Page 121 of 128
Sandboxing is governed by three independent settings: mode (when it applies), scope (how many containers), and backend (where it runs). The most common failure is an expectation gap — `tools.exec.host` now defaults to auto, so 'unset means sandboxed' is no longer true, and the security audit has a check specifically for it.
By default every DM lands in one main session, and group activity and background work report back into it. Memory is entirely Markdown on disk — the model only remembers what gets saved, with no hidden state. But if more than one person can DM your agent, DM isolation is something you have to turn on.
OpenClaw's security docs open by stating the scope: this is a personal-assistant trust model, one gateway per trusted operator. It explicitly is not a security boundary for mutually adversarial users sharing one agent — and a 'not vulnerabilities by design' list pins that down.
OpenClaw's browser is a separate agent-only profile, fully isolated from your personal browser. And web_search's return shape carries an externalContent.untrusted marker — search results are typed as untrusted external content at the type level.
exec is a mutating shell surface: disabling write, edit, and apply_patch does nothing to make it read-only. And since sandboxing is off by default, host=auto actually resolves to the gateway — if you really want the sandbox, say so explicitly and it will at least fail closed.
Skills load from six sources with the highest precedence winning on name collisions, and a per-agent list replaces rather than merges. Sub-agents get no session or message tools by default — they return plain text to the parent, and the right to speak to a human stays with the parent agent.
When the tool catalog no longer fits in the prompt, OpenClaw offers two answers: Code Mode shows the model only exec and wait and has it write small programs against a hidden catalog, while Tool Search keeps structured search/describe/call controls. Neither bypasses tool policy.
The official triage flow is seven commands and two minutes to a diagnosis. And the most common symptom — the assistant feeling limited or missing tools — is usually the tool profile: minimal allows only session_status, while coding is the default for new local configs.
The Control UI gained a session rail: it uses a utility model to produce a run digest and attaches a read-only companion thread, so you can ask what a session is doing without entering or interrupting the main agent run. Its contents never enter chat.history.
The model is the CPU, the harness is the operating system, and the agent is the application. No matter how powerful a model is, without a good harness it's just a demo. Phil Schmid argues that harness is the most critical infrastructure in AI engineering for 2026.
The original Claude Code troubleshooting collection has been split into orders 33-35: installation & login, runtime problems, and config diagnosis. This page is their index.
Standard Playwright gets blocked by Cloudflare. Both playwright-extra + stealth and nodriver can bypass it. The final step is wrapping the solution into an MCP server so AI agents can use it automatically.
Agent Teams lets multiple full Claude Code sessions work as one team: a team lead assigns work while teammates each run their own context window, coordinating through point-to-point messaging and a shared task list. This post covers the three key differences from sub-agents, the trade-off between teammateMode display modes, and why token cost scales linearly with team size.
Anthropic's official Claude Code best practices boil down to one constraint: manage the context window. This post reorganizes their guidance into a working loop — explore, plan mode, implement with a runnable check, verify, commit — plus prompt techniques, when to /clear vs rewind, and the five failure patterns they call out.
Channels are a special kind of MCP server that push CI failures, monitoring alerts, and Telegram messages directly into a running Claude Code session — and Claude can answer back through the same channel via a reply tool. This post breaks down the channel contract, two-way replies, security gates, and install requirements.
Checkpointing is not git commits: Claude Code snapshots your files before every user prompt, keeps the 100 most recent per session, and deletes them after 30 days. This piece breaks down the five rewind menu options, the tracking boundaries (bash, subagents, symlinks), and how checkpoints divide labor with git.
Claude Code gains browser control through the Claude in Chrome extension: read console logs and DOM state, click, type, upload files, record GIFs, and operate sites you're already signed into. The official prerequisites list Chrome, Edge, and Chromium-based browsers such as Brave, Arc, Vivaldi, and Opera, but WSL is not supported.
Put Claude Code into GitHub Actions with anthropics/claude-code-action: /install-github-app sets everything up in one command, @claude in a PR or issue comment gets bugs fixed, branches pushed, and PR creation links returned; Bedrock/Vertex/Foundry backends switch via one input with OIDC and no stored keys; the GitLab CI/CD integration (beta) mirrors it as a single .gitlab-ci.yml job where every change flows through a merge request.
Every Claude Code session starts with a clean context window. Three memory mechanisms carry knowledge across sessions: CLAUDE.md files loaded every session, .claude/rules/ files that load conditionally via paths frontmatter, and auto memory Claude writes itself. All CLAUDE.md layers are concatenated into context — not inherited by override. This guide covers layer behavior, @path imports, monorepo strategies with nested CLAUDE.md, and sharing one instruction file across tools via @AGENTS.md.
Claude Code loads the system prompt, MEMORY.md, CLAUDE.md, MCP tool names, and skill descriptions before you type your first word. This post breaks down the startup context, what each of six extension features costs, and how to control auto-compaction with /compact, /autocompact, and autoCompactWindow.