Gabriel Vidal 1ef6364067 feat(sidecar): per-run scope — dontAsk, confined edits, a guest's prompt ...

/spawn, /resume and /fork take an optional scope: the run then launches
on --permission-mode dontAsk (allow rules do nothing under bypass) with
--permission-prompts none, Edit allowed only under scope.writeDirs, the
working tools allowed outright, scope.denyRead refused, the scope's
system prompt appended and remote control off. scope.sandbox adds
Claude Code's bubblewrap sandbox for Bash (needs bwrap + socat).

Verified end to end with a haiku run through this sidecar: a Write
inside the project went through, one outside was denied, Bash ran, a
read of ~/.ssh was denied, and the model knew whose session it was.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-11 15:27:43 +02:00

4.2 KiB

Raw Permalink Blame History

View Raw