claudebox

Author	SHA1	Message	Date
Christopher Mühl	778216ead9	docs(quick-260410-d4u): on non-nixos hosts, bwrap fails because /etc/static does not exist Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-10 09:46:51 +02:00
Christopher Mühl	97c10f8fd4	fix(260410-d4u): conditionally mount /etc/static only on NixOS Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-10 09:29:11 +02:00
Christopher Mühl	e43d33602d	fix: symlink ~/.claude to ~/.claudebox instead of renaming mount Both paths now resolve inside the sandbox, so hook paths and settings referencing ~/.claude work without fixups. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-09 21:44:54 +02:00
Christopher Mühl	27d9db44a0	feat(03-01): add SANDBOX.md generation and CLAUDE.md import check	2026-04-09 21:18:10 +02:00
Christopher Mühl	b035f82cc7	feat(02-02): add confirmation prompt with TTY detection	2026-04-09 17:21:37 +02:00
Christopher Mühl	1c986d22b8	feat(02-02): add env audit display with masking and grouped sections	2026-04-09 17:20:58 +02:00
Christopher Mühl	7001303436	feat(02-01): add --check mode for prerequisite verification	2026-04-09 17:13:18 +02:00
Christopher Mühl	1eddd9336d	feat(02-01): add --dry-run mode that prints full bwrap command and exits	2026-04-09 17:13:17 +02:00
Christopher Mühl	72ba48d004	feat(02-01): refactor flag parsing to while/shift with CLAUDE_ARGS accumulator	2026-04-09 17:13:17 +02:00
Christopher Mühl	613d015cc1	fix: SHELL path, PATH isolation, --shell flag, nix-claude-code input - Resolve SHELL to nix store bash path (was /bin/bash which doesn't exist in sandbox) - Inject clean SANDBOX_PATH via makeBinPath (was leaking entire host PATH) - Add --shell flag to drop into sandboxed bash for manual verification - Use nix-claude-code flake for claude-code binary instead of host PATH discovery Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-09 14:59:43 +02:00
Christopher Mühl	9296453be3	fix(01-02): resolve claude and env paths through symlinks readlink -f ensures CLAUDE_BIN and env point to real nix store paths accessible inside the bwrap sandbox. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-09 11:14:50 +02:00
Christopher Mühl	51dba047f3	feat(01-01): add claudebox.sh with bwrap sandbox, env allowlist, and secret hiding	2026-04-09 11:11:44 +02:00

12 commits