From b43c738f66a0263e496552fc60f58d64f43e3a35 Mon Sep 17 00:00:00 2001
From: Albert Mavashev <amavashev@k2n.io>
Date: Tue, 12 May 2026 13:11:07 -0400
Subject: [PATCH] chore: hygiene bundle round 2 (#62 + #63 defensive defaults)

Propagation from cycles-spring-boot-starter#66.
---
 .claude/session-start-global-deny.sh | 14 ++++++++------
 .claude/session-start-maven-proxy.sh | 14 ++++++++++----
 2 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/.claude/session-start-global-deny.sh b/.claude/session-start-global-deny.sh
index ec9c217..7e758b9 100755
--- a/.claude/session-start-global-deny.sh
+++ b/.claude/session-start-global-deny.sh
@@ -62,12 +62,14 @@ fi
 
 # --- Part 2: Fix git remote URLs to use local proxy ---
 # NOTE: This block intentionally rewrites the `origin` remote on EVERY sibling
-# repo under /home/user/* with a github.com remote, not just this one. Claude
-# Code remote sessions clone multiple repos and all need the local git proxy.
-# To opt out (e.g., when running outside that environment, or when you want
-# unrelated checkouts left alone), set CYCLES_CLAUDE_SKIP_REMOTE_REWRITE=1.
-# Tracked org-wide at runcycles/.github#63.
-if [ -n "$CYCLES_CLAUDE_SKIP_REMOTE_REWRITE" ]; then
+# repo under /home/user/* with a github.com remote. That multi-repo scope is
+# only meaningful inside Claude Code's remote sessions (which clone many repos
+# and need them all on the local git proxy). To keep the default safe on
+# vanilla developer machines, we gate on $http_proxy being set — the Claude
+# Code remote env sets that, a vanilla dev machine does not.
+# Explicit override: set CYCLES_CLAUDE_SKIP_REMOTE_REWRITE=1 to skip even when
+# $http_proxy is set. Tracked org-wide at runcycles/.github#63.
+if [ -z "$http_proxy" ] || [ -n "$CYCLES_CLAUDE_SKIP_REMOTE_REWRITE" ]; then
   exit 0
 fi
 
diff --git a/.claude/session-start-maven-proxy.sh b/.claude/session-start-maven-proxy.sh
index 27a1e6c..6bc5b6d 100755
--- a/.claude/session-start-maven-proxy.sh
+++ b/.claude/session-start-maven-proxy.sh
@@ -57,9 +57,14 @@ else
 XMLEOF
 fi
 
-# Install mvn-proxy wrapper that fixes JAVA_TOOL_OPTIONS interference
-MVN_BIN=$(which mvn 2>/dev/null || echo "/opt/maven/bin/mvn")
-cat > /usr/local/bin/mvn-proxy << WRAPEOF
+# Install mvn-proxy wrapper that fixes JAVA_TOOL_OPTIONS interference.
+# Defensively skip if a user-managed wrapper is already present — same etiquette
+# as the ~/.m2/settings.xml check above. Tracked org-wide at runcycles/.github#62.
+if [ -f /usr/local/bin/mvn-proxy ]; then
+  echo "[cycles] /usr/local/bin/mvn-proxy already exists; not overwriting." >&2
+else
+  MVN_BIN=$(which mvn 2>/dev/null || echo "/opt/maven/bin/mvn")
+  cat > /usr/local/bin/mvn-proxy << WRAPEOF
 #!/bin/bash
 # Maven wrapper that fixes proxy auth for Claude Code remote environments.
 # Use 'mvn-proxy' instead of 'mvn' to avoid DNS resolution and proxy auth issues.
@@ -74,4 +79,5 @@ export MAVEN_OPTS="-Dhttps.proxyHost=\$PROXY_HOST -Dhttps.proxyPort=\$PROXY_PORT
 
 exec ${MVN_BIN} -Daether.connector.basic.threads=1 "\$@"
 WRAPEOF
-chmod +x /usr/local/bin/mvn-proxy
+  chmod +x /usr/local/bin/mvn-proxy
+fi