Codeman maintainer 353fe7ebcf fix: say what Allow network access really opens (release review) ...

The setting told users the sandbox and approvals stay on. With it on, a
command in Codex's sandbox can call Codeman's API, which can start a session
outside the sandbox with no approval prompt. Measured on codex 0.162.0 with
`codex sandbox`: a touch the sandbox refused landed through POST /api/sessions,
and from inside a Codeman pane it landed with a password set too, because a
pane inherits CODEMAN_PASSWORD. Without that password the same call gets 401.

The settings row, the wiki, the skill and the changeset now say so, the wiki
Security page and security-architecture name it, and the docs scope the claims
to what the code does: app-wide, local launches only, not cron jobs, and
--no-daemon is a local launch's flag. Agent-CLIs gains the --no-daemon
trade-off. A test pins that no surface sells the sandbox as still in charge.

Text only: the switch, the clamp and the launch are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-06 03:25:00 +01:00

..

_Footer.md

docs: publish docs/wiki as the user manual, with a sync workflow

2026-08-18 16:20:43 +02:00

_Sidebar.md

feat(discord): testable codeman notify, short-id route, wiki page, docs and glue tests

2026-10-29 21:46:06 +08:00

Agent-CLIs.md

fix: say what Allow network access really opens (release review)

2026-11-06 03:25:00 +01:00

Autonomous-Loops.md

docs: publish docs/wiki as the user manual, with a sync workflow

2026-08-18 16:20:43 +02:00

Codeman-Skill.md

fix: say what Allow network access really opens (release review)

2026-11-06 03:25:00 +01:00

Config-Backups.md

docs(discord): write down the lone-digit rule, which installs have codeman, and tidy comments

2026-10-30 09:12:41 +08:00

Contributing.md

Merge pull request #660: fix(test): make a bare vitest invocation use the isolated CI config

2026-10-22 19:53:43 +02:00

Core-Concepts.md

fix(cases): never delete another clone's files after a failed direct clone

2026-10-31 17:57:51 +08:00

Cron-Jobs.md

docs(cron): rewrap the single-line prompt paragraph

2026-10-21 08:10:00 +02:00

Custom-Model-Endpoints.md

fix: apply the review items for #755 at merge

2026-11-04 16:55:44 +01:00

Discord-Bridge.md

fix: keep credential files out of the file routes and Discord uploads (release review)

2026-11-04 17:28:52 +01:00

Docker-Cases.md

fix(#592): a docker case signs Copilot in inside the container, never by token

2026-10-18 08:05:34 +02:00

Driving-Codeman-From-An-Agent.md

Merge pull request #694: feat(agent): COD-529 add bounded inspection and guarded submission

2026-10-27 02:14:44 +01:00

FAQ.md

feat(copilot): plan-usage chip row for the monthly premium-request quota (#662)

2026-10-22 19:32:17 +02:00

Git-Worktrees.md

fix(#625): never remove a worktree that is, or holds, a Docker case workspace

2026-10-16 01:36:45 +02:00

Home.md

feat(discord): testable codeman notify, short-id route, wiki page, docs and glue tests

2026-10-29 21:46:06 +08:00

Hooks-And-Integrations.md

docs: tighten the inbox, push and idle-detection wording

2026-10-17 18:28:03 +02:00

HTTP-API.md

Merge pull request #676: feat(tabs): per-case default session group

2026-10-22 19:54:54 +02:00

Input-And-Voice.md

docs: finish dropping the stripped-newline rule from the input docs

2026-10-21 04:11:28 +02:00

Installation.md

feat(copilot): plan-usage chip row for the monthly premium-request quota (#662)

2026-10-22 19:32:17 +02:00

Keeping-Agents-Running.md

feat(copilot): plan-usage chip row for the monthly premium-request quota (#662)

2026-10-22 19:32:17 +02:00

Keyboard-Shortcuts.md

fix: apply the review items for #685 at merge

2026-10-24 14:05:12 +02:00

Mobile-Guide.md

fix(mobile): hold the PTY rows while the on-screen keyboard is up

2026-10-24 20:17:45 -04:00

Multi-User-Mode.md

docs(multi-user): document the settings read, system operations and own picks

2026-10-16 13:13:35 +02:00

Notifications-And-Approvals.md

feat(discord): testable codeman notify, short-id route, wiki page, docs and glue tests

2026-10-29 21:46:06 +08:00

Quick-Start.md

fix(shortcuts): Ctrl+W no longer closes a session

2026-10-06 15:46:49 +02:00

Remote-Access.md

fix(tunnel): give the unauthenticated tunnel its own acknowledgement

2026-10-26 03:13:25 -04:00

Remote-SSH-Sessions.md

docs(copilot): document GitHub Copilot CLI in full

2026-10-18 00:47:53 +08:00

Running-As-A-Service.md

docs(install): describe installer v2 and the Tailscale naming options

2026-09-20 21:38:12 +02:00

Security.md

fix: say what Allow network access really opens (release review)

2026-11-06 03:25:00 +01:00

Settings-Reference.md

fix: say what Allow network access really opens (release review)

2026-11-06 03:25:00 +01:00

The-Dashboard.md

feat(tabs): start a session beside any tab from an opt-in + in its actions

2026-10-24 20:29:00 -04:00

Tile-Grid.md

docs(tiles): a popped-out session frees its place too

2026-10-10 06:38:46 +02:00

Troubleshooting.md

Merge pull request #661: feat(config): timestamped config backups with a configurable folder and retention

2026-10-22 19:54:40 +02:00

Versioning.md

docs: publish docs/wiki as the user manual, with a sync workflow

2026-08-18 16:20:43 +02:00

Watching-Agents-Work.md

feat(toolbar): move "+" and the case gear into the case picker

2026-10-08 22:22:40 +02:00

Web-Tabs.md

docs(wiki): catch the manual up to 1.29.0 and add the three run modes it never had

2026-09-15 19:05:59 +02:00

Working-With-Files.md

Merge pull request #693: feat: edit history panel for local claude sessions (files edited, diffs, generated images)

2026-11-04 17:04:46 +01:00