[Kaap10]

Summary

Closes #1952.

On a Claude Code secure setup (sandbox enabled, ~/ in denyRead), write operations through the write dispatcher (vetted-op) failed before starting:

uv run --project ~/.claude/magpie/vetted-ops vetted-op --caller pr-management-triage workflow-approve <run-id>
error: Project directory `/Users/<you>/.claude/magpie/vetted-ops` does not exist

As diagnosed in #1952, vetted-op-read and vetted-op-tracker work because they are declared in sandbox.excludedCommands. In contrast, vetted-op was omitted from sandbox.excludedCommands, causing it to run inside the sandbox where:

1. It cannot access ~/.claude/magpie/vetted-ops under denyRead.
2. Even if granted read access, child gh CLI commands fail with macOS Seatbelt TLS certificate errors (x509: OSStatus -26276).

This PR excludes vetted-op from sandbox.excludedCommands in both uv run --project and uvx --from launcher forms, mirroring vetted-op-tracker. vetted-op remains strictly gated under permissions.ask (never allow), preserving the human-in-the-loop confirmation requirement for remote mutations.

Changes

1. tools/sandbox-lint/src/sandbox_lint/__init__.py:

   • Added uv run --project ~/.claude/magpie/vetted-ops vetted-op * and uvx --from ~/.claude/magpie/vetted-ops vetted-op * to EXCLUDED_COMMAND_ALLOWLIST.

2. .claude/settings.json and tools/sandbox-lint/expected.json:

   • Added both vetted-op launcher forms to sandbox.excludedCommands.
   • Added both vetted-op launcher forms to permissions.ask.

3. tools/sandbox-lint/tests/test_validator.py:

   • Replaced test_baseline_never_excludes_the_vetted_op_write_dispatcher with test_baseline_excludes_and_asks_the_vetted_op_write_dispatcher, verifying that both launcher forms are present in sandbox.excludedCommands and permissions.ask, and absent from permissions.allow.

4. Documentation and Skill Checks:

   • Synchronized docs/setup/secure-agent-setup.md, tools/vetted-ops/README.md, tools/sandbox-lint/README.md, tools/spec-loop/specs/agent-isolation-sandbox.md, tools/spec-loop/specs/vetted-command-surface.md, step-v-vetted-ops.md, conditional-checks.md, and vetted-ops-drift.md to document that vetted-op runs outside the sandbox while remaining under permissions.ask.

Verification

• uv run python -m pytest tools/sandbox-lint/tests/test_validator.py -k vetted_op: 26 passed.
• uv run python -m pytest tools/sandbox-lint/tests/test_validator.py -k "test_baseline_file_matches_live_settings or test_baseline_satisfies_invariants or test_live_settings_satisfy_invariants": 3 passed (0 diffs between live settings and baseline expected.json).
• sandbox-lint --settings .claude/settings.json --expected tools/sandbox-lint/expected.json: OK.
• uv run python -m pytest plugins/magpie-setup: 31 passed, 7 skipped.
• prek run mixed-line-ending trailing-whitespace end-of-file-fixer typos: all passed with LF line endings.

Generated-by: Claude Code

[Kaap10]

Closing in favor of maintainer PR #1956, which covers the sandbox exclusion and also addresses the --config write bound and threat model updates.