chore: harvest stable doc domains and align codex/gemini CLI allows

[keito4]

Why

直近 active リポ走査で繰り返し参照されていた安定ドキュメントドメインと、config が公式採用済み（codex-review / gemini-review skill）の CLI 許可が共有 settings.json に取り込まれておらず、.devcontainer 設定とのドリフトも生じていた。

What

.claude/settings.json

• WebFetch: registry.terraform.io / pub.dev / docs.doppler.com / services.gradle.org（モバイル・IaC・secret ツールチェーンの公式 doc 先）
• Bash: codex / gemini / devcontainer — codex/gemini レビュー skill を公式採用済みなのに allow が local 止まりだった。.devcontainer/claude-settings.json には既に存在しており parity を回復

.devcontainer/claude-settings.json

• WebFetch ドメインが skills.sh 以降未追従だったため上記5件を追加し settings.json と整合

Risk

低。すべて読み取り/参照系の allow 追加のみ。deny/ask ポリシーは無変更。

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated configuration files to enable integration with additional development tools and service providers.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR expands Claude's external access permissions across two configuration files by allowlisting additional domains for web requests and new command patterns for Bash execution. The changes enable new tool integrations for Terraform, Dart, Doppler, Gradle, and specialized Claude commands.

Changes

Claude Permissions Expansion

Layer / File(s)	Summary
Expand external domain access and command execution permissions .claude/settings.json, .devcontainer/claude-settings.json	Main settings adds four domains (registry.terraform.io, pub.dev, docs.doppler.com, services.gradle.org) to WebFetch allowlist, three Bash command patterns (codex:*, gemini:*, devcontainer:*) to Bash allowlist. Devcontainer settings adds five domains (skills.sh, registry.terraform.io, pub.dev, docs.doppler.com, services.gradle.org) to WebFetch allowlist.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• keito4/config#453: Updates Claude DevContainer permissions allowlist by adding new WebFetch(...) and Bash(...) entries.
• keito4/config#312: Expands Claude permissions allowlist in .devcontainer/claude-settings.json with new WebFetch domains and Bash command patterns.
• keito4/config#197: Updates Claude permission allowlist in .devcontainer/claude-settings.json by adding new WebFetch domains and Bash command patterns.

Suggested labels

size/XS

Poem

🐰 New domains and commands spring to light,
Devcontainers ready to take flight,
Terraform, Dart, and Doppler too,
Claude's permissions expand anew!
Registry calls and Gradle's way—
A config feast for development's day! 🌱

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: adding stable documentation domains and aligning CLI allowlist entries across configuration files.
Description check	✅ Passed	The description covers most required sections (Why, What, Risk), but is missing explicit testing instructions and a pre-merge checklist as specified in the template.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/harvest-domains-and-cli-allows

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[claude]

Claude finished @keito4's task in 1m 5s —— View job

---

コードレビュー結果

• コンテキスト収集
• 変更ファイルの精査（.claude/settings.json / .devcontainer/claude-settings.json）
• セキュリティ・整合性チェック
• レビューフィードバック投稿

---

総評: ✅ APPROVE

変更はすべて読み取り/参照系の allow 追加のみ。deny/ask ポリシーは無変更。セキュリティリスクは低く、目的（parity 回復）に対して正確に実装されています。

---

5観点レビュー

観点	評価	詳細
Security	✅	全て読み取り専用 WebFetch または既知 CLI ツール。破壊的操作なし
Performance	✅	設定ファイル変更のみ。N/A
Quality	✅	変更は最小限・目的通り。既存エントリのグループ順序に一致
Accessibility	✅	N/A
AI Residuals	✅	なし

---

個別確認

.claude/settings.json — WebFetch 追加（4件）

• registry.terraform.io — Terraform 公式プロバイダ/モジュールドキュメント ✅
• pub.dev — Dart/Flutter 公式パッケージレジストリ ✅
• docs.doppler.com — Doppler 公式ドキュメント ✅
• services.gradle.org — Gradle サービスエンドポイント ✅（後述）

.claude/settings.json — Bash 追加（3件）

• Bash(codex:*) — .devcontainer/claude-settings.json:144 に既存。parity 回復 ✅
• Bash(gemini:*) — .devcontainer/claude-settings.json:145 に既存。parity 回復 ✅
• Bash(devcontainer:*) — .devcontainer/claude-settings.json:147 に既存。parity 回復 ✅

.devcontainer/claude-settings.json — WebFetch 追加（5件）

• skills.sh + 上記 4 件を追加し settings.json と整合 ✅

---

Recommendation（verdict への影響なし）

1. services.gradle.org の分類について

PR 説明では「公式 doc 先」と記述されていますが、services.gradle.org は Gradle の toolchain ダウンロード・Build Scan 送信に使われるサービスエンドポイントです（ドキュメントは docs.gradle.org）。WebFetch は読み取りのみなので実害はありませんが、将来的にドキュメント参照が目的なら docs.gradle.org を追加することも検討できます。

2. devcontainer 側に残る未追従エントリ

parity の完全化を目指すなら、.devcontainer/claude-settings.json のみに存在する以下のエントリも settings.json 側へ追加する余地があります：

"Bash(timeout * gemini:*)"  // .devcontainer:146
"Bash(code:*)"              // .devcontainer:148 (VS Code CLI)

今回の PR スコープ外のため必須ではありませんが、次回の parity 整合時に検討ください。

---

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.claude/settings.json:
- Around line 25-28: Replace the over-broad Gradle distribution host entry
"WebFetch(domain:services.gradle.org)" with the documentation host
"WebFetch(domain:docs.gradle.org)"; update the JSON entry where
"WebFetch(domain:services.gradle.org)" appears (and the mirrored entry in the
devcontainer settings if present) so the allowlist targets docs.gradle.org
instead of services.gradle.org to limit access to the user manual rather than
distribution endpoints.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: fbc66ff7-2e87-4a44-b18d-387c46e68760

📥 Commits

Reviewing files that changed from the base of the PR and between fd65d98 and ab4ff04.

📒 Files selected for processing (2)

• .claude/settings.json
• .devcontainer/claude-settings.json

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Use the Gradle docs host here, not the distribution service.

The PR frames these additions as stable documentation domains, but services.gradle.org is Gradle’s distributions/version endpoint, while the user manual is hosted on docs.gradle.org. That broadens WebFetch beyond documentation content, and the mirrored entry in .devcontainer/claude-settings.json repeats the same over-permissioning. Consider allowlisting WebFetch(domain:docs.gradle.org) instead. (services.gradle.org)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.claude/settings.json around lines 25 - 28, Replace the over-broad Gradle
distribution host entry "WebFetch(domain:services.gradle.org)" with the
documentation host "WebFetch(domain:docs.gradle.org)"; update the JSON entry
where "WebFetch(domain:services.gradle.org)" appears (and the mirrored entry in
the devcontainer settings if present) so the allowlist targets docs.gradle.org
instead of services.gradle.org to limit access to the user manual rather than
distribution endpoints.

[github-actions]

🎉 This PR is included in version 1.114.2 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀