Drop host mode: HostSandbox, the environment allowlist, the sidecar host
command and the in-process recording proxy. proxy.py is now the proxy
container's entry point only, and aiohttp/zstandard leave the Python deps.
Images are tagged with a hash of the files they are built from, so editing
proxy.py or a Containerfile rebuilds them. Reports drop the sandbox level.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GZY2T82aEHnuVC4ALzRcPh
Claude Code runs in a pinned, checksum-verified image on an internal
network with no egress and a dummy credential. A proxy container is the
only way out: it records every request and swaps in the real credential,
which never enters the Claude Code container. The host's cached feature
flags seed the sandbox config so tools such as Monitor stay available.
--sandbox host keeps the previous in-process mode.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
pytest suite that runs claude -p behind a recording API proxy and checks
whether a canary secret reaches the wire, the transcript or the answer.
Cases: cat, Read, env, unlabeled random value, known value, tail -f in
foreground/background, Monitor. Subjects: bare Claude Code (control) and
the redacted PostToolUse hook.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Nicolas Massé