Point Claude runs at path-scoped rules and nested memory

[ppXD]

Summary

• Pointer rules. Three kinds of memory never reach the model under the pin:

  • a rule scoped by paths: (no --add-dir loads it);
  • nested memory past the in-place budget (it is not added);
  • memory loaded in place, for an Explore or Plan subagent, which the CLI starts without project memory.

  The pinned 2.1.263 still attaches a user rule under CLAUDE_CONFIG_DIR/rules whose paths: match a file its Read tool opens, in subagents too. Each build therefore writes rules/codespace-repository-NNN.md (ClaudeWorkspaceMemory.Pointers.cs):

  • one per scoped repository rule, its globs rebased onto the cwd with gitignore anchoring (ClaudeRuleScope.Rebase);
  • one per nested directory that holds memory, globbed /<dir>. Past the budget its sentence says the memory was not preloaded; in place, it says to read the memory only if it is not already in context.

• No repository byte in the config home.

  • A pointer is runner text: absolute paths of [A-Za-z0-9._+-/] in backticks, never an @, and globs re-emitted from a safe set.
  • A memory file with an unsafe name is left out of its directory's pointer alone, with a notice.
  • Every pointer is read back through the port of the CLI's frontmatter parse and dropped unless that gives exactly the globs written. A glob holding ---, for example from {-,b}--x, is refused there.

• Bounds.

  • Each pointer is at most 4 KiB, naming its directory's memory files while they fit and counting the rest.
  • All pointers together are at most 128 KiB; at most 128 pointers are written and 128 directories checked.
  • The directory a pointer points into passes the same guard, on the same per-build budget.
  • The walk continues past the in-place budget to find every scoped rule and every directory to point at.

Test plan

• Unit: the full suite passes (12050 passed, 1 skipped). New cases:
  • a 10000-rule directory's pointer stays under 4 KiB and counts the rest;
  • three 6300-rule directories with 922-byte paths keep the spec inside the launch frame (NativeLaunchProtocol.FitsTheFrame);
  • the 128 KiB total and its notice;
  • an unsafe rule name left out alone;
  • a primary-repository rule linked into the sibling gets no pointer;
  • a frontmatter longer than 4 KiB still gets its pointer;
  • {-,b}--x refused by the read-back;
  • 128 directories of chain links checked within the build budget, shared or not;
  • in-place directories pointed at;
  • bounds pinned (Rule 8).
• Unit, mutations: each of these turns at least one case red:
  • naming every file;
  • no total bound;
  • an unsafe name refusing the whole pointer;
  • read-back off;
  • no in-place pointers;
  • a fresh budget per directory.
• Integration (Postgres): RealHarnessWorkspaceMemoryTests 7/7. The large-tree arm now has pkg-out/CLAUDE.md linked outside: it gets no pointer and one notice. With the pointer guard off, the arm fails.
• E2E on macOS, real Claude 2.1.263 and Codex 0.142.2: RepositoryConfigE2ETests 14/14. The workflow's repository-config gate, run against the TRX, prints All 14 repository-config E2E cases and 14 markers ran and passed.
  • The differential corpus adds gen/, src/**/** and a frontmatter past 4 KiB. It now requires one pointer per scoped rule, none for the ** rule, and none in the first request. Each of these fails it:
    • anchoring on a trailing slash;
    • dropping the /** doubling;
    • reading a lone ** as scoped;
    • classifying from the head only.
  • The over-budget arm adds two directories under /etc, where bwrap binds them: one whose CLAUDE.md links outside, one whose scoped rule imports an outside file. Reads below them attach nothing, the launch names both, and no outside text reaches a request. With the pointer guard off, the arm fails.
  • An_explore_subagent_is_pointed_at_nested_memory_loaded_in_place: unpinned, the CLI attaches pkg/CLAUDE.md to an Explore subagent's read below pkg/. Pinned, the subagent never sees the in-place memory, and its read attaches the pointer. With in-place pointers off, the arm fails.
  • ScriptedModelUpstream gains a subagent script and an opt-in classifier verdict, so plan mode lets Explore start.
  • The nested-in-place arms require three pointers per repository and none in the first request.
• Review bench:
  • 128 small directories of chain links: 38.2 s → 0.5 s;
  • 128 directories naming 16000 imports: 59.1 s → 2.1 s, with the budget notice;
  • three 6300-rule directories: spec JSON 17.7 MB → 20 KB, largest pointer 4034 bytes.
• CI root sandbox lane: floor 107, new marker nested-subagent-pointer claude-code single-repo Confined; the gate now prints its counts from the tuples it checks
• CI non-root lane: 19 arms, marker [repo-config-e2e] ran non-root scoped-rule-pointer claude-code single-repo Standard uid=1654