Skip to content

v0.9.22

Choose a tag to compare

View all tags
@depletionmode depletionmode released this 04 May 08:49
· 52 commits to main since this release
v0.9.22
4236587
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

This release switches the Claude Code bridges (CCRv1 and CCRv2) to always-on TLS with dynamically-issued, per-SNI self-signed leaf certificates. Recent Claude Code releases require wss:// / https:// for --sdk-url, and this drops the per-environment TLS configuration burden entirely.

Claude Bridge

  • TLS is now mandatory and automatic for both CCRv1 (WebSocket) and CCRv2 (HTTP+SSE). The TLS enable toggle has been removed from CLI and web settings.
  • Per-SNI dynamic leaf certificates: a self-signed CA is created on first run and persisted at ~/.praxis_bridge_ca_cert.pem (key file chmodded 0600 on Unix). Whatever hostname the client requests via SNI gets a freshly-minted, cached leaf certificate signed by that CA — no domain configuration required.
  • CCRv2 listener overhaul: replaced axum_server::bind_rustls with a hand-rolled TlsListener. TCP accepts and TLS handshake failures are now logged at DEBUG/WARN; previously these were silent drops, masking ALPN and handshake issues.
  • ALPN left empty: ALPN negotiation triggered post-handshake disconnects from Claude Code's ws layer. HTTP/1.1 vs HTTP/2 detection still works via the connection preface.
  • Config cleanup: removed all TLS toggles and domain keys from service_config and the dispatch client.

UI

  • CLI Service settings tab: replaces the TLS toggle with a static "TLS (wss/https, per-SNI cert)" line and a note pointing at the CA path.
  • Web SettingsModal: same treatment; CCRv1/v2 URL hints are now hard-coded to wss:// / https://.

Docs

  • docs/src/connectors/claude-bridge.md: documents the per-SNI flow, CA file location, NODE_EXTRA_CA_CERTS / NODE_TLS_REJECT_UNAUTHORIZED=0 workflows, and Claude's --sdk-url allowlist (with the DNS / /etc/hosts redirection pattern operators need).
  • Hoisted callout that CLAUDE_CODE_USE_CCR_V2=1 is mandatory for HTTPS — without it, Claude Code silently fails to open the connection.
  • docs/src/reference/config.md: dropped removed TLS keys.

CI / Packaging

  • AUR package: pkgrel resets to 1 whenever pkgver changes.
  • AUR package: adds /usr/bin/praxis symlink to praxis_cli.
  • AUR update workflow now triggers itself rather than being chained from release.yml.

Breaking changes

  • TLS toggle removed: any custom configuration that set the TLS enable flag or the bridge domain in service_config will be ignored. Both bridges now serve TLS unconditionally.
  • CCRv1 start() signature: now requires Arc<rustls::ServerConfig>. Affects anyone embedding the service crate directly.

Upgrading

After upgrading, point Claude Code at the bridge using wss:// / https://. To trust the bridge CA without redirecting an Anthropic hostname:

NODE_EXTRA_CA_CERTS=~/.praxis_bridge_ca_cert.pem claude --sdk-url wss://<host>:<port>

For CCRv2 you must also set CLAUDE_CODE_USE_CCR_V2=1. See docs/connectors/claude-bridge.md for the full setup including the --sdk-url allowlist workaround.

Assets 4
Loading