{"version":"2.1.311","anchor":"agent-proxy-nss-trust-check-cached-by-a-record-file","canonical_anchor":"agent-proxy-gains-two-disable-switches-java-store-nss-reco","heading":"Agent proxy remembers trusted NSS databases and gains disable switches","tier":"use","area":"Cloud Sessions","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.311\/e\/agent-proxy-nss-trust-check-cached-by-a-record-file","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.311","markdown":"### Agent proxy remembers trusted NSS databases and gains disable switches\n\nThe cloud-session agent proxy can skip repeat NSS certificate checks, gains NSS and Java store disable switches, and reports more status\n\n**What**\n\nIn cloud sessions, an agent proxy sits between Claude Code and the network and serves its own certificates. NSS is a certificate store some programs use, and `certutil` is the tool that reads and changes it.\n\n- On start-up, the proxy can record that an NSS database already trusts its certificates and skip running `certutil` on the next start. The record is a hash of the folder's contents. Before, `certutil` ran on every start.\n\n- Two environment variables are added to the proxy's list: `CCR_AGENT_PROXY_NSS_RECORDS_DISABLED` and `CCR_AGENT_PROXY_JAVA_STORE_DIRECT_DISABLED`. Their names suggest switches to turn off NSS record handling and direct Java trust-store handling. What reads them was not checked.\n\n- The proxy status report now includes `gitConfigConflicts`, plus fields for whether downloads and uploads are paused.\n\n**Why**\n\nCloud session start-up can skip a repeated certificate check. The new variables appear to offer a way to turn that behaviour off, and the proxy's status report shows more about its state.\n\n- Area: Cloud Sessions\n- Names: `CCR_AGENT_PROXY_NSS_RECORDS_DISABLED`\n- Tier: Use it now\n- Useful: 4\/5\n- Signal: 2\/5\n- Scope: individual\n- Heads-up: no"}