Run a Nucleic Control container's approval + interceptor channel over a vsock-relayed unix socket instead of TCP/HTTP on the VM gateway, so macOS raises no incoming-connection / local-network prompts.
- MCPApprovalServer: real AF_UNIX listener + transport-agnostic ByteConn (host UDS transport).
- ContainerEngine: relay the host control socket into the guest (UnixSocketConfiguration.into); init launches an in-guest loopback bridge (control-bridge.js) forwarding 127.0.0.1:9099 -> the relayed socket.
- ApprovalServerRegistry: one token-multiplexed approval server per shared control container.
- ClaudeCodeBackend: serve UDS-only (no IP listener) + point mcpConfig/interceptor env at the bridge; CommandInterceptor.hookEnv centralizes the interceptor wiring.
- GrokACPBackend / CodexAppServerBackend: exec inside the shared control container (stdio over vsock) for per-family isolation.
All gated behind ContainerServiceSettings.vsockControlPlaneEnabled (default off); legacy gateway-TCP path unchanged. Needs the sandbox image to ship control-bridge.js (and, for Grok/Codex, their CLIs + auth) before flipping the flag. See docs/VSOCK_CONTROL_PLANE.md.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
