feat: devcontainer環境のclaude設定を統合 - #59
Conversation
- Claude設定ファイルをDockerイメージに組み込み - 開発環境でのClaude初期設定を自動化 - commitlint.config.jsを追加（Husky用） - Supabase CLIバージョンをv2.31.8に更新 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
WalkthroughThis change updates the development container setup by introducing a default Claude settings JSON file with explicit command and web fetch permissions, adjusts the Dockerfile to copy this configuration into the container, and adds a commitlint configuration to enforce commit message standards. The Dockerfile no longer copies the commitlint config to Changes
Sequence Diagram(s)sequenceDiagram
participant DevContainer as DevContainer Build
participant Dockerfile as Dockerfile
participant Claude as Claude Settings
participant CommitLint as CommitLint
participant LocalSettings as Local Claude Settings
DevContainer->>Dockerfile: Build container
Dockerfile->>Claude: Copy claude-settings.json to /.claude/
Dockerfile->>Claude: Set ownership to vscode
DevContainer->>CommitLint: Add commitlint.config.js to project root
Note over LocalSettings: On Claude Stop Hook
LocalSettings->>Webhook: POST notification with project, task, request info
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Possibly related PRs
Poem
Note ⚡️ Unit Test Generation is now available in beta!Learn more here, or try it out under "Finishing Touches" below. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
commitlint.config.js (1)
1-9: Commit-lint rules are solid; add max-length for better UX
You already forbid empty / wrong-case subjects and empty types – great. Consider enablingheader-max-length(e.g. 100) to avoid CI rejects from overly long commit titles.'type-empty': [2, 'never'], 'scope-empty': [0], + 'header-max-length': [2, 'always', 100].devcontainer/Dockerfile (1)
41-43: Lock down permissions on the settings file after copy
The JSON contains policy data that should not be world-readable. Add a chmod in the same layer to avoid leaking it in later image stages.COPY --chown=vscode:vscode .devcontainer/claude-settings.json /home/vscode/.claude/settings.json +RUN chmod 600 /home/vscode/.claude/settings.json
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
supabase/.temp/cli-latestis excluded by!**/.temp/**
📒 Files selected for processing (3)
.devcontainer/Dockerfile(1 hunks).devcontainer/claude-settings.json(1 hunks)commitlint.config.js(1 hunks)
🧰 Additional context used
🧠 Learnings (1)
commitlint.config.js (1)
Learnt from: CR
PR: keito4/config#0
File: .cursor/rules/commit.cursorrules:0-0
Timestamp: 2025-06-25T06:37:26.200Z
Learning: Commit messages must follow the Conventional Commits format: (): , where type can be feat, fix, docs, refactor, etc.
🔇 Additional comments (2)
.devcontainer/claude-settings.json (2)
1-45: Permissions file looks valid JSON and matches Claude-Code schema
The structure is syntactically correct, keys are spelled as expected, and the allow-list granularity is clear. No blockers from a parsing standpoint.
37-43: Allow-list is very permissive – consider tightening or adding explicit denies
GrantingBash(git push:*),Bash(kubectl *:*), and generic web-fetch on github.com gives the agent power to mutate source history or prod-cluster state if mis-prompted. If the container is ever used outside an isolated playground, add a few guard-rails, e.g."deny": [ + "Bash(git push:*)", + "Bash(kubectl apply:*)", + "Bash(kubectl delete:*)" ]or move destructive commands to an opt-in “ask-first” list.
- Stopフックでn8n webhookへの通知機能を追加 - プロジェクト名を正しく設定（keito4/config） - タスク名とリクエスト詳細を環境変数から取得して通知 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.claude/settings.local.json(1 hunks)
🔇 Additional comments (1)
.claude/settings.local.json (1)
28-30: Double-check env-var collision semantics
CLAUDE_CODE_PROJECT_NAMEis now hard-wired to"keito4/config".
If the same variable can be injected from the outside (e.g., CI job or host shell), this local definition will silently shadow it, which may confuse users running the container for other forks of the repo.Confirm that this override is intentional or consider guarding it:
- "env": { - "CLAUDE_CODE_PROJECT_NAME": "keito4/config" - }, + "env": { + "CLAUDE_CODE_PROJECT_NAME": "${CLAUDE_CODE_PROJECT_NAME:-keito4/config}" + },
| "hooks": { | ||
| "Stop": [ | ||
| { | ||
| "matcher": "", | ||
| "hooks": [ | ||
| { | ||
| "type": "command", | ||
| "command": "curl -X POST http://host.docker.internal:5678/webhook/notify -H \\\"Content-Type: application/json\\\" -d '{\\\"project_name\\\":\\\"keito4/config\\\",\\\"task_name\\\":\\\"${CLAUDE_TASK}\\\",\\\"request_detail\\\":\\\"${CLAUDE_REQUEST}\\\"}'" | ||
| } | ||
| ] | ||
| } |
There was a problem hiding this comment.
Quote-handling & injection risk in Stop-hook payload
${CLAUDE_TASK} and ${CLAUDE_REQUEST} are interpolated directly into a one-liner curl command.
If either variable contains double quotes, newlines, or shell metacharacters, the JSON becomes invalid or, worse, allows command injection once the string reaches a shell.
Safer pattern: build the JSON with jq -n (or printf) and pass it to curl via stdin; this removes the need for heavy escaping and prevents shell injection.
- "command": "curl -X POST http://host.docker.internal:5678/webhook/notify -H \\\"Content-Type: application/json\\\" -d '{\\\"project_name\\\":\\\"keito4/config\\\",\\\"task_name\\\":\\\"${CLAUDE_TASK}\\\",\\\"request_detail\\\":\\\"${CLAUDE_REQUEST}\\\"}'"
+ "command": "jq -n --arg project \"${CLAUDE_CODE_PROJECT_NAME}\" --arg task \"${CLAUDE_TASK}\" --arg detail \"${CLAUDE_REQUEST}\" '{project_name:$project,task_name:$task,request_detail:$detail}' | curl -X POST -H \"Content-Type: application/json\" --data @- http://host.docker.internal:5678/webhook/notify"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "hooks": { | |
| "Stop": [ | |
| { | |
| "matcher": "", | |
| "hooks": [ | |
| { | |
| "type": "command", | |
| "command": "curl -X POST http://host.docker.internal:5678/webhook/notify -H \\\"Content-Type: application/json\\\" -d '{\\\"project_name\\\":\\\"keito4/config\\\",\\\"task_name\\\":\\\"${CLAUDE_TASK}\\\",\\\"request_detail\\\":\\\"${CLAUDE_REQUEST}\\\"}'" | |
| } | |
| ] | |
| } | |
| "hooks": { | |
| "Stop": [ | |
| { | |
| "matcher": "", | |
| "hooks": [ | |
| { | |
| "type": "command", | |
| "command": "jq -n --arg project \"${CLAUDE_CODE_PROJECT_NAME}\" --arg task \"${CLAUDE_TASK}\" --arg detail \"${CLAUDE_REQUEST}\" '{project_name:$project,task_name:$task,request_detail:$detail}' | curl -X POST -H \"Content-Type: application/json\" --data @- http://host.docker.internal:5678/webhook/notify" | |
| } | |
| ] | |
| } |
🤖 Prompt for AI Agents
In .claude/settings.local.json around lines 31 to 41, the Stop-hook curl command
directly interpolates ${CLAUDE_TASK} and ${CLAUDE_REQUEST} into a JSON string,
risking invalid JSON or shell injection if these variables contain quotes or
special characters. To fix this, refactor the command to build the JSON payload
safely using a tool like jq -n or printf, then pass the JSON to curl via stdin
instead of embedding it inline. This avoids complex escaping and prevents
injection vulnerabilities.
1 participant
🤖 Generated with Claude Code
Summary by CodeRabbit