feat: add upstream proxy support

config.example.yaml

@@ -12,6 +12,7 @@ server:
 # Upstream Anthropic API
 upstream:
   url: https://api.anthropic.com
+  # proxy: "http://user:pass@host:port"  # Optional: upstream proxy for API requests
 
 # OAuth - gateway manages token lifecycle centrally
 # Step 1: On admin machine, run `claude` and do browser OAuth login

package.json

@@ -14,6 +14,7 @@
     "test": "tsx tests/rewriter.test.ts"
   },
   "dependencies": {
+    "https-proxy-agent": "^9.0.0",
     "yaml": "^2.7.0"
   },
   "devDependencies": {

src/config.ts

@@ -17,6 +17,7 @@ export type Config = {
   }
   upstream: {
     url: string
+    proxy?: string  // e.g. http://user:pass@host:port
   }
   auth: {
     tokens: TokenEntry[]

src/index.ts

@@ -12,7 +12,7 @@ try {
   log('info', 'CC Gateway starting...')
 
   // Initialize OAuth first - gateway manages the token lifecycle
-  await initOAuth(config.oauth.refresh_token)
+  await initOAuth(config.oauth.refresh_token, config.upstream.proxy)
 
   startProxy(config)
 } catch (err) {

src/oauth.ts

@@ -1,4 +1,5 @@
 import { request as httpsRequest } from 'https'
+import { HttpsProxyAgent } from 'https-proxy-agent'
 import { log } from './logger.js'
 
 const TOKEN_URL = 'https://platform.claude.com/v1/oauth/token'
@@ -24,7 +25,10 @@ let cachedTokens: OAuthTokens | null = null
  * The gateway holds the refresh token and manages access token lifecycle.
  * Client machines never need to contact platform.claude.com.
  */
-export async function initOAuth(refreshToken: string): Promise<void> {
+let proxyAgent: HttpsProxyAgent<string> | undefined
+
+export async function initOAuth(refreshToken: string, proxyUrl?: string): Promise<void> {
+  if (proxyUrl) proxyAgent = new HttpsProxyAgent(proxyUrl)
   log('info', 'Refreshing OAuth token...')
   cachedTokens = await refreshOAuthToken(refreshToken)
   log('info', `OAuth token acquired, expires at ${new Date(cachedTokens.expiresAt).toISOString()}`)
@@ -87,6 +91,7 @@ function refreshOAuthToken(refreshToken: string): Promise<OAuthTokens> {
           'Content-Type': 'application/json',
           'Content-Length': String(Buffer.byteLength(body)),
         },
+        ...(proxyAgent ? { agent: proxyAgent } : {}),
       },
       (res) => {
         const chunks: Buffer[] = []

src/proxy.ts

@@ -3,6 +3,7 @@ import { createServer as createHttpServer, type IncomingMessage, type ServerResp
 import { readFileSync } from 'fs'
 import { request as httpsRequest } from 'https'
 import { URL } from 'url'
+import { HttpsProxyAgent } from 'https-proxy-agent'
 import type { Config } from './config.js'
 import { authenticate, initAuth } from './auth.js'
 import { getAccessToken } from './oauth.js'
@@ -13,10 +14,12 @@ export function startProxy(config: Config) {
   initAuth(config)
 
   const upstream = new URL(config.upstream.url)
+  const proxyAgent = config.upstream.proxy ? new HttpsProxyAgent(config.upstream.proxy) : undefined
+  if (proxyAgent) log('info', `Using upstream proxy: ${config.upstream.proxy!.replace(/:([^:@]+)@/, ':***@')}`)
   const useTls = config.server.tls?.cert && config.server.tls?.key
 
   const handler = (req: IncomingMessage, res: ServerResponse) => {
-    handleRequest(req, res, config, upstream)
+    handleRequest(req, res, config, upstream, proxyAgent)
   }
 
   let server
@@ -46,6 +49,7 @@ async function handleRequest(
   res: ServerResponse,
   config: Config,
   upstream: URL,
+  proxyAgent?: HttpsProxyAgent<string>,
 ) {
   const method = req.method || 'GET'
   const path = req.url || '/'
@@ -135,6 +139,7 @@ async function handleRequest(
         host: upstream.host,
         'content-length': String(body.length),
       },
+      ...(proxyAgent ? { agent: proxyAgent } : {}),
     },
     (proxyRes) => {
       const status = proxyRes.statusCode || 502