feat: add-exclude-commands

[yxtay]

Summary by CodeRabbit

• Bug Fixes
  • Updated sandbox restrictions to block Docker, Git, and SSH commands.
  • Removed the sandbox’s filesystem write allowance for improved protection.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 57d37404-3864-46f8-b467-3f81b843b9d5

📥 Commits

Reviewing files that changed from the base of the PR and between ec227a1 and fae2c3c.

📒 Files selected for processing (1)

• chezmoi/.chezmoitemplates/claude-settings.json

---

📝 Walkthrough

Walkthrough

The Claude settings template broadens sandbox command exclusions to include Docker, Git, and SSH commands, while removing the previous filesystem write allowance.

Changes

Claude sandbox configuration

Layer / File(s)	Summary
Sandbox command and filesystem restrictions chezmoi/.chezmoitemplates/claude-settings.json	The sandbox excludes docker *, git *, and ssh *, and no longer defines filesystem.allowWrite.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• yxtay/dotfiles#862: Modifies the same Claude sandbox configuration and related command/filesystem restrictions.

Poem

A rabbit hops through sandbox walls,
Where Docker, Git, and SSH calls fall.
Write paths vanish, commands stay tight,
The settings now guard day and night.
Tippy-tap—what a tidy change!

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/add-exclude-commands

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request updates the Claude settings template to add "git *" and "ssh *" to the list of excluded commands in the sandbox configuration. However, the changes also accidentally removed the entire "filesystem" configuration block, which would prevent Claude from writing to specified directories. The reviewer recommends restoring this block to avoid breaking tools and integrations.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The filesystem configuration block under sandbox was completely removed in this change. This appears to be an accidental deletion, as the PR title only mentions adding excluded commands. Removing this block will prevent Claude from writing to these directories, which may break various tools and integrations. Please restore the filesystem block.

    "excludedCommands": ["docker *", "git *", "ssh *"],
    "filesystem": {
      "allowWrite": [
        "~/.cache",
        "~/.cargo/registry",
        "~/.gradle",
        "~/.local/lib",
        "~/.local/share/uv",
        "~/.m2",
        "~/.mempalace",
        "~/.memsearch",
        "~/.npm",
        "~/.yarn",
        "~/Library/Caches",
        "~/Library/Python",
        "~/Library/pnpm",
        "~/go/pkg",
        "~/wiki"
      ]
    }