Reversing Claude CoWork

hehehaha

Motivation

Recently, Claude released CoWork that aims to adapt Claude Code for general users. Since there were rumors that it runs a Linux VM using Apple's Virtualization Framework, I wanted to take a look for myself to see how it was implemented and also gain more experience in reversing swift.

This analysis started at the end of Jan 2026 and might not be accurate due to how often Claude is updated.

Objectives

Below are a list of questions that I came up with to "guide" my RE efforts for learning.

1. What is the different components in Claude, specifically CoWork and how do they work together

2. How does the communication between VM and host work in CoWork's Case

3. Which functions and behaviors are exclusive to the CoWork "mode" versus the standard Claude Chat interface.

4. How do specific Swift constructs (structs, enums, closures) and behaviours appear in the disassembled binary?

Overview

Claude Cowork runs a CLI process inside a single shared VM and connects that process to the desktop session flow.

It is broken up into three main components:

1. Frontend (app.asar)

2. Bridging API (swift-addon.node)

3. Guest VM (Claude-vm)

Most of the reverse-engineering efforts will be placed on swift-addon.node.

Architecture

This is the rough overview of the entire Claude Architecture and its different components.

Architecture

Initial Analysis

Like most applications on MacOS, dumping entitlements give us a good idea of what kind of privileged actions a binary might need to perform.

nicholas@nicholas:/mnt/e/Claude/Claude/MacOS$ ipsw macho info -e ./Claude
? Detected a universal MachO file, please select an architecture to analyze: AARCH64, ARM64
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.cs.allow-jit</key>
    <true/>
    <key>com.apple.security.device.audio-input</key>
    <true/>
    <key>com.apple.security.device.bluetooth</key>
    <true/>
    <key>com.apple.security.device.camera</key>
    <true/>
    <key>com.apple.security.device.print</key>
    <true/>
    <key>com.apple.security.device.usb</key>
    <true/>
    <key>com.apple.security.personal-information.location</key>
    <true/>
    <key>com.apple.security.personal-information.photos-library</key>
    <true/>
    <key>com.apple.security.virtualization</key>
    <true/>
  </dict>
</plist>

Two interesting entries that stand out immediately is com.apple.security.cs.allow-jit and com.apple.security.virtualization.

com.apple.security.virtualization allows an application to use the Virtualization framework. and com.apple.security.cs.allow-jit like it's name suggests allows for execution of JIT-Compiled code although I'm not entirely sure for which component.

Looking at the Claude binary, we see that it's mainly a electron wrapper and the contents that interests are more is app.asar

We can extract and "deobfuscate" the contents from app.asar using webcrack.

After which, we can begin analyzing the key contents of app.asar in the following section.

Frontend

Cowork Session Lifecycle

Cowork sessions do not create a VM per session. They reuse the existing VM if it exists and spawn a per-session process inside it.

The VM lifecycle is managed by the swift-addon via Apple's Virtualization framework. Cowork ties into that lifecycle with the functions below.

Firstly, Cowork checks if there already is a Guest VM spawned in g0

async function g0() {
  const t = await Ca();
  return t ? t.isGuestConnected() : false;
}

A prototype is defined in T5e which maps createVMSpawnFunction to C5e

// (1) Prototype defined
const T5e = Object.freeze(Object.defineProperty({
  __proto__: null,
  createVMSpawnFunction: C5e,
  isVMGuestConnected: g0
}, Symbol.toStringTag, {
  value: "Module"
}));

function C5e(t) {
  var a;
  // (2) Adding additionalMounts values
  const e = Object.keys(t.additionalMounts).length;
  const r = Object.keys(t.additionalMounts).join(", ");
  Le.info(`[Spawn:config] Creating spawn function for process=${t.processName}, isResume=${t.isResume}, mounts=${e} (${r}), allowedDomains=${((a = t.allowedDomains) == null ? void 0 : a.length) ?? 0}`);
  return n => {
    // (3) Spawning with random UUID
    const i = ya.randomUUID();
    Le.info(`[Spawn:create] id=${i} name=${t.processName} cmd=${n.command} args=${n.args.join(" ")} cwd=${n.cwd ?? "(none)"}`);
    qme();
    const s = new y5e(i, t.processName);
    s.setupStdinForwarding();
    const o = {};
    let c = 0;
    for (const [l, u] of Object.entries(n.env)) {
      if (u !== void 0) {
        o[l] = u;
        c++;
      }
    }
    Le.verbose(`[Spawn:create] id=${i} env vars=${c} (sensitive values filtered)`);
    $5e(s, i, n.command, n.args, n.cwd, o, t).catch(l => {
      Le.error(`[Spawn:create] id=${i} Failed to spawn: %o`, l);
      s.emit("error", l);
    });
    return s;
  };
}

This brings us to $5e which is the core entrypoint and calls the exported function vm.spawn from swift-addon.node. This later spawns a process inside the VM.

async function $5e(t, e, r, a, n, i, s) {
  // (1) Load the Swift addon (vm API bridge)
  const o = await Ca();
  if (!o) {
    Le.error(`[Spawn:vm] id=${e} Swift VM addon not available`);
    t.setError(new Error("Swift VM addon not available"), "lam_vm_process_spawn_failed");
    return;
  }
  try {
    // (2) Approve OAuth token for the guest MITM proxy (if set)
    const c = i.CLAUDE_CODE_OAUTH_TOKEN;
    if (c) {
      await o.addApprovedOauthToken(c);
      Le.info(`[Spawn:vm] id=${e} OAuth token approved with MITM proxy`);
    }
    // (3) Spawn a process in the existing VM
    await o.spawn(e, s.processName, r, a, n, Object.keys(i).length > 0 ? i : void 0, s.additionalMounts, s.isResume, s.allowedDomains, s.sharedCwdPath);
    await t.confirmSpawn();
    Le.info(`[Spawn:vm] id=${e} Spawn succeeded`);
    // (4) Telemetry/logging
    Vr("lam_vm_process_spawned", {
      vm_instance_id: ws() ?? "unknown",
      is_resume: s.isResume,
      mount_count: Object.keys(s.additionalMounts).length
    });
  } catch (c) {
    const l = c instanceof Error ? c.message : String(c);
    Le.error(`[Spawn:vm] id=${e} Spawn failed: ${l}`);
    t.setError(c instanceof Error ? c : new Error(l), "lam_vm_process_spawn_failed");
  }
}

Cowork Specific Tools

Looking for Cowork strings, we see that there is some logic related to mounting, tool and delete permissions.

For mounting a specific user directory, Cowork exposes a tool that asks the user to pick a directory and then mounts it into the VM using vm.mountPath(..., "rw")

This is mounted at /sessions/${t.vmProcessName}/mnt/${o}

const e = xy("request_cowork_directory", "Request access to a directory on the user's computer. This will show a directory picker dialog to the user, and if they select a directory, it will be mounted and made available to you. Use this whenever the user asks you to work with files on their computer and you don't currently have access to the relevant location. This is the primary way to gain file system access - don't ask users to 'start a new task' when you can simply request the directory directly.", {}, async () => {
  const a = t.getVmProcessId();
  if (!a) {
    return {
      content: [{
        type: "text",
        text: "Session VM process not available. The session may not be fully initialized."
      }],
      isError: true
    };
  }
  const n = {
    title: "Select Directory to Share",
    properties: ["openDirectory", "createDirectory"],
    message: "Select a directory to share with the agent"
  };
  const i = De ? await oe.dialog.showOpenDialog(De, n) : await oe.dialog.showOpenDialog(n);
  if (i.canceled || i.filePaths.length === 0) {
    return {
      content: [{
        type: "text",
        text: "Directory selection was cancelled by the user."
      }]
    };
  }
  const s = i.filePaths[0];
  const o = me.basename(s);
  const c = Tn.homedir();
  const l = me.relative(await xt.realpath(c), await xt.realpath(s));
  if (!(await IWe(s, c))) {
    return {
      content: [{
        type: "text",
        text: `Selected directory "${s}" is outside the home directory and cannot be mounted.`
      }],
      isError: true
    };
  }
  const u = await Ca();
  if (!u) {
    return {
      content: [{
        type: "text",
        text: "VM API not available. Cannot mount directory."
      }]
    };
  }
  try {
    // (1) Mounting user directory to VM - session
    await u.mountPath(a, l, o, "rw");
    const h = `/sessions/${t.vmProcessName}/mnt/${o}`;
    t.addUserSelectedFolder(t.sessionId, s);
    G.info(`[CoworkDirectoryTool] Mounted directory: ${s} -> ${h}`);
    return {
      content: [{
        type: "text",
        text: `Successfully mounted directory.\n\nHost path: ${s}\nVM path: ${h}\n\nYou can now access files in this directory at ${h}`
      }]
    };
  } catch (h) {
    const p = h instanceof Error ? h.message : String(h);
    G.error(`[CoworkDirectoryTool] Failed to mount directory: ${p}`);
    return {
      content: [{
        type: "text",
        text: `Failed to mount directory: ${p}`
      }],
      isError: true
    };
  }
});

For delete permissions, Cowork has a dedicated tool allow_cowork_file_delete which upgrades a mount from rw → rwd so deletes are allowed. This is only used when a delete fails with "Operation not permitted."

const r = xy("allow_cowork_file_delete", "Request permission to delete files in a directory. IMPORTANT: call this tool whenever a delete operation (such as rm) fails with 'Operation not permitted', rather than telling the user it is impossible. If approved, file deletion will be enabled.", {
  file_path: ae().describe("The VM path of the file you're trying to delete")
}, async ({
  file_path: a
}) => {
  const n = t.getVmProcessId();
  if (!n) {
    return {
      content: [{
        type: "text",
        text: "Session VM process not available. The session may not be fully initialized."
      }],
      isError: true
    };
  }
  const i = Iye(a, t.vmProcessName, t.getUserSelectedFolders(), t.getOutputsSubpath());
  if (!i) {
    return {
      content: [{
        type: "text",
        text: `Could not find mount for path: ${a}. Make sure the path is within a mounted directory.`
      }],
      isError: true
    };
  }
  const s = await Ca();
  if (!s) {
    return {
      content: [{
        type: "text",
        text: "VM API not available. Cannot modify mount permissions."
      }]
    };
  }
  try {
    await s.mountPath(n, i.subpath, i.name, "rwd");
    t.setFileDeleteApprovedForMount(i.name);
    G.info(`[CoworkDirectoryTool] Enabled file deletion for mount: ${i.name}`);
    return {
      content: [{
        type: "text",
        text: `File deletion is now enabled for the "${i.name}" folder.`
      }]
    };
  } catch (o) {
    const c = o instanceof Error ? o.message : String(o);
    G.error(`[CoworkDirectoryTool] Failed to enable file deletion: ${c}`);
    return {
      content: [{
        type: "text",
        text: `Failed to enable file deletion: ${c}`
      }],
      isError: true
    };
  }
});

For confirmation, Cowork injects a folder name into the tool permission prompt when the delete tool is requested.

canUseTool: async ($e, Ve, { suggestions: Je }) => {
  let tt = Ve;
  if ($e === "mcp__cowork__allow_cowork_file_delete") {
    const Xe = this.sessions.get(e);
    const rt = Ve.file_path;
    let vt = "workspace";
    if (rt && Xe != null && Xe.vmProcessName) {
      const Wt = me.relative(Tn.homedir(), this.getOutputsDir(e, Xe.sharedCwdPath));
      const Kt = Iye(rt, Xe.vmProcessName, Xe.userSelectedFolders ?? [], Wt);
      if (Kt) {
        vt = Kt.name;
      }
    }
    tt = {
      ...Ve,
      _folderName: vt
    };
  }
  return this.handleToolPermission(e, $e, tt, Je);
},

Midway through, I realized that many of the functions in index.js have been identified and reverse-engineered by others using Claude itself which I thought was pretty hilarious. Here are some good breakdowns.

• https://aaddrick.com/blog/claude-desktop-cowork-mode-vm-architecture-analysis

• https://aaddrick.com/blog/reverse-engineering-claude-desktops-cowork-mode-a-deep-dive-into-vm-isolation-and-linux-possibilities

For the purpose of learning, I will focus on how this translates to Swift and what actually happens when these functions/frameworks are called.

Bridging API

Node.js ↔ Swift Interop

Before we get into swift-addon, we first have to understand how Swift and Node work together. Let's take this example.

package.swift

// Package.swift
// This tells Swift to build a Dynamic Library (shared object)
// instead of an executable app.
let package = Package(
    name: "HelloWorld",
    products: [
        .library(name: "HelloWorld", type: .dynamic, targets: ["HelloWorld"]),
    ],
    dependencies: [
        .package(url: "https://github.com/LinusU/swift-napi-bindings", from: "1.0.0-alpha.1"),
    ],
    targets: [
        .target(name: "Trampoline", dependencies: ["NAPIC"]),
        .target(name: "HelloWorld", dependencies: ["NAPI", "Trampoline"]),
    ]
)

trampoline.c

HelloWorld.swift

index.js

Swift cannot directly speak to Node.js because of swift-mangling, which scrambles function names. With the example above, here is what happens when Node.js opens the shared library HelloWorld.node:

1. Node searches for a standard C symbol

   1. Node looks for the specific, non-mangled C macro NAPI_MODULE. It finds this in Trampoline.c

2. The Trampoline calls Swift

   1. The C code calls init_hello_world. It is able to find the Swift implementation because @_cdecl forced the Swift compiler to use that exact name

3. Swift executes

   1. Swift uses NAPI bindings to construct a JavaScript-compatible object and returns it to Node for use.

Let's see this in action from index.js which was extracted from app.asar

index.js

async function Ca() {
  const t = await jme();
  return (t == null ? undefined : t.vm) ?? null;
}
async function jme() {
  // (1) Load swift-addon.node first
  return Qu || Qb || (Le.info("[SwiftVM] Loading @ant/claude-swift module..."), Qb = (async () => {
    try {
      Qu = (await import("@ant/claude-swift")).default;
      Le.info("[SwiftVM] Module loaded successfully");
      return Qu;
    } catch (t) {
      Le.error("[SwiftVM] Failed to load module: %o", t);
      return null;
    }
  })(), Qb);
}
async function L5e(t, e) {
  const r = y0();
  const a = Date.now();
  const n = ws();
  Le.info(`[VM:start] Beginning startup, bundlePath=${r}`);
  Le.info(`[VM:start] Bundle version: ${da}`);
  Le.info(`[VM:start] VM instance ID: ${n}`);
  Le.info("[VM:start] Step 1/4: Downloading bundle + SDK...");
  const i = Date.now();
  const [s, o] = await Promise.all([Hme(e), sl.prepareForVM()]);
  if (!o.ready) {
    throw new Error(o.error ?? "SDK preparation failed");
  }
  Le.info(`[VM:start] Step 1/4 complete: download=${s}, SDK ready, took ${Date.now() - i}ms`);
  Le.info("[VM:start] Step 2/4: Loading Swift VM API...");
  const c = Date.now();
  const l = await Ca();
  if (!l) {
    Le.error("[VM:start] Swift VM addon not available");
    Vr("lam_vm_startup_failed", {
      vm_instance_id: n,
      bundle_version: da,
      duration_ms: Date.now() - a,
      error_type: "swift_addon_unavailable",
      is_fresh_download: s,
      failed_step: "swift_api"
    });
    throw new Error("Swift VM addon not available");
  }
  Le.info(`[VM:start] Step 2/4 complete: Swift API loaded, took ${Date.now() - c}ms`);
  await qme();
  k5e();
  if (!Yte) {
    Yte = true;
    Bf({
      name: "claude-vm-shutdown",
      fn: async () => {
        const S = Date.now();
        const C = ws();
        Le.info(`[VM:shutdown] App quit, stopping VM (instance: ${C})...`);
        try {
          await l.stopVM();
          Le.info(`[VM:shutdown] Completed in ${Date.now() - S}ms`);
          Vr("lam_vm_shutdown_completed", {
            vm_instance_id: C ?? "unknown",
            bundle_version: da,
            duration_ms: Date.now() - S,
            trigger: "app_quit"
          });
        } catch (E) {
          Le.error("[VM:shutdown] Failed: %o", E);
          Vr("lam_vm_shutdown_failed", {
            vm_instance_id: C ?? "unknown",
            bundle_version: da,
            duration_ms: Date.now() - S,
            trigger: "app_quit"
          });
          throw E;
        } finally {
          g5e();
        }
      }
    });
  }
  Le.info("[VM:start] Step 3/4: Starting VM...");
  const u = Date.now();
  const h = (t == null ? undefined : t.memoryGB) ?? D5e;
  await l.startVM(r, h);
  Le.info(`[VM:start] Step 3/4 complete: VM start called, took ${Date.now() - u}ms`);
  eL(Qd.Booting);
  Le.info("[VM:start] Step 4/4: Waiting for guest connection...");
  const p = Date.now();
  let d = 0;
  let v = Date.now();
  while (Date.now() - c < Qte) {
    d++;
    if (await g0()) {
      const S = Date.now() - a;
      Le.info(`[VM:start] Step 4/4 complete: connected after ${d} polls, ${Date.now() - p}ms since boot`);
      const C = sl.getVMStorageSubpath();
      const E = sl.getRequiredVersion();
      Le.info(`[VM:start] Installing SDK: subpath=${C}, version=${E}`);
      await l.installSdk(C, E);
      Le.info(`[VM:start] SDK installed, total startup time: ${S}ms`);
      tL();
      eL(Qd.Ready);
      Vr("lam_vm_startup_completed", {
        vm_instance_id: n,
        bundle_version: da,
        duration_ms: S,
        is_fresh_download: s
      });
      return;
    }
    if (Date.now() - v >= 10000) {
      const S = Date.now() - p;
      Le.info(`[VM:start] Still waiting for guest connection... ${S}ms elapsed, ${d} polls`);
      v = Date.now();
    }
    await new Promise(S => setTimeout(S, M5e));
  }
<snip>

swift-addon.node

Lets break it down

1. Node loads the binary swift_addon.node via import in jme() which triggers dlopen

2. This executes napiRegisterModule in swift_addon.node in the background which returns a tree of objects to Node, specifically the vm branch

3. In L5e specifically, it calls startVM. Node looks up the string startVM in the N-API object which eventually lands in ClaudeSwift.vmStartVM

With that, we will now focus on the VM lifecycle.

VM Lifecycle

__int64 __fastcall specialized static NAPIBindings.createVMObject(env:)(__int64 a1)
{
  __int64 v2; // x19
  __int64 v3; // x2
  __int64 v4; // x2
  __int64 v5; // x2
  __int64 v6; // x2
  __int64 v7; // x2
  __int64 v9; // [xsp+0h] [xbp-20h] BYREF

  v2 = napiCreateObject(_:)(a1);
  if ( v2 )
  {
    v9 = 0;
    napi_create_function(
      a1,
      "createVM",
      8,
      @objc closure #1 in variable initialization expression of vmCreateVM,
      0,
      &v9);
    if ( v9 )
      napi_set_named_property(a1, v2, "createVM");
    v9 = 0;
    napi_create_function(a1, "startVM", 7, @objc closure #1 in variable initialization expression of vmStartVM, 0, &v9);
    if ( v9 )
      napi_set_named_property(a1, v2, "startVM");
    v9 = 0;
    napi_create_function(a1, "stopVM", 6, @objc closure #1 in variable initialization expression of vmStopVM, 0, &v9);
    if ( v9 )
      napi_set_named_property(a1, v2, "stopVM");
    v9 = 0;
    napi_create_function(
      a1,
      "isRunning",
      9,
      @objc closure #1 in variable initialization expression of vmIsRunning,
      0,
      &v9);
    if ( v9 )
      napi_set_named_property(a1, v2, "isRunning");
    v9 = 0;
    if ( ((unsigned __int64)"eateVM" & 0x1000000000000000LL) != 0 )
    {
      v3 = String.UTF8View._foreignCount()();
    }
    else if ( ((unsigned __int64)"eateVM" & 0x2000000000000000LL) != 0 )
    {
      v3 = ((unsigned __int64)"eateVM" >> 56) & 0xF;
    }
    else
    {
      v3 = 16;
    }
    napi_create_function(
      a1,
      "isGuestConnected",
      v3,
      @objc closure #1 in variable initialization expression of vmIsGuestConnected,
      0,
      &v9);
    if ( v9 )
      napi_set_named_property(a1, v2, "isGuestConnected");
    v9 = 0;
    napi_create_function(a1, "spawn", 5, @objc closure #1 in variable initialization expression of vmSpawn, 0, &v9);
    if ( v9 )
      napi_set_named_property(a1, v2, "spawn");
  <snip>

The full decompilation is a repetitive pattern of napi_create_function + napi_set_named_property for each method. Here is the complete N-API method export table for all VM related tasks.

#	N-API Export	Purpose
1	createVM	Create VM instance with bundle path + disk size
2	startVM	Boot the VM
3	stopVM	Shutdown VM
4	isRunning	Check if VM is running
5	isGuestConnected	Check vsock connection to guest
6	spawn	Spawn process in VM
7	kill	Kill process in VM
8	writeStdin	Write to process stdin
9	isProcessRunning	Check if a specific process is alive
10	setEventCallbacks	Set stdout/stderr/exit/error/networkStatus callbacks
11	showDebugWindow	Show VM debug/graphics window
12	hideDebugWindow	Hide VM debug/graphics window
13	setDebugLogging	Enable/disable debug logging
14	isDebugLoggingEnabled	Check debug logging state
15	mountPath	Mount host path in VM
16	loadTranscripts	Load conversation transcripts
17	readFile	Read file from VM
18	installSdk	Install SDK in VM
19	addApprovedOauthToken	Add OAuth token to VM

Let's take a closer look starting with vmCreateVM.

vmCreateVM

specialized ClaudeVMManager.createVM(at:diskSizeGB:)()
{
  <snip>
  static Logger.info(_:topic:file:line:)(..., 209);

  // (1) Store bundlePath in self.currentBundlePath
  v6 = (__int64 *)(v1 + OBJC_IVAR____TtC11ClaudeSwift15ClaudeVMManager_currentBundlePath);
  v7 = v6[1];
  *v6 = v3;                              // self.currentBundlePath = bundlePath
  v6[1] = (__int64)v2;
  swift_bridgeObjectRelease(v7);

  // (2) Validate rootfs.img exists
  v9 = objc_retainAutoreleasedReturnValue(
    objc_msgSend((id)objc_opt_self(&OBJC_CLASS___NSFileManager), "defaultManager"));
  v10 = v6[1];                            // self.currentBundlePath (string object part)
  if ( !v10 )                             // Fatal error if bundlePath is nil
    return _assertionFailure(..., "ClaudeSwift/ClaudeVMManager.swift", 33, 2, 133, 0);

  // (3) Build URL bundlePath + "/rootfs.img"
  URL.init(fileURLWithPath:)(v16, v10);
  URL.appendingPathComponent(_:)(0x692E7366746F6F72LL, 0xEA0000000000676DLL);
                                          // "rootfs.img" (small string: 0x692E7366746F6F72 = "rootfs.i")
  URL.path.getter(v18);
  v21 = String._bridgeToObjectiveC()();
  LOBYTE(v12) = (unsigned __int8)objc_msgSend(v11, "fileExistsAtPath:", v21);
  objc_release(v11);

  if ( (v12 & 1) != 0 )                  // rootfs.img exists — success
  {
    // " file: rootfs at " (0x1D44D0)
    static Logger.info(_:topic:file:line:)(..., 226);
    return;
  }

  // (4) throw VMError if rootfs.img NOT found
  static Logger.error(_:topic:file:line:)(..., 222);
  v38 = lazy protocol witness table accessor for type VMError and conformance VMError(v37);
  v39 = swift_allocError(&type metadata for VMError, v38, 0, 0);
  *(_OWORD *)v40 = xmmword_1E38E0;       // VMError payload
  *(_BYTE *)(v40 + 16) = 0;
  swift_willThrow(v39);                   // Throw VMError to caller
}

This function does not create the VM (that happens in startVM) but instead, stores the bundle path and validates that rootfs.img exists via NSFileManager.fileExistsAtPath

vmStartVM

Opening it up in IDA and filtering for startVM, we see the following.

Tracing it, we eventually land in ClaudeVMManager.startVM().

vmStartVM

__int64 closure #1 in closure #1 in variable initialization expression of vmStartVM()
{
  __int64 v0; // x22
  char v1; // w19
  _QWORD *v2; // x0
  __int64 v4; // x0
  __int64 v5; // x0
  __int64 v6; // x1

  // (1) Checks if macOS version is >= 13.0
  if ( _stdlib_isOSVersionAtLeast(_:_:_:)(0xDu, 0, 0) )
  {
    if ( one-time initialization token for shared != -1 )
      swift_once(&one-time initialization token for shared, one-time initialization function for shared);
    v1 = *(_BYTE *)(v0 + 80);
    v2 = (_QWORD *)swift_task_alloc(384);
    *(_QWORD *)(v0 + 64) = v2;
    *v2 = v0;
    v2[1] = closure #1 in closure #1 in variable initialization expression of vmStartVM;
    // (2) Function of interest
    return ClaudeVMManager.startVM(bundlePath:memoryGB:)(
             *(_QWORD *)(v0 + 16),
             *(_QWORD *)(v0 + 24),
             *(_QWORD *)(v0 + 32),
             v1 & 1);
  }
  else
  {
    v4 = swift_release(*(_QWORD *)(v0 + 40));
    v5 = lazy protocol witness table accessor for type VMError and conformance VMError(v4);
    swift_allocError(&type metadata for VMError, v5, 0, 0);
    *(_OWORD *)v6 = xmmword_1E5820;
    *(_BYTE *)(v6 + 16) = 2;
    swift_willThrow();
    return (*(__int64 (**)(void))(v0 + 8))();
  }
}

ClaudeVMManager.startVM

To summarise what this function is doing

1. Setting up file path for rootfs.img which is a img file downloaded from anthropic's website

2. Setup config with createLiunxVMConfiguration and initializes it with VZVirtualMachine(configuration)

3. Setups the communication channel (vsock) with the use of VZVirtioSocketDevice

   1. If found, it initializes a RPC client ClaudeVMDaemonRPCClient(socketDevice: device)

   2. Calls applyStoredCallbacks() which handles different streams such as stderr, stdout and more

It also calls ClaudeVMManager.createLinuxVMConfiguration which we will look into below.

createLinuxVMConfiguration

This function is responsible for building VZVirtualMachineConfiguration.

For brevity sake, I included a table that shows the different components set.

Component	Class	Value
CPU	setCPUCount:	min(max(hostCPUs/2, 1), 4)
Memory	setMemorySize:	memoryGB << 30 (default 8GB from JS)
Platform	VZGenericPlatformConfiguration	Persistent machine identifier
Boot	VZEFIBootLoader	UEFI/GRUB
Storage (root)	VZNVMExpress / VZVirtioBlock	rootfs.img (read-write)
Storage (session)	Same	session-data.img (read-write)
Storage (optional)	VZUSBMassStorageDevice	smol-bin.img (read-only)
Network	VZVirtioNetworkDevice + VZNATAttachment	NAT with persistent MAC
Entropy	VZVirtioEntropyDevice	Hardware RNG
Graphics	VZVirtioGraphicsDevice	1280x800 scanout
Keyboard	VZUSBKeyboardConfiguration	USB keyboard
Mouse	VZUSBScreenCoordinatePointingDevice	USB mouse
Console	VZVirtioConsoleDevice	"claude-daemon-console" via NSPipe
Socket	VZVirtioSocketDevice	vsock (port 51234)
Filesystem	VZVirtioFileSystemDevice	Tag "claudeshared", home dir shared R/W

vmStopVM

The core logic is in ClaudeVMManager.stopVM() at 0x2cc04.

__int64 __fastcall ClaudeVMManager.stopVM()(__int64 a1, __int64 a2)
{
  <snip>
  v4 = OBJC_IVAR____TtC11ClaudeSwift15ClaudeVMManager_virtualMachine;
  v5 = *(void **)(v3 + v4);             // self.virtualMachine
  // (1) Check if self.virtualMachine is present (is VM running)
  if ( !v5 )                             
  {
    // "No VM running" (0x7572204D56206F4E = "No VM ru" + 0xED0000676E696E6E = "nning")
    static Logger.debug(_:topic:file:line:)(
      0x7572204D56206F4ELL, 0xED0000676E696E6ELL, 9,
      0xD000000000000073LL, 0x80000000001D39B0LL, 456);
    return (*(__int64 (**)(void))(v2 + 8))();
  }

  // "Stopping VM..." (0x676E6970706F7453 = "Stopping" + 0xEE002E2E2E4D5620 = " VM...")
  static Logger.info(_:topic:file:line:)(
    0x676E6970706F7453LL, 0xEE002E2E2E4D5620LL, 9,
    0xD000000000000073LL, 0x80000000001D39B0LL, 460);
  // (2) Signal Stop to Running VM 
  if ( (unsigned int)objc_msgSend(v6, "canRequestStop") )  // [vm canRequestStop]
  {
    v7 = swift_continuation_init(v2 + 16, 1);
    objc_msgSend(v6, "stopWithCompletionHandler:");   
    return swift_continuation_await(v2 + 16);    
  }

  // (3) poll vm.state every 100ms with 10 second timeout
  if ( !objc_msgSend(*(id *)(v2 + 248), "state") )    // Already stopped?
  {
    // "VM reached stopped state" (0x1D3D10)
    static Logger.debug(...);
    goto LABEL_14;                        // Skip to Task.sleep cleanup
  }

  // (4) Logging stuff
  Date.init()();                          // startTime = Date()
  v14 = objc_msgSend(v12, "state");       // Check state again

  if ( !v14                               // state == 0 means stopped
    || (v19 = Date.timeIntervalSince(_:)(v16),  // elapsed = Date() - startTime
        v19 >= 10.0) )                    // 10 second timeout
  {
    if ( objc_msgSend(*(id *)(v2 + 248), "state") )  // Still not stopped after timeout?
    {
      // "o reach stopped state..." (0x1D3C80) → builds: "VM failed to reach stopped state..."
      // Logs: "VM still in state <N> after timeout"
      // "for VM to stop (state: " (0x1D3CB0)
      static Logger.warn(_:topic:file:line:)(..., 488);
    }
    else
    {
      // "VM stopped successfully" (0x1D3CF0)
      static Logger.info(_:topic:file:line:)(..., 486);
    }
    goto LABEL_14;
  }

  // Sleep 100ms then retry
  return static Task<>.sleep(nanoseconds:)(100000000);  // 100_000_000 ns = 100ms
}

There are essentially two shutdown paths

1. If canRequestStop is true → calls [VZVirtualMachine stopWithCompletionHandler:] (sends ACPI shutdown signal, awaits completion via swift_continuation_await)

2. If canRequestStop is false → polls vm.state every 100ms with a 10-second timeout via static Task<>.sleep(nanoseconds:)(100000000).

   1. Logs a warning if the VM is still running after timeout.

isGuestConnected

ClaudeVMManager.isGuestConnected.getter at 0x2db10

__int64 ClaudeVMManager.isGuestConnected.getter()
{
  __int64 v0; // x20
  __int64 v1; // x8

  v1 = *(_QWORD *)(v0 + OBJC_IVAR____TtC11ClaudeSwift15ClaudeVMManager_rpcClient);
                                         // self.rpcClient
  if ( v1 && *(_QWORD *)(v1 + 24) )     // rpcClient != nil && rpcClient.connection != nil (offset +24)
    return *(unsigned __int8 *)(v1 + 48);// return rpcClient.guestReady (Bool at offset +48)
  else
    return 0;                            // false
}

Basically checks for rpcClient, rpcClient.connection (offset +24) exists AND returns rpcClient.guestReady (offset +48)

vSock Communication

Listener Setup

To take a deeper look into how Claude communicates with the VM, we can look at the RPCClient methods.

void ClaudeVMDaemonRPCClient.setupListener()()
{
  __int64 v0; // x20
  __int64 v1; // x19
  Swift::String v2; // x0
  void *object; // x22
  Swift::String v4; // x0
  id v5; // x20
  __int64 v6; // x21
  objc_class *v7; // x22
  char *v8; // x0
  char *v9; // x8
  id v10; // x21
  void *v11; // x19
  objc_super v12; // [xsp+8h] [xbp-58h] BYREF
  int v13; // [xsp+1Ch] [xbp-44h]
  unsigned __int64 v14; // [xsp+20h] [xbp-40h]
  unsigned __int64 v15; // [xsp+28h] [xbp-38h]

  v1 = v0;
  type metadata accessor for Logger(0);
  _StringGuts.grow(_:)(33);
  swift_bridgeObjectRelease(0xE000000000000000LL);
  v14 = 0xD00000000000001CLL;
  v15 = 0x80000000001D3670LL;
  v13 = 51234;
  v2._countAndFlagsBits = dispatch thunk of CustomStringConvertible.description.getter(
                            &type metadata for UInt32,
                            &protocol witness table for UInt32);
  object = v2._object;
  String.append(_:)(v2);
  swift_bridgeObjectRelease(object);
  v4._countAndFlagsBits = 3026478;
  v4._object = (void *)0xE300000000000000LL;
  String.append(_:)(v4);
  static Logger.debug(_:topic:file:line:)(
    0xD00000000000001CLL,
    0x80000000001D3670LL,
    9,
    0xD00000000000007BLL,
    0x80000000001D31C0LL,
    138);
  swift_bridgeObjectRelease(0x80000000001D3670LL);
  // (1) init VZVirtioSocketListener
  v5 = objc_msgSend(objc_allocWithZone((Class)&OBJC_CLASS___VZVirtioSocketListener), "init");
  v6 = swift_allocObject(&unk_232BE0, 24, 7);
  swift_weakInit(v6 + 16, v1);
  v7 = (objc_class *)type metadata accessor for ClaudeVMConnectionDelegate(0);
  v8 = (char *)objc_allocWithZone(v7);
  v9 = &v8[OBJC_IVAR____TtC11ClaudeSwiftP33_6E26B1B1F51AB5CCC69A9217701D7BEB26ClaudeVMConnectionDelegate_onConnection];
  *(_QWORD *)v9 = partial apply for closure #1 in ClaudeVMDaemonRPCClient.setupListener();
  *((_QWORD *)v9 + 1) = v6;
  v12.receiver = v8;
  v12.super_class = v7;
  v10 = objc_msgSendSuper2(&v12, "init");
  objc_msgSend(v5, "setDelegate:", v10);
  v11 = *(void **)(v1 + 16);
  objc_setAssociatedObject(v11, "claudeVMListenerDelegate", v10, (char *)&dword_0 + 1);
  // (2) The port is set to 51234
  objc_msgSend(v11, "setSocketListener:forPort:", v5, 51234);
  objc_release(v5);
  objc_release(v10);
}

We see that it initalizes a listener at port 51234 and a delegate method which eventually leads to listener:shouldAcceptNewConnection:fromSocketDevice: and eventually handleGuestConnection.

This link becomes obvious in two decompiled blocks

1. Delegate accepts the connection and calls its stored onConnection closure:

bool __cdecl -[ClaudeVMConnectionDelegate listener:shouldAcceptNewConnection:fromSocketDevice:](...)
{
  v6 = *(void (__fastcall **)(id))((char *)&self->super.isa
       + OBJC_IVAR____ClaudeVMConnectionDelegate_onConnection);
  v7 = objc_retain(a4); // VZVirtioSocketConnection
  v6(v7);               // invoke closure
  return 1;
}

1. That closure immediately forwards the connection to handleGuestConnection which calls startReadingMessages

__int64 __fastcall ClaudeVMDaemonRPCClient.handleGuestConnection(_:)(void *a1)
{
  __int64 v1; // x20
  void *v3; // x0
  __int64 v4; // x19
  __int64 result; // x0
  void (__fastcall *v6)(__int64); // x21
  __int64 v7; // x20
  __int64 v8; // x0
  _BYTE v9[24]; // [xsp+8h] [xbp-38h] BYREF

  type metadata accessor for Logger(0);
  static Logger.info(_:topic:file:line:)(
    0x6F63207473657547LL,
    0xEF64657463656E6ELL,
    9,
    0xD00000000000007BLL,
    0x80000000001D31C0LL,
    170);
  v3 = *(v1 + 24);
  *(v1 + 24) = a1;
  objc_release(v3);
  // (1) Calls startReadingMesssages 
  ClaudeVMDaemonRPCClient.startReadingMessages()(objc_retain(a1));
  v4 = v1 + OBJC_IVAR____TtC11ClaudeSwift23ClaudeVMDaemonRPCClient_onGuestConnected;
  result = swift_beginAccess(v1 + OBJC_IVAR____TtC11ClaudeSwift23ClaudeVMDaemonRPCClient_onGuestConnected, v9, 0, 0);
  v6 = *v4;
  if ( *v4 )
  {
    v7 = *(v4 + 8);
    v8 = swift_retain(v7);
    v6(v8);
    return _sSSSiSgSSSgIeggyg_SgWOe_0(v6, v7);
  }
  return result;
}

Reading Messages

ClaudeVMDaemonRPCClient.startReadingMessages at 0x19E24 is the entry point for the inbound message pipeline. It extracts the raw file descriptor from the VZVirtioSocketConnection, configures it for non-blocking I/O via fcntl, and launches a detached Task that runs the read loop.

// ClaudeVMDaemonRPCClient.startReadingMessages (0x19E24)
// Spawns async read loop for incoming vsock messages from VM guest
v5 = *(void **)(v0 + 24);               // self.connection (VZVirtioSocketConnection)
if ( v5 )
{
    v6 = objc_retain(v5);
    // (1) Extract the raw file descriptor from the vsock connection
    v7 = objc_msgSend(v6, "fileDescriptor");
    // Logger.debug("Starting read loop on fd=\(fd)")
    static Logger.debug(..., 206);

    // (2) Set O_NONBLOCK on the fd so reads won't block the async task
    v13 = fcntl(_:_:)(v7, 3);           // F_GETFL
    fcntl(_:_:_:)(v7, 4, v13 | 4);      // F_SETFL | O_NONBLOCK

    // (3) Launch a detached Task with the read loop closure
    //     The closure captures the fd (at offset +32) and a weak self ref (at +40)
    v16 = swift_allocObject(&unk_232C30, 48, 7);
    *(v16 + 32) = v7;                   // captured fd
    *(v16 + 40) = v15;                  // captured weak self

    v17 = specialized static Task<>.detached(name:priority:operation:)(
            0, 0, v4,
            &async function pointer to partial apply for closure #1 in
              ClaudeVMDaemonRPCClient.startReadingMessages(),
            v16);

    // Store the Task handle at self+40 (replaces any previous read task)
    *(v1 + 40) = v17;
}
else
{
    // Logger.debug("startReadingMessages: no connection")
    static Logger.debug(..., 201);
}

The operation: argument passed to Task.detached is a Swift AsyncFunctionPointer, a two-field struct defined by the Swift ABI in executor.h:

template <class AsyncSignature>
class AsyncFunctionPointer {
public:
  TargetCompactFunctionPointer<InProcess, AsyncFunctionType<AsyncSignature>,
                        /*nullable*/ false,
                        int32_t> Function;
  uint32_t ExpectedContextSize;
};

At 0x1E34C8 in __const, the raw bytes E0 72 E4 FF 20 00 00 00 decode as:

• Function = int32_t(-0x1B8D20) → resolved target: 0x1E34C8 + signext32(0xFFE472E0)

• ExpectedContextSize = 0x20 (32 bytes)

Since IDA doesn't natively resolve these relative pointers, we can use a IDAPython script scans __const for all AsyncFunctionPointer records, applies the SwiftAsyncFunction struct, and creates navigatable cross-references here.

Following the resolved async pointer xrefs, we land in the actual read loop at ClaudeVMDaemonRPCClient_readLoop_vsock_TY0 (0x1A588). This function continuously reads raw bytes over vsock, accumulates them into a persistent Data buffer, and extracts complete messages using a 4-byte big-endian length header.

The loop begins by checking Task.isCancelled and allocating a 4KB read buffer:

// Check for task cancellation before each iteration
if ( static Task<>.isCancelled.getter() & 1 )
    goto CLEANUP;

// Allocate a 4KB temporary buffer, zero-filled
v17 = static Array._allocateBufferUninitialized(minimumCapacity:)(..., &type metadata for UInt8);
*(_QWORD *)(v17 + 16) = 4096;           // swift_array->count = 4096
bzero((void *)(v17 + 32), 0x1000u);      // zero the element storage

// Non-blocking read from the vsock fd
v18 = read(v16, (void *)(v17 + 32), 4096u);

if ( v18 < 0 ) {
    // Negative return: check errno
    if ( errno == 35 ) {                 // EAGAIN — no data available yet
        // Sleep 10ms and retry
        return static Task<>.sleep(nanoseconds:)(10000000);
    }
    // Logger.debug("Read error: errno=\(errno)")
    goto CLEANUP;
}
if ( v18 == 0 ) {
    // EOF — guest disconnected
    // Logger.debug("claudeVMListenerDelegate")
    goto CLEANUP;
}
// Logger.debug("Read \(bytes_read) bytes from fd=\(fd)")

Each successful read appends the new bytes to a persistent Data buffer via Data._Representation.append(contentsOf:). The loop then enters a message extraction phase that processes as many complete messages as possible from the accumulated buffer. It first checks whether the buffer contains at least 4 bytes for the length header:

// (1) Check buffer length
if ( buffer_length < 4 ) goto READ_MORE;

// (2) Some bit swapping
uint32_t message_length = bswap32(*buffer_ptr);

// Logger.debug("Message length prefix: \(message_length)")

if message_length >> 22 > 0x18 (roughly >100MB), the message is logged as too large and the 4-byte header is discarded:

if ( message_length >> 22 > 0x18 ) {
    // Logger.warn("Message too large: \(message_length)... Message too large: ")
    specialized RangeReplaceableCollection<>.removeFirst(_:)(4);
    goto CLEANUP;
}

If the buffer contains the full message (buffer_length >= message_length + 4), the body is sliced out, decoded as UTF-8, and deserialized:

// (1) Skip header (4 bytes) and take message_length bytes
specialized Collection.dropFirst(_:)(4, ...);
specialized Collection.prefix(_:)(message_length, ...);

// (2) Remove the consumed bytes from the persistent buffer
specialized RangeReplaceableCollection<>.removeFirst(_:)(message_length + 4);

// (3) Decode the JSON payload into a ClaudeVMMessage struct
v165 = JSONDecoder.init()();
dispatch thunk of JSONDecoder.decode<A>(_:from:)(
    &type metadata for ClaudeVMMessage, body_data, ...);

if ( !decode_error ) {
    // Logger.debug("Processing message #\(counter), type=\(msg.type), event=\(msg.event), method=\(msg.method)")
    return ClaudeVMDaemonRPCClient.handleMessage(_:)(decoded_message);
} else {
    // Logger.error("Decode error: \(error)")
    // Logger.debug("Failed JSON: \(rawJson)")
}

If the buffer doesn't have enough data for a complete message, it logs the shortfall and loops back to read():

// Logger.debug("Need more data: have \(buffer_length), need \(message_length + 4)")

When the read loop terminates (EOF, cancellation, or fatal error), it logs the total number of processed messages and switches to MainActor for cleanup via swift_task_switch:

// Logger.debug("Read loop ended, processed \(message_count) messages")
// Switch to MainActor for cleanup
swift_task_switch(closure, MainActor.shared.unownedExecutor);

Message Structure

Before looking at dispatch, we can first prove that ClaudeVMMessage.CodingKeys matches the custom ClaudeVMMessage struct defined in IDA. Let's take a closer look.

__int64 __fastcall ClaudeVMMessage.encode(to:)(__int64 a1)
{
  ClaudeVMMessage *v1; // x20
  __int64 v2; // x21
  ClaudeVMMessage *ClaudeVMMessage; // x23
  __int64 v5; // x19
  __int64 v6; // x27
  char *v7; // x22
  __int64 v8; // x25
  __int64 v9; // x26
  ClaudeSwift::ClaudeVMMessage::CodingKeys CodingKeys_MetaData; // w0
  __int64 Container; // x0
  __int64 v12; // x0
  __int64 v13; // x0
  __int64 v14; // x25
  __int64 v15; // x0
  void *object; // x8
  __int64 v17; // x0
  __int128 v19; // [xsp+0h] [xbp-60h] BYREF
  void *v20; // [xsp+10h] [xbp-50h]
  char v21; // [xsp+1Fh] [xbp-41h] BYREF

  ClaudeVMMessage = v1;
  v5 = __swift_instantiateConcreteTypeFromMangledNameV2(
         &_ss22KeyedEncodingContainerVy11ClaudeSwift0D9VMMessage07_6E26B1H24F51AB5CCC69A9217701D7BEBLLV10CodingKeysOGMd,
         &_ss22KeyedEncodingContainerVy11ClaudeSwift0D9VMMessage07_6E26B1H24F51AB5CCC69A9217701D7BEBLLV10CodingKeysOGMR);
  v6 = *(_QWORD *)(v5 - 8);
  v7 = (char *)&v19 - ((*(_QWORD *)(v6 + 64) + 15LL) & 0xFFFFFFFFFFFFFFF0LL);
  v8 = *(_QWORD *)(a1 + 24);
  v9 = *(_QWORD *)(a1 + 32);
  __swift_project_boxed_opaque_existential_1(a1, v8); 
  *(_QWORD *)&CodingKeys_MetaData = lazy protocol witness table accessor for type ClaudeVMMessage.CodingKeys and conformance ClaudeVMMessage.CodingKeys();
  Container = dispatch thunk of Encoder.container<A>(keyedBy:)(
                &unk_232D40,
                &unk_232D40,
                *(_QWORD *)&CodingKeys_MetaData,
                v8,
                v9);
  LOBYTE(v19) = ClaudeVMMessage->type;
  v21 = 0;
  // (1) Encode compulsory "type" field
  v12 = lazy protocol witness table accessor for type ClaudeVMMessageType and conformance ClaudeVMMessageType(Container);
  KeyedEncodingContainer.encode<A>(_:forKey:)(&v19, &v21, v5, &type metadata for ClaudeVMMessageType, v12);
  if ( !v2 )
  {
    // (2) Encode "id" and the other fields if present
    LOBYTE(v19) = 1;
    KeyedEncodingContainer.encodeIfPresent(_:forKey:)();
    // method
    LOBYTE(v19) = 2;
    KeyedEncodingContainer.encodeIfPresent(_:forKey:)();
    // event
    LOBYTE(v19) = 3;
    v13 = KeyedEncodingContainer.encodeIfPresent(_:forKey:)();
    // params
    LOBYTE(v19) = 4;
    v14 = lazy protocol witness table accessor for type ClaudeVMAnyCodable and conformance ClaudeVMAnyCodable(v13);
    KeyedEncodingContainer.encodeIfPresent<A>(_:forKey:)(ClaudeVMMessage->params_buf, &v19, v5, &unk_232A90, v14);
    // result
    LOBYTE(v19) = 5;
    v15 = KeyedEncodingContainer.encodeIfPresent<A>(_:forKey:)(ClaudeVMMessage->result_buf, &v19, v5, &unk_232A90, v14);
    object = ClaudeVMMessage->error.message._object;
    v19 = *(_OWORD *)&ClaudeVMMessage->error.code;
    v20 = object;
    // error
    v21 = 6;
    v17 = lazy protocol witness table accessor for type ClaudeVMError and conformance ClaudeVMError(v15);
    KeyedEncodingContainer.encodeIfPresent<A>(_:forKey:)(&v19, &v21, v5, &unk_232DB8, v17);
  }
  return (*(__int64 (__fastcall **)(char *, __int64))(v6 + 8))(v7, v5);
}

FF enum __udec ClaudeSwift::ClaudeVMMessage::CodingKeys : __int8
FF {
FF     ClaudeSwift_ClaudeVMMessage_CodingKeys_type = 0u,
FF     ClaudeSwift_ClaudeVMMessage_CodingKeys_id = 1u,
FF     ClaudeSwift_ClaudeVMMessage_CodingKeys_method = 2u,
FF     ClaudeSwift_ClaudeVMMessage_CodingKeys_event = 3u,
FF     ClaudeSwift_ClaudeVMMessage_CodingKeys_params = 4u,
FF     ClaudeSwift_ClaudeVMMessage_CodingKeys_result = 5u,
FF     ClaudeSwift_ClaudeVMMessage_CodingKeys_error = 6u,
FF     ClaudeSwift_ClaudeVMMessage_CodingKeys_unknownDefault = 7u,
FF };

In encode(to:) (0x1782C), the encoder is built with ClaudeVMMessage.CodingKeys, then key indices 0..6 are written immediately before encoding values read from the same ClaudeVMMessage * instance (type, id/method/event, params_buf, result_buf, error). This shows that the CodingKeys enum defines the serialized key mapping for ClaudeVMMessage.

Putting it together, this gives us the complete layout of ClaudeVMMessage.

CodingKey	Field	Offset	Type	Used By
0	type	+0	ClaudeVMMessageType	All messages
1	id	+8/+16	String?	Request/Response
2	method	+24/+32	String?	Request
3	event	+40/+48	String?	Event
4	params	+56	ClaudeVMAnyCodable?	Request/Event
5	result	+88	ClaudeVMAnyCodable?	Response
6	error	+120..+136	ClaudeVMError?	Response

We can define it in IDA in the following manner.

00000000 struct ClaudeVMMessage // sizeof=0x90
00000000 {
00000000     char type;
00000001     char _pad[7];
00000008     Swift::String_optional id;
00000018     Swift::String_optional method;
00000028     Swift::String_optional event;
00000038     __int64 params_buf[3];
00000050     __int64 params_meta;
00000058     __int64 result_buf[3];
00000070     __int64 result_meta;
00000078     ClaudeSwift::ClaudeVMError error;
00000090 };

The type field is an enum stored as a single byte which corresponds to different message types.

enum ClaudeSwift::ClaudeVMMessageType : __int8
{
    request        = 0,
    notification   = 1,
    response       = 2,
    event          = 3,
    unknownDefault = 4,
};

Message Dispatching

After JSONDecoder produces a ClaudeVMMessage, the read loop calls ClaudeVMDaemonRPCClient.handleMessage (0x20638) which immediately forwards to the dispatcher at 0x206A4. The dispatcher reads the type byte and branches accordingly

// ClaudeVMDaemonRPCClient_handleMessage_dispatch (0x206A4)
incoming_message = *(#330 **)(async_frame + 32);
// (1) Read type byte at offset +0
message_type = *(unsigned __int8 *)incoming_message;   

// Logger.debug("handleMessage: type=\(message.type)")
static Logger.debug(_:topic:file:line:)(..., 314);


// (2) Check if its a response/event message
if ( message_type == 2 )                                
{
    // Logger.debug("Handling response: id=\(message.id)")
    static Logger.debug(_:topic:file:line:)(..., 320);
    ClaudeVMDaemonRPCClient_handleResponse_resume(response_message);
}
else if ( message_type == 3 )                        
{
    // Logger.debug("Handling event: \(message.event)")
    static Logger.debug(_:topic:file:line:)(..., 317);
    ClaudeVMDaemonRPCClient.handleEvent(_:)(event_message);
}
else
{
    // Logger.warn("Unexpected message type: \(message_type)")
    static Logger.warn(_:topic:file:line:)(..., 323);
}

Only response (type=2) and event (type=3) are handled inbound. Requests (type=0) are outbound-only — the host sends them to the guest via sendRequest.

Type Value	Name	Direction	Has Response?
0	request	Host → Guest	Yes (continuation stored)
1	notification	Host → Guest	No (fire-and-forget)
2	response	Guest → Host	N/A (is the response)
3	event	Guest → Host	No (callback invoked)

Before diving into the handlers, we type v2 as _TtC11ClaudeSwift23ClaudeVMDaemonRPCClient * since it represents self. From the OBJC ivar metadata we can reconstruct the class layout:

00000000 struct _TtC11ClaudeSwift23ClaudeVMDaemonRPCClient // sizeof=0x99
00000000 {
00000000     unsigned __int8 _TtCs12_SwiftObject_opaque[16];
00000010     unsigned __int8 socketDevice[8];
00000018     unsigned __int8 connection[8];      // XREF: ClaudeVMDaemonRPCClient_writeMessage_vsock+30/r
00000020     unsigned __int8 pendingRequests[8];
00000028     unsigned __int8 readTask[8];
00000030     unsigned __int8 guestReady[1];
00000031     unsigned __int8 readyContinuation[];
00000031     unsigned __int8 requestCounter[8];
00000039     unsigned __int8 onStdout[16];
00000049     unsigned __int8 onStderr[16];
00000059     unsigned __int8 onExit[16];
00000069     unsigned __int8 onError[16];
00000079     unsigned __int8 onNetworkStatus[16];
00000089     unsigned __int8 onGuestConnected[16];
00000099 };

The event callbacks (onStdout, onStderr, onExit, onError, onNetworkStatus) are assigned by ClaudeVMManager.applyStoredCallbacks at 0x31A2C, which copies stored closures from the manager into the RPC client:

// ClaudeVMManager.applyStoredCallbacks (0x31A2C) — transfers callback closures to RPC client
v2 = *(v0 + OBJC_IVAR____TtC11ClaudeSwift15ClaudeVMManager_rpcClient);
if ( v2 )
{
    // (1) Copy storedOnStdout → rpcClient.onStdout
    v3 = *(v0 + OBJC_IVAR____TtC11ClaudeSwift15ClaudeVMManager_storedOnStdout); //
    v4 = *(v0 + OBJC_IVAR____TtC11ClaudeSwift15ClaudeVMManager_storedOnStdout + 8);
    v5 = v2 + OBJC_IVAR____TtC11ClaudeSwift23ClaudeVMDaemonRPCClient_onStdout;
    swift_beginAccess(v2 + OBJC_IVAR____...onStdout, v38, 1, 0);
    *v5 = v3;       // function pointer
    v5[1] = v4;     // context pointer

    // ... same pattern for onStderr, onExit, onError, onNetworkStatus
}

If you noticed above, the code is writing 16 bytes of data (v3 and v4) into the memory address pointed to by v5.

In Swift, this 16-byte payload represents an escaping closure. Closures package both code and state (the variables they capture from their surrounding environment). The structure consists of a function pointer and a context pointer as seen below.

struct SwiftClosure {
    void *functionPointer; // Offset 0x0 (8 bytes)
    void *contextPointer;  // Offset 0x8 (8 bytes)
};

You can read more about closures here

handleEvent — Guest-Initiated Notifications

handleEvent at 0x20C1C routes asynchronous notifications from the guest VM. Unlike responses, these events are unsolicited meaining the guest pushes them whenever something happens (process output, exit, errors, etc.). The function reads message.event and dispatches through a chain of string comparisons:

// Swift equivalent of handleEvent @ 0x20C1C
func handleEvent(_ message: ClaudeVMMessage) {
    guard let event = message.event else { return }

    switch event {
    case "ready":         handleReadyEvent(message)
    case "stdout":        handleStdoutEvent(message)
    case "stderr":        handleStderrEvent(message)
    case "exit":          handleExitEvent(message)
    case "error":         handleErrorEvent(message)
    case "networkStatus": handleNetworkStatusEvent(message)
    default:
        Logger.debug("Unknown event: \(event)")
    }
}

Six events are handled, each invoking a callback closure stored on self:

Event	Description	Params	Callback Type
ready	Guest daemon initialized	(none)	CheckedContinuation<(), Never>?
stdout	Process stdout output	id: String, data: String	((String, String) -> Void)?
stderr	Process stderr output	id: String, data: String	((String, String) -> Void)?
exit	Process exited	id: String, code?: Int, signal?: String	((String, Int?, String?) -> Void)?
error	Process error	message: String, id?: String, fatal?: Bool	((String?, String, Bool) -> Void)?
networkStatus	VM network connectivity changed	status: String	((String) -> Void)?

Every handler (except ready) follows the same pattern: cast message.params to [String: Any], look up keys via __RawDictionaryStorage.find<A>, dynamic-cast the values to the expected types, and invoke the callback closure. Here's stdout as a detailed example:

Detailed Example: stdout

  // (1) check event is stdout
  if ( message_event == 'tuodts' && object == (void *)'\xE6\0\0\0\0\0\0\0'
    || (_stringCompareWithSmolCheck(_:_:expecting:)('tuodts', 0xE600000000000000LL, message_event, object, 0) & 1) != 0 )
  {
    outlined init with copy of ClaudeVMAnyCodable?(
      a1->params_buf,
      &v85,
      &_s11ClaudeSwift0A12VMAnyCodable07_6E26B1F24F51AB5CCC69A9217701D7BEBLLVSgMd,
      &_s11ClaudeSwift0A12VMAnyCodable07_6E26B1F24F51AB5CCC69A9217701D7BEBLLVSgMR);
    if ( v87 )
    {
      outlined init with copy of Any(&v85, &v89);
      outlined destroy of ClaudeVMAnyCodable(&v85);
      v16 = __swift_instantiateConcreteTypeFromMangledNameV2(&_sSDySSypGMd, &_sSDySSypGMR);
      // (2) Cast params to [String: Any]
      result = swift_dynamicCast(&v85, &v89, (char *)&type metadata for Any + 8, v16, 6);
      if ( (result & 1) == 0 )
        return result;
      v17 = v85;
      if ( !*(_QWORD *)(v85 + 16) )
        return swift_bridgeObjectRelease(v17);
      swift_bridgeObjectRetain(v85);
      //  params["id"] — small string 0xE200000000000000 | 25705
      v18 = specialized __RawDictionaryStorage.find<A>(_:)('di', 0xE200000000000000LL);
      if ( (v19 & 1) != 0 )
      {
        outlined init with copy of Any(*(_QWORD *)(v17 + 56) + 32 * v18, &v89);
        swift_bridgeObjectRelease(v17);
        if ( (swift_dynamicCast(&v85, &v89, (char *)&type metadata for Any + 8, &type metadata for String, 6) & 1) != 0 )
        {
          v21 = v85;
          v20 = v86;
          if ( *(_QWORD *)(v17 + 16) )
          {
            swift_bridgeObjectRetain(v17);
            // params["data"] — small string 0xE400000000000000 | 1635017060
            v22 = specialized __RawDictionaryStorage.find<A>(_:)('atad', 0xE400000000000000LL);
            if ( (v23 & 1) != 0 )
            {
              outlined init with copy of Any(*(_QWORD *)(v17 + 56) + 32 * v22, &v89);
              swift_bridgeObjectRelease(v17);
              goto LABEL_63;
            }
            swift_bridgeObjectRelease(v17);
          }
          v89 = 0u;
          v90 = 0u;
LABEL_63:
          swift_bridgeObjectRelease(v17);
          if ( *((_QWORD *)&v90 + 1) )
          {
            if ( (swift_dynamicCast(&v85, &v89, (char *)&type metadata for Any + 8, &type metadata for String, 6) & 1) != 0 )
            {
              v47 = v85;
              v45 = (unsigned __int64)v86;
              // (3) Call onStdout callback
              v48 = OBJC_IVAR____TtC11ClaudeSwift23ClaudeVMDaemonRPCClient_onStdout;
LABEL_66:
              v49 = v2 + v48;
              swift_beginAccess(v2 + v48, &v89, 0, 0);
              v50 = *(void (__fastcall **)(__int64, void *, __int64, unsigned __int64))v49;
              if ( !*(_QWORD *)v49 )
              {
LABEL_69:
                swift_bridgeObjectRelease(v45);
                return swift_bridgeObjectRelease(v20);
              }
              v51 = *(_QWORD *)(v49 + 8);
              swift_retain(v51);
              v50(v21, v20, v47, v45);
              v52 = (void (__fastcall *)(_QWORD, _QWORD, _QWORD, _QWORD))v50;
              v53 = v51;
LABEL_68:
              _sSSSiSgSSSgIeggyg_SgWOe_0(v52, v53);
              goto LABEL_69;
            }
            return swift_bridgeObjectRelease(v20);
          }
          goto LABEL_86;
        }
        return swift_bridgeObjectRelease(v17);
      }
      goto LABEL_59;
    }
LABEL_79:
    v59 = &_s11ClaudeSwift0A12VMAnyCodable07_6E26B1F24F51AB5CCC69A9217701D7BEBLLVSgMd;
    v60 = &_s11ClaudeSwift0A12VMAnyCodable07_6E26B1F24F51AB5CCC69A9217701D7BEBLLVSgMR;
    v61 = &v85;
    return outlined destroy of (String, Any)(v61, v59, v60);
  }

In the decompilation, it does a chain of dictionary lookups using small-string-encoded keys and swift_dynamicCast for type-safe extraction before calling onStdout callback. The stderr handler similar, but instead just reads from OBJC_IVAR____...onStderr instead. The remaining events follow the same extraction pattern with different keys and types.

In the binary, the event name dispatch doesn't use standard string comparison.

Swift uses small string optimization — strings ≤15 bytes are stored inline as two integers rather than heap-allocated. The comparison is a fast integer check with a _stringCompareWithSmolCheck fallback for heap strings:

// Event dispatch at 0x20C1C — read event string from message offset +40/+48
v11 = *(void **)(a1 + 48);                   // message.event._object
v12 = *(_QWORD *)(a1 + 40);                  // message.event._countAndFlagsBits

// Fast path: compare raw small-string bits directly
if ( v12 == 0x7964616572LL && v11 == (void *)0xE500000000000000LL )      // "ready"
    goto HANDLE_READY;
// Slow path: full string comparison for heap-allocated strings
else if ( (_stringCompareWithSmolCheck(_:_:expecting:)() & 1) != 0 )
    goto HANDLE_READY;

if ( v12 == 0x74756F647473LL && v11 == (void *)0xE600000000000000LL )    // "stdout"
    goto HANDLE_STDOUT;
// ... same pattern for each event

The encoding is as follows, bytes stored in little-endian in the first word, discriminator byte (0xE0 | length) in the MSB of the second word.

The same encoding applies to dictionary keys extracted from message.params

Below are the associated event keys that it compares against before it calling the associated callback.

Event Name	Word 1 (LE bytes)	Word 2 (discriminator)	Length
ready	0x7964616572	0xE500000000000000	5
stdout	0x74756F647473	0xE600000000000000	6
stderr	0x727265647473	0xE600000000000000	6
exit	0x74697865	0xE400000000000000	4
error	0x726F727265	0xE500000000000000	5
networkStatus	0x536B726F7774656E	0xED00007375746174	13

Key	Integer Value	Discriminator
id	25705	0xE200000000000000
data	1635017060	0xE400000000000000
code	1701080931	0xE400000000000000
signal	0x6C616E676973	0xE600000000000000
message	0x6567617373656D	0xE700000000000000
fatal	0x6C61746166	0xE500000000000000
status	0x737574617473	0xE600000000000000

Sending Messages

To send a message to the Guest VM, the RPC layer uses length-prefixed JSON over vsock.

The format is simply [4-byte Big Endian Length][JSON bytes]. It utilizes VZVirtioSocketConnection.fileDescriptor to send messages and uses a string id req-<counter> to keep track.

Taking a look at sendRequest with the appropriate struct ClaudeVMMessage applied, we see the following.

void ClaudeVMDaemonRPCClient.sendRequest(method:params:)()
{
  ClaudeVMMessage *crafting_claudemessage; // x22
  __int64 v1; // x9
  __int64 requestCounter; // x8
  bool overflow_flag; // vf
  __int64 req_counter; // x8
  void *v5; // x21
  Swift::String v6; // x0
  void *object; // x19
  __int64 v8; // x0
  void *v9; // x8
  Swift::Int v10; // x9
  __int64 v11; // x21
  __int64 v12; // x0
  __int64 v13; // x24
  __int64 v14; // x20
  _QWORD *v15; // x21
  __int64 v16; // x19
  ClaudeVMMessage **v17; // x0
  __int64 v18; // x19
  __int64 ObjectType; // x0
  __int64 v20; // x3
  __int64 v21; // x1
  __int64 v22; // x2

  v1 = *(_QWORD *)&crafting_claudemessage[3].type;
  // (1) Check request counter for overflow
  requestCounter = *(_QWORD *)(v1 + OBJC_IVAR____TtC11ClaudeSwift23ClaudeVMDaemonRPCClient_requestCounter);
  overflow_flag = __OFADD__(requestCounter, 1);
  req_counter = requestCounter + 1;
  if ( overflow_flag )
  {
    __break(1u);
  }
  else
  {
    v5 = crafting_claudemessage[2].error.message._object;
    *(_QWORD *)(v1 + OBJC_IVAR____TtC11ClaudeSwift23ClaudeVMDaemonRPCClient_requestCounter) = req_counter;
    crafting_claudemessage[2].result_buf[2] = req_counter;
    v6._countAndFlagsBits = dispatch thunk of CustomStringConvertible.description.getter(
                              &type metadata for Int,
                              &protocol witness table for Int);
    object = v6._object;
    String.append(_:)(v6);
    swift_bridgeObjectRelease(object);
    // (2) Append request counter with the following format req-<counter>
    crafting_claudemessage[3].event.value._object = (void *)'-qer';
    crafting_claudemessage[3].params_buf[0] = 0xE400000000000000LL;
    if ( v5 )
      v8 = __swift_instantiateConcreteTypeFromMangledNameV2(
             &demangling cache variable for type metadata for [String : Any],
             (__int64 *)&mangled name ref for type metadata for [String : Any]);
    else
      v8 = 0;

    // (3) Initialize ClaudeVMMessage struct fields
    v9 = crafting_claudemessage[2].error.message._object;
    v10 = crafting_claudemessage[2].error.code;
    v11 = crafting_claudemessage[2].error.message._countAndFlagsBits;
    LOBYTE(crafting_claudemessage->params_meta) = 0;              // type = request
    crafting_claudemessage[1].method = 0u;
    crafting_claudemessage[1].event = 0u;
    crafting_claudemessage->result_buf[0] = '-qer';               // id prefix
    crafting_claudemessage->result_buf[1] = 0xE400000000000000LL; // id suffix marker
    crafting_claudemessage->result_buf[2] = v10;                  // id counter value
    crafting_claudemessage->result_meta = v11;                    // method string bits
    crafting_claudemessage->error.code = 0;                       // no error
    crafting_claudemessage->error.message._countAndFlagsBits = 0;
    crafting_claudemessage->error.message._object = v9;           // method string object
    *(_QWORD *)&crafting_claudemessage[1].type = 0;
    crafting_claudemessage[1].id.value._countAndFlagsBits = 0;
    crafting_claudemessage[1].id.value._object = (void *)v8;      // params dictionary
    crafting_claudemessage[1].params_buf[0] = 0;
    crafting_claudemessage[1].params_buf[1] = 0;
    crafting_claudemessage[1].params_buf[2] = 0
    swift_bridgeObjectRetain(v9);
    swift_bridgeObjectRetain(v11);
    swift_bridgeObjectRetain(0xE400000000000000LL);
    // (4) Serialize and write message to vsock (VZVirtioSocketConnection fd)
    v12 = ClaudeVMDaemonRPCClient.writeMessage(_:)((__int64)&crafting_claudemessage->params_meta);
    v13 = *(_QWORD *)&crafting_claudemessage[3].type;
    v14 = static MainActor.shared.getter(v12);
    crafting_claudemessage[3].params_buf[1] = v14;
    v15 = (_QWORD *)swift_task_alloc(48);
    crafting_claudemessage[3].params_buf[2] = (__int64)v15;
    v15[2] = v13;
    v15[3] = '-qer';
    v15[4] = 0xE400000000000000LL;
    // (5) Version check
    if ( _stdlib_isOSVersionAtLeastOrVariantVersionAtLeast(_:_:_:_:_:_:)(0xFu, 0, 0, 0x12u, 0, 0) )
    {
      v16 = crafting_claudemessage[3].method.value._countAndFlagsBits;
      v17 = (ClaudeVMMessage **)swift_task_alloc(async function pointer to withCheckedThrowingContinuation<A>(isolation:function:_:)[1]);
      crafting_claudemessage[3].params_meta = (__int64)v17;
      *v17 = crafting_claudemessage;
      // (6) Creates continuation and suspends till response/error
      v17[1] = (ClaudeVMMessage *)ClaudeVMDaemonRPCClient.sendRequest(method:params:);
      withCheckedThrowingContinuation<A>(isolation:function:_:)(
        crafting_claudemessage[2].result_meta,
        v14,
        v16,
        0xD00000000000001BLL,
        0x80000000001D3650LL,
        partial apply for closure #2 in ClaudeVMDaemonRPCClient.sendRequest(method:params:),
        v15,
        &type metadata for ClaudeVMMessage);
    }
    else
    {
      if ( v14 )
      {
        v18 = crafting_claudemessage[3].method.value._countAndFlagsBits;
        ObjectType = swift_getObjectType(v14);
        v20 = dispatch thunk of Actor.unownedExecutor.getter(ObjectType, v18);
        v22 = v21;
      }
      else
      {
        v20 = 0;
        v22 = 0;
      }
      swift_task_switch(ClaudeVMDaemonRPCClient.sendRequest(method:params:), v20, v22);
    }
  }
}

At a high level, the decompilation above is doing:

1. Increment and validate request counter

2. Generate unique request id req-<counter>

3. Craft ClaudeVMMessage

   1. Sets type = request

   2. Sets id = req-<counter>

   3. Sets method = provided_method_name

   4. Sets params = Dictionary<String, Any>

4. Serialize to JSON and write to vsock via writeMessage_vsock

5. Suspend and await a response (continuation stored in pendingRequests)

This function also makes use of Swift Continuations, which allow an asynchronous task to suspend itself so that synchronous code can capture it and manually resume it later in response to an event.

In this case at (6), it's doing the following:

1. Allocates task frame on the heap

   1. This allows it to persist across suspension

2. Create continuation and suspend

   1. Stores CheckedContinuation<ClaudeVMMessage, Error> in pendingRequests[requestId]

   2. Task suspends until the read loop decodes a matching response and handleResponse resumes it

For more information about Swift's Continuations, check this out

This brings us to ClaudeVMDaemonRPCClient.writeMessage_vsock, which is the on-the-wire encoder + write loop. For brevity's sake, I have truncated the decompilation to show only the key code.

__int64 __fastcall ClaudeVMDaemonRPCClient_writeMessage_vsock(ClaudeVMMessage *ClaudeVMMessage, ...)
{
  // (1) Load self.connection (VZVirtioSocketConnection) from offset +0x18; throw ClaudeVMRPCError if nil
  vsock_connection = *(void **)(self_ptr + 24);
  if ( !vsock_connection )
  {
    static Logger.debug(...);
    swift_willThrow(swift_allocError(&type metadata for ClaudeVMRPCError, ...));
    return;
  }

  // (2) JSON-encode ClaudeVMMessage to bytes via JSONEncoder.encode(...)
  json_encoder = JSONEncoder.init()();
  v11 = dispatch thunk of JSONEncoder.encode<A>(_:)(ClaudeVMMessage, &type metadata for ClaudeVMMessage, ...);
  json_data       = v11;
  json_data_flags = v12;
  swift_release(json_encoder);

  // (3) Compute byte length, bswap32 it for big-endian wire format, prepend to JSON bytes
  //     payload = [4-byte BE length] + [JSON bytes]
  length_prefix_be = bswap32(json_len);
  payload_data = specialized Data._Representation.init(_:)(&length_prefix_be, ...);
  Data.append(_:)(json_data, json_data_flags);

  // (4) Get raw vsock fd via [VZVirtioSocketConnection fileDescriptor]
  vsock_fd = (ssize_t)objc_msgSend(vsock_connection_retained, "fileDescriptor");

  // (5) Write loop — handles partial writes; on EAGAIN sleeps 1ms and retries
  while ( v53 < total_bytes_to_write )
  {
    vsock_fd = write(v47, v67, remaining);
    if ( vsock_fd < 0 )
    {
      errno_value = errno.getter();
      if ( errno_value != 35 )               // errno 35 = EAGAIN/EWOULDBLOCK
      {
        static Logger.error(...);
        swift_willThrow(swift_allocError(&type metadata for ClaudeVMRPCError, ...));
        return;
      }
      vsock_fd = usleep(0x3E8u);             // sleep 1ms and retry
    }
    v53 += vsock_fd;
  }
}

writeMessage_vsock is the implementation for outbound RPC:

1. Load self.connection (VZVirtioSocketConnection) and error/throw if it’s nil.

2. Encode the ClaudeVMMessage to JSON bytes via JSONEncoder.encode(...).

3. Compute the JSON byte length and build the frame:

   1. length_prefix_be = bswap32(json_len)

   2. payload = Data(prefix_be) + jsonBytes

4. Write the payload to the vsock fd in a loop:

   1. Handles partial writes (keeps an offset until written == total).

   2. If write(...) fails with errno == 35 (EAGAIN/EWOULDBLOCK), it sleeps (usleep(1000)) and retries.

   3. Other errno values become ClaudeVMRPCError.

Another odd thing you might notice is that IDA's decompilation of Swift is usually full of undefined variables highlighted in red.

Using writeMessage as an example, we see that v1 is undefined.

Looking at the disassembly reveals that v1 maps to the x20 register, which serves as the designated Swift self pointer according to the ARM64 calling convention.

We can easily fix this by modifying the calling convention by editing the function prototype.

__int64 __usercall ClaudeVMDaemonRPCClient_writeMessage_vsock@<X0>(ClaudeVMMessage *message@<X0>, __int64 a2@<X1>, _TtC11ClaudeSwift23ClaudeVMDaemonRPCClient *self@<X20>);

This gives us a nicer decompilation in IDA.

To understand which methods actually use sendRequest, we can take a look at the xrefs.

We see the spawn method, let's take a closer look at its decompilation.

unsigned __int64 ClaudeVMDaemonRPCClient.spawn(id:name:command:args:cwd:env:additionalMounts:isResume:allowedDomains:sharedCwdPath:)()
{
  // (1) Load all spawn parameters
  cwd_string_object   = *(void **)(async_frame + 928);
  additionalMounts_ptr = *(_QWORD *)(async_frame + 944);
  args_array          = *(_QWORD *)(async_frame + 912);
  command_object      = *(void **)(async_frame + 904);
  name_object         = *(void **)(async_frame + 888);
  id_object           = *(void **)(async_frame + 872);
  isResume            = *(unsigned __int8 *)(async_frame + 1040);
  // ... log: "spawn: id=<id> name=<name> command=<cmd> args=[...] cwd=<cwd> mounts=<n> isResume=<bool>"
  static Logger.debug(..., 459);

  // (2) Build params dictionary with required fields such as id, name etc
  params_storage = swift_initStackObject(..., frame + 16);
  *(_QWORD *)(params_storage + 32) = 25705;            // params["id"]       = id       (small string "id")
  *(_QWORD *)(params_storage + 80) = 1701667182;       // params["name"]     = name     (small string "name")
  *(_QWORD *)(params_storage + 128) = 0x646E616D6D6F63LL; // params["command"] = command (small string "command")
  *(_QWORD *)(params_storage + 176) = 1936159329;      // params["args"]     = args     (small string "args")
  *(_BYTE *)(params_storage + 240)  = isResume_saved;  // params["isResume"] = isResume
  params = _sSD17dictionaryLiteralSDyxq_Gx_q_td_tcfCSS_ypTt0g5Tf4g_n(params_storage); // Dictionary<String, Any>

  // (3) Add optional params: cwd, env
  if ( cwd_saved )
    specialized _NativeDictionary.setValue(_:forKey:isUnique:)(cwd_saved,   "cwd", ...);
  if ( env_dict )
    specialized _NativeDictionary.setValue(_:forKey:isUnique:)(env_dict,    "env", ...);

  // (4) If additionalMounts is set, iterate the dictionary and build per-mount config dicts
  //     Each entry: mountName → {"path": subpath, "mode": "rw"/"ro"/"rwd"}
  if ( additionalMounts_ptr )
  {
    while ( bucket_mask )                              // walk Swift Dictionary hash buckets
    {
      mount_name = v71[1];
      mount_path = *v73;   mount_mode = v73[2];
      mount_config_dict = _DictionaryStorage.allocate(capacity: 2); // {"path": ..., "mode": ...}
      specialized _NativeDictionary.setValue(mount_config_dict, mount_name, ...); // mounts[name] = config
    }
    specialized _NativeDictionary.setValue(_:forKey:isUnique:)(mounts_dict, "additionalMounts", ...);
  }

  // (5) Add remaining optional params: allowedDomains, sharedCwdPath
  if ( allowedDomains_ptr )
    specialized _NativeDictionary.setValue(_:forKey:isUnique:)(allowedDomains, "allowedDomains", ...);
  if ( sharedCwdPath_ptr )
    specialized _NativeDictionary.setValue(_:forKey:isUnique:)(sharedCwdPath,  "sharedCwdPath",  ...);

  // (6) Allocate async continuation frame and tail-call sendRequest(method: "spawn", params: paramsDict)
  continuation_frame = swift_task_alloc(528);
  *continuation_frame = frame;
  continuation_frame[1] = ClaudeVMDaemonRPCClient.spawn(...);
  return ClaudeVMDaemonRPCClient_sendRequest_async(frame + 288, 'nwaps', '\xE5\0\0\0\0\0\0\0', params);
}

This function simply does the following

1. Load parameters from async_frame

   1. id

   2. name

   3. command

   4. args

   5. cwd

   6. env

   7. additionalMounts

   8. allowedDomains

   9. sharedCwdPath

   10. isResume

2. Create base dictionary and add optional parameters cwd and env

3. Sends RPC request via sendRequest which serialized params to JSON

The final JSON sent to the VM should look something like this

{
  "type": "request",
  "id": "req-1",
  "method": "spawn",
  "params": {
    "id": "uuid-here",
    "name": "cowork-session", 
    "command": "claude",
    "args": ["--arg1", "--arg2"],
    "isResume": false,
    "cwd": "/home/user/project",
    "env": {"KEY": "value"},
    "additionalMounts": {
      "project": {"path": "Documents/project", "mode": "rw"}
    },
    "allowedDomains": ["api.anthropic.com"],
    "sharedCwdPath": "/sessions/shared"
  }
}

Other functions such as mountPath do something similar where they format a JSON request and send it to the VM guest daemon. The message specification and parameters are specified below and the actual validation/action is done in the guest-daemon side.

#	Swift Method	RPC Method	Address	N-API Export	JS Call
1	spawn(id:name:command:args:cwd:env:additionalMounts:isResume:allowedDomains:sharedCwdPath:)	"spawn"	0x22f48	vmSpawn	vm.spawn(...)
2	kill(id:signal:)	"kill"	0x23a74	vmKill	vm.kill(id, signal)
3	isRunning(id:)	"isRunning"	0x23d20	vmIsProcessRunning	vm.isProcessRunning(id)
4	mountPath(processId:subpath:mountName:mode:)	"mountPath"	0x245f8	vmMountPath	vm.mountPath(...)
5	loadTranscripts(processName:)	"loadTranscripts"	0x2495c	vmLoadTranscripts	vm.loadTranscripts(name)
6	readFile(processName:filePath:)	"readFile"	0x24ee0	vmReadFile	vm.readFile(name, path)
7	installSdk(sdkSubpath:version:)	"installSdk"	0x25550	vmInstallSdk	vm.installSdk(path, ver)
8	addApprovedOauthToken(token:)	"addApprovedOauthToken"	0x25b58	vmAddApprovedOauthToken	vm.addApprovedOauthToken(token)

writeStdin — Fire-and-Forget Notifications

ClaudeVMDaemonRPCClient.writeStdin(id:data:) at 0x24070. Unlike spawn/kill, this does not use sendRequest — it builds a ClaudeVMMessage with type=1 (notification) and calls writeMessage directly.

// ClaudeVMDaemonRPCClient.writeStdin(id:data:) @ 0x24070
Swift::Void ClaudeVMDaemonRPCClient.writeStdin(id:data:)(
        Swift::String id,
        Swift::String data)
{
  object = data._object;
  countAndFlagsBits = data._countAndFlagsBits;
  v4 = id._object;
  v5 = id._countAndFlagsBits;

  // (1) Build key-value pairs for params dict: {"id": id, "data": data}
  inited = swift_initStackObject(v6, v12);
  *(_OWORD *)(inited + 16) = xmmword_1E30E0;
  *(_QWORD *)(inited + 32) = 25705;              // "id" (0x6469 little-endian small string)
  *(_QWORD *)(inited + 40) = 0xE200000000000000LL;
  *(_QWORD *)(inited + 48) = v5;                  // id value
  *(_QWORD *)(inited + 56) = v4;
  *(_QWORD *)(inited + 64) = 1635017060;          // "data" (0x61746164 little-endian small string)
  *(_QWORD *)(inited + 72) = 0xE400000000000000LL;
  *(_QWORD *)(inited + 80) = countAndFlagsBits;   // data value
  *(_QWORD *)(inited + 88) = object;

  v8 = _sSD17dictionaryLiteralSDyxq_Gx_q_td_tcfCSS_SSTt0g5Tf4g_n(inited);
                                                   // Dictionary literal init from key-value pairs

  // (2) Build ClaudeVMMessage — type=1 (notification), method="stdin"
  v13.type = 1;                                    // notification — no response expected
  v13.id.value._countAndFlagsBits = 0;             // no id (not a request)
  v13.id.value._object = 0;
  v13.method = (Swift::String_optional)xmmword_1E3100;  // "stdin" (5-byte small string at 0x1E3100)
  v13.event.value._countAndFlagsBits = 0;
  v13.params_buf[0] = v8;                          // params = {"id": id, "data": data}
  memset(v13.result_buf, 0, 56);

  // (3) Send directly via writeMessage — no continuation
  ClaudeVMDaemonRPCClient_writeMessage_vsock(&v13, v10, v11);

  outlined destroy of ClaudeVMMessage(&v13);
}

Key difference from sendRequest is that it uses ClaudeVMMessage.type = 1 (notification) instead of type = 0 (request). This means that it doesn't wait for a response back.

Complete Chain

Here's how the different components covered above work together, using spawn command as the example.

0. Wire up callbacks (once)

Before the VM can report anything back to JS, the callbacks need to be registered. qme() does this on first spawn and never again:

// app.asar — qme() @ index.js:133086
let Gte = false;
async function qme() {
  // (1) Skip if already initialized
  if (Gte) return;
  // (2) Get Swift VM addon handle
  const t = await Ca();
  // (3) Register all 5 event callbacks — each routes by process id via Ys map
  t.setEventCallbacks(
    (r, a) => { Ys.get(r)?.pushStdout(a) },            // onStdout        — stdout data
    (r, a) => { Ys.get(r)?.pushStdout(a) },            // onStderr        — NOTE: merged into stdout
    (r, a, n) => { Ys.get(r)?.setExited(a, n) },       // onExit          — (exitCode, signal)
    (r, a) => { Ys.get(r)?.setError(new Error(a)) },   // onError
    (r) => { X4.emit("networkStatus", r) }              // onNetworkStatus — VM-level event
  );
  Gte = true;
}

Swift wraps each of those closures as a thread-safe function handle (napi_threadsafe_function) so they can be called from any thread, then copies them to the live RPC client via applyStoredCallbacks().

1. JS calls spawn

$5e (the spawn wrapper in app.asar) calls qme(), then calls o.spawn(...) on the Swift addon. That goes through N-API into ClaudeVMDaemonRPCClient.spawn, which builds the parameters dictionary and hands it to sendRequest.

2. Request goes out over vsock

sendRequest assigns the call an ID ("req-N"), serializes it to JSON, prepends a 4-byte big-endian length, and writes the frame over the vsock file descriptor. It then suspends the current Swift async task, storing a CheckedContinuation in pendingRequests["req-N"] and waits.

3. Guest responds

The guest daemon processes the spawn and sends back {"type":"response","id":"req-N","result":{...}}. The read loop on the host picks it up, decodes it, and routes it to handleResponse, which looks up the stored continuation by ID and resumes it. The original sendRequest call returns with the response.

4. Guest pushes stdout events

Once the process is running, the guest sends output as events where no request from the host needed. Each message looks like {"type":"event","event":"stdout","params":{"id":"...","data":"..."}}. handleEvent matches the event name, extracts the data, and calls the stored onStdout callback.

The four message types the vSock layer uses:

Type	Name	Direction	Handling
0	request	Host → Guest	sendRequest — continuation stored in pendingRequests
1	notification	Host → Guest	writeMessage — fire-and-forget, no response
2	response	Guest → Host	handleResponse — resumes stored continuation
3	event	Guest → Host	handleEvent — invokes stored callback closure

This is a diagram of what that looks like

┌──────────────────────────────────────────────────────────────────────────┐
│                     vSock Communication Flow                            │
│                                                                         │
│  ┌──────────┐                                          ┌─────────────┐  │
│  │  Electron │                                          │  Guest VM   │  │
│  │  (JS)     │                                          │  (Go Daemon)│  │
│  └─────┬─────┘                                          └──────┬──────┘  │
│        │                                                       │         │
│        │  vm.spawn(...)                                        │         │
│        ├──────────────────────────────────────────────────────►│         │
│        │  {"type":"request","id":"req-1","method":"spawn",...}  │         │
│        │  [4-byte BE len][JSON]                                │         │
│        │                                                       │         │
│        │                       {"type":"response","id":"req-1" │         │
│        │◄────────────────────,"result":{...}}─────────────────┤         │
│        │  handleResponse → resume continuation                 │         │
│        │                                                       │         │
│        │  vm.writeStdin(id, data)                              │         │
│        ├──────────────────────────────────────────────────────►│         │
│        │  {"type":"notification","method":"stdin",...}          │         │
│        │  (fire-and-forget, no response)                       │         │
│        │                                                       │         │
│        │                       {"type":"event",                │         │
│        │◄────────────────────"event":"stdout",...}─────────────┤         │
│        │  handleEvent → onStdout → Ys.get(id).pushStdout()     │         │
│        │                                                       │         │
│  ┌─────┴─────┐                                          ┌──────┴──────┐  │
│  │  swift-    │          vsock port 51234                │  guest-     │  │
│  │  addon     │  ◄═══════════════════════════════════►   │  daemon     │  │
│  │  .node     │    Length-prefixed JSON over virtio      │             │  │
│  └───────────┘                                          └─────────────┘  │
└──────────────────────────────────────────────────────────────────────────┘

Both onStdout and onStderr in qme() call pushStdout where stdout and stderr are merged into a single stream at the JS layer.

Tracing

Using strace, we could come up with a simple script that traces all vsock communication to/from host to guest by tracking read and write syscalls.

#!/usr/sbin/dtrace -s

#pragma D option quiet
#pragma D option bufsize=64m
#pragma D option dynvarsize=64m
#pragma D option strsize=16384
#pragma D option cleanrate=50hz

dtrace:::BEGIN
{
    printf("Capturing Claude vsock messages...\nPress Ctrl+C to stop\n\n");
}

syscall::read:entry
/execname == "Claude"/
{
    self->buf  = arg1;
    self->size = arg2;
    self->track = 1;
}

syscall::read:return
/self->track == 1 && arg1 > 4/
{
    this->d = (uint8_t *)copyin(self->buf, 5);
    this->msglen = (this->d[0] << 24) | (this->d[1] << 16) | (this->d[2] << 8) | this->d[3];

    this->ok = (this->d[4] == 0x7b && this->msglen > 5 && this->msglen < 1000000) ? 1 : 0;
}

syscall::read:return
/self->track == 1 && arg1 > 4 && this->ok/
{
    printf("[%Y] READ  fd=%d bytes=%d\n>>> %s\n\n",
           walltimestamp, self->buf, arg1,
           copyinstr(self->buf + 4, (self->size < 16383) ? self->size : 16383));

    self->buf = 0; self->size = 0; self->track = 0;
}

syscall::read:return
/self->track == 1/
{
    self->buf = 0; self->size = 0; self->track = 0;
}

syscall::write:entry
/execname == "Claude"/
{
    self->wbuf  = arg1;
    self->wsize = arg2;
    self->wtrack = 1;
}

syscall::write:return
/self->wtrack == 1 && arg1 > 4/
{
    this->wd = (uint8_t *)copyin(self->wbuf, 5);
    this->wmsglen = (this->wd[0] << 24) | (this->wd[1] << 16) | (this->wd[2] << 8) | this->wd[3];

    this->wok = (this->wd[4] == 0x7b && this->wmsglen > 5 && this->wmsglen < 1000000) ? 1 : 0;
}

syscall::write:return
/self->wtrack == 1 && arg1 > 4 && this->wok/
{
    printf("[%Y] WRITE fd=%d bytes=%d\n<<< %s\n\n",
           walltimestamp, self->wbuf, arg1,
           copyinstr(self->wbuf + 4, (self->wsize < 16383) ? self->wsize : 16383));

    self->wbuf = 0; self->wsize = 0; self->wtrack = 0;
}

syscall::write:return
/self->wtrack == 1/
{
    self->wbuf = 0; self->wsize = 0; self->wtrack = 0;
}

dtrace:::END
{
    printf("Capture stopped.\n");
}

In the example below, I requested to mount a directory from host to guest (mountPath) and sure enough we see the call.

[2026 Feb  9 16:29:32] CLAUDE READ fd=87 bytes=754 msglen=238
>>> {"type":"event","event":"stdout","params":{"id":"70cfac68-2a41-4f32-ac5f-9b69df3fcab7","data":"{\"type\":\"stream_event\",\"event\":{\"type\":\"content_block_start\",\"index\":3,\"content_block\":{\"type\":\"tool_use\",\"id\":\"toolu_015PhvjpGPbs8uKRhuJx51WB\",\"name\":\"mcp__cowork__request_cowork_directory\",\"input\":{}}},\"session_id\":\"7fb3a8bc-a9e9-405c-be62-3c6ed0eea52f\",\"parent_tool_use_id\":null,\"uuid\":\"0d3af87b-6ee9-4c4b-aab7-696d9ab37b2b\"}\n{\"type\":\"stream_event\",\"event\":{\"type\":\"content_block_delta\",\"index\":3,\"delta\":{\"type\":\"input_json_delta\",\"partial_json\":\"\"}},\"session_id\":\"7fb3a8bc-a9e9-405c-be62-3c6ed0eea52f\",\"parent_tool_use_id\":null,\"uuid\":\"e49708ad-403d-4c65-935a-ed81cf9ecdc4\"}\n"}}

[2026 Feb  9 16:29:32] CLAUDE READ fd=87 bytes=2002 msglen=113
>>> {"type":"event","event":"stdout","params":{"id":"70cfac68-2a41-4f32-ac5f-9b69df3fcab7","data":"{\"type\":\"assistant\",\"message\":{\"model\":\"claude-opus-4-6\",\"id\":\"msg_01KFWgpSAc8SwnXKXtP811AR\",\"type\":\"message\",\"role\":\"assistant\",\"content\":[{\"type\":\"tool_use\",\"id\":\"toolu_015PhvjpGPbs8uKRhuJx51WB\",\"name\":\"mcp__cowork__request_cowork_directory\",\"input\":{}}],\"stop_reason\":null,\"stop_sequence\":null,\"usage\":{\"input_tokens\":3,\"cache_creation_input_tokens\":11577,\"cache_read_input_tokens\":22237,\"cache_creation\":{\"ephemeral_5m_input_tokens\":0,\"ephemeral_1h_input_tokens\":11577},\"output_tokens\":12,\"service_tier\":\"standard\",\"inference_geo\":\"not_available\"},\"context_management\":null},\"parent_tool_use_id\":null,\"session_id\":\"7fb3a8bc-a9e9-405c-be62-3c6ed0eea52f\",\"uuid\":\"0151684e-37ea-460f-b979-2aa2126423be\"}\n"}}

[2026 Feb  9 16:29:32] CLAUDE READ fd=87 bytes=532 msglen=16
>>> {"type":"event","event":"stdout","params":{"id":"70cfac68-2a41-4f32-ac5f-9b69df3fcab7","data":"{\"type\":\"control_request\",\"request_id\":\"7b28d2cb-3b99-40b7-8bfe-eb3dc3b4122c\",\"request\":{\"subtype\":\"can_use_tool\",\"tool_name\":\"mcp__cowork__request_cowork_directory\",\"input\":{},\"permission_suggestions\":[{\"type\":\"addRules\",\"rules\":[{\"toolName\":\"mcp__cowork__request_cowork_directory\"}],\"behavior\":\"allow\",\"destination\":\"localSettings\"}],\"tool_use_id\":\"toolu_015PhvjpGPbs8uKRhuJx51WB\"}}\n"}}

[2026 Feb  9 16:29:38] CLAUDE READ fd=87 bytes=488 msglen=228
>>> {"type":"event","event":"stdout","params":{"id":"70cfac68-2a41-4f32-ac5f-9b69df3fcab7","data":"{\"type\":\"control_request\",\"request_id\":\"56e7fe8d-cedf-4a8e-9a74-d4a303eab959\",\"request\":{\"subtype\":\"mcp_message\",\"server_name\":\"cowork\",\"message\":{\"method\":\"tools/call\",\"params\":{\"name\":\"request_cowork_directory\",\"arguments\":{},\"_meta\":{\"claudecode/toolUseId\":\"toolu_015PhvjpGPbs8uKRhuJx51WB\",\"progressToken\":2}},\"jsonrpc\":\"2.0\",\"id\":2}}}\n"}}

[2026 Feb  9 16:29:42] CLAUDE WRITE fd=87 bytes=169 msglen=165
<<< {"type":"request","params":{"processId":"70cfac68-2a41-4f32-ac5f-9b69df3fcab7","subpath":"Music","mode":"rw","mountName":"Music"},"id":"req-33","method":"mountPath"}eq-33","method":"mountPath"}

[2026 Feb  9 16:29:42] CLAUDE READ fd=87 bytes=117 msglen=113
>>> {"type":"response","id":"req-33","result":{"mountPoint":"/sessions/busy-sharp-davinci/mnt/Music","success":true}}

[2026 Feb  9 16:29:42] CLAUDE WRITE fd=87 bytes=577 msglen=61
<<< {"method":"stdin","type":"notification","params":{"id":"70cfac68-2a41-4f32-ac5f-9b69df3fcab7","data":"{\"type\":\"control_response\",\"response\":{\"subtype\":\"success\",\"request_id\":\"56e7fe8d-cedf-4a8e-9a74-d4a303eab959\",\"response\":{\"mcp_response\":{\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"Successfully mounted directory.\\n\\nHost path: \/Users\/user\/Music\\nVM path: \/sessions\/busy-sharp-davinci\/mnt\/Music\\n\\nYou can now access files in this directory at \/sessions\/busy-sharp-davinci\/mnt\/Music\"}]},\"jsonrpc\":\"2.0\",\"id\":2}}}}\n"}}

[2026 Feb  9 16:29:42] CLAUDE READ fd=87 bytes=895 msglen=123
>>> {"type":"event","event":"stdout","params":{"id":"70cfac68-2a41-4f32-ac5f-9b69df3fcab7","data":"{\"type\":\"user\",\"message\":{\"role\":\"user\",\"content\":[{\"tool_use_id\":\"toolu_015PhvjpGPbs8uKRhuJx51WB\",\"type\":\"tool_result\",\"content\":[{\"type\":\"text\",\"text\":\"Successfully mounted directory.\\n\\nHost path: /Users/user/Music\\nVM path: /sessions/busy-sharp-davinci/mnt/Music\\n\\nYou can now access files in this directory at /sessions/busy-sharp-davinci/mnt/Music\"}]}]},\"parent_tool_use_id\":null,\"session_id\":\"7fb3a8bc-a9e9-405c-be62-3c6ed0eea52f\",\"uuid\":\"0a3e356e-26fe-41af-b933-4cc932672376\",\"tool_use_result\":[{\"type\":\"text\",\"text\":\"Successfully mounted directory.\\n\\nHost path: /Users/user/Music\\nVM path: /sessions/busy-sharp-davinci/mnt/Music\\n\\nYou can now access files in this directory at /sessions/busy-sharp-davinci/mnt/Music\"}]}\n"}}

This is in line with the current analysis, where the mountPath parameters matches (processId, subpath, mode, mountName).

{"type":"request","params":{"processId":"70cfac68-2a41-4f32-ac5f-9b69df3fcab7","subpath":"Music","mode":"rw","mountName":"Music"},"id":"req-33","method":"mountPath"}eq-33","method":"mountPath"}

Guest VM

Now that we know how the host communicates with the Guest VM. Let's take a look at what the binaries/processes running inside the Guest VM entail.

As I was lazy to download the Guest VM and manually extract out the relevant files, I prompted Claude-CoWork to reveal the processes running on the machine and extract out the relevant files for analysis.

claude

This is the main claude binary, which is compiled with bun.js utilizing JavaScriptCore. Running it on a ARM Linux VM shows that its just a compiled Claude-Code Binary

Welcome to Claude Code v2.1.8                                                                                        
…………………………………………………………………………………………………………………………………………………………                                                           
                                                                                                                    
    *                                       █████▓▓░                                                                
                                *         ███▓░     ░░                                                              
            ░░░░░░                        ███▓░                                                                      
    ░░░   ░░░░░░░░░░                      ███▓░                                                                      
  ░░░░░░░░░░░░░░░░░░░    *                ██▓░░      ▓                                                              
                                            ░▓▓███▓▓░                                                               
*                                 ░░░░                                                                              
                                ░░░░░░░░                                                                            
                              ░░░░░░░░░░░░░░░░                                                                      
      █████████                                        *                                                            
      ██▄█████▄██                        *                                                                           
      █████████      *                                                                                              
…………………█ █   █ █………………………………………………………………………………………………………………                                                           
                                                                                                                    
Let's get started.                                                                                                  
                                                                                                                    
Choose the text style that looks best with your terminal                                                            
To change this later, run /theme                                                                                    
                                                                                                                    
❯ 1. Dark mode ✔                                                                                                    
  1. Light mode                                                                                                     
  2. Dark mode (colorblind-friendly)                                                                                
  3. Light mode (colorblind-friendly)                                                                               
  4. Dark mode (ANSI colors only)                                                                                   
  5. Light mode (ANSI colors only)                                                                                  
                                                                                                                    
╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌
1  function greet() {                                                                                               
2 -  console.log("Hello, World!");                                                                                  
2 +  console.log("Hello, Claude!");                                                                                 
3  }                                                                                                                
╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌
Syntax theme: Monokai Extended (ctrl+t to disable)                                                                  

apply-seccomp

apply-seccomp-<arch> is a helper binary used for enforcing seccomp rules (*.bpf files).

user@lima-default:/Users/user/Documents/GitHub/ClaudeResearch/vm_binaries/seccomp$ seccomp-tools disasm ./unix-block-x64.bpf 
line  CODE  JT   JF      K
=================================
0000: 0x20 0x00 0x00 0x00000004  A = arch
0001: 0x15 0x00 0x0a 0xc000003e  if (A != ARCH_X86_64) goto 0012
0002: 0x20 0x00 0x00 0x00000000  A = sys_number
0003: 0x35 0x00 0x01 0x40000000  if (A < 0x40000000) goto 0005
0004: 0x15 0x00 0x07 0xffffffff  if (A != 0xffffffff) goto 0012
0005: 0x15 0x00 0x04 0x00000029  if (A != amd64.socket) goto 0010
0006: 0x20 0x00 0x00 0x00000014  A = new_root >> 32 # pivot_root(new_root, put_old)
0007: 0x15 0x00 0x02 0x00000000  if (A != 0x0) goto 0010
0008: 0x20 0x00 0x00 0x00000010  A = new_root # pivot_root(new_root, put_old)
0009: 0x15 0x01 0x00 0x00000001  if (A == 0x1) goto 0011
0010: 0x06 0x00 0x00 0x7fff0000  return ALLOW
0011: 0x06 0x00 0x00 0x00050001  return ERRNO(1)
0012: 0x06 0x00 0x00 0x00000000  return KILL
user@lima-default:/Users/user/Documents/GitHub/ClaudeResearch/vm_binaries/seccomp$ seccomp-tools disasm ./unix-block-arm64.bpf 
line  CODE  JT   JF      K
=================================
0000: 0x20 0x00 0x00 0x00000004  A = arch
0001: 0x15 0x00 0x08 0xc00000b7  if (A != ARCH_AARCH64) goto 0010
0002: 0x20 0x00 0x00 0x00000000  A = sys_number
0003: 0x15 0x00 0x04 0x000000c6  if (A != socket) goto 0008
0004: 0x20 0x00 0x00 0x00000014  A = family >> 32 # socket(family, type, protocol)
0005: 0x15 0x00 0x02 0x00000000  if (A != 0x0) goto 0008
0006: 0x20 0x00 0x00 0x00000010  A = family # socket(family, type, protocol)
0007: 0x15 0x01 0x00 0x00000001  if (A == 0x1) goto 0009
0008: 0x06 0x00 0x00 0x7fff0000  return ALLOW
0009: 0x06 0x00 0x00 0x00050001  return ERRNO(1)
0010: 0x06 0x00 0x00 0x00000000  return KILL
user@lima-default:/Users/user/Documents/GitHub/ClaudeResearch/vm_binaries/seccomp$ 

Using seccomp-tools, we can easily see the accompanying seccomp rules

• Both seccomp filters block unix domain socket calls with AF_UNIX = 1, which prevents the sandboxed process from talking to other processes.

• The x64 filter does the additional step of blocking x32 syscalls as well, preventing x32 abi abuse

Opening apply-seccomp- in IDA reveals a straightforward wrapper that loads a BPF filter, installs it via seccomp, and then replaces itself with the target process using execve.

// main(int argc, char **argv)                                                                                   
__int64 __fastcall main(int argc, char **argv)                                                                   
{                                                                                                                
  int fd;                                                                                                      
  unsigned int fd_copy;                                                                                        
  __int64 bytes_read;                                                                                                                                                                                                                                                          
  int v15;                         // [rsp+0h] - sock_fprog.len                                                
  _BYTE v16[24];                   // [rsp+10h] - BPF filter buffer (up to 4096 bytes)                         
  unsigned __int64 stack_canary;   // [rsp+1018h] - stack protector                                            
                                                                                                               
  stack_canary = __readfsqword(0x28u);  // Stack canary check                                                  
                                                                                                               
  // Check argument count: need at least 3 args (program, filter, command)                                     
  if (argc <= 2)                                                                                               
  {                                                                                                            
      // Print usage message                                                                                   
      fprintf(stderr, "Usage: %s <filter.bpf> <command> [args...]\n", argv[0]);                                
  }                                                                                                            
  else                                                                                                         
  {                                                                                                            
      // (1) Open the BPF filter file                                                                      
      fd = open(argv[1], O_RDONLY);  // sub_448010                                                             
      fd_copy = fd;                                                                                            
                                                                                                               
      if (fd < 0)                                                                                              
      {                                                                                                        
          perror("Failed to open BPF filter file");                                                            
      }                                                                                                        
      else                                                                                                     
      {                                                                                                        
          // (2) Read up to 4096 bytes from the filter file                                                
          bytes_read = read(fd, v16, 4096);  // sub_448140                                                     
                                                                                                               
          // (3) Close the file                                                                            
          close(fd_copy);  // sub_4483B0                                                                       
                                                                                                               
          if (bytes_read < 0)                                                                                  
          {                                                                                                    
              perror("Failed to read BPF filter");                                                             
          }                                                                                                    
          else if (bytes_read == 0)                                                                            
          {                                                                                                    
              // Empty file                                                                                    
              fwrite("BPF filter file is empty\n", 1, 25, stderr);                                             
          }                                                                                                    
          else if ((bytes_read & 7) != 0)                                                                      
          {                                                                                                    
              // Size must be multiple of 8 (each BPF instruction is 8 bytes)                                  
              fprintf(stderr,                                                                                  
                  "Invalid BPF filter size: %zd (must be multiple of 8)\n",                                    
                  bytes_read);                                                                                 
          }                                                                                                    
          else                                                                                                 
          {                                                                                                    
              // (4) Build sock_fprog structure                                                            
              // sock_fprog.len = number of instructions (size / 8)                                            
              LOWORD(v15) = bytes_read >> 3;                                                                   
              // sock_fprog.filter = pointer to v16 buffer (set implicitly via stack layout)                   
                                                                                                               
              // (5) Set PR_SET_NO_NEW_PRIVS (required before loading seccomp filter)                      
              // prctl(38, 1, 0, 0, 0)                                                                         
              if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))  // sub_44A8D0                                       
              {                                                                                                
                  perror("prctl(PR_SET_NO_NEW_PRIVS) failed");                                                 
              }                                                                                                
              // (6)) Apply seccomp BPF filter                                                              
              // prctl(22, 2, &sock_fprog)                                                                     
              else if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &v15))                                       
              {                                                                                                
                  perror("prctl(PR_SET_SECCOMP) failed");                                                      
              }                                                                                                
              else                                                                                             
              {                                                                                                
                  // Step 7: Execute the command with remaining arguments                                      
                  // argv[2] = command, &argv[2] = new argv array                                              
                  execvp(argv[2], &argv[2]);  // sub_446F70                                                    
                                                                                                               
                  // Only reached if execvp fails                                                              
                  perror("execvp failed");                                                                     
              }                                                                                                
          }                                                                                                    
      }                                                                                                        
  }                                                                                                            
                                                                                                               
  // Stack canary verification                                                                                 
  if (stack_canary != __readfsqword(0x28u))                                                                    
      __stack_chk_fail();                                                                                                                                                                                                      
  return 1;  // Return 1 on any error path                                                                     
}

To summarize, the binary does the following

1. Load the BPF filter from the file specified in argv[1].

2. Lock privileges with prctl(PR_SET_NO_NEW_PRIVS, 1), ensuring neither this process nor any descendant can gain new privileges.

3. Install the seccomp filter with prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &sock_fprog).

   1. Once applied, the filter is inherited by all child processes, cannot be removed, and persists across execve.

4. Replace itself via execvp(command, args), so the target command starts inside the sandbox.

Because the filter is installed before execve, the new process image inherits the restrictions from the moment it begins execution. Any blocked syscall triggers the configured action which is either SIGKILL (for architecture mismatches) or ERRNO(1) (for disallowed Unix socket creation)

sdk-daemon (aka coworkd)

This is the main binary of interest that orchestrates what is going on in the Guest VM.

Like most golang binaries, we can make use of redress to extract metadata and reconstruct symbols.

Nicholas@Nicholas-MacBook-Pro redress-v1.2.56 % ./redress info /Users/user/Desktop/Personal/Claude/_vm_extract/bin/sdk-daemon
OS            EM_AARCH64
Arch          
Compiler      1.23.12 (2025-08-06)
Build ID      iSrozSaxcnoBfj3Acbc4/EZkgU-uIo4Ce7LDccwKo/FlzBqbNWUwXA8HBJWaH-/rfhrZ41dcnjVPRnbQkLV
Main root     sdk-daemon
# main        4
# std         118
# vendor      14
-buildmode    exe
-compiler     gc
-trimpath     true
CGO_ENABLED   0
GOARCH        arm64
GOOS          linux
GOARM64       v8.0
vcs           git
vcs.revision  c2a39e9c82f5a4d51f511f53f532afd276312731
vcs.time      2026-01-18T20:18:52Z
vcs.modified  true

Here vcs.time tells us that this binary was built on 18/01/2026.

Another useful command is types <struct|interface|all> which parses golang's metadata to display the structs defined in the binary.

user@users-MacBook-Pro redress-v1.2.56 % ./redress types struct /Users/user/Desktop/Personal/Claude/_vm_extract/bin/sdk-daemon
type abi.FuncType struct {
	abi.Type
	InCount  uint16
	OutCount uint16
}

type abi.ITab struct {
	Inter *abi.InterfaceType
	Type  *abi.Type
	Hash  uint32
	Fun   [1]uintptr
}

type abi.Imethod struct {
	Name int32
	Typ  int32
}

type abi.InterfaceType struct {
	abi.Type
	PkgPath abi.Name
	Methods []abi.Imethod
}

type abi.Name struct {
	Bytes *uint8
}

type abi.PtrType struct {
	abi.Type
	Elem *abi.Type
}

type abi.RegArgs struct {
	Ints        [16]uintptr
	Floats      [16]uint64
	Ptrs        [16]unsafe.Pointer
	ReturnIsPtr [2]uint8
}

type abi.Type struct {
	Size_       uintptr
	PtrBytes    uintptr
	Hash        uint32
	TFlag       uint8
	Align_      uint8
	FieldAlign_ uint8
	Kind_       uint8
	Equal       func(unsafe.Pointer, unsafe.Pointer) bool
	GCData      *uint8
	Str         int32
	PtrToThis   int32
}
<snip>

In this event that IDA is not able to parse/analyze the golang metadata properly, this is useful for referencing and making the code more readable (through Inserting Custom Structures etc).

Taking at the entrypoint main.main, we see the following.

// (1) Mount smol-bin — polls up to 10s for a block device, mounts it at /smol/bin
mountSmolErr = main_MountSmolBin();  // → fatal if err

// (2) Check if a newer sdk-daemon binary is available via smol-bin tools
updateAvailable = main_CheckForUpdates();
main_UnmountSmolBin();
if (updateAvailable & 1) {
    logger_Info("[daemon] restarting to apply sdk-daemon update");
    os_Exit(0);
}

// (3) Mount the macOS host filesystem share at /mnt/.virtiofs-root
// mount -t virtiofs claudeshared /mnt/.virtiofs-root
// mount --make-private /mnt/.virtiofs-root
recoverUsersErr = main_mountSharedDirectory();  // → fatal if err

// (4) Mount the per-session ext4 block device at /sessions
// Formats with mkfs.ext4 on first use; subsequent boots detect existing filesystem and skip format
v9 = main_mountSessionDisk();  // → fatal if err

// (5) Recover any user accounts that persisted across restarts
v11 = main_recoverExistingUsers();
if (v11) { sdk_daemon_internal_logger_Error("[daemon] failed to recover users: %v"); }

// (6) Allocate the vsock client targeting the host
// CID=0x00000002 (VMADDR_CID_HOST), port=0xC822 (51234 decimal)
rpcClient = runtime_newobject(&RTYPE_rpc_Client);
*(_QWORD *)&rpcClient->port_cid = 0xC82200000002LL;

The key thing here is the creation of rpc_Client struct. From a glance, it has the relevant port (51234) and CID=0x00000002 which refers to the host machine that the Guest VM is communicating to. We will breakdown rpc_Client later.

It then proceeds to allocate a ProcessManager which is in charge of tracking the processes spawned by tasks.

// (7) Allocate ProcessManager — tracks all guest processes spawned by the host
// processes:  map[string]*Process  (processID → handle)
// nameToID:   map[string]string    (processName → processID)
allocatedProcMgr = runtime_newobject(&RTYPE_main_ProcessManager);
allocatedProcMgr->processes = runtime_makemap_small();
allocatedProcMgr->nameToID  = runtime_makemap_small();
g_processMgr = allocatedProcMgr;

This structure can be seen in IDA, where we see that ProcessManager handles stdout, stderr and OnExit.

00000000 struct main_ProcessManager // sizeof=0x40
00000000 {
00000000     map_string__ptr_main_Process processes;
00000008     map_string_string nameToID;
00000010     sync_RWMutex mu;
00000028     PTR_funcstring_comma__string OnStdout;
00000030     PTR_funcstring_comma__string OnStderr;
00000038     PTR_funcstring_comma___ptr_int_comma___ptr_string OnExit;
00000040 };

This is seen below where different closures are registered for the three events (stdout, stderr and exit).

// (8) Wire process output events → vsock
// When a child process writes to its output or exits, the closure fires and sends a JSON event notification back to the host over vsock
procMgr->OnStdout = {main_main_stdout, rpcClient}  // child wrote to stdout → send "stdout" event
procMgr->OnStderr = {main_main_stderr, rpcClient}  // child wrote to stderr → send "stderr" event
procMgr->OnExit   = {main_main_exit,   rpcClient}  // child exited          → send "exit" event

Next, a MITM proxy is initalized and started where outbound HTTPs is intercepted to inject approved OAuth tokens.

mitmProxy = sdk_daemon_internal_proxy_New("/var/run/mitm-proxy.sock");  // → fatal if err
sdk_daemon_internal_proxy__ptr_Proxy_Start(mitmProxy);                  // → fatal if err

Then, all inbound RPC handlers are mapped onto rpcClient with methods such as Spawn, Kill that were seen earlier in swift-addon.node.

// (10) Register all inbound RPC handlers onto rpcClient
rpcClient->OnSpawn                 = {ProcessManager.Spawn,      procMgr}  // start a new process inside the guest
rpcClient->OnKill                  = {ProcessManager.Kill,       procMgr}  // send a signal to a running process
rpcClient->OnIsRunning             = {ProcessManager.IsRunning,  procMgr}  // query if a process is still alive
rpcClient->OnStdin                 = {ProcessManager.WriteStdin, procMgr}  // write bytes into a process's stdin pipe
rpcClient->OnMountPath             = fn_mountSubpath                        // mount a virtiofs subpath into the session
rpcClient->OnLoadTranscripts       = fn_loadTranscripts                     // load stored Claude conversation transcripts
rpcClient->OnReadFile              = fn_readFile                            // read a guest file; response is base64-encoded
rpcClient->OnInstallSdk            = fn_installSDKBinary                   // install a new sdk-daemon binary on disk
rpcClient->OnAddApprovedOauthToken = {addproxytoken, mitmProxy}             // add an OAuth token to the MITM proxy allowlist
rpcClient->OnStaticIPAssignment    = fn_configureStaticIP                  // apply a static IP config to the guest network

This is the recovered structure from Golang's Metadata reconstructed by IDA. Besides port and its port_cid, we can confirm that the rpcClient struct maps different RPC methods seen earlier in swift-addon.node such as onSpawn.

00000000 struct rpc_Client // sizeof=0x70
00000000 {
00000000     uint32 port_cid;
00000004     uint32 port;
00000008     net_Conn conn;
00000018     sync_Mutex mu;
00000020     PTR_funcrpc_SpawnParams_error OnSpawn;
00000028     PTR_funcstring_comma__string_error OnKill;
00000030     PTR_funcstring_bool_comma___ptr_int_comma__error OnIsRunning;
00000038     PTR_funcstring_comma__string OnStdin;
00000040     PTR_funcstring_comma__string_comma__string_comma__string_string_comma__error OnMountPath;
00000048     PTR_funcstring_map_string_string_comma__error OnLoadTranscripts;
00000050     PTR_funcstring_comma__string__slice_uint8_comma__error OnReadFile;
00000058     PTR_funcstring_comma__string_error OnInstallSdk;
00000060     PTR_funcstring_error OnAddApprovedOauthToken;
00000068     PTR_funcstring_comma__int_comma__string_comma__string OnStaticIPAssignment;
00000070 };

00000008 typedef rpc_Client *_ptr_rpc_Client;    // XREF: sdk_daemon_rpc._ptr_Client.Connect/r
00000008  

Lastly, the daemon ensures its fully initialized and spawns a readLoop to read JSON over vsock until the connection drops.

// (11) Connect to host over vsock — Spawns a readLoop goroutine that reads length-prefixed JSON frames until the connection drops
sdk_daemon_rpc__ptr_Client_Connect(rpcClient);  // → fatal if err
// rpcClient.conn.Close() is deferred here — runs at shutdown

// (12) Wait for IPv4 routing to come up inside the guest, Polls hasIPv4Route() every 100ms
main_waitForIPv4Route({main_main_network_status, rpcClient});

// (13) Signal the host that the daemon is fully initialized and sends {"type":"event","event":"ready"} over vsock
sdk_daemon_rpc__ptr_Client_SendReady(rpcClient);  // → fatal if err
logger_Info("[daemon] connected, waiting for commands");

// (14) Block until SIGINT (2) or SIGTERM (15) — main goroutine idles here
signalChan = runtime_makechan(&RTYPE_chan_os_Signal, 1);
os_signal_Notify(signalChan, [SIGINT, SIGTERM]);
runtime_chanrecv1(signalChan, 0);

// (15) Graceful shutdown — run deferred closures in LIFO order
logger_Info("[daemon] shutting down");
if (g_consoleFile) { os__ptr_file_close(g_consoleFile); g_consoleFile = 0; }
(*deferClientClose)();  // rpcClient.conn.Close() — closes the vsock connection
(*deferProxyStop)();    // proxy.Stop()           — stops the MITM proxy

RPC Communication Flow

As seen earlier in swift-addon.node, all vsock frames share the same wire format which is <4 byte Big-Endian Length><JSON data>

From the guest's perspective there are four message types where two are inbound and two are outbound.

Guest	Type	Behaviour
Receives	"request"	Dispatched by handleRequest; every path converges to sendResponse where a reply is always sent
Receives	"notification"	Dispatched by handleNotification; no reply sent
Sends	"response"	Sent after handling every inbound request; echoes the request ID so the host can match continuations
Sends	"event"	Sent async: stdout, stderr, exit, networkStatus, ready

Anything else arriving inbound including response or event hits the fallthrough in readLoop and is logged as [rpc] unknown message type and discarded.

RPC Request Handler

The handleRequest dispatches on string length first, followed by a byte comparison which is confirmed from IDA's decompilation. Every path (including errors) converges at LABEL_88 and calls sendResponse so the host always gets a reply.

Here is a shorter and cleaned up version of the code

// coworkd/rpc.(*Client).handleRequest
__int64 __golang coworkd_rpc__ptr_Client_handleRequest(__int64 a1, _QWORD *a2)
{
  <snip> // Local variable declarations (v2 to v71, arrays, structs, etc.)

  <snip> // Setup string parameters for method and id
  coworkd_internal_logger_Debug("[rpc] handling request: method=%s id=%s", 39, &v51);
  
  v4 = a2;
  v5 = a2[5]; // Method string length
  v6 = a2[4]; // Method string pointer
  
  if ( v5 > 8 )
  {
    if ( v5 > 10 )
    {
      if ( v5 != 13 )
      {
        if ( v5 != 21 )
          goto LABEL_67;
        v55 = a2[4];
        if ( (runtime_memequal(v6, "addApprovedOauthToken", 21) & 1) != 0 )
        {
          if ( *(_QWORD *)(a1 + 96) )
          {
            <snip> // unmarshalParams, call handler, runtime_convT
            goto LABEL_68;
          }
        }
        else
        {
          if ( (runtime_memequal(v55, "installCACertificates", 21) & 1) == 0 )
          {
            <snip>
            goto LABEL_67;
          }
          if ( *(_QWORD *)(a1 + 112) )
          {
            <snip> // unmarshalParams, call handler, runtime_convT
            goto LABEL_68;
          }
        }
        fmt_Errorf("handler not registered", 22, 0);
        goto LABEL_68;
      }
      if ( *(_QWORD *)v6 != 0x726F6D654D746567LL || *(_DWORD *)(v6 + 8) != 1718503801 || *(_BYTE *)(v6 + 12) != 111 )
        goto LABEL_67; // "getMemoryInfo"
        
      <snip> // call getMemoryInfo handler, runtime_convTnoptr
    }
    else if ( v5 == 9 )
    {
      if ( *(_QWORD *)v6 == 'ninnuRsi' && *(_BYTE *)(v6 + 8) == 103 ) // "isRunning"
      {
        if ( *(_QWORD *)(a1 + 56) )
        {
          <snip> // unmarshalParams, call handler, runtime_convT
        }
      }
      else
      {
        if ( *(_QWORD *)v6 != 0x746150746E756F6DLL || *(_BYTE *)(v6 + 8) != 104 ) // "mountPath"
          goto LABEL_67;
          
        <snip> // unmarshalParams, call handler, runtime_convT
      }
    }
    else
    {
      if ( *(_QWORD *)v6 != 0x536C6C6174736E69LL || *(_WORD *)(v6 + 8) != 27492 ) // "installSdk"
        goto LABEL_67;
        
      <snip> // unmarshalParams, call handler, runtime_convT
    }
  }
  else
  {
    if ( v5 == 4 )
    {
      if ( *(_DWORD *)v6 == 1819044203 ) // "kill"
      {
        <snip> // unmarshalParams, call handler
        goto LABEL_68;
      }
LABEL_67:
      <snip> // setup error message
      fmt_Errorf("unknown method: %s", 18, &v30);
      goto LABEL_68;
    }
    if ( v5 == 5 )
    {
      if ( *(_DWORD *)v6 != 2002874483 || *(_BYTE *)(v6 + 4) != 110 ) // "chown"
        goto LABEL_67;
        
      <snip> // unmarshalParams, call handler, runtime_convT
    }
    else
    {
      if ( v5 != 8 || *(_QWORD *)v6 != 0x656C694664616572LL ) // "readFile"
        goto LABEL_67;
        
      <snip> // unmarshalParams, call handler, base64 encode, runtime_convT
    }
  }
LABEL_68:
  result = coworkd_rpc__ptr_Client_sendResponse();
  if ( result )
  {
    <snip> // Extract error
    return coworkd_internal_logger_Error("[rpc] failed to send response: %v", 33, &v30);
  }
  return result;
}

Below is a list of request and notification handlers respectively.

Method	Len	rpc_Client slot	Params	Returns	Description
kill	4	a1[5]	{ID, Signal}	error	Sends a signal to a running guest process
spawn	5	a1[4]	SpawnParams	{ID, Success}	Spawns a sandboxed Claude Code process via sandbox-helper
readFile	8	a1[10]	{ProcessID, FilePath}	{Success, Content (b64), Error}	Reads a file from the guest FS; file content is base64.StdEncoding.EncodeToString before JSON
isRunning	9	a1[6]	{ID}	{ID, Running, ExitCode*}	Checks if a process is alive; returns exit code if stopped
mountPath	9	a1[8]	{ProcessID, Subpath, MountName, Mode}	{MountPoint, Success}	Bind-mounts a host or session path into the guest process's directory
installSdk	10	a1[11]	{SdkSubpath, Version}	{Success, Error}	Installs an SDK version from smol-bin into the guest
loadTranscripts	15	a1[9]	{ProcessName}	LoadTranscriptsResult	Loads stored conversation transcripts for a named session
addApprovedOauthToken	21	a1[12]	{Token}	{Success, Error}	Registers an OAuth token in the MITM proxy's sync.Map allowlist

Method	Len	rpc_Client slot	Params	Description
stdin	5	a1[7]	{ID, Data}	Writes bytes to a running process's stdin pipe (fire-and-forget)
staticIPAssignment	18	a1[13]	{IP, PrefixLength, Gateway, DNS}	Applies a static network config to the guest's network interface

The response is then sent back over vsock.

LABEL_88:
  result = sdk_daemon_rpc__ptr_Client_sendResponse(v7, (char *)v4[2], v4[3], v13, v14, v8, v9);
  if ( result )
  {
    v139 = 0;
    v140 = 0;
    v139 = *(RTYPE **)(result + 8);
    v140 = v124;
    return sdk_daemon_internal_logger_Error("[rpc] failed to send response: %v", 33, &v139, 1, 1);
  }
  return result;

Every request, including errors, gets a response echoing back the original request ID.

// success
{"type": "response", "id": "abc123", "result": {"id": "proc-1", "success": true}, "error": null}

// error (code always -1, message is err.Error())
{"type": "response", "id": "abc123", "result": null, "error": {"code": -1, "message": "process not found"}}

RPC Notifications (host → guest)

Notifications at handleNotification @ 0x2e57b0 are fire-and-forget where no response is sent back

// sdk_daemon_rpc._ptr_Client.handleNotification
switch (method) {
    // (1) Write bytes to a running process's stdin pipe
    case "stdin" (len=5):
        OnStdin(id, data)
        // → ProcessManager.WriteStdin: RLock processes map, lookup by ID, write to pipe

    // (2) Apply a static IP configuration to the guest network interface
    case "staticIPAssignment" (len=18):
        OnStaticIPAssignment(ip, prefixLength, gateway, dns)

    default:
        logger_Error("[rpc] unknown notification: %s", method)
}

stdin is a notification (not a request) because the host doesn't need to wait for acknowledgement as it is streaming data into a pipe.

RPC Events (guest → host) — (sendEvent @ 0x2e4450)

The sdk-daemon sends events to the host (swift-addon.node) via vsock.

// sdk_daemon_rpc._ptr_Client.sendEvent
// (1) Acquire conn mutex (same lock used by sendResponse — serializes all writes)
sync_Mutex_lock(rpcClient->mu);
defer: unlock

// (2) Build message
p_rpc_Message->Type  = "event"
p_rpc_Message->Event = eventName    // "stdout", "stderr", "exit", "networkStatus", "ready"
p_rpc_Message->Params = params      // typed struct (StdoutEventParams, ExitEventParams, etc.)

// (3) Serialize and write
sdk_daemon_rpc_WriteMessage(conn, p_rpc_Message)

Here is the associated event callback table and how it is mapped from sdk-daemon to swift-addon.node.

Event Callback Table (sdk-daemon -> swift-addon.node)

Event	sdk-daemon Function	Address	swift-addon Handler	Description
stdout	main.main.stdout	0x2edc90	handleStdoutEvent	Process stdout data
stderr	main.main.stderr	0x2edb80	handleStderrEvent	Process stderr data
exit	main.main.exit	0x2eda70	handleExitEvent	Process exit notification
networkStatus	main.main.network_status	0x2ed870	handleNetworkStatusEvent	Network state change
addApprovedOauthToken	main.main.addproxytoken	0x2ed9b0	N/A (receives from host)	Approve OAuth token for MITM

stdout

// main.main.stdout (0x2edc90)
__int64 __golang main_main_stdout(__int64 process_id_ptr, __int64 process_id_len, __int64 data_ptr, __int64 data_len)
{
  __int64 closure_ctx; // x26
  void *v5; // x0
  __int64 result; // x0
  __int64 rpc_client; // [xsp+48h] [xbp-50h]
  _QWORD stdout_params[5]; // [xsp+70h] [xbp-28h] BYREF

  rpc_client = *(_QWORD *)(closure_ctx + 8);    // (1) Get rpc_client from closure context (X26+8)
  stdout_params[0] = process_id_ptr;            // (2) Build StdoutEventParams{Id: processId, Data: data}
  stdout_params[1] = process_id_len;
  stdout_params[2] = data_ptr;
  stdout_params[3] = data_len;
  v5 = (void *)runtime_convT(&RTYPE_rpc_StdoutEventParams, stdout_params);
  result = sdk_daemon_rpc__ptr_Client_sendEvent(// (3) Send 'stdout' event to host via vsock
             rpc_client,
             "stdout",  // GoStr[6] from pooled string
             6u,
             &RTYPE_rpc_StdoutEventParams,
             v5);
  if ( result )  // error check
    sdk_daemon_internal_logger_Error("[daemon] failed to send stdout for %s: %v", ...);
  return result;
}

stderr

exit

network_status

addproxytoken

MITM Proxy Check Logic

When an outbound HTTPS request arrives at the MITM proxy, the handler at Start.func2 (0x2c2b30) applies three checks in order.

// sdk-daemon/internal/proxy.(*Proxy).Start.func2
retval_2C2B30 __golang sdk_daemon_internal_proxy__ptr_Proxy_Start_func2(_QWORD *a1)
{
  __int64 v1; // x26
  string v2; // kr00_16
  __int64 v3; // x0
  string v4; // kr20_16
  retval_2C2B30 result; // x0
  __int64 v7; // [xsp+50h] [xbp-78h]
  proxy_Proxy *v8; // [xsp+68h] [xbp-60h]
  __int64 v9; // [xsp+70h] [xbp-58h]
  RTYPE *v10; // [xsp+80h] [xbp-48h] BYREF
  __int64 v11; // [xsp+88h] [xbp-40h]
  RTYPE *v12; // [xsp+90h] [xbp-38h] BYREF
  __int64 v13; // [xsp+98h] [xbp-30h]
  RTYPE *v14; // [xsp+A0h] [xbp-28h]
  __int64 v15; // [xsp+A8h] [xbp-20h]
  RTYPE *v16; // [xsp+B0h] [xbp-18h]
  __int64 v17; // [xsp+B8h] [xbp-10h]
  string v19; // 0:x1.16
  string v20; // 0:x1.16
  string v21; // 0:x1.16

  v9 = a1[16];
  v7 = a1[17];
  v8 = *(proxy_Proxy **)(v1 + 8);
  v2 = net_url__ptr_URL_RequestURI((_ptr_url_URL)a1[2]);
  v12 = 0;
  v13 = 0;
  v14 = 0;
  v15 = 0;
  v16 = 0;
  v17 = 0;
  v3 = runtime_convTstring(*a1, a1[1]);
  v12 = &RTYPE_string;
  v13 = v3;
  v14 = &RTYPE_string;
  v15 = runtime_convTstring(v9, v7);
  v16 = &RTYPE_string;
  v17 = runtime_convTstring(v2.ptr, v2.len);
  sdk_daemon_internal_logger_Debug("[proxy] >>> REQUEST: %s %s%s", 28, &v12);
  // (1) Check against Domain Allowlist
  if ( (sdk_daemon_internal_proxy_IsAllowedDomain(v9, v7) & 1) != 0 )
  {
    v19.ptr = "Authorization";
    v19.len = 13;
    v20 = net_textproto_MIMEHeader_Get((textproto_MIMEHeader)a1[7], v19);
    // (2) Token approval
    if ( sdk_daemon_internal_proxy__ptr_Proxy_isTokenApproved(v8, v20) )
    {
      v21.ptr = "anthropic-beta";
      v21.len = 14;
      // (3) Block web-fetch beta feature
      v4 = net_textproto_MIMEHeader_Get((textproto_MIMEHeader)a1[7], v21);
      if ( internal_stringslite_Index() < 0 )
      {
        result._r0 = a1;
        result._r1 = 0;
      }
      else
      {
        v10 = &RTYPE_string;
        v11 = runtime_convTstring(v4.ptr, v4.len);
        sdk_daemon_internal_logger_Info("[proxy] blocking request - disallowed beta feature in header: %s", 64, &v10);
        result._r1 = github_com_elazarl_goproxy_NewResponse(a1, "text/plain", 10, 403, "Beta feature not allowed", 24);
        result._r0 = a1;
      }
    }
    else
    {
      sdk_daemon_internal_logger_Info("[proxy] blocking request - invalid or missing bearer token", 58, 0);
      result._r1 = github_com_elazarl_goproxy_NewResponse(a1, "text/plain", 10, 401, "Unauthorized", 12);
      result._r0 = a1;
    }
  }
  else
  {
    v10 = &RTYPE_string;
    v11 = runtime_convTstring(v9, v7);
    sdk_daemon_internal_logger_Info("[proxy] blocking request - domain not allowed: %s", 49, &v10);
    result._r1 = github_com_elazarl_goproxy_NewResponse(a1, "text/plain", 10, 403, "Domain not allowed", 18);
    result._r0 = a1;
  }
  return result;
}

IsAllowedDomain performs some normalization by stripping the port, lowercasing the hostname and only accepting anthropic.com and its subdomains.

// sdk-daemon/internal/proxy.(*Proxy).isTokenApproved
bool __golang sdk_daemon_internal_proxy__ptr_Proxy_isTokenApproved(_ptr_proxy_Proxy a1, string a2)
{
  _QWORD v3[3]; // [xsp+30h] [xbp-18h] BYREF

  if ( !a2.len )
    return 1;
  if ( (__int64)a2.len <= 7 )
    return 0;
  if ( (strings_EqualFold(a2.ptr) & 1) == 0 )
    return 0;
  v3[0] = a2.ptr + 7;
  v3[1] = a2.len - 7;
  return sync__ptr_Map_Load(&a1->approvedTokens, &RTYPE_string, v3)._r2;
}

isTokenApproved checks the Authorization header on outbound requests.

• If the header is absent (i.e. a2.len == 0), the request is approved unconditionally.

• This is probbaly done for tool calls such as bash/npm/git which do not require credentials

When the header is present, as with Claude's own API calls to Anthropic, the token must begin with Bearer and exist in the daemon's approvedTokens map.

Lastly, we will move on to how Claude implements sandboxing within the Guest VM and how it works with CoWork.

Sandboxing

Every Claude Code session inside the Guest VM is wrapped in multiple layers of isolation. The sandboxing is split between two components:

• coworkd (sdk-daemon) which isolates sessions from each other through the use of dedicated users and more

• SRT + sandbox-helper isolates the Claude Code process itself with the use of bwrap namespaces, read-only filesystem and more

The entire Claude Code runtime, including its Read, Glob, and Grep tools runs inside a single bubblewrap namespace where PID 1 is bwrap.

This was confirmed by prompting CoWork to run cat /proc/1/cmdline, which returned the full --ro-bind / / --unshare-pid --unshare-net argument set.

How a Session Gets Sandboxed: ProcessManager.Spawn

Everything starts when the macOS host sends a spawn RPC over vsock. coworkd's ProcessManager.Spawn at 0x2eed60 orchestrates four isolation mechanisms before exec-ing into sandbox-helper, which then adds the remaining layers. The full spawn sequence is:

coworkd (root, PID 1 = systemd → sdk-daemon)
│
├─ 1. ensureUser(sessionId)
│     → useradd -m -d /sessions/{id} -s /bin/bash {id}
│     → returns uid/gid for the new Linux user
│
├─ 2. CreateCgroup(processId)
│     → mkdir /sys/fs/cgroup/sdk-daemon/{id}
│     → open(cgroupPath) → cgroupFD
│
├─ 3. mountSubpathForUser(shareName, subpath, userId, uid, gid, mode)
│     → bindfs /mnt/.virtiofs-root/shared/{name} → /sessions/{id}/mnt/{path}
│     → mode: ro | rw (--delete-deny) | rwd
│
├─ 4. Build exec.Cmd for sandbox-helper
│     → args = [uid_str, gid_str, (--no-srt)?, command, args...]
│     → SysProcAttr{UseCgroupFD: true, CgroupFD: cgroupFD}
│
└─ 5. cmd.Start() — fork+exec
      → kernel places child in cgroup atomically via clone()
      → child exec's /usr/local/bin/sandbox-helper

From here, sandbox-helper takes over and applies the remaining isolation before executing into SRT, which wraps the Claude Code instance with bubblewrap:

sandbox-helper (now running as child process, still root)
│
├─ 6. Unshare mount namespace (CLONE_NEWNS)
│     → mount("/", MS_SLAVE|MS_REC) — prevent propagation
│     → unmount /mnt/.virtiofs-root/shared — cut off host virtiofs
│     → unmount /mnt/.virtiofs-root — cut off virtiofs root
│
├─ 7. Drop privileges
│     → setgroups([gid]), setgid(gid), setuid(uid)
│     → now running as the session's dedicated Linux user
│
├─ 8. Apply seccomp filter
│     → applySeccompFilter() — blocks AF_VSOCK socket creation
│     → prevents raw vsock connection to host (proxy bypass)
│
├─ 9. Load SRT config (unless --no-srt)
│     → reads /etc/srt-settings.base.json (network allowlist, MITM socket path)
│     → BuildSrtCommand(config, command, args...)
│
└─ 10. exec /usr/local/lib/node_modules_global/bin/srt --config ... -- <cmd>
       │
       SRT (Node.js, Anthropic's sandbox-runtime)
       │
       ├─ 11. Build bwrap argument list from config
       │     → --ro-bind / / (read-only root)
       │     → --unshare-pid, --unshare-net
       │     → --new-session --die-with-parent
       │     → --bind for writable paths (session home, .npm/_logs, etc.)
       │     → --ro-bind /dev/null over dangerous files (shell configs, git hooks)
       │     → --setenv HTTP_PROXY=http://localhost:3128
       │     → --setenv HTTPS_PROXY=http://localhost:3128
       │     → --setenv ALL_PROXY=socks5://localhost:1080
       │
       ├─ 12. Start socat bridges (BEFORE seccomp)
       │     → socat TCP-LISTEN:3128 → Unix socket → SRT HTTP proxy
       │     → socat TCP-LISTEN:1080 → Unix socket → SRT SOCKS proxy
       │     → SRT proxies forward to /var/run/mitm-proxy.sock (coworkd MITM)
       │
       ├─ 13. exec bwrap ... -- apply-seccomp unix-block-arm64.bpf claude <args>
       │     │
       │     bwrap (PID 1 inside sandbox)
       │     │
       │     └─ apply-seccomp
       │        ├─ prctl(PR_SET_NO_NEW_PRIVS, 1)
       │        ├─ prctl(PR_SET_SECCOMP, FILTER, &bpf) — 2 stacked filters
       │        │   → socket(AF_UNIX) → ERRNO(1)
       │        │   → all other syscalls → ALLOW
       │        └─ execvp("claude", args)
       │           │
       │           Claude Code (node)
       │           ├─ All tools (Bash, Read, Glob, Grep, Edit, Write) run here
       │           ├─ CapEff: 0x0 (all capabilities zeroed)
       │           ├─ Cannot create AF_UNIX sockets (seccomp)
       │           ├─ Cannot see other PIDs (PID namespace)
       │           ├─ Cannot write to / (ro-bind)
       │           └─ Network only via socat proxy bridges
       │
       └─ Network egress path:
            Claude Code → localhost:3128/1080
            → socat → Unix socket → SRT HTTP/SOCKS proxy (domain filter)
            → /var/run/mitm-proxy.sock → coworkd MITM proxy (token + beta filter)
            → NAT → Internet

The order matters in this case as socat is started before seccomp is applied, then Claude Code runs. Because socat is already running when seccomp kicks in, its existing Unix domain socket connections stay open allowing it to reach the internet. Claude Code on the other hand starts after seccomp is applied and as such cannot create new Unix sockets due to the filter(AF_UNIX is blocked).

This prevent Claude Code from bypassing the proxy chain or talking to other sessions.

The --no-srt flag (injected when AllowedDomains == ["*"]) skips the SRT/bwrap wrapping entirely and runs the command directly after the privilege drop.

Configuration

Two configuration files from the VM image confirm this layered design.

sdk-daemon.service - the systemd unit for coworkd:

[Unit]
Description=Claude SDK Daemon - vsock RPC bridge for process management
After=network.target local-fs.target systemd-udev-settle.service
Wants=network.target

[Service]
Type=simple
ExecStart=/usr/local/bin/sdk-daemon
Restart=always
RestartSec=3

User=root
Group=root
Environment=HOME=/root
StandardOutput=journal
StandardError=journal
SyslogIdentifier=sdk-daemon

# Must allow process spawning — cannot lock down with systemd hardening
NoNewPrivileges=no
ProtectSystem=false
ProtectHome=false
PrivateTmp=false

[Install]
WantedBy=multi-user.target

srt-settings.json — the SRT configuration consumed by sandbox-helper via BuildSrtCommand:

{
  "network": {
    "allowedDomains": [
      "registry.npmjs.org",
      "npmjs.com",
      "www.npmjs.com",
      "npmjs.org",
      "www.npmjs.org",
      "yarnpkg.com",
      "registry.yarnpkg.com",
      "pypi.org",
      "files.pythonhosted.org",
      "pythonhosted.org",
      "github.com",
      "archive.ubuntu.com",
      "security.ubuntu.com",
      "api.anthropic.com",
      "*.anthropic.com",
      "anthropic.com",
      "crates.io",
      "index.crates.io",
      "static.crates.io",
      "statsig.anthropic.com",
      "sentry.io",
      "*.sentry.io"
    ],
    "deniedDomains": [],
    "allowLocalBinding": true,
    "mitmProxy": {
      "socketPath": "/var/run/mitm-proxy.sock",
      "domains": ["*.anthropic.com", "anthropic.com"]
    }
  },
  "filesystem": {
    "denyRead": [],
    "allowWrite": ["/"],
    "denyWrite": []
  }
}

The schema matches SRT's sandbox-config.js (SRT source). The mitmProxy.socketPath is /var/run/mitm-proxy.sock which is the coworkd's MITM proxy listens on. This chains SRT's network filtering through the existing proxy: SRT's HTTP/SOCKS proxies enforce the allowedDomains list (package registries, GitHub, etc.), then forward *.anthropic.com traffic through coworkd's MITM proxy which gates token approval and beta headers.

The filesystem.allowWrite: ["/"] looks permissive but Guest VM's filesystem is already isolated by Virtualization.framework, and per-session write restrictions are enforced by coworkd's bindfs mounts. SRT's uses filesystem sandboxing (via --ro-bind / /) which still blocks everything by default and only allows explicit writable bind mounts.

Now let's examine each isolation mechanism in detail, following the order they're applied during spawn.

Layer 1: Linux User Isolation (coworkd)

Each session gets its own Linux user (useradd -m -d /sessions/{id}), handled by main.ensureUser. Each session's uid is mapped into a user namespace where other sessions' UIDs appear as nobody:nogroup, and home directories are drwxr-x---, so sessions cannot access each other's files.

// main.ensureUser
__int64 __golang main_ensureUser(__int64 username_ptr, __int64 username_len, char should_exist)
{
  __int64 home_path_len;
  _QWORD *new_user;
  const char *cache_path;
  const char *home_path;
  retval_32BC00 cmd_result;

  v63 = 9;
  // (1) Build home path: /sessions/{username}
  v62 = "/sessions";                           
  v65 = username_len;
  v64 = (void *)username_ptr;
  home_path = (const char *)path_Join(&v62);
  home_path_len = v3;
  // (2) Check if user already exists
  existing_user = (_QWORD *)os_user_Lookup(username_ptr, username_len);  // 
  if ( v5 )  // user doesn't exist
  {
    if ( (should_exist & 1) != 0 )
    {
      sdk_daemon_internal_logger_Info(
        "[process] user %s should exist but doesn't, attempting recovery from home directory", 0x53);
      result = main_recoverUserFromHomeDir(username_ptr, username_len, home_path, home_path_len);
      if ( v7 )
      {
        fmt_Errorf("user %s should already exist but does not, and recovery failed: %w", 66, ...);
        return 0;
      }
    }
    else
    {
      sdk_daemon_internal_logger_Info("[process] creating user %s with home %s", 0x27, ...);

      // (3) Build useradd command: useradd -m -d /sessions/{user} -s /bin/bash {user}
      v49[0] = &unk_3A1425;  // "-m"
      v49[1] = 2;
      v49[2] = &unk_3A1427;  // "-d"
      v49[3] = 2;
      v49[4] = home_path;
      v49[5] = home_path_len;
      v49[6] = &unk_3A141D;  // "-s"
      v49[7] = 2;
      v49[8] = "/bin/bash";
      v49[9] = 9;
      v49[10] = username_ptr;
      v49[11] = username_len;

      useradd_cmd = (exec_Cmd *)os_exec_Command("useradd", 7, v49, 6);
      cmd_result = os_exec__ptr_Cmd_CombinedOutput(useradd_cmd);
      if ( cmd_result.1.tab )
      {
        fmt_Errorf("useradd failed: %w: %s", 22, ...);
        return 0;
      }

      v16 = (_QWORD *)os_user_Lookup(username_ptr, username_len);
      if ( v17 )
      {
        fmt_Errorf("lookup user after creation: %w", 30, ...);
        return 0;
      }

      new_user = v16;
      uid = strconv_Atoi(*v16, v16[1]);
      gid = strconv_Atoi(new_user[2], new_user[3]);

      v64 = &unk_3A151B;  // ".cache"
      v65 = 3;
      cache_path = (const char *)path_Join(&v62);

      if ( !os_MkdirAll(cache_path) )
        os_Chown(cache_path, cache_path_len);

      sdk_daemon_internal_logger_Info(
        "[process] created user %s: uid=%d gid=%d home=%s", 0x30, ...);
      return uid;
    }
  }
  else
  {
    v38 = existing_user;
    v31 = strconv_Atoi(*existing_user, existing_user[1]);
    v35 = strconv_Atoi(v38[2], v38[3]);
    sdk_daemon_internal_logger_Info("[process] user %s already exists: uid=%d gid=%d", 0x2F, ...);

    if ( (should_exist & 1) != 0 )
      return v31;
    else
    {
      fmt_Errorf("user %s already exists unexpectedly: uid=%d gid=%d", 0x32, ...);
      return 0;
    }
  }
  return result;
}

Layer 2: Cgroup v2 Isolation (coworkd)

Each spawned process is placed in a dedicated cgroup under /sys/fs/cgroup/sdk-daemon/{processId} for lifecycle tracking and clean teardown.

Function	Address	Action
main.initCgroupSubtree	0x2e86c0	os.MkdirAll("/sys/fs/cgroup/sdk-daemon/") — creates the daemon's subtree once at startup
main.CreateCgroup	0x2e87d0	os.Mkdir("/sys/fs/cgroup/sdk-daemon/{processID}") — per-process cgroup
main.(*Cgroup).OpenFD	called @ 0x2efd4c	Opens an FD for the new cgroup directory
main.(*Cgroup).Cleanup	called @ 0x2f0558	Removes the cgroup directory on process exit

The cgroup is attached to the child process via syscall.SysProcAttr before exec:

// main.(*ProcessManager).Spawn @ 0x2efd18–0x2efdcc
Cgroup = main_CreateCgroup(a2.ID.ptr, a2.ID.len);   // /sys/fs/cgroup/sdk-daemon/{id}
Sysfd  = main__ptr_Cgroup_OpenFD(Cgroup);            // fd = open(cgroupPath, O_RDONLY)

p_syscall_SysProcAttr = runtime_newobject(&RTYPE_syscall_SysProcAttr);
p_syscall_SysProcAttr->UseCgroupFD = 1;              // tell Go runtime to use the FD
p_syscall_SysProcAttr->CgroupFD    = Sysfd;          // kernel places child in cgroup atomically

cmd->SysProcAttr = p_syscall_SysProcAttr;
os_exec__ptr_Cmd_Start(cmd);                         // forks + execs

Layer 3: Filesystem Isolation via bindfs (coworkd)

main.mountSubpathForUser (@ 0x2eab60) uses bindfs to expose host directories into the session with permission constraints. The source is always the virtiofs share from macOS (/mnt/.virtiofs-root/shared/{name}), mounted to /sessions/{id}/mnt/{path}.

Mode	bindfs flags	Permissions
ro	-p u=rX:go=	Read + execute only
rw	--delete-deny -p u=rwX:go=	Read + write, no delete
rwd	-p u=rwX:go=	Full read/write/delete

The --delete-deny default on rw mode is notable, it prevents Claude Code from deleting files in the shared workspace even if it has write access. Deletion must be explicitly upgraded to rwd mode which requires explicit permission from the user (allow_cowork_file_delete),

// main.mountSubpathForUser
const char *__golang main_mountSubpathForUser(
        __int64 share_name_ptr, __int64 share_name_len,
        const char *subpath_ptr, __int64 subpath_len,
        const char *user_id_ptr, __int64 user_id_len,
        unsigned int uid, unsigned int gid,
        unsigned __int16 *mode_ptr, __int64 mode_len)
{
  // (1) Build source: /mnt/.virtiofs-root/shared/{shareName}
  source_path = path_Join("/mnt/.virtiofs-root", "shared", share_name);

  // (2) Build dest: /sessions/{userId}/mnt/{subpath}
  session_path = path_Join("/sessions", user_id);
  mnt_path = path_Join(session_path, "mnt");
  dest_path = path_Join(mnt_path, subpath);

  // (3) If already mounted, unmount first (supports remount with different mode)
  if ( mountpoint(dest_path) == 0 )
    umount(dest_path);

  // (4) Verify source exists, create dest dirs, chown + chmod 0700
  os_Stat(source_path);
  os_MkdirAll(dest_path, 0755);
  os_Chown(mnt_path, uid, gid);
  os_Chown(dest_path, uid, gid);
  os_Chmod(dest_path, 0700);

  // (5) Build bindfs args based on mode
  base_args = ["-u", uid_str, "-g", gid_str];
  if mode == "ro":   append("-p", "u=rX:go=")
  if mode == "rw":   append("--delete-deny", "-p", "u=rwX:go=")
  if mode == "rwd":  append("-p", "u=rwX:go=")

  // (6) Execute: /usr/bin/bindfs -u {uid} -g {gid} {perms} {source} {dest}
  os_exec_Command("/usr/bin/bindfs", args);
}

Layer 4: sandbox-helper (mount isolation + privilege drop + seccomp)

coworkd fork+exec's the child into /usr/local/bin/sandbox-helper, which applies three isolation steps before handing off to SRT:

1. Mount namespace isolation: calls unshare(CLONE_NEWNS), makes all mounts slave, then unmounts the virtiofs share (/mnt/.virtiofs-root/shared and /mnt/.virtiofs-root). After this, the session can no longer reach the host filesystem. The only files available are what coworkd already bind-mounted into /sessions/{id}/mnt/.

2. Privilege drop: calls setgroups([gid]), setgid(gid), setuid(uid). The process now runs as the session's dedicated Linux user instead of root.

3. Seccomp (AF_VSOCK block): applySeccompFilter() blocks socket(AF_VSOCK), preventing the process from opening a raw vsock connection to the macOS host, which would bypass the proxy chain.

Unless --no-srt was passed, sandbox-helper then loads the SRT config and exec's into SRT:

// sandbox-helper main()
configPath = args.configPath ?? "/etc/srt-settings.base.json";
os.Stat(configPath);  // fatal: "network allowlist config missing"
srtArgs = BuildSrtCommand(configPath, command, args...);
exec.Command("/usr/local/lib/node_modules_global/bin/srt", srtArgs...);

Layer 5: SRT Bubblewrap Sandbox

SRT is Anthropic's open-source sandboxing tool. It builds the bubblewrap argument list from the SRT config and wraps the entire Claude Code process:

bwrap \
  --new-session --die-with-parent \
  --unshare-net \                    # Network namespace isolation
  --unshare-pid \                    # PID namespace isolation
  --proc /proc \
  --ro-bind / / \                    # Entire root filesystem read-only
  --bind <allowed-path> <allowed-path> \  # Explicit writable paths
  --ro-bind /dev/null <denied-path> \     # Dangerous files → /dev/null
  --dev /dev \
  --setenv HTTP_PROXY http://localhost:3128 \
  --setenv HTTPS_PROXY http://localhost:3128 \
  --setenv ALL_PROXY socks5://localhost:1080 \
  -- apply-seccomp unix-block-arm64.bpf claude <args>

Before launching bwrap, SRT starts socat bridges to restore network access through the two proxies (SOCKS5/HTTP(S))

socat TCP-LISTEN:3128 → Unix socket → SRT HTTP(S) proxy  → /var/run/mitm-proxy.sock
socat TCP-LISTEN:1080 → Unix socket → SRT SOCKS proxy → /var/run/mitm-proxy.sock

SRT's HTTP(S) and SOCKS5 proxies enforce the allowedDomains list from srt-settings.json (npm, PyPI, GitHub, crates.io, etc.). Traffic to *.anthropic.com is additionally forwarded through coworkd's MITM proxy (via the mitmProxy.socketPath), which applies token and beta-header checks.

SRT always blocks write access to dangerous files regardless of configuration, detected by scanning with ripgrep at sandbox initialization:

Category	Blocked Paths
Shell configs	.bashrc, .bash_profile, .zshrc, .zprofile, .profile
Git configs	.gitconfig, .gitmodules, .git/hooks, .git/config
IDE/Tool configs	.vscode/, .idea/, .claude/commands/, .claude/agents/
Other	.ripgreprc, .mcp.json

Component	Source in SRT Repo	Location in Guest VM	Purpose
srt CLI	dist/cli.js	/usr/local/lib/node_modules_global/bin/srt	Entry point
apply-seccomp	vendor/seccomp/arm64/apply-seccomp	Inside bwrap exec chain	Applies BPF before exec
unix-block.bpf	vendor/seccomp/arm64/unix-block.bpf	/smol/bin/unix-block-arm64.bpf	BPF filter
SandboxManager	dist/sandbox/sandbox-manager.js	Bundled	Orchestrates bwrap + proxies
HTTP Proxy	dist/sandbox/http-proxy.js	In-process	Domain filtering for HTTP/HTTPS
SOCKS5 Proxy	dist/sandbox/socks-proxy.js	In-process	Domain filtering for TCP (git, SSH)

Layer 6: Seccomp BPF (apply-seccomp)

The last binary in the exec chain before Claude Code is apply-seccomp, a minimal C binary from SRT's vendor/seccomp/. It loads two stacked BPF filters that block exactly one syscall family:

socket(AF_UNIX=1, ...)  →  ERRNO(1)   // EPERM — silently denied
socket(AF_*, ...)       →  ALLOW      // all other address families pass

This prevents Claude Code from creating Unix domain sockets, which stops:

• IPC between sessions (connecting to another session's sockets)

• Bypassing the proxy chain (connecting to arbitrary .sock files)

The socat bridges established before seccomp was applied are the only Unix socket connections available which locks down new socket creation.

After applying the filter, apply-seccomp calls execvp("claude", args), and Claude Code starts with:

• CapEff: 0x0 — all Linux capabilities zeroed, no DAC bypass even as mapped root

• Seccomp: 2 — BPF mode with 2 stacked filters

• PID 1 = bwrap, completely isolated PID namespace

• Read-only root filesystem, writable only in explicit bind mounts

• Network only via socat proxy bridges → SRT domain filter → coworkd MITM proxy → NAT

Spawn Flow (Sequence Diagram)

This bring us to the end of the sandboxing section.

MITM Proxy: End-to-End

Every HTTPS request from Claude Code to *.anthropic.com is routed through an in-VM HTTP/HTTPS MITM proxy as specified earlier. This section traces the complete flow of traffic from the electron app to and back from the Guest VM.

Proxy Initialisation

When coworkd starts, main.main (@ 0x2f86e0) calls:

// main.main @ 0x2f86e0 (simplified)
proxy = coworkd_internal_proxy_New()      // 0x2cbfe0
proxy.Start("/var/run/mitm-proxy.sock")   // 0x2cc0d0

coworkd_internal_proxy_New (@ 0x2cbfe0) allocates a Proxy struct, calls NewCertManager() to generate a self-signed CA, and InstallToTrustStore() to add that CA to the guest's system certificate store. This is done so that Claude Code's TLS validation accepts the proxy's interposed certificates.

coworkd_internal_proxy__ptr_Proxy_Start (@ 0x2cc0d0) then:

1. net.Listen("unix", "/var/run/mitm-proxy.sock") which creates a Unix domain socket

2. os.Chmod("/var/run/mitm-proxy.sock", 0o666) makes the socket writable so that all guest processes can connect

3. Starts a goproxy.NewProxyHttpServer() (from github.com/elazarl/goproxy) to serve on that socket

4. Registers Start.func1 (@ 0x2cd340) as the CONNECT handler for HTTPS MITM

5. Registers Start.func2 (@ 0x2cca50) as the request handler (the three-check gate)

OAuth Token Setup (Electron → proxy)

Before Claude Code can make any authenticated requests, the frontend must register an OAuth token with the proxy. The flow crosses all three layers:

JS (app.asar)
│  CLAUDE_CODE_OAUTH_TOKEN environment variable is set by the session initialiser
│  vm.addApprovedOauthToken(token)              ← NAPI call into swift-addon.node
│
swift-addon.node (ClaudeVMDaemonRPCClient)
│  Serialises:  {"method":"addApprovedOauthToken","params":{"token":"eyJhbGci..."}}
│  Prefixes 4-byte big-endian length
│  Writes to VZVirtioSocketConnection (vsock CID=2, port=51234)
│
coworkd (Go) — coworkd_rpc._ptr_Client.handleRequest @ 0x2eee60
│  Reads 4-byte length prefix → reads JSON body
│  Dispatches on method name: len==21 && memcmp("addApprovedOauthToken") → calls client[96]
│  main.main.func4 @ 0x2f9710:
│      proxy.AddApprovedToken(token)            ← calls @ 0x2cd160
│
coworkd_internal_proxy._ptr_Proxy.AddApprovedToken @ 0x2cd160
   sync.Map.Swap(&self.approvedTokens, token, struct{}{})
   logger.Info("[proxy] added approved OAuth token (hash: %x...)", token[:8])

The token is stored in a sync.Map at offset +80 in the Proxy struct. Multiple tokens can coexist (one per active session).

Request Handling

When Claude Code sends an HTTPS request through the proxy (via HTTP_PROXY=unix:///var/run/mitm-proxy.sock), Start.func2 (@ 0x2cca50) is invoked for every outbound request:

// coworkd_internal_proxy._ptr_Proxy.Start.func2 @ 0x2cca50

// (1) Check against Domain allowlist (coworkd_internal_proxy.IsAllowedDomain @ 0x2cbe90)
host = stripPort(req.Host)
host = strings.ToLower(host)
if host != "anthropic.com" && !strings.HasSuffix(host, ".anthropic.com"):
    return 403 "Domain not allowed"

// (2) Perform Token approval (coworkd_internal_proxy._ptr_Proxy.isTokenApproved @ 0x2cd250)
authHeader = req.Header.Get("Authorization")
if authHeader.len == 0:
    pass                                   // BYPASS: no auth header → allowed through
elif !strings.EqualFold(authHeader[:7], "bearer "):
    return 401 "Unauthorized"
else:
    token = authHeader[7:]
    _, found = self.approvedTokens.Load(token)
    if !found: return 401 "Unauthorized"

// (3) Block web-fetch beta feature
if strings.Index(req.Header.Get("anthropic-beta"), "web-fetch") >= 0:
    return 403 "Beta feature not allowed"

// All checks passed → forward to Anthropic API via NAT

As mentioned earlier, any requests not to *.anthropic.com does not require an Authorization header with bearer token.

It is important to note that the http(s) traffic is directly sent to anthropic without passing through the host from the VM. The host simply does the NAT translation for this.

Complete Request Flow

Closing Thoughts

Analyzing Claude and its components proved to be a harder task than expected and showed a pretty complex architecture that was merticulously thought out to prevent potential bugs and vulnerabilities.

I also got more familiar with certain Swift behaviours and how they look like when decompiled.

It was also kinda hilarious that Claude was able to reverse itself suprisingly well, and being able to dynamically verify what was running in the Guest VM was a welcome suprise.

I also used Claude Code with IDA-Pro-mcp extensively which sped up analysis due to the fact that the binaries were easily decompilable and readable. However, I did spend a considerable amount of time validating the output and restructuring the findings.

References

Claude Desktop Cowork Mode - VM Architecture Analysis - aaddrick.comaaddrick.com

Reverse Engineering Claude Desktop's Cowork Mode: A Deep Dive into VM Isolation and Linux Possibilities - aaddrick.comaaddrick.com

GitHub - doronz88/swift_reversing: My ongoing primer on reversing SwiftGitHub

IDAPython Scripts

### Fix Async Pointer Swift
import idc
import idaapi
import idautils

def get_segment_by_name(name):
    """Safe helper to find segment by name for older IDA versions"""
    # Try the modern API first
    try:
        seg = idaapi.get_segm_by_name(name)
        if seg: return seg
    except:
        pass

    # Fallback: Iterate segments manually
    for seg_ea in idautils.Segments():
        seg_name = idc.get_segm_name(seg_ea)
        if seg_name == name:
            return idaapi.getseg(seg_ea)
    return None

def create_swift_async_struct_legacy():
    """Creates the SwiftAsyncFunction struct safely."""
    struc_name = "SwiftAsyncFunction"
    sid = idc.get_struc_id(struc_name)

    # If struct exists, return it
    if sid != idc.BADADDR:
        return sid

    print("[-] Creating 'SwiftAsyncFunction' structure...")
    # Add struct (returns id)
    sid = idc.add_struc(-1, struc_name, 0)

    # Member 1: Relative Pointer (4 bytes)
    idc.add_struc_member(sid, "RelativeImpl", -1, idc.FF_DWORD | idc.FF_DATA, -1, 4)

    # Member 2: Context Size (4 bytes)
    idc.add_struc_member(sid, "ContextSize", -1, idc.FF_DWORD | idc.FF_DATA, -1, 4)

    return sid

def solve_swift_async_pointers():
    print("[-] Starting Swift Async Scan (Compatibility Mode)...")

    # 1. Setup Segments
    text_seg = get_segment_by_name("__text")
    const_seg = get_segment_by_name("__const")

    # Fallback if __const isn't found
    if not const_seg:
        const_seg = get_segment_by_name("__data")

    if not text_seg or not const_seg:
        print("[!] Error: Could not find __text or __const segments.")
        return

    text_start = text_seg.start_ea
    text_end = text_seg.end_ea
    scan_start = const_seg.start_ea
    scan_end = const_seg.end_ea

    # 2. Get/Create the Struct
    struct_id = create_swift_async_struct_legacy()
    struct_size = idc.get_struc_size(struct_id)

    count = 0

    # 3. Scan 4-byte aligned
    for ea in range(scan_start, scan_end, 4):

        # --- A. Read the candidate pointer ---
        val = idc.get_wide_dword(ea)

        # Handle Signed 32-bit manually
        if val & 0x80000000:
            signed_offset = val - 0x100000000
        else:
            signed_offset = val

        target_addr = ea + signed_offset

        # --- B. HEURISTIC 1: Does it point to Code? ---
        if not (text_start <= target_addr < text_end):
            continue

        # Optimization: Ignore offsets that are too small
        if abs(signed_offset) < 0x20:
            continue

        # --- C. HEURISTIC 2: The "Context Size" Check ---
        next_dword = idc.get_wide_dword(ea + 4)

        # If the next dword looks invalid (too big or negative), skip
        if next_dword > 0xFFFF or (next_dword & 0x80000000):
            continue

        # --- D. HEURISTIC 3: Alignment ---
        if target_addr % 4 != 0:
            continue

        # --- E. Apply Fixes ---
        try:
            # 1. Clean bytes
            idc.del_items(ea, 0, struct_size)

            # 2. Apply Structure
            idc.create_struct(ea, struct_size, "SwiftAsyncFunction")

            # 3. Make the first member (offset) clickable
            # Force it to be an offset relative to EA
            idc.op_offset(ea, 0, idc.REF_OFF32 | idc.REFINFO_SIGNEDOP, -1, ea, 0)

            # 4. Add DREF
            idc.add_dref(ea, target_addr, idc.dr_O)

            # 5. Add Comment
            func_name = idc.get_name(target_addr)
            if not func_name:
                func_name = "sub_%X" % target_addr

            idc.set_cmt(ea, "Async Impl -> " + func_name, 0)

            print("[+] Fixed Async Closure at %X -> %s" % (ea, func_name))
            count += 1

        except Exception as e:
            print("[!] Failed at %X: %s" % (ea, str(e)))

    print("[-] Scan Complete. Resolved %d Async Function Pointers." % count)

if __name__ == "__main__":
    solve_swift_async_pointers()