Adds a per-project "Allow host build/run" sandbox capability that lets a
containerized agent request to build and run executables on the host
machine, escaping the Linux sandbox — e.g. compiling and running a macOS
binary the container can't.
- New `host_exec` MCP tool on the approval server, advertised only when the
session opts in. Pre-allowed via --allowedTools so the call reaches our
handler directly rather than Claude's permission path: the handler is the
sole gate, so `auto` mode can never auto-approve it.
- Every host command surfaces an explicit approval (risk .hostExec) and runs
on the host via /bin/zsh -lc in the session worktree only after approval.
An explicit "Allow for Session" choice grants the rest of the session;
auto-approve never sets that — only a deliberate user choice does.
- ProjectSandbox.allowHostExec (off by default) with tolerant decoding so
rows persisted before the field default to false instead of dropping the
whole sandbox config.
- Threaded allowHostExec through RunSpec/ResumeSpec/SessionController; Mac
Project Settings toggle; Mac ApprovalBar "Allow for Session" button; iOS
risk styling/biometric gate for .hostExec.
- Tests: host_exec advertised/served only when registered + refused
otherwise; allowHostExec round-trip and legacy-JSON default-to-false.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Split the pure value types the sync wire layer projects out of NucleicCore
into a new platform-agnostic NucleicProtocol target the iPhone client can link:
JSONValue, the AgentEvent model, Approval/Decision, and the identifiers
(SessionID/ApprovalID/BackendID/AgentInput/SessionStatus/DiffStat). AgentInput
gains Codable for the wire. NucleicCore re-exports NucleicProtocol so all host
code keeps referencing them unqualified. Package gains an iOS platform so the
shared lib resolves in the NucleicRemote Xcode project.
148 tests green (swift test --build-system native).
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
abkslmandClaude Opus 4.8