milestone-3: respect explicit TLS override in proxy tunnel

src/usage-api.ts

@@ -967,7 +967,7 @@ function createProxyTunnelAgent(proxyUrl: URL): https.Agent {
           const tlsSocket = tls.connect({
             socket: proxySocket,
             servername: String(options.servername ?? targetHost),
-            rejectUnauthorized: options.rejectUnauthorized !== false,
+            rejectUnauthorized: getProxyTunnelRejectUnauthorized(options.rejectUnauthorized),
           }, () => {
             settle(null, tlsSocket);
           });
@@ -990,6 +990,17 @@ function createProxyTunnelAgent(proxyUrl: URL): https.Agent {
   }();
 }
 
+export function getProxyTunnelRejectUnauthorized(
+  rejectUnauthorized: https.RequestOptions['rejectUnauthorized'],
+  env: NodeJS.ProcessEnv = process.env
+): boolean {
+  if (rejectUnauthorized === false) {
+    return false;
+  }
+
+  return env.NODE_TLS_REJECT_UNAUTHORIZED !== '0';
+}
+
 function fetchUsageApi(accessToken: string): Promise<UsageApiResult> {
   return new Promise((resolve) => {
     const host = 'api.anthropic.com';

tests/usage-api.test.js

@@ -19,6 +19,7 @@ let resolveKeychainCredentials;
 let getUsageApiTimeoutMs;
 let isNoProxy;
 let getProxyUrl;
+let getProxyTunnelRejectUnauthorized;
 let parseRetryAfterSeconds;
 let USAGE_API_USER_AGENT;
 
@@ -55,6 +56,7 @@ before(async () => {
     getUsageApiTimeoutMs,
     isNoProxy,
     getProxyUrl,
+    getProxyTunnelRejectUnauthorized,
     parseRetryAfterSeconds,
     USAGE_API_USER_AGENT,
   } = await import(`../dist/usage-api.js?cacheBust=${Date.now()}`));
@@ -1024,6 +1026,24 @@ describe('getUsage', () => {
   });
 });
 
+describe('getProxyTunnelRejectUnauthorized', () => {
+  test('defaults to strict TLS when no override is set', () => {
+    assert.equal(getProxyTunnelRejectUnauthorized(undefined, {}), true);
+  });
+
+  test('respects an explicit request override first', () => {
+    assert.equal(getProxyTunnelRejectUnauthorized(false, {}), false);
+  });
+
+  test('respects NODE_TLS_REJECT_UNAUTHORIZED=0 for proxy tunnels', () => {
+    assert.equal(getProxyTunnelRejectUnauthorized(undefined, { NODE_TLS_REJECT_UNAUTHORIZED: '0' }), false);
+  });
+
+  test('keeps TLS verification enabled for non-zero env values', () => {
+    assert.equal(getProxyTunnelRejectUnauthorized(undefined, { NODE_TLS_REJECT_UNAUTHORIZED: '1' }), true);
+  });
+});
+
 test('usage API user agent uses a non-empty claude-hud identifier', () => {
   assert.equal(USAGE_API_USER_AGENT, 'claude-code/2.1');
 });