IDE Bridge integration

While Claude Code executes within an isolated container sandbox, the IDE Bridge establishes a secure local communication channel between the container and your desktop editor. This allows Claude to automatically open edited files, highlight active code selections, and inspect compile-time diagnostics directly from your IDE.

Supported IDE environments

Speedwave communicates with any editor that implements the standard Claude Code lock file protocol under ~/.claude/ide/:

• VS Code: Supported via the official Claude Code extension.
• Cursor: Supported natively through its embedded Claude Code integration.
• JetBrains IDEs (IntelliJ, WebStorm, PyCharm): Supported via the Claude Code plugin.

Open your project in the editor, then select the target IDE in the Speedwave Health Dashboard. Speedwave persists your selection and reconnects automatically across application restarts. When no editor is active, the bridge returns structured fallback responses.

Architecture and communication flow

Speedwave hosts a local mediator process bridging the container sandbox and your host editor:

1. Claude sends an IDE tool request (such as opening a file path or retrieving diagnostic lints).
2. The host bridge validates session authentication and forwards the request to the designated editor socket.
3. The editor executes the action and returns language server diagnostics to the container.

To configure the channel, Speedwave initializes a local listener and writes connection metadata into an ephemeral lock file. This folder is mounted into the Claude container in read-only mode, enabling the container process to discover the bridge endpoint without modifying configuration state.

A background watchdog verifies lock file integrity every five seconds, recreating the file if altered. The Health Dashboard continuously probes active editor sockets to verify process health before listing editors as available.

Security boundaries and access control

• Loopback binding: The bridge listener binds strictly to the local loopback interface (127.0.0.1), ensuring it remains unreachable from external networks.
• Cryptographic tokens: On startup, Speedwave generates a high-entropy session token stored in the lock file. Requests require this token, which is evaluated using constant-time comparison algorithms to mitigate timing attacks.
• Filesystem permissions: The lock file enforces 0o600 permissions within 0o700 directories (or owner-only DACLs on Windows).
• Origin header validation: To prevent cross-site websocket hijacking or browser-based attacks, the bridge rejects any request containing an Origin header with HTTP 403 Forbidden.

For broader architectural details, see the Isolation model and Troubleshooting guide.