chore(harden): commit /harden command + harden sandbox-mask git hygiene - #21
Merged
Conversation
…for sandbox masks - Add .claude/commands/harden.md (was present locally but never committed). - docs/HARDENING.md: document that a sandboxed session masks sensitive config paths as /dev/null device nodes (phantom git-status noise), and how to cope. - .gitignore: ignore machine-local settings.local.json + the unambiguous personal dotfiles the sandbox masks (NOT .mcp.json/.gitmodules/.claude/* — those can be real). - implementer.md / orchestrator.md: hard rule to stage explicit paths, never `git add -A`/`git commit -a`, so a masked device node can't abort a worker's commit. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011HosUeuSvhetARboEfDW6K
robercano
approved these changes
Jul 1, 2026
robercano-ghbot
pushed a commit
that referenced
this pull request
Jul 1, 2026
Adds a "Concurrent config-write safety" subsection to ARCHITECTURE.md → Limits: links anthropics/claude-code#29217, the probe finding (didn't repro on v2.1.153), mitigations (max_parallel_workers 2-3, no concurrent sessions, keep updated), and the residual settings.json-staging risk mitigated by the explicit-staging rule. Docs-module slice of #5; the implementer staging rule already landed in #21. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011HosUeuSvhetARboEfDW6K
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Commits the
/hardencommand and makes the template resilient to the sandbox's/dev/nullconfig masks..claude/commands/harden.md— the/hardencommand existed locally but was never committed; now it is.docs/HARDENING.md— new Caveat: a sandboxed session bind-mounts/dev/nullover sensitive paths (shell rc,.gitconfig, editor dirs,.mcp.json, Claude's.claude/{hooks,skills,routines,launch.json}). They appear as character-device files (crw-rw-rw- … 1,3) thatgit statusreports as untracked/modified though they aren't real files. Explains the two consequences (no blanketgit add; which paths are gitignored vs not)..gitignore— ignore.claude/settings.local.json+ the unambiguous personal dotfiles the sandbox masks. Deliberately not.mcp.json/.gitmodules/.claude/*(can be legit tracked files).implementer.md/orchestrator.md— hard rule: stage explicit paths, nevergit add -A/git commit -a, so a masked device node can't abort a worker's commit.Why
Every project generated from this template runs under the sandbox (
settings.jsonhassandbox.enabled: true, and/hardentightens it), so every downstream repo sees these phantom entries. Without this, a worker doinggit add -Acan fail to commit, and agents/humans waste cycles on non-existent "untracked" files. The explicit-staging rule is the robust fix; the gitignore + doc reduce the noise.Notes
🤖 Generated with Claude Code
https://claude.ai/code/session_011HosUeuSvhetARboEfDW6K