Read this first¶
pAInapple Code is an MVP and is very YOLO-oriented — read this page before you run it anywhere that matters.
Permissions¶
Because the bridge runs Claude in headless mode (-p), any approval prompt — a file write, a Bash command — is auto-denied. There is no interactive "allow this?" dialog. For that reason, the best experience is in the Auto or YOLO (Bypass Permissions) modes, which are exactly the modes that give Claude the most freedom.
The permission modes available (configurable per session in the settings popup):
| Mode | Behavior |
|---|---|
| Plan | Read-only |
| Don't Ask (default) | Auto-deny unless pre-approved |
| Accept Edits | Auto-allow writes plus some basic Bash commands like cp or mv |
| Auto | Claude's AI classifier gates each tool call |
| YOLO | bypassPermissions — full access |
For details, see the Claude Code permission-modes docs.
Terminal¶
The terminal widget is a real shell
The terminal widget is a real PTY running as the user that started the server. Any prompt injection or other attack (including a compromised npm package pulled in during a task) can run arbitrary commands as that user.
This risk isn't unique to this project, but it's worth restating the consequences of running non-isolated AI agents that can fetch and execute arbitrary code from the internet — via npm, pip, or even this project itself.
Isolation¶
Always run in isolation
Run your Claude environment — especially a YOLO-oriented one — inside isolation: Docker, a VM, LXC, BSD jails, or similar. The Docker setup with the painapple-docker.sh wrapper is the easiest path to basic isolation.
If these concepts are unfamiliar, this MVP is probably not for you yet.
Network exposure¶
By default the server binds 127.0.0.1 over plain HTTP. Bind it to a non-loopback host and it auto-enables TLS with a self-signed certificate (browsers show a one-time certificate warning — see the --tls flag).
The password gate is not a firewall
Either way, the built-in auth is a single-password gate — not a substitute for proper network controls. For real public exposure, put the server behind your own reverse proxy and keep the bridge itself on loopback.