feat(daemon)!: make official proxy capture opt-in via --capture-official

By default the daemon no longer spawns the implicit proxy for the
official Anthropic upstream, so `cc use official` traffic now flows
direct to Anthropic instead of being captured. Capture is opt-in via
a new `--capture-official` flag on `daemon start`/`restart`.

A user-defined alias that explicitly points at https://api.anthropic.com
still gets its own proxy as before — only the implicit, always-on
official proxy is now gated.

- dedupe_upstreams(storage, capture_official): gate the official append
- thread the flag through LifecycleConfig::from_storage, DaemonAction,
  handle_start, and the CLI
- soften the build_official_env "direct" message to be accurate whether
  the daemon is down or capture is simply disabled

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Linuxdazhao

src/cli/cli.rs

@@ -337,6 +337,11 @@ pub enum DaemonCommands {
         /// Increase verbosity (-v info, -vv debug, -vvv trace)
         #[arg(short = 'v', long = "verbose", action = clap::ArgAction::Count)]
         verbose: u8,
+
+        /// Capture `cc use official` traffic through the daemon proxy.
+        /// Off by default — official traffic flows direct to Anthropic.
+        #[arg(long = "capture-official")]
+        capture_official: bool,
     },
     /// Stop the running daemon
     Stop,
@@ -359,6 +364,11 @@ pub enum DaemonCommands {
         /// Increase verbosity (-v info, -vv debug, -vvv trace)
         #[arg(short = 'v', long = "verbose", action = clap::ArgAction::Count)]
         verbose: u8,
+
+        /// Capture `cc use official` traffic through the daemon proxy.
+        /// Off by default — official traffic flows direct to Anthropic.
+        #[arg(long = "capture-official")]
+        capture_official: bool,
     },
 }
 

src/cli/main.rs

@@ -1009,21 +1009,25 @@ pub fn run() -> Result<()> {
                         foreground,
                         log_level,
                         verbose,
+                        capture_official,
                     } => DaemonAction::Start {
                         foreground,
                         log_level,
                         verbose,
+                        capture_official,
                     },
                     DaemonCommands::Stop => DaemonAction::Stop,
                     DaemonCommands::Status { json } => DaemonAction::Status { json },
                     DaemonCommands::Restart {
                         foreground,
                         log_level,
                         verbose,
+                        capture_official,
                     } => DaemonAction::Restart {
                         foreground,
                         log_level,
                         verbose,
+                        capture_official,
                     },
                 };
                 handle_daemon_command(action, &storage)?;

src/daemon/commands.rs

@@ -15,6 +15,7 @@ pub enum DaemonAction {
         foreground: bool,
         log_level: Option<String>,
         verbose: u8,
+        capture_official: bool,
     },
     Stop,
     Status {
@@ -24,6 +25,7 @@ pub enum DaemonAction {
         foreground: bool,
         log_level: Option<String>,
         verbose: u8,
+        capture_official: bool,
     },
 }
 
@@ -40,16 +42,18 @@ pub fn handle_daemon_command(action: DaemonAction, storage: &ConfigStorage) -> R
             foreground,
             log_level,
             verbose,
-        } => handle_start(foreground, log_level, verbose, storage),
+            capture_official,
+        } => handle_start(foreground, log_level, verbose, capture_official, storage),
         DaemonAction::Stop => handle_stop(),
         DaemonAction::Status { json } => handle_status(json, storage),
         DaemonAction::Restart {
             foreground,
             log_level,
             verbose,
+            capture_official,
         } => {
             let _ = handle_stop();
-            handle_start(foreground, log_level, verbose, storage)
+            handle_start(foreground, log_level, verbose, capture_official, storage)
         }
     }
 }
@@ -59,9 +63,10 @@ fn handle_start(
     foreground: bool,
     log_level: Option<String>,
     verbose: u8,
+    capture_official: bool,
     storage: &ConfigStorage,
 ) -> Result<()> {
-    let cfg = LifecycleConfig::from_storage(storage, foreground)?;
+    let cfg = LifecycleConfig::from_storage(storage, foreground, capture_official)?;
 
     // Preflight: check for existing pidfile (spec §8 invariant table).
     let pidfile = Pidfile::new(cfg.pidfile_path.clone());

src/daemon/lifecycle.rs

@@ -23,13 +23,17 @@ pub struct LifecycleConfig {
 }
 
 impl LifecycleConfig {
-    pub fn from_storage(storage: &ConfigStorage, foreground: bool) -> Result<Self> {
+    pub fn from_storage(
+        storage: &ConfigStorage,
+        foreground: bool,
+        capture_official: bool,
+    ) -> Result<Self> {
         let home = dirs::home_dir().context("could not find home directory")?;
         let cc_switch_dir = home.join(".cc-switch");
         std::fs::create_dir_all(&cc_switch_dir)
             .with_context(|| format!("failed to create {}", cc_switch_dir.display()))?;
 
-        let upstreams = dedupe_upstreams(storage);
+        let upstreams = dedupe_upstreams(storage, capture_official);
 
         Ok(Self {
             state_path: cc_switch_dir.join("daemon-state.json"),
@@ -41,7 +45,7 @@ impl LifecycleConfig {
     }
 }
 
-fn dedupe_upstreams(storage: &ConfigStorage) -> Vec<Upstream> {
+fn dedupe_upstreams(storage: &ConfigStorage, capture_official: bool) -> Vec<Upstream> {
     let mut seen = BTreeSet::new();
     let mut result = Vec::new();
     for config in storage.configurations.values() {
@@ -53,15 +57,19 @@ fn dedupe_upstreams(storage: &ConfigStorage) -> Vec<Upstream> {
             result.push(key);
         }
     }
-    // Always include the official Anthropic upstream so `cc use official`
-    // routes through the daemon. Dedup naturally handles the (rare) case
-    // where a user-defined alias points at the same URL.
-    let official = (
-        "claude".to_string(),
-        crate::daemon::OFFICIAL_UPSTREAM.to_string(),
-    );
-    if seen.insert(official.clone()) {
-        result.push(official);
+    // The implicit official Anthropic upstream is opt-in: only spawn a proxy
+    // for `cc use official` when the daemon was started with
+    // `--capture-official`. By default official traffic flows direct to
+    // Anthropic. A user-defined alias that points at the official URL is
+    // handled above and deduped here, so it always gets its proxy.
+    if capture_official {
+        let official = (
+            "claude".to_string(),
+            crate::daemon::OFFICIAL_UPSTREAM.to_string(),
+        );
+        if seen.insert(official.clone()) {
+            result.push(official);
+        }
     }
     result
 }
@@ -365,7 +373,7 @@ mod tests {
             "https://api.anthropic.com",
             "https://other.example.com/v1",
         ]);
-        let result = dedupe_upstreams(&storage);
+        let result = dedupe_upstreams(&storage, false);
         assert_eq!(result.len(), 2);
         assert_eq!(result[0].1, "https://api.anthropic.com");
         assert_eq!(result[1].1, "https://other.example.com/v1");
@@ -374,7 +382,7 @@ mod tests {
     #[test]
     fn dedupe_upstreams_skips_empty_urls() {
         let storage = make_storage(&["", "https://api.anthropic.com"]);
-        let result = dedupe_upstreams(&storage);
+        let result = dedupe_upstreams(&storage, false);
         assert_eq!(result.len(), 1);
         assert_eq!(result[0].1, "https://api.anthropic.com");
     }
@@ -395,23 +403,37 @@ mod tests {
     }
 
     #[test]
-    fn dedupe_upstreams_always_includes_official() {
-        let result = dedupe_upstreams(&make_storage(&[]));
+    fn dedupe_upstreams_excludes_official_by_default() {
+        // Default: do NOT spawn the implicit official proxy. `cc use official`
+        // traffic flows direct to Anthropic unless capture is explicitly enabled.
+        let result = dedupe_upstreams(&make_storage(&[]), false);
+        assert!(
+            !result.contains(&(
+                "claude".to_string(),
+                crate::daemon::OFFICIAL_UPSTREAM.to_string()
+            )),
+            "OFFICIAL_UPSTREAM must be absent by default, got {result:?}",
+        );
+    }
+
+    #[test]
+    fn dedupe_upstreams_includes_official_when_capture_enabled() {
+        let result = dedupe_upstreams(&make_storage(&[]), true);
         assert!(
             result.contains(&(
                 "claude".to_string(),
                 crate::daemon::OFFICIAL_UPSTREAM.to_string()
             )),
-            "OFFICIAL_UPSTREAM must always be in dedupe_upstreams output, got {result:?}",
+            "OFFICIAL_UPSTREAM must be present when capture_official=true, got {result:?}",
         );
     }
 
     #[test]
     fn dedupe_upstreams_dedupes_when_user_has_official_url() {
         // Belt-and-suspenders: user shouldn't normally do this, but if they
         // configure an alias with the official URL, we must not spawn two
-        // proxies for the same URL.
-        let result = dedupe_upstreams(&make_storage(&[crate::daemon::OFFICIAL_UPSTREAM]));
+        // proxies for the same URL even with capture enabled.
+        let result = dedupe_upstreams(&make_storage(&[crate::daemon::OFFICIAL_UPSTREAM]), true);
         let count = result
             .iter()
             .filter(|(_, url)| url == crate::daemon::OFFICIAL_UPSTREAM)
@@ -421,4 +443,19 @@ mod tests {
             "OFFICIAL_UPSTREAM must appear exactly once, got {result:?}"
         );
     }
+
+    #[test]
+    fn dedupe_upstreams_keeps_user_official_alias_without_capture() {
+        // A user-defined alias explicitly pointing at the official URL still
+        // gets its proxy even when implicit official capture is off.
+        let result = dedupe_upstreams(&make_storage(&[crate::daemon::OFFICIAL_UPSTREAM]), false);
+        let count = result
+            .iter()
+            .filter(|(_, url)| url == crate::daemon::OFFICIAL_UPSTREAM)
+            .count();
+        assert_eq!(
+            count, 1,
+            "user-defined official alias must still spawn its proxy, got {result:?}"
+        );
+    }
 }

src/daemon/mod.rs

@@ -114,8 +114,9 @@ pub fn try_resolve_proxy_from_paths(
     }
 }
 
-/// Official Anthropic upstream URL. The daemon spawns one ccs-proxy for this
-/// URL at startup so `cc use official` traffic can be captured.
+/// Official Anthropic upstream URL. The daemon spawns a ccs-proxy for this
+/// URL **only** when started with `--capture-official`; by default `cc use
+/// official` traffic flows direct to Anthropic and is not captured.
 ///
 /// MUST stay byte-identical to Claude CLI's default `ANTHROPIC_BASE_URL`, since
 /// `find_proxy` does literal string match.
@@ -142,11 +143,12 @@ pub fn build_official_env() -> crate::config::config::EnvironmentConfig {
         ProxyResolution::Direct => {
             eprintln!(
                 "{}",
-                "\u{2139} cc daemon is not running — official traffic will NOT be captured.".blue()
+                "\u{2139} official traffic is going direct to Anthropic (not captured).".blue()
             );
             eprintln!(
                 "{}",
-                "  Run `cc-switch daemon start` and re-run to enable capture.".blue()
+                "  Start the daemon with `cc-switch daemon start --capture-official` to capture it."
+                    .blue()
             );
             env
         }

tests/daemon_supervisor.rs

@@ -59,23 +59,23 @@ mod daemon_supervisor {
             ("personal", "https://api.anthropic.com"),
             ("glm", "https://glm.example.com/v1"),
         ]);
-        let cfg = LifecycleConfig::from_storage(&storage, false).unwrap();
+        let cfg = LifecycleConfig::from_storage(&storage, false, false).unwrap();
         // Two unique upstreams, not three.
         assert_eq!(cfg.upstreams.len(), 2);
     }
 
     #[test]
     fn lifecycle_config_skips_empty_urls() {
         let storage = make_storage(&[("empty", ""), ("work", "https://api.anthropic.com")]);
-        let cfg = LifecycleConfig::from_storage(&storage, false).unwrap();
+        let cfg = LifecycleConfig::from_storage(&storage, false, false).unwrap();
         assert_eq!(cfg.upstreams.len(), 1);
         assert_eq!(cfg.upstreams[0].1, "https://api.anthropic.com");
     }
 
     #[test]
     fn lifecycle_config_paths_are_in_cc_switch_dir() {
         let storage = make_storage(&[("x", "https://api.anthropic.com")]);
-        let cfg = LifecycleConfig::from_storage(&storage, false).unwrap();
+        let cfg = LifecycleConfig::from_storage(&storage, false, false).unwrap();
         let state_str = cfg.state_path.to_string_lossy();
         let pid_str = cfg.pidfile_path.to_string_lossy();
         assert!(state_str.contains(".cc-switch"), "state_path: {state_str}");
@@ -167,11 +167,20 @@ mod daemon_supervisor {
     }
 
     #[test]
-    fn empty_configurations_yields_only_official_upstream() {
-        // Empty user config still yields exactly the official upstream, so
-        // `cc use official` traffic can be captured by the daemon.
+    fn empty_configurations_yields_no_upstreams_by_default() {
+        // Default: no implicit official proxy. Empty user config yields zero
+        // upstreams, so `cc use official` traffic flows direct to Anthropic.
         let storage = make_storage(&[]);
-        let cfg = LifecycleConfig::from_storage(&storage, false).unwrap();
+        let cfg = LifecycleConfig::from_storage(&storage, false, false).unwrap();
+        assert_eq!(cfg.upstreams.len(), 0);
+    }
+
+    #[test]
+    fn empty_configurations_yields_official_upstream_with_capture() {
+        // With `--capture-official`, the daemon spawns the official proxy so
+        // `cc use official` traffic can be captured.
+        let storage = make_storage(&[]);
+        let cfg = LifecycleConfig::from_storage(&storage, false, true).unwrap();
         assert_eq!(cfg.upstreams.len(), 1);
         assert_eq!(
             cfg.upstreams[0].1,