[FEAT] Support Windows Integrated Authentication (NTLM/Negotiate) for Corporate Proxies + PAC file

Summary

Claude Code fails to connect through corporate proxy environments that require Windows Integrated Authentication (NTLM/Negotiate), while other tools in the same environment (like VSCode extensions) work correctly.

Environment

• OS: Windows 11 Enterprise (Corporate environment)
• Claude CLI version: Latest
• Proxy Infrastructure: Corporate proxy with authenticated gateway
• Authentication Required: NTLM/Negotiate (Windows Integrated Authentication)
• Network: Corporate firewall with authenticated proxy

Problem Description

Current Behavior

Claude Code consistently fails with connection errors when attempting to connect through corporate proxies that require Windows Integrated Authentication:

⎿ API Error (Connection error.) · Retrying in 1 seconds… (attempt 1/10)
⎿ TypeError (fetch failed)

Expected Behavior

Claude Code should successfully authenticate and connect through corporate proxies using Windows Integrated Authentication, similar to how VSCode extensions handle the same network environment.

Technical Investigation

Proxy Authentication Analysis

Testing the corporate proxy manually reveals the authentication requirements:

curl -v https://api.anthropic.com --proxy http://corporate-proxy:8080

# Response:
HTTP/1.1 407 authenticationrequired
Via: 1.1 [gateway-ip] (Corporate Secure Web Gateway)
Proxy-Authenticate: Negotiate
Proxy-Authenticate: NTLM
Proxy-Authenticate: Basic realm="Corporate Web Gateway"

Key findings:

1. Proxy requires multiple authentication methods: Negotiate, NTLM, Basic
2. Basic authentication with domain credentials fails (still returns 407)
3. Windows Integrated Authentication (NTLM/Negotiate) is the preferred/required method

Comparison with Working Tools

VSCode/Extensions (Working):

• Extensions like Cline successfully make Anthropic API calls
• Uses VSCode's built-in proxy handling with integrated authentication
• Network connections show established proxy tunnels: ESTABLISHED to corporate proxy

Claude Code (Failing):

• Cannot establish authenticated proxy connections
• Node.js fetch() doesn't support Windows Integrated Authentication out of the box
• Environment variables like HTTP_PROXY are insufficient for NTLM authentication

Network Analysis

netstat -ano | findstr ":8080"

# Shows VSCode processes with successful connections:
TCP    [local-ip]:[port]      [proxy-ip]:8080      ESTABLISHED     [pid]
TCP    [local-ip]:[port]      [proxy-ip]:8080      ESTABLISHED     [pid]

# While Claude Code connections fail to establish

Attempted Solutions

Environment Variables Tested

# Standard proxy configuration
HTTP_PROXY=http://corporate-proxy:8080
HTTPS_PROXY=http://corporate-proxy:8080

# With credentials (still fails due to NTLM requirement)
HTTP_PROXY=http://username:password@corporate-proxy:8080

# SSL bypass attempts
NODE_TLS_REJECT_UNAUTHORIZED=0

Authentication Methods Tested

1. Basic Authentication: Failed (proxy rejects basic auth for api.anthropic.com)
2. Credentials in URL: Failed (same reason)
3. Manual curl with credentials: Failed (requires NTLM)

---