The runner can warn about or block repo-committed settings that grant access outside the workspace.
What's wrong with this entry?
Before starting a session, the runner inspects the checked-out repo's .claude/settings.json and settings.local.json for grants that would escape the session workspace and reports or blocks them. --confine-repo-settings (or SELF_HOSTED_RUNNER_CONFINE_REPO_SETTINGS) picks enforce, warn or off; the CLI defaults to warn, which logs what it would have refused and starts the session anyway.
- What it looks at: permissions.allow paths, sandbox filesystem allowRead/allowWrite, additionalDirectories, bare Edit and Write rules,
envset by the repo, and any repo override of the operator's sandbox or hooks posture. - Symlinks and
..are resolved, and a path that cannot be resolved is treated as a violation rather than allowed. - An invalid value for the flag fails at startup rather than silently falling back.
- Outcomes are reported through telemetry named
self_hosted_confine, with separate reasons for warn and enforce.
self_hosted_confine_violation_enforce
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
-
v2.1.234
Self-hosted runners report when warm-up finished
Both mention self hosted runner
-
v2.1.236
Self-hosted runner releases a session only after its work finishes
Both mention self hosted runner
-
v2.1.236
Runner waits for sessions to be released before shutting down
Both mention self hosted runner