Client Certificate Support for WebSocket Proxies

What: WebSocket connections now support HTTPS proxies with client certificate authentication (mTLS).

How to use: Configure client certificates via environment variables:

export CLAUDE_CODE_CLIENT_CERT=/path/to/cert.pem
export CLAUDE_CODE_CLIENT_KEY=/path/to/key.pem
export CLAUDE_CODE_CLIENT_KEY_PASSPHRASE=optional_passphrase

Details:

• New CFA() function creates per-request proxy agents with certificate support
• Applies to both API requests and WebSocket connections
• Respects proxy bypass rules on a per-URL basis
• Replaces global proxy agent pattern with per-connection agents
• Evidence: CFA() function at line 151929, WebSocket usage at line 488707, API usage at lines 483464 and 483483