Getting the best results from owned bots

Confined. These may review other accounts' code with no extra switch:

• Claude Code: a sandbox, with a read-only checkout and no network.
• Codex: a read-only sandbox. On a Mac, its commands can still read this account's files; the doctor reports what is closed.
• OpenClaw in Docker: only as confined as the owner's container. The repository token stays outside it.

Full rights. The Connector puts no sandbox around Cursor Agent, Cline, Qoder, OpenCode, OpenClaw run directly, or an owner-written template. Each runs with the owner's rights, within its own settings.

• For other accounts' code, even an outside contributor's pull request, use Claude Code or Codex on a personal computer, or OpenClaw in Docker on a server.
• Full-rights bots take such work only with "allowUnsandboxedNetwork": true in the driver section. Set it only on a spare computer or virtual machine without personal accounts.
• Mix tools and models on one Call. One often catches what another misses.

On a server, run OpenClaw in Docker; that bot also suits other accounts' code. Run directly, OpenClaw suits the owner's own code on the owner's own computer.

Either way, the whole task arrives as a file, which OpenClaw reads as the message. An OpenClaw build from before that option (--message-file, added in June 2026) still runs directly, with a warning to upgrade: on macOS and Linux it gets the task on the command line, where other programs can read it, and on Windows a long task may be cut.

Docker is set up by hand; the installers run OpenClaw directly.

1. Run OpenClaw's gateway in a long-lived container, signed in to a model provider, as OpenClaw's Docker guide shows. It needs Git, sh, common Linux tools, and a writable /tmp and home folder.
2. Mount one host folder for the bot, open to the container's user, by default at /home/node/.openclaw/workspace. Job checkouts go there, beside OpenClaw's AGENTS.md, USER.md and memory files: keep nothing private there.
3. Run it as a non-root user. Leave out --privileged, added capabilities, devices, and host PID or user namespaces. Mount no Docker socket, home folder or keys. The Connector does not check this by default.
4. With the Connector stopped, set the bot's worker.json "workspace" to that folder. In its driver section, set "runner" to "docker", "container" to the name docker ps shows, and "containerWorkspace" to the mount path.
5. The doctor cannot see inside the container. Check that docker exec <container> openclaw agent --help lists --message-file, run docker exec <container> openclaw health, then one small Call.

When OpenClaw runs directly, install its gateway as a service: openclaw gateway install.

• Each bot's settings are in workers/<tool>/worker.json under ~/.deskbot on macOS or %LOCALAPPDATA%\Deskbot on Windows; Claude Code's folder is claude. Edit one only with no Call running and the Connector stopped (on macOS, launchctl bootout gui/$(id -u)/dev.deskfleet.connector.<id>; restart it with ~/.deskbot/start.command).
• Run the doctor with Python 3.11 or newer, from ~/.deskbot/connector on macOS or %LOCALAPPDATA%\Deskbot on Windows: python3 deskbot_worker.py --config <that worker.json> doctor (python on Windows). It checks sign-in only for Claude Code, Codex and Cursor Agent; finish with one small Call.

A bot thinks at the level its owner saved for its tool on that computer, for the model it runs, read again for every job. Deskfleet doesn't set it.

• Claude Code follows the level saved for each model with /effort, a saved cap (maxEffortLevel), and thinking turned off. It doesn't follow the general level that /effort saved before Claude Code 2.1.251: save a level for the model with /effort. It doesn't follow the default model either: the bot runs the model Claude Code picks for a new session, or the one its driver section names. An organization's override of a level applies to the bot as it does to the owner. Claude Code never saves max, so a bot thinks at max only when the Connector's service has CLAUDE_CODE_EFFORT_LEVEL.
• Codex follows model_reasoning_effort in ~/.codex/config.toml, and the model there unless the driver section sets "model". Cline follows the reasoning level in its provider settings.
• OpenCode follows the level its terminal app saved for each model, when it can tell which model the run uses (the bot's own "model", or the one OpenCode reports) and that model offers the level. A level picked in OpenCode's web or desktop app can't be followed.
• OpenClaw uses the level saved for it, unless the driver section sets "thinking".
• Cursor Agent and Qoder get no level from Deskfleet. Cursor keeps its level in its saved model settings, and whether a headless run follows them hasn't been checked; Qoder saves no level.

• To pin a model, set "model" in the driver section to provider/model, such as anthropic/claude-opus-5: one slash, and only letters, digits, dots, underscores, colons and dashes. Anything else, such as opus[1m], makes the service refuse the bot's heartbeat.
• A template names its model in its own command.
• Some free models may train on what a bot sends them: OpenCode Zen says so of Big Pickle during its free period. Check the terms, keep such a bot out of Calls on private repositories, and leave "Review private repositories" off in its Network profile.

• On macOS, run the installer and every upgrade from a Terminal where the proxy is set and every tool works. The service keeps that Terminal's PATH, certificate settings and plain proxy addresses, and setup names any it leaves out.
• Cline 3.0.68 ignored HTTP_PROXY and HTTPS_PROXY in a macOS test, though Cline's docs say it uses them. If Cline cannot reach its provider, route the whole system, for example with a VPN's TUN or "enhanced" mode.