Add HTTP proxy server for Claude Code sandbox mode

[tlockney]

Summary

This PR introduces claude-proxy, a new HTTP/HTTPS proxy server designed to work with Claude Code's sandbox mode. It allows users to control which domains their sandboxed code can access through a configurable allowlist.

Key Changes

• New executable: bin/claude-proxy - A Deno-based proxy server that:

  • Listens on a configurable port (default: 8080)
  • Supports both HTTP and HTTPS (via CONNECT tunneling)
  • Enforces domain allowlisting with wildcard pattern support
  • Provides configurable logging levels (quiet, normal, verbose)

• Configuration system:

  • JSON config file support at ~/.config/claude-proxy/config.json
  • CLI argument overrides (--allow, --port, --log-level, --config)
  • Merges CLI domains with config file domains for flexibility

• Domain matching:

  • Exact domain matching (e.g., "github.com")
  • Wildcard subdomain matching (e.g., "*.github.com")
  • Case-insensitive comparison

• HTTP proxy features:

  • Handles standard HTTP requests with full URL rewriting
  • Implements HTTP CONNECT tunneling for HTTPS
  • Bidirectional piping for efficient data transfer
  • Filters proxy-specific headers (Proxy-Authorization, Proxy-Connection)
  • Proper error handling with appropriate HTTP status codes (403 for blocked, 502 for connection failures)

Notable Implementation Details

• Uses Deno's built-in networking APIs for connection handling
• Implements custom I/O utilities (writeAll, pipe) for reliable data transfer
• Supports IPv6 addresses in CONNECT requests
• Includes comprehensive help text with usage examples and Claude Code settings integration instructions
• Graceful error handling with connection cleanup

https://claude.ai/code/session_01SLwXju59WZmk97fSJbrW5S