[BUG] Claude Code on the Web: Gradle wrapper fails to download distribution - Java doesn't honor https_proxy

---

Found 3 possible duplicate issues:

1. https://github.com/anthropics/claude-code/issues/13372
2. https://github.com/anthropics/claude-code/issues/12752
3. https://github.com/anthropics/claude-code/issues/11220

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

I tried setting various JAVA_TOOL_OPTIONS to try to work around this, but I always got auth errors no matter what I tried (Claude seems to think Gradle isn't setting up basic auth correctly).

I tried vendoring everything but git lfs doesn't seem to work either:

git lfs pull 2>&1
Use `git lfs logs last` to view the log.
batch response: Fatal error: Server error &{%!!(string=http) %!!(string=) %!!(*url.Userinfo=&{local_proxy  false}) %!!(string=127.0.0.1:18439) %!!(string=/git/brendanlong/lion-reader.git/info/lfs/objects/batch) %!!(string=) %!!(bool=false) %!!(bool=false) %!!(string=) %!!(string=) %!!(string=)}s(MISSING) from HTTP 502

Errors logged to '/home/user/lion-reader/.git/lfs/logs/20260111T215435.016064847.log'.
Use `git lfs logs last` to view the log.
batch response: Fatal error: Server error &{%!!(string=http) %!!(string=) %!!(*url.Userinfo=&{local_proxy  false}) %!!(string=127.0.0.1:18439) %!!(string=/git/brendanlong/lion-reader.git/info/lfs/objects/batch) %!!(string=) %!!(bool=false) %!!(bool=false) %!!(string=) %!!(string=) %!!(string=)}s(MISSING) from HTTP 502

Errors logged to '/home/user/lion-reader/.git/lfs/logs/20260111T215435.017303518.log'.
Use `git lfs logs last` to view the log.
Failed to fetch some objects from 'http://local_proxy@127.0.0.1:18439/git/brendanlong/lion-reader.git/info/lfs'... +12 lines

This is really annoying

As a work-around, try setting the http.proxyHost and related settings in the /root/.gradle/gradle.properties file in the sandbox.

🤖 Claude suggested this work-around, and it worked for me:

PROXY_HOST=$(echo "$https_proxy" | sed 's|.*@||' | sed 's|:.*||') && PROXY_PORT=$(echo "$https_proxy" | sed 's|.*:||') && PROXY_USER=$(echo "$https_proxy" | sed 's|http://||' | sed 's|@.*||' | sed 's|:.*||') && PROXY_PASS=$(echo "$https_proxy" | sed 's|http://||' | sed 's|@.*||' | sed 's|^[^:]*:||') && cat > /root/.gradle/gradle.properties << PROPEOF 
systemProp.http.proxyHost=$PROXY_HOST
systemProp.http.proxyPort=$PROXY_PORT
systemProp.http.proxyUser=$PROXY_USER
systemProp.http.proxyPassword=$PROXY_PASS
systemProp.https.proxyHost=$PROXY_HOST
systemProp.https.proxyPort=$PROXY_PORT
systemProp.https.proxyUser=$PROXY_USER
systemProp.https.proxyPassword=$PROXY_PASS
systemProp.jdk.http.auth.tunneling.disabledSchemes=
systemProp.jdk.http.auth.proxying.disabledSchemes=
PROPEOF

After this, the ./gradlew <cmd> Gradle wrapper commands were able to download the configured distribution and work as expected.

We're hitting the same problem class on the local sandbox (sandbox.enabled via enterprise
managed settings) — not just Claude Code on the Web. Claude Code 2.1.220, Ubuntu 26.04 aarch64
(bubblewrap), Bedrock auth, managed-domains-only allowlist (internal Cloudsmith Maven mirror).

Local-sandbox repro (Maven Wrapper, empty ~/.m2)

The sandbox injects HTTPS_PROXY=http://srt:<per-session-token>@localhost:3128. Running
./mvnw inside a sandboxed Bash command:

1. Wrapper jar download (shell/wget): works — wget reads the credentials out of

$HTTPS_PROXY itself.

1. Maven distribution download (Java DefaultDownloader): cannot be made to work.

• No proxy sysprops → java.net.UnknownHostException (expected — no direct egress in the netns).
• With `-Dhttps.proxyHost=localhost -Dhttps.proxyPort=3128 -Dhttps.proxyUser=… -Dhttps.proxyPassword=…

-Djdk.http.auth.tunneling.disabledSchemes=`:

``
java.io.IOException: Unable to tunnel through proxy. Proxy returns "HTTP/1.1 407 Proxy Authentication Required"
at java.base/sun.net.www.protocol.http.HttpURLConnection.doTunneling0(...)
at org.apache.maven.wrapper.DefaultDownloader.download(DefaultDownloader.java:85)
``

This is unfixable from user config: https.proxyUser/proxyPassword are not JDK properties
(absent from the Networking Properties doc);
the JDK only sends Proxy-Authorization via a programmatically registered
java.net.Authenticator, and only after a 407 challenge
(JDK-8210814). Oracle closed the exact
Gradle/Maven-wrapper 407 scenario as expected behavior
(JDK-8171351). The Maven Wrapper itself has no
proxy-auth support (MWRAPPER-46, open
since 2021). So for raw-JDK downloaders the per-session-credential proxy is a hard wall, and
tools that do implement proxy auth (Maven core via settings.xml, Gradle via systemProp.*)
need their config regenerated every session because the credentials rotate.