{"version":"2.1.224","anchor":"tunnel-from-the-orchestrator-to-a-private-github-enterprise-","canonical_anchor":"tunnel-from-the-orchestrator-to-a-private-github-enterprise-","heading":"Tunnel from the orchestrator to a private GitHub Enterprise host","tier":"use","area":"Self-Hosted Runner","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224\/e\/tunnel-from-the-orchestrator-to-a-private-github-enterprise-","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224","markdown":"### Tunnel from the orchestrator to a private GitHub Enterprise host\n\nPass --scm-connector-host to tunnel Anthropic requests into a GitHub Enterprise server only your network can reach.\n\n**What**\n\nPassing `--scm-connector-host` opens a persistent WebSocket to Anthropic and proxies inbound HTTP requests to a GitHub Enterprise server that is only reachable from inside your network. `--scm-connector-id` is required alongside it, `--scm-connector-provider` defaults to `ghe`, and `--scm-connector-ca-file` supplies a custom CA. The connector is entirely off unless you pass the host flag.\n\n**Details**\n\n- Requests are checked against a method allowlist, hop-by-hop headers are stripped, and paths that would escape the configured origin are refused.\n- Frames asking to open a raw socket or a PTY (`wsOpen`, `ptyOpen`) are rejected.\n- Close code 4003 means another orchestrator already holds this connector; it retries after 30 seconds.\n- `--scm-connector-host-rewrite` is documented as being for end-to-end testing only.\n\n**Evidence**\n\n`\/v1\/code\/scm-connectors\/{provider}\/{id}\/tunnel`\n\n- Area: Self-Hosted Runner\n- Names: `--scm-connector-host`, `--scm-connector-id`, `--scm-connector-provider`, `--scm-connector-ca-file`, `--scm-connector-host-rewrite`\n- Tier: Use it now\n- Useful: 3\/5\n- Signal: 5\/5"}