Claude Code: Self-Hosted Runners Arrive

Claude Code started life as a single terminal window you typed into. As of last week it can run on your own servers, spawn agents without a hard ceiling, and let separate sessions send each other messages. That is a different animal.

Table of Contents

Three changes, one changelog

The Claude Code changelog entry dated 7 August 2026, version 2.1.224, carries three capability changes at once:

Self-hosted runners. The command claude self-hosted-runner turns your own machines or containers into a place Claude Code web, mobile and desktop sessions can run. Team and Enterprise plans, public beta, off by default.
Cross-session messaging. Sessions can message each other on any of your machines, with ListAgents to discover them. macOS and Linux only.
No more 200-subagent cap. The old ceiling of 200 subagents per session is gone, so long-running sessions stop refusing new agents. Concurrency and depth limits still apply.

Self-hosted runners, minus the myth

The obvious assumption is that self-hosting keeps your code away from Anthropic. Half right. Self-hosted environments move execution, not inference. Your repository checkouts, build artefacts, secrets and any file a session creates stay on machines you provision. The conversation itself, meaning prompts, responses and tool results that can include code Claude reads, still goes to Anthropic for inference, and the transcript is stored so you can resume from another device. If your rule is that no code ever leaves your perimeter, this does not clear that bar.

The scoping is tight. Team and Enterprise only, GitHub-only checkouts in the current beta, and organisations on Zero Data Retention cannot use it at all. Anthropic itself says most enterprises should stick with the hosted option, and points self-hosting at teams whose compliance rules demand it, while warning that you should budget engineers to run it. Read that as a staffing line, not a footnote.

Sessions that talk, carefully

Cross-session messaging is narrower than it sounds, by design. A message is a piece of text one session writes to another. Never conversation history, never files, never permissions. An incoming message cannot approve an action, change a setting or run a slash command. A /compact typed into a message arrives as plain text and stays plain text.

The safeguards are the real story. A message arriving at a session that is running with bypassed permissions is held for your approval rather than delivered, and the approval dialog defaults to a five-minute expiry, after which the message is dropped rather than waved through. There are caps too: 100 held messages per session, 50 unread, plus an isolatePeerMachines switch that forces approval before any reply leaves the machine. Two eager agents will ping-pong forever otherwise, so the throttles earn their keep.

The bits that help

There is also an archive plugin source feature that installs plugins from a zip over HTTPS without git or npm, with optional SHA-256 pinning, a tidy way to lock a plugin to a known-good build. A day later, version 2.1.225 on 8 August let a session start a conversation with your Remote Control sessions on other machines by name, loosening the reply-only rule from the day before.

Should you touch it?

Solo on one Mac or Linux box: try cross-session messaging with two or three windows open and skip the runners. On a team where anyone runs sessions with permissions bypassed: set crossSessionInbound before you need it, not during your first mid-run surprise. Enterprise: cost the staffing before the compute. This is Claude Code growing edges, and edges are worth respecting.

Did you know: removing the 200-agent cap did not make fan-out unlimited. The concurrency and depth limits survived the change, and Anthropic pointedly declined to publish the numbers.

Sources

The free stack. One email a week: the AI tools and moves that actually matter, hype filtered out. Subscribe free →