English | 简体中文
Most people use AI coding tools on private business code. That code cannot go on a public task board. This document defines the four ways around that, ordered by how much the worker gets to see.
Every task issue must declare exactly one tier.
The task lives in a repository that is already public. Point at it and go.
Worker sees: everything, same as any open-source contributor. Setup cost: none. Use for: open-source maintenance, general-purpose tooling, algorithm work, anything where the code is not the secret.
Phase 0 of this project runs P0 only. Get the social mechanics working before adding machinery.
The idea: do not hand over code, hand over a specification. Interface signatures, acceptance tests, and fake fixtures. The worker writes an implementation that makes the tests pass. Your business logic never leaves your machine.
Produced by the sparepack CLI:
sparepack init # writes a commented sparepack.yaml
sparepack pack # extract → redact → scan → review → emit
sparepack verify <pkg> # re-derive the pack from disk and re-scan itNothing is exposed unless you name it. There is no "exclude these and ship the rest" mode, because that mode is how leaks happen.
include: [ "src/payment/types.ts" ] # exposed verbatim
interfaces: [ "src/payment/gateway.ts" ] # signatures kept, bodies emptied
tests: [ "tests/payment/*.spec.ts" ] # this IS the task specification
fixtures: { "data/orders.json": "shape:5" } # empty | shape[:n] | rows:n | text:n
redact: [ { pattern: "acme-corp|ACME", replace: "example-org" } ]Built-in patterns for API key prefixes across major providers, private key blocks, JWTs, connection strings carrying a real password, hardcoded secret assignments, Chinese national ID and mobile numbers, email addresses, private IP ranges, and internal hostnames.
Findings never carry the full matched text — a report that leaks what it found is worse than no report, so each one shows a masked excerpt and a length. Credentials and personal data block the build; internal topology only warns.
Automated redaction is not trustworthy enough to be the last step. After packing, sparepack prints the complete file manifest with byte counts and a per-file summary of what was kept, emptied, or substituted, and waits for you to type publish before anything is written to disk.
If you would not be comfortable posting the manifest publicly, do not confirm.
The scanner is lexical: it finds patterns, not meaning. A business rule spelled out in a comment, an internal codename you forgot to add to redact, a customer name that looks like an ordinary word — none of those get caught. The manifest review is the part that actually decides what gets published. Everything else in the tool exists to make that review possible.
sparepack works today and lives in its own repository: mxx1111/sparepack, published as sparepack on npm.
npx sparepack initIt does not depend on this project — you do not need a task board to want help with your code without handing over the codebase.
Some tasks genuinely need the surrounding codebase — debugging an integration issue, tracking down a race condition, anything where the bug is in the interaction rather than in one function. Those go to P2.
The code never touches the worker's disk.
- Requester adds the worker as a collaborator, scoped to one dedicated branch via branch protection.
- Worker opens a Codespace on their own GitHub account and runs their own Claude Code inside it.
- Work happens, PR goes up, requester merges.
- Requester removes the collaborator, deletes the branch. The Codespace expires on its own.
Neither party is the other's host. This is the whole point.
If the sandbox ran on the requester's hardware, the requester would be root on the box where the worker's ~/.claude/.credentials.json is mounted. That turns a privacy feature into a credential-harvesting device — strictly worse than not doing it at all. Putting the sandbox on Microsoft's infrastructure makes it a neutral third party to both sides, and personal accounts get 60 free core-hours a month.
The cost is that your code passes through GitHub's cloud. For most projects that is already true. For the ones where it is not, see P3.
- Branch protection restricts the worker to the task branch
- No secrets in the repo's Codespaces secrets for that branch
- Repository-level Actions permissions reviewed before granting access
- Calendar reminder to revoke access after merge
Full repository access under an NDA, for people you already have a relationship with. Requires 5+ successful deliveries in the community before a worker is eligible.
For code that genuinely cannot go to any cloud. There is no implementation of this today — what follows is the requirement, not a thing you can go and use.
A container the requester hosts, with: egress allowlisted to api.anthropic.com plus package registries and nothing else, access granted through a per-task ephemeral credential pinned to the worker's single device, full session recording, and destruction of both container and credential when the task closes.
An earlier draft of this document pointed at a self-hosted terminal gateway as the starting point for building it. That project is no longer maintained, so the pointer has been removed rather than left to rot. If you need this tier, expect to build it, and read the warning below first — it may change your mind about wanting it.
Is the code already public? → P0
Can the task be expressed as tests + interfaces? → P1 ← try hard to land here
Does it need the live codebase to reproduce? → P2
Can the code not go to any cloud at all? → P3, only with people you know
Bias toward P1. If you find yourself reaching for P2 often, the tasks are probably too large — split them.
大部分人是拿 AI 在私有业务代码上干活的，那种代码没法往公开任务板上贴。本文件定义绕开这个问题的四种办法，按接单者能看到的信息量排序。
每个任务 issue 必须且只能声明一个级别。
任务在一个本来就公开的仓库里，直接给链接就完事。
接单者能看到： 全部，跟任何开源贡献者一样。 准备成本： 零。 适用于： 开源维护、通用工具、算法题，以及任何"代码本身不是秘密"的场景。
本项目 Phase 0 只跑 P0。先把社会协作那套跑通，再上机械。
思路是：不给代码，给规约。 接口签名、验收测试、假数据。接单者写一个能让测试通过的实现。你的业务逻辑压根没离开过你的机器。
由 sparepack CLI 生成：
sparepack init # 生成一份带注释的 sparepack.yaml
sparepack pack # 抽取 → 脱敏 → 扫描 → 人工复核 → 产出
sparepack verify <pkg> # 从磁盘重新推导任务包并再扫一遍你不点名的东西一概不暴露。没有"排除这几个、剩下的都发出去"这种模式，因为泄露就是这么发生的。
include: [ "src/payment/types.ts" ] # 原样暴露
interfaces: [ "src/payment/gateway.ts" ] # 保留签名，清空函数体
tests: [ "tests/payment/*.spec.ts" ] # 这就是任务规约本身
fixtures: { "data/orders.json": "shape:5" } # empty | shape[:n] | rows:n | text:n
redact: [ { pattern: "acme-corp|ACME", replace: "example-org" } ]内置规则覆盖各家厂商的 API key 前缀、私钥块、JWT、带真实密码的连接串、硬编码的密钥赋值、中国大陆身份证号与手机号、邮箱、内网 IP 段和内部域名。
findings 永远不含完整匹配内容——一份会泄露它所发现之物的报告，比没有报告更糟，所以每条只给遮蔽摘要和长度。凭证和个人数据会阻断构建，内网拓扑只警告。
自动脱敏没可靠到能当最后一道关。打包完成后，sparepack 会打印完整的文件清单（带字节数）和逐文件的处理摘要（保留了什么、清空了什么、替换了什么），然后等你敲 publish，在此之前不写任何东西到盘上。
判断标准很简单：这份清单你敢不敢公开贴出来。不敢就别确认。
扫描器是词法级的，它找的是模式，不是含义。写在注释里的业务规则、你忘了加进 redact 的内部代号、一个看起来像普通词的客户名——这些都抓不到。真正决定什么东西被公开的，是那一步人工复核。 工具里其余所有东西，存在的意义只是让那次复核成为可能。
sparepack 现在就能用，在它自己的仓库里：mxx1111/sparepack，已发布到 npm：sparepack。
npx sparepack init它不依赖本项目——想让人帮你改代码又不想交出整个代码库，这件事本身不需要一个任务板。
有些任务确实需要周边代码库，比如排查集成问题、追一个竞态条件，凡是 bug 在"交互"而不在"某个函数"里的，都属于这类。这些走 P2。
代码不落接单者磁盘。
- 发布者把接单者加为 collaborator，用分支保护限定在一个专用分支上。
- 接单者在自己的 GitHub 账号下开 Codespace，在里面跑他自己的 Claude Code。
- 干活，提 PR，发布者合并。
- 发布者移除 collaborator、删分支。Codespace 自己会过期。
双方都不是对方的宿主。 这就是全部理由。
如果沙箱跑在发布者的硬件上，发布者就是那台机器的 root，而接单者的 ~/.claude/.credentials.json 正挂在里面。那样一个隐私功能就变成了凭证收割装置，比不做还糟。把沙箱放在微软的基础设施上，对双方而言它都是中立第三方，而且个人账号每月有 60 核时免费额度。
代价是代码要过 GitHub 的云。对大多数项目来说这本来就已经是事实了。不是的那些，看 P3。
- 分支保护已把接单者限制在任务分支上
- 该分支相关的 Codespaces secrets 里没有密钥
- 授权前复查过仓库级的 Actions 权限
- 设好合并后回收权限的提醒
NDA 下的完整仓库访问，只给你已经有关系的人。接单者需要在社区内有 5 次以上成功交付才有资格。
给那种确实不能上任何云的代码。目前没有实现，下面写的是要求，不是一个你可以拿来就用的东西。
一个由发布者托管的容器：出网白名单只放行 api.anthropic.com 和包管理源，其余一律禁止；访问权通过一次性凭据授予，并锁死接单者的单个设备；全程会话录制；任务关闭时容器和凭据一起销毁。
本文档早先的版本把一个自托管终端网关项目指为搭建它的起点。那个项目已不再维护，所以这里把指针删掉，而不是留着烂在文档里。真需要这一级的话，做好自己从头搭的准备，而且先读下面那段警告——读完你可能就不想要了。
代码本来就是公开的吗？ → P0
任务能表达成「测试 + 接口」吗？ → P1 ← 尽量往这里落
必须有活的代码库才能复现吗？ → P2
代码完全不能上任何云吗？ → P3，且只跟认识的人
优先 P1。如果你发现自己老是想用 P2，多半是任务切得太大了，拆开。