Unclear It is not known what each of these variables actually turns off.
What
In cloud sessions, an agent proxy sits between Claude Code and the network and serves its own certificates. NSS is a certificate store some programs use, and certutil is the tool that reads and changes it.
- On start-up, the proxy can record that an NSS database already trusts its certificates and skip running
certutilon the next start. The record is a hash of the folder's contents. Before,certutilran on every start. - Two environment variables are added to the proxy's list:
CCR_AGENT_PROXY_NSS_RECORDS_DISABLEDandCCR_AGENT_PROXY_JAVA_STORE_DIRECT_DISABLED. Their names suggest switches to turn off NSS record handling and direct Java trust-store handling. What reads them was not checked. - The proxy status report now includes
gitConfigConflicts, plus fields for whether downloads and uploads are paused.
Why
Cloud session start-up can skip a repeated certificate check. The new variables appear to offer a way to turn that behaviour off, and the proxy's status report shows more about its state.
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
It is not known what each of these variables actually turns off.