Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.224 Home All releases ←olderv2.1.223 v2.1.225newer→
Claude Code v2.1.224

Server-supplied CLI arguments are validated on self-hosted runners

Under the hood
Useful2 Signal3
Self-Hosted Runners

Self-hosted runners now reject malformed or blocklisted CLI arguments handed down by the server.

What

Arguments the server hands to a self-hosted runner session are now checked against a name pattern and a blocklist before becoming CLI flags. Rejected ones are skipped and logged as "malformed" or "blocked", and the count of arguments actually applied is logged.

Details
  • Values starting with - are passed as --name=value so they are not parsed as a separate flag.
  • Log lines are assembled from a template beginning "[runner:session] Skipping ".
Evidence

[runner:session] Skipping

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Related

Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.

See this entry in the whole of v2.1.224 →