{"version":"2.1.310","anchor":"gh-stand-in-accepts-a-standalone-proxy-port-token-and-any","canonical_anchor":"gh-stand-in-accepts-a-standalone-proxy-port-token-and-any","heading":"Governed git tools: gh guard and a standalone proxy mode","tier":"use","area":"Git","scope":"both","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.310\/e\/gh-stand-in-accepts-a-standalone-proxy-port-token-and-any","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.310","markdown":"### Governed git tools: gh guard and a standalone proxy mode\n\nIn proxied sessions, the built-in gh now refuses to run outside the session's proxy, and a new standalone-proxy mode sets up git and gh\n\n**Unclear.** Nothing shown passes \"standalone-proxy\" to the stand-in, so whether this path is reachable in normal use is unclear.\n\n**What**\n\nIn some sessions, network traffic goes through a proxy (a go-between server), and Claude Code supplies its own stand-in for `gh`, the GitHub command-line tool, plus a git setup that goes through that proxy. This setup changed:\n\n- When the session's proxy state has `governedGitTools` on, the environment setup now only puts `ghShimDir` on PATH and sets no proxy or certificate (CA) variables. This check now comes first. Before, the same branch was keyed on `toolScoped` and ran only after the port and CA bundle checks.\n\n- A new shell guard refuses to run `gh` unless HTTPS_PROXY names a proxy on 127.0.0.1. Its error reads: \"gh: this session's proxy is not set (HTTPS_PROXY names no proxy on 127.0.0.1), so gh cannot reach GitHub; run gh from this session's own shell, with HTTPS_PROXY as the session set it.\"\n\n- A new \"standalone-proxy\" mode: when the agent proxy uses its standalone relay, startup no longer stops early. It builds a standalone route, fetches the CA through the proxy, writes the trust bundle, sets up the governed git config and the `gh` stand-in, and reports success as standalone. Before, this mode only logged that the hosted relay was not started.\n\n- The `gh` stand-in (`--gh-standin`) accepts \"standalone-proxy\" in place of a numeric port. Then it uses HTTPS_PROXY instead of a local 127.0.0.1 address and leaves out the `\/__agentproxy\/status` address. `--any-host` now uses a shared constant instead of the string \"any\".\n\n- Startup no longer branches on `CLAUDE_CODE_AGENT_PROXY_GIT_CONFIG` and `CLAUDE_CODE_AGENT_PROXY_GH_SHIM` in this block. The git config and `gh` stand-in are set up through shared steps, and the number of git-config environment variables went from 5 to 6.\n\n- The session notice about GitHub access now keys on `governedGitTools`. It says either that other traffic goes through the same proxy, where curl, npm or gh using their own token fail TLS because only git and gh trust that CA bundle, or that other traffic uses the machine's own network connection. Before, it always said the latter.\n\n**Why**\n\nRunning `gh` outside the session's own shell now fails with a clear message instead of an obscure one, and Claude is told accurately whether other network traffic shares the proxy.\n\n- Area: Git\n- Names: `HTTPS_PROXY`\n- Tier: Use it now\n- Useful: 3\/5\n- Signal: 3\/5\n- Scope: both\n- Heads-up: no"}