Claude Code CLI "Connection refused" on Windows behind corporate proxy (CNTLM)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Environment:

Claude Code v2.1.267 (latest)
Windows 11 Enterprise
Behind corporate proxy via CNTLM (local relay on 127.0.0.1:3128)
What works:

Claude Code VS Code extension connects fine (proxy set via claudeCode.environmentVariables)
Invoke-WebRequest -Uri "https://api.anthropic.com" -Proxy "http://127.0.0.1:3128" returns 404 (proves proxy chain reaches Anthropic)
CNTLM is running, port 3128 is listening and accepting connections
What fails:

Claude Code CLI in terminal gets "Connection refused — a firewall or proxy may be blocking it" after 10 retries
Same terminal, same env vars, same machine
Environment variables confirmed in the failing terminal:

HTTPS_PROXY = http://127.0.0.1:3128
HTTP_PROXY = http://127.0.0.1:3128
NODE_EXTRA_CA_CERTS = C:\Users\...\bosch-ca-bundle.pem (16 KB, exists)
Also tried:

NODE_TLS_REJECT_UNAUTHORIZED=0 — still fails
Proxy is reachable (Test-NetConnection 127.0.0.1 -Port 3128 → TcpTestSucceeded: True)
Conclusion: The CLI appears to not use HTTP_PROXY/HTTPS_PROXY environment variables, or uses a different connection path than the VS Code extension.

What Should Happen?

The Claude Code CLI should respect the standard HTTP_PROXY / HTTPS_PROXY environment variables and route API requests through the configured proxy, the same way the VS Code extension does. When a valid proxy is running and reachable, the CLI should connect successfully instead of failing with "Connection refused."

Error Messages/Logs

Steps to Reproduce

Be on a corporate network behind a proxy that requires authentication (e.g. using CNTLM as a local relay on 127.0.0.1:3128)
Set user environment variables:
HTTP_PROXY=http://127.0.0.1:3128
HTTPS_PROXY=http://127.0.0.1:3128
NODE_EXTRA_CA_CERTS=C:\Users\<user>\.claude\bosch-ca-bundle.pem
Confirm proxy is running: Test-NetConnection -ComputerName 127.0.0.1 -Port 3128 → TcpTestSucceeded: True
Confirm proxy chain reaches Anthropic: Invoke-WebRequest -Uri "https://api.anthropic.com" -Proxy "http://127.0.0.1:3128" → returns HTTP 404 (server reached)
Open a terminal (PowerShell or cmd)
Run claude
Type any prompt (e.g. "hi")
Observe: "Connection refused — a firewall or proxy may be blocking it" after 10 retries
Note: The VS Code extension works fine on the same machine with the same proxy, configured via claudeCode.environmentVariables in VS Code settings.

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

v2.1.267

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

_No response_