Feedback claude sandbox disabled for workers

The nopriv-sandboxed behavior in Claude Code is a Linux user-namespace sandbox that is orthogonal to --dangerously-skip-permissions. Passing --dangerously-skip-permissions (as forge_spawn_session.sh does) only skips permission prompts; it does not disable the Bash sandbox.

Justin explicitly set sandbox.enabled: false in /home/justinwieb/.claude/settings.json so that all Claude Code sessions on Console, including workers spawned via the remote-bridge bot, run as justinwieb with full uid and sudo access.

Why: Spawned workers were hitting nopriv-sandboxed on every sudo call, breaking autonomous task execution. On a single-user dev VM already running with --dangerously-skip-permissions, the sandbox added no meaningful security benefit.

How to apply: If a future session re-enables the sandbox or a new settings.json is written, restore sandbox: { "enabled": false } at the top level. If a worker reports sudo failures, check this setting first before debugging the spawn flow.

[auto-memory session d049a823-7950-45de-925f-8a0ab1cc40a9, confidence 0.88, mode direct]

Auto-memory addendum 2026-05-01T07:42:05.652816¶

The sandbox.enabled: false setting was added to /home/justinwieb/.claude/settings.json to allow spawned workers full uid access including sudo.

Why: Claude Code's nopriv sandbox is orthogonal to --dangerously-skip-permissions. Passing --dangerously-skip-permissions in forge_spawn_session.sh only skips permission prompts; it does not disable the sandbox. Workers spawned via /spawn, /newbot in remote bridge bot, and claude -p pipe-mode workers all inherit user settings and were silently losing sudo access.

How to apply: If workers are reporting sudo failures or unexpected permission errors, check ~/.claude/settings.json for sandbox.enabled: false. If the setting is missing (e.g. after a settings reset), re-add it. Note: this setting applies to all claude processes running as the justinwieb user on Console; processes running as a different user or in an LXC without that settings file will not inherit it.

[auto-memory session d049a823-7950-45de-925f-8a0ab1cc40a9, confidence 0.85]