feat: add ANTHROPIC_BASE_URL proxy support with optional TLS skip

[Steffen025]

Summary

• Adds ANTHROPIC_BASE_URL support to route API requests through a custom proxy/gateway
• Adds ANTHROPIC_INSECURE to optionally skip TLS verification (double-gated: only active when ANTHROPIC_BASE_URL is also set)
• New src/proxy.ts module with 24 tests

Problem

Users behind API gateways, corporate proxies, or monitoring layers (e.g. LiteLLM, custom logging proxies) cannot use the plugin because all requests go directly to api.anthropic.com. There's no way to reroute traffic through an intermediary.

Solution

Two opt-in environment variables:

Variable	Purpose	Example
ANTHROPIC_BASE_URL	Override the API origin (protocol + host)	https://proxy.internal:8443
ANTHROPIC_INSECURE	Skip TLS verification (for self-signed certs)	1 or true

Safety design

• ANTHROPIC_INSECURE is double-gated — it has no effect unless ANTHROPIC_BASE_URL is also set. This prevents accidentally disabling TLS against the production Anthropic API.
• URLs with embedded credentials (user:pass@host) are rejected.
• Non-HTTP(S) protocols are rejected.
• When neither variable is set, behavior is identical to before — zero impact on existing users.

Integration

The change to fetch.ts is minimal (4 lines):

// Before:
const reqInput = addBetaParam(input);
// ...
let response = await fetch(reqInput, { ...init, body, headers: reqHeaders });

// After:
const reqInput = rewriteOrigin(addBetaParam(input));
// ...
let response = await fetch(reqInput, {
  ...init, body, headers: reqHeaders,
  ...(isInsecure() && { tls: { rejectUnauthorized: false } }),
} as RequestInit);

New module: src/proxy.ts

Function	Purpose
resolveBaseUrl()	Parse and validate ANTHROPIC_BASE_URL
isInsecure()	Check if TLS skip is active (requires both env vars)
rewriteOrigin()	Rewrite request origin preserving path and query

Tests

24 new tests covering:

• URL parsing (valid HTTPS, HTTP, invalid, empty, whitespace)
• Credential rejection, unsupported protocols
• TLS gating (requires both env vars)
• Origin rewriting for string, URL, and Request inputs
• Path/query preservation, no-op when same origin

All 115 tests pass (91 existing + 24 new):

bun test v1.3.10
 115 pass
 0 fail
 149 expect() calls
Ran 115 tests across 7 files.

[cemalturkcan]

A few things to fix before merging:

1. Retry path drops the TLS skip

Initial fetch gets tls: { rejectUnauthorized: false } but handleRetryableError doesn't carry it through. First request works against a self-signed proxy, retry breaks.

2. Path in base URL gets silently ignored

ANTHROPIC_BASE_URL=https://proxy.company.com/anthropic the /anthropic part disappears. Requests go to https://proxy.company.com/v1/messages with no warning. Either join the path or reject URLs with a path and log why.

3. Silent catch in rewriteOrigin

Catch block returns original input without logging. If rewriting fails, requests silently go to api.anthropic.com. Add a log.warn.

4. No startup log when proxy is active

Only debug-level per-request log. Should have an info/warn at startup when proxy is configured.

5. Type cast

as RequestInit hides the Bun-specific tls property. Use BunFetchRequestInit.

[cemalturkcan]

(

[Steffen025]

All five points addressed:

1. Retry TLS — tlsOpts extracted and passed through to handleRetryableError
2. Path in base URL — URLs with a path are now rejected with a log hint suggesting the origin-only form
3. Silent catch — rewriteOrigin now logs a warning on failure
4. Startup log — log.info("Proxy configured", { baseUrl, insecure }) on first resolve
5. Type cast — Introduced BunFetchRequestInit type instead of as RequestInit

Also cached resolveBaseUrl() result for the process lifetime and added resetProxyCache() for test isolation.

116 tests pass, lint clean.

[cemalturkcan]

Looks good

[github-actions]

🎉 This PR is included in version 1.5.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀