Unleashed

Permission bypass for Claude Code — with a safety net.

Unleashed is a PTY wrapper that intercepts Claude Code's permission prompts and auto-approves them, enabling fully autonomous coding sessions. Sentinel — the integrated safety gate — evaluates commands before approval using a three-tier architecture: fast local rules, Haiku API evaluation, and fail-open error handling.

The Problem

The Solution

flowchart TD
    CC["Claude Code<br/>(runs in PTY)"]
    PTY["PTY Reader<br/>(3 threads)"]
    DETECT{"Permission<br/>Prompt?"}
    LOCAL{"Tier 1: Local Rules<br/>(regex, less than 1ms)"}
    API{"Tier 2: Haiku API<br/>(LLM, 1-3s)"}
    APPROVE["Auto-Approve<br/>(send CR)"]
    BLOCK["Block<br/>(user decides)"]
    FAILOPEN["Fail-Open<br/>(approve + warn)"]
    MIRROR["Session Mirror<br/>(clean transcript)"]

    CC -->|"raw bytes"| PTY
    PTY --> DETECT
    DETECT -->|"No"| MIRROR
    DETECT -->|"Yes"| LOCAL

    LOCAL -->|"ALLOW"| APPROVE
    LOCAL -->|"BLOCK"| BLOCK
    LOCAL -->|"UNCERTAIN"| API

    API -->|"ALLOW"| APPROVE
    API -->|"BLOCK"| BLOCK
    API -->|"ERROR"| FAILOPEN
    FAILOPEN --> APPROVE

    style APPROVE fill:#4ade80,stroke:#333,color:#000
    style BLOCK fill:#ef4444,stroke:#333,color:#fff
    style FAILOPEN fill:#fbbf24,stroke:#333,color:#000
    style LOCAL fill:#60a5fa,stroke:#333,color:#000
    style API fill:#a78bfa,stroke:#333,color:#000

Key Features

Architecture

Three threads manage the PTY lifecycle:

Worker threads handle sentinel API calls without blocking the PTY reader. See Architecture wiki for the full technical breakdown.

Quick Start

# 1. Clone and install
git clone https://github.com/martymcenroe/unleashed.git
cd unleashed && poetry install

# 2. Add the tier system to ~/.bash_profile
_unleashed_run() {
  local script="$1"; shift
  local project_path
  project_path="$(cygpath -w "$(pwd)")"
  (cd /c/Users/mcwiz/Projects/unleashed && \
   poetry run python "src/$script" --cwd "$project_path" "$@")
}

unleashed() {
  _unleashed_run unleashed-c-21.py --sentinel-shadow --mirror --friction "$@"
}

# 3. Run from any project directory
cd ~/Projects/my-project
unleashed

# 4. Optional: beta/alpha tiers for testing new versions
unleashed-beta() {
  _unleashed_run unleashed-c-22.py --mirror --friction "$@"  # example
}

See Version Promotions for the tier system and promotion workflow.

Sentinel Safety Gate

Sentinel evaluates commands through three tiers before auto-approval:

Scope Configuration

# Bash commands only (default)
--sentinel-scope bash

# Bash + file operations
--sentinel-scope write

# All tool types (audit mode)
--sentinel-scope all

# Observe without acting
--sentinel-shadow

See Sentinel Safety Gate wiki for the full deep dive.

Session Mirror

The session mirror produces clean, human-readable transcripts from Claude Code's Ink-rendered PTY output. The pipeline:

1. Rate-limited buffer (200ms accumulation — catches mid-repaint artifacts)
2. ANSI stripping (cursor-tracking parser removes escape sequences)
3. Garbage filter (95 compiled regex patterns remove rendering noise)
4. Dedup (suppresses progressive repaint repetitions)

See Session Mirror wiki for the rendering challenge story.

Roadmap

All 45+ open issues are organized on the Unleashed Roadmap project board.

See Roadmap wiki for the full prioritized list.

Documentation

Wiki

Architecture Decision Records

About

Built by a Professional Engineer who needs autonomous AI coding sessions to be productive — but also needs them to not destroy his file system.

Unleashed exists because of a fundamental tension: productivity requires trust, and trust requires safety. Claude Code's permission system is the right default for interactive use. But for autonomous sessions — the kind where you step away for 45 minutes and come back to finished work — manual approval defeats the purpose.

The sentinel integration is the answer to "how do you auto-approve safely?" Not by trusting blindly, and not by blocking everything, but by making fast local decisions for the obvious cases and consulting an AI for the ambiguous ones. And when even the AI can't help (API down, timeout, error), by failing open with a warning rather than freezing the session.

This is a single-user developer tool. The threat model, the design decisions, and the tradeoffs all reflect that context. For the full story, see Lessons Learned.

License

PolyForm Noncommercial 1.0.0