watchdeck shows every Claude Code session on your machine as a live map: every tool call, who decided it (your deny rules, Claude Code's auto check, you, the OS sandbox), and what was stopped. A denial becomes a rule in one click, written into Claude Code's own settings, so the next session never asks again. Local, private, one binary; nothing leaves your machine.
Why I built it: Claude Code's own controls are good, but each decision lives inside one session and disappears with it. I wanted one place that keeps every decision across sessions and projects, shows me what needs a rule, and writes that rule where Claude Code reads it. Where Claude Code has no control at all, scripts that skills run, MCP servers, named commands, watchdeck runs them in an OS sandbox (Seatbelt on macOS, bubblewrap on Linux) with no network and no access to credential paths unless you grant it.
What it does, concretely:
- A dashboard (`watchdeck` opens it): Home says whether you are protected and what needs you; Sessions is the map of every session, live, with a timeline per session; Rules is everything that limits an agent on this machine, strongest first, with an add sheet that previews the file it will write.
- A hook on Bash and the file tools that adds a few milliseconds per call (median 6.2 ms on my M-series Mac in the runs before the v0.1.0 tag, measured before every release and checked in CI).
- Leak watch: if a secret-shaped string shows up in a tool result or a reply, Home tells you where, never the secret itself.
- `watchdeck doctor --prove` runs the hook you installed against a built-in canary in a throwaway HOME and reports five checks, so "it is enforced" is something you can see.
What it does not do, up front: it cannot stop prose. A `SKILL.md` can still talk the model into misusing Read or WebFetch; only scripts are sandboxed. Network is on or off per subject; no hostname filtering yet. In my own headless study (18 sessions, three models, three scenarios), no planted marker leaked, but three WebFetch calls went around a refused `curl` untouched, so I added rules that cover every route to a host or a path with one intent. macOS is verified end to end; Linux passes CI but has not run on a developer machine. No Windows.
Releases are reproducible, signed (keyless cosign bundle), attested (GitHub build provenance), with an SBOM per archive, and the installer can verify all of that before it installs anything. Apache-2.0.
watchdeck shows every Claude Code session on your machine as a live map: every tool call, who decided it (your deny rules, Claude Code's auto check, you, the OS sandbox), and what was stopped. A denial becomes a rule in one click, written into Claude Code's own settings, so the next session never asks again. Local, private, one binary; nothing leaves your machine.
Why I built it: Claude Code's own controls are good, but each decision lives inside one session and disappears with it. I wanted one place that keeps every decision across sessions and projects, shows me what needs a rule, and writes that rule where Claude Code reads it. Where Claude Code has no control at all, scripts that skills run, MCP servers, named commands, watchdeck runs them in an OS sandbox (Seatbelt on macOS, bubblewrap on Linux) with no network and no access to credential paths unless you grant it.
What it does, concretely:
- A dashboard (`watchdeck` opens it): Home says whether you are protected and what needs you; Sessions is the map of every session, live, with a timeline per session; Rules is everything that limits an agent on this machine, strongest first, with an add sheet that previews the file it will write. - A hook on Bash and the file tools that adds a few milliseconds per call (median 6.2 ms on my M-series Mac in the runs before the v0.1.0 tag, measured before every release and checked in CI). - Leak watch: if a secret-shaped string shows up in a tool result or a reply, Home tells you where, never the secret itself. - `watchdeck doctor --prove` runs the hook you installed against a built-in canary in a throwaway HOME and reports five checks, so "it is enforced" is something you can see.
What it does not do, up front: it cannot stop prose. A `SKILL.md` can still talk the model into misusing Read or WebFetch; only scripts are sandboxed. Network is on or off per subject; no hostname filtering yet. In my own headless study (18 sessions, three models, three scenarios), no planted marker leaked, but three WebFetch calls went around a refused `curl` untouched, so I added rules that cover every route to a host or a path with one intent. macOS is verified end to end; Linux passes CI but has not run on a developer machine. No Windows.
Releases are reproducible, signed (keyless cosign bundle), attested (GitHub build provenance), with an SBOM per archive, and the installer can verify all of that before it installs anything. Apache-2.0.
Install: `curl -fsSL https://raw.githubusercontent.com/Panda-Taps-LLC/watchdeck/m... | sh` or `brew install Panda-Taps-LLC/tap/watchdeck`, then `watchdeck setup`. Remove it with `watchdeck uninstall`.
The ask: tell me what you see on your machine that it should have caught, and what rule you wanted that it could not write. I will answer every issue.