Self-hosted runner sessions can send all traffic through a customer-run proxy
New CCR_AGENT_PROXY_RELAY_MODE value agent_proxy_standalone routes all self-hosted session traffic through your own proxy and refuses to start otherwise
What probably matters to youSection of the release
What
CCR_AGENT_PROXY_RELAY_MODE (an environment variable that controls how the agent proxy relays network traffic) gains a new value, agent_proxy_standalone. With it, all session traffic goes through a proxy you run, named by CCR_AGENT_PROXY_STANDALONE_URL.
The URL must be https with no username or password inside it.
Claude Code starts a local forwarder on 127.0.0.1, signs in to the proxy with the session's own id and token, and sets CLAUDE_CODE_ENABLE_PROXY_AUTH_HELPER to false.
If any check fails, Claude Code refuses to start rather than connect directly.
The outgoing proxy also gains a configurable log label, can reload after an upstream connection fails, accepts a function for upstream TLS options, and can send plain http:// requests through a CONNECT tunnel (a way of passing traffic through a proxy) using a new request parser.
Why
Operators of self-hosted runners can force every outgoing connection through their own proxy, and a session that cannot reach it stops instead of quietly going direct.
