Sandbox exclusion `git merge --ff-only *` admits options and has no ask rule #214

New issue

Closed

opened 2026-11-10 20:42:25 +01:00 by motoko · 0 comments

motoko commented

2026-11-10 20:42:25 +01:00

Collaborator

Seen at 99fc8652bb, .claude/settings.json
(sandbox.excludedCommands), added by adb02f0 for deliver/land.md's
landing step.

Options pass the exclusion. The * matches any trailing arguments,
options included. A later merge option overrides --ff-only, and other
merge options read files, so a command matching the exclusion can run
outside the sandbox past the Read rules on secret files and expose
their content through git's output.

No ask rule. Where a developer's own settings allow git merge, an
excluded merge in the main checkout runs unsandboxed without a prompt
and can replace the policy files and the hook scripts that the
PreToolUse hooks then run outside the sandbox.

Smallest fix: exclude only git merge --ff-only --end-of-options *,
give land.md the same form (git 2.48 and later accept it), and add
Bash(git merge --ff-only *) to permissions.ask. With
--end-of-options, git treats every later argument as a revision and
refuses an option there.

Seen at 99fc8652bb5e4431fece00cab512d29469909f34, `.claude/settings.json` (`sandbox.excludedCommands`), added by adb02f0 for `deliver/land.md`'s landing step. **Options pass the exclusion.** The `*` matches any trailing arguments, options included. A later merge option overrides `--ff-only`, and other merge options read files, so a command matching the exclusion can run outside the sandbox past the `Read` rules on secret files and expose their content through git's output. **No ask rule.** Where a developer's own settings allow `git merge`, an excluded merge in the main checkout runs unsandboxed without a prompt and can replace the policy files and the hook scripts that the PreToolUse hooks then run outside the sandbox. Smallest fix: exclude only `git merge --ff-only --end-of-options *`, give `land.md` the same form (git 2.48 and later accept it), and add `Bash(git merge --ff-only *)` to `permissions.ask`. With `--end-of-options`, git treats every later argument as a revision and refuses an option there.

motoko referenced this issue from a commit

2026-11-11 10:39:01 +01:00

fix(claude): narrow and ask before landing merges

motoko referenced this issue from a commit

2026-11-11 10:39:01 +01:00

docs: say the landing merge always asks

motoko referenced this issue

2026-11-11 10:39:15 +01:00

fix(claude): narrow and ask before landing merges #217