A coding assistant in a container on the web
A starting mandate for agentbox: I attached a repository and I want it worked on: read it, change it, run things, commit, and push to that repository — that is why I attache…
Source: https://what-can-it-do.games.sgit.ai/map/mandates/coding-assistant-in-a-container/index.html↗ · site v0.8.0 · this file is generated from the same content
as the page, so the two cannot drift. Every page on this site has a .md twin; internal links
below point at them.
Play↗ / The map↗ / The mandates↗ / A coding assistant in a container on the web
A coding assistant in a container on the web
I attached a repository and I want it worked on: read it, change it, run things, commit, and push to that repository — that is why I attached it. The container is disposable, so what it does to the container's own files is its business. I do not want it signing as me, and I do not want it creating sessions or routines that keep going after this one ends.
Status: starting-point · authored 2026-09-09 · the site, as a starting point — not measured, not surveyed; the first thing to argue with · edit this mandate ↗
The delta
Against every profile this mandate applies to. ▲ is authority you did not ask for; ▼ is something you were counting on that is not there. The tally is at the bottom.
Legend: ▲ excess — it can, and you did not want it to · ▼ shortfall — it cannot, and you wanted it to · ✓ aligned — it can, and you wanted it to · – aligned — it cannot, and you did not want it to · ? it can, and the mandate does not say · · it cannot, and the mandate does not say
| Capability | Claude Code (web container) |
|---|---|
| filesystem | |
| Read the project it is working on | ✓ |
| Change the project it is working on | ✓ |
| Read any file the account can reach — unstated: host is the container, and the container is thrown away | ? |
| Change any file the account can reach | ? |
| Delete files anywhere the account can reach | ? |
| Read a retained record: shell history, past sessions | ▲ |
| process | |
| Run programs as the account | ✓ |
| Run programs inside its own sandbox only | · |
| network | |
| Reach a permitted list of hosts | ✓ |
| Reach any host on the internet | · |
| identity | |
| Read credentials stored where it runs — unstated: the only keys in the image are the session's own | ? |
| Act in accounts with the credentials it holds — unstated: the scoped platform token is how it pushes at all — not a want, not a refusal, a mechanism | ? |
| Change its own permission settings | · |
| communication | |
| Send a message to anyone | · |
| Read mail or chat it is connected to | · |
| code | |
| Commit to the repository it was pointed at | ✓ |
| Push to a code host (any branch it can reach) | ✓ |
| Sign commits with the key it holds | ▲ |
| Publish packages, images or pages under the name it holds | · |
| money | |
| Spend money or tokens against an account it holds | · |
| schedule | |
| Create something that outlives the turn where it runs (a cron, a service) | ? |
| Create something that outlives the session, on the platform (a routine, a scheduled trigger, a new session) | ▲ |
| browser | |
| Read every page you visit | · |
| The delta | ▲ 3 · ▼ 0 |
In words
- Claude Code — web container: excess — Sign commits with the key it holds; Read a retained record: shell history, past sessions; Create something that outlives the session, on the platform (a routine, a scheduled trigger, a new session). No shortfall.
The mandate, row by row
| Capability | Position | Note |
|---|---|---|
| Read the project it is working on↗ | want | |
| Change the project it is working on↗ | want | |
| Run programs as the account↗ | want | |
| Commit to the repository it was pointed at↗ | want | |
| Push to a code host (any branch it can reach)↗ | want | |
| Reach a permitted list of hosts↗ | want | |
| Sign commits with the key it holds↗ | do not want | |
| Create something that outlives the session, on the platform (a routine, a scheduled trigger, a new session)↗ | do not want | |
| Read a retained record: shell history, past sessions↗ | do not want | |
| Read any file the account can reach↗ | unstated | unstated: host is the container, and the container is thrown away |
| Read credentials stored where it runs↗ | unstated | unstated: the only keys in the image are the session's own |
| Act in accounts with the credentials it holds↗ | unstated | unstated: the scoped platform token is how it pushes at all — not a want, not a refusal, a mechanism |
You cannot deny the excess rows. The agent already has the access. What is left is how long you are prepared to live with each one and who says so — what to do next↗.