{"version":"2.1.224","anchor":"runner-can-refuse-repo-committed-settings-that-reach-outside","canonical_anchor":"runner-can-refuse-repo-committed-settings-that-reach-outside","heading":"Runner can refuse repo-committed settings that reach outside the workspace","tier":"use","area":"Self-Hosted Runner","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224\/e\/runner-can-refuse-repo-committed-settings-that-reach-outside","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224","markdown":"### Runner can refuse repo-committed settings that reach outside the workspace\n\nThe runner can warn about or block repo-committed settings that grant access outside the workspace.\n\n**What**\n\nBefore starting a session, the runner inspects the checked-out repo's `.claude\/settings.json` and `settings.local.json` for grants that would escape the session workspace and reports or blocks them. `--confine-repo-settings` (or `SELF_HOSTED_RUNNER_CONFINE_REPO_SETTINGS`) picks enforce, warn or off; the CLI defaults to warn, which logs what it would have refused and starts the session anyway.\n\n**Details**\n\n- What it looks at: permissions.allow paths, sandbox filesystem allowRead\/allowWrite, additionalDirectories, bare Edit and Write rules, `env` set by the repo, and any repo override of the operator's sandbox or hooks posture.\n- Symlinks and `..` are resolved, and a path that cannot be resolved is treated as a violation rather than allowed.\n- An invalid value for the flag fails at startup rather than silently falling back.\n- Outcomes are reported through telemetry named `self_hosted_confine`, with separate reasons for warn and enforce.\n\n**Evidence**\n\n`self_hosted_confine_violation_enforce`\n\n- Area: Self-Hosted Runner\n- Names: `--confine-repo-settings`, `SELF_HOSTED_RUNNER_CONFINE_REPO_SETTINGS`\n- Tier: Use it now\n- Useful: 3\/5\n- Signal: 4\/5"}