{"name":"CCR_UPSTREAM_PROXY_ENABLED","slug":"ccr-upstream-proxy-enabled","family":"env","title":"Environment variables","noun":"environment variable","description":"One of three switches, with `CCR_AGENT_PROXY_ENABLED` and `CCR_EGRESS_GATEWAY_ENABLED`, that lets the egress gateway start in a remote session (`CLAUDE_CODE_REMOTE` truthy); a truthy value is `1`, `true`, `yes` or `on`. With any switch on, the gateway then needs `CLAUDE_CODE_REMOTE_SESSION_ID` and a session token, and starts a local relay on `127.0.0.1` that connects to the gateway over a websocket. Outside a remote session it has no effect.","description_source":"code","described_by":{"bundle":"2.1.177","author":"claude-opus-5-5"},"presence":{"first_seen":"2.1.138","removed_in":"2.1.178","in_current_build":false,"newest_mined":"2.1.308","builds":36,"mined_builds":149,"first_cited":null},"aliases":[],"entries":[{"version":"2.1.85","anchor":"upstream-proxy-for-remote-sessions","heading":"Upstream Proxy for Remote Sessions","line":null,"released_at":"2026-03-26 20:55:47","reason":"found in this entry's text"}],"entries_total":1,"docs":[],"docs_total":0,"gates":[],"related":[{"name":"CCR_AGENT_PROXY_CA_CERT_B64","slug":"ccr-agent-proxy-ca-cert-b64","description":"In hosted remote sessions, the agent proxy can read its certificate authority from `CCR_AGENT_PROXY_CA_CERT_B64` instead of always downloading it"},{"name":"CCR_AGENT_PROXY_CA_WATCH_ENABLED","slug":"ccr-agent-proxy-ca-watch-enabled","description":"In remote sessions using the agent proxy, certificate checks accept swapped order and the gh stand-in now lives in each session's own folder"},{"name":"CCR_AGENT_PROXY_ENABLED","slug":"ccr-agent-proxy-enabled","description":"The remote agent proxy now caps stalled uploads and reads, with two env vars to disable each."},{"name":"CCR_AGENT_PROXY_FRAME_HOSTS","slug":"ccr-agent-proxy-frame-hosts","description":"Artifact traffic can take a direct tunnel when the runner environment names hosts; local runs keep the old route."},{"name":"CCR_AGENT_PROXY_INCLUDE_HOSTS","slug":"ccr-agent-proxy-include-hosts","description":"Read by the agent proxy setup in a remote session (`CLAUDE_CODE_REMOTE` truthy and `CCR_AGENT_PROXY_ENABLED` set), which removes it from the environment before those checks. With `CCR_AGENT_PROXY_RELAY_MODE=selective` and no `AGENT_PROXY_URL`, it is a comma-separated host list: those hosts go through the proxy relay and unlisted hosts use normal networking. An empty or unparsable list logs a warning and falls back to tunnelling all traffic."},{"name":"CCR_AGENT_PROXY_NO_PROXY_LOCAL_ONLY","slug":"ccr-agent-proxy-no-proxy-local-only","description":"New CCR_AGENT_PROXY_NO_PROXY_LOCAL_ONLY environment variable narrows the agent proxy's no-proxy list to local addresses"},{"name":"CCR_AGENT_PROXY_RECEIVE_GATE_DISABLED","slug":"ccr-agent-proxy-receive-gate-disabled","description":"The remote agent proxy now caps stalled uploads and reads, with two env vars to disable each."},{"name":"CCR_AGENT_PROXY_RELAY_MODE","slug":"ccr-agent-proxy-relay-mode","description":"On self-hosted runners, Claude Code can route all session traffic through a proxy you run, and refuses to start if it cannot"},{"name":"CCR_AGENT_PROXY_STANDALONE_URL","slug":"ccr-agent-proxy-standalone-url","description":"On self-hosted runners, Claude Code can route all session traffic through a proxy you run, and refuses to start if it cannot"},{"name":"CCR_AGENT_PROXY_TOKEN_FILE_DESCRIPTOR","slug":"ccr-agent-proxy-token-file-descriptor","description":"Claude Code now recognises CCR_AGENT_PROXY_TOKEN_FILE_DESCRIPTOR as a way to receive the agent proxy credential"}],"url":"https:\/\/changelogs.core-directive.com\/reference\/env\/ccr-upstream-proxy-enabled","family_url":"https:\/\/changelogs.core-directive.com\/reference\/env.json"}