dot

commit 3fe01b54772d6008b2e198c4cf939126d371ded1
parent 8259ae8d8f12254aafb984c735877b3a74cc95a9
Author: Chris <chris@echoz.io>
Date:   Thu, 25 Jun 2026 15:52:41 +0200

feat(claude): exclude some commands from sandbox

Diffstat:
M
modules/claude/default.nix
 | 
15
+++++++++++++--

1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/modules/claude/default.nix b/modules/claude/default.nix
@@ -24,15 +24,26 @@
         settings = {
           permissions = {
             allow = [
-              "Read(//nix/store*)"
+              "Read(//nix/store/*)"
             ];
           };
           sandbox = {
             enabled = true;
+            excludedCommands = [
+              "nix *"
+              "gh *"
+              "git push"
+              "git push *"
+              "git pull"
+              "git pull *"
+              "git commit *"
+              "git fetch"
+              "git fetch *"
+            ];
             filesystem = {
               denyRead = [ "/" ];
               allowRead = [
-                "/nix/store"
+                "/nix"
                 "/run/current-system"
               ];
             };