{"version":"2.1.238","anchor":"a-403-from-a-corporate-proxy-no-longer-looks-like-a-permanen","canonical_anchor":"a-403-from-a-corporate-proxy-no-longer-looks-like-a-permanen","heading":"A 403 from a corporate proxy no longer looks like a permanent rejection","tier":"notice","area":"Internals","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.238\/e\/a-403-from-a-corporate-proxy-no-longer-looks-like-a-permanen","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.238","markdown":"### A 403 from a corporate proxy no longer looks like a permanent rejection\n\nA 403 injected by your corporate proxy is retried as an outage instead of a hard refusal.\n\n**What**\n\nStreaming connections and the bridge credential fetch now check whether a 403 came from Anthropic's own servers or was injected in front of them. A 403 from something else is treated as a temporary outage: the connection keeps retrying instead of giving up, and the bridge treats it as unreachable rather than as a real refusal, until it repeats past a threshold and is finally accepted as one.\n\n**Details**\n\n- Repeated non-origin 403s are tracked as a streak with attempt count, window and gap, and recovery is logged as `cli_sse_nonorigin_403_recovered`.\n- Disconnect reasons can now state how long the refusal lasted.\n- The bridge side sits behind `tengu_ethereal_mist`, whose compiled fallback is on; the effective value comes from remote config.\n\n**Evidence**\n\n`cli_sse_nonorigin_403_recovered`\n\n- Flag `tengu_ethereal_mist`: Not enough to say (read for one account on one subscription tier against v2.1.238; this account: no value returned, anonymous baseline: no value returned, compiled default: on)\n- Area: Internals\n- Tier: You'll notice\n- Useful: 4\/5\n- Signal: 3\/5"}