[potiuk]

Two commits. The first is the lint hardening that missed the #1684 merge; the second closes the gap its last review found.

1. Refuse settings that switch a control off wholesale. In any layer — committed floor, local template, or a contributor's own .claude/settings.local.json — sandbox-lint now fails on:

• an excludedCommands entry or Bash(...) allow whose command runs anything:
  • *, or a shell or interpreter by name, path or version (bash, /bin/sh, python3.12, env, source, …);
  • a leading NAME=value;
  • a script in the checkout or under a writable directory;
  • a package runner not pinned to a read-only path (uv run without --project, every other uv subcommand, uvx without --from, npx, and npm/pnpm/yarn/pipx beyond their read-only forms);
• a bare Bash allow;
• defaultMode: bypassPermissions;
• * in allowedDomains.

2. Keep the vetted-ops checkout out of the working directories. The sandbox makes every working directory (permissions.additionalDirectories, /add-dir) writable to sandboxed Bash, whatever allowWrite says. sandbox-add-project-root.sh listed ~/.claude/magpie there, and the vetted-ops exclusions run that checkout's code outside the sandbox. The entry was only there to stop Read prompts under blockReadsOutsideWorkingDirectories, which the vetted-ops commands need off anyway.

• The script no longer adds it, and removes it where an earlier version did.
• sandbox-lint counts working directories as writable, and fails on one covering the checkout.
• Doctor probe 9 reports ✗ for one (the path, any parent, ~ spellings). Verify has a new check 16f, and update treats it as a must-fix.
• Docs and specs are updated to match.

Migration: update ~/.claude/scripts/sandbox-add-project-root.sh, re-run it with --all-worktrees from each repo, and restart the agent session.

Residual risk (sandbox-lint README): the check recognises shapes, so a tool not on its lists that runs its arguments still passes (find -exec, git -c, make, …). An allowlist of command words for excludedCommands would close that and is a separate change. The environment uv builds from a pin lives in the writable uv cache or .venv.

🤖 Generated with Claude Code