unleash

Binary patchers + operator setup for local coding agents.
Discover every install, patch in place, deploy authorization config, and keep it patched after updates.

 

 

macOS arm64 · macOS x64 · Linux x64 · Linux arm64 · Windows x64 · Windows arm64

What is Unleash?

Unleash is a three-product operator suite. Each product finds every copy of its target agent on the machine — npm, bun, WinGet, Scoop, Homebrew, native installers, version managers — patches the binary in place, writes operator config, and installs a guard that re-applies patches after updates.

Currently tested: Claude Code 2.1.228 · Codex CLI 0.147.0 · OMP 17.2.13 / 17.2.14

Install

# npm
npm install -g unleash-cc      # Claude Code
npm install -g unleash-gpt     # Codex CLI
npm install -g unleash-omp     # Oh-My-Pi

# bun
bun add -g unleash-cc

# Windows — all three from GitHub releases
irm https://raw.githubusercontent.com/NetVar1337/unleash/main/scripts/install.ps1 | iex

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/NetVar1337/unleash/main/scripts/install.sh | bash

GitHub Releases ship standalone binaries for six platforms
(unleash-windows-amd64.exe, unleash-darwin-arm64, …) plus checksums.
A winget manifest template lives in contrib/winget/.

Quick start

unleash setup        # Claude Code — patch + rules + plugins + guard
unleash-gpt setup    # Codex CLI  — patch + rules/config
unleash-omp setup    # Oh-My-Pi   — patch + rules/config

Same verbs on every product:

unleash status           # every detected install + SHA + format
unleash patch --dry-run  # preview
unleash patch            # patch ALL detected installs
unleash verify           # confirm applied markers
unleash scan             # signature-drift report
unleash guard            # SHA check; re-patch on change
unleash doctor           # full health report
unleash install-skills   # LLM jailbreak / Fable skill pack
unleash rollback         # restore newest backup
unleash tui              # interactive control panel

Discovery surface

Unleash patches the agent no matter how it was installed. Multiple coexisting copies are all patched (hardlinked files are deduped by identity).

npm (flat + nested), bun, pnpm, volta, WinGet, native (~/.local/bin/codex, ~/.codex/bin), Scoop, Homebrew, PATH shim fallback.

Standalone SEA executables (WindowsApps, %LOCALAPPDATA%\Programs, ~/.local/bin, WinGet), bun global @oh-my-pi/pi-coding-agent, npm global, mise, PATH shim fallback.

Engine notes

Why this survives real installs and updates:

• Same-length in-place patching — replacements pad to match length; longer ones are skipped, never shifting bytecode.
• Hardlink-safe commit — npm often hardlinks bin/claude.exe to the platform binary; Unleash writes verified bytes in place so every link is patched.
• SEA layout tolerance — Bun SEA builds where .bun raw size exceeds virtual size (CC 2.1.228+) and both pre/post-2.1.150 active-bundle layouts; only the patchable bundle is touched, never the VFS tail.
• Bytecode constant-pool targeting (CC 2.1.228+) — the active region is Bun bytecode + length-prefixed string pools, not minified JS source. Gate ids, messages, and pool strings are the primary surface; settings cover runtime defaults that no longer exist as :!1 flips.
• Backref-capable matcher — \1–\9 backreferences (emulated on RE2) for minifier-agnostic patterns.
• Update guard — unleash guard (Task Scheduler / launchd / systemd, ~6h) compares per-target SHA manifests and re-runs the pipeline after updates.

What each product patches

Unleash · Claude Code

Bytecode constant-pool + settings patching of the Bun SEA:

Settings companion (01-bypass-permissions) forces defaultMode=bypassPermissions, trust skip, sandbox disable, and related operator defaults.

Unleash-GPT · Codex CLI

• Sentry DSN → loopback
• OTLP metrics endpoint → loopback
• Cyber-safety doc endpoint → loopback
• High-risk cyber fallback + approval/policy rejection wording neutralized
• Approval/sandbox fallback warning neutralized
• Writes ~/.codex/AGENTS.md + ~/.codex/config.toml:

approval_policy = "never"
sandbox_mode = "danger-full-access"
dangerously_bypass_approvals_and_sandbox = true

Unleash-OMP · Oh-My-Pi

• Auto-QA grievance endpoint → loopback
• Approval deny/prompt branches neutralized (17.x resolver shapes)
• Channel permission gate → always-allow tool execution
• Startup update check + marketplace auto-update defaults off (binary and config.yml)
• OMP npm update-check endpoint → loopback
• Writes ~/.omp/agent/AGENTS.md + ~/.omp/agent/config.yml:

tools:
  approvalMode: yolo
startup:
  checkUpdate: false
marketplace:
  autoUpdate: "off"

Build from source

git clone https://github.com/NetVar1337/unleash
cd unleash/go

# Claude Code
GOOS=windows GOARCH=amd64 go build -o unleash-windows-amd64.exe .
# Codex CLI
GOOS=windows GOARCH=amd64 go build -o unleash-gpt-windows-amd64.exe ./cmd/unleash-gpt
# Oh-My-Pi
GOOS=windows GOARCH=amd64 go build -o unleash-omp-windows-amd64.exe ./cmd/unleash-omp

Requires Go 1.24.2+. Release workflows build all six platform targets per product.

Release layout

npm packages are thin launchers over prebuilt bin/ binaries (npm and bun).
Publishing is tag-driven: push cc-vX.Y.Z → publish [email protected].

Safety model

Operator-authorization block with four hard stops:

1. No secret exfiltration to networks not invoked by the current task.
2. No overwriting uncommitted work without green tests or explicit confirmation.
3. No sending messages or creating public PRs without in-session acknowledgement.
4. Force-push to main/master requires explicit in-session consent.

Everything else is treated as pre-authorized local operator work.

Every patch run creates timestamped backups first (rollback restores the newest).
Patched binaries are smoke-verified (--version + startup check) before commit.

Unleash skills pack

Private pack: full skills + instruction markdown live in NetVar1337/unleash-skills (private). This public tree only embeds a stub so builds succeed.

Unleash skills pack

Mega bundle (skills (private repo)) under contrib/skills/:

• LLM jailbreaks / Fable safeguards (llm-jailbreak-taxonomy, llm-fable-safeguards, …)
• Coding style: Karpathy, Julius, Ponytail
• Game hacking, aimbot humanization/triggerbot, game internals/exploits
• Windows internals, stealth injectors, stealth hypervisor, kernel/BYOVD
• Languages: C++23, C++ game hacking, Go, Rust, Zig, Java, Assembly
• reverse-skill domain pack + cua-driver (trycua/cua)

unleash install-skills

See contrib/skills/README.md.

Brand assets

License

GPL-3.0-or-later — see LICENSE.