Ask before editing any agent configuration file #215

New issue

Closed

opened 2026-11-10 20:54:42 +01:00 by motoko · 0 comments

motoko commented

2026-11-10 20:54:42 +01:00

Collaborator

Defect

Since adb02f0 narrowed the sandbox, nothing asks before an agent edits
the files that configure the agents themselves: .agents/,
AGENTS.md, AGENTS.local.md, the CLAUDE files, .claude/, .codex/,
and .opencode/. The sandbox's denyWrite on them went, and
.claude/settings.json holds no ask rule for them, so in
bypassPermissions mode the file tools edit them with no prompt, and a
sandboxed command writes them as freely.

Seen at 99fc8652bb.

These files decide what every later session follows and runs: the
policy, the skills, the subagent briefs, the hook scripts that the
PreToolUse and PostToolUse hooks run, and the settings. #213 covers
only .claude/settings.json and .claude/settings.local.json; this
issue asks the same for every agent configuration file.

Scenario

A developer runs a session in bypassPermissions mode. An instruction
injected into what the agent reads, or a mistaken step, has it rewrite a
hook script under .agents/hooks/, a skill, or AGENTS.md. Every later
session runs or follows the changed file, and nothing asked first.

Requested behavior

Every edit of an agent configuration file asks the user, in every
permission mode, at every depth below the project root, the worktrees
under .worktrees/ included, so a policy change in a worktree also
asks.

Smallest fix

Add Edit rules to permissions.ask in .claude/settings.json, which
cover every built-in file-editing tool, Write included, anchored at
the project root as #213 proposes, for example:

"ask": [
  "Edit(/**/.agents/**)",
  "Edit(/**/AGENTS.md)",
  "Edit(/**/AGENTS.local.md)",
  "Edit(/**/CLAUDE.md)",
  "Edit(/**/CLAUDE.local.md)",
  "Edit(/**/.claude/**)",
  "Edit(/**/.codex/**)",
  "Edit(/**/.opencode/**)"
]

A shell write cannot be matched by a rule, so the sandbox's
filesystem.denyWrite on the same paths would come back for commands
inside it, leaving shell edits of these files to a command run outside
the sandbox, which prompts. The README's Hooks and settings section and
the sandbox guide would say which files ask. This supersedes #213 if
taken whole.

## Defect Since adb02f0 narrowed the sandbox, nothing asks before an agent edits the files that configure the agents themselves: `.agents/`, `AGENTS.md`, `AGENTS.local.md`, the CLAUDE files, `.claude/`, `.codex/`, and `.opencode/`. The sandbox's `denyWrite` on them went, and `.claude/settings.json` holds no `ask` rule for them, so in `bypassPermissions` mode the file tools edit them with no prompt, and a sandboxed command writes them as freely. Seen at 99fc8652bb5e4431fece00cab512d29469909f34. These files decide what every later session follows and runs: the policy, the skills, the subagent briefs, the hook scripts that the PreToolUse and PostToolUse hooks run, and the settings. #213 covers only `.claude/settings.json` and `.claude/settings.local.json`; this issue asks the same for every agent configuration file. ## Scenario A developer runs a session in `bypassPermissions` mode. An instruction injected into what the agent reads, or a mistaken step, has it rewrite a hook script under `.agents/hooks/`, a skill, or `AGENTS.md`. Every later session runs or follows the changed file, and nothing asked first. ## Requested behavior Every edit of an agent configuration file asks the user, in every permission mode, at every depth below the project root, the worktrees under `.worktrees/` included, so a policy change in a worktree also asks. ## Smallest fix Add `Edit` rules to `permissions.ask` in `.claude/settings.json`, which cover every built-in file-editing tool, `Write` included, anchored at the project root as #213 proposes, for example: ```json "ask": [ "Edit(/**/.agents/**)", "Edit(/**/AGENTS.md)", "Edit(/**/AGENTS.local.md)", "Edit(/**/CLAUDE.md)", "Edit(/**/CLAUDE.local.md)", "Edit(/**/.claude/**)", "Edit(/**/.codex/**)", "Edit(/**/.opencode/**)" ] ``` A shell write cannot be matched by a rule, so the sandbox's `filesystem.denyWrite` on the same paths would come back for commands inside it, leaving shell edits of these files to a command run outside the sandbox, which prompts. The README's Hooks and settings section and the sandbox guide would say which files ask. This supersedes #213 if taken whole.

motoko referenced this issue from a commit

2026-11-11 09:34:39 +01:00

feat(claude): ask before agent config file edits

motoko referenced this issue from a pull request that will close it,

2026-11-11 09:35:00 +01:00

feat(claude): ask before agent config file edits #216