fix(service): never bake Claude first-party's own intercept proxy by scy7796 · Pull Request #7327 · lidge-jun/opencodex

scy7796 · 2026-10-18T16:33:06Z

Summary

Closes #7326.

resolvedProxyEnv() now skips one URL shape when it bakes proxy env into the service: http://opencodex:<token>@127.0.0.1:<port>, the URL claudeInterceptProxyUrl() writes for first-party. If HTTPS_PROXY holds it and https_proxy holds a real proxy, the real one gets baked.

A plain http://127.0.0.1:<port> still gets baked, since local proxy clients like Clash and v2rayN use that form. That's why I didn't reuse isClaudeInterceptProxyUrl(). It also matches the loopback URL without a token, so it would drop those.

The Windows wrapper, the systemd unit and the launchd plist all take their proxy env from this function, so one change covers all three.

Changed:

src/service/definition.ts: the skip, with a comment on why it only matches the URL with the token
tests/service/service.test.ts: one test. The intercept URL is dropped, the lowercase fallback works, and plain loopback and user:pass proxies are kept
structure/runtime.md: one sentence in the intercept paragraph

Verification

I ran these on Windows 11 with Bun 1.4.3, on this branch at dev 8640c2f, on 2026-10-19:

the new test fails without the fix and passes with it
bun test tests/service/service.test.ts: 209 pass, 0 fail
bun test tests/service/launchd-repair.test.ts: 61 pass, 0 fail
tests/ci-workflows/file-size-ratchet.test.ts and tests/ci-workflows/import-cycle-ratchet.test.ts: pass
bun x tsc --noEmit: no errors
bun run structure:check and bun run privacy:scan: pass
.github/scripts/pr-hygiene.cjs over the branch diff: no findings

The first time I ran those four files together, one test failed. The same command passed on the next run (295 pass, 0 fail), and each file passes alone. I didn't run the full bun run test. The change is one function with its own test, so I'm leaving the rest to CI.

Checklist

Scope stays focused and avoids unrelated cleanup.
Docs or release notes were updated when needed.
Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

Required local validation passed; commands, results, and any full-suite exception are documented.
I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).
I resolved all correct Codex and CodeRabbit findings.
My PR is ready for review.

With Claude Code CLI first-party on, ~/.claude/settings.json sets HTTPS_PROXY to OpenCodex's own intercept listener (http://opencodex:<token>@127.0.0.1:<port>), and every process Claude Code starts inherits it. Installing or restarting the service from such a shell baked that URL into the service definition, so the proxy sent its own outbound traffic back through its intercept listener and the per-install token ended up in the wrapper script. resolvedProxyEnv now skips the token-bearing intercept URL and falls through to the lower-case spelling when it holds a real proxy. A tokenless loopback proxy such as a local Clash or v2rayN port is still baked.

coderabbitai · 2026-10-18T16:33:12Z

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml
Review profile: ASSERTIVE
Plan: Advanced
Run ID: a23e840f-47b0-4f99-aadd-51ff9dc7d51d

📥 Commits

Reviewing files that changed from the base of the PR and between 8640c2f and 74e056e.

📒 Files selected for processing: 3

src/service/definition.ts
structure/runtime.md
tests/service/service.test.ts

+-------------------------------------------------------------------------+
| Performing code review exorcisms to the eerie strains of Tubular Bells. |
+-------------------------------------------------------------------------+
  \
   \     /)/)
        ( '')
        /  |
      o(___)

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-18T16:33:16Z

✅ Deterministic PR hygiene checks passed.

github-actions · 2026-10-18T16:33:30Z

⏳ DRAFT

review readiness checklist open (0/4 boxes ticked).

What to do

Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

⬜ Required local validation passed; commands, results, and any full-suite exception are documented.
⬜ I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).
⬜ I resolved all correct Codex and CodeRabbit findings.
⬜ My PR is ready for review.

0/4 boxes ticked.

Automatic draft conversion failed. Please convert this pull request to a draft manually until every box above is ticked.

Ingwannu · 2026-10-19T04:32:23Z

Intake/scoped review at 74e056e12af35cb9a9101b8360ebd7585bdbea5d.

Linked bug #7326 has a concrete inherited-proxy reproduction. The patch skips only the generated token-bearing loopback intercept URL, preserves a real tokenless local proxy and falls through to lowercase env where appropriate. The shared definition input covers systemd/launchd/Windows rendering, but the fixture is not a real service-reinstall receipt. Retain Draft and the service/proxy review gate.

Current-head functional workflows are awaiting fork approval; that is pending execution, not a passing test result. No local suite was run for this branch in this intake. No workflow approval, new scan, live configuration change or merge was performed. Required review/readiness gates remain in force.

chatgpt-codex-connector · 2026-10-19T06:07:44Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T06:15:29.136567Z	`74e056e`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 74e056e12a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-19T06:15:27Z

+ * proxy's own outbound traffic back through its intercept listener. Only the token-bearing form
+ * is matched: a plain `http://127.0.0.1:<port>` is a user's local proxy client and is kept.
+ */
+const OWN_CLAUDE_INTERCEPT_PROXY = /^http:\/\/opencodex:[^@/]+@127\.0\.0\.1:\d{1,5}\/?$/i;


Preserve proxies that merely use the opencodex username

When a user's real authenticated local proxy uses the username opencodex (for example, http://opencodex:pw@127.0.0.1:7897), this regex classifies it as the Claude intercept URL even though any nonempty password matches, so resolvedProxyEnv drops the user's configured proxy and the installed service can lose outbound connectivity. Match the generated credential's actual fixed 43-character base64url shape (or the known token) rather than every password for that username.

AGENTS.md reference: src/AGENTS.md:L10-L10

Useful? React with 👍 / 👎.

github-actions Bot added the bug Something isn't working label Oct 18, 2026

Ingwannu mentioned this pull request Oct 19, 2026

[Bug] Service install bakes Claude first-party's own intercept proxy as the outbound HTTPS_PROXY #7326

Closed

lidge-jun marked this pull request as ready for review October 19, 2026 06:07

lidge-jun requested review from Ingwannu and lidge-jun as code owners October 19, 2026 06:07

lidge-jun merged commit 1c5e963 into lidge-jun:dev Oct 19, 2026
6 checks passed

chatgpt-codex-connector Bot reviewed Oct 19, 2026

View reviewed changes

lidge-jun mentioned this pull request Oct 19, 2026

[WRONG BRANCH] release: promote dev 52c326b479 to main as 2.89.0 #7372

Merged

3 tasks done

Navigation Menu

Repository navigation

fix(service): never bake Claude first-party's own intercept proxy - #7327

fix(service): never bake Claude first-party's own intercept proxy#7327
lidge-jun merged 1 commit into
lidge-jun:devfrom
scy7796:fix/service-skip-own-intercept-proxy

scy7796 commented Oct 18, 2026 •

edited by github-actions Bot

Loading

Uh oh!

coderabbitai Bot commented Oct 18, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 18, 2026

Uh oh!

github-actions Bot commented Oct 18, 2026 •

edited

Loading

Uh oh!

Ingwannu commented Oct 19, 2026

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Oct 19, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

scy7796 commented Oct 18, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Checklist

Review readiness checklist

Uh oh!

coderabbitai Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 18, 2026

Uh oh!

github-actions Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⏳ DRAFT

What to do

Review readiness checklist

Uh oh!

Ingwannu commented Oct 19, 2026

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Oct 19, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

scy7796 commented Oct 18, 2026 •

edited by github-actions Bot

Loading

coderabbitai Bot commented Oct 18, 2026 •

edited

Loading

github-actions Bot commented Oct 18, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 19, 2026 •

edited

Loading