Any Read() deny rule makes Claude Code resolve the file operands of every
Bash command that reads files. A path it cannot resolve, such as one that
follows a cd into a directory the analyzer does not track, escalates to a
permission prompt even under bypassPermissions. A plain recursive grep in
the repo root escalates too, because it could reach .env.
Drop the read rules and widen the write rules to cover the same files, so
secrets still cannot be written through Edit, Write, or a shell redirect.
Reads of those files are no longer blocked.
Claude-Session: https://claude.ai/code/session_01RNCupPk2yewQT1JMNjkV8M
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: auto-allow scratch file ops confined to /tmp
The /tmp entries in .claude/settings.json used a `Bash(cmd:/tmp/*)` form, but
the colon is only meaningful as a trailing `:*` wildcard — each was matched as
a literal command string no invocation produces, so mkdir, cp, mv, touch,
chmod, tar and unzip all prompted despite the rules being present.
mkdir and touch become working prefix rules. The rest move to a PreToolUse
hook, which is required for mv and chmod (both sit in the `ask` list, which
outranks any allow rule) and preferable for cp/tar/unzip: a prefix rule can
only constrain the first operand, so `cp /tmp/x ~/.zshrc` would match a
`cp /tmp/` prefix. The hook instead requires every path operand to resolve
under /tmp, which also keeps it from becoming a way around the
`Read(**/.env)` deny rules by copying a project file into readable scratch.
tar and unzip get a separate parser: their destination arrives as a flag value
(`-C`, `-d`) and a bundle like `-xzf` consumes the following token. Flags are
an allowlist, so `-P`/`--absolute-names`, which disable tar's refusal to
extract `..` and absolute member paths, defer rather than needing enumeration.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: close three symlink and prefix-rule escapes in the /tmp hook
Review findings on the previous commit, all three genuine:
Drop the `Bash(mkdir|touch /tmp/:*)` allow rules. A prefix rule constrains
only the first operand, so they accepted `mkdir /tmp/../etc/evil` and
`touch /tmp/a ~/.bashrc` — the hook already deferred both, but an allow rule
grants the call before the hook's silence can matter. They were also
redundant: the hook covers mkdir and touch on its own.
Refuse globs outright. Bash expands them only after the hook has decided, so
realpath saw the unexpanded pattern: `chmod 600 /tmp/link*` canonicalized to
itself, passed, then expanded onto a symlink pointing outside /tmp, and chmod
follows command-line symlinks. guard-rm-outside-tmp.sh can allow globs under
/tmp because `rm` unlinks a symlink rather than following it; every command
here follows one instead.
Make options a per-command allowlist. Generic acceptance let `cp -RL` through,
which dereferences while recursing and so copies the content of a symlink
target outside /tmp into a scratch dir that `Read(/tmp/**)` exposes — the same
deny-rule bypass the every-operand rule exists to prevent. Plain `-r` and `-a`
recreate such a symlink as a symlink and stay allowed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: require absolute operands so option words cannot pose as /tmp paths
Both remaining escapes shared a root cause: a token the tool reads as an
option was validated as a path, because resolving it against the cwd made any
bare word look safe whenever that cwd was under /tmp. `tar P -xf /tmp/a.tar
-C /tmp/out` checked out as /tmp/P while tar read P as --absolute-names, and
`cp /tmp/tree -RL /tmp/out` checked out as /tmp/-RL while cp read -RL as
dereferencing recursion.
Accept only absolute operands, which removes the class rather than the two
instances. Also apply the option allowlist at every position, since GNU utils
permute and recognize options after operands.
`unzip -l` no longer requires a destination; listing extracts nothing.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: drop a contradictory comment and stop treating unzip -v as extraction
The sentence justifying the old before-first-operand option check outlived the
check itself, leaving the file asserting both that and the all-position rule
that replaced it. Only the second is true.
`unzip -v` is a verbose listing and writes nothing, so it no longer requires an
extraction destination.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: allow /tmp rm and read-only gmail in local permission rules
* fix: gate rm outside /tmp via PreToolUse hook and gate gmail drafts
* fix: reject shell expansion and multi-line commands in rm guard
* fix: make rm guard allow-only with Bash(rm:*) ask as safety net
* fix: reject quotes and backslashes in rm guard to block obscured traversal
* fix: switch rm guard to deny-by-default whitelist of safe /tmp operands
* fix: treat lone dash as rm operand, not an option flag
* fix: defer option tokens containing glob chars in rm guard
* feat: also auto-allow rm strictly inside git working trees under $HOME
* feat: auto-allow deleting linked worktree root folders, still guard primary checkouts
* fix: restrict globs to /tmp and validate post-operand option tokens in rm guard
* docs: correct rm guard rationale to not overclaim git recoverability
- guard-main-branch.sh: exit 2 on block (was advisory echo), and block
force-push to main from any branch (--force, -f, --force-with-lease, +ref)
- settings.json: gate claude.ai MCP connectors (Stripe, Gmail, Calendar,
Drive, Slack, Linear) behind permissions.ask
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore: narrow secret-file Read deny rule to dotfiles/extensions
* feat(vault): configurable JWT auth mount path and fix setup docs
* chore: bump ee-repo-ref for vault jwt mount path
* chore: bump ee-repo-ref after rebase onto EE main
* chore: update ee-repo-ref to a1cd60b54e8595b4e5ce6b654e675e4bbe2253b2
This commit updates the EE repository reference after PR #567 was merged in windmill-ee-private.
Previous ee-repo-ref: c274f233a0ebb54afa296c3db15ff330e1baebcf
New ee-repo-ref: a1cd60b54e8595b4e5ce6b654e675e4bbe2253b2
Automated by sync-ee-ref workflow.
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
* chore: remove wm-cursor, add local-review skill, update PR skill for EE
- Remove the unused wm-cursor script and all references to it in
README_WORKMUX_DEV.md and worktree-common.sh
- Add /local-review skill for code review (bugs + CLAUDE.md compliance)
- Add EE companion PR workflow to the /pr skill
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: add wm-ts-nav tree-sitter navigator and fix format hooks
- Add wm-ts-nav: standalone tree-sitter code navigator with SQLite index
for fast symbol search, definition lookup, and file outlines across
Rust, TypeScript, and Svelte files (~12ms warm, ~1s cold for 482 files)
- Fix format hooks: surface errors instead of swallowing with 2>/dev/null,
use direct prettier path with svelte plugin, add success feedback
- Add wm-ts-nav commands to settings allow list
- Document wm-ts-nav usage in CLAUDE.md
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(wm-ts-nav): add refs command and --parent filter
- refs: find usages of a symbol in code, skipping comments and strings
(tree-sitter AST walk, ~46ms for 482 files vs grep's 4ms but no noise)
- --parent filter on search: find all methods on a type across all files
(e.g. search "%" --kind function --parent ServiceName)
- Update CLAUDE.md with clearer when-to-use guidance
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(wm-ts-nav): index refs in DB with import-path resolution
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(wm-ts-nav): add body, callers, callees commands and refs --file/--caller
- body: extract a symbol's source code from disk using indexed line ranges
- callers: cross-file call graph via SQL join of refs + symbols tables
- callees: list all identifiers referenced within a symbol's body
- refs --file: scope results to files matching a substring
- refs --caller: annotate each ref with the containing function name
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(wm-ts-nav): add auto-rebuilding wrapper script
The `wm-ts-nav/nav` wrapper checks if source files are newer than the
binary and rebuilds automatically. Invoked via `sh wm-ts-nav/nav` to
avoid needing executable permissions after clone.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: tighten CLAUDE.md nav section for actionable guidance
Remove redundant question→command mapping, latency numbers, and
excessive examples. Lead with "prefer wm-ts-nav over Read to save
context window" and keep only the patterns that change behavior.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: revert backend/Cargo.lock to main
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: promote wm-ts-nav in workflow, copy binary to worktrees
- CLAUDE.md: integrate wm-ts-nav into Workflow step 1 and Core
Principles so agents use outline/body before full file reads
- workmux: copy built binary via files.copy
- worktree-common.sh: copy binary in wm_copy_dependencies for webmux
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(wm-ts-nav): fix double indexing, add TSX grammar, remove needless clone
- Reuse index stats from the pre-query update instead of indexing twice
on the Index command
- Add Lang::Tsx variant so .tsx/.jsx files use LANGUAGE_TSX instead of
LANGUAGE_TYPESCRIPT (Svelte stays on TS since script blocks are pure TS)
- Remove source.clone() for non-Svelte files — move directly instead
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(wm-ts-nav): fix svelte line numbers, add class methods, innermost caller
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: optionally enable rust-analyzer plugin in worktree settings
When USE_RUST_PLUGIN env var is set, the worktree-env script now includes
the rust-analyzer-lsp plugin in .claude/settings.local.json.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: remove rust-analyzer plugin from default settings
The rust-analyzer plugin is now opt-in via USE_RUST_PLUGIN env var
in worktree-env, so it no longer needs to be in the shared settings.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: add WM_CLONE_DB and USE_RUST_PLUGIN to wmdev startup envs
Defaults both to false so they can be toggled per-worktree.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: use explicit truthy checks for WM_CLONE_DB and USE_RUST_PLUGIN
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add Claude Code hooks for formatting and notifications
- Add PostToolUse hooks to auto-format files after Edit/Write:
- format-frontend.sh: runs prettier on frontend files
- format-backend.sh: runs rustfmt on backend Rust files
- Add Notification hook to alert user when Claude needs input
- Add edition=2021 to rustfmt.toml for proper parsing
- Update .gitignore for symlinked cache directories
- Add additional bash permissions for cargo check and npm scripts
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* remove echo
* notification when in ssh as well
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* better claude
* refactor: remove seed parameter from AI chat completions
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Ruben FiszelandClaude Opus 5
hugocasaandClaude Opus 4.7
centdixandClaude Opus 4.6