claude config: sandbox, no-coauthor, pushback rule - #19
Open
cafedomingo wants to merge 9 commits into
Open
Conversation
- enable OS-level Bash sandbox, deny ~/.ssh except *.pub/config/known_hosts - exclude git commit from sandbox so SSH signing can read the private key - acceptEdits default mode, alwaysThinkingEnabled - attribution.commit/pr empty to enforce no co-author trailers - CLAUDE.md: add pushback-on-bad-approach rule - scope WebFetch allow to a few doc domains instead of blanket ask - reorganize settings.json thematically, alpha-sorted within groups
cafedomingo
changed the title
- move CLAUDE.md to root-level AGENTS.md, symlink both ~/.claude/CLAUDE.md and ~/.codex/AGENTS.md to it (single source of truth, no drift) - leave Codex's config.toml and Cursor's cli-config.json untouched: both mix user prefs with live app state (mcp servers, trust levels, privacy cache) that a dotfiles symlink would clobber - add cursor/permissions.json (terminalAllowlist/autoRun), new file so no existing config at risk - exclude ssh/scp/rsync/make from the Bash sandbox: same private-key-read and outside-cwd-write issues as git/gh, all already ask-gated
avoids double-loading when an AGENTS.md-aware agent works on the dotfiles repo itself (project-root AGENTS.md + global symlink to the same file would both get merged into context)
- carry forward real preferences (model, sandbox_mode, personality, approvals_reviewer, sandbox_workspace_write.network_access, plugin enablement, desktop prefs, notify hook) - drop app-rewritten bookkeeping: marketplaces cache, mcp_servers (install-path specific), model-migration notices, tui nux counters, per-project trust_level -- Codex regenerates all of this on next launch - remove dead "prefs" entry from Makefile EXCLUDE, directory no longer exists
and two sandbox gaps flagged in review - cursor: installed cursor-agent 2025.10.01 has no permissions.json/ terminalAllowlist support (verified by grepping the actual JS bundle) -- it only reads cli-config.json's embedded permissions.allow/deny. Replace the inert symlinked file with a jq merge that updates just that key and preserves the rest of the (live-state-heavy) file - sandbox: deny common secret env vars (GITHUB_TOKEN, ANTHROPIC_API_KEY, AWS_*, etc) from sandboxed Bash subprocesses -- file-path denial alone doesn't stop a subprocess reading inherited env vars - linux: add bubblewrap + socat to packages.list, the sandbox's actual Linux dependencies -- without them Claude Code silently falls back to running unsandboxed rather than failing loud
…rship user runs make themselves for anything writing outside cwd; no need for Claude-side carve-outs on link/cleanup/clean either
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
~/.sshexcept*.pub/config/known_hosts, deny~/.aws/credentials), excluding git commit/push/pull/clone/fetch,gh, ssh/scp/rsync,makesince those are already ask-gated or need direct private-key/network/outside-cwd access the sandbox blocksacceptEditsdefault mode,alwaysThinkingEnabled,attribution.commit/prempty to enforce no co-author trailersAGENTS.md, symlink~/.claude/CLAUDE.mdand~/.codex/AGENTS.mdto the same file (single source of truth)cursor/permissions.json(new file, no existing config touched)config.tomland Cursor'scli-config.jsonintentionally left alone: both mix user prefs with live app state a symlink would clobber