Repository navigation
fix(ci): refuse a committed .claude/settings.local.json in sandbox-lint - #1692
Merged
potiuk merged 1 commit intoOct 17, 2026
Merged
Conversation
Since apache#1684 the committed .claude/settings.json is the shared floor and .claude/settings.local.json is each contributor's own layer, reconciled from the local template. The local file is gitignored but can be force-added, and a committed copy would be loaded for everyone who checks the repository out: its scalars override the floor's (`sandbox.enabled: false`), and CI lints only the floor and the template. apache#1684 dropped the step that refused committed agent settings. The workflow now runs when .claude/settings.local.json changes and fails while it is tracked, pointing the author at the floor or the template. Generated-by: Claude Opus 5
potiuk
added a commit
that referenced
this pull request
Oct 19, 2026
Hand-sync of tools/spec-loop/specs/ with the functionality that landed between 43e4c6e and ccb53a3. Specs changed: - adapters: Gmail drafting through the gmail-plaintext MCP tools, not the CLI (93051d5, #1681); the Jira CLI's explicit --deployment and the tracker backends shipped as generated plugin copies (1cf5cee, #1683); local-tracker report files and folders created 0600 / 0700 (68ec4a3, #1700). - agent-isolation-sandbox: agent-guard unwrapping env / command and refusing env -S (b00d4b5, #1691; 4aea234, #1694); the macOS touch overlay shown whether or not activation is granted (0d9c168, #1697); the sandbox-lint workflow refusing a tracked .claude/settings.local.json (51a610b, #1692) and sandbox-lint refusing the Gmail token path in allowRead (93051d5, #1681). - vetted-command-surface: the spelling guard refusing a quoted ~, the right spelling behind env / command, and other spellings of the eval wrapper (b00d4b5, #1691). - adoption-and-setup: the tracker-backend question on every first setup and the Jira label mapping and doctor gate (1cf5cee, #1683). - .last-sync bumped to ccb53a3. No spec change needed (specs already updated in the commit itself): ccb53a3, 9a8ec5f, 9955d7d, c9f34cc, 76cc6e8, 1d773a8, 16014a2. No functional change for the specs: d4b7dc3 (review-body wording), 77e8145 (test timing), 8d606d6 (eval fixtures), a04891f (the previous sync). Generated-by: Claude Opus 5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.claude/settings.jsonis the shared floor and.claude/settings.local.jsonis each contributor's own layer, reconciled fromtools/agent-isolation/claude-settings.local.template.json.sandbox.enabled: falseswitches the sandbox off..claude/settings.json, which is now tracked by design), and with it the only guard against this..claude/settings.local.jsonis added to the workflow'spull_requestandpushpath filters..asf.yamlnote listing the workflow's paths includes it.Type of change
sandbox-lintworkflow,.asf.yamlcomment)Test plan
prek run --all-filespassesNotes for reviewers
sandbox-lintworkflow ortools/sandbox-lint.sandbox_lint. That is not addressed here.Gen-AI disclosure: prepared with the assistance of Claude Code (Claude Opus 5); reviewed by the author.
🤖 Generated with Claude Code