A device_bash tool runs local sandboxed shell commands for cloud sessions, gated on the tengu_violin_wood flag and a bound device.
A new tool called device_bash lets a session running in the cloud execute a shell command on the machine where Claude Code is running, inside its OS sandbox, and return the output. It takes command plus an optional timeout_ms. It is off unless the remote-config flag tengu_violin_wood turns on the device bridge, and it still refuses without a server-asserted session and a bound device id.
- registered alongside the existing device-info probe on the same bridge; the bridge itself starts only behind an async remote-config check that falls back to off on error
- the tool description tells the model explicitly that this is the local device, not the cloud container
- a per-device-connection concurrency cap limits how many commands can run at once
- commands run with sandboxing, protection against changing the working directory, and credential scrubbing of the environment
Run a shell command on the user's local machine (the device running Claude Code), inside Claude Code's OS sandbox.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
tengu_violin_wood Off in both readingsThe flag server returned off for the account this site reads and for the anonymous baseline. A reading of off cannot rule out a rollout these two readings sit outside of.
This account: off · anonymous baseline: off · compiled default in v2.1.227: not a boolean we can read
These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.
Read once, for one account on one subscription tier, against v2.1.227. It isn't a statement about your account. What a flag value here can and cannot tell you
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
New in this build: tengu_violin_wood