{"name":"CCR_ON_BRANCH_DEFAULT_GUARD","slug":"ccr-on-branch-default-guard","family":"env","title":"Environment variables","noun":"environment variable","description":"Cloud on-branch checkout guard can now be forced on via a CCR_ON_BRANCH_DEFAULT_GUARD environment variable","description_source":"entry","described_by":{"version":"2.1.277","anchor":"new-git-branch-guard-telemetryenv-override-for-cloud-sessio"},"presence":{"first_seen":"2.1.208","removed_in":null,"in_current_build":true,"newest_mined":"2.1.308","builds":89,"mined_builds":149,"first_cited":null},"aliases":[],"entries":[{"version":"2.1.277","anchor":"new-git-branch-guard-telemetryenv-override-for-cloud-sessio","heading":"New git-branch-guard telemetry\/env override for cloud session on-branch checkout","line":"Cloud on-branch checkout guard can now be forced on via a CCR_ON_BRANCH_DEFAULT_GUARD environment variable","released_at":"2026-09-18 16:22:26","reason":"found in this entry's text, named in this entry"}],"entries_total":1,"docs":[],"docs_total":0,"gates":[],"related":[{"name":"CCR_AGENT_PROXY_CA_CERT_B64","slug":"ccr-agent-proxy-ca-cert-b64","description":"In hosted remote sessions, the agent proxy can read its certificate authority from `CCR_AGENT_PROXY_CA_CERT_B64` instead of always downloading it"},{"name":"CCR_AGENT_PROXY_CA_WATCH_ENABLED","slug":"ccr-agent-proxy-ca-watch-enabled","description":"In remote sessions using the agent proxy, certificate checks accept swapped order and the gh stand-in now lives in each session's own folder"},{"name":"CCR_AGENT_PROXY_ENABLED","slug":"ccr-agent-proxy-enabled","description":"The remote agent proxy now caps stalled uploads and reads, with two env vars to disable each."},{"name":"CCR_AGENT_PROXY_FRAME_HOSTS","slug":"ccr-agent-proxy-frame-hosts","description":"Artifact traffic can take a direct tunnel when the runner environment names hosts; local runs keep the old route."},{"name":"CCR_AGENT_PROXY_INCLUDE_HOSTS","slug":"ccr-agent-proxy-include-hosts","description":"Read by the agent proxy setup in a remote session (`CLAUDE_CODE_REMOTE` truthy and `CCR_AGENT_PROXY_ENABLED` set), which removes it from the environment before those checks. With `CCR_AGENT_PROXY_RELAY_MODE=selective` and no `AGENT_PROXY_URL`, it is a comma-separated host list: those hosts go through the proxy relay and unlisted hosts use normal networking. An empty or unparsable list logs a warning and falls back to tunnelling all traffic."},{"name":"CCR_AGENT_PROXY_NO_PROXY_LOCAL_ONLY","slug":"ccr-agent-proxy-no-proxy-local-only","description":"New CCR_AGENT_PROXY_NO_PROXY_LOCAL_ONLY environment variable narrows the agent proxy's no-proxy list to local addresses"},{"name":"CCR_AGENT_PROXY_RECEIVE_GATE_DISABLED","slug":"ccr-agent-proxy-receive-gate-disabled","description":"The remote agent proxy now caps stalled uploads and reads, with two env vars to disable each."},{"name":"CCR_AGENT_PROXY_RELAY_MODE","slug":"ccr-agent-proxy-relay-mode","description":"On self-hosted runners, Claude Code can route all session traffic through a proxy you run, and refuses to start if it cannot"},{"name":"CCR_AGENT_PROXY_STANDALONE_URL","slug":"ccr-agent-proxy-standalone-url","description":"On self-hosted runners, Claude Code can route all session traffic through a proxy you run, and refuses to start if it cannot"},{"name":"CCR_AGENT_PROXY_TOKEN_FILE_DESCRIPTOR","slug":"ccr-agent-proxy-token-file-descriptor","description":"Claude Code now recognises CCR_AGENT_PROXY_TOKEN_FILE_DESCRIPTOR as a way to receive the agent proxy credential"}],"url":"https:\/\/changelogs.core-directive.com\/reference\/env\/ccr-on-branch-default-guard","family_url":"https:\/\/changelogs.core-directive.com\/reference\/env.json"}