What
Before starting a session, the runner inspects the checked-out repo's .claude/settings.json and settings.local.json for grants that would escape the session workspace and reports or blocks them. --confine-repo-settings (or SELF_HOSTED_RUNNER_CONFINE_REPO_SETTINGS) picks enforce, warn or off; the CLI defaults to warn, which logs what it would have refused and starts the session anyway.
Details
- What it looks at: permissions.allow paths, sandbox filesystem allowRead/allowWrite, additionalDirectories, bare Edit and Write rules,
envset by the repo, and any repo override of the operator's sandbox or hooks posture. - Symlinks and
..are resolved, and a path that cannot be resolved is treated as a violation rather than allowed. - An invalid value for the flag fails at startup rather than silently falling back.
- Outcomes are reported through telemetry named
self_hosted_confine, with separate reasons for warn and enforce.
Evidence
self_hosted_confine_violation_enforce
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Names in the bundle--confine-repo-settingsSELF_HOSTED_RUNNER_CONFINE_REPO_SETTINGS
One source agreesOne thing we can check says the same as this entry.
The name it cites is new in this build
New in this build: SELF_HOSTED_RUNNER_CONFINE_REPO_SETTINGS