Remote and ephemeral machines
anyray-connect configures the machine it runs on, but coding agents often run somewhere else.
Each remote is one headless command away from routing through your gateway.
Two things hold on every path below. With --yes, a run never prompts. And sign-in needs no local
browser: enrollment polls the gateway, so you open the printed URL anywhere and the remote CLI
completes on its own.
Devcontainers and Codespaces
Add your org's SSO link (or a shared enrollment link) as a
Codespaces or devcontainer secret named ANYRAY_SSO_LINK. Secrets arrive as environment
variables, so the link never sits in a committed file.
{
"postCreateCommand": "curl -fsSL https://app.anyray.ai/connect.sh | sh -s -- --sso \"$ANYRAY_SSO_LINK\" --yes"
}
The installer puts anyray-connect on PATH, enrolls, and applies.
Run anyray-connect status inside the container.
What a container skips, and why that is correct
status and doctor print an Environment section naming the detected backend. Containers
have no launchd or systemd --user, so connect skips the OS auto-refresh schedule on purpose.
The session drives renewal instead: Claude Code through its apiKeyHelper, and MCP clients and
the VS Code extension through a throttled tick. Connect also skips self-update, because a
container updates by rebuilding the image. Neither skip is a failure.
The apply ends by pulling the org's skills and connectors, so a container carries them from
postCreateCommand on.
Mount a directory, not a single config file
Mounting a single file to persist tool state across rebuilds (say ~/.claude.json) pins
that path as a mount point. Linux refuses to atomically replace a mount point, so
write-then-rename config publishing cannot swap it. anyray-connect detects this and writes
such files in place, verified by re-reading but not atomic. doctor names each affected
file. Mount the parent directory or a volume instead:
{
// Prefer a directory or volume mount: atomic config writes keep working.
"mounts": ["source=claude-state,target=/home/vscode/.claude-state,type=volume"]
// Avoid: "type=bind,source=${localEnv:HOME}/.claude.json,target=/home/vscode/.claude.json"
}
Connect lists the environments you work in
An interactive run shows its plan before writing anything. Under Other environments you work in it lists the SSH remotes, dev containers, WSL distros, Codespaces, and tunnels found in your editors' recent history. A run configures only the machine it executes on, so treat that list as a checklist.
For personal machines with dotfiles, the same one-liner works in a Codespaces dotfiles install script.
SSH remotes
SSH into the host and run the normal installer command. Enrollment prints a sign-in URL and code, which you open in the browser on your laptop.
curl -fsSL https://app.anyray.ai/connect.sh | sh -s -- --sso https://app.anyray.ai/sso/tnt_example --yes
An SSH host is a real machine, so the systemd --user auto-refresh schedule installs normally.
Windows remote desktops
A persistent desktop (Azure Virtual Desktop, Windows 365, or Citrix with a roaming profile) is a Windows machine like any other. Run the installer once, and the Scheduled Task keeps the key, skills, and connectors fresh.
A non-persistent pool resets the profile at logoff. Enroll on login with the managed installer and policy file instead, so nothing has to survive the session.
Commit the routing with the repo
Instead of configuring each machine, commit the routing. Then every checkout routes, including checkouts on machines you never touch.
anyray-connect --project --yes
This writes two committable files in the current repo:
| File | What it carries |
|---|---|
.claude/settings.json | ANTHROPIC_BASE_URL pointing at the gateway, plus an apiKeyHelper (anyray-connect print-key) that resolves each developer's own key on demand. |
.codex/config.toml | An Anyray model_providers block with command-backed auth: the same helper, no serialized key. |
The files are machine-independent by construction. They carry no credential, no identity, and no
absolute paths. Each consuming machine still needs anyray-connect installed and enrolled once,
which the devcontainer bootstrap above provides.
anyray-connect --project --revert removes exactly what was written and preserves other settings.
Subscription seat pass-through is a per-developer, per-machine lane, so it cannot ride a committed
file. A checked-in project config bills that repo through the org API on every machine that opens
it, which is why the command asks first. anyray-connect --revert undoes one machine only and
cannot touch these files, so run anyray-connect --project --revert in the repo and commit it.
CI jobs
Enroll the job as a service key, put the key in the runner's secret store, and run the same headless bootstrap:
export ANYRAY_CLIENT_KEY=ark_svc_… # from the runner's secret store
curl -fsSL https://app.anyray.ai/connect.sh | sh -s -- --gateway <origin> --yes
Scope the run with --tools shell-env if the job only needs the SDK env. A service key never
refreshes, so the container needs no schedule and no helper. What else changes on that lane:
Service keys.
Hosted cloud agents
Codex cloud tasks, Cursor cloud agents, Devin, Claude Code on the web, and the Copilot cloud agent run on vendor infrastructure. Their model calls never leave the vendor's backend, so machine config cannot route them. Checked against each vendor's docs in July 2026.
| Hosted agent | Env/secret injection into the sandbox | Its own inference redirectable? |
|---|---|---|
| OpenAI Codex cloud | Yes: per-repo environments, setup scripts | No |
| Cursor cloud agents | Yes: dashboard secrets, environment.json | No, curated models via Cursor's backend |
| Devin | Yes: org secrets, YAML blueprints | No, "does not currently support third-party LLM API keys" |
| Claude Code on the web | Yes: cloud environments (no secrets store) | No, inference rides an Anthropic-bound channel |
| Copilot cloud agent | Yes: Agents secrets, copilot-setup-steps.yml | No, endpoint pinned to api.*.githubcopilot.com |
Every vendor lets the sandbox reach your gateway through an egress allowlist, but the agent's own model client stays outside the configurable path. That spend is billed by the vendor and never reaches Anyray's spend store.
The one partial opening today is the Copilot cloud agent on self-hosted runners, where inference transits your own network. If hosted-agent visibility matters to your org, tell us.