env -i starts with an empty environment, so nothing leaks from my shell. The home directory is empty: no config, skills, memory, or history. The token is the same as for my current session; /ccu retrieves it from macOS Keychain. The subscription is the same, but there is no email: the Claude Code account profile is stored in .claude.json, which is written upon login, while home is clean here.

Permissions must be granted in advance

claude -p rejects any tool that requires confirmation: there is no one to approve it. Therefore, the main agent lists the tools required by the task in work/.claude/settings.json, for example, for a web task:

{"permissions": {"allow": ["WebFetch", "WebSearch", "Bash(curl:*)"]}}

In a folder that Claude Code does not trust, these settings are ignored, so /ccu also marks work as trusted in .claude.json inside home:

{"projects": {"<run dir>/work": {"hasTrustDialogAccepted": true}}}

The transcript stays with me

After the run, /ccu turns the raw session log into a readable transcript.md. The main agent passes along the instance’s response, but never reads the transcript.I can read it myself whenever I want.

What about the CMS?

Through /ccu, Claude Code recommended Payload.

┬─┬ノ( º _ ºノ)