When the CCR agent proxy runs on Linux, Claude Code now attempts to install its CA certificate into the system-level certificate store in addition to using environment variable trust. Supports:
- Debian/Ubuntu:
/usr/local/share/ca-certificates/ccr-agent-proxy.crt+update-ca-certificates - RHEL/CentOS:
/etc/pki/ca-trust/source/anchors/ccr-agent-proxy.crt+update-ca-trust extract
Falls back to env-var trust if the system install fails. A notification is logged when system trust succeeds: [agent-proxy] CA installed to system trust via update-ca-certificates.
Evidence
New Bjl() function — search for "[agent-proxy] CA installed to system trust via" and "/etc/pki/ca-trust/source/anchors"
Strings lifted out of the shipped bundle, so the claim above can be checked against them.