Keeping it honest

Why you can let it near your sessions

What leaves the Mac, what proves what, and the gates that fail on purpose before every release.

LampBoard sits beside every session you run. That is a lot of trust to ask of a menu-bar app, so here is what it rests on, each point something you can check.

What leaves the Mac

Nothing, unless you ask. Switch on LampMaster and, once an hour and when you ask it, a claude -p run reads a summary of your sessions with your own account, as any session of yours would. Switch on Usage left and the panel asks api.anthropic.com how much of your plan remains, with the sign-in Claude Code already keeps. The sessions on another machine are read over your own ssh. Checking for updates asks GitHub's public release page, and only when you press it. There is no LampBoard server, no account and no analytics. In Settings, the two sections that act on your sessions or send something off this Mac carry an orange edge.

Who may talk to the panel

The panel listens on 127.0.0.1 only. Reading your sessions, answering and every action need a token from a file only you can read, and a request a web page could send (a browser's Origin, a foreign Host) is refused before any route. A hook's signal is still taken without the token, for hooks an older version installed: it can change a row's colour, and nothing more. The helper proves every question it asks with a second key the hooks never carry, and believes only an answer signed with it. So a process that learned the token still cannot answer a permission for you.

What a click can and cannot do

Allow, Deny and messages to a session happen only from the panel or the Hub, by a click or a key, with the switch for each one off until you turn it on. A message goes into the session's own box, as you, and Claude Code holds it to that session's permissions: it can ask for work, never grant itself more. LampMaster suggests and never acts. Asking another session goes out only when you send it. In the Hub and in the live view you type into the session's own terminal, as you would in a terminal of your own.

The gates

Before every merge a gate on a test Mac builds the app, runs every domain test and every end-to-end test against real instances on fake homes, loads the helper as Claude Code reads it, and checks that the documents describe the code as it is. Then it commits violations on purpose — a personal path in a test, a helper that would be refused, a stale figure — and fails if any of them gets through. A gate nobody has seen fail is not believed.

What you install

The app is signed with a Developer ID and notarized by Apple; the disk image and the installer package are too. The source is on GitHub, under a licence that lets you read and build it yourself. The site and this guide never show a real panel: every figure is drawn, and every capture comes from the app's demo on a temporary home, on invented sessions.