{"slug": "watchdeck-see-what-every-claude-code-session-was-stopped-from-doing", "title": "Watchdeck: See what every Claude Code session was stopped from doing", "summary": "Panda-Taps-LLC released watchdeck v0.1.0 on 2026-11-04, an Apache-2.0-licensed local tool that maps every Claude Code session on a machine, records each tool call and who decided it, and converts a denial into a rule in one click. The tool writes the Claude Code deny and ask rules that auto mode applies before its own check, and runs skill scripts and MCP servers in their own OS sandbox where Claude Code has no sandbox; macOS enforcement is verified end to end, while Linux (bubblewrap) passes CI but has not run on a developer machine. watchdeck ships as a single binary installable via curl script with optional --verify provenance checking, a Homebrew tap, a Claude Code plugin, or a Go 1.27+ source build, and also flags secret-shaped strings in tool results, replies and tool inputs as \"Secret seen\" rows without holding the secret.", "body_md": "watchdeck shows every Claude Code session on your machine as a live map, every tool call with who decided it, and turns a denial into a rule in one click. Local, private, one binary.\n\n```\ncurl -fsSL https://raw.githubusercontent.com/Panda-Taps-LLC/watchdeck/main/scripts/install.sh | sh\n```\n\nAdd `--verify` (`curl … | sh -s -- --verify`) to check the release's provenance with the GitHub CLI or cosign before anything is installed. The script comes from the `main` branch and installs the latest release; `--version vX.Y.Z`, with the script fetched from that tag's URL instead of `main`, pins both. Or from the Homebrew tap, whose formula is updated with each release:\n\n```\nbrew install Panda-Taps-LLC/tap/watchdeck\n```\n\nOr, typed inside Claude Code, the plugin, which gives the band above the prompt, `/watchdeck:open` and `/watchdeck:status`; it needs the binary too, so it comes after one of the two installs above:\n\n```\n/plugin install watchdeck --marketplace Panda-Taps-LLC/watchdeck\n```\n\nOr build from source (Go 1.27+):\n\n```\ngit clone https://github.com/Panda-Taps-LLC/watchdeck && cd watchdeck\ngo build -o ~/.local/bin/watchdeck ./cmd/watchdeck && watchdeck setup\n```\n\n`setup` tests the sandbox, offers the recommended rules and adds the Claude Code settings watchdeck needs, asking before each write. `watchdeck uninstall` removes all of it in one confirmed step.\n\n<sub>The left half of the GIF is a rendering of a terminal, labelled demo. The right half is the dashboard on a fixture home with synthetic sessions. How both were made: [docs/images/README.md](https://github.com/Panda-Taps-LLC/watchdeck/blob/main/docs/images/README.md).</sub>\n\n**Status:** v0.1.0, 2026-11-04. macOS enforcement is verified end to end. Linux (bubblewrap) passes CI but has not run on a developer machine. License: Apache-2.0.\n\nBesides the map and the one-click rule:\n\n- **Leak watch.** A secret-shaped string in any session's tool results, replies or tool inputs becomes a \"Secret seen\" row in Needs you, saying where it was seen and never holding the secret.\n- **Rules that cover every route.** One rule for a path, a domain or a command is written as every rule that reaches it (Claude Code's own rule, a search rule, a shell rule) and removed as one; skill scripts are not covered.\n- **Allow for a while.** Pause one of watchdeck's own rules for an hour or a session, or widen a skill's sandbox for up to eight hours; it ends by itself and never allows what Claude Code refused.\n- **Rule counts and a try box.** Each rule shows how often it fired and when, and you can try a command, a path or a URL against your saved rules before a session does.\n\n<sub>Every session, live ones first, with the last calls of each as a lane.</sub>\n\n<sub>Everything that limits an agent on this machine, strongest first; try a call against it, or add a rule in one step.</sub>\n\n<sub>A denial becomes a rule, or is acknowledged, and the list empties.</sub>\n\nAuto mode decides one call at a time, inside one session, and its Recently denied tab shows only that session. watchdeck keeps every decision from every session on the machine, and writes the Claude Code deny and ask rules that auto mode applies before its own check. Where Claude Code has no sandbox, such as a skill's scripts or an MCP server, watchdeck runs each one in its own OS sandbox.\n\n- **Prose instructions.** A`SKILL.md` can still talk the agent into misusing Read or WebFetch; only scripts are sandboxed.\n- **Auto mode's own decisions.** watchdeck records them and turns them into rules, but it does not change how Claude Code's check decides.\n- **`bypassPermissions` mode.** Claude Code can settle an ask there without you, so watchdeck's asks drop the sandbox rewrite; an interactive bypass session is not verified.\n- **A person turning it off.** Anyone who can edit your Claude Code settings can remove watchdeck's hooks;`watchdeck doctor` says when it is not installed.\n- **Commands built at run time.** Words another program produces when the command runs, such as`tr` ,`sed` or`base64` output piped into a shell, are not seen.\n- **Anything outside Claude Code.** A program running as you that Claude Code did not start is out of reach.\n\nThe full list, with the tests behind each line: [docs/GUIDE.md](https://github.com/Panda-Taps-LLC/watchdeck/blob/main/docs/GUIDE.md#what-this-does-not-do).\n\nWhat the models actually did when told no, in 18 headless sessions on 2026-10-20 and 2026-10-21, and four more on 2026-10-25 with a rule for every route and leak watch: [docs/DENIED.md](https://github.com/Panda-Taps-LLC/watchdeck/blob/main/docs/DENIED.md).\n\nEverything stays on this machine. The dashboard listens on 127.0.0.1 only, behind a token, and there is no telemetry. Transcripts are read read-only: when the dashboard builds its session index over `~/.claude/projects` and when you open a session. Of them, watchdeck keeps only a local search index, and `watchdeck ui --no-transcripts` turns both off. The index and watchdeck's own activity log are files in your state directory, mode 0600.\n\nEvery release ships `checksums.txt`, a keyless cosign bundle `checksums.txt.sigstore.json` and a GitHub build-provenance attestation, all made by this repository's release workflow for the tag. With cosign 3.x (`brew install cosign`):\n\n```\ntag=v0.1.0          # the release you downloaded; the archive, checksums.txt and checksums.txt.sigstore.json sit beside each other\ncosign verify-blob \\\n  --certificate-identity \"https://github.com/Panda-Taps-LLC/watchdeck/.github/workflows/release.yml@refs/tags/$tag\" \\\n  --certificate-oidc-issuer https://token.actions.githubusercontent.com \\\n  --bundle checksums.txt.sigstore.json checksums.txt\ngrep watchdeck_0.1.0_darwin_arm64.tar.gz checksums.txt | shasum -a 256 -c    # your archive; sha256sum -c on Linux\n```\n\nA second channel, Rekor plus the workflow identity rather than a second download: `gh attestation verify watchdeck_0.1.0_darwin_arm64.tar.gz --repo Panda-Taps-LLC/watchdeck --signer-workflow Panda-Taps-LLC/watchdeck/.github/workflows/release.yml`. What a failure means and what to send us: [SECURITY.md](https://github.com/Panda-Taps-LLC/watchdeck/blob/main/SECURITY.md#verify-a-release). For maintainers, `scripts/verify-release.sh <tag>` runs the cosign block on `checksums.txt`, the `gh` block on every archive and every sha256 of a release. The installer runs the `gh` line for you with `--verify` (the cosign line when `gh` is not signed in) and installs nothing when it fails; designed, not tested against a real release. The first signed release comes with the public repository.\n\n| Command | What it does | \n|---|---|\n| `watchdeck` | Opens the dashboard in your browser, starting it in the background if needed | \n| `watchdeck setup` | First run: sandbox self-test, recommended rules, the Claude Code settings watchdeck needs; asks before each write | \n| `watchdeck status` | One screen: protection, live sessions, what needs you, the dashboard and the install checks | \n| `watchdeck rules` | Every rule on this machine, strongest first, and one place to add one | \n| `watchdeck doctor` | Checks the install, one line per check with the fix for each problem | \n| `watchdeck uninstall` | Removes watchdeck in one confirmed step, with what it wrote to your Claude Code settings | \n\nMore commands: `watchdeck help advanced`.\n\n- [docs/GUIDE.md](https://github.com/Panda-Taps-LLC/watchdeck/blob/main/docs/GUIDE.md) : every command, the dashboard, rules and policies, MCP sandboxing, limits and troubleshooting\n- [docs/DESIGN.md](https://github.com/Panda-Taps-LLC/watchdeck/blob/main/docs/DESIGN.md) : the design, and what is verified and how\n- [docs/MANIFEST.md](https://github.com/Panda-Taps-LLC/watchdeck/blob/main/docs/MANIFEST.md) : reference for`PERMISSIONS.yaml` and grants\n- [CONTRIBUTING.md](https://github.com/Panda-Taps-LLC/watchdeck/blob/main/CONTRIBUTING.md) ·[SECURITY.md](https://github.com/Panda-Taps-LLC/watchdeck/blob/main/SECURITY.md) ·[LICENSE](https://github.com/Panda-Taps-LLC/watchdeck/blob/main/LICENSE) (Apache-2.0)", "url": "https://wpnews.pro/news/watchdeck-see-what-every-claude-code-session-was-stopped-from-doing", "canonical_source": "https://github.com/Panda-Taps-LLC/watchdeck", "published_at": "2026-11-05 20:33:54+00:00", "updated_at": "2026-11-05 20:51:49.851327+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "ai-safety", "developer-tools"], "entities": ["Panda-Taps-LLC", "watchdeck", "Claude Code", "Anthropic", "Homebrew", "GitHub", "bubblewrap", "Go"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/watchdeck-see-what-every-claude-code-session-was-stopped-from-doing", "markdown": "https://wpnews.pro/news/watchdeck-see-what-every-claude-code-session-was-stopped-from-doing.md", "text": "https://wpnews.pro/news/watchdeck-see-what-every-claude-code-session-was-stopped-from-doing.txt", "jsonld": "https://wpnews.pro/news/watchdeck-see-what-every-claude-code-session-was-stopped-from-doing.jsonld"}}