Publish, upload, comment and blob requests try a tunnel first, offered only when CCR_AGENT_PROXY_FRAME_HOSTS is set by the runner.
Artifact publish, upload, comment and blob requests now go through a wrapper that first tries a direct tunnel and falls back to the existing gateway route when the tunnel is declined, refused, never opened, or errors. The tunnel is only offered when the environment variable CCR_AGENT_PROXY_FRAME_HOSTS is set and parses as a hostname list. Nothing in Claude Code writes that variable; it is supplied by the runner environment, so ordinary local runs keep the old path entirely.
- The tunnel route uses a proxy agent with no auth; the fallback route uses the session token against the existing gateway host.
- Each failure writes a telemetry event recording why the tunnel was not used, and successful relays over the tunnel are flagged as such.
- The variable is new in this build and sits among the other runner-supplied agent-proxy variables.
[frame-tunnel] CCR_AGENT_PROXY_FRAME_HOSTS is malformed; keeping the gateway routes
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
New in this build: CCR_AGENT_PROXY_FRAME_HOSTS