What
In cloud sessions, an agent proxy sits between Claude Code and the network and serves its own certificates. NSS is a certificate store some programs use, and certutil is the tool that reads and changes it.
- On start-up, the proxy can record that an NSS database already trusts its certificates and skip running
certutilon the next start. The record is a hash of the folder's contents. Before,certutilran on every start. - Two environment variables are added to the proxy's list:
CCR_AGENT_PROXY_NSS_RECORDS_DISABLEDandCCR_AGENT_PROXY_JAVA_STORE_DIRECT_DISABLED. Their names suggest switches to turn off NSS record handling and direct Java trust-store handling. What reads them was not checked. - The proxy status report now includes
gitConfigConflicts, plus fields for whether downloads and uploads are paused.
Why
Cloud session start-up can skip a repeated certificate check. The new variables appear to offer a way to turn that behaviour off, and the proxy's status report shows more about its state.
Names in the bundleCCR_AGENT_PROXY_NSS_RECORDS_DISABLED
One source agreesOne thing we can check says the same as this entry.
The name it cites is new in this build
New in this build: CCR_AGENT_PROXY_NSS_RECORDS_DISABLED