Watchdeck: See what every Claude Code session was stopped from doing

Panda-Taps LLC released watchdeck v0.1.0 on November 4, 2026, delivering a local monitoring binary that visualizes active Claude Code sessions on a host machine, according to github.com's report. The open-source Apache-2.0 utility tracks every individual tool invocation across parallel agent sessions, identifies which component decided each action, and lets developers convert interactive permission denials into persistent guardrail rules with one click. Enforcement on macOS is verified end to end, while Linux sandboxing relies on bubblewrap, which passes continuous integration checks.

This release targets software engineers and system administrators running Anthropic's Claude Code coding agent locally who need visibility over multi-session filesystem access, shell executions, and credential exposure. The software operates strictly on the local machine without cloud telemetry or external network calls, binding an administrative dashboard to 127.0.0.1 behind an authentication token. Developers can observe live sessions, isolate tool scripts inside operating system sandboxes, inspect permission denials across project workspaces, and test candidate restriction rules against potential commands before committing them to configuration files.

What shipped in See what every Claude Code session was

The core package delivers the watchdeck compiled binary alongside an optional Claude Code interface plugin. Operating as a single executable, the software runs a local web dashboard that displays live sessions ordered first, showing the most recent tool calls for each session structured as an activity lane. The tool includes a Leak watch engine that scans tool inputs, agent replies, and execution output for secret-shaped strings. When suspicious patterns appear, the dashboard logs a dedicated Secret seen alert inside an action queue labelled Needs you, identifying the source session and location while discarding the raw secret string to avoid storage leakage.

The binary ships with an integrated command-line interface providing setup, diagnostic, and lifecycle commands. Running setup triggers a sandbox self-test, applies suggested security baselines, and adds required Claude Code settings after prompting the developer for explicit confirmation before each disk modification. The companion Claude Code plugin displays a persistent status band directly above the interactive terminal prompt, exposing native slash commands including /watchdeck:open and /watchdeck:status. The system stores its search index and activity records locally under the user's state directory with restricted file permissions set to mode 0600.

What improved in See what every Claude Code session was

Standard Claude Code auto mode restricts decision-making to a single active session in isolation, displaying blocked actions solely through a temporary Recently denied tab tied to that specific process. The new release bridges cross-session boundaries by consolidating historical and live decisions across every project workspace on the machine into a unified ledger. When a developer blocks an action, the platform generates linked rules that simultaneously write to Claude Code's native deny rules, search rules, and shell execution rules, enabling administrators to remove or adjust the entire security constraint in a single transaction.

The sandboxing architecture also expands coverage for external extensions. While Claude Code lacks native isolation for Model Context Protocol servers and skill scripts, the binary wraps each server and script in dedicated operating system sandbox boundaries. Users can activate temporary permission grants using an Allow for a while feature, which suspends a rule for one hour or one session, or expands a skill sandbox for up to eight hours before automatically reverting without overriding explicit underlying blocks.

What you gain from See what every Claude Code session was

Engineers gain centralized visibility over autonomous agent behavior across overlapping terminal windows, eliminating blind spots where background agents touch files or invoke shell commands. The dashboard's rules overview organizes all active machine restrictions ordered by protective strength, featuring dedicated execution counters and timestamps that show exactly how often each rule was triggered. A built-in rule trial box allows developers to dry-run commands, filesystem paths, or remote URLs against established rules to verify security posture before an agent executes them in real time.

Operational safety improves through explicit governance over automated permission loops. The tool was evaluated across 18 headless testing sessions on October 20 and October 21, 2026, followed by four additional validation runs on October 25, 2026, testing rule persistence and leak protection when models encounter blocks. While the system stops direct execution misuse, it maintains clear architectural limits: prose instructions in SKILL.md files directing standard read operations are not rewritten, interactive bypassPermissions modes drop sandbox modifications, and shell commands constructed dynamically at runtime through piping utilities like sed, tr, or base64 cannot be evaluated ahead of execution.

How to get See what every Claude Code session was

Installation is supported across direct shell scripts, Homebrew, source compilation, and native agent plugins. Developers on macOS or Linux can install the signed release binary using the official installation script or package manager:

curl -fsSL https://raw.githubusercontent.com/Panda-Taps-LLC/watchdeck/main/scripts/install.sh | sh

To verify build provenance with the GitHub CLI or cosign prior to installation, append the verification flag to the shell execution:

curl -fsSL https://raw.githubusercontent.com/Panda-Taps-LLC/watchdeck/main/scripts/install.sh | sh -s -- --verify

Homebrew users on supported platforms can add the Panda-Taps tap and install the binary package directly:

brew install Panda-Taps-LLC/tap/watchdeck

To build from source on workstations with Go version 1.27 or higher, clone the repository, compile the binary to the local path, and initialize configuration:

git clone https://github.com/Panda-Taps-LLC/watchdeck && cd watchdeck
go build -o ~/.local/bin/watchdeck ./cmd/watchdeck && watchdeck setup

Once the binary is installed on the local system path, open Claude Code and install the visual terminal status band and slash commands from the marketplace:

/plugin install watchdeck --marketplace Panda-Taps-LLC/watchdeck

What to watch after See what every Claude Code session was

Developers should monitor host system configuration and installation health using diagnostic commands. Running watchdeck doctor executes a comprehensive system verification check, outputting a line-by-line validation report alongside remediation steps for broken configuration hooks or missing permissions. If an agent or user alters local Claude Code preferences outside the utility, doctor identifies the missing hooks immediately. In environments where repository index creation is unnecessary or sensitive, running watchdeck ui --no-transcripts disables transcript parsing across the local ~/.claude/projects directory while retaining session activity monitoring.

Future updates will center on expanding sandbox verification beyond the current platform tier. While macOS kernel enforcement is verified end to end in production configurations, the Linux bubblewrap isolation layer currently relies on continuous integration validation without verified runs across physical developer machines. Organizations tracking integrity can validate release archives against published keyless cosign bundles and Rekor transparency logs using the repository's verification scripts. Complete uninstallation remains available at any time via watchdeck uninstall, which removes all binary hooks and configuration adjustments in a single confirmed operation.