## Trigger

- `claude update` reports a network error such as `ECONNREFUSED` or `Failed to fetch version`.
- `claude mcp list` reports stdio MCP servers as `Failed to connect`, especially servers started through `npx`.
- Shell-level proxy tests look correct or the user has already tried setting `http_proxy` / `https_proxy`.
- WSL mirrored networking is in use and there are multiple plausible proxy addresses, such as a WSL-local loopback proxy and a WireGuard address for peer machines.

## Symptoms

- A candidate proxy succeeds from the interactive WSL shell.
- Another candidate proxy address is valid for a different host or peer, but fails from inside this WSL session.
- `claude update` still fails even when launched with correct shell proxy variables.
- `npx -y @playwright/mcp@latest ...` succeeds without the bad proxy but times out or fails when the bad proxy is injected.

## Diagnosis

- Claude Code loads `~/.claude/settings.json` and injects its `env` block into Claude-run operations.
- Those settings env values can override the outer shell environment used to launch `claude`.
- The same injected env reaches updater network calls and stdio MCP child processes.
- Therefore an obsolete proxy in `~/.claude/settings.json` can break both `claude update` and MCP, even when one-shot shell proxy variables appear correct.

## Fix

1. Inspect Claude settings proxy values without printing secrets:
   ```bash
   python3 - <<'PY'
   import json, pathlib
   env = json.loads((pathlib.Path.home() / ".claude/settings.json").read_text()).get("env", {})
   for key in ["HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy", "NO_PROXY"]:
       print(key, env.get(key))
   PY
   ```

2. Smoke-test each candidate proxy from inside the same WSL runtime:
   ```bash
   curl -sSI --max-time 8 --proxy "$CANDIDATE_PROXY_URL" https://downloads.claude.ai/claude-code-releases/latest | head -5
   ```

3. Remove stale proxy keys or update only the proxy variables in
   `~/.claude/settings.json` to the WSL-reachable address.

4. Verify both affected surfaces:
   ```bash
   claude update
   claude mcp list
   claude mcp get playwright
   ```

5. If shared agent guidance still names the stale proxy, update the canonical user `AGENTS.md` so future agents do not reintroduce the same address.

## Reuse Rule

- Load for Claude Code updater failures, Claude Code MCP stdio failures, or WSL proxy confusion where shell proxy checks and Claude behavior disagree.
- Prefer this narrow diagnosis over changing MCP server definitions when manual MCP initialization works outside Claude.
- Do not store tokens or provider secrets in the card or logs; inspect only proxy-related settings.