Follow Discord
Sweep 22 Oct 2026 · 04:32Z Build v2.1.308 527 read Stable v2.1.308 Latest v2.1.308 Next v2.1.308 Feeds RSS JSON llms.txt llms-full.txt Unofficial
HomeReleasesv2.1.238entry #45

Claude Code v2.1.238 ·

Self-hosted runner can mint a Proxy-Authorization header per connection

The self-hosted runner can generate a fresh proxy auth token for every outbound connection.

Use it now Notable New Features
JSON All of v2.1.238
Use it nowTier: how much it should matter to you
3Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
Self-Hosted RunnerArea: what it touches
New FeaturesKind: in v2.1.238,
What probably matters to youSection of the release
What

The self-hosted runner can now authenticate to an outbound HTTP proxy with a token it generates fresh for every connection, via --proxy-authorization-command / SELF_HOSTED_RUNNER_PROXY_AUTHORIZATION_COMMAND or --proxy-authorization-file / SELF_HOSTED_RUNNER_PROXY_AUTHORIZATION_FILE. Set exactly one. It is off unless you set it, and the help text says it is not yet supported with the orchestrator subcommand.

Details
  • With it set, the runner starts a small forwarding proxy on 127.0.0.1 that injects the header, then points HTTPS_PROXY/HTTP_PROXY at itself for the runner and every session it spawns, clearing the other proxy variables. NO_PROXY is left alone.
  • The command is re-run, or the file re-read, for each new connection, so rotating tokens stay current. The value is never logged.
  • The real upstream proxy must be named by HTTPS_PROXY or HTTP_PROXY, and must be http:// or https://. ALL_PROXY alone is rejected.
  • The listener is brought up before the runner registers; if it cannot start, the runner prints a [runner:fatal] line and exits with code 1.
  • Both new environment variables are stripped from the environment handed to child processes, alongside the existing pool and environment secrets. Configured runs report self_hosted_egress_proxy_auth.
Evidence

SELF_HOSTED_RUNNER_PROXY_AUTHORIZATION_COMMAND, set only one of --proxy-authorization-command (SELF_HOSTED_RUNNER_PROXY_AUTHORIZATION_COMMAND) and --proxy-authorization-file (SELF_HOSTED_RUNNER_PROXY_AUTHORIZATION_FILE), [runner:fatal] could not start the proxy-authorization listener:

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Read from
Names in the bundle--proxy-authorization-command--proxy-authorization-fileSELF_HOSTED_RUNNER_PROXY_AUTHORIZATION_COMMANDSELF_HOSTED_RUNNER_PROXY_AUTHORIZATION_FILE
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agreeAdded claude self-hosted-runner --proxy-authorization-command / --proxy-authorization-file for egress proxies that require a freshly issued…

See this entry in the whole of v2.1.238 →

Feedback