Self-hosted runner sessions can send all traffic through a customer-run proxy

What

CCR_AGENT_PROXY_RELAY_MODE (an environment variable that controls how the agent proxy relays network traffic) gains a new value, agent_proxy_standalone. With it, all session traffic goes through a proxy you run, named by CCR_AGENT_PROXY_STANDALONE_URL.

• It only works when CLAUDE_CODE_ENVIRONMENT_KIND is byoc (a self-hosted runner).
• The URL must be https with no username or password inside it.
• Claude Code starts a local forwarder on 127.0.0.1, signs in to the proxy with the session's own id and token, and sets CLAUDE_CODE_ENABLE_PROXY_AUTH_HELPER to false.
• If any check fails, Claude Code refuses to start rather than connect directly.
• The outgoing proxy also gains a configurable log label, can reload after an upstream connection fails, accepts a function for upstream TLS options, and can send plain http:// requests through a CONNECT tunnel (a way of passing traffic through a proxy) using a new request parser.

Why

Operators of self-hosted runners can force every outgoing connection through their own proxy, and a session that cannot reach it stops instead of quietly going direct.