From d2696ff5572c5ba89282fbf9991e6626271d5009 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 27 Oct 2026 14:31:26 +0000
Subject: [PATCH 1/7] feat: optional Claude Code self-hosted runner with a
 skill for sharing the workspace

Add modules/claude-self-hosted-runner, vendored into all three templates.
A switch (default off) starts `claude self-hosted-runner` in a restart loop
in tmux session `claude-runner` on every workspace start, once the user has
saved ~/.claude-runner/environment-secret; the secret never goes through
Terraform. A second parameter sets the number of concurrent sessions (1-4).

The runner rewrites ~/.gitconfig and ~/.config/git before every session, so
the session git identity and ignore list go in /etc/gitconfig, reinstalled
on each start, and the runner refuses to start alongside remote control.

It also installs:
- ~/.claude/skills/coder-shared-workspace, copied into every session, with
  rules for sessions sharing one Docker daemon and DDEV install: worktrees
  instead of shared checkouts, no workspace-wide Docker/DDEV commands, and a
  flock around test suites that power off DDEV.
- claude-sessions, listing live sessions with checkout, branch and unpushed
  commits, and --push-outcome-on-release, so commits from repositories that
  forbid agents to push still reach the session's claude/ branch.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UrTUMvjLtFGNseL9fh5s4o
---
 CLAUDE.md                                     |  2 +-
 Makefile                                      | 11 ++-
 docs/user/using-workspaces.md                 | 22 +++++
 .../claude-self-hosted-runner/files/SKILL.md  | 87 +++++++++++++++++++
 .../files/claude-runner-loop.sh.tftpl         | 20 +++++
 .../files/claude-sessions                     | 13 +++
 .../claude-self-hosted-runner/files/gitconfig |  8 ++
 .../claude-self-hosted-runner/files/gitignore |  4 +
 .../modules/claude-self-hosted-runner/main.tf | 44 ++++++++++
 .../claude-self-hosted-runner/outputs.tf      | 42 +++++++++
 .../claude-self-hosted-runner/variables.tf    | 17 ++++
 .../claude-self-hosted-runner/versions.tf     |  7 ++
 drupal-contrib/template.tf                    |  7 ++
 drupal-contrib/tests/validate.tftest.hcl      | 56 ++++++++++++
 .../claude-self-hosted-runner/files/SKILL.md  | 87 +++++++++++++++++++
 .../files/claude-runner-loop.sh.tftpl         | 20 +++++
 .../files/claude-sessions                     | 13 +++
 .../claude-self-hosted-runner/files/gitconfig |  8 ++
 .../claude-self-hosted-runner/files/gitignore |  4 +
 .../modules/claude-self-hosted-runner/main.tf | 44 ++++++++++
 .../claude-self-hosted-runner/outputs.tf      | 42 +++++++++
 .../claude-self-hosted-runner/variables.tf    | 17 ++++
 .../claude-self-hosted-runner/versions.tf     |  7 ++
 drupal-core/template.tf                       |  7 ++
 drupal-core/tests/validate.tftest.hcl         | 65 ++++++++++++++
 .../claude-self-hosted-runner/files/SKILL.md  | 87 +++++++++++++++++++
 .../files/claude-runner-loop.sh.tftpl         | 20 +++++
 .../files/claude-sessions                     | 13 +++
 .../claude-self-hosted-runner/files/gitconfig |  8 ++
 .../claude-self-hosted-runner/files/gitignore |  4 +
 .../modules/claude-self-hosted-runner/main.tf | 44 ++++++++++
 .../claude-self-hosted-runner/outputs.tf      | 42 +++++++++
 .../claude-self-hosted-runner/variables.tf    | 17 ++++
 .../claude-self-hosted-runner/versions.tf     |  7 ++
 freeform/template.tf                          |  7 ++
 freeform/tests/validate.tftest.hcl            | 56 ++++++++++++
 .../claude-self-hosted-runner/files/SKILL.md  | 87 +++++++++++++++++++
 .../files/claude-runner-loop.sh.tftpl         | 20 +++++
 .../files/claude-sessions                     | 13 +++
 .../claude-self-hosted-runner/files/gitconfig |  8 ++
 .../claude-self-hosted-runner/files/gitignore |  4 +
 modules/claude-self-hosted-runner/main.tf     | 44 ++++++++++
 modules/claude-self-hosted-runner/outputs.tf  | 42 +++++++++
 .../claude-self-hosted-runner/variables.tf    | 17 ++++
 modules/claude-self-hosted-runner/versions.tf |  7 ++
 .../add-claude-self-hosted-runner/proposal.md | 18 ++++
 .../specs/claude-self-hosted-runner/spec.md   | 22 +++++
 .../add-claude-self-hosted-runner/tasks.md    | 10 +++
 48 files changed, 1249 insertions(+), 2 deletions(-)
 create mode 100644 drupal-contrib/modules/claude-self-hosted-runner/files/SKILL.md
 create mode 100644 drupal-contrib/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
 create mode 100644 drupal-contrib/modules/claude-self-hosted-runner/files/claude-sessions
 create mode 100644 drupal-contrib/modules/claude-self-hosted-runner/files/gitconfig
 create mode 100644 drupal-contrib/modules/claude-self-hosted-runner/files/gitignore
 create mode 100644 drupal-contrib/modules/claude-self-hosted-runner/main.tf
 create mode 100644 drupal-contrib/modules/claude-self-hosted-runner/outputs.tf
 create mode 100644 drupal-contrib/modules/claude-self-hosted-runner/variables.tf
 create mode 100644 drupal-contrib/modules/claude-self-hosted-runner/versions.tf
 create mode 100644 drupal-core/modules/claude-self-hosted-runner/files/SKILL.md
 create mode 100644 drupal-core/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
 create mode 100644 drupal-core/modules/claude-self-hosted-runner/files/claude-sessions
 create mode 100644 drupal-core/modules/claude-self-hosted-runner/files/gitconfig
 create mode 100644 drupal-core/modules/claude-self-hosted-runner/files/gitignore
 create mode 100644 drupal-core/modules/claude-self-hosted-runner/main.tf
 create mode 100644 drupal-core/modules/claude-self-hosted-runner/outputs.tf
 create mode 100644 drupal-core/modules/claude-self-hosted-runner/variables.tf
 create mode 100644 drupal-core/modules/claude-self-hosted-runner/versions.tf
 create mode 100644 freeform/modules/claude-self-hosted-runner/files/SKILL.md
 create mode 100644 freeform/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
 create mode 100644 freeform/modules/claude-self-hosted-runner/files/claude-sessions
 create mode 100644 freeform/modules/claude-self-hosted-runner/files/gitconfig
 create mode 100644 freeform/modules/claude-self-hosted-runner/files/gitignore
 create mode 100644 freeform/modules/claude-self-hosted-runner/main.tf
 create mode 100644 freeform/modules/claude-self-hosted-runner/outputs.tf
 create mode 100644 freeform/modules/claude-self-hosted-runner/variables.tf
 create mode 100644 freeform/modules/claude-self-hosted-runner/versions.tf
 create mode 100644 modules/claude-self-hosted-runner/files/SKILL.md
 create mode 100644 modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
 create mode 100644 modules/claude-self-hosted-runner/files/claude-sessions
 create mode 100644 modules/claude-self-hosted-runner/files/gitconfig
 create mode 100644 modules/claude-self-hosted-runner/files/gitignore
 create mode 100644 modules/claude-self-hosted-runner/main.tf
 create mode 100644 modules/claude-self-hosted-runner/outputs.tf
 create mode 100644 modules/claude-self-hosted-runner/variables.tf
 create mode 100644 modules/claude-self-hosted-runner/versions.tf
 create mode 100644 openspec/changes/add-claude-self-hosted-runner/proposal.md
 create mode 100644 openspec/changes/add-claude-self-hosted-runner/specs/claude-self-hosted-runner/spec.md
 create mode 100644 openspec/changes/add-claude-self-hosted-runner/tasks.md

diff --git a/CLAUDE.md b/CLAUDE.md
index 4c3cff1..7aa34fb 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -79,7 +79,7 @@ make test-templates
 
 ## Shared Terraform Assets
 
-Some Terraform config (currently `modules/claude-remote-control`, `modules/docker-daemon`, `shared/vscode-extensions.tf`, `shared/bashrc-symlink-guard.sh` and `shared/ssh-agent-setup.sh`) is shared across all three templates but must exist as a **physical copy inside each template directory** — `coder templates push` and CI's `terraform validate`/`test` only ever operate on a single template directory, so a relative `../modules` or `../shared` reference would not survive the push and would not be visible to CI.
+Some Terraform config (currently `modules/claude-remote-control`, `modules/claude-self-hosted-runner`, `modules/docker-daemon`, `shared/vscode-extensions.tf`, `shared/bashrc-symlink-guard.sh` and `shared/ssh-agent-setup.sh`) is shared across all three templates but must exist as a **physical copy inside each template directory** — `coder templates push` and CI's `terraform validate`/`test` only ever operate on a single template directory, so a relative `../modules` or `../shared` reference would not survive the push and would not be visible to CI.
 
 - **Edit only the canonical source**: `modules/claude-remote-control/` or `shared/vscode-extensions.tf` at the repo root. Never hand-edit the vendored copies (`<template>/modules/claude-remote-control/`, `<template>/vscode-extensions.tf`) — they get overwritten the next time anyone runs the sync.
 - **Always resync through `make`**, never by hand-copying: `make sync-shared` (or `make sync-claude-module` / `make sync-vscode-extensions` individually). `make validate`, `make test-templates`, and every `make push-template-*` / `make push-all-templates` target already depend on `sync-shared`, so day-to-day you rarely need to invoke it directly.
diff --git a/Makefile b/Makefile
index 7fbc36e..69aa70d 100644
--- a/Makefile
+++ b/Makefile
@@ -115,6 +115,15 @@ sync-claude-module: ## Vendor modules/claude-remote-control into each template d
 	done
 	@echo "Synced modules/claude-remote-control into: $(TEMPLATES)"
 
+.PHONY: sync-claude-runner-module
+sync-claude-runner-module: ## Vendor modules/claude-self-hosted-runner into each template dir (same reason as sync-claude-module: push only bundles the given --directory)
+	@for t in $(TEMPLATES); do \
+		rm -rf $$t/modules/claude-self-hosted-runner; \
+		mkdir -p $$t/modules; \
+		cp -r modules/claude-self-hosted-runner $$t/modules/claude-self-hosted-runner; \
+	done
+	@echo "Synced modules/claude-self-hosted-runner into: $(TEMPLATES)"
+
 .PHONY: sync-vscode-extensions
 sync-vscode-extensions: ## Vendor shared/vscode-extensions.tf into each template dir (same reason as sync-claude-module: push only bundles the given --directory)
 	@for t in $(TEMPLATES); do \
@@ -146,7 +155,7 @@ sync-ssh-agent-setup: ## Vendor shared/ssh-agent-setup.sh into each template dir
 	@echo "Synced shared/ssh-agent-setup.sh into: $(TEMPLATES)"
 
 .PHONY: sync-shared
-sync-shared: sync-claude-module sync-vscode-extensions sync-docker-daemon-module sync-bashrc-guard sync-ssh-agent-setup ## Vendor all shared Terraform assets (modules + vscode-extensions.tf) into each template dir
+sync-shared: sync-claude-module sync-claude-runner-module sync-vscode-extensions sync-docker-daemon-module sync-bashrc-guard sync-ssh-agent-setup ## Vendor all shared Terraform assets (modules + vscode-extensions.tf) into each template dir
 
 .PHONY: validate
 validate: sync-shared ## Validate all Terraform templates (requires terraform in PATH)
diff --git a/docs/user/using-workspaces.md b/docs/user/using-workspaces.md
index f9a0b6a..f6ae485 100644
--- a/docs/user/using-workspaces.md
+++ b/docs/user/using-workspaces.md
@@ -70,6 +70,28 @@ chmod +x ~/.coder-startup.sh
 - It runs non-interactively, so `~/.bashrc` is not sourced. `PATH` includes `~/.local/bin`, `~/.npm-global/bin` and Homebrew (`/home/linuxbrew/.linuxbrew/bin`). Export anything else the hook needs inside the script.
 - It runs on every start, so make it safe to run more than once, e.g. check whether a process is already running before starting it.
 
+### Running a Claude Code Self-Hosted Runner
+
+Turn on **Run a Claude Code self-hosted runner** when creating or editing a workspace to have it run a Claude Code self-hosted runner. Sessions you start on claude.ai/code in that runner's environment then run in this workspace, with its Docker and DDEV.
+
+One-time setup:
+
+1. On claude.ai, create a self-hosted environment and copy its environment secret.
+2. In the workspace, save it:
+
+   ```bash
+   mkdir -p ~/.claude-runner
+   (umask 077; cat > ~/.claude-runner/environment-secret)   # paste, then Ctrl-D
+   ```
+
+3. Restart the workspace.
+
+On every start the runner runs in the tmux session `claude-runner` (`tmux attach -t claude-runner`), logging to `/tmp/claude-runner.log`. It clones session repositories under `~/workspace`.
+
+- **Use a workspace only for the runner.** The runner deletes and rewrites `~/.gitconfig` and `~/.config/git` before every session, so the template puts the sessions' git identity (`Claude <noreply@anthropic.com>`) and ignore list in `/etc/gitconfig` instead. The option refuses to start the runner when Claude Code remote control is also on.
+- **Finding a session's work.** Run `claude-sessions` in the workspace to list live sessions with their checkout, branch and the number of commits not on any remote. When a session ends because its user went idle, the runner was stopped, or it failed, the runner pushes the session's `claude/...` branch to `origin` (`--push-outcome-on-release`), so commits made by a repository whose rules forbid agents to push still reach GitHub.
+- **Concurrent sessions.** "Claude Code runner: concurrent sessions" (1 to 4) sets how many sessions run at once. They share one Docker daemon and one DDEV install, so the template installs the skill `~/.claude/skills/coder-shared-workspace`, which tells sessions how to stay out of each other's way: separate git worktrees, no `ddev poweroff`, and a lock around test suites that take over Docker. For full isolation, use several workspaces with one session each instead; the same environment secret works in all of them.
+
 ### Ending Your Day
 
 ```bash
diff --git a/drupal-contrib/modules/claude-self-hosted-runner/files/SKILL.md b/drupal-contrib/modules/claude-self-hosted-runner/files/SKILL.md
new file mode 100644
index 0000000..1bf8354
--- /dev/null
+++ b/drupal-contrib/modules/claude-self-hosted-runner/files/SKILL.md
@@ -0,0 +1,87 @@
+---
+name: coder-shared-workspace
+description: Rules for sharing this Coder workspace, its Docker daemon and its DDEV install with other Claude sessions that the self-hosted runner runs at the same time. Read before running ddev, docker, or a repository's integration tests, before cleaning up disk, and before working in a checkout another session may be using.
+---
+
+# Sharing this workspace with other sessions
+
+This workspace runs a Claude Code self-hosted runner that can host several
+sessions at once. They all run as the same Unix user, with the same home
+directory, one Docker daemon and one DDEV global configuration. Nothing
+isolates them except the rules below.
+
+## See who else is here
+
+```bash
+pgrep -af -- '--sdk-url' | grep -o 'sessions/cse_[A-Za-z0-9]*' | sort -u
+pgrep -af -- '--sdk-url' | grep -o -- '--add-dir [^ ]*' | sort | uniq -c
+```
+
+The first lists active sessions; the second shows which directories they
+work in. If you are the only session, the rest of this file still applies,
+since another session can start at any time.
+
+## Repositories and checkouts
+
+- Sessions working in different repositories do not interfere with each
+  other's files.
+- Never switch the branch, reset, stash, or clean a checkout another
+  session is using. If your working directory is a checkout another session
+  also has, make your own worktree and work there:
+
+  ```bash
+  repo=~/workspace/<owner>/<repo>
+  git -C "$repo" worktree add ~/workspace/<repo>-worktrees/<your-branch> -b <your-branch> <base>
+  ```
+
+  Keep worktrees under `~/workspace/<repo>-worktrees/`. Remove yours with
+  `git worktree remove` when the session is done. Two worktrees cannot have
+  the same branch checked out.
+- Put scratch files in `~/tmp/<your session id>/`, not directly in `~/tmp`.
+
+## Docker and DDEV
+
+There is one Docker daemon. A command that affects every container affects
+every session.
+
+- **Never** run these unless the user asks for them:
+  `ddev poweroff`, `ddev stop --all`, `ddev delete images`,
+  `ddev clean`, `docker system prune`, `docker volume prune`,
+  `docker rm -f $(docker ps -aq)`, or anything that restarts dockerd.
+  Stop, restart or delete only projects you started.
+- Do not change the DDEV global configuration (`ddev config global`,
+  `~/.ddev/global_config.yaml`). Put settings in the project's
+  `.ddev/config.*.yaml` instead.
+- Give throwaway projects names no other session will pick, such as
+  `<purpose>-<first 8 characters of your session id>`, and delete them with
+  `ddev delete -Oy <name>` when done. The names registered in the workspace
+  (`$CODER_PROJECT_NAMES`) are the only ones reachable from a browser; check
+  `ddev list` and ask before taking one another session is using.
+- Do not set fixed host ports (`host_https_port`, `host_webserver_port`,
+  `host_db_port`) in a project. Let DDEV choose, so two projects never
+  collide. Pick free ports for any other server you run.
+- A project you started may be stopped by another session's tests (see
+  below). If it is, `ddev start` it again.
+
+## Tests that take over Docker
+
+Some test suites start and power off DDEV projects on their own, for
+example the integration tests of `ddev/ddev` (`make testpkg`, `make testcmd`,
+`go test ./pkg/ddevapp/...`), which run `ddev poweroff`. Run those only
+while holding the workspace-wide Docker lock, so two of them never run at
+the same time:
+
+```bash
+flock --exclusive ~/.cache/coder-docker.lock make testpkg TESTARGS="-run TestName"
+```
+
+`flock` waits until the lock is free. Tell the user when you have been
+waiting more than a few minutes, rather than waiting silently. Code that
+only compiles or runs unit tests that do not touch Docker needs no lock.
+
+## Disk
+
+The disk is shared. When it fills up, stop what you started and delete
+only what you created (build output, your worktrees, your `~/tmp`
+directory, your test projects). Never delete another session's files, and
+never prune Docker images or volumes another session may use.
diff --git a/drupal-contrib/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl b/drupal-contrib/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
new file mode 100644
index 0000000..50f0e7a
--- /dev/null
+++ b/drupal-contrib/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Keep the Claude Code self-hosted runner running; it exits on its own when
+# --release-idle-session-min leaves it with no sessions.
+export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:/home/linuxbrew/.linuxbrew/bin:$PATH"
+while true; do
+  /home/linuxbrew/.linuxbrew/bin/claude self-hosted-runner \
+    --environment-secret-file "${secret_file}" \
+    --base-dir "${base_dir}" \
+    --capacity ${capacity} \
+    --client-label "$CODER_WORKSPACE_NAME" \
+    --use-anthropic-git-proxy \
+    --push-outcome-on-release \
+    --release-idle-session-min 30 \
+    --kill-session-after-min 480 \
+    --health-port 0 \
+    --log-file /tmp/claude-runner.log
+  rc=$?
+  echo "$(date): runner exited ($rc); restarting in 5s"
+  sleep 5
+done
diff --git a/drupal-contrib/modules/claude-self-hosted-runner/files/claude-sessions b/drupal-contrib/modules/claude-self-hosted-runner/files/claude-sessions
new file mode 100644
index 0000000..43b43c4
--- /dev/null
+++ b/drupal-contrib/modules/claude-self-hosted-runner/files/claude-sessions
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# List the runner's live sessions: id, checkout, branch, and commits on no remote
+# branch, so a person can find a session's work without asking it.
+set -u
+pgrep -af -- '--sdk-url' | while read -r _ cmd; do
+  id=$(grep -o 'sessions/cse_[A-Za-z0-9]*' <<<"$cmd" | head -1 | cut -d/ -f2)
+  for dir in $(grep -o -- '--add-dir [^ ]*' <<<"$cmd" | cut -d' ' -f2 | grep -v '/_sessions/'); do
+    git -C "$dir" rev-parse --git-dir >/dev/null 2>&1 || continue
+    branch=$(git -C "$dir" branch --show-current)
+    ahead=$(git -C "$dir" rev-list --count HEAD --not --remotes)
+    printf '%s  %s  %s  unpushed: %s\n' "$id" "$dir" "$branch" "$ahead"
+  done
+done | sort -u
diff --git a/drupal-contrib/modules/claude-self-hosted-runner/files/gitconfig b/drupal-contrib/modules/claude-self-hosted-runner/files/gitconfig
new file mode 100644
index 0000000..a24da96
--- /dev/null
+++ b/drupal-contrib/modules/claude-self-hosted-runner/files/gitconfig
@@ -0,0 +1,8 @@
+# Installed by the claude-self-hosted-runner module. The runner deletes
+# ~/.gitconfig and ~/.config/git before every session, so session git
+# settings live here instead.
+[user]
+	name = Claude
+	email = noreply@anthropic.com
+[core]
+	excludesFile = /etc/gitignore-claude-runner
diff --git a/drupal-contrib/modules/claude-self-hosted-runner/files/gitignore b/drupal-contrib/modules/claude-self-hosted-runner/files/gitignore
new file mode 100644
index 0000000..04fb92b
--- /dev/null
+++ b/drupal-contrib/modules/claude-self-hosted-runner/files/gitignore
@@ -0,0 +1,4 @@
+# Installed by the claude-self-hosted-runner module.
+config.coder.yaml
+docker-compose.coder-describe.yaml
+.claude/settings.local.json
diff --git a/drupal-contrib/modules/claude-self-hosted-runner/main.tf b/drupal-contrib/modules/claude-self-hosted-runner/main.tf
new file mode 100644
index 0000000..a580c8b
--- /dev/null
+++ b/drupal-contrib/modules/claude-self-hosted-runner/main.tf
@@ -0,0 +1,44 @@
+data "coder_parameter" "enable_claude_runner" {
+  name         = "enable_claude_runner"
+  display_name = "Run a Claude Code self-hosted runner"
+  description  = <<-EOT
+    Start a Claude Code self-hosted runner on every workspace start, so sessions you start on claude.ai/code in that environment run in this workspace.
+
+    **One-time setup:** create a self-hosted environment on claude.ai, then save its environment secret in the workspace as `~/.claude-runner/environment-secret` (mode 600). Until that file exists, the runner doesn't start and the startup log says why.
+
+    **Use a workspace dedicated to the runner.** The runner deletes and rewrites `~/.gitconfig` and `~/.config/git` before every session. It can't be enabled together with Claude Code remote control.
+  EOT
+
+  type      = "bool"
+  form_type = "switch"
+  default   = "false"
+  mutable   = true
+  order     = var.parameter_order
+}
+
+data "coder_parameter" "claude_runner_capacity" {
+  name         = "claude_runner_capacity"
+  display_name = "Claude Code runner: concurrent sessions"
+  description  = "How many sessions the runner hosts at once. They share this workspace's Docker daemon and DDEV; the runner installs a skill telling them how to avoid conflicts. Only takes effect when the runner is enabled."
+  type         = "number"
+  default      = "1"
+  mutable      = true
+  order        = var.parameter_order + 1
+  validation {
+    min = 1
+    max = 4
+  }
+}
+
+locals {
+  # Compared as strings, not tobool(): see modules/claude-remote-control.
+  enabled     = data.coder_parameter.enable_claude_runner.value == "true"
+  capacity    = try(tonumber(data.coder_parameter.claude_runner_capacity.value), 1)
+  secret_file = "/home/coder/.claude-runner/environment-secret"
+
+  loop_script = templatefile("${path.module}/files/claude-runner-loop.sh.tftpl", {
+    secret_file = local.secret_file
+    base_dir    = var.base_dir
+    capacity    = local.capacity
+  })
+}
diff --git a/drupal-contrib/modules/claude-self-hosted-runner/outputs.tf b/drupal-contrib/modules/claude-self-hosted-runner/outputs.tf
new file mode 100644
index 0000000..d347c79
--- /dev/null
+++ b/drupal-contrib/modules/claude-self-hosted-runner/outputs.tf
@@ -0,0 +1,42 @@
+output "enabled" {
+  description = "Whether the Claude Code self-hosted runner is enabled"
+  value       = local.enabled
+}
+
+output "startup_script" {
+  description = "Bash snippet for the caller to append to its coder_agent startup_script, after the claude-remote-control snippet and before the ~/.coder-startup.sh user hook."
+  value       = <<-EOT
+
+    # Claude Code self-hosted runner, in tmux session "claude-runner".
+    CLAUDE_RUNNER_ENABLED="${local.enabled}"
+    CLAUDE_REMOTE_CONTROL_ENABLED="${var.remote_control_enabled}"
+    if [ "$CLAUDE_RUNNER_ENABLED" = "true" ]; then
+      if [ "$CLAUDE_REMOTE_CONTROL_ENABLED" = "true" ]; then
+        CLAUDE_RUNNER_MSG="✗ Claude Code self-hosted runner NOT started: Claude Code remote control is also enabled, and the runner rewrites ~/.gitconfig before every session. Turn one of them off."
+      elif [ ! -s "${local.secret_file}" ]; then
+        CLAUDE_RUNNER_MSG="✗ Claude Code self-hosted runner NOT started: save your environment secret as ${local.secret_file} (chmod 600), then restart the workspace."
+      else
+        # /etc is not persistent, so reinstall the session git config on every start.
+        echo '${base64encode(file("${path.module}/files/gitconfig"))}' | base64 -d | sudo tee /etc/gitconfig >/dev/null
+        echo '${base64encode(file("${path.module}/files/gitignore"))}' | base64 -d | sudo tee /etc/gitignore-claude-runner >/dev/null
+        # The runner copies ~/.claude into each session when it starts.
+        mkdir -p ~/.claude/skills/coder-shared-workspace ~/.cache "${var.base_dir}"
+        echo '${base64encode(file("${path.module}/files/SKILL.md"))}' | base64 -d > ~/.claude/skills/coder-shared-workspace/SKILL.md
+        mkdir -p ~/.local/bin
+        echo '${base64encode(local.loop_script)}' | base64 -d > ~/.local/bin/claude-runner-loop
+        chmod +x ~/.local/bin/claude-runner-loop
+        echo '${base64encode(file("${path.module}/files/claude-sessions"))}' | base64 -d > ~/.local/bin/claude-sessions
+        chmod +x ~/.local/bin/claude-sessions
+        mkcert -install >/dev/null 2>&1 || true
+        if pgrep -f 'claude self-hosted-runner' >/dev/null || tmux has-session -t claude-runner 2>/dev/null; then
+          CLAUDE_RUNNER_MSG="✓ Claude Code self-hosted runner already running (tmux attach -t claude-runner)"
+        else
+          tmux new-session -d -s claude-runner ~/.local/bin/claude-runner-loop
+          CLAUDE_RUNNER_MSG="✓ Claude Code self-hosted runner started, capacity ${local.capacity} (tmux attach -t claude-runner; log /tmp/claude-runner.log)"
+        fi
+      fi
+      echo "$CLAUDE_RUNNER_MSG"
+      echo "$CLAUDE_RUNNER_MSG" >> ~/WELCOME.txt
+    fi
+  EOT
+}
diff --git a/drupal-contrib/modules/claude-self-hosted-runner/variables.tf b/drupal-contrib/modules/claude-self-hosted-runner/variables.tf
new file mode 100644
index 0000000..49efc79
--- /dev/null
+++ b/drupal-contrib/modules/claude-self-hosted-runner/variables.tf
@@ -0,0 +1,17 @@
+variable "parameter_order" {
+  description = "Base UI order for the two coder_parameters this module declares (uses this value and this value + 1)"
+  type        = number
+  default     = 14
+}
+
+variable "base_dir" {
+  description = "Directory the runner clones session repositories into"
+  type        = string
+  default     = "/home/coder/workspace"
+}
+
+variable "remote_control_enabled" {
+  description = "Whether Claude Code remote control is enabled in the same workspace; the runner refuses to start alongside it"
+  type        = bool
+  default     = false
+}
diff --git a/drupal-contrib/modules/claude-self-hosted-runner/versions.tf b/drupal-contrib/modules/claude-self-hosted-runner/versions.tf
new file mode 100644
index 0000000..394c7cb
--- /dev/null
+++ b/drupal-contrib/modules/claude-self-hosted-runner/versions.tf
@@ -0,0 +1,7 @@
+terraform {
+  required_providers {
+    coder = {
+      source = "coder/coder"
+    }
+  }
+}
diff --git a/drupal-contrib/template.tf b/drupal-contrib/template.tf
index 0b7948e..616a3d7 100644
--- a/drupal-contrib/template.tf
+++ b/drupal-contrib/template.tf
@@ -1064,6 +1064,8 @@ BASHPROFILE_WELCOME
 
     ${module.claude_remote_control.startup_script}
 
+    ${module.claude_self_hosted_runner.startup_script}
+
     # User startup hook: run ~/.coder-startup.sh (persistent home) on every
     # workspace start, e.g. to start services or long-running processes without
     # waiting for someone to open a terminal. It is detached from the agent so a
@@ -1179,6 +1181,11 @@ module "claude_remote_control" {
   agent_id = coder_agent.main.id
 }
 
+module "claude_self_hosted_runner" {
+  source                 = "./modules/claude-self-hosted-runner"
+  remote_control_enabled = module.claude_remote_control.enabled
+}
+
 # Drupal Site (HTTP) - appears when DDEV project is running.
 # Uses subdomain routing for unique URLs per workspace. Sharing is controlled
 # by data.coder_parameter.drupal_site_public (Public Sharing switch above).
diff --git a/drupal-contrib/tests/validate.tftest.hcl b/drupal-contrib/tests/validate.tftest.hcl
index 5aae18a..9913943 100644
--- a/drupal-contrib/tests/validate.tftest.hcl
+++ b/drupal-contrib/tests/validate.tftest.hcl
@@ -186,3 +186,59 @@ run "ssh_agent_relay" {
     error_message = "startup script must point DDEV's ssh_agent_upstream at the relay socket"
   }
 }
+
+run "claude_runner_disabled_by_default" {
+  command = plan
+  assert {
+    condition     = strcontains(coder_agent.main.startup_script, "CLAUDE_RUNNER_ENABLED=\"false\"")
+    error_message = "the Claude Code self-hosted runner must be off unless enable_claude_runner=true"
+  }
+}
+
+run "claude_runner_enabled" {
+  command = plan
+  override_data {
+    target = module.claude_self_hosted_runner.data.coder_parameter.enable_claude_runner
+    values = {
+      value = "true"
+    }
+  }
+  override_data {
+    target = module.claude_self_hosted_runner.data.coder_parameter.claude_runner_capacity
+    values = {
+      value = "3"
+    }
+  }
+  assert {
+    condition     = strcontains(coder_agent.main.startup_script, "CLAUDE_RUNNER_ENABLED=\"true\"")
+    error_message = "startup script must start the runner when enable_claude_runner=true"
+  }
+  assert {
+    condition     = strcontains(coder_agent.main.startup_script, "CLAUDE_REMOTE_CONTROL_ENABLED=\"false\"")
+    error_message = "the runner must see remote control as off when enable_claude_code=false"
+  }
+  assert {
+    condition     = strcontains(base64decode(regex("echo '([A-Za-z0-9+/=]+)' \\| base64 -d > ~/.local/bin/claude-runner-loop", coder_agent.main.startup_script)[0]), "--capacity 3")
+    error_message = "runner loop script must pass the claude_runner_capacity value as --capacity"
+  }
+}
+
+run "claude_runner_refuses_alongside_remote_control" {
+  command = plan
+  override_data {
+    target = module.claude_self_hosted_runner.data.coder_parameter.enable_claude_runner
+    values = {
+      value = "true"
+    }
+  }
+  override_data {
+    target = module.claude_remote_control.data.coder_parameter.enable_claude_code
+    values = {
+      value = "true"
+    }
+  }
+  assert {
+    condition     = strcontains(coder_agent.main.startup_script, "CLAUDE_REMOTE_CONTROL_ENABLED=\"true\"")
+    error_message = "the runner snippet must know remote control is on, so it refuses to start"
+  }
+}
diff --git a/drupal-core/modules/claude-self-hosted-runner/files/SKILL.md b/drupal-core/modules/claude-self-hosted-runner/files/SKILL.md
new file mode 100644
index 0000000..1bf8354
--- /dev/null
+++ b/drupal-core/modules/claude-self-hosted-runner/files/SKILL.md
@@ -0,0 +1,87 @@
+---
+name: coder-shared-workspace
+description: Rules for sharing this Coder workspace, its Docker daemon and its DDEV install with other Claude sessions that the self-hosted runner runs at the same time. Read before running ddev, docker, or a repository's integration tests, before cleaning up disk, and before working in a checkout another session may be using.
+---
+
+# Sharing this workspace with other sessions
+
+This workspace runs a Claude Code self-hosted runner that can host several
+sessions at once. They all run as the same Unix user, with the same home
+directory, one Docker daemon and one DDEV global configuration. Nothing
+isolates them except the rules below.
+
+## See who else is here
+
+```bash
+pgrep -af -- '--sdk-url' | grep -o 'sessions/cse_[A-Za-z0-9]*' | sort -u
+pgrep -af -- '--sdk-url' | grep -o -- '--add-dir [^ ]*' | sort | uniq -c
+```
+
+The first lists active sessions; the second shows which directories they
+work in. If you are the only session, the rest of this file still applies,
+since another session can start at any time.
+
+## Repositories and checkouts
+
+- Sessions working in different repositories do not interfere with each
+  other's files.
+- Never switch the branch, reset, stash, or clean a checkout another
+  session is using. If your working directory is a checkout another session
+  also has, make your own worktree and work there:
+
+  ```bash
+  repo=~/workspace/<owner>/<repo>
+  git -C "$repo" worktree add ~/workspace/<repo>-worktrees/<your-branch> -b <your-branch> <base>
+  ```
+
+  Keep worktrees under `~/workspace/<repo>-worktrees/`. Remove yours with
+  `git worktree remove` when the session is done. Two worktrees cannot have
+  the same branch checked out.
+- Put scratch files in `~/tmp/<your session id>/`, not directly in `~/tmp`.
+
+## Docker and DDEV
+
+There is one Docker daemon. A command that affects every container affects
+every session.
+
+- **Never** run these unless the user asks for them:
+  `ddev poweroff`, `ddev stop --all`, `ddev delete images`,
+  `ddev clean`, `docker system prune`, `docker volume prune`,
+  `docker rm -f $(docker ps -aq)`, or anything that restarts dockerd.
+  Stop, restart or delete only projects you started.
+- Do not change the DDEV global configuration (`ddev config global`,
+  `~/.ddev/global_config.yaml`). Put settings in the project's
+  `.ddev/config.*.yaml` instead.
+- Give throwaway projects names no other session will pick, such as
+  `<purpose>-<first 8 characters of your session id>`, and delete them with
+  `ddev delete -Oy <name>` when done. The names registered in the workspace
+  (`$CODER_PROJECT_NAMES`) are the only ones reachable from a browser; check
+  `ddev list` and ask before taking one another session is using.
+- Do not set fixed host ports (`host_https_port`, `host_webserver_port`,
+  `host_db_port`) in a project. Let DDEV choose, so two projects never
+  collide. Pick free ports for any other server you run.
+- A project you started may be stopped by another session's tests (see
+  below). If it is, `ddev start` it again.
+
+## Tests that take over Docker
+
+Some test suites start and power off DDEV projects on their own, for
+example the integration tests of `ddev/ddev` (`make testpkg`, `make testcmd`,
+`go test ./pkg/ddevapp/...`), which run `ddev poweroff`. Run those only
+while holding the workspace-wide Docker lock, so two of them never run at
+the same time:
+
+```bash
+flock --exclusive ~/.cache/coder-docker.lock make testpkg TESTARGS="-run TestName"
+```
+
+`flock` waits until the lock is free. Tell the user when you have been
+waiting more than a few minutes, rather than waiting silently. Code that
+only compiles or runs unit tests that do not touch Docker needs no lock.
+
+## Disk
+
+The disk is shared. When it fills up, stop what you started and delete
+only what you created (build output, your worktrees, your `~/tmp`
+directory, your test projects). Never delete another session's files, and
+never prune Docker images or volumes another session may use.
diff --git a/drupal-core/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl b/drupal-core/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
new file mode 100644
index 0000000..50f0e7a
--- /dev/null
+++ b/drupal-core/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Keep the Claude Code self-hosted runner running; it exits on its own when
+# --release-idle-session-min leaves it with no sessions.
+export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:/home/linuxbrew/.linuxbrew/bin:$PATH"
+while true; do
+  /home/linuxbrew/.linuxbrew/bin/claude self-hosted-runner \
+    --environment-secret-file "${secret_file}" \
+    --base-dir "${base_dir}" \
+    --capacity ${capacity} \
+    --client-label "$CODER_WORKSPACE_NAME" \
+    --use-anthropic-git-proxy \
+    --push-outcome-on-release \
+    --release-idle-session-min 30 \
+    --kill-session-after-min 480 \
+    --health-port 0 \
+    --log-file /tmp/claude-runner.log
+  rc=$?
+  echo "$(date): runner exited ($rc); restarting in 5s"
+  sleep 5
+done
diff --git a/drupal-core/modules/claude-self-hosted-runner/files/claude-sessions b/drupal-core/modules/claude-self-hosted-runner/files/claude-sessions
new file mode 100644
index 0000000..43b43c4
--- /dev/null
+++ b/drupal-core/modules/claude-self-hosted-runner/files/claude-sessions
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# List the runner's live sessions: id, checkout, branch, and commits on no remote
+# branch, so a person can find a session's work without asking it.
+set -u
+pgrep -af -- '--sdk-url' | while read -r _ cmd; do
+  id=$(grep -o 'sessions/cse_[A-Za-z0-9]*' <<<"$cmd" | head -1 | cut -d/ -f2)
+  for dir in $(grep -o -- '--add-dir [^ ]*' <<<"$cmd" | cut -d' ' -f2 | grep -v '/_sessions/'); do
+    git -C "$dir" rev-parse --git-dir >/dev/null 2>&1 || continue
+    branch=$(git -C "$dir" branch --show-current)
+    ahead=$(git -C "$dir" rev-list --count HEAD --not --remotes)
+    printf '%s  %s  %s  unpushed: %s\n' "$id" "$dir" "$branch" "$ahead"
+  done
+done | sort -u
diff --git a/drupal-core/modules/claude-self-hosted-runner/files/gitconfig b/drupal-core/modules/claude-self-hosted-runner/files/gitconfig
new file mode 100644
index 0000000..a24da96
--- /dev/null
+++ b/drupal-core/modules/claude-self-hosted-runner/files/gitconfig
@@ -0,0 +1,8 @@
+# Installed by the claude-self-hosted-runner module. The runner deletes
+# ~/.gitconfig and ~/.config/git before every session, so session git
+# settings live here instead.
+[user]
+	name = Claude
+	email = noreply@anthropic.com
+[core]
+	excludesFile = /etc/gitignore-claude-runner
diff --git a/drupal-core/modules/claude-self-hosted-runner/files/gitignore b/drupal-core/modules/claude-self-hosted-runner/files/gitignore
new file mode 100644
index 0000000..04fb92b
--- /dev/null
+++ b/drupal-core/modules/claude-self-hosted-runner/files/gitignore
@@ -0,0 +1,4 @@
+# Installed by the claude-self-hosted-runner module.
+config.coder.yaml
+docker-compose.coder-describe.yaml
+.claude/settings.local.json
diff --git a/drupal-core/modules/claude-self-hosted-runner/main.tf b/drupal-core/modules/claude-self-hosted-runner/main.tf
new file mode 100644
index 0000000..a580c8b
--- /dev/null
+++ b/drupal-core/modules/claude-self-hosted-runner/main.tf
@@ -0,0 +1,44 @@
+data "coder_parameter" "enable_claude_runner" {
+  name         = "enable_claude_runner"
+  display_name = "Run a Claude Code self-hosted runner"
+  description  = <<-EOT
+    Start a Claude Code self-hosted runner on every workspace start, so sessions you start on claude.ai/code in that environment run in this workspace.
+
+    **One-time setup:** create a self-hosted environment on claude.ai, then save its environment secret in the workspace as `~/.claude-runner/environment-secret` (mode 600). Until that file exists, the runner doesn't start and the startup log says why.
+
+    **Use a workspace dedicated to the runner.** The runner deletes and rewrites `~/.gitconfig` and `~/.config/git` before every session. It can't be enabled together with Claude Code remote control.
+  EOT
+
+  type      = "bool"
+  form_type = "switch"
+  default   = "false"
+  mutable   = true
+  order     = var.parameter_order
+}
+
+data "coder_parameter" "claude_runner_capacity" {
+  name         = "claude_runner_capacity"
+  display_name = "Claude Code runner: concurrent sessions"
+  description  = "How many sessions the runner hosts at once. They share this workspace's Docker daemon and DDEV; the runner installs a skill telling them how to avoid conflicts. Only takes effect when the runner is enabled."
+  type         = "number"
+  default      = "1"
+  mutable      = true
+  order        = var.parameter_order + 1
+  validation {
+    min = 1
+    max = 4
+  }
+}
+
+locals {
+  # Compared as strings, not tobool(): see modules/claude-remote-control.
+  enabled     = data.coder_parameter.enable_claude_runner.value == "true"
+  capacity    = try(tonumber(data.coder_parameter.claude_runner_capacity.value), 1)
+  secret_file = "/home/coder/.claude-runner/environment-secret"
+
+  loop_script = templatefile("${path.module}/files/claude-runner-loop.sh.tftpl", {
+    secret_file = local.secret_file
+    base_dir    = var.base_dir
+    capacity    = local.capacity
+  })
+}
diff --git a/drupal-core/modules/claude-self-hosted-runner/outputs.tf b/drupal-core/modules/claude-self-hosted-runner/outputs.tf
new file mode 100644
index 0000000..d347c79
--- /dev/null
+++ b/drupal-core/modules/claude-self-hosted-runner/outputs.tf
@@ -0,0 +1,42 @@
+output "enabled" {
+  description = "Whether the Claude Code self-hosted runner is enabled"
+  value       = local.enabled
+}
+
+output "startup_script" {
+  description = "Bash snippet for the caller to append to its coder_agent startup_script, after the claude-remote-control snippet and before the ~/.coder-startup.sh user hook."
+  value       = <<-EOT
+
+    # Claude Code self-hosted runner, in tmux session "claude-runner".
+    CLAUDE_RUNNER_ENABLED="${local.enabled}"
+    CLAUDE_REMOTE_CONTROL_ENABLED="${var.remote_control_enabled}"
+    if [ "$CLAUDE_RUNNER_ENABLED" = "true" ]; then
+      if [ "$CLAUDE_REMOTE_CONTROL_ENABLED" = "true" ]; then
+        CLAUDE_RUNNER_MSG="✗ Claude Code self-hosted runner NOT started: Claude Code remote control is also enabled, and the runner rewrites ~/.gitconfig before every session. Turn one of them off."
+      elif [ ! -s "${local.secret_file}" ]; then
+        CLAUDE_RUNNER_MSG="✗ Claude Code self-hosted runner NOT started: save your environment secret as ${local.secret_file} (chmod 600), then restart the workspace."
+      else
+        # /etc is not persistent, so reinstall the session git config on every start.
+        echo '${base64encode(file("${path.module}/files/gitconfig"))}' | base64 -d | sudo tee /etc/gitconfig >/dev/null
+        echo '${base64encode(file("${path.module}/files/gitignore"))}' | base64 -d | sudo tee /etc/gitignore-claude-runner >/dev/null
+        # The runner copies ~/.claude into each session when it starts.
+        mkdir -p ~/.claude/skills/coder-shared-workspace ~/.cache "${var.base_dir}"
+        echo '${base64encode(file("${path.module}/files/SKILL.md"))}' | base64 -d > ~/.claude/skills/coder-shared-workspace/SKILL.md
+        mkdir -p ~/.local/bin
+        echo '${base64encode(local.loop_script)}' | base64 -d > ~/.local/bin/claude-runner-loop
+        chmod +x ~/.local/bin/claude-runner-loop
+        echo '${base64encode(file("${path.module}/files/claude-sessions"))}' | base64 -d > ~/.local/bin/claude-sessions
+        chmod +x ~/.local/bin/claude-sessions
+        mkcert -install >/dev/null 2>&1 || true
+        if pgrep -f 'claude self-hosted-runner' >/dev/null || tmux has-session -t claude-runner 2>/dev/null; then
+          CLAUDE_RUNNER_MSG="✓ Claude Code self-hosted runner already running (tmux attach -t claude-runner)"
+        else
+          tmux new-session -d -s claude-runner ~/.local/bin/claude-runner-loop
+          CLAUDE_RUNNER_MSG="✓ Claude Code self-hosted runner started, capacity ${local.capacity} (tmux attach -t claude-runner; log /tmp/claude-runner.log)"
+        fi
+      fi
+      echo "$CLAUDE_RUNNER_MSG"
+      echo "$CLAUDE_RUNNER_MSG" >> ~/WELCOME.txt
+    fi
+  EOT
+}
diff --git a/drupal-core/modules/claude-self-hosted-runner/variables.tf b/drupal-core/modules/claude-self-hosted-runner/variables.tf
new file mode 100644
index 0000000..49efc79
--- /dev/null
+++ b/drupal-core/modules/claude-self-hosted-runner/variables.tf
@@ -0,0 +1,17 @@
+variable "parameter_order" {
+  description = "Base UI order for the two coder_parameters this module declares (uses this value and this value + 1)"
+  type        = number
+  default     = 14
+}
+
+variable "base_dir" {
+  description = "Directory the runner clones session repositories into"
+  type        = string
+  default     = "/home/coder/workspace"
+}
+
+variable "remote_control_enabled" {
+  description = "Whether Claude Code remote control is enabled in the same workspace; the runner refuses to start alongside it"
+  type        = bool
+  default     = false
+}
diff --git a/drupal-core/modules/claude-self-hosted-runner/versions.tf b/drupal-core/modules/claude-self-hosted-runner/versions.tf
new file mode 100644
index 0000000..394c7cb
--- /dev/null
+++ b/drupal-core/modules/claude-self-hosted-runner/versions.tf
@@ -0,0 +1,7 @@
+terraform {
+  required_providers {
+    coder = {
+      source = "coder/coder"
+    }
+  }
+}
diff --git a/drupal-core/template.tf b/drupal-core/template.tf
index 1a9ae78..72079df 100644
--- a/drupal-core/template.tf
+++ b/drupal-core/template.tf
@@ -1297,6 +1297,8 @@ BASHCOMP
 
     ${module.claude_remote_control.startup_script}
 
+    ${module.claude_self_hosted_runner.startup_script}
+
     # User startup hook: run ~/.coder-startup.sh (persistent home) on every
     # workspace start, e.g. to start services or long-running processes without
     # waiting for someone to open a terminal. It is detached from the agent so a
@@ -1410,6 +1412,11 @@ module "claude_remote_control" {
   agent_id = coder_agent.main.id
 }
 
+module "claude_self_hosted_runner" {
+  source                 = "./modules/claude-self-hosted-runner"
+  remote_control_enabled = module.claude_remote_control.enabled
+}
+
 # Drupal Site (HTTP) - appears when DDEV project is running.
 # Uses subdomain routing for unique URLs per workspace. Sharing is controlled
 # by data.coder_parameter.drupal_site_public (Public Sharing switch above).
diff --git a/drupal-core/tests/validate.tftest.hcl b/drupal-core/tests/validate.tftest.hcl
index 111c43e..79d2d99 100644
--- a/drupal-core/tests/validate.tftest.hcl
+++ b/drupal-core/tests/validate.tftest.hcl
@@ -214,3 +214,68 @@ run "ssh_agent_relay" {
     error_message = "startup script must point DDEV's ssh_agent_upstream at the relay socket"
   }
 }
+
+run "claude_runner_disabled_by_default" {
+  command = plan
+  variables {
+    cache_path = "/tmp/mock-cache"
+  }
+  assert {
+    condition     = strcontains(coder_agent.main.startup_script, "CLAUDE_RUNNER_ENABLED=\"false\"")
+    error_message = "the Claude Code self-hosted runner must be off unless enable_claude_runner=true"
+  }
+}
+
+run "claude_runner_enabled" {
+  command = plan
+  variables {
+    cache_path = "/tmp/mock-cache"
+  }
+  override_data {
+    target = module.claude_self_hosted_runner.data.coder_parameter.enable_claude_runner
+    values = {
+      value = "true"
+    }
+  }
+  override_data {
+    target = module.claude_self_hosted_runner.data.coder_parameter.claude_runner_capacity
+    values = {
+      value = "3"
+    }
+  }
+  assert {
+    condition     = strcontains(coder_agent.main.startup_script, "CLAUDE_RUNNER_ENABLED=\"true\"")
+    error_message = "startup script must start the runner when enable_claude_runner=true"
+  }
+  assert {
+    condition     = strcontains(coder_agent.main.startup_script, "CLAUDE_REMOTE_CONTROL_ENABLED=\"false\"")
+    error_message = "the runner must see remote control as off when enable_claude_code=false"
+  }
+  assert {
+    condition     = strcontains(base64decode(regex("echo '([A-Za-z0-9+/=]+)' \\| base64 -d > ~/.local/bin/claude-runner-loop", coder_agent.main.startup_script)[0]), "--capacity 3")
+    error_message = "runner loop script must pass the claude_runner_capacity value as --capacity"
+  }
+}
+
+run "claude_runner_refuses_alongside_remote_control" {
+  command = plan
+  variables {
+    cache_path = "/tmp/mock-cache"
+  }
+  override_data {
+    target = module.claude_self_hosted_runner.data.coder_parameter.enable_claude_runner
+    values = {
+      value = "true"
+    }
+  }
+  override_data {
+    target = module.claude_remote_control.data.coder_parameter.enable_claude_code
+    values = {
+      value = "true"
+    }
+  }
+  assert {
+    condition     = strcontains(coder_agent.main.startup_script, "CLAUDE_REMOTE_CONTROL_ENABLED=\"true\"")
+    error_message = "the runner snippet must know remote control is on, so it refuses to start"
+  }
+}
diff --git a/freeform/modules/claude-self-hosted-runner/files/SKILL.md b/freeform/modules/claude-self-hosted-runner/files/SKILL.md
new file mode 100644
index 0000000..1bf8354
--- /dev/null
+++ b/freeform/modules/claude-self-hosted-runner/files/SKILL.md
@@ -0,0 +1,87 @@
+---
+name: coder-shared-workspace
+description: Rules for sharing this Coder workspace, its Docker daemon and its DDEV install with other Claude sessions that the self-hosted runner runs at the same time. Read before running ddev, docker, or a repository's integration tests, before cleaning up disk, and before working in a checkout another session may be using.
+---
+
+# Sharing this workspace with other sessions
+
+This workspace runs a Claude Code self-hosted runner that can host several
+sessions at once. They all run as the same Unix user, with the same home
+directory, one Docker daemon and one DDEV global configuration. Nothing
+isolates them except the rules below.
+
+## See who else is here
+
+```bash
+pgrep -af -- '--sdk-url' | grep -o 'sessions/cse_[A-Za-z0-9]*' | sort -u
+pgrep -af -- '--sdk-url' | grep -o -- '--add-dir [^ ]*' | sort | uniq -c
+```
+
+The first lists active sessions; the second shows which directories they
+work in. If you are the only session, the rest of this file still applies,
+since another session can start at any time.
+
+## Repositories and checkouts
+
+- Sessions working in different repositories do not interfere with each
+  other's files.
+- Never switch the branch, reset, stash, or clean a checkout another
+  session is using. If your working directory is a checkout another session
+  also has, make your own worktree and work there:
+
+  ```bash
+  repo=~/workspace/<owner>/<repo>
+  git -C "$repo" worktree add ~/workspace/<repo>-worktrees/<your-branch> -b <your-branch> <base>
+  ```
+
+  Keep worktrees under `~/workspace/<repo>-worktrees/`. Remove yours with
+  `git worktree remove` when the session is done. Two worktrees cannot have
+  the same branch checked out.
+- Put scratch files in `~/tmp/<your session id>/`, not directly in `~/tmp`.
+
+## Docker and DDEV
+
+There is one Docker daemon. A command that affects every container affects
+every session.
+
+- **Never** run these unless the user asks for them:
+  `ddev poweroff`, `ddev stop --all`, `ddev delete images`,
+  `ddev clean`, `docker system prune`, `docker volume prune`,
+  `docker rm -f $(docker ps -aq)`, or anything that restarts dockerd.
+  Stop, restart or delete only projects you started.
+- Do not change the DDEV global configuration (`ddev config global`,
+  `~/.ddev/global_config.yaml`). Put settings in the project's
+  `.ddev/config.*.yaml` instead.
+- Give throwaway projects names no other session will pick, such as
+  `<purpose>-<first 8 characters of your session id>`, and delete them with
+  `ddev delete -Oy <name>` when done. The names registered in the workspace
+  (`$CODER_PROJECT_NAMES`) are the only ones reachable from a browser; check
+  `ddev list` and ask before taking one another session is using.
+- Do not set fixed host ports (`host_https_port`, `host_webserver_port`,
+  `host_db_port`) in a project. Let DDEV choose, so two projects never
+  collide. Pick free ports for any other server you run.
+- A project you started may be stopped by another session's tests (see
+  below). If it is, `ddev start` it again.
+
+## Tests that take over Docker
+
+Some test suites start and power off DDEV projects on their own, for
+example the integration tests of `ddev/ddev` (`make testpkg`, `make testcmd`,
+`go test ./pkg/ddevapp/...`), which run `ddev poweroff`. Run those only
+while holding the workspace-wide Docker lock, so two of them never run at
+the same time:
+
+```bash
+flock --exclusive ~/.cache/coder-docker.lock make testpkg TESTARGS="-run TestName"
+```
+
+`flock` waits until the lock is free. Tell the user when you have been
+waiting more than a few minutes, rather than waiting silently. Code that
+only compiles or runs unit tests that do not touch Docker needs no lock.
+
+## Disk
+
+The disk is shared. When it fills up, stop what you started and delete
+only what you created (build output, your worktrees, your `~/tmp`
+directory, your test projects). Never delete another session's files, and
+never prune Docker images or volumes another session may use.
diff --git a/freeform/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl b/freeform/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
new file mode 100644
index 0000000..50f0e7a
--- /dev/null
+++ b/freeform/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Keep the Claude Code self-hosted runner running; it exits on its own when
+# --release-idle-session-min leaves it with no sessions.
+export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:/home/linuxbrew/.linuxbrew/bin:$PATH"
+while true; do
+  /home/linuxbrew/.linuxbrew/bin/claude self-hosted-runner \
+    --environment-secret-file "${secret_file}" \
+    --base-dir "${base_dir}" \
+    --capacity ${capacity} \
+    --client-label "$CODER_WORKSPACE_NAME" \
+    --use-anthropic-git-proxy \
+    --push-outcome-on-release \
+    --release-idle-session-min 30 \
+    --kill-session-after-min 480 \
+    --health-port 0 \
+    --log-file /tmp/claude-runner.log
+  rc=$?
+  echo "$(date): runner exited ($rc); restarting in 5s"
+  sleep 5
+done
diff --git a/freeform/modules/claude-self-hosted-runner/files/claude-sessions b/freeform/modules/claude-self-hosted-runner/files/claude-sessions
new file mode 100644
index 0000000..43b43c4
--- /dev/null
+++ b/freeform/modules/claude-self-hosted-runner/files/claude-sessions
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# List the runner's live sessions: id, checkout, branch, and commits on no remote
+# branch, so a person can find a session's work without asking it.
+set -u
+pgrep -af -- '--sdk-url' | while read -r _ cmd; do
+  id=$(grep -o 'sessions/cse_[A-Za-z0-9]*' <<<"$cmd" | head -1 | cut -d/ -f2)
+  for dir in $(grep -o -- '--add-dir [^ ]*' <<<"$cmd" | cut -d' ' -f2 | grep -v '/_sessions/'); do
+    git -C "$dir" rev-parse --git-dir >/dev/null 2>&1 || continue
+    branch=$(git -C "$dir" branch --show-current)
+    ahead=$(git -C "$dir" rev-list --count HEAD --not --remotes)
+    printf '%s  %s  %s  unpushed: %s\n' "$id" "$dir" "$branch" "$ahead"
+  done
+done | sort -u
diff --git a/freeform/modules/claude-self-hosted-runner/files/gitconfig b/freeform/modules/claude-self-hosted-runner/files/gitconfig
new file mode 100644
index 0000000..a24da96
--- /dev/null
+++ b/freeform/modules/claude-self-hosted-runner/files/gitconfig
@@ -0,0 +1,8 @@
+# Installed by the claude-self-hosted-runner module. The runner deletes
+# ~/.gitconfig and ~/.config/git before every session, so session git
+# settings live here instead.
+[user]
+	name = Claude
+	email = noreply@anthropic.com
+[core]
+	excludesFile = /etc/gitignore-claude-runner
diff --git a/freeform/modules/claude-self-hosted-runner/files/gitignore b/freeform/modules/claude-self-hosted-runner/files/gitignore
new file mode 100644
index 0000000..04fb92b
--- /dev/null
+++ b/freeform/modules/claude-self-hosted-runner/files/gitignore
@@ -0,0 +1,4 @@
+# Installed by the claude-self-hosted-runner module.
+config.coder.yaml
+docker-compose.coder-describe.yaml
+.claude/settings.local.json
diff --git a/freeform/modules/claude-self-hosted-runner/main.tf b/freeform/modules/claude-self-hosted-runner/main.tf
new file mode 100644
index 0000000..a580c8b
--- /dev/null
+++ b/freeform/modules/claude-self-hosted-runner/main.tf
@@ -0,0 +1,44 @@
+data "coder_parameter" "enable_claude_runner" {
+  name         = "enable_claude_runner"
+  display_name = "Run a Claude Code self-hosted runner"
+  description  = <<-EOT
+    Start a Claude Code self-hosted runner on every workspace start, so sessions you start on claude.ai/code in that environment run in this workspace.
+
+    **One-time setup:** create a self-hosted environment on claude.ai, then save its environment secret in the workspace as `~/.claude-runner/environment-secret` (mode 600). Until that file exists, the runner doesn't start and the startup log says why.
+
+    **Use a workspace dedicated to the runner.** The runner deletes and rewrites `~/.gitconfig` and `~/.config/git` before every session. It can't be enabled together with Claude Code remote control.
+  EOT
+
+  type      = "bool"
+  form_type = "switch"
+  default   = "false"
+  mutable   = true
+  order     = var.parameter_order
+}
+
+data "coder_parameter" "claude_runner_capacity" {
+  name         = "claude_runner_capacity"
+  display_name = "Claude Code runner: concurrent sessions"
+  description  = "How many sessions the runner hosts at once. They share this workspace's Docker daemon and DDEV; the runner installs a skill telling them how to avoid conflicts. Only takes effect when the runner is enabled."
+  type         = "number"
+  default      = "1"
+  mutable      = true
+  order        = var.parameter_order + 1
+  validation {
+    min = 1
+    max = 4
+  }
+}
+
+locals {
+  # Compared as strings, not tobool(): see modules/claude-remote-control.
+  enabled     = data.coder_parameter.enable_claude_runner.value == "true"
+  capacity    = try(tonumber(data.coder_parameter.claude_runner_capacity.value), 1)
+  secret_file = "/home/coder/.claude-runner/environment-secret"
+
+  loop_script = templatefile("${path.module}/files/claude-runner-loop.sh.tftpl", {
+    secret_file = local.secret_file
+    base_dir    = var.base_dir
+    capacity    = local.capacity
+  })
+}
diff --git a/freeform/modules/claude-self-hosted-runner/outputs.tf b/freeform/modules/claude-self-hosted-runner/outputs.tf
new file mode 100644
index 0000000..d347c79
--- /dev/null
+++ b/freeform/modules/claude-self-hosted-runner/outputs.tf
@@ -0,0 +1,42 @@
+output "enabled" {
+  description = "Whether the Claude Code self-hosted runner is enabled"
+  value       = local.enabled
+}
+
+output "startup_script" {
+  description = "Bash snippet for the caller to append to its coder_agent startup_script, after the claude-remote-control snippet and before the ~/.coder-startup.sh user hook."
+  value       = <<-EOT
+
+    # Claude Code self-hosted runner, in tmux session "claude-runner".
+    CLAUDE_RUNNER_ENABLED="${local.enabled}"
+    CLAUDE_REMOTE_CONTROL_ENABLED="${var.remote_control_enabled}"
+    if [ "$CLAUDE_RUNNER_ENABLED" = "true" ]; then
+      if [ "$CLAUDE_REMOTE_CONTROL_ENABLED" = "true" ]; then
+        CLAUDE_RUNNER_MSG="✗ Claude Code self-hosted runner NOT started: Claude Code remote control is also enabled, and the runner rewrites ~/.gitconfig before every session. Turn one of them off."
+      elif [ ! -s "${local.secret_file}" ]; then
+        CLAUDE_RUNNER_MSG="✗ Claude Code self-hosted runner NOT started: save your environment secret as ${local.secret_file} (chmod 600), then restart the workspace."
+      else
+        # /etc is not persistent, so reinstall the session git config on every start.
+        echo '${base64encode(file("${path.module}/files/gitconfig"))}' | base64 -d | sudo tee /etc/gitconfig >/dev/null
+        echo '${base64encode(file("${path.module}/files/gitignore"))}' | base64 -d | sudo tee /etc/gitignore-claude-runner >/dev/null
+        # The runner copies ~/.claude into each session when it starts.
+        mkdir -p ~/.claude/skills/coder-shared-workspace ~/.cache "${var.base_dir}"
+        echo '${base64encode(file("${path.module}/files/SKILL.md"))}' | base64 -d > ~/.claude/skills/coder-shared-workspace/SKILL.md
+        mkdir -p ~/.local/bin
+        echo '${base64encode(local.loop_script)}' | base64 -d > ~/.local/bin/claude-runner-loop
+        chmod +x ~/.local/bin/claude-runner-loop
+        echo '${base64encode(file("${path.module}/files/claude-sessions"))}' | base64 -d > ~/.local/bin/claude-sessions
+        chmod +x ~/.local/bin/claude-sessions
+        mkcert -install >/dev/null 2>&1 || true
+        if pgrep -f 'claude self-hosted-runner' >/dev/null || tmux has-session -t claude-runner 2>/dev/null; then
+          CLAUDE_RUNNER_MSG="✓ Claude Code self-hosted runner already running (tmux attach -t claude-runner)"
+        else
+          tmux new-session -d -s claude-runner ~/.local/bin/claude-runner-loop
+          CLAUDE_RUNNER_MSG="✓ Claude Code self-hosted runner started, capacity ${local.capacity} (tmux attach -t claude-runner; log /tmp/claude-runner.log)"
+        fi
+      fi
+      echo "$CLAUDE_RUNNER_MSG"
+      echo "$CLAUDE_RUNNER_MSG" >> ~/WELCOME.txt
+    fi
+  EOT
+}
diff --git a/freeform/modules/claude-self-hosted-runner/variables.tf b/freeform/modules/claude-self-hosted-runner/variables.tf
new file mode 100644
index 0000000..49efc79
--- /dev/null
+++ b/freeform/modules/claude-self-hosted-runner/variables.tf
@@ -0,0 +1,17 @@
+variable "parameter_order" {
+  description = "Base UI order for the two coder_parameters this module declares (uses this value and this value + 1)"
+  type        = number
+  default     = 14
+}
+
+variable "base_dir" {
+  description = "Directory the runner clones session repositories into"
+  type        = string
+  default     = "/home/coder/workspace"
+}
+
+variable "remote_control_enabled" {
+  description = "Whether Claude Code remote control is enabled in the same workspace; the runner refuses to start alongside it"
+  type        = bool
+  default     = false
+}
diff --git a/freeform/modules/claude-self-hosted-runner/versions.tf b/freeform/modules/claude-self-hosted-runner/versions.tf
new file mode 100644
index 0000000..394c7cb
--- /dev/null
+++ b/freeform/modules/claude-self-hosted-runner/versions.tf
@@ -0,0 +1,7 @@
+terraform {
+  required_providers {
+    coder = {
+      source = "coder/coder"
+    }
+  }
+}
diff --git a/freeform/template.tf b/freeform/template.tf
index 1dd4905..f66e289 100644
--- a/freeform/template.tf
+++ b/freeform/template.tf
@@ -365,6 +365,8 @@ BASHCOMP
 
     ${module.claude_remote_control.startup_script}
 
+    ${module.claude_self_hosted_runner.startup_script}
+
     # User startup hook: run ~/.coder-startup.sh (persistent home) on every
     # workspace start, e.g. to start services or long-running processes without
     # waiting for someone to open a terminal. It is detached from the agent so a
@@ -446,6 +448,11 @@ module "claude_remote_control" {
   agent_id = coder_agent.main.id
 }
 
+module "claude_self_hosted_runner" {
+  source                 = "./modules/claude-self-hosted-runner"
+  remote_control_enabled = module.claude_remote_control.enabled
+}
+
 # One coder_app per project name. All route to ddev-router on port 8080.
 # ddev-router dispatches by Host header: {slug}--{workspace}--{owner}.{domain}
 # The DDEV project name must equal the slug for coder-routes to build the correct rule.
diff --git a/freeform/tests/validate.tftest.hcl b/freeform/tests/validate.tftest.hcl
index 4c7d8c6..b4802d3 100644
--- a/freeform/tests/validate.tftest.hcl
+++ b/freeform/tests/validate.tftest.hcl
@@ -250,3 +250,59 @@ run "ssh_agent_relay" {
     error_message = "startup script must point DDEV's ssh_agent_upstream at the relay socket"
   }
 }
+
+run "claude_runner_disabled_by_default" {
+  command = plan
+  assert {
+    condition     = strcontains(coder_agent.main.startup_script, "CLAUDE_RUNNER_ENABLED=\"false\"")
+    error_message = "the Claude Code self-hosted runner must be off unless enable_claude_runner=true"
+  }
+}
+
+run "claude_runner_enabled" {
+  command = plan
+  override_data {
+    target = module.claude_self_hosted_runner.data.coder_parameter.enable_claude_runner
+    values = {
+      value = "true"
+    }
+  }
+  override_data {
+    target = module.claude_self_hosted_runner.data.coder_parameter.claude_runner_capacity
+    values = {
+      value = "3"
+    }
+  }
+  assert {
+    condition     = strcontains(coder_agent.main.startup_script, "CLAUDE_RUNNER_ENABLED=\"true\"")
+    error_message = "startup script must start the runner when enable_claude_runner=true"
+  }
+  assert {
+    condition     = strcontains(coder_agent.main.startup_script, "CLAUDE_REMOTE_CONTROL_ENABLED=\"false\"")
+    error_message = "the runner must see remote control as off when enable_claude_code=false"
+  }
+  assert {
+    condition     = strcontains(base64decode(regex("echo '([A-Za-z0-9+/=]+)' \\| base64 -d > ~/.local/bin/claude-runner-loop", coder_agent.main.startup_script)[0]), "--capacity 3")
+    error_message = "runner loop script must pass the claude_runner_capacity value as --capacity"
+  }
+}
+
+run "claude_runner_refuses_alongside_remote_control" {
+  command = plan
+  override_data {
+    target = module.claude_self_hosted_runner.data.coder_parameter.enable_claude_runner
+    values = {
+      value = "true"
+    }
+  }
+  override_data {
+    target = module.claude_remote_control.data.coder_parameter.enable_claude_code
+    values = {
+      value = "true"
+    }
+  }
+  assert {
+    condition     = strcontains(coder_agent.main.startup_script, "CLAUDE_REMOTE_CONTROL_ENABLED=\"true\"")
+    error_message = "the runner snippet must know remote control is on, so it refuses to start"
+  }
+}
diff --git a/modules/claude-self-hosted-runner/files/SKILL.md b/modules/claude-self-hosted-runner/files/SKILL.md
new file mode 100644
index 0000000..1bf8354
--- /dev/null
+++ b/modules/claude-self-hosted-runner/files/SKILL.md
@@ -0,0 +1,87 @@
+---
+name: coder-shared-workspace
+description: Rules for sharing this Coder workspace, its Docker daemon and its DDEV install with other Claude sessions that the self-hosted runner runs at the same time. Read before running ddev, docker, or a repository's integration tests, before cleaning up disk, and before working in a checkout another session may be using.
+---
+
+# Sharing this workspace with other sessions
+
+This workspace runs a Claude Code self-hosted runner that can host several
+sessions at once. They all run as the same Unix user, with the same home
+directory, one Docker daemon and one DDEV global configuration. Nothing
+isolates them except the rules below.
+
+## See who else is here
+
+```bash
+pgrep -af -- '--sdk-url' | grep -o 'sessions/cse_[A-Za-z0-9]*' | sort -u
+pgrep -af -- '--sdk-url' | grep -o -- '--add-dir [^ ]*' | sort | uniq -c
+```
+
+The first lists active sessions; the second shows which directories they
+work in. If you are the only session, the rest of this file still applies,
+since another session can start at any time.
+
+## Repositories and checkouts
+
+- Sessions working in different repositories do not interfere with each
+  other's files.
+- Never switch the branch, reset, stash, or clean a checkout another
+  session is using. If your working directory is a checkout another session
+  also has, make your own worktree and work there:
+
+  ```bash
+  repo=~/workspace/<owner>/<repo>
+  git -C "$repo" worktree add ~/workspace/<repo>-worktrees/<your-branch> -b <your-branch> <base>
+  ```
+
+  Keep worktrees under `~/workspace/<repo>-worktrees/`. Remove yours with
+  `git worktree remove` when the session is done. Two worktrees cannot have
+  the same branch checked out.
+- Put scratch files in `~/tmp/<your session id>/`, not directly in `~/tmp`.
+
+## Docker and DDEV
+
+There is one Docker daemon. A command that affects every container affects
+every session.
+
+- **Never** run these unless the user asks for them:
+  `ddev poweroff`, `ddev stop --all`, `ddev delete images`,
+  `ddev clean`, `docker system prune`, `docker volume prune`,
+  `docker rm -f $(docker ps -aq)`, or anything that restarts dockerd.
+  Stop, restart or delete only projects you started.
+- Do not change the DDEV global configuration (`ddev config global`,
+  `~/.ddev/global_config.yaml`). Put settings in the project's
+  `.ddev/config.*.yaml` instead.
+- Give throwaway projects names no other session will pick, such as
+  `<purpose>-<first 8 characters of your session id>`, and delete them with
+  `ddev delete -Oy <name>` when done. The names registered in the workspace
+  (`$CODER_PROJECT_NAMES`) are the only ones reachable from a browser; check
+  `ddev list` and ask before taking one another session is using.
+- Do not set fixed host ports (`host_https_port`, `host_webserver_port`,
+  `host_db_port`) in a project. Let DDEV choose, so two projects never
+  collide. Pick free ports for any other server you run.
+- A project you started may be stopped by another session's tests (see
+  below). If it is, `ddev start` it again.
+
+## Tests that take over Docker
+
+Some test suites start and power off DDEV projects on their own, for
+example the integration tests of `ddev/ddev` (`make testpkg`, `make testcmd`,
+`go test ./pkg/ddevapp/...`), which run `ddev poweroff`. Run those only
+while holding the workspace-wide Docker lock, so two of them never run at
+the same time:
+
+```bash
+flock --exclusive ~/.cache/coder-docker.lock make testpkg TESTARGS="-run TestName"
+```
+
+`flock` waits until the lock is free. Tell the user when you have been
+waiting more than a few minutes, rather than waiting silently. Code that
+only compiles or runs unit tests that do not touch Docker needs no lock.
+
+## Disk
+
+The disk is shared. When it fills up, stop what you started and delete
+only what you created (build output, your worktrees, your `~/tmp`
+directory, your test projects). Never delete another session's files, and
+never prune Docker images or volumes another session may use.
diff --git a/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl b/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
new file mode 100644
index 0000000..50f0e7a
--- /dev/null
+++ b/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Keep the Claude Code self-hosted runner running; it exits on its own when
+# --release-idle-session-min leaves it with no sessions.
+export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:/home/linuxbrew/.linuxbrew/bin:$PATH"
+while true; do
+  /home/linuxbrew/.linuxbrew/bin/claude self-hosted-runner \
+    --environment-secret-file "${secret_file}" \
+    --base-dir "${base_dir}" \
+    --capacity ${capacity} \
+    --client-label "$CODER_WORKSPACE_NAME" \
+    --use-anthropic-git-proxy \
+    --push-outcome-on-release \
+    --release-idle-session-min 30 \
+    --kill-session-after-min 480 \
+    --health-port 0 \
+    --log-file /tmp/claude-runner.log
+  rc=$?
+  echo "$(date): runner exited ($rc); restarting in 5s"
+  sleep 5
+done
diff --git a/modules/claude-self-hosted-runner/files/claude-sessions b/modules/claude-self-hosted-runner/files/claude-sessions
new file mode 100644
index 0000000..43b43c4
--- /dev/null
+++ b/modules/claude-self-hosted-runner/files/claude-sessions
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# List the runner's live sessions: id, checkout, branch, and commits on no remote
+# branch, so a person can find a session's work without asking it.
+set -u
+pgrep -af -- '--sdk-url' | while read -r _ cmd; do
+  id=$(grep -o 'sessions/cse_[A-Za-z0-9]*' <<<"$cmd" | head -1 | cut -d/ -f2)
+  for dir in $(grep -o -- '--add-dir [^ ]*' <<<"$cmd" | cut -d' ' -f2 | grep -v '/_sessions/'); do
+    git -C "$dir" rev-parse --git-dir >/dev/null 2>&1 || continue
+    branch=$(git -C "$dir" branch --show-current)
+    ahead=$(git -C "$dir" rev-list --count HEAD --not --remotes)
+    printf '%s  %s  %s  unpushed: %s\n' "$id" "$dir" "$branch" "$ahead"
+  done
+done | sort -u
diff --git a/modules/claude-self-hosted-runner/files/gitconfig b/modules/claude-self-hosted-runner/files/gitconfig
new file mode 100644
index 0000000..a24da96
--- /dev/null
+++ b/modules/claude-self-hosted-runner/files/gitconfig
@@ -0,0 +1,8 @@
+# Installed by the claude-self-hosted-runner module. The runner deletes
+# ~/.gitconfig and ~/.config/git before every session, so session git
+# settings live here instead.
+[user]
+	name = Claude
+	email = noreply@anthropic.com
+[core]
+	excludesFile = /etc/gitignore-claude-runner
diff --git a/modules/claude-self-hosted-runner/files/gitignore b/modules/claude-self-hosted-runner/files/gitignore
new file mode 100644
index 0000000..04fb92b
--- /dev/null
+++ b/modules/claude-self-hosted-runner/files/gitignore
@@ -0,0 +1,4 @@
+# Installed by the claude-self-hosted-runner module.
+config.coder.yaml
+docker-compose.coder-describe.yaml
+.claude/settings.local.json
diff --git a/modules/claude-self-hosted-runner/main.tf b/modules/claude-self-hosted-runner/main.tf
new file mode 100644
index 0000000..a580c8b
--- /dev/null
+++ b/modules/claude-self-hosted-runner/main.tf
@@ -0,0 +1,44 @@
+data "coder_parameter" "enable_claude_runner" {
+  name         = "enable_claude_runner"
+  display_name = "Run a Claude Code self-hosted runner"
+  description  = <<-EOT
+    Start a Claude Code self-hosted runner on every workspace start, so sessions you start on claude.ai/code in that environment run in this workspace.
+
+    **One-time setup:** create a self-hosted environment on claude.ai, then save its environment secret in the workspace as `~/.claude-runner/environment-secret` (mode 600). Until that file exists, the runner doesn't start and the startup log says why.
+
+    **Use a workspace dedicated to the runner.** The runner deletes and rewrites `~/.gitconfig` and `~/.config/git` before every session. It can't be enabled together with Claude Code remote control.
+  EOT
+
+  type      = "bool"
+  form_type = "switch"
+  default   = "false"
+  mutable   = true
+  order     = var.parameter_order
+}
+
+data "coder_parameter" "claude_runner_capacity" {
+  name         = "claude_runner_capacity"
+  display_name = "Claude Code runner: concurrent sessions"
+  description  = "How many sessions the runner hosts at once. They share this workspace's Docker daemon and DDEV; the runner installs a skill telling them how to avoid conflicts. Only takes effect when the runner is enabled."
+  type         = "number"
+  default      = "1"
+  mutable      = true
+  order        = var.parameter_order + 1
+  validation {
+    min = 1
+    max = 4
+  }
+}
+
+locals {
+  # Compared as strings, not tobool(): see modules/claude-remote-control.
+  enabled     = data.coder_parameter.enable_claude_runner.value == "true"
+  capacity    = try(tonumber(data.coder_parameter.claude_runner_capacity.value), 1)
+  secret_file = "/home/coder/.claude-runner/environment-secret"
+
+  loop_script = templatefile("${path.module}/files/claude-runner-loop.sh.tftpl", {
+    secret_file = local.secret_file
+    base_dir    = var.base_dir
+    capacity    = local.capacity
+  })
+}
diff --git a/modules/claude-self-hosted-runner/outputs.tf b/modules/claude-self-hosted-runner/outputs.tf
new file mode 100644
index 0000000..d347c79
--- /dev/null
+++ b/modules/claude-self-hosted-runner/outputs.tf
@@ -0,0 +1,42 @@
+output "enabled" {
+  description = "Whether the Claude Code self-hosted runner is enabled"
+  value       = local.enabled
+}
+
+output "startup_script" {
+  description = "Bash snippet for the caller to append to its coder_agent startup_script, after the claude-remote-control snippet and before the ~/.coder-startup.sh user hook."
+  value       = <<-EOT
+
+    # Claude Code self-hosted runner, in tmux session "claude-runner".
+    CLAUDE_RUNNER_ENABLED="${local.enabled}"
+    CLAUDE_REMOTE_CONTROL_ENABLED="${var.remote_control_enabled}"
+    if [ "$CLAUDE_RUNNER_ENABLED" = "true" ]; then
+      if [ "$CLAUDE_REMOTE_CONTROL_ENABLED" = "true" ]; then
+        CLAUDE_RUNNER_MSG="✗ Claude Code self-hosted runner NOT started: Claude Code remote control is also enabled, and the runner rewrites ~/.gitconfig before every session. Turn one of them off."
+      elif [ ! -s "${local.secret_file}" ]; then
+        CLAUDE_RUNNER_MSG="✗ Claude Code self-hosted runner NOT started: save your environment secret as ${local.secret_file} (chmod 600), then restart the workspace."
+      else
+        # /etc is not persistent, so reinstall the session git config on every start.
+        echo '${base64encode(file("${path.module}/files/gitconfig"))}' | base64 -d | sudo tee /etc/gitconfig >/dev/null
+        echo '${base64encode(file("${path.module}/files/gitignore"))}' | base64 -d | sudo tee /etc/gitignore-claude-runner >/dev/null
+        # The runner copies ~/.claude into each session when it starts.
+        mkdir -p ~/.claude/skills/coder-shared-workspace ~/.cache "${var.base_dir}"
+        echo '${base64encode(file("${path.module}/files/SKILL.md"))}' | base64 -d > ~/.claude/skills/coder-shared-workspace/SKILL.md
+        mkdir -p ~/.local/bin
+        echo '${base64encode(local.loop_script)}' | base64 -d > ~/.local/bin/claude-runner-loop
+        chmod +x ~/.local/bin/claude-runner-loop
+        echo '${base64encode(file("${path.module}/files/claude-sessions"))}' | base64 -d > ~/.local/bin/claude-sessions
+        chmod +x ~/.local/bin/claude-sessions
+        mkcert -install >/dev/null 2>&1 || true
+        if pgrep -f 'claude self-hosted-runner' >/dev/null || tmux has-session -t claude-runner 2>/dev/null; then
+          CLAUDE_RUNNER_MSG="✓ Claude Code self-hosted runner already running (tmux attach -t claude-runner)"
+        else
+          tmux new-session -d -s claude-runner ~/.local/bin/claude-runner-loop
+          CLAUDE_RUNNER_MSG="✓ Claude Code self-hosted runner started, capacity ${local.capacity} (tmux attach -t claude-runner; log /tmp/claude-runner.log)"
+        fi
+      fi
+      echo "$CLAUDE_RUNNER_MSG"
+      echo "$CLAUDE_RUNNER_MSG" >> ~/WELCOME.txt
+    fi
+  EOT
+}
diff --git a/modules/claude-self-hosted-runner/variables.tf b/modules/claude-self-hosted-runner/variables.tf
new file mode 100644
index 0000000..49efc79
--- /dev/null
+++ b/modules/claude-self-hosted-runner/variables.tf
@@ -0,0 +1,17 @@
+variable "parameter_order" {
+  description = "Base UI order for the two coder_parameters this module declares (uses this value and this value + 1)"
+  type        = number
+  default     = 14
+}
+
+variable "base_dir" {
+  description = "Directory the runner clones session repositories into"
+  type        = string
+  default     = "/home/coder/workspace"
+}
+
+variable "remote_control_enabled" {
+  description = "Whether Claude Code remote control is enabled in the same workspace; the runner refuses to start alongside it"
+  type        = bool
+  default     = false
+}
diff --git a/modules/claude-self-hosted-runner/versions.tf b/modules/claude-self-hosted-runner/versions.tf
new file mode 100644
index 0000000..394c7cb
--- /dev/null
+++ b/modules/claude-self-hosted-runner/versions.tf
@@ -0,0 +1,7 @@
+terraform {
+  required_providers {
+    coder = {
+      source = "coder/coder"
+    }
+  }
+}
diff --git a/openspec/changes/add-claude-self-hosted-runner/proposal.md b/openspec/changes/add-claude-self-hosted-runner/proposal.md
new file mode 100644
index 0000000..588a425
--- /dev/null
+++ b/openspec/changes/add-claude-self-hosted-runner/proposal.md
@@ -0,0 +1,18 @@
+# Change: Add Optional Claude Code Self-Hosted Runner
+
+## Why
+A Coder workspace can serve as a Claude Code self-hosted runner, so sessions started on claude.ai/code run with the workspace's Docker and DDEV. Today that takes a hand-written `~/.coder-startup.sh`, a restart loop in tmux and a hand-maintained `/etc/gitconfig`, and it is easy to get wrong: a startup marker kept in `/tmp` survived a workspace stop/start and silently kept the runner from starting. Several sessions on one runner also share one Docker daemon and one DDEV install, and nothing tells them how to avoid breaking each other's work.
+
+## What Changes
+- New shared module `modules/claude-self-hosted-runner`, vendored into `drupal-core`, `drupal-contrib` and `freeform` like the other shared modules (`make sync-claude-runner-module`, part of `make sync-shared`).
+- Two parameters: "Run a Claude Code self-hosted runner" (switch, default off) and "Claude Code runner: concurrent sessions" (1–4, default 1).
+- When on, and `~/.claude-runner/environment-secret` exists, the startup script starts `claude self-hosted-runner` in a restart loop in tmux session `claude-runner`, with `--use-anthropic-git-proxy` and `--push-outcome-on-release`. The secret never goes through Terraform.
+- Because the runner rewrites `~/.gitconfig` and `~/.config/git` before every session, the session git identity and ignore list are installed in `/etc/gitconfig` on every start.
+- The runner refuses to start when Claude Code remote control is also on, and says why in the build log and `~/WELCOME.txt`.
+- Installs the skill `~/.claude/skills/coder-shared-workspace`, which the runner copies into every session: worktrees instead of shared checkouts, no workspace-wide Docker/DDEV commands, a `flock` around test suites that power off DDEV, and disk cleanup limited to a session's own files.
+- Installs `claude-sessions`, which lists live sessions with their checkout, branch and unpushed commit count.
+- Documented in `docs/user/using-workspaces.md`.
+
+## Impact
+- Affected specs: `claude-self-hosted-runner` (new capability)
+- Affected code: `modules/claude-self-hosted-runner/` and its vendored copies, `drupal-core/template.tf`, `drupal-contrib/template.tf`, `freeform/template.tf`, their `tests/validate.tftest.hcl`, `Makefile`, `CLAUDE.md`, `docs/user/using-workspaces.md`
diff --git a/openspec/changes/add-claude-self-hosted-runner/specs/claude-self-hosted-runner/spec.md b/openspec/changes/add-claude-self-hosted-runner/specs/claude-self-hosted-runner/spec.md
new file mode 100644
index 0000000..04d158d
--- /dev/null
+++ b/openspec/changes/add-claude-self-hosted-runner/specs/claude-self-hosted-runner/spec.md
@@ -0,0 +1,22 @@
+## ADDED Requirements
+
+### Requirement: Optional Claude Code Self-Hosted Runner
+The workspace startup script SHALL start a Claude Code self-hosted runner on every workspace start when the user enables it and has saved an environment secret, and SHALL do nothing otherwise.
+
+#### Scenario: Enabled with a secret
+- **WHEN** a workspace starts with "Run a Claude Code self-hosted runner" on and `~/.claude-runner/environment-secret` is non-empty
+- **THEN** the startup script SHALL start `claude self-hosted-runner` in a restart loop in tmux session `claude-runner`, unless a runner is already running
+- **AND** it SHALL pass the "concurrent sessions" value as `--capacity`
+- **AND** it SHALL install the session git config in `/etc/gitconfig`, the `coder-shared-workspace` skill in `~/.claude/skills`, and `claude-sessions` in `~/.local/bin`
+
+#### Scenario: Enabled without a secret
+- **WHEN** the runner is enabled and the secret file is missing or empty
+- **THEN** the runner SHALL NOT start, and the build log and `~/WELCOME.txt` SHALL say how to add the secret
+
+#### Scenario: Enabled together with remote control
+- **WHEN** both the runner and Claude Code remote control are enabled
+- **THEN** the runner SHALL NOT start, and the build log and `~/WELCOME.txt` SHALL say to turn one of them off
+
+#### Scenario: Disabled
+- **WHEN** the runner is off (the default)
+- **THEN** workspace startup SHALL proceed exactly as before
diff --git a/openspec/changes/add-claude-self-hosted-runner/tasks.md b/openspec/changes/add-claude-self-hosted-runner/tasks.md
new file mode 100644
index 0000000..cd87d38
--- /dev/null
+++ b/openspec/changes/add-claude-self-hosted-runner/tasks.md
@@ -0,0 +1,10 @@
+## 1. Implementation
+- [x] 1.1 Add `modules/claude-self-hosted-runner` and the `sync-claude-runner-module` Makefile target <!-- id: 1.1 -->
+- [x] 1.2 Wire the module into `drupal-core`, `drupal-contrib` and `freeform`, after the remote-control snippet and before the user startup hook <!-- id: 1.2 -->
+- [x] 1.3 Add runner runs to each template's `tests/validate.tftest.hcl` <!-- id: 1.3 -->
+- [x] 1.4 Document the runner in `docs/user/using-workspaces.md` <!-- id: 1.4 -->
+
+## 2. Validation
+- [x] 2.1 `terraform fmt -check -recursive`, `make validate` and `make test-templates` pass <!-- id: 2.1 -->
+- [ ] 2.2 Manual check on staging: with the switch on and the secret saved, the runner comes up after a workspace restart with no terminal open, and a session lands on it <!-- id: 2.2 -->
+- [ ] 2.3 Manual check on staging: with capacity 2, two sessions run at once and both see the `coder-shared-workspace` skill <!-- id: 2.3 -->

From ea52812cfcb87b083f5a2308730b6c774c6b0f78 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 27 Oct 2026 14:41:33 +0000
Subject: [PATCH 2/7] feat: give each runner session its own DDEV global
 directory

The coder-shared-workspace skill now tells sessions to set
DDEV_XDG_CONFIG_HOME to a per-session directory seeded from ~/.ddev, so
project lists and global settings stay separate. Container names and the
shared router stay global, so unique project names and the test lock remain.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UrTUMvjLtFGNseL9fh5s4o
---
 docs/user/using-workspaces.md                 |  2 +-
 .../claude-self-hosted-runner/files/SKILL.md  | 28 +++++++++++++++----
 .../claude-self-hosted-runner/files/SKILL.md  | 28 +++++++++++++++----
 .../claude-self-hosted-runner/files/SKILL.md  | 28 +++++++++++++++----
 .../claude-self-hosted-runner/files/SKILL.md  | 28 +++++++++++++++----
 .../add-claude-self-hosted-runner/proposal.md |  2 +-
 6 files changed, 90 insertions(+), 26 deletions(-)

diff --git a/docs/user/using-workspaces.md b/docs/user/using-workspaces.md
index f6ae485..198c4ec 100644
--- a/docs/user/using-workspaces.md
+++ b/docs/user/using-workspaces.md
@@ -90,7 +90,7 @@ On every start the runner runs in the tmux session `claude-runner` (`tmux attach
 
 - **Use a workspace only for the runner.** The runner deletes and rewrites `~/.gitconfig` and `~/.config/git` before every session, so the template puts the sessions' git identity (`Claude <noreply@anthropic.com>`) and ignore list in `/etc/gitconfig` instead. The option refuses to start the runner when Claude Code remote control is also on.
 - **Finding a session's work.** Run `claude-sessions` in the workspace to list live sessions with their checkout, branch and the number of commits not on any remote. When a session ends because its user went idle, the runner was stopped, or it failed, the runner pushes the session's `claude/...` branch to `origin` (`--push-outcome-on-release`), so commits made by a repository whose rules forbid agents to push still reach GitHub.
-- **Concurrent sessions.** "Claude Code runner: concurrent sessions" (1 to 4) sets how many sessions run at once. They share one Docker daemon and one DDEV install, so the template installs the skill `~/.claude/skills/coder-shared-workspace`, which tells sessions how to stay out of each other's way: separate git worktrees, no `ddev poweroff`, and a lock around test suites that take over Docker. For full isolation, use several workspaces with one session each instead; the same environment secret works in all of them.
+- **Concurrent sessions.** "Claude Code runner: concurrent sessions" (1 to 4) sets how many sessions run at once. They share one Docker daemon and one DDEV install, so the template installs the skill `~/.claude/skills/coder-shared-workspace`, which tells sessions how to stay out of each other's way: separate git worktrees, a DDEV global directory per session (`DDEV_XDG_CONFIG_HOME`), no `ddev poweroff`, and a lock around test suites that take over Docker. For full isolation, use several workspaces with one session each instead; the same environment secret works in all of them.
 
 ### Ending Your Day
 
diff --git a/drupal-contrib/modules/claude-self-hosted-runner/files/SKILL.md b/drupal-contrib/modules/claude-self-hosted-runner/files/SKILL.md
index 1bf8354..e651bdb 100644
--- a/drupal-contrib/modules/claude-self-hosted-runner/files/SKILL.md
+++ b/drupal-contrib/modules/claude-self-hosted-runner/files/SKILL.md
@@ -49,14 +49,30 @@ every session.
   `ddev clean`, `docker system prune`, `docker volume prune`,
   `docker rm -f $(docker ps -aq)`, or anything that restarts dockerd.
   Stop, restart or delete only projects you started.
-- Do not change the DDEV global configuration (`ddev config global`,
-  `~/.ddev/global_config.yaml`). Put settings in the project's
-  `.ddev/config.*.yaml` instead.
-- Give throwaway projects names no other session will pick, such as
+- Give your session its own DDEV global directory with
+  [`DDEV_XDG_CONFIG_HOME`](https://docs.ddev.com/en/stable/users/usage/architecture/#global-files),
+  seeded from the workspace's, so your project list and global settings
+  are yours:
+
+  ```bash
+  export DDEV_XDG_CONFIG_HOME=~/tmp/<your session id>/config
+  mkdir -p "$DDEV_XDG_CONFIG_HOME/ddev"
+  cp -r ~/.ddev/global_config.yaml ~/.ddev/commands "$DDEV_XDG_CONFIG_HOME/ddev/"
+  ```
+
+  Shell state does not carry over between your commands, so export the
+  variable in every command that runs `ddev`, including test runs. Keep the
+  router settings copied from `~/.ddev` unchanged: the router and
+  `ddev-ssh-agent` containers are shared by every session. Never edit
+  `~/.ddev/global_config.yaml` itself.
+- Project names are still global, because Docker container names are.
+  Give throwaway projects names no other session will pick, such as
   `<purpose>-<first 8 characters of your session id>`, and delete them with
   `ddev delete -Oy <name>` when done. The names registered in the workspace
-  (`$CODER_PROJECT_NAMES`) are the only ones reachable from a browser; check
-  `ddev list` and ask before taking one another session is using.
+  (`$CODER_PROJECT_NAMES`) are the only ones reachable from a browser. Each
+  session's `ddev list` shows only its own projects, so list every running
+  one with `docker ps --format '{{.Label "com.ddev.site-name"}}' | grep . | sort -u`,
+  and ask before taking a name another session is using.
 - Do not set fixed host ports (`host_https_port`, `host_webserver_port`,
   `host_db_port`) in a project. Let DDEV choose, so two projects never
   collide. Pick free ports for any other server you run.
diff --git a/drupal-core/modules/claude-self-hosted-runner/files/SKILL.md b/drupal-core/modules/claude-self-hosted-runner/files/SKILL.md
index 1bf8354..e651bdb 100644
--- a/drupal-core/modules/claude-self-hosted-runner/files/SKILL.md
+++ b/drupal-core/modules/claude-self-hosted-runner/files/SKILL.md
@@ -49,14 +49,30 @@ every session.
   `ddev clean`, `docker system prune`, `docker volume prune`,
   `docker rm -f $(docker ps -aq)`, or anything that restarts dockerd.
   Stop, restart or delete only projects you started.
-- Do not change the DDEV global configuration (`ddev config global`,
-  `~/.ddev/global_config.yaml`). Put settings in the project's
-  `.ddev/config.*.yaml` instead.
-- Give throwaway projects names no other session will pick, such as
+- Give your session its own DDEV global directory with
+  [`DDEV_XDG_CONFIG_HOME`](https://docs.ddev.com/en/stable/users/usage/architecture/#global-files),
+  seeded from the workspace's, so your project list and global settings
+  are yours:
+
+  ```bash
+  export DDEV_XDG_CONFIG_HOME=~/tmp/<your session id>/config
+  mkdir -p "$DDEV_XDG_CONFIG_HOME/ddev"
+  cp -r ~/.ddev/global_config.yaml ~/.ddev/commands "$DDEV_XDG_CONFIG_HOME/ddev/"
+  ```
+
+  Shell state does not carry over between your commands, so export the
+  variable in every command that runs `ddev`, including test runs. Keep the
+  router settings copied from `~/.ddev` unchanged: the router and
+  `ddev-ssh-agent` containers are shared by every session. Never edit
+  `~/.ddev/global_config.yaml` itself.
+- Project names are still global, because Docker container names are.
+  Give throwaway projects names no other session will pick, such as
   `<purpose>-<first 8 characters of your session id>`, and delete them with
   `ddev delete -Oy <name>` when done. The names registered in the workspace
-  (`$CODER_PROJECT_NAMES`) are the only ones reachable from a browser; check
-  `ddev list` and ask before taking one another session is using.
+  (`$CODER_PROJECT_NAMES`) are the only ones reachable from a browser. Each
+  session's `ddev list` shows only its own projects, so list every running
+  one with `docker ps --format '{{.Label "com.ddev.site-name"}}' | grep . | sort -u`,
+  and ask before taking a name another session is using.
 - Do not set fixed host ports (`host_https_port`, `host_webserver_port`,
   `host_db_port`) in a project. Let DDEV choose, so two projects never
   collide. Pick free ports for any other server you run.
diff --git a/freeform/modules/claude-self-hosted-runner/files/SKILL.md b/freeform/modules/claude-self-hosted-runner/files/SKILL.md
index 1bf8354..e651bdb 100644
--- a/freeform/modules/claude-self-hosted-runner/files/SKILL.md
+++ b/freeform/modules/claude-self-hosted-runner/files/SKILL.md
@@ -49,14 +49,30 @@ every session.
   `ddev clean`, `docker system prune`, `docker volume prune`,
   `docker rm -f $(docker ps -aq)`, or anything that restarts dockerd.
   Stop, restart or delete only projects you started.
-- Do not change the DDEV global configuration (`ddev config global`,
-  `~/.ddev/global_config.yaml`). Put settings in the project's
-  `.ddev/config.*.yaml` instead.
-- Give throwaway projects names no other session will pick, such as
+- Give your session its own DDEV global directory with
+  [`DDEV_XDG_CONFIG_HOME`](https://docs.ddev.com/en/stable/users/usage/architecture/#global-files),
+  seeded from the workspace's, so your project list and global settings
+  are yours:
+
+  ```bash
+  export DDEV_XDG_CONFIG_HOME=~/tmp/<your session id>/config
+  mkdir -p "$DDEV_XDG_CONFIG_HOME/ddev"
+  cp -r ~/.ddev/global_config.yaml ~/.ddev/commands "$DDEV_XDG_CONFIG_HOME/ddev/"
+  ```
+
+  Shell state does not carry over between your commands, so export the
+  variable in every command that runs `ddev`, including test runs. Keep the
+  router settings copied from `~/.ddev` unchanged: the router and
+  `ddev-ssh-agent` containers are shared by every session. Never edit
+  `~/.ddev/global_config.yaml` itself.
+- Project names are still global, because Docker container names are.
+  Give throwaway projects names no other session will pick, such as
   `<purpose>-<first 8 characters of your session id>`, and delete them with
   `ddev delete -Oy <name>` when done. The names registered in the workspace
-  (`$CODER_PROJECT_NAMES`) are the only ones reachable from a browser; check
-  `ddev list` and ask before taking one another session is using.
+  (`$CODER_PROJECT_NAMES`) are the only ones reachable from a browser. Each
+  session's `ddev list` shows only its own projects, so list every running
+  one with `docker ps --format '{{.Label "com.ddev.site-name"}}' | grep . | sort -u`,
+  and ask before taking a name another session is using.
 - Do not set fixed host ports (`host_https_port`, `host_webserver_port`,
   `host_db_port`) in a project. Let DDEV choose, so two projects never
   collide. Pick free ports for any other server you run.
diff --git a/modules/claude-self-hosted-runner/files/SKILL.md b/modules/claude-self-hosted-runner/files/SKILL.md
index 1bf8354..e651bdb 100644
--- a/modules/claude-self-hosted-runner/files/SKILL.md
+++ b/modules/claude-self-hosted-runner/files/SKILL.md
@@ -49,14 +49,30 @@ every session.
   `ddev clean`, `docker system prune`, `docker volume prune`,
   `docker rm -f $(docker ps -aq)`, or anything that restarts dockerd.
   Stop, restart or delete only projects you started.
-- Do not change the DDEV global configuration (`ddev config global`,
-  `~/.ddev/global_config.yaml`). Put settings in the project's
-  `.ddev/config.*.yaml` instead.
-- Give throwaway projects names no other session will pick, such as
+- Give your session its own DDEV global directory with
+  [`DDEV_XDG_CONFIG_HOME`](https://docs.ddev.com/en/stable/users/usage/architecture/#global-files),
+  seeded from the workspace's, so your project list and global settings
+  are yours:
+
+  ```bash
+  export DDEV_XDG_CONFIG_HOME=~/tmp/<your session id>/config
+  mkdir -p "$DDEV_XDG_CONFIG_HOME/ddev"
+  cp -r ~/.ddev/global_config.yaml ~/.ddev/commands "$DDEV_XDG_CONFIG_HOME/ddev/"
+  ```
+
+  Shell state does not carry over between your commands, so export the
+  variable in every command that runs `ddev`, including test runs. Keep the
+  router settings copied from `~/.ddev` unchanged: the router and
+  `ddev-ssh-agent` containers are shared by every session. Never edit
+  `~/.ddev/global_config.yaml` itself.
+- Project names are still global, because Docker container names are.
+  Give throwaway projects names no other session will pick, such as
   `<purpose>-<first 8 characters of your session id>`, and delete them with
   `ddev delete -Oy <name>` when done. The names registered in the workspace
-  (`$CODER_PROJECT_NAMES`) are the only ones reachable from a browser; check
-  `ddev list` and ask before taking one another session is using.
+  (`$CODER_PROJECT_NAMES`) are the only ones reachable from a browser. Each
+  session's `ddev list` shows only its own projects, so list every running
+  one with `docker ps --format '{{.Label "com.ddev.site-name"}}' | grep . | sort -u`,
+  and ask before taking a name another session is using.
 - Do not set fixed host ports (`host_https_port`, `host_webserver_port`,
   `host_db_port`) in a project. Let DDEV choose, so two projects never
   collide. Pick free ports for any other server you run.
diff --git a/openspec/changes/add-claude-self-hosted-runner/proposal.md b/openspec/changes/add-claude-self-hosted-runner/proposal.md
index 588a425..d675d76 100644
--- a/openspec/changes/add-claude-self-hosted-runner/proposal.md
+++ b/openspec/changes/add-claude-self-hosted-runner/proposal.md
@@ -9,7 +9,7 @@ A Coder workspace can serve as a Claude Code self-hosted runner, so sessions sta
 - When on, and `~/.claude-runner/environment-secret` exists, the startup script starts `claude self-hosted-runner` in a restart loop in tmux session `claude-runner`, with `--use-anthropic-git-proxy` and `--push-outcome-on-release`. The secret never goes through Terraform.
 - Because the runner rewrites `~/.gitconfig` and `~/.config/git` before every session, the session git identity and ignore list are installed in `/etc/gitconfig` on every start.
 - The runner refuses to start when Claude Code remote control is also on, and says why in the build log and `~/WELCOME.txt`.
-- Installs the skill `~/.claude/skills/coder-shared-workspace`, which the runner copies into every session: worktrees instead of shared checkouts, no workspace-wide Docker/DDEV commands, a `flock` around test suites that power off DDEV, and disk cleanup limited to a session's own files.
+- Installs the skill `~/.claude/skills/coder-shared-workspace`, which the runner copies into every session: worktrees instead of shared checkouts, a DDEV global directory per session via `DDEV_XDG_CONFIG_HOME`, no workspace-wide Docker/DDEV commands, a `flock` around test suites that power off DDEV, and disk cleanup limited to a session's own files.
 - Installs `claude-sessions`, which lists live sessions with their checkout, branch and unpushed commit count.
 - Documented in `docs/user/using-workspaces.md`.
 

From a630c62bd33fe3899be5d7934a801ccba6b44f28 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 27 Oct 2026 14:56:54 +0000
Subject: [PATCH 3/7] refactor: offer the Claude Code self-hosted runner in
 freeform only

The Drupal templates set up one project for a person to work on; a runner
workspace is a general-purpose host, which is what freeform is for.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UrTUMvjLtFGNseL9fh5s4o
---
 CLAUDE.md                                     |   4 +-
 Makefile                                      |  12 +-
 docs/user/using-workspaces.md                 |   2 +-
 .../claude-self-hosted-runner/files/SKILL.md  | 103 ------------------
 .../files/claude-runner-loop.sh.tftpl         |  20 ----
 .../files/claude-sessions                     |  13 ---
 .../claude-self-hosted-runner/files/gitconfig |   8 --
 .../claude-self-hosted-runner/files/gitignore |   4 -
 .../modules/claude-self-hosted-runner/main.tf |  44 --------
 .../claude-self-hosted-runner/outputs.tf      |  42 -------
 .../claude-self-hosted-runner/variables.tf    |  17 ---
 .../claude-self-hosted-runner/versions.tf     |   7 --
 drupal-contrib/template.tf                    |   7 --
 drupal-contrib/tests/validate.tftest.hcl      |  56 ----------
 .../claude-self-hosted-runner/files/SKILL.md  | 103 ------------------
 .../files/claude-runner-loop.sh.tftpl         |  20 ----
 .../files/claude-sessions                     |  13 ---
 .../claude-self-hosted-runner/files/gitconfig |   8 --
 .../claude-self-hosted-runner/files/gitignore |   4 -
 .../modules/claude-self-hosted-runner/main.tf |  44 --------
 .../claude-self-hosted-runner/outputs.tf      |  42 -------
 .../claude-self-hosted-runner/variables.tf    |  17 ---
 .../claude-self-hosted-runner/versions.tf     |   7 --
 drupal-core/template.tf                       |   7 --
 drupal-core/tests/validate.tftest.hcl         |  65 -----------
 .../add-claude-self-hosted-runner/proposal.md |   4 +-
 .../specs/claude-self-hosted-runner/spec.md   |   2 +-
 .../add-claude-self-hosted-runner/tasks.md    |   4 +-
 28 files changed, 14 insertions(+), 665 deletions(-)
 delete mode 100644 drupal-contrib/modules/claude-self-hosted-runner/files/SKILL.md
 delete mode 100644 drupal-contrib/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
 delete mode 100644 drupal-contrib/modules/claude-self-hosted-runner/files/claude-sessions
 delete mode 100644 drupal-contrib/modules/claude-self-hosted-runner/files/gitconfig
 delete mode 100644 drupal-contrib/modules/claude-self-hosted-runner/files/gitignore
 delete mode 100644 drupal-contrib/modules/claude-self-hosted-runner/main.tf
 delete mode 100644 drupal-contrib/modules/claude-self-hosted-runner/outputs.tf
 delete mode 100644 drupal-contrib/modules/claude-self-hosted-runner/variables.tf
 delete mode 100644 drupal-contrib/modules/claude-self-hosted-runner/versions.tf
 delete mode 100644 drupal-core/modules/claude-self-hosted-runner/files/SKILL.md
 delete mode 100644 drupal-core/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
 delete mode 100644 drupal-core/modules/claude-self-hosted-runner/files/claude-sessions
 delete mode 100644 drupal-core/modules/claude-self-hosted-runner/files/gitconfig
 delete mode 100644 drupal-core/modules/claude-self-hosted-runner/files/gitignore
 delete mode 100644 drupal-core/modules/claude-self-hosted-runner/main.tf
 delete mode 100644 drupal-core/modules/claude-self-hosted-runner/outputs.tf
 delete mode 100644 drupal-core/modules/claude-self-hosted-runner/variables.tf
 delete mode 100644 drupal-core/modules/claude-self-hosted-runner/versions.tf

diff --git a/CLAUDE.md b/CLAUDE.md
index 7aa34fb..f13fdbb 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -79,7 +79,9 @@ make test-templates
 
 ## Shared Terraform Assets
 
-Some Terraform config (currently `modules/claude-remote-control`, `modules/claude-self-hosted-runner`, `modules/docker-daemon`, `shared/vscode-extensions.tf`, `shared/bashrc-symlink-guard.sh` and `shared/ssh-agent-setup.sh`) is shared across all three templates but must exist as a **physical copy inside each template directory** — `coder templates push` and CI's `terraform validate`/`test` only ever operate on a single template directory, so a relative `../modules` or `../shared` reference would not survive the push and would not be visible to CI.
+Some Terraform config (currently `modules/claude-remote-control`, `modules/docker-daemon`, `shared/vscode-extensions.tf`, `shared/bashrc-symlink-guard.sh` and `shared/ssh-agent-setup.sh`) is shared across all three templates but must exist as a **physical copy inside each template directory** — `coder templates push` and CI's `terraform validate`/`test` only ever operate on a single template directory, so a relative `../modules` or `../shared` reference would not survive the push and would not be visible to CI.
+
+`modules/claude-self-hosted-runner` follows the same rules but is vendored into `freeform` only, the one template that offers the runner.
 
 - **Edit only the canonical source**: `modules/claude-remote-control/` or `shared/vscode-extensions.tf` at the repo root. Never hand-edit the vendored copies (`<template>/modules/claude-remote-control/`, `<template>/vscode-extensions.tf`) — they get overwritten the next time anyone runs the sync.
 - **Always resync through `make`**, never by hand-copying: `make sync-shared` (or `make sync-claude-module` / `make sync-vscode-extensions` individually). `make validate`, `make test-templates`, and every `make push-template-*` / `make push-all-templates` target already depend on `sync-shared`, so day-to-day you rarely need to invoke it directly.
diff --git a/Makefile b/Makefile
index 69aa70d..5e99a98 100644
--- a/Makefile
+++ b/Makefile
@@ -116,13 +116,11 @@ sync-claude-module: ## Vendor modules/claude-remote-control into each template d
 	@echo "Synced modules/claude-remote-control into: $(TEMPLATES)"
 
 .PHONY: sync-claude-runner-module
-sync-claude-runner-module: ## Vendor modules/claude-self-hosted-runner into each template dir (same reason as sync-claude-module: push only bundles the given --directory)
-	@for t in $(TEMPLATES); do \
-		rm -rf $$t/modules/claude-self-hosted-runner; \
-		mkdir -p $$t/modules; \
-		cp -r modules/claude-self-hosted-runner $$t/modules/claude-self-hosted-runner; \
-	done
-	@echo "Synced modules/claude-self-hosted-runner into: $(TEMPLATES)"
+sync-claude-runner-module: ## Vendor modules/claude-self-hosted-runner into freeform, the only template that offers it (same reason as sync-claude-module: push only bundles the given --directory)
+	@rm -rf freeform/modules/claude-self-hosted-runner
+	@mkdir -p freeform/modules
+	@cp -r modules/claude-self-hosted-runner freeform/modules/claude-self-hosted-runner
+	@echo "Synced modules/claude-self-hosted-runner into: freeform"
 
 .PHONY: sync-vscode-extensions
 sync-vscode-extensions: ## Vendor shared/vscode-extensions.tf into each template dir (same reason as sync-claude-module: push only bundles the given --directory)
diff --git a/docs/user/using-workspaces.md b/docs/user/using-workspaces.md
index 198c4ec..39709dc 100644
--- a/docs/user/using-workspaces.md
+++ b/docs/user/using-workspaces.md
@@ -72,7 +72,7 @@ chmod +x ~/.coder-startup.sh
 
 ### Running a Claude Code Self-Hosted Runner
 
-Turn on **Run a Claude Code self-hosted runner** when creating or editing a workspace to have it run a Claude Code self-hosted runner. Sessions you start on claude.ai/code in that runner's environment then run in this workspace, with its Docker and DDEV.
+In a `freeform` workspace, turn on **Run a Claude Code self-hosted runner** when creating or editing it to have it run a Claude Code self-hosted runner. Sessions you start on claude.ai/code in that runner's environment then run in this workspace, with its Docker and DDEV.
 
 One-time setup:
 
diff --git a/drupal-contrib/modules/claude-self-hosted-runner/files/SKILL.md b/drupal-contrib/modules/claude-self-hosted-runner/files/SKILL.md
deleted file mode 100644
index e651bdb..0000000
--- a/drupal-contrib/modules/claude-self-hosted-runner/files/SKILL.md
+++ /dev/null
@@ -1,103 +0,0 @@
----
-name: coder-shared-workspace
-description: Rules for sharing this Coder workspace, its Docker daemon and its DDEV install with other Claude sessions that the self-hosted runner runs at the same time. Read before running ddev, docker, or a repository's integration tests, before cleaning up disk, and before working in a checkout another session may be using.
----
-
-# Sharing this workspace with other sessions
-
-This workspace runs a Claude Code self-hosted runner that can host several
-sessions at once. They all run as the same Unix user, with the same home
-directory, one Docker daemon and one DDEV global configuration. Nothing
-isolates them except the rules below.
-
-## See who else is here
-
-```bash
-pgrep -af -- '--sdk-url' | grep -o 'sessions/cse_[A-Za-z0-9]*' | sort -u
-pgrep -af -- '--sdk-url' | grep -o -- '--add-dir [^ ]*' | sort | uniq -c
-```
-
-The first lists active sessions; the second shows which directories they
-work in. If you are the only session, the rest of this file still applies,
-since another session can start at any time.
-
-## Repositories and checkouts
-
-- Sessions working in different repositories do not interfere with each
-  other's files.
-- Never switch the branch, reset, stash, or clean a checkout another
-  session is using. If your working directory is a checkout another session
-  also has, make your own worktree and work there:
-
-  ```bash
-  repo=~/workspace/<owner>/<repo>
-  git -C "$repo" worktree add ~/workspace/<repo>-worktrees/<your-branch> -b <your-branch> <base>
-  ```
-
-  Keep worktrees under `~/workspace/<repo>-worktrees/`. Remove yours with
-  `git worktree remove` when the session is done. Two worktrees cannot have
-  the same branch checked out.
-- Put scratch files in `~/tmp/<your session id>/`, not directly in `~/tmp`.
-
-## Docker and DDEV
-
-There is one Docker daemon. A command that affects every container affects
-every session.
-
-- **Never** run these unless the user asks for them:
-  `ddev poweroff`, `ddev stop --all`, `ddev delete images`,
-  `ddev clean`, `docker system prune`, `docker volume prune`,
-  `docker rm -f $(docker ps -aq)`, or anything that restarts dockerd.
-  Stop, restart or delete only projects you started.
-- Give your session its own DDEV global directory with
-  [`DDEV_XDG_CONFIG_HOME`](https://docs.ddev.com/en/stable/users/usage/architecture/#global-files),
-  seeded from the workspace's, so your project list and global settings
-  are yours:
-
-  ```bash
-  export DDEV_XDG_CONFIG_HOME=~/tmp/<your session id>/config
-  mkdir -p "$DDEV_XDG_CONFIG_HOME/ddev"
-  cp -r ~/.ddev/global_config.yaml ~/.ddev/commands "$DDEV_XDG_CONFIG_HOME/ddev/"
-  ```
-
-  Shell state does not carry over between your commands, so export the
-  variable in every command that runs `ddev`, including test runs. Keep the
-  router settings copied from `~/.ddev` unchanged: the router and
-  `ddev-ssh-agent` containers are shared by every session. Never edit
-  `~/.ddev/global_config.yaml` itself.
-- Project names are still global, because Docker container names are.
-  Give throwaway projects names no other session will pick, such as
-  `<purpose>-<first 8 characters of your session id>`, and delete them with
-  `ddev delete -Oy <name>` when done. The names registered in the workspace
-  (`$CODER_PROJECT_NAMES`) are the only ones reachable from a browser. Each
-  session's `ddev list` shows only its own projects, so list every running
-  one with `docker ps --format '{{.Label "com.ddev.site-name"}}' | grep . | sort -u`,
-  and ask before taking a name another session is using.
-- Do not set fixed host ports (`host_https_port`, `host_webserver_port`,
-  `host_db_port`) in a project. Let DDEV choose, so two projects never
-  collide. Pick free ports for any other server you run.
-- A project you started may be stopped by another session's tests (see
-  below). If it is, `ddev start` it again.
-
-## Tests that take over Docker
-
-Some test suites start and power off DDEV projects on their own, for
-example the integration tests of `ddev/ddev` (`make testpkg`, `make testcmd`,
-`go test ./pkg/ddevapp/...`), which run `ddev poweroff`. Run those only
-while holding the workspace-wide Docker lock, so two of them never run at
-the same time:
-
-```bash
-flock --exclusive ~/.cache/coder-docker.lock make testpkg TESTARGS="-run TestName"
-```
-
-`flock` waits until the lock is free. Tell the user when you have been
-waiting more than a few minutes, rather than waiting silently. Code that
-only compiles or runs unit tests that do not touch Docker needs no lock.
-
-## Disk
-
-The disk is shared. When it fills up, stop what you started and delete
-only what you created (build output, your worktrees, your `~/tmp`
-directory, your test projects). Never delete another session's files, and
-never prune Docker images or volumes another session may use.
diff --git a/drupal-contrib/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl b/drupal-contrib/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
deleted file mode 100644
index 50f0e7a..0000000
--- a/drupal-contrib/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/usr/bin/env bash
-# Keep the Claude Code self-hosted runner running; it exits on its own when
-# --release-idle-session-min leaves it with no sessions.
-export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:/home/linuxbrew/.linuxbrew/bin:$PATH"
-while true; do
-  /home/linuxbrew/.linuxbrew/bin/claude self-hosted-runner \
-    --environment-secret-file "${secret_file}" \
-    --base-dir "${base_dir}" \
-    --capacity ${capacity} \
-    --client-label "$CODER_WORKSPACE_NAME" \
-    --use-anthropic-git-proxy \
-    --push-outcome-on-release \
-    --release-idle-session-min 30 \
-    --kill-session-after-min 480 \
-    --health-port 0 \
-    --log-file /tmp/claude-runner.log
-  rc=$?
-  echo "$(date): runner exited ($rc); restarting in 5s"
-  sleep 5
-done
diff --git a/drupal-contrib/modules/claude-self-hosted-runner/files/claude-sessions b/drupal-contrib/modules/claude-self-hosted-runner/files/claude-sessions
deleted file mode 100644
index 43b43c4..0000000
--- a/drupal-contrib/modules/claude-self-hosted-runner/files/claude-sessions
+++ /dev/null
@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-# List the runner's live sessions: id, checkout, branch, and commits on no remote
-# branch, so a person can find a session's work without asking it.
-set -u
-pgrep -af -- '--sdk-url' | while read -r _ cmd; do
-  id=$(grep -o 'sessions/cse_[A-Za-z0-9]*' <<<"$cmd" | head -1 | cut -d/ -f2)
-  for dir in $(grep -o -- '--add-dir [^ ]*' <<<"$cmd" | cut -d' ' -f2 | grep -v '/_sessions/'); do
-    git -C "$dir" rev-parse --git-dir >/dev/null 2>&1 || continue
-    branch=$(git -C "$dir" branch --show-current)
-    ahead=$(git -C "$dir" rev-list --count HEAD --not --remotes)
-    printf '%s  %s  %s  unpushed: %s\n' "$id" "$dir" "$branch" "$ahead"
-  done
-done | sort -u
diff --git a/drupal-contrib/modules/claude-self-hosted-runner/files/gitconfig b/drupal-contrib/modules/claude-self-hosted-runner/files/gitconfig
deleted file mode 100644
index a24da96..0000000
--- a/drupal-contrib/modules/claude-self-hosted-runner/files/gitconfig
+++ /dev/null
@@ -1,8 +0,0 @@
-# Installed by the claude-self-hosted-runner module. The runner deletes
-# ~/.gitconfig and ~/.config/git before every session, so session git
-# settings live here instead.
-[user]
-	name = Claude
-	email = noreply@anthropic.com
-[core]
-	excludesFile = /etc/gitignore-claude-runner
diff --git a/drupal-contrib/modules/claude-self-hosted-runner/files/gitignore b/drupal-contrib/modules/claude-self-hosted-runner/files/gitignore
deleted file mode 100644
index 04fb92b..0000000
--- a/drupal-contrib/modules/claude-self-hosted-runner/files/gitignore
+++ /dev/null
@@ -1,4 +0,0 @@
-# Installed by the claude-self-hosted-runner module.
-config.coder.yaml
-docker-compose.coder-describe.yaml
-.claude/settings.local.json
diff --git a/drupal-contrib/modules/claude-self-hosted-runner/main.tf b/drupal-contrib/modules/claude-self-hosted-runner/main.tf
deleted file mode 100644
index a580c8b..0000000
--- a/drupal-contrib/modules/claude-self-hosted-runner/main.tf
+++ /dev/null
@@ -1,44 +0,0 @@
-data "coder_parameter" "enable_claude_runner" {
-  name         = "enable_claude_runner"
-  display_name = "Run a Claude Code self-hosted runner"
-  description  = <<-EOT
-    Start a Claude Code self-hosted runner on every workspace start, so sessions you start on claude.ai/code in that environment run in this workspace.
-
-    **One-time setup:** create a self-hosted environment on claude.ai, then save its environment secret in the workspace as `~/.claude-runner/environment-secret` (mode 600). Until that file exists, the runner doesn't start and the startup log says why.
-
-    **Use a workspace dedicated to the runner.** The runner deletes and rewrites `~/.gitconfig` and `~/.config/git` before every session. It can't be enabled together with Claude Code remote control.
-  EOT
-
-  type      = "bool"
-  form_type = "switch"
-  default   = "false"
-  mutable   = true
-  order     = var.parameter_order
-}
-
-data "coder_parameter" "claude_runner_capacity" {
-  name         = "claude_runner_capacity"
-  display_name = "Claude Code runner: concurrent sessions"
-  description  = "How many sessions the runner hosts at once. They share this workspace's Docker daemon and DDEV; the runner installs a skill telling them how to avoid conflicts. Only takes effect when the runner is enabled."
-  type         = "number"
-  default      = "1"
-  mutable      = true
-  order        = var.parameter_order + 1
-  validation {
-    min = 1
-    max = 4
-  }
-}
-
-locals {
-  # Compared as strings, not tobool(): see modules/claude-remote-control.
-  enabled     = data.coder_parameter.enable_claude_runner.value == "true"
-  capacity    = try(tonumber(data.coder_parameter.claude_runner_capacity.value), 1)
-  secret_file = "/home/coder/.claude-runner/environment-secret"
-
-  loop_script = templatefile("${path.module}/files/claude-runner-loop.sh.tftpl", {
-    secret_file = local.secret_file
-    base_dir    = var.base_dir
-    capacity    = local.capacity
-  })
-}
diff --git a/drupal-contrib/modules/claude-self-hosted-runner/outputs.tf b/drupal-contrib/modules/claude-self-hosted-runner/outputs.tf
deleted file mode 100644
index d347c79..0000000
--- a/drupal-contrib/modules/claude-self-hosted-runner/outputs.tf
+++ /dev/null
@@ -1,42 +0,0 @@
-output "enabled" {
-  description = "Whether the Claude Code self-hosted runner is enabled"
-  value       = local.enabled
-}
-
-output "startup_script" {
-  description = "Bash snippet for the caller to append to its coder_agent startup_script, after the claude-remote-control snippet and before the ~/.coder-startup.sh user hook."
-  value       = <<-EOT
-
-    # Claude Code self-hosted runner, in tmux session "claude-runner".
-    CLAUDE_RUNNER_ENABLED="${local.enabled}"
-    CLAUDE_REMOTE_CONTROL_ENABLED="${var.remote_control_enabled}"
-    if [ "$CLAUDE_RUNNER_ENABLED" = "true" ]; then
-      if [ "$CLAUDE_REMOTE_CONTROL_ENABLED" = "true" ]; then
-        CLAUDE_RUNNER_MSG="✗ Claude Code self-hosted runner NOT started: Claude Code remote control is also enabled, and the runner rewrites ~/.gitconfig before every session. Turn one of them off."
-      elif [ ! -s "${local.secret_file}" ]; then
-        CLAUDE_RUNNER_MSG="✗ Claude Code self-hosted runner NOT started: save your environment secret as ${local.secret_file} (chmod 600), then restart the workspace."
-      else
-        # /etc is not persistent, so reinstall the session git config on every start.
-        echo '${base64encode(file("${path.module}/files/gitconfig"))}' | base64 -d | sudo tee /etc/gitconfig >/dev/null
-        echo '${base64encode(file("${path.module}/files/gitignore"))}' | base64 -d | sudo tee /etc/gitignore-claude-runner >/dev/null
-        # The runner copies ~/.claude into each session when it starts.
-        mkdir -p ~/.claude/skills/coder-shared-workspace ~/.cache "${var.base_dir}"
-        echo '${base64encode(file("${path.module}/files/SKILL.md"))}' | base64 -d > ~/.claude/skills/coder-shared-workspace/SKILL.md
-        mkdir -p ~/.local/bin
-        echo '${base64encode(local.loop_script)}' | base64 -d > ~/.local/bin/claude-runner-loop
-        chmod +x ~/.local/bin/claude-runner-loop
-        echo '${base64encode(file("${path.module}/files/claude-sessions"))}' | base64 -d > ~/.local/bin/claude-sessions
-        chmod +x ~/.local/bin/claude-sessions
-        mkcert -install >/dev/null 2>&1 || true
-        if pgrep -f 'claude self-hosted-runner' >/dev/null || tmux has-session -t claude-runner 2>/dev/null; then
-          CLAUDE_RUNNER_MSG="✓ Claude Code self-hosted runner already running (tmux attach -t claude-runner)"
-        else
-          tmux new-session -d -s claude-runner ~/.local/bin/claude-runner-loop
-          CLAUDE_RUNNER_MSG="✓ Claude Code self-hosted runner started, capacity ${local.capacity} (tmux attach -t claude-runner; log /tmp/claude-runner.log)"
-        fi
-      fi
-      echo "$CLAUDE_RUNNER_MSG"
-      echo "$CLAUDE_RUNNER_MSG" >> ~/WELCOME.txt
-    fi
-  EOT
-}
diff --git a/drupal-contrib/modules/claude-self-hosted-runner/variables.tf b/drupal-contrib/modules/claude-self-hosted-runner/variables.tf
deleted file mode 100644
index 49efc79..0000000
--- a/drupal-contrib/modules/claude-self-hosted-runner/variables.tf
+++ /dev/null
@@ -1,17 +0,0 @@
-variable "parameter_order" {
-  description = "Base UI order for the two coder_parameters this module declares (uses this value and this value + 1)"
-  type        = number
-  default     = 14
-}
-
-variable "base_dir" {
-  description = "Directory the runner clones session repositories into"
-  type        = string
-  default     = "/home/coder/workspace"
-}
-
-variable "remote_control_enabled" {
-  description = "Whether Claude Code remote control is enabled in the same workspace; the runner refuses to start alongside it"
-  type        = bool
-  default     = false
-}
diff --git a/drupal-contrib/modules/claude-self-hosted-runner/versions.tf b/drupal-contrib/modules/claude-self-hosted-runner/versions.tf
deleted file mode 100644
index 394c7cb..0000000
--- a/drupal-contrib/modules/claude-self-hosted-runner/versions.tf
+++ /dev/null
@@ -1,7 +0,0 @@
-terraform {
-  required_providers {
-    coder = {
-      source = "coder/coder"
-    }
-  }
-}
diff --git a/drupal-contrib/template.tf b/drupal-contrib/template.tf
index 616a3d7..0b7948e 100644
--- a/drupal-contrib/template.tf
+++ b/drupal-contrib/template.tf
@@ -1064,8 +1064,6 @@ BASHPROFILE_WELCOME
 
     ${module.claude_remote_control.startup_script}
 
-    ${module.claude_self_hosted_runner.startup_script}
-
     # User startup hook: run ~/.coder-startup.sh (persistent home) on every
     # workspace start, e.g. to start services or long-running processes without
     # waiting for someone to open a terminal. It is detached from the agent so a
@@ -1181,11 +1179,6 @@ module "claude_remote_control" {
   agent_id = coder_agent.main.id
 }
 
-module "claude_self_hosted_runner" {
-  source                 = "./modules/claude-self-hosted-runner"
-  remote_control_enabled = module.claude_remote_control.enabled
-}
-
 # Drupal Site (HTTP) - appears when DDEV project is running.
 # Uses subdomain routing for unique URLs per workspace. Sharing is controlled
 # by data.coder_parameter.drupal_site_public (Public Sharing switch above).
diff --git a/drupal-contrib/tests/validate.tftest.hcl b/drupal-contrib/tests/validate.tftest.hcl
index 9913943..5aae18a 100644
--- a/drupal-contrib/tests/validate.tftest.hcl
+++ b/drupal-contrib/tests/validate.tftest.hcl
@@ -186,59 +186,3 @@ run "ssh_agent_relay" {
     error_message = "startup script must point DDEV's ssh_agent_upstream at the relay socket"
   }
 }
-
-run "claude_runner_disabled_by_default" {
-  command = plan
-  assert {
-    condition     = strcontains(coder_agent.main.startup_script, "CLAUDE_RUNNER_ENABLED=\"false\"")
-    error_message = "the Claude Code self-hosted runner must be off unless enable_claude_runner=true"
-  }
-}
-
-run "claude_runner_enabled" {
-  command = plan
-  override_data {
-    target = module.claude_self_hosted_runner.data.coder_parameter.enable_claude_runner
-    values = {
-      value = "true"
-    }
-  }
-  override_data {
-    target = module.claude_self_hosted_runner.data.coder_parameter.claude_runner_capacity
-    values = {
-      value = "3"
-    }
-  }
-  assert {
-    condition     = strcontains(coder_agent.main.startup_script, "CLAUDE_RUNNER_ENABLED=\"true\"")
-    error_message = "startup script must start the runner when enable_claude_runner=true"
-  }
-  assert {
-    condition     = strcontains(coder_agent.main.startup_script, "CLAUDE_REMOTE_CONTROL_ENABLED=\"false\"")
-    error_message = "the runner must see remote control as off when enable_claude_code=false"
-  }
-  assert {
-    condition     = strcontains(base64decode(regex("echo '([A-Za-z0-9+/=]+)' \\| base64 -d > ~/.local/bin/claude-runner-loop", coder_agent.main.startup_script)[0]), "--capacity 3")
-    error_message = "runner loop script must pass the claude_runner_capacity value as --capacity"
-  }
-}
-
-run "claude_runner_refuses_alongside_remote_control" {
-  command = plan
-  override_data {
-    target = module.claude_self_hosted_runner.data.coder_parameter.enable_claude_runner
-    values = {
-      value = "true"
-    }
-  }
-  override_data {
-    target = module.claude_remote_control.data.coder_parameter.enable_claude_code
-    values = {
-      value = "true"
-    }
-  }
-  assert {
-    condition     = strcontains(coder_agent.main.startup_script, "CLAUDE_REMOTE_CONTROL_ENABLED=\"true\"")
-    error_message = "the runner snippet must know remote control is on, so it refuses to start"
-  }
-}
diff --git a/drupal-core/modules/claude-self-hosted-runner/files/SKILL.md b/drupal-core/modules/claude-self-hosted-runner/files/SKILL.md
deleted file mode 100644
index e651bdb..0000000
--- a/drupal-core/modules/claude-self-hosted-runner/files/SKILL.md
+++ /dev/null
@@ -1,103 +0,0 @@
----
-name: coder-shared-workspace
-description: Rules for sharing this Coder workspace, its Docker daemon and its DDEV install with other Claude sessions that the self-hosted runner runs at the same time. Read before running ddev, docker, or a repository's integration tests, before cleaning up disk, and before working in a checkout another session may be using.
----
-
-# Sharing this workspace with other sessions
-
-This workspace runs a Claude Code self-hosted runner that can host several
-sessions at once. They all run as the same Unix user, with the same home
-directory, one Docker daemon and one DDEV global configuration. Nothing
-isolates them except the rules below.
-
-## See who else is here
-
-```bash
-pgrep -af -- '--sdk-url' | grep -o 'sessions/cse_[A-Za-z0-9]*' | sort -u
-pgrep -af -- '--sdk-url' | grep -o -- '--add-dir [^ ]*' | sort | uniq -c
-```
-
-The first lists active sessions; the second shows which directories they
-work in. If you are the only session, the rest of this file still applies,
-since another session can start at any time.
-
-## Repositories and checkouts
-
-- Sessions working in different repositories do not interfere with each
-  other's files.
-- Never switch the branch, reset, stash, or clean a checkout another
-  session is using. If your working directory is a checkout another session
-  also has, make your own worktree and work there:
-
-  ```bash
-  repo=~/workspace/<owner>/<repo>
-  git -C "$repo" worktree add ~/workspace/<repo>-worktrees/<your-branch> -b <your-branch> <base>
-  ```
-
-  Keep worktrees under `~/workspace/<repo>-worktrees/`. Remove yours with
-  `git worktree remove` when the session is done. Two worktrees cannot have
-  the same branch checked out.
-- Put scratch files in `~/tmp/<your session id>/`, not directly in `~/tmp`.
-
-## Docker and DDEV
-
-There is one Docker daemon. A command that affects every container affects
-every session.
-
-- **Never** run these unless the user asks for them:
-  `ddev poweroff`, `ddev stop --all`, `ddev delete images`,
-  `ddev clean`, `docker system prune`, `docker volume prune`,
-  `docker rm -f $(docker ps -aq)`, or anything that restarts dockerd.
-  Stop, restart or delete only projects you started.
-- Give your session its own DDEV global directory with
-  [`DDEV_XDG_CONFIG_HOME`](https://docs.ddev.com/en/stable/users/usage/architecture/#global-files),
-  seeded from the workspace's, so your project list and global settings
-  are yours:
-
-  ```bash
-  export DDEV_XDG_CONFIG_HOME=~/tmp/<your session id>/config
-  mkdir -p "$DDEV_XDG_CONFIG_HOME/ddev"
-  cp -r ~/.ddev/global_config.yaml ~/.ddev/commands "$DDEV_XDG_CONFIG_HOME/ddev/"
-  ```
-
-  Shell state does not carry over between your commands, so export the
-  variable in every command that runs `ddev`, including test runs. Keep the
-  router settings copied from `~/.ddev` unchanged: the router and
-  `ddev-ssh-agent` containers are shared by every session. Never edit
-  `~/.ddev/global_config.yaml` itself.
-- Project names are still global, because Docker container names are.
-  Give throwaway projects names no other session will pick, such as
-  `<purpose>-<first 8 characters of your session id>`, and delete them with
-  `ddev delete -Oy <name>` when done. The names registered in the workspace
-  (`$CODER_PROJECT_NAMES`) are the only ones reachable from a browser. Each
-  session's `ddev list` shows only its own projects, so list every running
-  one with `docker ps --format '{{.Label "com.ddev.site-name"}}' | grep . | sort -u`,
-  and ask before taking a name another session is using.
-- Do not set fixed host ports (`host_https_port`, `host_webserver_port`,
-  `host_db_port`) in a project. Let DDEV choose, so two projects never
-  collide. Pick free ports for any other server you run.
-- A project you started may be stopped by another session's tests (see
-  below). If it is, `ddev start` it again.
-
-## Tests that take over Docker
-
-Some test suites start and power off DDEV projects on their own, for
-example the integration tests of `ddev/ddev` (`make testpkg`, `make testcmd`,
-`go test ./pkg/ddevapp/...`), which run `ddev poweroff`. Run those only
-while holding the workspace-wide Docker lock, so two of them never run at
-the same time:
-
-```bash
-flock --exclusive ~/.cache/coder-docker.lock make testpkg TESTARGS="-run TestName"
-```
-
-`flock` waits until the lock is free. Tell the user when you have been
-waiting more than a few minutes, rather than waiting silently. Code that
-only compiles or runs unit tests that do not touch Docker needs no lock.
-
-## Disk
-
-The disk is shared. When it fills up, stop what you started and delete
-only what you created (build output, your worktrees, your `~/tmp`
-directory, your test projects). Never delete another session's files, and
-never prune Docker images or volumes another session may use.
diff --git a/drupal-core/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl b/drupal-core/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
deleted file mode 100644
index 50f0e7a..0000000
--- a/drupal-core/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/usr/bin/env bash
-# Keep the Claude Code self-hosted runner running; it exits on its own when
-# --release-idle-session-min leaves it with no sessions.
-export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:/home/linuxbrew/.linuxbrew/bin:$PATH"
-while true; do
-  /home/linuxbrew/.linuxbrew/bin/claude self-hosted-runner \
-    --environment-secret-file "${secret_file}" \
-    --base-dir "${base_dir}" \
-    --capacity ${capacity} \
-    --client-label "$CODER_WORKSPACE_NAME" \
-    --use-anthropic-git-proxy \
-    --push-outcome-on-release \
-    --release-idle-session-min 30 \
-    --kill-session-after-min 480 \
-    --health-port 0 \
-    --log-file /tmp/claude-runner.log
-  rc=$?
-  echo "$(date): runner exited ($rc); restarting in 5s"
-  sleep 5
-done
diff --git a/drupal-core/modules/claude-self-hosted-runner/files/claude-sessions b/drupal-core/modules/claude-self-hosted-runner/files/claude-sessions
deleted file mode 100644
index 43b43c4..0000000
--- a/drupal-core/modules/claude-self-hosted-runner/files/claude-sessions
+++ /dev/null
@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-# List the runner's live sessions: id, checkout, branch, and commits on no remote
-# branch, so a person can find a session's work without asking it.
-set -u
-pgrep -af -- '--sdk-url' | while read -r _ cmd; do
-  id=$(grep -o 'sessions/cse_[A-Za-z0-9]*' <<<"$cmd" | head -1 | cut -d/ -f2)
-  for dir in $(grep -o -- '--add-dir [^ ]*' <<<"$cmd" | cut -d' ' -f2 | grep -v '/_sessions/'); do
-    git -C "$dir" rev-parse --git-dir >/dev/null 2>&1 || continue
-    branch=$(git -C "$dir" branch --show-current)
-    ahead=$(git -C "$dir" rev-list --count HEAD --not --remotes)
-    printf '%s  %s  %s  unpushed: %s\n' "$id" "$dir" "$branch" "$ahead"
-  done
-done | sort -u
diff --git a/drupal-core/modules/claude-self-hosted-runner/files/gitconfig b/drupal-core/modules/claude-self-hosted-runner/files/gitconfig
deleted file mode 100644
index a24da96..0000000
--- a/drupal-core/modules/claude-self-hosted-runner/files/gitconfig
+++ /dev/null
@@ -1,8 +0,0 @@
-# Installed by the claude-self-hosted-runner module. The runner deletes
-# ~/.gitconfig and ~/.config/git before every session, so session git
-# settings live here instead.
-[user]
-	name = Claude
-	email = noreply@anthropic.com
-[core]
-	excludesFile = /etc/gitignore-claude-runner
diff --git a/drupal-core/modules/claude-self-hosted-runner/files/gitignore b/drupal-core/modules/claude-self-hosted-runner/files/gitignore
deleted file mode 100644
index 04fb92b..0000000
--- a/drupal-core/modules/claude-self-hosted-runner/files/gitignore
+++ /dev/null
@@ -1,4 +0,0 @@
-# Installed by the claude-self-hosted-runner module.
-config.coder.yaml
-docker-compose.coder-describe.yaml
-.claude/settings.local.json
diff --git a/drupal-core/modules/claude-self-hosted-runner/main.tf b/drupal-core/modules/claude-self-hosted-runner/main.tf
deleted file mode 100644
index a580c8b..0000000
--- a/drupal-core/modules/claude-self-hosted-runner/main.tf
+++ /dev/null
@@ -1,44 +0,0 @@
-data "coder_parameter" "enable_claude_runner" {
-  name         = "enable_claude_runner"
-  display_name = "Run a Claude Code self-hosted runner"
-  description  = <<-EOT
-    Start a Claude Code self-hosted runner on every workspace start, so sessions you start on claude.ai/code in that environment run in this workspace.
-
-    **One-time setup:** create a self-hosted environment on claude.ai, then save its environment secret in the workspace as `~/.claude-runner/environment-secret` (mode 600). Until that file exists, the runner doesn't start and the startup log says why.
-
-    **Use a workspace dedicated to the runner.** The runner deletes and rewrites `~/.gitconfig` and `~/.config/git` before every session. It can't be enabled together with Claude Code remote control.
-  EOT
-
-  type      = "bool"
-  form_type = "switch"
-  default   = "false"
-  mutable   = true
-  order     = var.parameter_order
-}
-
-data "coder_parameter" "claude_runner_capacity" {
-  name         = "claude_runner_capacity"
-  display_name = "Claude Code runner: concurrent sessions"
-  description  = "How many sessions the runner hosts at once. They share this workspace's Docker daemon and DDEV; the runner installs a skill telling them how to avoid conflicts. Only takes effect when the runner is enabled."
-  type         = "number"
-  default      = "1"
-  mutable      = true
-  order        = var.parameter_order + 1
-  validation {
-    min = 1
-    max = 4
-  }
-}
-
-locals {
-  # Compared as strings, not tobool(): see modules/claude-remote-control.
-  enabled     = data.coder_parameter.enable_claude_runner.value == "true"
-  capacity    = try(tonumber(data.coder_parameter.claude_runner_capacity.value), 1)
-  secret_file = "/home/coder/.claude-runner/environment-secret"
-
-  loop_script = templatefile("${path.module}/files/claude-runner-loop.sh.tftpl", {
-    secret_file = local.secret_file
-    base_dir    = var.base_dir
-    capacity    = local.capacity
-  })
-}
diff --git a/drupal-core/modules/claude-self-hosted-runner/outputs.tf b/drupal-core/modules/claude-self-hosted-runner/outputs.tf
deleted file mode 100644
index d347c79..0000000
--- a/drupal-core/modules/claude-self-hosted-runner/outputs.tf
+++ /dev/null
@@ -1,42 +0,0 @@
-output "enabled" {
-  description = "Whether the Claude Code self-hosted runner is enabled"
-  value       = local.enabled
-}
-
-output "startup_script" {
-  description = "Bash snippet for the caller to append to its coder_agent startup_script, after the claude-remote-control snippet and before the ~/.coder-startup.sh user hook."
-  value       = <<-EOT
-
-    # Claude Code self-hosted runner, in tmux session "claude-runner".
-    CLAUDE_RUNNER_ENABLED="${local.enabled}"
-    CLAUDE_REMOTE_CONTROL_ENABLED="${var.remote_control_enabled}"
-    if [ "$CLAUDE_RUNNER_ENABLED" = "true" ]; then
-      if [ "$CLAUDE_REMOTE_CONTROL_ENABLED" = "true" ]; then
-        CLAUDE_RUNNER_MSG="✗ Claude Code self-hosted runner NOT started: Claude Code remote control is also enabled, and the runner rewrites ~/.gitconfig before every session. Turn one of them off."
-      elif [ ! -s "${local.secret_file}" ]; then
-        CLAUDE_RUNNER_MSG="✗ Claude Code self-hosted runner NOT started: save your environment secret as ${local.secret_file} (chmod 600), then restart the workspace."
-      else
-        # /etc is not persistent, so reinstall the session git config on every start.
-        echo '${base64encode(file("${path.module}/files/gitconfig"))}' | base64 -d | sudo tee /etc/gitconfig >/dev/null
-        echo '${base64encode(file("${path.module}/files/gitignore"))}' | base64 -d | sudo tee /etc/gitignore-claude-runner >/dev/null
-        # The runner copies ~/.claude into each session when it starts.
-        mkdir -p ~/.claude/skills/coder-shared-workspace ~/.cache "${var.base_dir}"
-        echo '${base64encode(file("${path.module}/files/SKILL.md"))}' | base64 -d > ~/.claude/skills/coder-shared-workspace/SKILL.md
-        mkdir -p ~/.local/bin
-        echo '${base64encode(local.loop_script)}' | base64 -d > ~/.local/bin/claude-runner-loop
-        chmod +x ~/.local/bin/claude-runner-loop
-        echo '${base64encode(file("${path.module}/files/claude-sessions"))}' | base64 -d > ~/.local/bin/claude-sessions
-        chmod +x ~/.local/bin/claude-sessions
-        mkcert -install >/dev/null 2>&1 || true
-        if pgrep -f 'claude self-hosted-runner' >/dev/null || tmux has-session -t claude-runner 2>/dev/null; then
-          CLAUDE_RUNNER_MSG="✓ Claude Code self-hosted runner already running (tmux attach -t claude-runner)"
-        else
-          tmux new-session -d -s claude-runner ~/.local/bin/claude-runner-loop
-          CLAUDE_RUNNER_MSG="✓ Claude Code self-hosted runner started, capacity ${local.capacity} (tmux attach -t claude-runner; log /tmp/claude-runner.log)"
-        fi
-      fi
-      echo "$CLAUDE_RUNNER_MSG"
-      echo "$CLAUDE_RUNNER_MSG" >> ~/WELCOME.txt
-    fi
-  EOT
-}
diff --git a/drupal-core/modules/claude-self-hosted-runner/variables.tf b/drupal-core/modules/claude-self-hosted-runner/variables.tf
deleted file mode 100644
index 49efc79..0000000
--- a/drupal-core/modules/claude-self-hosted-runner/variables.tf
+++ /dev/null
@@ -1,17 +0,0 @@
-variable "parameter_order" {
-  description = "Base UI order for the two coder_parameters this module declares (uses this value and this value + 1)"
-  type        = number
-  default     = 14
-}
-
-variable "base_dir" {
-  description = "Directory the runner clones session repositories into"
-  type        = string
-  default     = "/home/coder/workspace"
-}
-
-variable "remote_control_enabled" {
-  description = "Whether Claude Code remote control is enabled in the same workspace; the runner refuses to start alongside it"
-  type        = bool
-  default     = false
-}
diff --git a/drupal-core/modules/claude-self-hosted-runner/versions.tf b/drupal-core/modules/claude-self-hosted-runner/versions.tf
deleted file mode 100644
index 394c7cb..0000000
--- a/drupal-core/modules/claude-self-hosted-runner/versions.tf
+++ /dev/null
@@ -1,7 +0,0 @@
-terraform {
-  required_providers {
-    coder = {
-      source = "coder/coder"
-    }
-  }
-}
diff --git a/drupal-core/template.tf b/drupal-core/template.tf
index 72079df..1a9ae78 100644
--- a/drupal-core/template.tf
+++ b/drupal-core/template.tf
@@ -1297,8 +1297,6 @@ BASHCOMP
 
     ${module.claude_remote_control.startup_script}
 
-    ${module.claude_self_hosted_runner.startup_script}
-
     # User startup hook: run ~/.coder-startup.sh (persistent home) on every
     # workspace start, e.g. to start services or long-running processes without
     # waiting for someone to open a terminal. It is detached from the agent so a
@@ -1412,11 +1410,6 @@ module "claude_remote_control" {
   agent_id = coder_agent.main.id
 }
 
-module "claude_self_hosted_runner" {
-  source                 = "./modules/claude-self-hosted-runner"
-  remote_control_enabled = module.claude_remote_control.enabled
-}
-
 # Drupal Site (HTTP) - appears when DDEV project is running.
 # Uses subdomain routing for unique URLs per workspace. Sharing is controlled
 # by data.coder_parameter.drupal_site_public (Public Sharing switch above).
diff --git a/drupal-core/tests/validate.tftest.hcl b/drupal-core/tests/validate.tftest.hcl
index 79d2d99..111c43e 100644
--- a/drupal-core/tests/validate.tftest.hcl
+++ b/drupal-core/tests/validate.tftest.hcl
@@ -214,68 +214,3 @@ run "ssh_agent_relay" {
     error_message = "startup script must point DDEV's ssh_agent_upstream at the relay socket"
   }
 }
-
-run "claude_runner_disabled_by_default" {
-  command = plan
-  variables {
-    cache_path = "/tmp/mock-cache"
-  }
-  assert {
-    condition     = strcontains(coder_agent.main.startup_script, "CLAUDE_RUNNER_ENABLED=\"false\"")
-    error_message = "the Claude Code self-hosted runner must be off unless enable_claude_runner=true"
-  }
-}
-
-run "claude_runner_enabled" {
-  command = plan
-  variables {
-    cache_path = "/tmp/mock-cache"
-  }
-  override_data {
-    target = module.claude_self_hosted_runner.data.coder_parameter.enable_claude_runner
-    values = {
-      value = "true"
-    }
-  }
-  override_data {
-    target = module.claude_self_hosted_runner.data.coder_parameter.claude_runner_capacity
-    values = {
-      value = "3"
-    }
-  }
-  assert {
-    condition     = strcontains(coder_agent.main.startup_script, "CLAUDE_RUNNER_ENABLED=\"true\"")
-    error_message = "startup script must start the runner when enable_claude_runner=true"
-  }
-  assert {
-    condition     = strcontains(coder_agent.main.startup_script, "CLAUDE_REMOTE_CONTROL_ENABLED=\"false\"")
-    error_message = "the runner must see remote control as off when enable_claude_code=false"
-  }
-  assert {
-    condition     = strcontains(base64decode(regex("echo '([A-Za-z0-9+/=]+)' \\| base64 -d > ~/.local/bin/claude-runner-loop", coder_agent.main.startup_script)[0]), "--capacity 3")
-    error_message = "runner loop script must pass the claude_runner_capacity value as --capacity"
-  }
-}
-
-run "claude_runner_refuses_alongside_remote_control" {
-  command = plan
-  variables {
-    cache_path = "/tmp/mock-cache"
-  }
-  override_data {
-    target = module.claude_self_hosted_runner.data.coder_parameter.enable_claude_runner
-    values = {
-      value = "true"
-    }
-  }
-  override_data {
-    target = module.claude_remote_control.data.coder_parameter.enable_claude_code
-    values = {
-      value = "true"
-    }
-  }
-  assert {
-    condition     = strcontains(coder_agent.main.startup_script, "CLAUDE_REMOTE_CONTROL_ENABLED=\"true\"")
-    error_message = "the runner snippet must know remote control is on, so it refuses to start"
-  }
-}
diff --git a/openspec/changes/add-claude-self-hosted-runner/proposal.md b/openspec/changes/add-claude-self-hosted-runner/proposal.md
index d675d76..e9512be 100644
--- a/openspec/changes/add-claude-self-hosted-runner/proposal.md
+++ b/openspec/changes/add-claude-self-hosted-runner/proposal.md
@@ -4,7 +4,7 @@
 A Coder workspace can serve as a Claude Code self-hosted runner, so sessions started on claude.ai/code run with the workspace's Docker and DDEV. Today that takes a hand-written `~/.coder-startup.sh`, a restart loop in tmux and a hand-maintained `/etc/gitconfig`, and it is easy to get wrong: a startup marker kept in `/tmp` survived a workspace stop/start and silently kept the runner from starting. Several sessions on one runner also share one Docker daemon and one DDEV install, and nothing tells them how to avoid breaking each other's work.
 
 ## What Changes
-- New shared module `modules/claude-self-hosted-runner`, vendored into `drupal-core`, `drupal-contrib` and `freeform` like the other shared modules (`make sync-claude-runner-module`, part of `make sync-shared`).
+- New module `modules/claude-self-hosted-runner`, vendored into `freeform` only (`make sync-claude-runner-module`, part of `make sync-shared`). The Drupal templates set up one project for a person to work on, which is not what a runner workspace needs.
 - Two parameters: "Run a Claude Code self-hosted runner" (switch, default off) and "Claude Code runner: concurrent sessions" (1–4, default 1).
 - When on, and `~/.claude-runner/environment-secret` exists, the startup script starts `claude self-hosted-runner` in a restart loop in tmux session `claude-runner`, with `--use-anthropic-git-proxy` and `--push-outcome-on-release`. The secret never goes through Terraform.
 - Because the runner rewrites `~/.gitconfig` and `~/.config/git` before every session, the session git identity and ignore list are installed in `/etc/gitconfig` on every start.
@@ -15,4 +15,4 @@ A Coder workspace can serve as a Claude Code self-hosted runner, so sessions sta
 
 ## Impact
 - Affected specs: `claude-self-hosted-runner` (new capability)
-- Affected code: `modules/claude-self-hosted-runner/` and its vendored copies, `drupal-core/template.tf`, `drupal-contrib/template.tf`, `freeform/template.tf`, their `tests/validate.tftest.hcl`, `Makefile`, `CLAUDE.md`, `docs/user/using-workspaces.md`
+- Affected code: `modules/claude-self-hosted-runner/` and its vendored copy in `freeform/`, `freeform/template.tf`, `freeform/tests/validate.tftest.hcl`, `Makefile`, `CLAUDE.md`, `docs/user/using-workspaces.md`
diff --git a/openspec/changes/add-claude-self-hosted-runner/specs/claude-self-hosted-runner/spec.md b/openspec/changes/add-claude-self-hosted-runner/specs/claude-self-hosted-runner/spec.md
index 04d158d..1a595d1 100644
--- a/openspec/changes/add-claude-self-hosted-runner/specs/claude-self-hosted-runner/spec.md
+++ b/openspec/changes/add-claude-self-hosted-runner/specs/claude-self-hosted-runner/spec.md
@@ -1,7 +1,7 @@
 ## ADDED Requirements
 
 ### Requirement: Optional Claude Code Self-Hosted Runner
-The workspace startup script SHALL start a Claude Code self-hosted runner on every workspace start when the user enables it and has saved an environment secret, and SHALL do nothing otherwise.
+The `freeform` workspace startup script SHALL start a Claude Code self-hosted runner on every workspace start when the user enables it and has saved an environment secret, and SHALL do nothing otherwise.
 
 #### Scenario: Enabled with a secret
 - **WHEN** a workspace starts with "Run a Claude Code self-hosted runner" on and `~/.claude-runner/environment-secret` is non-empty
diff --git a/openspec/changes/add-claude-self-hosted-runner/tasks.md b/openspec/changes/add-claude-self-hosted-runner/tasks.md
index cd87d38..b3b44fe 100644
--- a/openspec/changes/add-claude-self-hosted-runner/tasks.md
+++ b/openspec/changes/add-claude-self-hosted-runner/tasks.md
@@ -1,7 +1,7 @@
 ## 1. Implementation
 - [x] 1.1 Add `modules/claude-self-hosted-runner` and the `sync-claude-runner-module` Makefile target <!-- id: 1.1 -->
-- [x] 1.2 Wire the module into `drupal-core`, `drupal-contrib` and `freeform`, after the remote-control snippet and before the user startup hook <!-- id: 1.2 -->
-- [x] 1.3 Add runner runs to each template's `tests/validate.tftest.hcl` <!-- id: 1.3 -->
+- [x] 1.2 Wire the module into `freeform`, after the remote-control snippet and before the user startup hook <!-- id: 1.2 -->
+- [x] 1.3 Add runner runs to `freeform/tests/validate.tftest.hcl` <!-- id: 1.3 -->
 - [x] 1.4 Document the runner in `docs/user/using-workspaces.md` <!-- id: 1.4 -->
 
 ## 2. Validation

From 78468d3e1d5d191784c320b9d8dd012b6748d268 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 27 Oct 2026 15:03:51 +0000
Subject: [PATCH 4/7] fix: start the runner when only the startup script
 mentions it

The "already running" check used pgrep -f 'claude self-hosted-runner',
which matched the startup script's own bash process, so on staging the
runner never started. Anchor the pattern on the program name.

The docs now use chmod 600 for the secret: the home directory's default
ACL leaves a file created under umask 077 group-readable.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UrTUMvjLtFGNseL9fh5s4o
---
 docs/user/using-workspaces.md                         | 3 ++-
 freeform/modules/claude-self-hosted-runner/outputs.tf | 3 ++-
 modules/claude-self-hosted-runner/outputs.tf          | 3 ++-
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/docs/user/using-workspaces.md b/docs/user/using-workspaces.md
index 39709dc..1e41839 100644
--- a/docs/user/using-workspaces.md
+++ b/docs/user/using-workspaces.md
@@ -81,7 +81,8 @@ One-time setup:
 
    ```bash
    mkdir -p ~/.claude-runner
-   (umask 077; cat > ~/.claude-runner/environment-secret)   # paste, then Ctrl-D
+   cat > ~/.claude-runner/environment-secret   # paste, then Ctrl-D
+   chmod 600 ~/.claude-runner/environment-secret
    ```
 
 3. Restart the workspace.
diff --git a/freeform/modules/claude-self-hosted-runner/outputs.tf b/freeform/modules/claude-self-hosted-runner/outputs.tf
index d347c79..4a18c57 100644
--- a/freeform/modules/claude-self-hosted-runner/outputs.tf
+++ b/freeform/modules/claude-self-hosted-runner/outputs.tf
@@ -28,7 +28,8 @@ output "startup_script" {
         echo '${base64encode(file("${path.module}/files/claude-sessions"))}' | base64 -d > ~/.local/bin/claude-sessions
         chmod +x ~/.local/bin/claude-sessions
         mkcert -install >/dev/null 2>&1 || true
-        if pgrep -f 'claude self-hosted-runner' >/dev/null || tmux has-session -t claude-runner 2>/dev/null; then
+        # Anchored on the program name: this script's own bash command line contains the phrase.
+        if pgrep -f '^[^ ]*claude self-hosted-runner' >/dev/null || tmux has-session -t claude-runner 2>/dev/null; then
           CLAUDE_RUNNER_MSG="✓ Claude Code self-hosted runner already running (tmux attach -t claude-runner)"
         else
           tmux new-session -d -s claude-runner ~/.local/bin/claude-runner-loop
diff --git a/modules/claude-self-hosted-runner/outputs.tf b/modules/claude-self-hosted-runner/outputs.tf
index d347c79..4a18c57 100644
--- a/modules/claude-self-hosted-runner/outputs.tf
+++ b/modules/claude-self-hosted-runner/outputs.tf
@@ -28,7 +28,8 @@ output "startup_script" {
         echo '${base64encode(file("${path.module}/files/claude-sessions"))}' | base64 -d > ~/.local/bin/claude-sessions
         chmod +x ~/.local/bin/claude-sessions
         mkcert -install >/dev/null 2>&1 || true
-        if pgrep -f 'claude self-hosted-runner' >/dev/null || tmux has-session -t claude-runner 2>/dev/null; then
+        # Anchored on the program name: this script's own bash command line contains the phrase.
+        if pgrep -f '^[^ ]*claude self-hosted-runner' >/dev/null || tmux has-session -t claude-runner 2>/dev/null; then
           CLAUDE_RUNNER_MSG="✓ Claude Code self-hosted runner already running (tmux attach -t claude-runner)"
         else
           tmux new-session -d -s claude-runner ~/.local/bin/claude-runner-loop

From 4900130c97852322d54fb859f7e8d291f6289611 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 27 Oct 2026 15:07:59 +0000
Subject: [PATCH 5/7] fix: back off when the runner fails right after starting

With a revoked or wrong secret the runner exits within a second, and the
loop retried every 5s indefinitely. Wait 60s after a run shorter than a
minute.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UrTUMvjLtFGNseL9fh5s4o
---
 .../files/claude-runner-loop.sh.tftpl                     | 8 ++++++--
 .../files/claude-runner-loop.sh.tftpl                     | 8 ++++++--
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/freeform/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl b/freeform/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
index 50f0e7a..4da001b 100644
--- a/freeform/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
+++ b/freeform/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
@@ -3,6 +3,7 @@
 # --release-idle-session-min leaves it with no sessions.
 export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:/home/linuxbrew/.linuxbrew/bin:$PATH"
 while true; do
+  started=$(date +%s)
   /home/linuxbrew/.linuxbrew/bin/claude self-hosted-runner \
     --environment-secret-file "${secret_file}" \
     --base-dir "${base_dir}" \
@@ -15,6 +16,9 @@ while true; do
     --health-port 0 \
     --log-file /tmp/claude-runner.log
   rc=$?
-  echo "$(date): runner exited ($rc); restarting in 5s"
-  sleep 5
+  # A runner that fails at once (a revoked secret, no network) would otherwise retry every 5s.
+  delay=5
+  [ $(( $(date +%s) - started )) -lt 60 ] && delay=60
+  echo "$(date): runner exited ($rc); restarting in $${delay}s"
+  sleep "$delay"
 done
diff --git a/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl b/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
index 50f0e7a..4da001b 100644
--- a/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
+++ b/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
@@ -3,6 +3,7 @@
 # --release-idle-session-min leaves it with no sessions.
 export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:/home/linuxbrew/.linuxbrew/bin:$PATH"
 while true; do
+  started=$(date +%s)
   /home/linuxbrew/.linuxbrew/bin/claude self-hosted-runner \
     --environment-secret-file "${secret_file}" \
     --base-dir "${base_dir}" \
@@ -15,6 +16,9 @@ while true; do
     --health-port 0 \
     --log-file /tmp/claude-runner.log
   rc=$?
-  echo "$(date): runner exited ($rc); restarting in 5s"
-  sleep 5
+  # A runner that fails at once (a revoked secret, no network) would otherwise retry every 5s.
+  delay=5
+  [ $(( $(date +%s) - started )) -lt 60 ] && delay=60
+  echo "$(date): runner exited ($rc); restarting in $${delay}s"
+  sleep "$delay"
 done

From ecd46ba3cedc41c5caab16dc8163779fe4f0c7f6 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 27 Oct 2026 16:29:41 +0000
Subject: [PATCH 6/7] fix: run one capacity-1 runner per concurrent session

On staging, a runner with --use-anthropic-git-proxy and --capacity 2 exits
at once: "--use-anthropic-git-proxy requires --capacity 1 (the proxy URL is
per-session and linked worktrees share origin)". Start one runner per
concurrent session instead, each with --capacity 1, its own base directory
~/workspace/runner-<n>, and its own GIT_CONFIG_GLOBAL, so one runner's git
config rewrite cannot break another's clone. Tested by hand on staging with
two runners and two sessions running at once.

Drop --push-outcome-on-release: under Anthropic-managed git it pushes to the
plain GitHub URL with the workspace's own git credentials, which a runner
workspace does not have, so the push would fail.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UrTUMvjLtFGNseL9fh5s4o
---
 docs/user/using-workspaces.md                 |  6 ++---
 .../claude-self-hosted-runner/files/SKILL.md  | 21 ++++++------------
 .../files/claude-runner-loop.sh.tftpl         | 22 ++++++++++++-------
 .../modules/claude-self-hosted-runner/main.tf |  3 +--
 .../claude-self-hosted-runner/outputs.tf      |  9 +++++---
 freeform/tests/validate.tftest.hcl            |  8 +++++--
 .../claude-self-hosted-runner/files/SKILL.md  | 21 ++++++------------
 .../files/claude-runner-loop.sh.tftpl         | 22 ++++++++++++-------
 modules/claude-self-hosted-runner/main.tf     |  3 +--
 modules/claude-self-hosted-runner/outputs.tf  |  9 +++++---
 .../add-claude-self-hosted-runner/proposal.md |  4 ++--
 .../specs/claude-self-hosted-runner/spec.md   |  3 +--
 .../add-claude-self-hosted-runner/tasks.md    |  2 +-
 13 files changed, 69 insertions(+), 64 deletions(-)

diff --git a/docs/user/using-workspaces.md b/docs/user/using-workspaces.md
index 1e41839..cb1d652 100644
--- a/docs/user/using-workspaces.md
+++ b/docs/user/using-workspaces.md
@@ -87,11 +87,11 @@ One-time setup:
 
 3. Restart the workspace.
 
-On every start the runner runs in the tmux session `claude-runner` (`tmux attach -t claude-runner`), logging to `/tmp/claude-runner.log`. It clones session repositories under `~/workspace`.
+On every start the runners run in the tmux session `claude-runner` (`tmux attach -t claude-runner`), one window per runner, logging to `/tmp/claude-runner-<n>.log`. Runner `<n>` clones session repositories under `~/workspace/runner-<n>`.
 
 - **Use a workspace only for the runner.** The runner deletes and rewrites `~/.gitconfig` and `~/.config/git` before every session, so the template puts the sessions' git identity (`Claude <noreply@anthropic.com>`) and ignore list in `/etc/gitconfig` instead. The option refuses to start the runner when Claude Code remote control is also on.
-- **Finding a session's work.** Run `claude-sessions` in the workspace to list live sessions with their checkout, branch and the number of commits not on any remote. When a session ends because its user went idle, the runner was stopped, or it failed, the runner pushes the session's `claude/...` branch to `origin` (`--push-outcome-on-release`), so commits made by a repository whose rules forbid agents to push still reach GitHub.
-- **Concurrent sessions.** "Claude Code runner: concurrent sessions" (1 to 4) sets how many sessions run at once. They share one Docker daemon and one DDEV install, so the template installs the skill `~/.claude/skills/coder-shared-workspace`, which tells sessions how to stay out of each other's way: separate git worktrees, a DDEV global directory per session (`DDEV_XDG_CONFIG_HOME`), no `ddev poweroff`, and a lock around test suites that take over Docker. For full isolation, use several workspaces with one session each instead; the same environment secret works in all of them.
+- **Finding a session's work.** Run `claude-sessions` in the workspace to list live sessions with their checkout, branch and the number of commits not on any remote.
+- **Concurrent sessions.** "Claude Code runner: concurrent sessions" (1 to 4) sets how many sessions run at once. The template starts one runner per session, because a runner using Anthropic-managed git takes only one session. The sessions share one Docker daemon and one DDEV install, so the template installs the skill `~/.claude/skills/coder-shared-workspace`, which tells sessions how to stay out of each other's way: separate checkouts, a DDEV global directory per session (`DDEV_XDG_CONFIG_HOME`), no `ddev poweroff`, and a lock around test suites that take over Docker. For full isolation, use several workspaces with one session each instead; the same environment secret works in all of them.
 
 ### Ending Your Day
 
diff --git a/freeform/modules/claude-self-hosted-runner/files/SKILL.md b/freeform/modules/claude-self-hosted-runner/files/SKILL.md
index e651bdb..96a310f 100644
--- a/freeform/modules/claude-self-hosted-runner/files/SKILL.md
+++ b/freeform/modules/claude-self-hosted-runner/files/SKILL.md
@@ -23,20 +23,13 @@ since another session can start at any time.
 
 ## Repositories and checkouts
 
-- Sessions working in different repositories do not interfere with each
-  other's files.
-- Never switch the branch, reset, stash, or clean a checkout another
-  session is using. If your working directory is a checkout another session
-  also has, make your own worktree and work there:
-
-  ```bash
-  repo=~/workspace/<owner>/<repo>
-  git -C "$repo" worktree add ~/workspace/<repo>-worktrees/<your-branch> -b <your-branch> <base>
-  ```
-
-  Keep worktrees under `~/workspace/<repo>-worktrees/`. Remove yours with
-  `git worktree remove` when the session is done. Two worktrees cannot have
-  the same branch checked out.
+- Each runner clones into its own directory, `~/workspace/runner-<n>/`, so
+  your checkout is yours. Never change files, branches or git state under
+  another runner's directory.
+- If you need a second checkout of your own repository, use a worktree
+  next to it, not a new clone:
+  `git worktree add ../<repo>-<your-branch> -b <your-branch> <base>`.
+  Remove it with `git worktree remove` when you are done.
 - Put scratch files in `~/tmp/<your session id>/`, not directly in `~/tmp`.
 
 ## Docker and DDEV
diff --git a/freeform/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl b/freeform/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
index 4da001b..22b344c 100644
--- a/freeform/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
+++ b/freeform/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
@@ -1,24 +1,30 @@
 #!/usr/bin/env bash
-# Keep the Claude Code self-hosted runner running; it exits on its own when
-# --release-idle-session-min leaves it with no sessions.
+# Keep Claude Code self-hosted runner number $1 running; it exits on its own
+# when --release-idle-session-min leaves it with no sessions.
+# --use-anthropic-git-proxy requires --capacity 1, so concurrent sessions come
+# from several runners, each with its own clones and its own global git config.
+set -u
+n="$1"
+base="${base_dir}/runner-$n"
+mkdir -p "$base"
 export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:/home/linuxbrew/.linuxbrew/bin:$PATH"
+export GIT_CONFIG_GLOBAL="$base/.gitconfig"
 while true; do
   started=$(date +%s)
   /home/linuxbrew/.linuxbrew/bin/claude self-hosted-runner \
     --environment-secret-file "${secret_file}" \
-    --base-dir "${base_dir}" \
-    --capacity ${capacity} \
-    --client-label "$CODER_WORKSPACE_NAME" \
+    --base-dir "$base" \
+    --capacity 1 \
+    --client-label "$CODER_WORKSPACE_NAME-$n" \
     --use-anthropic-git-proxy \
-    --push-outcome-on-release \
     --release-idle-session-min 30 \
     --kill-session-after-min 480 \
     --health-port 0 \
-    --log-file /tmp/claude-runner.log
+    --log-file "/tmp/claude-runner-$n.log"
   rc=$?
   # A runner that fails at once (a revoked secret, no network) would otherwise retry every 5s.
   delay=5
   [ $(( $(date +%s) - started )) -lt 60 ] && delay=60
-  echo "$(date): runner exited ($rc); restarting in $${delay}s"
+  echo "$(date): runner $n exited ($rc); restarting in $${delay}s"
   sleep "$delay"
 done
diff --git a/freeform/modules/claude-self-hosted-runner/main.tf b/freeform/modules/claude-self-hosted-runner/main.tf
index a580c8b..0ad3977 100644
--- a/freeform/modules/claude-self-hosted-runner/main.tf
+++ b/freeform/modules/claude-self-hosted-runner/main.tf
@@ -19,7 +19,7 @@ data "coder_parameter" "enable_claude_runner" {
 data "coder_parameter" "claude_runner_capacity" {
   name         = "claude_runner_capacity"
   display_name = "Claude Code runner: concurrent sessions"
-  description  = "How many sessions the runner hosts at once. They share this workspace's Docker daemon and DDEV; the runner installs a skill telling them how to avoid conflicts. Only takes effect when the runner is enabled."
+  description  = "How many sessions this workspace hosts at once, one runner each. They share this workspace's Docker daemon and DDEV; a skill installed for them says how to avoid conflicts. Only takes effect when the runner is enabled."
   type         = "number"
   default      = "1"
   mutable      = true
@@ -39,6 +39,5 @@ locals {
   loop_script = templatefile("${path.module}/files/claude-runner-loop.sh.tftpl", {
     secret_file = local.secret_file
     base_dir    = var.base_dir
-    capacity    = local.capacity
   })
 }
diff --git a/freeform/modules/claude-self-hosted-runner/outputs.tf b/freeform/modules/claude-self-hosted-runner/outputs.tf
index 4a18c57..aa346f4 100644
--- a/freeform/modules/claude-self-hosted-runner/outputs.tf
+++ b/freeform/modules/claude-self-hosted-runner/outputs.tf
@@ -30,10 +30,13 @@ output "startup_script" {
         mkcert -install >/dev/null 2>&1 || true
         # Anchored on the program name: this script's own bash command line contains the phrase.
         if pgrep -f '^[^ ]*claude self-hosted-runner' >/dev/null || tmux has-session -t claude-runner 2>/dev/null; then
-          CLAUDE_RUNNER_MSG="✓ Claude Code self-hosted runner already running (tmux attach -t claude-runner)"
+          CLAUDE_RUNNER_MSG="✓ Claude Code self-hosted runners already running (tmux attach -t claude-runner)"
         else
-          tmux new-session -d -s claude-runner ~/.local/bin/claude-runner-loop
-          CLAUDE_RUNNER_MSG="✓ Claude Code self-hosted runner started, capacity ${local.capacity} (tmux attach -t claude-runner; log /tmp/claude-runner.log)"
+          tmux new-session -d -s claude-runner -n runner-1 "$HOME/.local/bin/claude-runner-loop 1"
+          for i in $(seq 2 ${local.capacity}); do
+            tmux new-window -t claude-runner -n "runner-$i" "$HOME/.local/bin/claude-runner-loop $i"
+          done
+          CLAUDE_RUNNER_MSG="✓ ${local.capacity} Claude Code self-hosted runner(s) started (tmux attach -t claude-runner; logs /tmp/claude-runner-*.log)"
         fi
       fi
       echo "$CLAUDE_RUNNER_MSG"
diff --git a/freeform/tests/validate.tftest.hcl b/freeform/tests/validate.tftest.hcl
index b4802d3..c292a53 100644
--- a/freeform/tests/validate.tftest.hcl
+++ b/freeform/tests/validate.tftest.hcl
@@ -282,8 +282,12 @@ run "claude_runner_enabled" {
     error_message = "the runner must see remote control as off when enable_claude_code=false"
   }
   assert {
-    condition     = strcontains(base64decode(regex("echo '([A-Za-z0-9+/=]+)' \\| base64 -d > ~/.local/bin/claude-runner-loop", coder_agent.main.startup_script)[0]), "--capacity 3")
-    error_message = "runner loop script must pass the claude_runner_capacity value as --capacity"
+    condition     = strcontains(coder_agent.main.startup_script, "seq 2 3")
+    error_message = "startup script must start one runner per claude_runner_capacity"
+  }
+  assert {
+    condition     = strcontains(base64decode(regex("echo '([A-Za-z0-9+/=]+)' \\| base64 -d > ~/.local/bin/claude-runner-loop", coder_agent.main.startup_script)[0]), "--capacity 1")
+    error_message = "each runner must use --capacity 1, which --use-anthropic-git-proxy requires"
   }
 }
 
diff --git a/modules/claude-self-hosted-runner/files/SKILL.md b/modules/claude-self-hosted-runner/files/SKILL.md
index e651bdb..96a310f 100644
--- a/modules/claude-self-hosted-runner/files/SKILL.md
+++ b/modules/claude-self-hosted-runner/files/SKILL.md
@@ -23,20 +23,13 @@ since another session can start at any time.
 
 ## Repositories and checkouts
 
-- Sessions working in different repositories do not interfere with each
-  other's files.
-- Never switch the branch, reset, stash, or clean a checkout another
-  session is using. If your working directory is a checkout another session
-  also has, make your own worktree and work there:
-
-  ```bash
-  repo=~/workspace/<owner>/<repo>
-  git -C "$repo" worktree add ~/workspace/<repo>-worktrees/<your-branch> -b <your-branch> <base>
-  ```
-
-  Keep worktrees under `~/workspace/<repo>-worktrees/`. Remove yours with
-  `git worktree remove` when the session is done. Two worktrees cannot have
-  the same branch checked out.
+- Each runner clones into its own directory, `~/workspace/runner-<n>/`, so
+  your checkout is yours. Never change files, branches or git state under
+  another runner's directory.
+- If you need a second checkout of your own repository, use a worktree
+  next to it, not a new clone:
+  `git worktree add ../<repo>-<your-branch> -b <your-branch> <base>`.
+  Remove it with `git worktree remove` when you are done.
 - Put scratch files in `~/tmp/<your session id>/`, not directly in `~/tmp`.
 
 ## Docker and DDEV
diff --git a/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl b/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
index 4da001b..22b344c 100644
--- a/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
+++ b/modules/claude-self-hosted-runner/files/claude-runner-loop.sh.tftpl
@@ -1,24 +1,30 @@
 #!/usr/bin/env bash
-# Keep the Claude Code self-hosted runner running; it exits on its own when
-# --release-idle-session-min leaves it with no sessions.
+# Keep Claude Code self-hosted runner number $1 running; it exits on its own
+# when --release-idle-session-min leaves it with no sessions.
+# --use-anthropic-git-proxy requires --capacity 1, so concurrent sessions come
+# from several runners, each with its own clones and its own global git config.
+set -u
+n="$1"
+base="${base_dir}/runner-$n"
+mkdir -p "$base"
 export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:/home/linuxbrew/.linuxbrew/bin:$PATH"
+export GIT_CONFIG_GLOBAL="$base/.gitconfig"
 while true; do
   started=$(date +%s)
   /home/linuxbrew/.linuxbrew/bin/claude self-hosted-runner \
     --environment-secret-file "${secret_file}" \
-    --base-dir "${base_dir}" \
-    --capacity ${capacity} \
-    --client-label "$CODER_WORKSPACE_NAME" \
+    --base-dir "$base" \
+    --capacity 1 \
+    --client-label "$CODER_WORKSPACE_NAME-$n" \
     --use-anthropic-git-proxy \
-    --push-outcome-on-release \
     --release-idle-session-min 30 \
     --kill-session-after-min 480 \
     --health-port 0 \
-    --log-file /tmp/claude-runner.log
+    --log-file "/tmp/claude-runner-$n.log"
   rc=$?
   # A runner that fails at once (a revoked secret, no network) would otherwise retry every 5s.
   delay=5
   [ $(( $(date +%s) - started )) -lt 60 ] && delay=60
-  echo "$(date): runner exited ($rc); restarting in $${delay}s"
+  echo "$(date): runner $n exited ($rc); restarting in $${delay}s"
   sleep "$delay"
 done
diff --git a/modules/claude-self-hosted-runner/main.tf b/modules/claude-self-hosted-runner/main.tf
index a580c8b..0ad3977 100644
--- a/modules/claude-self-hosted-runner/main.tf
+++ b/modules/claude-self-hosted-runner/main.tf
@@ -19,7 +19,7 @@ data "coder_parameter" "enable_claude_runner" {
 data "coder_parameter" "claude_runner_capacity" {
   name         = "claude_runner_capacity"
   display_name = "Claude Code runner: concurrent sessions"
-  description  = "How many sessions the runner hosts at once. They share this workspace's Docker daemon and DDEV; the runner installs a skill telling them how to avoid conflicts. Only takes effect when the runner is enabled."
+  description  = "How many sessions this workspace hosts at once, one runner each. They share this workspace's Docker daemon and DDEV; a skill installed for them says how to avoid conflicts. Only takes effect when the runner is enabled."
   type         = "number"
   default      = "1"
   mutable      = true
@@ -39,6 +39,5 @@ locals {
   loop_script = templatefile("${path.module}/files/claude-runner-loop.sh.tftpl", {
     secret_file = local.secret_file
     base_dir    = var.base_dir
-    capacity    = local.capacity
   })
 }
diff --git a/modules/claude-self-hosted-runner/outputs.tf b/modules/claude-self-hosted-runner/outputs.tf
index 4a18c57..aa346f4 100644
--- a/modules/claude-self-hosted-runner/outputs.tf
+++ b/modules/claude-self-hosted-runner/outputs.tf
@@ -30,10 +30,13 @@ output "startup_script" {
         mkcert -install >/dev/null 2>&1 || true
         # Anchored on the program name: this script's own bash command line contains the phrase.
         if pgrep -f '^[^ ]*claude self-hosted-runner' >/dev/null || tmux has-session -t claude-runner 2>/dev/null; then
-          CLAUDE_RUNNER_MSG="✓ Claude Code self-hosted runner already running (tmux attach -t claude-runner)"
+          CLAUDE_RUNNER_MSG="✓ Claude Code self-hosted runners already running (tmux attach -t claude-runner)"
         else
-          tmux new-session -d -s claude-runner ~/.local/bin/claude-runner-loop
-          CLAUDE_RUNNER_MSG="✓ Claude Code self-hosted runner started, capacity ${local.capacity} (tmux attach -t claude-runner; log /tmp/claude-runner.log)"
+          tmux new-session -d -s claude-runner -n runner-1 "$HOME/.local/bin/claude-runner-loop 1"
+          for i in $(seq 2 ${local.capacity}); do
+            tmux new-window -t claude-runner -n "runner-$i" "$HOME/.local/bin/claude-runner-loop $i"
+          done
+          CLAUDE_RUNNER_MSG="✓ ${local.capacity} Claude Code self-hosted runner(s) started (tmux attach -t claude-runner; logs /tmp/claude-runner-*.log)"
         fi
       fi
       echo "$CLAUDE_RUNNER_MSG"
diff --git a/openspec/changes/add-claude-self-hosted-runner/proposal.md b/openspec/changes/add-claude-self-hosted-runner/proposal.md
index e9512be..9ca8fc4 100644
--- a/openspec/changes/add-claude-self-hosted-runner/proposal.md
+++ b/openspec/changes/add-claude-self-hosted-runner/proposal.md
@@ -6,10 +6,10 @@ A Coder workspace can serve as a Claude Code self-hosted runner, so sessions sta
 ## What Changes
 - New module `modules/claude-self-hosted-runner`, vendored into `freeform` only (`make sync-claude-runner-module`, part of `make sync-shared`). The Drupal templates set up one project for a person to work on, which is not what a runner workspace needs.
 - Two parameters: "Run a Claude Code self-hosted runner" (switch, default off) and "Claude Code runner: concurrent sessions" (1–4, default 1).
-- When on, and `~/.claude-runner/environment-secret` exists, the startup script starts `claude self-hosted-runner` in a restart loop in tmux session `claude-runner`, with `--use-anthropic-git-proxy` and `--push-outcome-on-release`. The secret never goes through Terraform.
+- When on, and `~/.claude-runner/environment-secret` exists, the startup script starts one `claude self-hosted-runner` per concurrent session, each in a restart loop in its own window of tmux session `claude-runner`, with `--use-anthropic-git-proxy` and `--capacity 1`. The runner refuses `--use-anthropic-git-proxy` with a larger capacity, so each runner gets its own base directory `~/workspace/runner-<n>` and its own `GIT_CONFIG_GLOBAL`. The secret never goes through Terraform.
 - Because the runner rewrites `~/.gitconfig` and `~/.config/git` before every session, the session git identity and ignore list are installed in `/etc/gitconfig` on every start.
 - The runner refuses to start when Claude Code remote control is also on, and says why in the build log and `~/WELCOME.txt`.
-- Installs the skill `~/.claude/skills/coder-shared-workspace`, which the runner copies into every session: worktrees instead of shared checkouts, a DDEV global directory per session via `DDEV_XDG_CONFIG_HOME`, no workspace-wide Docker/DDEV commands, a `flock` around test suites that power off DDEV, and disk cleanup limited to a session's own files.
+- Installs the skill `~/.claude/skills/coder-shared-workspace`, which the runner copies into every session: stay out of other runners' checkouts, a DDEV global directory per session via `DDEV_XDG_CONFIG_HOME`, no workspace-wide Docker/DDEV commands, a `flock` around test suites that power off DDEV, and disk cleanup limited to a session's own files.
 - Installs `claude-sessions`, which lists live sessions with their checkout, branch and unpushed commit count.
 - Documented in `docs/user/using-workspaces.md`.
 
diff --git a/openspec/changes/add-claude-self-hosted-runner/specs/claude-self-hosted-runner/spec.md b/openspec/changes/add-claude-self-hosted-runner/specs/claude-self-hosted-runner/spec.md
index 1a595d1..4369eb6 100644
--- a/openspec/changes/add-claude-self-hosted-runner/specs/claude-self-hosted-runner/spec.md
+++ b/openspec/changes/add-claude-self-hosted-runner/specs/claude-self-hosted-runner/spec.md
@@ -5,8 +5,7 @@ The `freeform` workspace startup script SHALL start a Claude Code self-hosted ru
 
 #### Scenario: Enabled with a secret
 - **WHEN** a workspace starts with "Run a Claude Code self-hosted runner" on and `~/.claude-runner/environment-secret` is non-empty
-- **THEN** the startup script SHALL start `claude self-hosted-runner` in a restart loop in tmux session `claude-runner`, unless a runner is already running
-- **AND** it SHALL pass the "concurrent sessions" value as `--capacity`
+- **THEN** the startup script SHALL start as many `claude self-hosted-runner` processes as the "concurrent sessions" value, each with `--capacity 1`, its own base directory and its own restart loop in tmux session `claude-runner`, unless a runner is already running
 - **AND** it SHALL install the session git config in `/etc/gitconfig`, the `coder-shared-workspace` skill in `~/.claude/skills`, and `claude-sessions` in `~/.local/bin`
 
 #### Scenario: Enabled without a secret
diff --git a/openspec/changes/add-claude-self-hosted-runner/tasks.md b/openspec/changes/add-claude-self-hosted-runner/tasks.md
index b3b44fe..ec0ce6f 100644
--- a/openspec/changes/add-claude-self-hosted-runner/tasks.md
+++ b/openspec/changes/add-claude-self-hosted-runner/tasks.md
@@ -7,4 +7,4 @@
 ## 2. Validation
 - [x] 2.1 `terraform fmt -check -recursive`, `make validate` and `make test-templates` pass <!-- id: 2.1 -->
 - [ ] 2.2 Manual check on staging: with the switch on and the secret saved, the runner comes up after a workspace restart with no terminal open, and a session lands on it <!-- id: 2.2 -->
-- [ ] 2.3 Manual check on staging: with capacity 2, two sessions run at once and both see the `coder-shared-workspace` skill <!-- id: 2.3 -->
+- [ ] 2.3 Manual check on staging: with concurrent sessions set to 2, two sessions run at once and both see the `coder-shared-workspace` skill <!-- id: 2.3 -->

From f50eb2a380a3f24d4554bee40ec8da57dfa529a3 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 27 Oct 2026 16:37:29 +0000
Subject: [PATCH 7/7] docs: mark the staging runner checks done

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UrTUMvjLtFGNseL9fh5s4o
---
 openspec/changes/add-claude-self-hosted-runner/tasks.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/openspec/changes/add-claude-self-hosted-runner/tasks.md b/openspec/changes/add-claude-self-hosted-runner/tasks.md
index ec0ce6f..e04c729 100644
--- a/openspec/changes/add-claude-self-hosted-runner/tasks.md
+++ b/openspec/changes/add-claude-self-hosted-runner/tasks.md
@@ -6,5 +6,5 @@
 
 ## 2. Validation
 - [x] 2.1 `terraform fmt -check -recursive`, `make validate` and `make test-templates` pass <!-- id: 2.1 -->
-- [ ] 2.2 Manual check on staging: with the switch on and the secret saved, the runner comes up after a workspace restart with no terminal open, and a session lands on it <!-- id: 2.2 -->
-- [ ] 2.3 Manual check on staging: with concurrent sessions set to 2, two sessions run at once and both see the `coder-shared-workspace` skill <!-- id: 2.3 -->
+- [x] 2.2 Manual check on staging: with the switch on and the secret saved, the runner comes up after a workspace restart with no terminal open, and a session lands on it <!-- id: 2.2 -->
+- [x] 2.3 Manual check on staging: with concurrent sessions set to 2, two sessions run at once and both see the `coder-shared-workspace` skill <!-- id: 2.3 -->