openrig — multi-agent Claude Code/Codex orchestration

What it is

The security-relevant detail here is not that OpenRig writes trust/permission settings — the summary has that — but the specific ways its isolation and safety controls fail to do what an operator would assume. These come straight from OpenRig's own "what OpenRig changes on your machine" section for this source revision (rig --version may lag npm).

How it works — the gaps the summary can't carry

Isolation env-vars don't isolate provider config. Provider files (Claude/Codex trust, hooks) are written under the daemon user's home, not the instance root. Per the page: "changing OPENRIG_HOME alone does not isolate provider configuration," and "a custom CLAUDE_CONFIG_DIR is not a general relocation of these writes." The trust writer uses the daemon home. Codex writes go to the daemon's CODEX_HOME/config.toml.

Seat policy overrides the YOLO env-var. YOLO being off by default is not sufficient: "a resolved seat policy takes precedence over the environment setting." A full-bypass seat policy selects --dangerously-skip-permissions / -s danger-full-access regardless of OPENRIG_YOLO. Auditing the environment alone won't tell you whether bypass is active.

Codex gets more than the workspace. Fresh Codex launches add writable access to the workspace's .git and a shared queue-state dir via --add-dir; the shared root comes from OPENRIG_SHARED_DOCS_ROOT or ~/.openrig/shared-docs. So .git history is writable, and multiple seats share a writable directory.

Default MCP wiring reaches external services. The shared settings resource sets permissions.defaultMode to acceptEdits and enables Exa/Context7 MCP entries — outbound connections with their own data flows, on by default.

More network endpoints than the daemon relay. Beyond activity relays to /api/activity/hooks (payload = event type/subtype, seat/runtime identity, timestamps, native session identity — excludes prompt text and tool args), daemon plugin init also checks the OpenRig plugin release endpoint on GitHub.

What to do

• Use the dry run, but know its limit — it does not preview later effects:

rig setup --dry-run

Per the page: "rig setup --dry-run does not preview every later startup effect," and daemon/bootstrap writes are automatic with no per-write interactive preview.

• Back up ~/.claude.json, .claude/settings.local.json, .mcp.json, and ~/.codex/config.toml before first use.
• If installing via Bun, install Node.js 22 separately and note that Bun may block the postinstall script, so the Node/SQLite preflight check "does not run at install time." Don't assume the check passed.
• Audit seat policies, not just OPENRIG_YOLO, before trusting that bypass is disabled.

Caveats

There is no rollback guarantee. Managed hook blocks retain unrelated hooks, but "trust entries, selected resource keys and Claude's existing status-line command can be replaced," and "some writers recover unreadable settings as empty objects" — i.e., a malformed settings file can be silently reset rather than preserved. The page states outright: "this is not a complete preservation or rollback guarantee." Built-in bootstrap no longer writes a command allowlist to ~/.claude/settings.json, so that particular older behavior is gone in this revision.