Why: `make` invocations and `… 2>&1 | tee /tmp/<log>` pipelines regularly
fall outside the sandbox auto-allow heuristic and trigger unnecessary
approval prompts. Adding targeted allow entries removes the friction
while keeping the write scope of `tee` bounded to /tmp.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Add explicit Bash allow entries for command shapes that slip past the
sandbox auto-allow heuristic: `gh run list *` (jq pipes in --jq string
confuse the parser), `grep *` (to back the new CLAUDE.md rule against
for-loops around per-file greps), and `wc *` (read-only, any flag).
Reorder permissions.allow strictly ASC so the Bash entries live
alongside the other allow rules in sort order, matching how ask/deny
are laid out. Document the three new entries in settings.md and add
the "prefer flat commands" guidance to CLAUDE.md Code Execution.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Add explicit Bash allow entries for command shapes where sandbox
auto-allow does not fire reliably (env-variable prefix, output
redirect, &&-chained subcommands). Document the rationale in the
settings reference so future additions follow the same pattern.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Consolidate gh ask/deny entries via namespace-wildcard patterns, cover
compound subcommands (item-*, field-*, mark-template*), and add a lint
test that enforces ASCII-sorted permission and sandbox arrays in
.claude/settings.json.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Sandbox network gate already bounds curl to allowedDomains, so the
interactive prompt added no real protection on top. Remove the rule
and the matching docs row.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Collapse explicit per-host entries into *.parent.tld patterns where the
sandbox only needs reach to a single domain family (Ansible, AWS, Docker,
Gitea, GitHub + githubusercontent, gstatic, hCaptcha, infinito, npm,
pythonhosted, Taiga). Apex domains stay listed bare. Sorted ASC with the
wildcard block first.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Network gate does not honor wildcards, so allowedDomains is enumerated
explicitly for every host the agent + tooling actually need. Adds
~/.cache/pip, ~/.venvs, ~/.ansible to allowWrite so the pre-commit
make test hook can install the editable package and run ansible.
Adds host shell / editor / tooling state files to .gitignore (and the
auto-generated .dockerignore mirror) so they never become part of the
working tree. Switches the dependabot coverage test to git ls-files
with an os.walk fallback that derives its skip list from the live
.gitignore, so it stays correct in container test environments
without .git/ while still ignoring untracked host artefacts.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Move docs/contributing/tools/agents/claude.md to claude/settings.md
- Split sandbox explanations into claude/sandbox.md, add claude/README.md as index
- Enable OS-level sandbox ("sandbox.enabled: true") for project-wide filesystem isolation
- Fail-closed on missing backend ("sandbox.failIfUnavailable: true") to prevent false-security state when bwrap/sandbox-exec is absent
- Add deny rules: "git clean*", "git branch -D*"
- Remove redundant "Read(~/.cache/pre-commit/**)" allow entry
- Update CLAUDE.md to instruct agent to summarize live permission state from settings.json at session start
- Update AGENTS.md and common.md references to new doc paths
- Normalize .md formatting per documentation.md rules (em dash removal, headline emojis)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Split Bash(gh workflow *) into list/view (allow), run (ask), enable/disable (deny)
- Add Bash(break) to allow list
- Remove duplicate /tmp grant from permissions.additionalDirectories; rely on sandbox.filesystem.allowWrite
- Add AGENTS.md "Temporary Files" rule requiring agents to write transient files only under /tmp
- Reorder .claude/settings.json allow entries into logical sections (Git, GitHub CLI, Build, Python, Ansible, Docker, Shell, Read, Web)
- Document new gh workflow entries, break, and Temporary Files cross-link in docs/contributing/tools/agents/claude.md
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds `Bash(scripts/*)` so repository helper scripts can be invoked
directly by path (shebang-based), required by inner-loop workflows
such as the Playwright spec rerunner. Adds `Bash(chmod +x scripts/*)`
so newly added scripts can be made executable without approval prompts.
Documents both entries in docs/contributing/tools/agents/claude.md
next to the existing `bash scripts/*` and `source scripts/*` rows.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds `Bash(pkill -f *)` to the allowlist so stuck background commands
(pre-commit hooks, `make test`, `git commit`) can be aborted without an
approval prompt. Broad wildcard consciously accepted — narrow per-pattern
entries required repeated allowlist edits for every new abort scenario.
Adds `Read(~/.cache/pre-commit/**)` so pre-commit's stashed patch files
can be reapplied via `git apply` after a manually killed hook run, and
uses `~` instead of a hardcoded username path.
Documents both entries in docs/contributing/tools/agents/claude.md,
including the explicit risk note that `pkill -f` with a regex can
terminate every user-owned process and should use the narrowest pattern
possible.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replaces two over-specific `Bash(awk ...)` allowlist entries (full paths
and exact patterns that would never match again) with a single
`Bash(awk*)` entry next to `jq*`, consistent with how `grep*`, `find*`,
and `sort*` are allowed. Removes the broken `Read(//var/lib/infinito/logs/**)`
entry: `/var/lib/infinito/` is a named Docker volume defined in
compose.yml and never exists on the host, so host-scoped read access
is meaningless (and the path had a double slash).
Documents the new `awk*` entry in docs/contributing/tools/agents/claude.md
with an explicit note that awk's `system()` and `"cmd" | getline` put
it in the same risk class as the already-allowed `find -exec`.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds `Bash(bash scripts/*)` and `Bash(source scripts/*)` to the Claude
Code allowlist so repository helper scripts (e.g. env exports in
scripts/meta/env) can run without approval prompts, while still keeping
arbitrary paths scoped to review.
Documents both permissions in docs/contributing/tools/agents/claude.md,
including the caveat that `source` bypasses the allowlist for nested
commands.
Extends CLAUDE.md with an explicit rule that agents MUST prefer `make`
targets over direct docker/ansible/python/script invocations whenever
an equivalent target exists.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds the shell built-in `wait` to the Claude Code allow-list so the agent
can block on background commands started via run_in_background without
prompting for operator approval. Documents the new entry in the Claude
Code settings reference.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Extend .claude/settings.json with git mv, rm, cherry-pick, apply, gh run, gh api, bash -n
- Add make chmod-scripts target and document it in make.md
- Move docs/contributing/tools/agents.md to agents/common.md
- Add docs/contributing/tools/agents/README.md and claude.md with full permission reference in table format
- Fix relative links in common.md after directory move
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
