Put bounds on autonomous runs

01The goal

Bound an unattended claude -p run with least privilege, the sandbox, turn and spend limits, a review gate and a cost estimate — so it can work alone and still land inside lines you drew.

02The idea

1. 01Least privilege. dontAsk mode denies every call that would prompt, so allow only the folders the task edits and the one command it runs — Edit(./src/**), not Edit.
2. 02The sandbox. The operating system limits what an allowed command can write and reach. Make it strict, and required for the run to start.
3. 03Limits. --max-turns caps agentic turns; --max-budget-usd caps estimated spend.
4. 04A review gate. Deny git commit and git push — deny rules hold in every mode — and you read the diff and commit what you accept. dontAsk also refuses the forms a rule misses, such as git -C . push.
5. 05A cost estimate. Run one slice first, and set the spend limit from what the slice cost.

03The walkthrough

Work in your repository; src/ and test/ and npm test stand for your own. Save the bounds as .claude/bounded-run.json:

The sandbox keys are the quiet half: failIfUnavailable exits at startup if the sandbox cannot start, instead of quietly running commands unsandboxed; allowUnsandboxedCommands false is strict mode — the escape-hatch retry is off, and repository settings cannot loosen it from under a --settings file; autoAllowBashIfSandboxed false keeps sandboxed commands flowing through your permission rules and mode instead of being waved through. On Linux and WSL 2, the sandbox needs bubblewrap and socat installed.

Then the runner, scripts/bounded-run.sh:

1. 01Make it executable and commit both files, so everyone who runs the task gets the same bounds.
2. 02See a limit stop a run, once, cheaply: the same command with --max-budget-usd 0.01 exits non-zero with subtype error_max_budget_usd. The recorded total_cost_usd can sit above the limit — it includes the response that crossed it.
3. 03Estimate on a slice: run the script on one small part of the bigger task — "add a test for one untested function in src/<file>, run npm test, then commit the test." The summary shows success, the turns used, the estimated cost, and under denied the git commit the bounds refused. HEAD is unchanged and the new test sits uncommitted — that is the review gate holding.
4. 04Set the real limit from the slice: scale the figure to the whole task, with room to spare.
5. 05Be the gate: read every change with git status and git diff (the bounds file included), run the tests yourself, and commit only what you accept. For a second opinion, start a session and have a subagent review the diff in a fresh context.

04Your turn

Bound a real task in your repository that is bigger than one slice — tests for every untested function in one folder, say. The contract: scripts/bounded-run.sh "<task>" <result.json> runs it; every allow rule names one folder or one command (no bare Bash, no Bash(npm *)); the deny rules stop git commit and git push, each with the trailing " *"; the sandbox is on, strict, and required; there is a turn limit and a spend limit above your slice cost; and you read the diff and ran the tests before committing any of it.

Know what the bounds do not cover. Hooks and local MCP servers run outside the sandbox with full access, and a -p run loads them without asking — read them before a bounded run in any repo you did not write, or set disableAllHooks: true in the bounds file. The allowed npm test executes test code the run can edit; inside the sandbox that code can write the working directory (within .git, only hooks and config are protected), though a push cannot reach a remote — dontAsk refuses hosts you have not allowed. That is why the script prints HEAD before and after, and why your review covers every changed file. A dynamic workflow started by such a run needs its own allow rule for the Workflow tool — and its agents’ spend counts toward the budget.