blueclawCommand execution
Command execution is how a tool call becomes a process running as the requester.
CommandGuardrailService.BuildCommandPlan (internal/security/command_guardrail_service.go) builds the plan and rewrites it to invoke the helper:
blueclaw-posix-helper exec --uid <uid> --gid <gid> --groups <gids> --cwd <dir> -- <argv>The helper is installed root:root 4755 and accepts only a real UID of root or blueclaw. It calls setgroups, setgid and setuid in that order, then execs with a canonical PATH, after which the process is the requester and cannot regain privilege. Its other commands are capabilities, sync (apply the projected users, groups and modes), reconcile-home and fs (one filesystem operation, after the same drop).
File tools are the same path. read, write, edit, file_delete and the rest build a shell command and run it through the requester's shell (internal/agentruntime/requester_shell.go), starting in the requester's $HOME, so tilde expansion, globs and relative paths behave as they would at that person's prompt.
The environment
A command never inherits the daemon's environment. The child environment starts empty, takes HOME, TERM and LANG, copies only the names the workspace owns from what the call requested, and derives HOME, TMPDIR and the XDG_* paths from the resolved identity. A credential the daemon holds has no path into a task's shell, and there is no list of sensitive names to keep current. External agent CLIs are started the same way.
Workspace layout
The workspace is the directory tree under terminal.workspaceRootPath where people, circles and the service keep their files.
What is not enforced
blueclaw has no executable allowlist, no denied command list, no denied path prefix, and no prompt instruction telling the model what it may not touch.