claudeclaw

ClaudeClaw

Persistent agent orchestrator plugin for Claude Code. Multi-channel message routing, structured memory, webhook triggers, cost tracking — with OS-level sandbox isolation.

Built on NanoClaw — ported to a Claude Code plugin architecture with a pluggable extension system and Anthropic's sandbox runtime.

What It Does

ClaudeClaw is a Claude Code plugin that provides an always-on message loop. It listens to channels (Slack, WhatsApp, Telegram), routes messages to Claude agents running in isolated sandboxes, and manages ongoing conversations with structured memory.

Core (Orchestrator)

• Always-on message loop — persistent listener, not one-shot
• Multi-channel routing — Slack, WhatsApp, Telegram (pluggable)
• Thread management — auto-create threads, follow-ups without re-mentioning
• Context accumulation — messages batch between triggers
• Structured memory — daily logs, topic files, searchable archive with QMD upgrade path
• Webhook triggers — HTTP POST with HMAC-SHA256 auth for CI/CD, GitHub, monitoring
• Per-group agent config — model, tools, system prompt, cost limits per group
• Cost tracking — token usage and estimated cost per agent run
• Extension system — plug in triage, SWE queue, or custom capabilities
• Dual runtime — OS-level sandbox (default) or container isolation

Triage Extension

• First-level support agent — investigates bugs, analyzes feature requests
• Answers users in plain language (no code in user threads)
• Creates GitHub issues when code changes are needed
• Posts to dev channel for technical visibility
• SWE task queue for sequential coding work

Quick Start

git clone https://github.com/sbusso/claudeclaw.git
cd claudeclaw
claude
# type: /setup

/setup handles everything interactively: dependencies, runtime selection (sandbox is the default), channel authentication via platform APIs, group registration, and service startup.

Runtime Options

ClaudeClaw supports two agent execution runtimes. Set RUNTIME in .env:

	Sandbox (default)	Container
Cold start	<10ms	~2-5s
Memory overhead	None	VM per container
Network isolation	OS-level allowedDomains	Full outbound (credential proxy mitigates)
Credential model	Direct credentials + restricted network	Proxy service
Setup	npm install	Container daemon + image build
Filesystem isolation	Kernel-enforced read/write boundaries	Volume mounts

Sandbox Runtime (Recommended)

Uses Anthropic's @anthropic-ai/sandbox-runtime for OS-level process sandboxing. On macOS it uses Apple's Seatbelt framework; on Linux, bubblewrap. No containers, no VMs — kernel-level restrictions on an ordinary process.

# .env
RUNTIME=sandbox

Security model: Real credentials are passed to the agent, but network is restricted to api.anthropic.com and localhost only. There's nowhere to exfiltrate credentials to. Filesystem access is kernel-enforced per the generated settings file — the agent for a family chat literally cannot read files from a work channel's directory.

Agents run with permissionMode: 'bypassPermissions' — the sandbox IS the trust boundary, not application-level permission checks.

Container Runtime

Uses Apple Container (macOS) or Docker for container-based isolation. Agents run in Linux VMs with volume mounts. A credential proxy on localhost injects real API keys — containers never see actual credentials.

# .env
RUNTIME=container

Per-group override: set "runtime": "sandbox" in the registered group config to use sandbox for specific groups while others use containers.

Agent Triggers

ClaudeClaw agents can be triggered three ways: