Sandbox allowWrite includes cth-hook.cjs and session settings.json
Maintainers usually reply within 2 days
@agentvivekkumar is already working on this.
Since Oct 10, 2026.
Assessment
This issue has not been assessed yet.
Description
Summary
sandboxWritableDirs() returns the agent directory, the hive root, and any extra directories. hookSettings() copies that list into sandbox.filesystem.allowWrite.
<hive>/bin/cth-hook.cjs is under the hive root. <agent dir>/settings.json is under the agent directory. Both are inside the write list.
harnessGuard.ts checks Write, Edit, MultiEdit, and NotebookEdit. It does not judge a shell command. This issue does not claim that editing the hook removes an OS sandbox the process has already loaded.
Why this matters
The hook file is run from disk on the next tool call. The settings file holds the sandbox rules for the next start.
Evidence
sandboxWritableDirs()andhookSettings()insrc/main/hive.tsisPlumbing()insrc/main/harnessGuard.tstest/auto-mode-sandbox.test.cjs, which currently expects the hive root onallowWrite
Change
Remove bin/cth-hook.cjs and settings.json from every agent write path.
Keep write access for protocol files:
inbox/andoutbox/memory/inbox.mdmemory/handoff.mdtasks.jsonboard.mdfor Michael
ALLOW_TEMP_WORKERS is false, so spawn-requests/ is not required in this build.
Do not treat a move of settings.json into private/ as done until Claude can still read --settings. private/ is on the deny-read list.
Test plan
-
allowWriteincludes the protocol paths above. - For Michael,
allowWriteincludesboard.md. -
allowWritedoes not includebin/cth-hook.cjs. -
allowWritedoes not includesettings.json. - An agent can still move a message to
inbox/.done.
Checkout: main at 0ef922bac25d6aad226243c72a0a7f142cfacfec.
- Dominant language
- TypeScript
- Stars
- 273
- Forks
- 211
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 359
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from agentvivekkumar/dontbemichael
-
Windows: a hidden Claude call cannot start when the CLI path has a spacePossibly taken @theshloksschauhan claimed this 13 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
agentvivekkumar/dontbemichael#426 ·
Maintainers usually reply within 2 days
-
Raise Home and Manager setup text to the 14px floorPossibly taken @glenmiracle18 claimed this 13 days ago. Openbug os:windows
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
agentvivekkumar/dontbemichael#416 · 2 comments ·
Maintainers usually reply within 2 days
-
Difficulty 5/5 Over a week Newbie friendliness 28/100
agentvivekkumar/dontbemichael#607 · 1 comment ·
Maintainers usually reply within 2 days
-
The router's loop guard never fires: nothing counts hopsPossibly taken @Vanshika25developer claimed this 6 days ago. Openos:linux
Difficulty 3/5 1-2 days Newbie friendliness 25/100
agentvivekkumar/dontbemichael#605 · 3 comments ·
Maintainers usually reply within 2 days
-
Give Fable a tier and a pricePossibly taken @sahibsiddiqui claimed this 6 days ago. Openenhancement
Difficulty 2/5 1-3 hours Newbie friendliness 15/100
agentvivekkumar/dontbemichael#556 ·
Maintainers usually reply within 2 days
All issues in agentvivekkumar/dontbemichael
Similar issues
-
[Bug]: Pen taps on sidebar rows start a drag and lose their clickPossibly taken @makhnatkin claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
Maintainers usually reply within 1 day
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
b310-digital/teammapper#1515 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 79/100
puckeditor/puck#1884 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
outline/outline#14378 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
nicobailon/pi-web-access#642 ·
Maintainers usually reply within 1 day