auth login fails behind fake-IP DNS proxy: token endpoint refused by address policy (198.18.0.0/15) #868

Summary

basecamp auth login --device-code (v0.13.0, linux amd64) cannot complete login on hosts whose DNS uses a fake-IP / transparent proxy (e.g. sandboxed agent VMs), because the token endpoint resolves to an address in 198.18.0.0/15 and oauth.DefaultIssuerPolicy refuses it.

Steps

1. On a host where launchpad.37signals.com resolves to 198.18.0.1 (benchmark range used by fake-IP egress proxies)
2. basecamp auth login --device-code, approve in browser, paste the callback URL

Result

token exchange failed: token endpoint "https://launchpad.37signals.com/authorization/token" resolves to an address refused by the address policy (see oauth.DefaultIssuerPolicy)

Setting BASECAMP_OAUTH_USE_PROXY=1 did not change the result.

Expected

A way to complete login in this environment, e.g. an env var / flag to allow the 198.18.0.0/15 range or skip the address policy for the known Launchpad host, or not applying the policy when an HTTP(S) proxy is in use.

Environment

• basecamp 0.13.0, Linux x86_64
• getent hosts launchpad.37signals.com → 198.18.0.1