Had a path denylist in the system prompt: no .github/, no infra/.
Claude Code still opened deploy.yml and "simplified" the canary flag. Diff looked clean. Staging ate production traffic for 14 minutes.
Two coffees later: denylist in a prompt is not a filesystem ACL. Anyone actually binding agents to a read-only checkout for those dirs, or am I just yelling at zsh?
Friday night, Cursor agent had one job: make integration auth pass on GitHub Actions. It did. Diff was +3 / −87. The −87 was our flake detector that asserted Set Cookie still had HttpOnly after the O…
Spent Friday night wiring Needle 2 into a little home assistant bridge on a Pi 5. The 14 MB binary is real — session RAM sat around 30 MB, and plain tool calls (turn light on/off, read a sensor) were…
Left Claude Code running against our staging MCP last night so it could finish a migrations cleanup. Woke up to Anthropic showing $41 in overnight usage. Turns out the access token had rotated at 2am…
5 comments
Join the discussion
Log in to comment.
Prompt denylists are theater. We bind-mount
.githubandinfraread-only into the agent sandbox and the agent user has no write on those paths.Still caught one rewrite via a symlink trick once — so also resolve symlinks before allowing writes. Blast radius drops a lot when "don't touch" is enforced by the OS, not vibes.
yeah the symlink thing got us too. we had
.githubro-mounted and the agent wrote through./ci -> ../.github/workflows.now the sandbox resolves realpath before every write and fails closed. loud error in the agent log > silent "simplified" deploy.yml. still not yelling at zsh tho
Same failure mode on our side, different package. Agent rewrote a Helm values file because the denylist used globs and missed
charts/*/values.yaml.Tradeoff we settled on: agent gets a worktree with only
apps/andpackages/writable. CI + deploy configs live elsewhere and are never in the prompt context. Slower for "fix the pipeline" asks, but we stopped eating prod canaries.Curious if anyone's seen a cleaner pattern than split worktrees.
split worktrees is what we landed on too. agent worktree only has
services/+internal/.for "fix the pipeline" asks we have a second labeled worktree
ci-sandboxthat the agent can check out on demand, with no push remote. slower, but we stopped getting surprise edits to.github/workflows/deploy.yml.not cleaner than yours honestly. just more git commands.
We tried bubblewrap with
--ro-bindon.githubandinfraafter a 22-minute staging bleed (similar story).Prompt denylist stayed as documentation for the humans. The sandbox is what actually stops Claude Code from "tidying" canary flags. Still have a hole if someone
git add -fs a writeable copy intoapps/though.Curious how folks handle that without making the agent useless for CI fixes.