Hello, Claude Code cloud sessions run inside a sandbox whose egress proxy only allows an allowlist of hosts, and it scopes

<http://github.com|github.com>

to this one repository — any other GitHub URL returns 403. That's fatal for Pants specifically because of how it's distributed: since 2.18, Pants isn't published to PyPI at all (wheels stopped at 2.17.1); the official installer (

get-pants.sh

) downloads the scie-pants launcher from GitHub release assets, which then downloads the Pants distribution itself from GitHub release assets. Both hops 403 in the sandbox, so

pants

can't even be installed, and there's no package-manager fallback. Installing Pants is only half the problem. At runtime Pants downloads three more binaries from GitHub releases — pex (required by every Python goal), ruff, and buildifier — so even a hand-delivered

pants

binary would fail on the first

fmt/lint/test/check

. Wondering if anyone has thought about this specific case. The only alternatives I've found are to mirror.

If you ask Claude to read slack, and Pants and scie-pants issues and discussions (or you do) you'll learn a lot.

Hint: PANTS_BOOTSTRAP_URLS env-var can remap the scie-pants assets. Further code.claude.com/docs/en/claude-code-on-the-web#… lists

release-assets.githubusercontent.com

which is where github stuff is hosted. I dont have the subscription to actually verify this works but unless im missing something anthropic intends this to "just work".

I have run into a similar issue with the bootstrap step. The problem I ran into, per claude was:

scie-pants fetches the Pants PEX with its bundled CPython 3.14,

whose default ssl context enables VERIFY_X509_STRICT; strict verification

rejects the proxy CA (it lacks a Key Usage extension)

The proxy in this case is the proxy that claude code runs to MITM traffic. It can be disabled for certain urls by . setting NO_PROXY/no_proxy. here's what I set it to for the initial download:

<http://github.com|github.com>,<http://githubusercontent.com|githubusercontent.com>,<http://codeload.github.com|codeload.github.com>

Currently, I'm using a claude session hook that sets no_proxy/NO_PROXY only for the initial call to

pants

that triggers the download. Once I do that, I haven't had any issues with using pants via claude code in the web to build pex's, run fmt/lint/test/check etc so not sure what to tell you there.

Based on the Claide Code GitHub proxy docs, this is just something happening in the "Claude Code on the Web", right? So why not go local? How performant is Pants in a cloud sandbox any way?

Correct, there is no issue running this locally. The cloud sandbox is actually fine for most build tasks, I haven't run into any massive issues.