[PR] feat(setup): ship the framework's agent settings as a template [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk opened a new pull request, #1671:
URL: https://github.com/apache/magpie/pull/1671

   ## Summary
   
   - **Why.** The repository committed its own `.claude/settings.json`, so every contributor's agent silently inherited the maintainers' sandbox, permission and self-adoption choices; each change to them was a repository change, and a checkout could never differ from the baseline without a dirty tree.
   - **What.** The file ships, byte for byte, as [`tools/agent-isolation/claude-settings.template.json`](tools/agent-isolation/claude-settings.template.json), and `.claude/settings.json` is gitignored. Every surface that referenced the committed file is retargeted:
     - `sandbox-lint` lints the template by default; the workflow paths, its job name and the `.asf.yaml` note follow, so the baseline stays linted in CI.
     - The pre-flight fingerprint covers the template through `tools/agent-isolation/` (the separate entry is gone; constant regenerated).
     - The fixer-hook exclusion for `.claude/settings.json` in `.pre-commit-config.yaml` is dropped — the file is no longer tracked.
     - Links and prose that meant this repository's file point at the template: threat model (M.14, M.29, X3, the review trigger), secure-agent setup and internals, spec-driven development, the write-skill security checklist, `sandbox-lint` README, and three specs.
   - **Contributor step.** CONTRIBUTING gains [Agent settings](CONTRIBUTING.md#agent-settings) (copy or merge the template; personal additions in `settings.local.json`); `setup-isolated-setup-install` gains Step T for a framework checkout; `setup-isolated-setup-verify` check 1 reports a missing copy (✗) or a missing block (⚠).
   
   Out of scope, as the issue says: the baseline's contents (unchanged), and an adopter's committed `.claude/settings.json` floor written by `adopt`.
   
   Closes #1639.
   
   ## Type of change
   
   - [x] Skill change (`setup-isolated-setup-install`, `setup-isolated-setup-verify`)
   - [ ] Tool / bridge contract
   - [x] Python package (`tools/sandbox-lint` default path and test; `setup-preflight` fingerprint sources)
   - [ ] Groovy reference impl
   - [x] Cross-cutting (sandbox baseline location, threat model)
   - [x] Documentation
   - [ ] Project template
   - [x] CI / dev loop (`sandbox-lint` workflow, `.asf.yaml`, `.pre-commit-config.yaml`, `.gitignore`)
   
   ## Test plan
   
   - [x] `prek run --all-files` passes
   - [x] `uv run sandbox-lint` — `OK (tools/agent-isolation/claude-settings.template.json matches tools/sandbox-lint/expected.json)`
   - [x] `tools/sandbox-lint` tests (270 passed, incl. the doc / allowed-domains consistency test now reading the template)
   - [x] `tools/setup-preflight` tests (252 passed); fingerprint constant regenerated
   - [ ] Eval suites for `setup-isolated-setup-install` / `-verify` — not run (prose additions only)
   
   ## Notes for reviewers
   
   - **After merge, each contributor needs a local copy once.** A clone made before this PR keeps its `.claude/settings.json` on disk (it becomes untracked and ignored); a fresh clone has none until `cp tools/agent-isolation/claude-settings.template.json .claude/settings.json`. `setup-isolated-setup-verify` flags it.
   - The template is the file the sandbox-lint baseline is compared against, so a baseline change is now a change to the template plus `tools/sandbox-lint/expected.json`.
   
   ---
   
   Gen-AI disclosure: prepared with the assistance of Claude Code (Claude Opus 5); reviewed by the author.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] feat(setup): ship the framework's agent settings as a template [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #1671:
URL: https://github.com/apache/magpie/pull/1671


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org