fix(pipelock): passthrough api.anthropic.com so Claude auth/chat works

Pipelock's BIP-39 seed-phrase scanner fires on Anthropic Messages API
bodies because user-authored conversation text can hit 12 consecutive
BIP-39 dictionary words that pass the checksum, returning a 403
`blocked: request body contains secret: BIP-39 Seed Phrase` that the
Claude CLI surfaces as `Please run /login`. Pipelock's `suppress`
section only covers git/file findings, not the inline body scanner,
so the recommended treatment for LLM endpoints is
`tls_interception.passthrough_domains`: CONNECT is still allowlist-
gated, but the body is not MITM'd. The existing body-scan integration
test moves to `raw.githubusercontent.com` so it still pins TLS body
DLP on non-passthrough'd hosts.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

claude_bottle/pipelock.py

@@ -30,6 +30,22 @@ DEFAULT_ALLOWLIST: tuple[str, ...] = (
     "raw.githubusercontent.com",
 )
 
+# Hosts pipelock should NOT TLS-MITM, even when tls_interception is
+# enabled. The Claude API endpoint is an LLM provider — its request
+# bodies are user-authored conversation text that legitimately can
+# trigger DLP scanners (notably the BIP-39 seed-phrase detector, which
+# fires on any 12+ consecutive English words that happen to be on the
+# BIP-39 wordlist and pass the checksum). Per pipelock's own
+# configuration.md, the recommended treatment for LLM API endpoints is
+# `passthrough_domains`: pipelock still proxies the CONNECT (so the
+# api_allowlist gate applies), but it does not generate a leaf cert or
+# decrypt the body. Body scanning happens on hosts that aren't
+# passthrough'd, so DLP protection against agent exfil to other
+# allowlisted hosts is unchanged.
+DEFAULT_TLS_PASSTHROUGH: tuple[str, ...] = (
+    "api.anthropic.com",
+)
+
 
 # --- Allowlist resolution --------------------------------------------------
 
@@ -119,6 +135,7 @@ def pipelock_build_config(
             "enabled": True,
             "ca_cert": ca_cert_path,
             "ca_key": ca_key_path,
+            "passthrough_domains": list(DEFAULT_TLS_PASSTHROUGH),
         }
     return cfg
 
@@ -158,6 +175,11 @@ def pipelock_render_yaml(cfg: dict[str, object]) -> str:
         lines.append(f"  enabled: {_bool(tls['enabled'])}")
         lines.append(f'  ca_cert: "{tls["ca_cert"]}"')
         lines.append(f'  ca_key: "{tls["ca_key"]}"')
+        passthrough = cast(list[str], tls.get("passthrough_domains", []))
+        if passthrough:
+            lines.append("  passthrough_domains:")
+            for d in passthrough:
+                lines.append(f'    - "{d}"')
     return "\n".join(lines) + "\n"