From 6af2fba183d2d0b5de2df3e1c1f7c72f03bfcc8f Mon Sep 17 00:00:00 2001 From: bob Date: Sat, 23 May 2026 18:26:08 -0400 Subject: [PATCH] feat(defaults): promote skillOverrides + autoMode.hard_deny to active defaults MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to PR #56's unblock batch. Two of the eight opt-ins shipped as stubs in that PR are now active defaults, based on a per-key review against the configurator's existing safety/efficiency goals. The other six stay stubbed for genuine reasons (user-workflow choice, infrastructure-dependent, or would break shipped scripts). Promoted: - skillOverrides: "name-only" → active in templates/token-efficiency/settings-patch.tier-pro.json (renders only when token-efficiency.tier=pro). Extends the pro tier's existing "aggressive context efficiency" contract by collapsing skill descriptions — the largest single contributor to per-turn context overhead, the metric /check-context flags. Model still sees skill names. basic tier unaffected. Personas affected: solo-experienced, small-team. Override by editing the patch. - autoMode.hard_deny: ["Running executable files", "Writing to system directories"] → active in templates/safety/settings-patch.json. Pure upside: zero behavior change for standard manual sessions (auto-mode classifier doesn't fire without --auto-mode), meaningful safety backstop for --auto-mode users. Consistent with the configurator's existing safety-first posture (disableBypassPermissionsMode, PreToolUse Bash blocking, scan-secrets, slop-scan). All non-custom personas affected. Tune via the patch. No tested_up_to bump (stays 2.1.150 from PR #56). No new tests required — schema validation + persona snapshots + 50+ shell fixtures all pass. Retrofit impact: existing users on cc-configure --retrofit will gain a top-level autoMode block (all non-custom personas) and, for pro-tier users, a top-level skillOverrides: "name-only". Both are no-ops in common workflows. Co-Authored-By: Claude Opus 4.7 --- CHANGELOG.md | 20 +++++++++++++ templates/safety/settings-patch.json | 29 +++++++++---------- .../settings-patch.tier-pro.json | 4 +-- 3 files changed, 35 insertions(+), 18 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f6afe34..c6fffc8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,26 @@ All notable changes to this project. Format: [Keep a Changelog](https://keepacha ## Unreleased +### feat(defaults): promote skillOverrides + autoMode.hard_deny to active defaults + +Follow-up to the #5706 unblock batch: two of the eight opt-ins shipped as stubs in that PR are now active defaults, based on a per-key review against the configurator's existing safety/efficiency goals. The other six stay stubbed for genuine reasons (user-workflow choice, infrastructure-dependent, or would break the shipped scripts). + +**Promoted to active:** + +- **`skillOverrides: "name-only"`** is now active in `templates/token-efficiency/settings-patch.tier-pro.json` (renders only when `token-efficiency.tier=pro`). The pro tier already signals "user wants aggressive context efficiency" — this extends that contract by collapsing skill descriptions (the largest single contributor to per-turn context overhead, exactly the metric `/check-context` flags). Model still sees skill names and can invoke them; only the descriptions are trimmed. `basic` tier is unaffected. Personas: `solo-experienced` + `small-team` get it (both use pro); `solo-newer` + `library-author` + `custom` do not. Override to `"off"` / `"user-invocable-only"` / unset by editing the patch if `"name-only"` is too aggressive for your skill set. +- **`autoMode.hard_deny: ["Running executable files", "Writing to system directories"]`** is now active in `templates/safety/settings-patch.json`. Pure upside: zero behavior change for standard manual sessions (the auto-mode classifier doesn't fire without `--auto-mode`), meaningful safety backstop for users who do run with `--auto-mode`. Consistent with the configurator's existing safety-first posture (`disableBypassPermissionsMode: disable`, PreToolUse Bash blocking, scan-secrets, slop-scan). Renders for all non-custom personas (every non-custom persona includes the `safety` module). Tune or remove entries by editing the patch if the example categories don't match your project's threat model. + +**Stubbed opt-ins kept as stubs** (with rationale): + +- `worktree.baseRef` (multi-agent) — `"fresh"` vs `"head"` is a genuine workflow preference, no persona signal distinguishes +- `worktree.bgIsolation` (multi-agent) — stub value matches CC's default, so writing active is a no-op; stub provides discoverability of the lever (and future-proofs if CC flips its default again like it did with `baseRef` between 2.1.128/2.1.133) +- `sandbox.failIfUnavailable` (safety) — fail-closed aligns with safety goals but breaks users on platforms where `bwrap`/`socat` aren't easily installable (esp. macOS); proper fix is a future `safety.sandbox_strict` flag +- `subagentStatusLine` (ui) — shipped `statusline.sh` doesn't handle the `--subagent` flag; promotable once the script learns it +- `statusLine.hideVimModeIndicator` (ui) — shipped `statusline.sh` doesn't render vim mode; active default would just remove vim display entirely for vim users (strict downgrade); promotable once the script learns vim mode +- `CLAUDE_CODE_STOP_HOOK_BLOCK_CAP` (safety) — no shipped Stop hook actually blocks repeatedly, so raising the cap adds noise without benefit by default; only useful for user-authored strict-blocking hooks + +**For existing users on `cc-configure --retrofit`:** the merged `.claude/settings.json` will gain a top-level `autoMode` block (all non-custom personas) and, for pro-tier users (`solo-experienced` and `small-team`), a top-level `skillOverrides: "name-only"`. Both are no-ops in common workflows: `autoMode.hard_deny` only fires under `--auto-mode`, and `skillOverrides: "name-only"` preserves all `/`-menu access while trimming descriptions the user typically doesn't read. Test plan covers per-persona rendering. No `tested_up_to` bump (stays 2.1.150 from the prior PR). + ### chore(compat): bump tested_up_to to 2.1.150 + ship eight schema-validated opt-ins after SchemaStore PR #5706 merge [SchemaStore PR #5706](https://github.com/SchemaStore/schemastore/pull/5706) merged 2026-05-23, syncing `claude-code-settings.json` to Claude Code v2.1.143 and unblocking nine settings keys (+ five env vars) that had been held in the configurator's backlog through three prior CHANGELOG resurveys. This PR ships all of them as commented-out opt-ins so users can uncomment to activate, matching the established pattern from PRs #17 (`prUrlTemplate`) and #18 (`sandbox.network.deniedDomains`). Bumps `tested_up_to` 2.1.132 → 2.1.150 (covers the 18 CC releases since the last bump, including the 2.1.147–2.1.150 resurvey that found only one new configurator-adjacent key — `allowAllClaudeAiMcps`, 2.1.149 — Enterprise managed setting, outside configurator territory). Closes tracking issue #53. diff --git a/templates/safety/settings-patch.json b/templates/safety/settings-patch.json index fc0c6a0..ff2502c 100644 --- a/templates/safety/settings-patch.json +++ b/templates/safety/settings-patch.json @@ -1,14 +1,17 @@ { - "//": "Merged into .claude/settings.json. PreToolUse hooks guard dangerous Bash and scan Write/Edit for secrets.", - "//2": "permissions.disableBypassPermissionsMode='disable' hard-disables --dangerously-skip-permissions for this project, even if the user passes the flag.", - "//3": "Optional opt-in: sandbox.network.deniedDomains (CC 2.1.113+, schemastore-validated 2026-04-28).", - "//4": "Only takes effect when the sandbox is otherwise active for the command (see sandboxing docs).", - "//5": "Supports wildcards (*.example.com). Below is a small data-exfiltration-resistant baseline; tune for your threat model.", - "//6": "Inside the // sandbox block: failIfUnavailable (CC 2.1.143+, schemastore-validated 2026-05-23) makes sandbox startup a hard failure when required dependencies are missing, instead of falling back to non-sandboxed execution. Fail-closed posture for safety-sensitive projects — uncomment the inner '// failIfUnavailable: true' line after uncommenting the outer block.", - "//7": "Optional: autoMode.hard_deny (CC 2.1.136+, schemastore-validated 2026-05-23). Classifier rules that block unconditionally regardless of user intent or allow exceptions — final guardrail when running with auto mode. Edit the strings to match the action categories you want to hard-block. Only meaningful if you run `claude --auto-mode`.", - "//8": "Optional: env CLAUDE_CODE_STOP_HOOK_BLOCK_CAP (CC 2.1.143+) overrides the default 8-block cap for consecutive Stop hook blocks. Raise this only if a safety Stop hook intentionally blocks repeatedly and you want to tolerate it without the cap kicking in.", - "//9": "Hook authoring note (CC 2.1.139+, schemastore-validated 2026-05-23): hookCommand entries now accept 'args: string[]' for direct-exec form (no shell, no quote-escaping pain) and 'continueOnBlock: boolean' for prompt hooks (default false; when true, ok:false feeds the reason back to Claude and the turn continues instead of stopping). Use these on custom hooks you add below.", - "//10": "Uncomment any opt-in by removing the leading '// ' on its key, then drop the explainer //N keys.", + "//": "Merged into .claude/settings.json. PreToolUse hooks guard dangerous Bash and scan Write/Edit for secrets. permissions.disableBypassPermissionsMode='disable' hard-disables --dangerously-skip-permissions for this project, even if the user passes the flag.", + "//2": "autoMode.hard_deny (CC 2.1.136+, schemastore-validated 2026-05-23) is on by default with two reasonable category blocks. The classifier only fires under `claude --auto-mode`, so this is a no-op for standard manual sessions — pure upside for auto-mode users. Tune the strings or remove entries to match your project's threat model.", + "//3": "Optional opt-in: sandbox.network.deniedDomains (CC 2.1.113+, schemastore-validated 2026-04-28). Only takes effect when the sandbox is otherwise active for the command (see sandboxing docs). Supports wildcards (*.example.com); the // sandbox block below has a small data-exfiltration-resistant baseline — tune for your threat model.", + "//4": "Inside the // sandbox block: failIfUnavailable (CC 2.1.143+, schemastore-validated 2026-05-23) makes sandbox startup a hard failure when required dependencies are missing instead of falling back to non-sandboxed execution. Fail-closed posture for safety-sensitive projects — uncomment the inner '// failIfUnavailable: true' line after uncommenting the outer block.", + "//5": "Optional: env CLAUDE_CODE_STOP_HOOK_BLOCK_CAP (CC 2.1.143+) overrides the default 8-block cap for consecutive Stop hook blocks. Raise only if a safety Stop hook intentionally blocks repeatedly and you want to tolerate it without the cap kicking in.", + "//6": "Hook authoring note (CC 2.1.139+, schemastore-validated 2026-05-23): hookCommand entries now accept 'args: string[]' for direct-exec form (no shell, no quote-escaping pain) and 'continueOnBlock: boolean' for prompt hooks (default false; when true, ok:false feeds the reason back to Claude and the turn continues instead of stopping). Use these on custom hooks you add below.", + "//7": "Uncomment any opt-in by removing the leading '// ' on its key, then drop the explainer //N keys.", + "autoMode": { + "hard_deny": [ + "Running executable files", + "Writing to system directories" + ] + }, "// sandbox": { "network": { "deniedDomains": [ @@ -26,12 +29,6 @@ }, "// failIfUnavailable": true }, - "// autoMode": { - "hard_deny": [ - "Running executable files", - "Writing to system directories" - ] - }, "// env": { "CLAUDE_CODE_STOP_HOOK_BLOCK_CAP": "16" }, diff --git a/templates/token-efficiency/settings-patch.tier-pro.json b/templates/token-efficiency/settings-patch.tier-pro.json index 4c45b0b..d855978 100644 --- a/templates/token-efficiency/settings-patch.tier-pro.json +++ b/templates/token-efficiency/settings-patch.tier-pro.json @@ -1,6 +1,6 @@ { - "//": "Optional: skillOverrides (CC 2.1.129+, schemastore-validated 2026-05-23). Suppresses skill visibility/descriptions to reduce context overhead — the metric /check-context flags. Values: 'off' (hides from model AND /-menu), 'user-invocable-only' (hides from model, /-menu still works), 'name-only' (collapses description to just the skill name). 'name-only' is the conservative default; pick 'user-invocable-only' if you only ever invoke skills explicitly. Uncomment the next line by removing the leading '// '.", - "// skillOverrides": "name-only", + "//": "skillOverrides (CC 2.1.129+) is set to 'name-only' by default in the pro tier: the model sees skill names but not descriptions, cutting the largest contributor to per-turn context overhead (the metric /check-context flags). Other values: 'off' (hides from model AND /-menu — too aggressive for most), 'user-invocable-only' (hides from model only, you keep /-menu access). Override here if 'name-only' is too aggressive for your skill set.", + "skillOverrides": "name-only", "env": { "CLAUDE_BASH_MAX_LINES": "80" },