new(bin/install-claude-permissions.sh): allow-list the toolkit's safe wrappers in .claude/settings.json - #83
Merged
Conversation
… wrappers in .claude/settings.json mxcli init seeds Bash(./mxcli:*) but nothing for bin/exec.sh, the other installed bin/*.sh scripts, this toolkit's own bin/*.sh run by absolute path, or mx under ~/.mxcli/mxbuild/*/modeler/mx -- every skill and CLAUDE.md tells an agent to run the model through the SAFE wrapper instead, so every one of those calls raised a Claude Code permission prompt, silently defeating bin/exec-approval.sh --set auto. Same merge pattern as install-claude-hooks.sh (Python via lib/portable.sh's require_py, backup before write, merge never overwrite). --check reports what's missing without writing; --uninstall removes only the entries this script itself added (tracked in a sidecar file), so a pre-existing Bash(./mxcli:*) from mxcli init is never touched either way. Rule syntax verified against the Claude Code permissions docs before picking the patterns. Wired into init-project.sh (scaffold time, non-fatal) and sync-project.sh (--check, reported as a stale-wiring finding). New fixture tests/wave2/test-install-claude-permissions.sh (26/26): fresh project, merge into a real captured mxcli init settings.json, idempotent re-run, --check naming, --uninstall leaving pre-existing entries alone. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
…ow-rules # Conflicts: # CHANGELOG.md
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Base of a two-PR stack. The follow-up (exec approval defaults to
auto, per-harness auto-run, stale-toolkit-clone warning) lands on top of this branch.Direct lane
What changed and why (one paragraph):
mxcli initseeds<project>/.claude/settings.jsonwithBash(./mxcli:*), but every skill and stamped instruction file in this toolkit tells the agent to run the model through the safe wrapperbin/exec.sh(snapshot first, mxbuild after, auto-restore on failure) instead. Neither that wrapper, the other installedbin/*.shscripts, the toolkit's ownbin/*.shrun by absolute path, normxunder~/.mxcli/mxbuild/*/modeler/mxwere ever allow-listed, so every exec through the safe path raised a harness permission prompt, which defeatedbin/exec-approval.sh --set auto(that knob decides whether the agent asks; it has no say over whether the harness prompts). Newbin/install-claude-permissions.sh <project> [--check|--uninstall]merges the fixed allow-list intopermissions.allow(idempotent, backup first, never touchesdeny, never addsBash(*), tracks what it added so--uninstallremoves only that).bin/init-project.shruns it at scaffold time;bin/sync-project.shruns--checkand reports missing entries without writing, since writing settings.json under a live session would race it. Rule syntax verified against the Claude Code permissions docs and cited in the header.Field evidence: run against a fresh scratch project scaffolded by
init-project.shin this session: 11 entries added,--checkafterwards reports all present. The fixture's "existing settings.json" input is a verbatim capture of whatmxcli initwrites (2026-09-16), not hand-typed.install-claude-hooks.shuses,check-portability.shcleanrender-routing.sh --checkpasses at 79,975 / 80,000)CHANGELOG.mdline appended in this PR, crediting the source project or person (CI-checked)## BUG-DRAFT-<slug>:— n/aChecks run (verbatim counts):
check-scripts.sh77/77 shell + 20/20 node ·check-portability.shclean (129 files) ·LEAKGUARD_ALLOW_NO_DENYLIST=1 check-no-client-data.shclean (549 files) ·check-pr-discipline.sh origin/masterclean ·render-routing.sh --checkin sync · newtests/wave2/test-install-claude-permissions.shPASS=26 FAIL=0.Known follow-up already scoped into the stacked PR: the two entries carrying the absolute toolkit-root path move to
.claude/settings.local.json(untracked, per-machine) so no home-directory path lands in a tracked project file.🤖 Generated with Claude Code
https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw
Generated by Claude Code