From 6ddad59d2fb5f8e3bb1a6ecc19ff626c2f4b355e Mon Sep 17 00:00:00 2001
From: James Feng <47167674+GhostDragon124@users.noreply.github.com>
Date: Tue, 2 Jun 2026 00:14:22 +0800
Subject: [PATCH] fix: gate preconnectAnthropicApi behind
 isEssentialTrafficOnly()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CC_Pure:  was the last un-gated outbound
connection — it unconditionally sent a TCP+TLS handshake to
api.anthropic.com on every startup. Now checked against the central
privacy gate (CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1) and
skipped when enabled.

Verified via strace: zero remote connections after fix.
---
 src/utils/apiPreconnect.ts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/utils/apiPreconnect.ts b/src/utils/apiPreconnect.ts
index 6a8de649b..b914390e1 100644
--- a/src/utils/apiPreconnect.ts
+++ b/src/utils/apiPreconnect.ts
@@ -25,6 +25,7 @@
 
 import { getOauthConfig } from '../constants/oauth.js'
 import { isEnvTruthy } from './envUtils.js'
+import { isEssentialTrafficOnly } from './privacyLevel.js'
 
 let fired = false
 
@@ -32,6 +33,9 @@ export function preconnectAnthropicApi(): void {
   if (fired) return
   fired = true
 
+  // CC_Pure: skip preconnect when non-essential traffic is disabled
+  if (isEssentialTrafficOnly()) return
+
   // Skip if using a cloud provider — different endpoint + auth
   if (
     isEnvTruthy(process.env.CLAUDE_CODE_USE_BEDROCK) ||