fix(server): relay the Remote Control bridge with the client's own credential

[ianberdin]

Claude Code 2.1.287: "Fixed claude remote-control failing to register behind an HTTP proxy" (anthropics/claude-code#97352). With HTTPS_PROXY pointing at TeamClaude, the bridge's control calls now reach the request listener. CLIENT_CREDENTIAL_PATHS relays only /v1/code/ and /api/oauth/ with the client's own credential, so everything else the bridge sends gets a rotated fleet token. A daemon cannot opt out per process: settings.json env is applied over the process environment, and remote-control refuses a root --settings.

Symptom - one machine running claude remote-control under systemd, in the 4h after the update:

• POST /v1/environments/bridge registered the machine under whichever account rotation picked: five organization_uuid values in round-robin order over ~22 restarts. The login's own org appeared only when rotation landed on it.
• Creating the session then answered 404 Not found.
• The work poll drew a 401 from every account in turn. Its bearer is the environment secret that registration returned, not an OAuth token, so a fleet token in its place can only be refused; ack and heartbeat carry the work's session-ingress token the same way. TeamClaude logged 1286 "token rejected" lines in those 4h, against 31 in the 24h before.
• The daemon dropped ~5s after "Ready", retried for ~11 min, exited, and was restarted. The phone could not reach the machine.

Change - add /v1/environments/, /v1/sessions/, /v2/session_ingress/ and /v2/ccr-sessions/ to CLIENT_CREDENTIAL_PATHS, the whole prefix as with /api/oauth/ in #245. The paths are from the 2.1.287 bundle: /v1/environments/bridge, /bridge/{id}/offline, /{id}/bridge/reconnect, /{id}/work/poll, /{id}/work/{work}/ack|heartbeat|stop; POST /v1/sessions, /v1/sessions/{id}, /events; the session MCP endpoints /v2/session_ingress/shttp/mcp/{id} and /v2/ccr-sessions/-/meta/mcp.

• Each entry ends in /, so it stops at a segment boundary (/v1/sessionsX still rotates). The entry without that slash, the collection itself, matches too: a session is created with a bare POST /v1/sessions, and classificationPath() has already dropped the ?beta=true. The rule moves into isClientCredentialPath(). It also takes the bare /v1/code and /api/oauth, which no client sends.
• WebSocket upgrades (/v2/session_ingress/mcp/ws/{id}) already keep the client's headers through relayUpgrade; this covers the plain requests.
• As with /api/oauth/* since fix(server): relay all /api/oauth/* with the client's own credential #245, a client with no login of its own now gets a 401 on these paths instead of a rotated token. The two /v1 prefixes also serve the public Managed Agents API (managed-agents-2026-04-01). Its environments and sessions belong to the organization that created them, so rotation could not serve them across a multi-org pool anyway.
• fix(server): relay /api/frame/* with the client's own credential #498 edits the same CLIENT_CREDENTIAL_PATHS line. Whichever lands second rebases: keep both comments and the union of entries. /api/frame/ works unchanged under the new predicate.

Tested - npm test: 2592 pass, 0 fail, 5 skipped (as on master). 15 new tests in test/remote-control-bridge-relay.test.js:

• 13 assert that a bridge path keeps the client's credential, its path and its body, with an account manager that throws if consulted. All 13 fail on master.
• 2 assert that /v1/sessionsX and /v1/environmentsX/bridge still rotate. Both fail if the entries are spelled without the trailing slash.

Inference rotating is already covered in test/oauth-client-credential.test.js. npm run lint, npm run typecheck and the strict ratchet (1703, unchanged) are clean on Node 22.12.0.

Live, the same prefixes as a hotfix on 1.1.22 on the affected machine (spelled there as plain /v1/environments and /v1/sessions): registration landed in the login's own org while the proxy's active account was a different one. Reconnect, poll, ack and heartbeat all answered 200, with no 401s.

🤖 Generated with Claude Code