Upstream Proxy for Remote Sessions / Claude Code v2.1.85

What

Remote Claude Code sessions can now route traffic through an upstream WebSocket proxy with automatic CA certificate management.

Details

Activated when CCR_UPSTREAM_PROXY_ENABLED and CLAUDE_CODE_REMOTE environment variables are set
Reads session tokens from /run/ccr/session_token
Connects to the proxy via /v1/code/upstreamproxy/ws WebSocket endpoint
Fetches CA certificates from /v1/code/upstreamproxy/ca-cert
Includes Proxy-Authorization header support
Relay listener starts on 127.0.0.1 for local proxying
Comprehensive error handling and logging with [upstreamproxy] prefix

Evidence

Upstream proxy initialization (search for "[upstreamproxy] enabled on 127.0.0.1")

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

The build it came inv2.1.85

26 Mar 2026 · 20 entries, this one is #5.

Either side of it

Open the release →

Names in this entry

envCCR_UPSTREAM_PROXY_ENABLED
One of three switches, with CCR_AGENT_PROXY_ENABLED and CCR_EGRESS_GATEWAY_ENABLED, that lets the egress gateway start in a remote session (CLAUDE_CODE_REMOTE truthy); a truthy value is 1, true, yes or on. With any switch on, the gateway then needs CLAUDE_CODE_REMOTE_SESSION_ID and a session token, and starts a local relay on 127.0.0.1 that connects to the gateway over a websocket. Outside a remote session it has no effect.
envCLAUDE_CODE_REMOTE
Remote sessions started from review can skip writing some state to disk.
slash/run
Skill. Launch and drive your project's app to see a change working, not only passing tests. See Run and verify your app

Is this right?