0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-12 05:36:40 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 4.7 2abfc64636 chore(claude): broaden make allow shapes, per-domain WebFetch, deny git -C

Three related settings.json changes:

1. Replace narrow `Bash(*=* make *)` with three broader rules covering
   any prefix + make, plus composites with `> /tmp/*` redirect and
   `2>&1` stderr-merge. Needed so multi-env invocations with quoted
   multi-word values (e.g. `FOO=a BAR=b APPS="x y z" make target > /tmp/log 2>&1`)
   auto-allow without prompting — the prior single-env rule and the
   generic `* > /tmp/*` rules did not compose for this shape.

2. Replace inert `WebFetch(domain:*)` with explicit per-domain entries
   for `github.com` and `raw.githubusercontent.com`. Tested empirically:
   the wildcard form does not suppress the permission prompt, so a
   per-domain allowlist is the only mechanism that works.

3. Add `Bash(git -C *)` to deny. Blocks cross-repo escapes via the
   `-C <path>` flag, which otherwise lets the agent reach into other
   working trees under `additionalDirectories`. Operators needing a
   second repo must open a dedicated session there.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

2026-04-19 03:27:04 +02:00

README.md

docs(actions): add SPOT catalog and push-trigger-pull procedure

2026-04-17 17:40:28 +02:00

sandbox.md

chore(claude): grant gh cache write, generic /tmp redirect allow

2026-04-18 11:25:16 +02:00

security.md

chore(claude): grant gh cache write, generic /tmp redirect allow

2026-04-18 11:25:16 +02:00

settings.md

chore(claude): broaden make allow shapes, per-domain WebFetch, deny git -C

2026-04-19 03:27:04 +02:00

README.md

Claude Code 🤖

This folder documents the Claude Code agent configuration for this project. The authoritative policy lives in .claude/settings.json; the pages here explain the reasoning behind each entry so future contributors understand why a rule exists before they change it.

For general agent workflow rules shared across all agents (Claude Code, Codex, Gemini, others), see common.md. For the Claude Code permission model reference, see docs.anthropic.com.