surshar / claude-code
Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.
Built by Anthropic · github.com/anthropics
| A.devcontainer/Dockerfile |
| A.devcontainer/devcontainer.json |
| A.devcontainer/init-firewall.sh |
| A.vscode/extensions.json |
| ALICENSE.md |
| AREADME.md |
| @@ -1,0 +1,78 @@ | ||
| 1 | +FROM node:20 | |
| 2 | + | |
| 3 | +ARG TZ | |
| 4 | +ENV TZ="$TZ" | |
| 5 | + | |
| 6 | +# Install basic development tools and iptables/ipset | |
| 7 | +RUN apt update && apt install -y less \ | |
| 8 | + git \ | |
| 9 | + procps \ | |
| 10 | + sudo \ | |
| 11 | + fzf \ | |
| 12 | + zsh \ | |
| 13 | + man-db \ | |
| 14 | + unzip \ | |
| 15 | + gnupg2 \ | |
| 16 | + gh \ | |
| 17 | + iptables \ | |
| 18 | + ipset \ | |
| 19 | + iproute2 \ | |
| 20 | + dnsutils \ | |
| 21 | + aggregate \ | |
| 22 | + jq | |
| 23 | + | |
| 24 | +# Ensure default node user has access to /usr/local/share | |
| 25 | +RUN mkdir -p /usr/local/share/npm-global && \ | |
| 26 | + chown -R node:node /usr/local/share | |
| 27 | + | |
| 28 | +ARG USERNAME=node | |
| 29 | + | |
| 30 | +# Persist bash history. | |
| 31 | +RUN SNIPPET="export PROMPT_COMMAND='history -a' && export HISTFILE=/commandhistory/.bash_history" \ | |
| 32 | + && mkdir /commandhistory \ | |
| 33 | + && touch /commandhistory/.bash_history \ | |
| 34 | + && chown -R $USERNAME /commandhistory | |
| 35 | + | |
| 36 | +# Set `DEVCONTAINER` environment variable to help with orientation | |
| 37 | +ENV DEVCONTAINER=true | |
| 38 | + | |
| 39 | +# Create workspace and config directories and set permissions | |
| 40 | +RUN mkdir -p /workspace /home/node/.claude && \ | |
| 41 | + chown -R node:node /workspace /home/node/.claude | |
| 42 | + | |
| 43 | +WORKDIR /workspace | |
| 44 | + | |
| 45 | +RUN wget https://github.com/dandavison/delta/releases/download/0.18.2/git-delta_0.18.2_arm64.deb && \ | |
| 46 | + sudo dpkg -i git-delta_0.18.2_arm64.deb && \ | |
| 47 | + rm git-delta_0.18.2_arm64.deb | |
| 48 | + | |
| 49 | +# Set up non-root user | |
| 50 | +USER node | |
| 51 | + | |
| 52 | +# Install global packages | |
| 53 | +ENV NPM_CONFIG_PREFIX=/usr/local/share/npm-global | |
| 54 | +ENV PATH=$PATH:/usr/local/share/npm-global/bin | |
| 55 | + | |
| 56 | +# Set the default shell to bash rather than sh | |
| 57 | +ENV SHELL /bin/zsh | |
| 58 | + | |
| 59 | +# Default powerline10k theme | |
| 60 | +RUN sh -c "$(wget -O- https://github.com/deluan/zsh-in-docker/releases/download/v1.2.0/zsh-in-docker.sh)" -- \ | |
| 61 | + -p git \ | |
| 62 | + -p fzf \ | |
| 63 | + -a "source /usr/share/doc/fzf/examples/key-bindings.zsh" \ | |
| 64 | + -a "source /usr/share/doc/fzf/examples/completion.zsh" \ | |
| 65 | + -a "export PROMPT_COMMAND='history -a' && export HISTFILE=/commandhistory/.bash_history" \ | |
| 66 | + -x | |
| 67 | + | |
| 68 | +# Install Claude | |
| 69 | +# TODO(ben): Add this back in when we have a public release | |
| 70 | +# RUN npm install -g @anthropic-ai/claude-code | |
| 71 | + | |
| 72 | +# Copy and set up firewall script | |
| 73 | +COPY init-firewall.sh /usr/local/bin/ | |
| 74 | +USER root | |
| 75 | +RUN chmod +x /usr/local/bin/init-firewall.sh && \ | |
| 76 | + echo "node ALL=(root) NOPASSWD: /usr/local/bin/init-firewall.sh" > /etc/sudoers.d/node-firewall && \ | |
| 77 | + chmod 0440 /etc/sudoers.d/node-firewall | |
| 78 | +USER node |
| @@ -1,0 +1,52 @@ | ||
| 1 | +{ | |
| 2 | + "name": "Claude Code Sandbox", | |
| 3 | + "build": { | |
| 4 | + "dockerfile": "Dockerfile", | |
| 5 | + "args": { | |
| 6 | + "TZ": "${localEnv:TZ:America/Los_Angeles}" | |
| 7 | + } | |
| 8 | + }, | |
| 9 | + "runArgs": [ | |
| 10 | + "--cap-add=NET_ADMIN", | |
| 11 | + "--cap-add=NET_RAW" | |
| 12 | + ], | |
| 13 | + "customizations": { | |
| 14 | + "vscode": { | |
| 15 | + "extensions": [ | |
| 16 | + "dbaeumer.vscode-eslint", | |
| 17 | + "esbenp.prettier-vscode", | |
| 18 | + "eamodio.gitlens" | |
| 19 | + ], | |
| 20 | + "settings": { | |
| 21 | + "editor.formatOnSave": true, | |
| 22 | + "editor.defaultFormatter": "esbenp.prettier-vscode", | |
| 23 | + "editor.codeActionsOnSave": { | |
| 24 | + "source.fixAll.eslint": "explicit" | |
| 25 | + }, | |
| 26 | + "terminal.integrated.defaultProfile.linux": "zsh", | |
| 27 | + "terminal.integrated.profiles.linux": { | |
| 28 | + "bash": { | |
| 29 | + "path": "bash", | |
| 30 | + "icon": "terminal-bash" | |
| 31 | + }, | |
| 32 | + "zsh": { | |
| 33 | + "path": "zsh" | |
| 34 | + } | |
| 35 | + } | |
| 36 | + } | |
| 37 | + } | |
| 38 | + }, | |
| 39 | + "remoteUser": "node", | |
| 40 | + "mounts": [ | |
| 41 | + "source=claude-code-bashhistory,target=/commandhistory,type=volume", | |
| 42 | + "source=claude-code-config,target=/home/node/.claude,type=volume" | |
| 43 | + ], | |
| 44 | + "remoteEnv": { | |
| 45 | + "NODE_OPTIONS": "--max-old-space-size=4096", | |
| 46 | + "CLAUDE_CONFIG_DIR": "/home/node/.claude", | |
| 47 | + "POWERLEVEL9K_DISABLE_GITSTATUS": "true" | |
| 48 | + }, | |
| 49 | + "workspaceMount": "source=${localWorkspaceFolder},target=/workspace,type=bind,consistency=delegated", | |
| 50 | + "workspaceFolder": "/workspace", | |
| 51 | + "postCreateCommand": "sudo /usr/local/bin/init-firewall.sh" | |
| 52 | +} |
| @@ -1,0 +1,119 @@ | ||
| 1 | +#!/bin/bash | |
| 2 | +set -euo pipefail # Exit on error, undefined vars, and pipeline failures | |
| 3 | +IFS=$'\n\t' # Stricter word splitting | |
| 4 | + | |
| 5 | +# Flush existing rules and delete existing ipsets | |
| 6 | +iptables -F | |
| 7 | +iptables -X | |
| 8 | +iptables -t nat -F | |
| 9 | +iptables -t nat -X | |
| 10 | +iptables -t mangle -F | |
| 11 | +iptables -t mangle -X | |
| 12 | +ipset destroy allowed-domains 2>/dev/null || true | |
| 13 | + | |
| 14 | +# First allow DNS and localhost before any restrictions | |
| 15 | +# Allow outbound DNS | |
| 16 | +iptables -A OUTPUT -p udp --dport 53 -j ACCEPT | |
| 17 | +# Allow inbound DNS responses | |
| 18 | +iptables -A INPUT -p udp --sport 53 -j ACCEPT | |
| 19 | +# Allow outbound SSH | |
| 20 | +iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT | |
| 21 | +# Allow inbound SSH responses | |
| 22 | +iptables -A INPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT | |
| 23 | +# Allow localhost | |
| 24 | +iptables -A INPUT -i lo -j ACCEPT | |
| 25 | +iptables -A OUTPUT -o lo -j ACCEPT | |
| 26 | + | |
| 27 | +# Create ipset with CIDR support | |
| 28 | +ipset create allowed-domains hash:net | |
| 29 | + | |
| 30 | +# Fetch GitHub meta information and aggregate + add their IP ranges | |
| 31 | +echo "Fetching GitHub IP ranges..." | |
| 32 | +gh_ranges=$(curl -s https://api.github.com/meta) | |
| 33 | +if [ -z "$gh_ranges" ]; then | |
| 34 | + echo "ERROR: Failed to fetch GitHub IP ranges" | |
| 35 | + exit 1 | |
| 36 | +fi | |
| 37 | + | |
| 38 | +if ! echo "$gh_ranges" | jq -e '.web and .api and .git' >/dev/null; then | |
| 39 | + echo "ERROR: GitHub API response missing required fields" | |
| 40 | + exit 1 | |
| 41 | +fi | |
| 42 | + | |
| 43 | +echo "Processing GitHub IPs..." | |
| 44 | +while read -r cidr; do | |
| 45 | + if [[ ! "$cidr" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/[0-9]{1,2}$ ]]; then | |
| 46 | + echo "ERROR: Invalid CIDR range from GitHub meta: $cidr" | |
| 47 | + exit 1 | |
| 48 | + fi | |
| 49 | + echo "Adding GitHub range $cidr" | |
| 50 | + ipset add allowed-domains "$cidr" | |
| 51 | +done < <(echo "$gh_ranges" | jq -r '(.web + .api + .git)[]' | aggregate -q) | |
| 52 | + | |
| 53 | +# Resolve and add other allowed domains | |
| 54 | +for domain in \ | |
| 55 | + "registry.npmjs.org" \ | |
| 56 | + "api.anthropic.com" \ | |
| 57 | + "sentry.io" \ | |
| 58 | + "statsig.anthropic.com" \ | |
| 59 | + "statsig.com"; do | |
| 60 | + echo "Resolving $domain..." | |
| 61 | + ips=$(dig +short A "$domain") | |
| 62 | + if [ -z "$ips" ]; then | |
| 63 | + echo "ERROR: Failed to resolve $domain" | |
| 64 | + exit 1 | |
| 65 | + fi | |
| 66 | + | |
| 67 | + while read -r ip; do | |
| 68 | + if [[ ! "$ip" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then | |
| 69 | + echo "ERROR: Invalid IP from DNS for $domain: $ip" | |
| 70 | + exit 1 | |
| 71 | + fi | |
| 72 | + echo "Adding $ip for $domain" | |
| 73 | + ipset add allowed-domains "$ip" | |
| 74 | + done < <(echo "$ips") | |
| 75 | +done | |
| 76 | + | |
| 77 | +# Get host IP from default route | |
| 78 | +HOST_IP=$(ip route | grep default | cut -d" " -f3) | |
| 79 | +if [ -z "$HOST_IP" ]; then | |
| 80 | + echo "ERROR: Failed to detect host IP" | |
| 81 | + exit 1 | |
| 82 | +fi | |
| 83 | + | |
| 84 | +HOST_NETWORK=$(echo "$HOST_IP" | sed "s/\.[0-9]*$/.0\/24/") | |
| 85 | +echo "Host network detected as: $HOST_NETWORK" | |
| 86 | + | |
| 87 | +# Set up remaining iptables rules | |
| 88 | +iptables -A INPUT -s "$HOST_NETWORK" -j ACCEPT | |
| 89 | +iptables -A OUTPUT -d "$HOST_NETWORK" -j ACCEPT | |
| 90 | + | |
| 91 | +# Set default policies to DROP first | |
| 92 | +# Set default policies to DROP first | |
| 93 | +iptables -P INPUT DROP | |
| 94 | +iptables -P FORWARD DROP | |
| 95 | +iptables -P OUTPUT DROP | |
| 96 | + | |
| 97 | +# First allow established connections for already approved traffic | |
| 98 | +iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT | |
| 99 | +iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT | |
| 100 | + | |
| 101 | +# Then allow only specific outbound traffic to allowed domains | |
| 102 | +iptables -A OUTPUT -m set --match-set allowed-domains dst -j ACCEPT | |
| 103 | + | |
| 104 | +echo "Firewall configuration complete" | |
| 105 | +echo "Verifying firewall rules..." | |
| 106 | +if curl --connect-timeout 5 https://example.com >/dev/null 2>&1; then | |
| 107 | + echo "ERROR: Firewall verification failed - was able to reach https://example.com" | |
| 108 | + exit 1 | |
| 109 | +else | |
| 110 | + echo "Firewall verification passed - unable to reach https://example.com as expected" | |
| 111 | +fi | |
| 112 | + | |
| 113 | +# Verify GitHub API access | |
| 114 | +if ! curl --connect-timeout 5 https://api.github.com/zen >/dev/null 2>&1; then | |
| 115 | + echo "ERROR: Firewall verification failed - unable to reach https://api.github.com" | |
| 116 | + exit 1 | |
| 117 | +else | |
| 118 | + echo "Firewall verification passed - able to reach https://api.github.com as expected" | |
| 119 | +fi |
| @@ -1,0 +1,8 @@ | ||
| 1 | +{ | |
| 2 | + "recommendations": [ | |
| 3 | + "dbaeumer.vscode-eslint", | |
| 4 | + "esbenp.prettier-vscode", | |
| 5 | + "ms-vscode-remote.remote-containers", | |
| 6 | + "eamodio.gitlens" | |
| 7 | + ] | |
| 8 | +} |
| @@ -1,0 +1,3 @@ | ||
| 1 | +Claude Code is a Beta research preview per our [Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms). When you use Claude Code, we collect Feedback, which includes usage data such as code acceptance or rejections, as well as associated conversation data. We may use this Feedback to improve our products, although we will not train models using your Feedback from Claude Code. | |
| 2 | + | |
| 3 | +© Anthropic PBC. All rights reserved. Use is subject to Anthropic's [Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms). |
| @@ -1,0 +1,55 @@ | ||
| 1 | +# Claude Code (Research Preview) | |
| 2 | + | |
| 3 | + | |
| 4 | + | |
| 5 | +Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands. | |
| 6 | + | |
| 7 | +Some of its key capabilities include: | |
| 8 | + | |
| 9 | +- Edit files and fix bugs across your codebase | |
| 10 | +- Answer questions about your code's architecture and logic | |
| 11 | +- Execute and fix tests, lint, and other commands | |
| 12 | +- Search through git history, resolve merge conflicts, and create commits and PRs | |
| 13 | + | |
| 14 | +**Learn more in the [official documentation](https://docs.anthropic.com/en/docs/agents/claude-code/introduction)**. | |
| 15 | + | |
| 16 | +## Get started | |
| 17 | + | |
| 18 | +<ol> | |
| 19 | + <li> | |
| 20 | + Run the following command in your terminal: <br /> | |
| 21 | + <code>npm install -g @anthropic-ai/claude-code</code> | |
| 22 | + </li> | |
| 23 | + <li> | |
| 24 | + Navigate to your project directory and run <code>claude</code> | |
| 25 | + </li> | |
| 26 | + <li> | |
| 27 | + Complete the one-time OAuth process with your Anthropic Console account. | |
| 28 | + </li> | |
| 29 | +</ol> | |
| 30 | + | |
| 31 | +### Research Preview | |
| 32 | + | |
| 33 | +We're launching Claude Code as a beta product in research preview to learn directly from developers about their experiences collaborating with AI agents. Our aim is to learn more about how developers prefer to collaborate with AI tools, which development workflows benefit most from working with the agent, and how we can make the agent experience more intuitive. | |
| 34 | + | |
| 35 | +This is an early version of the product experience, and it's likely to evolve as we learn more about developer preferences. Claude Code is an early look into what's possible with agentic coding, and we know there are areas to improve. We plan to enhance tool execution reliability, support for long-running commands, terminal rendering, and Claude's self-knowledge of its capabilities -- as well as many other product experiences -- over the coming weeks. | |
| 36 | + | |
| 37 | +### Reporting Bugs | |
| 38 | + | |
| 39 | +We welcome feedback during this beta period. Use the `/bug` command to report issues directly within Claude Code, or file a [GitHub issue](https://github.com/anthropics/claude-code/issues). | |
| 40 | + | |
| 41 | +### Data collection, usage, and retention | |
| 42 | + | |
| 43 | +When you use Claude Code, we collect feedback, which includes usage data (such as code acceptance or rejections), associated conversation data, and user feedback submitted via the `/bug` command. | |
| 44 | + | |
| 45 | +#### How we use your data | |
| 46 | + | |
| 47 | +We may use feedback to improve our products and services, but we will not train generative models using your feedback from Claude Code. Given their potentially sensitive nature, we store user feedback transcripts for only 30 days. | |
| 48 | + | |
| 49 | +If you choose to send us feedback about Claude Code, such as transcripts of your usage, Anthropic may use that feedback to debug related issues and improve Claude Code's functionality (e.g., to reduce the risk of similar bugs occurring in the future). | |
| 50 | + | |
| 51 | +### Privacy safeguards | |
| 52 | + | |
| 53 | +We have implemented several safeguards to protect your data, including limited retention periods for sensitive information, restricted access to user session data, and clear policies against using feedback for model training. | |
| 54 | + | |
| 55 | +For full details, please review our [Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms) and [Privacy Policy](https://www.anthropic.com/legal/privacy). |