feat(reddit): proxy-mode client support + deployment guide

plugins/claude-code/reddit/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "reddit",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Fetch Reddit posts, comments, and subreddit listings via Reddit's public JSON API. Returns markdown-formatted content suitable for LLM consumption. No authentication required.",
   "author": {
     "name": "Nathan Heaps",

plugins/claude-code/reddit/README.md

@@ -57,6 +57,24 @@ reddit-fetch.sh subreddit programming --after t3_abc123 --limit 10
 | `--after`        | Pagination cursor for next page   | none     |
 | `--exclude-nsfw` | Exclude NSFW posts                | included |
 
+## Proxy Mode (egress-restricted environments)
+
+By default the script fetches directly from `https://www.reddit.com`. In environments where outbound traffic to reddit.com is blocked (e.g. agent containers with SNI-based egress filtering), you can route requests through an operator-deployed APISIX proxy (built from off-the-shelf components — see the deployment guide below).
+
+Set these environment variables before running the script:
+
+| Variable              | Description                                               | Default    |
+| --------------------- | --------------------------------------------------------- | ---------- |
+| `REDDIT_PROXY_URL`    | Base URL of the proxy (e.g. `https://proxy-api.host.com`) | _(direct)_ |
+| `REDDIT_PROXY_TOKEN`  | Per-agent authentication key issued by the proxy          | _(none)_   |
+| `REDDIT_PROXY_HEADER` | Header name used to send the token                        | `apikey`   |
+
+When `REDDIT_PROXY_URL` is set, all API requests go through the proxy. Output `**Link**:` lines always show canonical `www.reddit.com` URLs regardless of this setting, so links remain valid for humans browsing Reddit.
+
+**The proxy is off by default** — normal usage requires no proxy configuration.
+
+See [`docs/proxy-deployment.md`](docs/proxy-deployment.md) for the full operator guide (reference architecture, Cloudflare Zero Trust setup, security model, and operational runbook). The plugin ships only the client-side env-var support above — standing up the proxy is an infrastructure task.
+
 ## Rate Limiting
 
 The script enforces a 6-second minimum gap between requests to respect Reddit's unauthenticated rate limits. HTTP 429 responses trigger automatic retries with backoff (up to 3 attempts).