Queue code tasks from AI workspace to local machine safely

cowork-to-code-bridge queues a named script through a shared local directory so it runs on a machine the user owns or administers, for work that cannot be completed in the current sandbox. The bridge daemon and its scripts run with the local account's own permissions - they can reach local files, credentials, processes, and outbound network connections available to that account, so every queued task should be treated as execution on the user's real machine. Opening no inbound port does not, by itself, make a queued task safe.

Use it only when every one of these holds: the user explicitly asked for work on their own machine; the bridge was already installed and independently verified by the owner; the exact local path, action, permission scope, and expected output are known; the action genuinely cannot be done safely in the current sandbox; and either a fixed approved script covers it, or the user explicitly approves the stronger run_claude.sh path. Named examples are a disk-health check, a repository status check, or a bounded edit in one named worktree. Do not activate this skill for a generic "write code" or "edit files" request that the current environment can already handle. The skill also does not endorse the upstream one-line installer: even at the reviewed commit, that installer still resolves mutable inputs (a PyPI version range, GitHub main fallbacks, a bridge_client.py fetch from main, optional Homebrew/Python/Claude-CLI installs), so pinning only install.sh does not pin what actually gets installed - a new install should wait for an independent owner audit or an immutable install path, never a piped-to-shell run.

The core API is call_remote (run one short fixed approved script and wait), queue_task (queue bounded work, return a task_id, used for anything over roughly 30 seconds), poll_task_result (read the current result without re-running), and cancel_task (cancel queued work or signal an in-flight process group) - state-changing calls always need a stable, operation-specific idempotency_key. Before queueing anything, nine machine-side preconditions must be confirmed, including that BRIDGE_ROOT is an owner-only absolute path, BRIDGE_ALLOW_UNAUTH is disabled, BRIDGE_CLAUDE_AUTOINSTALL=0, BRIDGE_PERMISSION_CEILING is set to an exact value like readonly or edit and confirmed in startup logs, and a per-task budget ceiling is configured. Results can fail with known negative exit codes - timeout (-2), spawn failure (-3), daemon crash (-4), cancellation (-5) - and a daemon crash leaves side-effect state unknown, so the target must be inspected before any retry.

scripts/run_claude.sh can invoke a full local coding agent from a free-form task, gated behind a two-stage flow: first a plan-scope task (capped by max_budget_usd and timeout) whose returned plan the user must explicitly approve - silence or the presence of a plan field is not approval, since the optional approve_plan.sh hook is not installed by default. Only after approval does an edit-scope task run, and its task logs must confirm the daemon generated the expected tool mapping with no CLAUDE_FLAGS override widening it, since the upstream --allowedTools mapping is not a hard deny. A full-scope task restores the local agent's normal command and credential reach and should only run on a machine already isolated to the minimum account, worktree, credentials, and network access required.

Users or agents who already own and have independently verified this bridge on their own machine, and need a small number of specific, pre-approved operations run there under an explicit permission ceiling - not a general remote code-execution channel for arbitrary or unreviewed scripts.

git init cowork-to-code-bridge-review
cd cowork-to-code-bridge-review
git remote add origin https://github.com/abhinaykrupa/cowork-to-code-bridge.git
git fetch --depth=1 origin 97f515d425df587c281effb02cda9ad0fd470790
git checkout --detach FETCH_HEAD
test "$(git rev-parse HEAD)" = "97f515d425df587c281effb02cda9ad0fd470790"
shasum -a 256 install.sh LICENSE