Allow read-only gh api GETs (plus XDG_CACHE_HOME=* prefix variant) so
log-fetch invocations with env prefix + redirect stop prompting. Route
every implicit-POST shape through ask: -f/-F/--field/--raw-field/--input
body flags and graphql*. Path-based deny rules keep precedence.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Centralise the full GitHub Actions workflow catalog in
docs/contributing/tools/actions.md as the single source of truth, link
pipeline.md and workflow.md to it, and introduce
docs/agents/action/push-trigger-pull.md as the authoritative procedure
for the push to draft CI to ready-for-review loop. Retire the stale
flat docs/contributing/tools/agents/claude.md and drop docs README
page-inventories that violate the readme_md.md scope rule.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Mirrors the XDG_CACHE_HOME=* gh run view * precedent: leading env-prefixes fall out of the auto-allow heuristic. Narrow namespace, sandbox boundaries still bound every write / read / network call.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Parallel to head *: tail is the right-hand-side twin that lives after && / | and would otherwise decline auto-allow.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Allow Bash(docker *) under test-only host assumption; keep run/build/push/login in ask
- Catch synonyms: docker container run, docker image build, docker buildx build, docker image push
- New security.md enumerates 9 trust assumptions as single source for rationale
- Shorten settings.md rationales to link by assumption number (DRY)
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Add Bash(echo *) and Bash(head *) to allow list for chained stdout/read primitives.
- Move Bash(for *)/Bash(while *)/Bash(until *) to deny: hard-enforces the
CLAUDE.md loop-forbidden rule so violations fail fast and force refactor
to single-command / grep / xargs forms.
- Drop redundant /tmp/* scoping from Bash(XDG_CACHE_HOME=* gh run view *)
and Bash(tee *); sandbox.filesystem.allowWrite is the authoritative
write boundary, so path restrictions on the allow rule added only
maintenance, no safety.
- Update docs/contributing/tools/agents/claude/settings.md to match.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Why: `make` invocations and `… 2>&1 | tee /tmp/<log>` pipelines regularly
fall outside the sandbox auto-allow heuristic and trigger unnecessary
approval prompts. Adding targeted allow entries removes the friction
while keeping the write scope of `tee` bounded to /tmp.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Add explicit Bash allow entries for command shapes that slip past the
sandbox auto-allow heuristic: `gh run list *` (jq pipes in --jq string
confuse the parser), `grep *` (to back the new CLAUDE.md rule against
for-loops around per-file greps), and `wc *` (read-only, any flag).
Reorder permissions.allow strictly ASC so the Bash entries live
alongside the other allow rules in sort order, matching how ask/deny
are laid out. Document the three new entries in settings.md and add
the "prefer flat commands" guidance to CLAUDE.md Code Execution.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Add explicit Bash allow entries for command shapes where sandbox
auto-allow does not fire reliably (env-variable prefix, output
redirect, &&-chained subcommands). Document the rationale in the
settings reference so future additions follow the same pattern.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Copy-paste prompt templates with selection matrix routing each workflow
to its SPOT procedure file. Covers development, iteration, testing,
refactor, debug (pipeline/local/log), commit, PR, and requirements.
Consolidate gh ask/deny entries via namespace-wildcard patterns, cover
compound subcommands (item-*, field-*, mark-template*), and add a lint
test that enforces ASCII-sorted permission and sandbox arrays in
.claude/settings.json.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Sandbox network gate already bounds curl to allowedDomains, so the
interactive prompt added no real protection on top. Remove the rule
and the matching docs row.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Collapse explicit per-host entries into *.parent.tld patterns where the
sandbox only needs reach to a single domain family (Ansible, AWS, Docker,
Gitea, GitHub + githubusercontent, gstatic, hCaptcha, infinito, npm,
pythonhosted, Taiga). Apex domains stay listed bare. Sorted ASC with the
wildcard block first.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Network gate does not honor wildcards, so allowedDomains is enumerated
explicitly for every host the agent + tooling actually need. Adds
~/.cache/pip, ~/.venvs, ~/.ansible to allowWrite so the pre-commit
make test hook can install the editable package and run ansible.
Adds host shell / editor / tooling state files to .gitignore (and the
auto-generated .dockerignore mirror) so they never become part of the
working tree. Switches the dependabot coverage test to git ls-files
with an os.walk fallback that derives its skip list from the live
.gitignore, so it stays correct in container test environments
without .git/ while still ignoring untracked host artefacts.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds scripts/install/sandbox.sh, a distro-aware installer for the OS-level
dependencies the Claude Code sandbox backend needs (bubblewrap, socat),
and exposes it through a new `make agent-install` target. Documents the
target in docs/contributing/tools/make.md, scripts/install/README.md, and
the Claude sandbox guide so contributors on a fresh host can bring up a
working sandbox without hand-installing distro packages.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Move docs/contributing/tools/agents/claude.md to claude/settings.md
- Split sandbox explanations into claude/sandbox.md, add claude/README.md as index
- Enable OS-level sandbox ("sandbox.enabled: true") for project-wide filesystem isolation
- Fail-closed on missing backend ("sandbox.failIfUnavailable: true") to prevent false-security state when bwrap/sandbox-exec is absent
- Add deny rules: "git clean*", "git branch -D*"
- Remove redundant "Read(~/.cache/pre-commit/**)" allow entry
- Update CLAUDE.md to instruct agent to summarize live permission state from settings.json at session start
- Update AGENTS.md and common.md references to new doc paths
- Normalize .md formatting per documentation.md rules (em dash removal, headline emojis)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Split Bash(gh workflow *) into list/view (allow), run (ask), enable/disable (deny)
- Add Bash(break) to allow list
- Remove duplicate /tmp grant from permissions.additionalDirectories; rely on sandbox.filesystem.allowWrite
- Add AGENTS.md "Temporary Files" rule requiring agents to write transient files only under /tmp
- Reorder .claude/settings.json allow entries into logical sections (Git, GitHub CLI, Build, Python, Ansible, Docker, Shell, Read, Web)
- Document new gh workflow entries, break, and Temporary Files cross-link in docs/contributing/tools/agents/claude.md
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds `Bash(scripts/*)` so repository helper scripts can be invoked
directly by path (shebang-based), required by inner-loop workflows
such as the Playwright spec rerunner. Adds `Bash(chmod +x scripts/*)`
so newly added scripts can be made executable without approval prompts.
Documents both entries in docs/contributing/tools/agents/claude.md
next to the existing `bash scripts/*` and `source scripts/*` rows.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds `Bash(pkill -f *)` to the allowlist so stuck background commands
(pre-commit hooks, `make test`, `git commit`) can be aborted without an
approval prompt. Broad wildcard consciously accepted — narrow per-pattern
entries required repeated allowlist edits for every new abort scenario.
Adds `Read(~/.cache/pre-commit/**)` so pre-commit's stashed patch files
can be reapplied via `git apply` after a manually killed hook run, and
uses `~` instead of a hardcoded username path.
Documents both entries in docs/contributing/tools/agents/claude.md,
including the explicit risk note that `pkill -f` with a regex can
terminate every user-owned process and should use the narrowest pattern
possible.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replaces two over-specific `Bash(awk ...)` allowlist entries (full paths
and exact patterns that would never match again) with a single
`Bash(awk*)` entry next to `jq*`, consistent with how `grep*`, `find*`,
and `sort*` are allowed. Removes the broken `Read(//var/lib/infinito/logs/**)`
entry: `/var/lib/infinito/` is a named Docker volume defined in
compose.yml and never exists on the host, so host-scoped read access
is meaningless (and the path had a double slash).
Documents the new `awk*` entry in docs/contributing/tools/agents/claude.md
with an explicit note that awk's `system()` and `"cmd" | getline` put
it in the same risk class as the already-allowed `find -exec`.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds `Bash(bash scripts/*)` and `Bash(source scripts/*)` to the Claude
Code allowlist so repository helper scripts (e.g. env exports in
scripts/meta/env) can run without approval prompts, while still keeping
arbitrary paths scoped to review.
Documents both permissions in docs/contributing/tools/agents/claude.md,
including the caveat that `source` bypasses the allowlist for nested
commands.
Extends CLAUDE.md with an explicit rule that agents MUST prefer `make`
targets over direct docker/ansible/python/script invocations whenever
an equivalent target exists.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds the shell built-in `wait` to the Claude Code allow-list so the agent
can block on background commands started via run_in_background without
prompting for operator approval. Documents the new entry in the Claude
Code settings reference.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Extend .claude/settings.json with git mv, rm, cherry-pick, apply, gh run, gh api, bash -n
- Add make chmod-scripts target and document it in make.md
- Move docs/contributing/tools/agents.md to agents/common.md
- Add docs/contributing/tools/agents/README.md and claude.md with full permission reference in table format
- Fix relative links in common.md after directory move
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
