Hidden Claude Desktop code reveals an unreleased self-hosted session endpoint

RUNTIMEWIRE INVESTIGATION — Original analysis

Original reporting by RuntimeWire, based on reverse engineering.

Why it matters

Enterprises are pushing control beyond the model endpoint. A customer-run session host would centralize Claude Code execution, policy and audit while keeping Desktop as the employee interface.

Reporting record

Claude Desktop 2.2553.1 contains an internal configuration that can redirect the Code tab's session traffic to an organization-specified HTTPS server, according to RuntimeWire's static analysis of the app's packaged source.

Three days before that build, Coder announced Claude Code support for Agent Relay, an early-access integration that also places tool execution inside customer-controlled workspaces. Coder said it developed the integration with support from the Claude Code team and was working with selected design partners.

The configuration group is titled "Self-hosted execution." It describes selfHostedUrl as the HTTPS endpoint of a self-hosted session host, then supplies the more important caveat: "Unreleased: only internal builds act on it."

How this compares with Coder's Agent Relay

Coder announced Claude Code support for Agent Relay on September 15th, 2026. Coder described the integration as developed with support from the Claude Code team and said it was in early access with selected design partners. Its published architecture places a runner inside each customer-controlled workspace. That runner opens an outbound connection to Anthropic's backend, and tool calls execute inside the workspace.

Under Coder's description, Anthropic still operates the agent loop and handles inference, account administration and billing. Developers use Claude Desktop or claude.ai as the interface. Desktop access to remotely executed Claude Code sessions was therefore already public and is not the distinguishing finding in RuntimeWire's analysis.

The packaged application supplies narrower evidence about a specific client behavior. RuntimeWire found the hidden selfHostedUrl setting and implementation code that redirects requests matching /v1/code/sessions and /v1/environment_providers/ to the configured HTTPS host. In ordinary terms, the setting changes where Desktop sends requests for coding sessions and execution environments. Coder describes a workspace runner connecting to Anthropic; the Desktop code describes session API traffic being directed to a specified host.

That distinction deserves attention, but it does not establish separate products. Both connection paths could belong to the same deployment architecture. The package does not identify who would operate the configured host, whether it would forward requests to Anthropic, where inference ultimately happens, or how the setting relates to Coder's integration. Static analysis found implementation code, not a tested deployment, and the cited public documentation does not resolve the relationship.

This concerns the agent runtime and session infrastructure. RuntimeWire found no evidence of downloadable Claude model weights, offline inference, or a customer-hosted foundation model.

Anthropic released Claude Desktop 2.2553.1 on September 18th, listing session and file-rewind fixes while reporting no user-facing changes for third-party deployments. The self-hosted code was absent from RuntimeWire's September 10th comparison package and present in the September 18th build. Its schema names version 2.110.0, released September 15th, as the minimum version for most of the related settings.

RuntimeWire performed static analysis of the packaged application. We did not alter its internal-build gate, execute the hidden functionality, authenticate to private services, or contact the placeholder endpoint included in the schema.

A session host, rather than another model gateway

For requests sent through the hidden path, the client obtains a credential, preserves the request method and body, handles authentication failures and retry metadata, and keeps long-lived responses open when a request accepts text/event-stream.

That API surface differs from Anthropic's existing customer-operated inference gateway. The documented gateway primarily implements POST /v1/messages, with an optional GET /v1/models, and forwards model requests to an inference provider. The hidden configuration instead applies to Code session and environment-provider traffic.

The environment_providers route name suggests the host can advertise or manage execution environments. That interpretation remains an inference because the desktop package contains client plumbing rather than the server implementation.

Anthropic already allows organizations to route Claude Desktop inference through Google Cloud, Amazon Bedrock, Microsoft Foundry, Anthropic's API, or a compatible gateway. Its public third-party architecture says conversation history stays on the user's device and the Code sandbox remains a local virtual machine.

Anthropic also documents remote Code sessions over SSH, with the interface on the employee's device and the Claude Code engine on an approved remote host. The hidden setting adds a configurable HTTPS path for session APIs, but the package does not show how that path relates to the SSH feature or Agent Relay.

Anthropic already has one self-hosted execution product

Anthropic made self-hosted sandboxes for Claude Managed Agents available on May 19th. That product keeps orchestration in Anthropic's control plane while customers run tool execution, files and network access on their own infrastructure. Customer workers poll an Anthropic queue, claim sessions and return tool results.

The Desktop implementation has a different visible boundary: the client redirects its session API to a custom base URL. The package does not establish whether Anthropic is building a Desktop front end for Managed Agents, supporting Coder's integration, creating a separate enterprise control plane, or providing infrastructure that could serve more than one of those uses.

One clue is configuration precedence. When the self-hosted block is present, the app removes or ignores a separately configured inference-provider block before processing the deployment. The session host therefore appears intended to own a broader portion of the request path than an execution worker alone. The final model-inference route is not visible in the archive.

Corporate identity is built into the plumbing

The configuration supports interactive OpenID Connect sign-in, a system-browser flow, operating-system identity brokers, an executable credential helper and a static bearer token. Microsoft Entra is named for broker authentication, with Web Account Manager on Windows and Company Portal on macOS.

Credential helpers can return a token and additional request headers through standard output. The app can cache those credentials, refresh them silently and store persistent OIDC tokens through Keychain, Windows Data Protection API or libsecret when available. Stored tokens are tied to the session-host and identity-provider configuration, then discarded when those settings change.

The host normally must use HTTPS and cannot include a query string or fragment. Plain HTTP is restricted to loopback addresses under limited local or device-management conditions. Those controls fit an enterprise deployment distributed through mobile-device management rather than a preference exposed to individual users.

The packaged production configuration reader appears to exclude keys marked internal-only. That matches the schema's warning that ordinary builds do not act on the endpoint, even though the implementation ships inside the app.

Remote execution with a narrow path back to the laptop

A separate section of the package creates a WebSocket bridge under /v1/code/devices/<device>_<session>/bridge. The bridge lets the session host advertise selected file tools on the employee's device, subject to organization policy.

The observed implementation explicitly refuses device_bash, directing the caller toward file staging and commit operations instead. That boundary indicates command execution is intended to remain away from the employee's device while preserving controlled access to files needed from the desktop.

The finding does not establish that a remote session receives unrestricted laptop access. The visible bridge offers a limited tool set, and its behavior still depends on user permissions and organization policy. A complete security assessment would require the host implementation and the final permission interface.

Centralizing the runtime would give enterprises one place to standardize operating systems, dependencies, repository access, secrets, network policy, audit records and retention. It would also concentrate source code, credentials and tool access in a service that becomes a high-value target. Tenant isolation, ephemeral environments, secret brokering and revocable file permissions would become core product requirements.

Cloudflare is an outbound-networking precedent

Anthropic already uses Cloudflare for its MCP tunnels research preview. Customers run cloudflared and an Anthropic proxy inside their networks, creating outbound-only connections that let Claude reach private MCP servers without opening inbound firewall ports.

RuntimeWire found no code tying that system to selfHostedUrl. The archive contains no cloudflared executable or feature-specific implementation string connecting the session host to Cloudflare.

Cloudflare's development-only Quick Tunnels are also a poor direct match. Cloudflare says they do not support Server-Sent Events, while Claude's hidden forwarding path explicitly preserves event-stream requests. A production Cloudflare Tunnel could still sit in front of the host, as could another reverse proxy or a directly reachable private ingress.

The code establishes that Claude Desktop contains client plumbing for directing coding-session and execution-environment requests to a configured HTTPS host. It does not establish who will operate that host, whether it forwards requests to Anthropic, where model inference will occur, how it relates to Coder's Agent Relay, or when customers might gain access.