Watchdeck: See what every Claude Code session was stopped from doing

watchdeck shows every Claude Code session on your machine as a live map, every tool call with who decided it, and turns a denial into a rule in one click. Local, private, one binary.

curl -fsSL https://raw.githubusercontent.com/Panda-Taps-LLC/watchdeck/main/scripts/install.sh | sh

Add --verify (curl … | sh -s -- --verify) to check the release's provenance with the GitHub CLI or cosign before anything is installed. The script comes from the main branch and installs the latest release; --version vX.Y.Z, with the script fetched from that tag's URL instead of main, pins both. Or from the Homebrew tap, whose formula is updated with each release:

brew install Panda-Taps-LLC/tap/watchdeck

Or, typed inside Claude Code, the plugin, which gives the band above the prompt, /watchdeck:open and /watchdeck:status; it needs the binary too, so it comes after one of the two installs above:

/plugin install watchdeck --marketplace Panda-Taps-LLC/watchdeck

Or build from source (Go 1.27+):

git clone https://github.com/Panda-Taps-LLC/watchdeck && cd watchdeck
go build -o ~/.local/bin/watchdeck ./cmd/watchdeck && watchdeck setup

setup tests the sandbox, offers the recommended rules and adds the Claude Code settings watchdeck needs, asking before each write. watchdeck uninstall removes all of it in one confirmed step.

_{The left half of the GIF is a rendering of a terminal, labelled demo. The right half is the dashboard on a fixture home with synthetic sessions. How both were made: docs/images/README.md.}

Status: v0.1.0, 2026-11-04. macOS enforcement is verified end to end. Linux (bubblewrap) passes CI but has not run on a developer machine. License: Apache-2.0.

Besides the map and the one-click rule:

• Leak watch. A secret-shaped string in any session's tool results, replies or tool inputs becomes a "Secret seen" row in Needs you, saying where it was seen and never holding the secret.
• Rules that cover every route. One rule for a path, a domain or a command is written as every rule that reaches it (Claude Code's own rule, a search rule, a shell rule) and removed as one; skill scripts are not covered.
• Allow for a while. one of watchdeck's own rules for an hour or a session, or widen a skill's sandbox for up to eight hours; it ends by itself and never allows what Claude Code refused.
• Rule counts and a try box. Each rule shows how often it fired and when, and you can try a command, a path or a URL against your saved rules before a session does.

_{Every session, live ones first, with the last calls of each as a lane.}

_{Everything that limits an agent on this machine, strongest first; try a call against it, or add a rule in one step.}

_{A denial becomes a rule, or is acknowledged, and the list empties.}

Auto mode decides one call at a time, inside one session, and its Recently denied tab shows only that session. watchdeck keeps every decision from every session on the machine, and writes the Claude Code deny and ask rules that auto mode applies before its own check. Where Claude Code has no sandbox, such as a skill's scripts or an MCP server, watchdeck runs each one in its own OS sandbox.

• Prose instructions. ASKILL.md can still talk the agent into misusing Read or WebFetch; only scripts are sandboxed.
• Auto mode's own decisions. watchdeck records them and turns them into rules, but it does not change how Claude Code's check decides.
• bypassPermissions mode. Claude Code can settle an ask there without you, so watchdeck's asks drop the sandbox rewrite; an interactive bypass session is not verified.
• A person turning it off. Anyone who can edit your Claude Code settings can remove watchdeck's hooks;watchdeck doctor says when it is not installed.
• Commands built at run time. Words another program produces when the command runs, such astr ,sed orbase64 output piped into a shell, are not seen.
• Anything outside Claude Code. A program running as you that Claude Code did not start is out of reach.

The full list, with the tests behind each line: docs/GUIDE.md.

What the models actually did when told no, in 18 headless sessions on 2026-10-20 and 2026-10-21, and four more on 2026-10-25 with a rule for every route and leak watch: docs/DENIED.md.

Everything stays on this machine. The dashboard listens on 127.0.0.1 only, behind a token, and there is no telemetry. Transcripts are read read-only: when the dashboard builds its session index over ~/.claude/projects and when you open a session. Of them, watchdeck keeps only a local search index, and watchdeck ui --no-transcripts turns both off. The index and watchdeck's own activity log are files in your state directory, mode 0600.

Every release ships checksums.txt, a keyless cosign bundle checksums.txt.sigstore.json and a GitHub build-provenance attestation, all made by this repository's release workflow for the tag. With cosign 3.x (brew install cosign):

tag=v0.1.0          # the release you downloaded; the archive, checksums.txt and checksums.txt.sigstore.json sit beside each other
cosign verify-blob \
  --certificate-identity "https://github.com/Panda-Taps-LLC/watchdeck/.github/workflows/release.yml@refs/tags/$tag" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --bundle checksums.txt.sigstore.json checksums.txt
grep watchdeck_0.1.0_darwin_arm64.tar.gz checksums.txt | shasum -a 256 -c    # your archive; sha256sum -c on Linux

A second channel, Rekor plus the workflow identity rather than a second download: gh attestation verify watchdeck_0.1.0_darwin_arm64.tar.gz --repo Panda-Taps-LLC/watchdeck --signer-workflow Panda-Taps-LLC/watchdeck/.github/workflows/release.yml. What a failure means and what to send us: SECURITY.md. For maintainers, scripts/verify-release.sh <tag> runs the cosign block on checksums.txt, the gh block on every archive and every sha256 of a release. The installer runs the gh line for you with --verify (the cosign line when gh is not signed in) and installs nothing when it fails; designed, not tested against a real release. The first signed release comes with the public repository.

More commands: watchdeck help advanced.

• docs/GUIDE.md : every command, the dashboard, rules and policies, MCP sandboxing, limits and troubleshooting
• docs/DESIGN.md : the design, and what is verified and how
• docs/MANIFEST.md : reference forPERMISSIONS.yaml and grants
• CONTRIBUTING.md ·SECURITY.md ·LICENSE (Apache-2.0)