Corporate Proxies

SOCKS keeps TLS end-to-end, so cert verification works untouched. A forward proxy that re-encrypts with its own certificate is a different story.

SOCKS proxies

Because SOCKS doesn't terminate TLS, agentty's certificate verification works exactly as it does on a direct connection. This is also why air-gap mode is safe over an untrusted network.

AGENTTY_SOCKS_PROXY=127.0.0.1:1080 agentty

TLS-terminating proxies (Zscaler, Bluecoat, mitmproxy)

If your network routes through a forward proxy that re-encrypts traffic with its own CA, install that CA into the system trust store — agentty picks up system roots at startup:

# Debian / Ubuntu
sudo cp corp-proxy-ca.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

# Fedora / RHEL
sudo cp corp-proxy-ca.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

Streaming through corporate VPNs

Some endpoint-security gateways keep the connection open but buffer SSE model events, so short replies arrive in one burst and older agentty builds report stream stalled — no events for 120s on larger tasks. Current builds:

• request no-cache, no-transform and uncompressed event streams,
• treat HTTP/2 control traffic as transport liveness while retaining a hard deadline,
• fall back to incremental TLS HTTP/1.1 streaming when a gateway removes h2 from ALPN.

Update agentty if you see the exact 120-second error. Streaming may still appear in bursts when company policy forces buffering—the client cannot make an intermediary reveal bytes it withholds—but the request will continue instead of being cancelled while the bounded connection remains alive.

Last resort

If you genuinely can't install the CA, you can disable peer verification:

AGENTTY_INSECURE=1 agentty