Fix proxy hook: add SSL CA trust, nonProxyHosts override, and Android SDK setup

Three fixes for Claude Code sessions with the Anthropic egress proxy:

1. **Remove early-exit on settings.xml** — JWT tokens rotate; proxy credentials
   must always be refreshed, not skipped if settings.xml already exists.

2. **Add nonProxyHosts override** — JAVA_TOOL_OPTIONS excludes *.google.com
   from the proxy, causing UnknownHostException for dl.google.com. Override
   with `systemProp.http(s).nonProxyHosts=localhost|127.0.0.1` in
   gradle.properties so Gradle routes all external traffic through the proxy.

3. **Import Anthropic TLS inspection CA** — The proxy does SSL interception
   with `CN=sandbox-egress-production TLS Inspection CA, O=Anthropic`. JVMs
   (Gradle daemon, sdkmanager) fail SSL handshakes because they don't trust
   this CA. Extract the cert from the system bundle (where it's pre-installed)
   and import it into the OpenJDK and JetBrains JDK trust stores.

4. **Auto-create local.properties** — Write sdk.dir if Android SDK is present
   at /root/android-sdk but local.properties doesn't exist yet.

https://claude.ai/code/session_016TTEnHNDddxPkNYDB6SMeM

.claude/hooks/pre-tool-use.sh

@@ -1,13 +1,12 @@
 #!/bin/bash
-# Auto-configure Maven/Gradle proxy auth in Claude Code environments.
-# Runs as a SessionStart hook. No-ops when not needed.
+# Auto-configure Maven/Gradle proxy auth and SSL trust in Claude Code environments.
+# Runs as a PreToolUse hook for Bash. No-ops when not needed.
 
 [ "$CLAUDECODE" = "1" ] || exit 0
 
 proxy="${https_proxy:-$HTTPS_PROXY}"
 [ -z "$proxy" ] && exit 0
 echo "$proxy" | grep -q '@' || exit 0
-[ -f ~/.m2/settings.xml ] && exit 0
 
 rest="${proxy#*://}"
 userpass="${rest%@*}"
@@ -18,6 +17,7 @@ host="${hostport%%:*}"
 port="${hostport##*:}"
 port="${port%/}"
 
+# --- Proxy credentials (always update; JWT tokens rotate) ---
 mkdir -p ~/.m2
 cat > ~/.m2/settings.xml << EOF
 <settings>
@@ -47,6 +47,57 @@ systemProp.http.proxyHost=$host
 systemProp.http.proxyPort=$port
 systemProp.http.proxyUser=$user
 systemProp.http.proxyPassword=$pass
+# Override nonProxyHosts: route all external traffic (incl. *.google.com) through proxy
+systemProp.http.nonProxyHosts=localhost|127.0.0.1
+systemProp.https.nonProxyHosts=localhost|127.0.0.1
 EOF
 
 echo "Configured Maven/Gradle proxy from HTTPS_PROXY" >&2
+
+# --- SSL trust: import Anthropic TLS inspection CA into JVM trust stores ---
+# The proxy does SSL interception; JVMs need to trust the Anthropic CA.
+# Extract the CA cert from the system bundle (it's pre-installed there).
+ANTHROPIC_CA_PEM=$(python3 -c "
+import re, ssl, sys
+try:
+    with open('/etc/ssl/certs/ca-certificates.crt') as f:
+        certs = re.findall(r'-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----', f.read(), re.DOTALL)
+    for cert in certs:
+        der = ssl.PEM_cert_to_DER_cert(cert)
+        if b'Anthropic' in der and b'sandbox-egress-production' in der:
+            print(cert)
+            break
+except Exception as e:
+    sys.stderr.write(f'CA extraction failed: {e}\n')
+" 2>/dev/null)
+
+if [ -n "$ANTHROPIC_CA_PEM" ]; then
+    TMPCA=$(mktemp /tmp/anthropic-ca.XXXXXX.pem)
+    echo "$ANTHROPIC_CA_PEM" > "$TMPCA"
+
+    # Import into all available JVM trust stores
+    for cacerts in \
+        /usr/lib/jvm/java-21-openjdk-amd64/lib/security/cacerts \
+        /root/.gradle/jdks/*/lib/security/cacerts; do
+        [ -f "$cacerts" ] || continue
+        # Check if already imported
+        keytool -list -keystore "$cacerts" -storepass changeit \
+            -alias anthropic-egress-production-ca >/dev/null 2>&1 && continue
+        keytool -import \
+            -alias anthropic-egress-production-ca \
+            -file "$TMPCA" \
+            -keystore "$cacerts" \
+            -storepass changeit \
+            -noprompt >/dev/null 2>&1 && \
+            echo "Imported Anthropic CA into $cacerts" >&2
+    done
+    rm -f "$TMPCA"
+fi
+
+# --- Android SDK: create local.properties if SDK is installed ---
+ANDROID_SDK_DIR="/root/android-sdk"
+LOCAL_PROPS="$(git -C "$(dirname "$0")/../.." rev-parse --show-toplevel 2>/dev/null)/local.properties"
+if [ -d "$ANDROID_SDK_DIR/platforms" ] && [ -n "$LOCAL_PROPS" ] && [ ! -f "$LOCAL_PROPS" ]; then
+    echo "sdk.dir=$ANDROID_SDK_DIR" > "$LOCAL_PROPS"
+    echo "Created local.properties with sdk.dir=$ANDROID_SDK_DIR" >&2
+fi