What
Nine new tools let an operator inspect and drive a self-hosted runner fleet: self_hosted_runner_get_pool, _list_runners, _list_sessions, _list_secrets, _spawn_local, _read_health, _read_metrics, _tail_log and _requeue_session. They load only when the CLI's --base-tools names one of them, and never when CLAUDE_CODE_REMOTE is set or the session kind is "bg". Auth reuses the operator's existing OAuth session, and tailed logs are redacted for secrets before reaching model context.
Details
- The enabling latch is one-way in production: the internal helper that turns the operator tools back off is documented as test-only.
- When a runner spawns a session, any tool name starting with
self_hosted_runner_is stripped from the server-supplied tools list before launch, so a spawned session cannot be handed fleet-operator tools. - If stripping empties the list, the
--toolsargument is dropped entirely and the default tool pool is used.
Evidence
[runner:session] Stripped self-hosted-runner operator tool names from the server-supplied tools arg, self_hosted_runner_spawn_local
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Names in the bundleCLAUDE_CODE_REMOTE