feat(claude): ask before agent config file edits #216

Merged

claudiomaradonna merged 2 commits from feat/agent-config-ask into main 2026-11-11 09:36:35 +01:00

Conversation 0 Commits 2 Files changed 3 +34 -3

motoko commented 2026-11-11 09:34:59 +01:00

Collaborator

Copy link

Why

Since adb02f0 narrowed the sandbox, nothing asks before Claude's file
tools edit the files that configure the agents. In bypassPermissions
mode an agent rewrote .claude/settings.local.json with no prompt, and
the same holds for the hook scripts, skills, briefs, and AGENTS.md:
one mistaken step or injected instruction can lift a protection that
every later session then loses. Closes #215 and #213.

Claude Code's permissions and permission-modes pages say an explicit
ask rule prompts in every mode, bypassPermissions included, and that
Edit rules cover every built-in file-editing tool. Restoring the
sandbox's filesystem.denyWrite on the same paths, as #215 also
proposes, was set aside: it would undo part of adb02f0's narrowing.

What changed

Before, an agent's Edit, Write, or NotebookEdit of .agents/,
AGENTS.md, AGENTS.local.md, the CLAUDE files, .claude/, .codex/,
or .opencode/ ran unasked in bypassPermissions mode. Now each asks,
in every mode, at the project root and every depth below it, the
worktrees under .worktrees/ included. A shell command that writes
those files is unchanged.

The README's Hooks and settings section says which edits ask, what a
shell write meets instead, and that a developer's own settings cannot
lift an ask rule.

Every policy edit in a worktree, as in this source's own maintenance,
now prompts.

How to verify

With this branch merged into the main checkout, start Claude Code at the
root in bypassPermissions mode and ask it to add a blank line to
AGENTS.md, then to a file under .worktrees/<branch>/.agents/: each
edit asks first. On main both go through unasked.

bash tests/verify-agent-config.sh (234 passed),
bash tests/check-work-folder.sh, .agents/hooks/shellcheck.sh repo,
prettier --check '**/*.md', scripts/verify-agent-config.sh, and
git diff --check main pass on the tip; the bubblewrap and python3
tests were skipped inside Claude Code's sandbox. The test "asks before a
file tool edits an agent configuration file, …" fails on main. The live
prompt check above was not run, since the rules take effect only from
the main checkout's settings.

Considerations

Claude Code's docs do not say verbatim that /**/ matches the project
root's top level, which Edit(/**/AGENTS.md) needs; the live check
settles it. No UPGRADING.md migration announces the new prompts to an
upgrading repository, by the maintainer's choice.

## Why Since adb02f0 narrowed the sandbox, nothing asks before Claude's file tools edit the files that configure the agents. In `bypassPermissions` mode an agent rewrote `.claude/settings.local.json` with no prompt, and the same holds for the hook scripts, skills, briefs, and `AGENTS.md`: one mistaken step or injected instruction can lift a protection that every later session then loses. Closes #215 and #213. Claude Code's permissions and permission-modes pages say an explicit `ask` rule prompts in every mode, `bypassPermissions` included, and that `Edit` rules cover every built-in file-editing tool. Restoring the sandbox's `filesystem.denyWrite` on the same paths, as #215 also proposes, was set aside: it would undo part of adb02f0's narrowing. ## What changed Before, an agent's `Edit`, `Write`, or `NotebookEdit` of `.agents/`, `AGENTS.md`, `AGENTS.local.md`, the CLAUDE files, `.claude/`, `.codex/`, or `.opencode/` ran unasked in `bypassPermissions` mode. Now each asks, in every mode, at the project root and every depth below it, the worktrees under `.worktrees/` included. A shell command that writes those files is unchanged. The README's Hooks and settings section says which edits ask, what a shell write meets instead, and that a developer's own settings cannot lift an ask rule. Every policy edit in a worktree, as in this source's own maintenance, now prompts. ## How to verify With this branch merged into the main checkout, start Claude Code at the root in `bypassPermissions` mode and ask it to add a blank line to `AGENTS.md`, then to a file under `.worktrees/<branch>/.agents/`: each edit asks first. On main both go through unasked. `bash tests/verify-agent-config.sh` (234 passed), `bash tests/check-work-folder.sh`, `.agents/hooks/shellcheck.sh repo`, `prettier --check '**/*.md'`, `scripts/verify-agent-config.sh`, and `git diff --check main` pass on the tip; the bubblewrap and python3 tests were skipped inside Claude Code's sandbox. The test "asks before a file tool edits an agent configuration file, …" fails on main. The live prompt check above was not run, since the rules take effect only from the main checkout's settings. ## Considerations Claude Code's docs do not say verbatim that `/**/` matches the project root's top level, which `Edit(/**/AGENTS.md)` needs; the live check settles it. No `UPGRADING.md` migration announces the new prompts to an upgrading repository, by the maintainer's choice.

motoko added 2 commits 2026-11-11 09:35:05 +01:00

feat(claude): ask before agent config file edits ... 059333225f

Since adb02f0 nothing asks before Claude's file tools edit the files
that configure the agents, so in bypassPermissions mode one mistaken
step or injected instruction can remove a protection that every later
session then loses. An explicit ask rule prompts in every mode, and Edit
rules cover every built-in file-editing tool, so root-anchored Edit
rules now make each edit of the policy, CLAUDE, and client files ask, in
the worktrees too. Shell writes stay with the sandbox, as before.

Closes #215
Closes #213

docs(readme): say which edits ask before they land 9249d3053e

claudiomaradonna merged commit 9249d3053e into main 2026-11-11 09:36:35 +01:00

claudiomaradonna deleted branch feat/agent-config-ask 2026-11-11 09:36:41 +01:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

claudiomaradonna/agent-foundry!216

No description provided.