- Move docs/contributing/tools/agents/claude.md to claude/settings.md
- Split sandbox explanations into claude/sandbox.md, add claude/README.md as index
- Enable OS-level sandbox ("sandbox.enabled: true") for project-wide filesystem isolation
- Fail-closed on missing backend ("sandbox.failIfUnavailable: true") to prevent false-security state when bwrap/sandbox-exec is absent
- Add deny rules: "git clean*", "git branch -D*"
- Remove redundant "Read(~/.cache/pre-commit/**)" allow entry
- Update CLAUDE.md to instruct agent to summarize live permission state from settings.json at session start
- Update AGENTS.md and common.md references to new doc paths
- Normalize .md formatting per documentation.md rules (em dash removal, headline emojis)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Extend .claude/settings.json with git mv, rm, cherry-pick, apply, gh run, gh api, bash -n
- Add make chmod-scripts target and document it in make.md
- Move docs/contributing/tools/agents.md to agents/common.md
- Add docs/contributing/tools/agents/README.md and claude.md with full permission reference in table format
- Fix relative links in common.md after directory move
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>