says the environment overrides the saved file."""
     result = hx.run("auth", check=True)
-    first = result.stdout.splitlines()[0]
-    assert first.startswith("openrouter")
-    assert "sk-or-…cafe" in first
-    assert "environment (HX_OPENROUTER_API_KEY)" in first
+    (line,) = [line for line in result.stdout.splitlines() if line.startswith("openrouter")]
+    assert "sk-or-…cafe" in line
+    assert "environment (HX_OPENROUTER_API_KEY)" in line
     assert "e2e0000" not in result.stdout, "the key must never be printed whole"
     assert "tavily" in result.stdout
 

{hx_cli-0.2.14 → hx_cli-0.2.15}/tests/e2e/test_commands.py

@@ -657,3 +657,33 @@ def test_unknown_command(hx: HX) -> None:
     term.settle()
     term.snapshot("unknown command")
     assert "Unknown command" in term.text() or "unknown command" in term.text()
+
+
+SIGN_IN_ORDER = (
+    "OpenAI (ChatGPT Plus/Pro)",
+    "Claude (Pro/Max, via Claude Code)",
+    "OpenRouter API key",
+    "Devin (personal or Enterprise)",
+)
+
+
+def test_sign_in_offers_openai_claude_openrouter_devin(hx: HX) -> None:
+    """/login and `hx auth login` list the accounts in one order: OpenAI, Claude, OpenRouter,
+    Devin. Enter at the terminal's menu still picks OpenRouter, as it did when it came first."""
+    term = hx.tui()
+    term.submit("/login")
+    screen = term.wait_for("Devin (personal or Enterprise)")
+    rows = [row for row in screen.split("\n") if any(label in row for label in SIGN_IN_ORDER)]
+    assert [label for row in rows for label in SIGN_IN_ORDER if label in row] == list(SIGN_IN_ORDER)
+    assert "OpenAI" in rows[0] and "→" in rows[0], "the first account is the one selected"
+    term.snapshot("sign-in accounts")
+    term.press("esc")
+
+    menu = hx.tui("auth", "login", ready="Choice")
+    screen = menu.text()
+    numbered = [f"{index}  {label}" for index, label in enumerate(SIGN_IN_ORDER, start=1)]
+    assert all(line in screen for line in numbered), screen
+    assert "Choice [3]:" in screen
+    menu.snapshot("hx auth login menu")
+    menu.press("enter")
+    menu.wait_for("OpenRouter API key")

{hx_cli-0.2.14 → hx_cli-0.2.15}/tests/test_live_claude_code.py

@@ -16,6 +16,7 @@ from __future__ import annotations
 
 import asyncio
 import os
+import re
 from collections.abc import Iterator
 from pathlib import Path
 
@@ -348,3 +349,76 @@ async def test_a_device_certificate_reaches_the_cli(
     assert "4417" in reply
     assert "api.anthropic.com" in mitm.intercepted
     assert "api.anthropic.com" not in mitm.rejected
+
+
+WRONG_PURPOSE_HINT = "Your network intercepts TLS with a certificate that is not valid for servers."
+
+
+async def test_an_interception_ca_of_the_wrong_purpose_names_the_fix(
+    hx_home: Path, tmp_path: Path, mitm: InterceptingProxy, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """Trusted, yet refused: the proxy signs through a CA that may not vouch for servers.
+    Adding the CA again changes nothing, so the hint must not say to."""
+    mitm.wrong_purpose = True
+    monkeypatch.setenv("HX_CA_BUNDLE", str(mitm.ca_file))
+    error, _ = await _tool_turn(tmp_path)
+    assert error is not None
+    assert "INVALID_PURPOSE" in error
+    assert WRONG_PURPOSE_HINT in error
+    assert "holds the CA" not in error
+    assert "api.anthropic.com" in mitm.rejected
+    assert "api.anthropic.com" not in mitm.intercepted
+
+
+class _PastedCode:
+    """The sign-in dialog, with a code that gets as far as the token exchange: the
+    state is the one the CLI asked for, the code itself is made up."""
+
+    def __init__(self) -> None:
+        self.url = ""
+
+    def show_url(self, url: str, message: str) -> None:
+        self.url = url
+
+    async def prompt_paste(self, prompt: str) -> str:
+        state = re.search(r"state=([^&\s]+)", self.url)
+        assert state is not None, self.url
+        return f"made-up-code#{state.group(1)}"
+
+
+@pytest.mark.parametrize("wrong_purpose", [True, False], ids=["wrong-purpose", "control"])
+async def test_signing_in_behind_an_interception_ca_of_the_wrong_purpose(
+    tmp_path: Path, mitm: InterceptingProxy, monkeypatch: pytest.MonkeyPatch, wrong_purpose: bool
+) -> None:
+    """/login through such a network, as a user on Claude Code 2.1.289 met it: the code is
+    pasted and the token exchange is refused. The failure says why and what to do, without
+    the sign-in URL. The control - the same proxy, signing as it should - reaches the server,
+    which turns the made-up code away. Claude Code's state goes to a directory of the test's
+    own, so the machine's login is never touched; no browser opens."""
+    from hx.auth import claude_code as cc_auth
+
+    if cc_auth.find_cli() is None:
+        pytest.skip("Claude Code is not installed")
+    mitm.wrong_purpose = wrong_purpose
+    monkeypatch.setenv("HX_CA_BUNDLE", str(mitm.ca_file))
+    monkeypatch.setenv("CLAUDE_CONFIG_DIR", str(tmp_path / "claude-config"))
+    no_browser = tmp_path / "bin"
+    no_browser.mkdir()
+    for opener in ("open", "xdg-open"):
+        (no_browser / opener).write_text("#!/bin/sh\nexit 0\n")
+        (no_browser / opener).chmod(0o755)
+    monkeypatch.setenv("PATH", f"{no_browser}{os.pathsep}{os.environ['PATH']}")
+
+    with pytest.raises(cc_auth.LoginFailed) as failed:
+        await cc_auth.login_interactive(_PastedCode())
+    message = str(failed.value)
+    assert "https://" not in message
+    assert "Paste code" not in message
+    if wrong_purpose:
+        assert message.startswith(
+            "`claude auth login` failed: unsupported certificate purpose. " + WRONG_PURPOSE_HINT
+        ), message
+        assert "platform.claude.com" in mitm.rejected
+    else:
+        assert message == "`claude auth login` failed: Request failed with status code 400"
+        assert "platform.claude.com" in mitm.intercepted

{hx_cli-0.2.14 → hx_cli-0.2.15}/tests/tls_proxy.py

@@ -25,6 +25,9 @@ from dataclasses import dataclass, field
 from pathlib import Path
 
 import trustme
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes
+from cryptography.x509.oid import ExtendedKeyUsageOID
 
 HEADER_LIMIT = 64 * 1024
 
@@ -39,10 +42,15 @@ class InterceptingProxy:
     require_client_cert: bool = False
     """Refuse a client that does not present a certificate from :attr:`ca` -
     the device certificate a zero-trust network asks every machine for."""
+    wrong_purpose: bool = False
+    """Sign through an issuing CA under :attr:`ca` whose extended key usage leaves
+    out server authentication: the chain is trusted, and still refused, with
+    "unsupported certificate purpose". A real inspection appliance did this."""
     events: list[tuple[str, str]] = field(default_factory=list)
     """``("intercepted" | "rejected", host)`` in the order they happened."""
     port: int = 0
     _contexts: dict[str, ssl.SSLContext] = field(default_factory=dict)
+    _issuer: trustme.CA | None = None
     _loop: asyncio.AbstractEventLoop | None = None
     _server: asyncio.Server | None = None
     _thread: threading.Thread | None = None
@@ -128,7 +136,12 @@ class InterceptingProxy:
         context = self._contexts.get(host)
         if context is None:
             context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
-            self.ca.issue_cert(host).configure_cert(context)
+            issuer = self.ca
+            if self.wrong_purpose:
+                if self._issuer is None:
+                    self._issuer = _client_only_child(self.ca)
+                issuer = self._issuer
+            issuer.issue_cert(host).configure_cert(context)
             if self.require_client_cert:
                 context.verify_mode = ssl.CERT_REQUIRED
                 self.ca.configure_trust(context)
@@ -180,6 +193,33 @@ class InterceptingProxy:
         )
 
 
+def _client_only_child(ca: trustme.CA) -> trustme.CA:
+    """A CA under ``ca`` that may only vouch for TLS clients.
+
+    trustme has no option for it, so its child CA is signed again with the
+    extension added; the key, names and identifiers stay, and so does every
+    certificate the child then issues.
+    """
+    child = ca.create_child_ca()
+    cert = child._certificate
+    builder = (
+        x509.CertificateBuilder()
+        .subject_name(cert.subject)
+        .issuer_name(cert.issuer)
+        .public_key(cert.public_key())
+        .serial_number(cert.serial_number)
+        .not_valid_before(cert.not_valid_before_utc)
+        .not_valid_after(cert.not_valid_after_utc)
+    )
+    for extension in cert.extensions:
+        builder = builder.add_extension(extension.value, extension.critical)
+    builder = builder.add_extension(
+        x509.ExtendedKeyUsage([ExtendedKeyUsageOID.CLIENT_AUTH]), critical=False
+    )
+    child._certificate = builder.sign(ca._private_key, hashes.SHA256())
+    return child
+
+
 def _upstream_context() -> ssl.SSLContext:
     import truststore