Nine operator tools can inspect runners, sessions, secrets, health, metrics and logs, loaded only via --base-tools.
What's wrong with this entry?
Nine new tools let an operator inspect and drive a self-hosted runner fleet: self_hosted_runner_get_pool, _list_runners, _list_sessions, _list_secrets, _spawn_local, _read_health, _read_metrics, _tail_log and _requeue_session. They load only when the CLI's --base-tools names one of them, and never when CLAUDE_CODE_REMOTE is set or the session kind is "bg". Auth reuses the operator's existing OAuth session, and tailed logs are redacted for secrets before reaching model context.
- The enabling latch is one-way in production: the internal helper that turns the operator tools back off is documented as test-only.
- When a runner spawns a session, any tool name starting with
self_hosted_runner_is stripped from the server-supplied tools list before launch, so a spawned session cannot be handed fleet-operator tools. - If stripping empties the list, the
--toolsargument is dropped entirely and the default tool pool is used.
[runner:session] Stripped self-hosted-runner operator tool names from the server-supplied tools arg, self_hosted_runner_spawn_local
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
-
v2.1.234
Self-hosted runners report when warm-up finished
Both mention self hosted runner
-
v2.1.236
Self-hosted runner releases a session only after its work finishes
Both mention self hosted runner
-
v2.1.236
Runner waits for sessions to be released before shutting down
Both mention self hosted runner