feat(claude): add safety-net plugin from cc-marketplace - #512
Conversation
- Add safety-net@cc-marketplace to enabled plugins - Add known_marketplaces.json with cc-marketplace registry - Configure Nix to manage marketplace configuration 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
📝 WalkthroughSummary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings. WalkthroughThis PR introduces Claude plugin marketplace configuration by adding a new Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello @shunkakinoki, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request integrates the Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
Mesa DescriptionTL;DRAdded the What changed?
Description generated by Mesa. Update settings |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds the safety-net plugin from a custom marketplace to the Claude Code configuration. The changes are well-structured, introducing a known_marketplaces.json file managed by Nix to define the custom marketplace, and then enabling the plugin in settings.json. This is a good approach for managing custom plugins. I have one suggestion to improve the consistency of the marketplace definitions.
| "source": { | ||
| "source": "git", | ||
| "url": "https://github.com/kenryu42/cc-marketplace.git" | ||
| } |
There was a problem hiding this comment.
For consistency with other marketplace definitions in this file, such as claude-plugins-official and anthropic-agent-skills, consider using the github source type instead of git. This would make the configuration more uniform and easier to read. The github source type is likely a shorthand for public GitHub repositories and should work for this marketplace as well.
| "source": { | |
| "source": "git", | |
| "url": "https://github.com/kenryu42/cc-marketplace.git" | |
| } | |
| "source": { | |
| "source": "github", | |
| "repo": "kenryu42/cc-marketplace" | |
| } |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
![mesa-dot-dev[bot]](https://avatars.githubusercontent.com/in/1050077?s=60&v=4){kind=small}
There was a problem hiding this comment.
Performed full review of 9d4a240...61d894d
Analysis
-
Supply Chain Security Risk: The PR introduces a third-party marketplace (cc-marketplace from github.com/kenryu42) without proper security vetting, verification of the maintainer's trustworthiness, or documentation explaining why this external source is necessary.
-
Non-Deterministic Configuration: The git URL references a default branch without pinning to a specific commit or tag, violating Nix's deterministic build philosophy and potentially pulling different plugin versions at different times.
-
Redundant Configuration: The known_marketplaces.json file duplicates built-in marketplace definitions that are already provided by Claude Code, creating unnecessary maintenance overhead and potential for configuration drift.
Tip
Help
Slash Commands:
/review- Request a full code review/review latest- Review only changes since the last review/describe- Generate PR description. This will update the PR body or issue comment depending on your configuration/help- Get help with Mesa commands and configuration options
0 files reviewed | 2 comments | Edit Agent Settings • Read Docs
| @@ -0,0 +1,26 @@ | |||
| { | |||
| "claude-code-plugins": { | |||
There was a problem hiding this comment.
This file appears to duplicate built-in marketplace definitions. Lines 2-19 define 'claude-code-plugins', 'claude-plugins-official', and 'anthropic-agent-skills' which are likely already known to Claude Code internally. According to the comment in default.nix (line 27), Claude Code 'will merge with built-in ones', suggesting these duplicated definitions may be unnecessary. Consider removing the built-in marketplace definitions and only defining the custom 'cc-marketplace' to reduce maintenance burden and potential for configuration drift.
Agent: 🏛 Architecture •
Prompt for Agent
Task: Address review feedback left on GitHub.
Repository: shunkakinoki/dotfiles#512
File: config/claude/known_marketplaces.json#L2
Action: Open this file location in your editor, inspect the highlighted code, and resolve the issue described below.
Feedback:
This file appears to duplicate built-in marketplace definitions. Lines 2-19 define 'claude-code-plugins', 'claude-plugins-official', and 'anthropic-agent-skills' which are likely already known to Claude Code internally. According to the comment in default.nix (line 27), Claude Code 'will merge with built-in ones', suggesting these duplicated definitions may be unnecessary. Consider removing the built-in marketplace definitions and only defining the custom 'cc-marketplace' to reduce maintenance burden and potential for configuration drift.
| }, | ||
| "cc-marketplace": { | ||
| "source": { | ||
| "source": "git", |
There was a problem hiding this comment.
The git URL for cc-marketplace should be pinned to a specific commit SHA or tag for reproducibility and security. Using the default branch means the plugin behavior could change unexpectedly between builds. Consider using a format like: "url": "https://github.com/kenryu42/cc-marketplace.git", "ref": "" to ensure deterministic builds, which aligns with Nix philosophy.
Agent: 🏛 Architecture •
Prompt for Agent
Task: Address review feedback left on GitHub.
Repository: shunkakinoki/dotfiles#512
File: config/claude/known_marketplaces.json#L22
Action: Open this file location in your editor, inspect the highlighted code, and resolve the issue described below.
Feedback:
The git URL for cc-marketplace should be pinned to a specific commit SHA or tag for reproducibility and security. Using the default branch means the plugin behavior could change unexpectedly between builds. Consider using a format like: "url": "https://github.com/kenryu42/cc-marketplace.git", "ref": "<commit-sha>" to ensure deterministic builds, which aligns with Nix philosophy.
There was a problem hiding this comment.
Pull request overview
This PR adds the safety-net plugin from the custom cc-marketplace to the Claude Code configuration to prevent destructive git and filesystem commands during development.
- Enables the
safety-net@cc-marketplaceplugin in Claude settings - Creates a
known_marketplaces.jsonfile to register the cc-marketplace custom plugin source - Configures Nix to deploy the marketplace registry file to the Claude plugins directory
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| config/claude/settings.json | Adds the safety-net plugin from cc-marketplace to the enabled plugins list |
| config/claude/known_marketplaces.json | Defines the cc-marketplace plugin source along with other known marketplaces (claude-code-plugins, claude-plugins-official, anthropic-agent-skills) |
| config/claude/default.nix | Configures Nix home-manager to deploy the known_marketplaces.json file to ~/.claude/plugins/ |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (4)
config/claude/known_marketplaces.json (2)
1-26: Add ES5 trailing commas for consistency.Per coding guidelines, JSON files should use ES5 trailing commas. Add trailing commas after lines 6, 12, 18, and 24.
♻️ Proposed fix
{ "claude-code-plugins": { "source": { "source": "git", "url": "https://github.com/anthropics/claude-code.git" } - }, + }, "claude-plugins-official": { "source": { "source": "github", "repo": "anthropics/claude-plugins-official" } - }, + }, "anthropic-agent-skills": { "source": { "source": "github", "repo": "anthropics/skills" } - }, + }, "cc-marketplace": { "source": { "source": "git", "url": "https://github.com/kenryu42/cc-marketplace.git" } - } + } }
1-26: Consider sorting marketplace keys alphabetically.For improved maintainability, the coding guidelines recommend alphabetically sorting keys in configuration files. The current order is: claude-code-plugins, claude-plugins-official, anthropic-agent-skills, cc-marketplace. Alphabetically, they should be: anthropic-agent-skills, cc-marketplace, claude-code-plugins, claude-plugins-official.
config/claude/default.nix (2)
27-29: Add documentation for the marketplace configuration.Per learnings, complex Nix configurations should be documented with comments. Add a comment explaining the purpose of the known_marketplaces.json configuration and its relationship to the safety-net plugin.
Based on learnings, document all major changes in Nix configurations.
📝 Proposed fix
+ # Claude plugin marketplace configuration + # Defines known plugin sources including cc-marketplace for safety-net plugin home.file.".claude/plugins/known_marketplaces.json" = { source = ./known_marketplaces.json; };
27-29: Consider sorting home.file entries alphabetically.Per coding guidelines, attribute sets in Nix files should be sorted alphabetically. The new
.claude/plugins/known_marketplaces.jsonentry should be placed before.claude/pushover.shto maintain alphabetical order.
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (3)
config/claude/default.nixconfig/claude/known_marketplaces.jsonconfig/claude/settings.json
🧰 Additional context used
📓 Path-based instructions (6)
**/*.{js,ts,jsx,tsx,json}
📄 CodeRabbit inference engine (CLAUDE.md)
Use Biome with 2-space indentation, 80-character line width, double quotes, and trailing commas (ES5) for JSON/JavaScript/TypeScript files
Files:
config/claude/settings.jsonconfig/claude/known_marketplaces.json
**/*.{json,yaml,yml,toml}
📄 CodeRabbit inference engine (.cursor/rules/formatting.mdc)
**/*.{json,yaml,yml,toml}: Use consistent indentation (2 spaces) in configuration files
Sort keys alphabetically when possible in configuration files
Use clear, descriptive names in configuration files
Files:
config/claude/settings.jsonconfig/claude/known_marketplaces.json
**/*.{js,jsx,ts,tsx,json}
📄 CodeRabbit inference engine (.cursor/rules/formatting.mdc)
**/*.{js,jsx,ts,tsx,json}: Format JavaScript/TypeScript/JSON files using Biome with 2-space indentation and 80 character line width
Enable Biome linter with recommended rules for JavaScript/TypeScript/JSON files
Files:
config/claude/settings.jsonconfig/claude/known_marketplaces.json
**/*.{js,jsx,ts,tsx,json,jsonc,md}
📄 CodeRabbit inference engine (.cursor/rules/general.mdc)
Use Biome for code formatting as configured in biome.json
Files:
config/claude/settings.jsonconfig/claude/known_marketplaces.json
**/*.nix
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.nix: Use nixfmt for formatting all Nix files
Document complex configurations with comments in Nix files
**/*.nix: Use 2 spaces for indentation in Nix files
Keep line length under 100 characters in Nix files
Sort attribute sets alphabetically in Nix files
Use consistent spacing around operators in Nix files
Format lists and sets consistently in Nix filesUse treefmt.toml for formatting Nix files
**/*.nix: UsemkOptionfor configurable options in Nix modules
Implement proper typing for all options in Nix modules
Follow the Nix expression language style guide
Files:
config/claude/default.nix
**/default.nix
📄 CodeRabbit inference engine (CLAUDE.md)
Use
default.nixfiles for module exports
Files:
config/claude/default.nix
🧠 Learnings (3)
📚 Learning: 2025-11-25T09:34:40.062Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/general.mdc:0-0
Timestamp: 2025-11-25T09:34:40.062Z
Learning: Document all major changes in Nix configurations
Applied to files:
config/claude/default.nix
📚 Learning: 2025-11-25T09:34:55.014Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/home-manager.mdc:0-0
Timestamp: 2025-11-25T09:34:55.014Z
Learning: Applies to home-manager/**/*.nix : Document all configuration options in Nix modules and programs
Applied to files:
config/claude/default.nix
📚 Learning: 2025-11-25T09:34:23.224Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-25T09:34:23.224Z
Learning: Applies to **/*.nix : Document complex configurations with comments in Nix files
Applied to files:
config/claude/default.nix
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (13)
- GitHub Check: shell-test
- GitHub Check: shell-lint
- GitHub Check: lua-neovim-test
- GitHub Check: lua-hammerspoon
- GitHub Check: lua-neovim
- GitHub Check: e2e-run (NixOS, ubuntu-latest)
- GitHub Check: e2e-run (Ubuntu, ubuntu-latest)
- GitHub Check: e2e-run (MacOS, macos-latest)
- GitHub Check: docker-build-push (linux/amd64, amd64, ubuntu-latest)
- GitHub Check: docker-build-push (linux/arm64, arm64, ubuntu-24.04-arm)
- GitHub Check: nix-nixos
- GitHub Check: nix-linux
- GitHub Check: nix-darwin
🔇 Additional comments (2)
config/claude/settings.json (1)
12-13: LGTM with verification needed.The safety-net plugin is correctly added to the enabledPlugins list with proper formatting and alphabetical ordering. The trailing comma on line 12 correctly follows ES5 conventions.
However, verify that the safety-net plugin provides the intended protection against destructive git and filesystem commands, and that it works in conjunction with the existing permissions deny list (lines 79-86).
config/claude/known_marketplaces.json (1)
20-25: Repository is accessible and properly configured.The cc-marketplace repository (https://github.com/kenryu42/cc-marketplace.git) is publicly accessible (HTTP 200), and the safety-net plugin is correctly referenced in config/claude/settings.json as "safety-net@cc-marketplace": true. The marketplace is properly registered in known_marketplaces.json.
Summary
safety-net@cc-marketplaceplugin to Claude Code configurationknown_marketplaces.jsonto manage custom marketplace registry via NixTest plan
make switchto apply configuration🤖 Generated with Claude Code
Summary by cubic
Enable the safety-net plugin in Claude Code to block destructive git and filesystem actions during development. Adds a Nix-managed custom marketplace registry to source the plugin from cc-marketplace.
New Features
Migration
Written for commit 2d5da24. Summary will update on new commits.