Development record
The file tools a headless role is granted (the --allowedTools list of the claude launch, internal/core/runner/claude.go) write files without asking the approver, so the approver's protected set does not cover what those tools write. The OS sandbox for launched agents, spc-2610161751056096, is the change that bounds those writes. <!-- record-lint: forward-looking -->
issueopenminoriss-2610161930115246
The file tools a headless role is granted (the --allowedTools list of the claude launch, internal/core/runner/claude.go) write files without asking the approver, so the approver's protected set does not cover what those tools write. The OS sandbox for launched agents, spc-2610161751056096, is the change that bounds those writes.
Frontmatter
| id | iss-2610161930115246 |
|---|---|
| type | issue |
| lifecycle | open |
| severity | minor |
.abcd/work/issues/open/iss-2610161930115246-the-file-tools-a-headless-role-is.md
open on GitHub ↗ · commit history ↗
mentions1
- spc-2610161751056096a-person-who-leaves-abcd-to-run-on-its