[codex] harden Claude one-command setup#73
Draft
oleg-bk wants to merge 7 commits into
Draft
Conversation
Add a bounded Claude Code PreToolUse adapter over the existing policy and evidence vocabulary. The adapter denies unknown shell composition and records digest-only workspace metadata while leaving installer and approval UX for later slices. Implemented with assistance from Codex.
Add project-local Claude Code hook install, status, and uninstall commands over the S1 hook adapter. The setup path preserves unrelated settings, reports advisory/protected status without stale evidence overclaim, and keeps native deny output actionable with a generic redirect instruction. Implemented with assistance from Codex.
Allow Claude PreToolUse calls to the AgentVeil MCP server through to the proxy approval boundary instead of double-blocking the controlled route. Native mutations and non-AgentVeil MCP servers remain governed by the hook. Implemented with assistance from Codex.
Document the G4 payload-drift diagnosis with tests: changed content keeps the same resource but changes payload hash, exact retries stay stable for identical payloads, and similar grants remain payload-agnostic. This rejects a broad similar-scope fix for filesystem writes without changing approval behavior. Implemented with assistance from Codex.
Add public-safe Claude Code connector scope documentation with current lower-level setup, target one-command UX, bounded evidence language, and explicit project-local limitations. Implemented with assistance from Codex.
Add setup claude-code orchestration over proxy init, Claude MCP route setup, project hook install, and managed local Approval Center lifecycle. The setup status path reports hook, MCP route, proxy route, and Approval Center state without counting config success as live user-path proof. Remove stops only AgentVeil-managed entries and the managed center. Implemented with assistance from Codex.
Add macOS folder selection for Claude setup, keep controlled writes rooted in the selected project by default, and ensure setup-managed approval centers are health-checked through the live approval page without browser spam. Prefer the invoked agentveil-mcp-proxy executable when writing project MCP config so live tests do not accidentally route through an older global install. Implemented with assistance from Codex.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds and hardens the public Claude Code project-local connector path for
agentveil-mcp-proxy.The public value is intentionally narrow: Claude asks before changing files in a configured project. Native Claude Code mutations are blocked before they run, Claude can retry through the AgentVeil-managed MCP write path, risky writes require approval, and bounded evidence is recorded locally.
What changed
setup claude-code --choose-folder --yesfor macOS project-folder selection.setup claude-code --yesfor terminal users already inside a project.agentveil-mcp-proxyexecutable, avoiding stale global installs.Validation
9 passed4 passedgit diff --check: clean/private/tmp/agentveil-mcp-proxy-dist-cd66f94Writeblocked;write_file;config.py;setup statusreportedprotected;Scope / No-overclaim
This PR is a public minimal connector path only. It does not claim host-wide control, all-terminal coverage,
claude --barecoverage, manual edit coverage, hosted custody, team policy packs, or private guided remediation.Product Guard gates