Restructure claude config into roles/ + stacks/#5
Merged
technicalpickles merged 10 commits intomainfrom Mar 26, 2026
Merged
Conversation
Merges settings.*.json + permissions.{json,personal,work}.json into
roles/base.jsonc, roles/personal.jsonc, roles/work.jsonc.
Adds sandbox scalars and base network hosts (source: agent-safehouse).
Adds Read(~/.claude/plugins/cache/**) to base allow list.
Captures allowAllUnixSockets from live settings (drift from spec).
Uses live env values for work role (model names updated since source).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Migrates permissions.beans.json, permissions.mcp.json, and permissions.skills.json into stacks/*.jsonc with nested permissions schema. No sandbox config for these stacks. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Migrates permissions.*.json into stacks/*.jsonc with new schema. Adds sandbox config (network hosts, filesystem write paths) from agent-safehouse. Creates new stacks: buildkite.jsonc, docs.jsonc. Distributes web.json WebFetch permissions to their topic stacks. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replaces flat permissions.*.json merging with roles/ + stacks/ system. Merges permissions arrays AND sandbox arrays (network hosts, filesystem write paths) from all source files. Sandbox scalars come from roles only. Local keys: model, enabledPlugins, extraKnownMarketplaces (was: awsAuthRefresh, env). awsAuthRefresh and env are now managed in roles/work.jsonc. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
These are replaced by claude/roles/ and claude/stacks/ directories. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Rewrites documentation to cover the new roles/ + stacks/ architecture, schema, merge logic, and updated common tasks. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Spec redesigns claude/ config from flat permissions.*.json files into roles/ + stacks/ directories with co-located permissions and sandbox config. Implementation plan covers file creation, claudeconfig.sh rewrite, verification, and cleanup. Also preserves model and sandbox in claudeconfig.sh local_keys as a stopgap until the refactor lands. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Plugin cache read access is skill/plugin-related, not a base safety rule. Better home in stacks/skills.jsonc. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Document why enableWeakerNetworkIsolation and allowAllUnixSockets are enabled, so future readers understand the tradeoffs. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
permissions.*.jsonfiles intoroles/+stacks/directories with co-located permissions and sandbox configclaudeconfig.shmerge logic to load roles (base + active role) then stacks, concatenating permissions and sandbox arrays separately (not deep-merging, which would replace arrays)buildkite.jsonc(CI host + bktide write path),docs.jsonc(karafka.io, lima-vm.io)Read(~/.claude/plugins/cache/**)for plugin progressive disclosureawsAuthRefresh, envtomodel, enabledPlugins, extraKnownMarketplaces(awsAuthRefresh and env now managed in roles/work.jsonc)Verification
Verified output matches pre-refactor snapshot:
Test plan
DOTPICKLES_ROLE=work ./claudeconfig.shand verify no errorsjq '.sandbox.network.allowedHosts | length' ~/.claude/settings.jsonreturns 15jq '.permissions.allow | length' ~/.claude/settings.jsonreturns 434🤖 Generated with Claude Code