Claude Code Cloud Sessions: Web, --cloud, and Teleport

Cloud sessions are available on Pro, Max, and Team plans, and to Enterprise users with premium seats or Chat + Claude Code seats. They count toward your plan's usage limits like any other Claude usage; there is no separate charge for the VM.

Setup is a one-time GitHub connection, in one of two ways:

• Claude GitHub App: authorise it during onboarding at claude.ai/code. Sessions can clone any public repository, and private repositories where the app is installed. The app is also what enables auto-fix for pull requests.
• /web-setup: run it inside the Claude Code CLI to send your local gh token to your Claude account. Sessions can then reach any repository that token can access, without installing the app.

Onboarding then creates a Default environment with Trusted network access (or asks you to create it on Team and Enterprise plans). Pick a repository and branch, choose a permission mode, and describe the task. Cloud sessions offer Auto, Accept edits, and Plan; there is no Manual or Bypass mode, because nobody is at the VM to approve prompts.

Every cloud session runs in a cloud environment: a saved configuration for network access, environment variables, network secrets, and a setup script. The VM itself is Ubuntu 24.04 on x86_64, with common toolchains pre-installed and approximate limits of 4 vCPUs, 16 GB of RAM, and 30 GB of disk.

Network access has four levels:

• None: no outbound access through the session's network.
• Trusted (the default): an allowlist of package registries, GitHub, and cloud SDKs.
• Full: any domain.
• Custom: your own allowlist, optionally with the defaults.

At every level, a few paths bypass the allowlist: GitHub through its own proxy, MCP connectors you enable, hosts listed on network secrets, and the Anthropic API for Claude Code's own requests, even at None. So "None" does not mean data cannot leave the VM.

Environment variables are not secret. Anyone who uses the environment can read them and the setup script, and every command Claude runs can read them. For API keys, use a network secret: Anthropic's proxy attaches the key to requests for the hosts you list after they leave the VM, so the key never enters the session. Your GitHub credentials are handled the same way, through the GitHub proxy.

A setup script is a Bash script, set in the environment dialog, that runs as root before Claude Code launches. Use it to install what the VM lacks:

1#!/bin/bash2apt update && apt install -y shellcheck3pip install -r requirements-dev.txt || true

It has three rules. It must exit zero, or the session fails to start (append || true to non-critical steps). It must finish in roughly five minutes, or the environment is not cached. And installs need network access, so a None-level environment cannot use package managers.

When setup finishes in time, Anthropic snapshots the filesystem and new sessions start from that snapshot, skipping the script. The cache keeps files, packages, and Docker images, but not running processes, so a database the script started is not running in the next session. The script runs again when you change it or the allowed hosts, and when the cache expires after roughly seven days.

For project setup that should happen in local and cloud sessions alike, such as npm install, use a SessionStart hook in the repository's .claude/settings.json instead. It runs after Claude Code launches, on every session including resumed ones.

A cloud session starts from a fresh clone. Anything committed to the repository is available; anything that lives only on your machine is not.

Available: the repo's CLAUDE.md, .claude/rules/, .claude/skills/, .claude/agents/, and .claude/commands/; hooks and permission rules in .claude/settings.json; MCP servers in .mcp.json (in a session with one repository); and your organisation's server-managed settings.

Not available: your ~/.claude/CLAUDE.md, user-level skills, agents, and settings; MCP servers added with claude mcp add at the default local or user scope; plugins, even ones the repo's settings enable; managed settings deployed to your laptop by MDM; and interactive logins.

The fix is usually to commit the configuration. Add an MCP server with claude mcp add --scope project so it lands in .mcp.json, and move skills you want everywhere into the repository's .claude/skills/. Skills you enable on claude.ai also load in cloud sessions.

From the CLI, signed in with the same claude.ai account:

1# start a new cloud session for the current repository2claude --cloud "Fix the flaky test in auth.spec.ts"3 4# several independent tasks run in parallel, one session each5claude --cloud "Update the API documentation"6 7# queue a follow-up into a running session and exit8claude -p "also add a regression test" --cloud <session-id>9 10# pull a cloud session into this terminal11claude --teleport            # picker12claude --teleport <session-id>

--cloud clones your current directory's GitHub remote at the current branch, not your local checkout, so push local commits first. If the repository has no remote, or the GitHub App is not installed on it, Claude Code uploads a bundle of the local repository instead (under 100 MB, committed history plus uncommitted changes to tracked files, never untracked files). On macOS, Linux, and WSL, uncommitted changes to files that look like credentials, such as .env, *.tfvars, or id_rsa, are left out of the upload.

--teleport checks that your working tree is clean, that you are in a checkout of the same repository (not a fork), that the session's branch has been pushed, and that you use the same account. It then checks out the branch and loads the full conversation. The terminal gets its own copy: new work there does not appear in the cloud session.

Each session shows a diff indicator such as +42 -18. Open it to review changes against the base branch (or any branch you pick with Compare against), click lines to leave inline comments, and send them with your next message. When the diff looks right, Create PR opens a full or draft pull request. The session stays live afterwards, so you can paste CI failures or reviewer comments and keep going.

Auto-fix goes a step further: Claude subscribes to the pull request's GitHub activity, and when a check fails or a reviewer comments, it investigates and pushes a fix if one is clear. Ambiguous or architecturally significant comments come back to you as questions. Turn it on from the CI status bar in the session, with /autofix-pr in the CLI on the PR's branch, or by asking Claude to watch a PR. It requires the Claude GitHub App on the repository.

Two cautions from the docs. Auto-fix cannot react to merge conflicts, because GitHub sends no event when the base branch moves; ask Claude to rebase. And Claude's replies on review threads are posted with your GitHub account (labelled as Claude Code), which can trigger comment-driven automation such as Atlantis or issue_comment workflows.

Cloud sessions share rate limits with the rest of your Claude usage, so five parallel sessions use limits five times as fast. Idle sessions pause after a few minutes and their VMs can be reclaimed; reopening provisions a fresh VM with the conversation restored, but background work such as running subagents or shell commands is lost.

Repository cloning and pull requests require GitHub (GitHub Enterprise Server is supported on Team and Enterprise). GitLab or Bitbucket code can be sent as a bundle with CCR_FORCE_BUNDLE=1, but the session cannot push results back to that remote. And because the session runs on Anthropic's infrastructure, it cannot reach services that exist only on your network unless they are reachable from the internet and allowed by the environment.

Use a GitHub repository with a test command and a small open issue.

1. Connect GitHub at claude.ai/code (or run /web-setup), keep the Default environment, and start a session on the issue in Plan mode. Approve the plan. 2. When the branch is pushed, open the diff, leave one inline comment, and send it. Create a draft PR. 3. In a local checkout, commit and push a small change, then run claude --cloud "add a test for <function>" and watch the setup checklist. 4. When that session finishes, run claude --teleport, pick it, and run the tests locally. 5. Add a setup script that installs one tool your project needs, start a new session, and confirm the tool is available. Start another session and confirm it starts faster from the cache.

Pass criterion: the PR contains the change and your inline comment's fix, the teleported branch passes tests locally, and the second session after the setup script skips the setup step.