@mmerterden/multi-agent-pipeline 20.2.1 → 20.3.1

package/install/claude.mjs

@@ -47,6 +47,22 @@ import { registerMcpServer } from "./_mcp-register.mjs";
  * Kept so installs can migrate it and uninstall can clean it.
  */
 export const LEGACY_PRE_COMMIT_MATCHER = "Bash(git commit:*)";
+export const AGENT_GUARD_FILE_MATCHER = "Edit|Write|NotebookEdit";
+// WebFetch and the toolkit's tools reach hosts with no Bash hook to see them:
+// the web_* tools directly, agent_run_steps by dispatching them, and the
+// ios_/android_open_url tools through the device browser. The guard registers
+// on every toolkit tool name and applies the network host policy. A matcher
+// with `_` and `*` in it is a regex over the tool name.
+export const AGENT_GUARD_WEB_MATCHER = "WebFetch|mcp__multi-agent-toolkit__.*";
+// The web-tools-only matcher an older install wrote; migrated in place.
+export const LEGACY_AGENT_GUARD_WEB_MATCHER = "WebFetch|mcp__multi-agent-toolkit__web_.*";
+// The guard's internal deadline is 5 s; the hook timeout must exceed it so the
+// guard prints its verdict rather than the harness cutting it off first.
+const AGENT_GUARD_TIMEOUT = 10;
+// A Bash guard entry must match the tool name "Bash" (or a whole-Bash glob), not
+// a `Bash(...)` command filter - that only ever matches the command string a
+// hook never sees, so the guard would never fire.
+const isBareBashMatcher = (m) => ["Bash", "Bash(*)", "Bash(:*)", "Bash(**)"].includes(String(m));
 
 /**
  * The only skills installed locally on Claude Code. Everything else reaches
@@ -723,25 +739,50 @@ export function configureSettings(home) {
     }
 
     // agent-guard.sh: the second load-bearing gate - blocks AI/assistant
-    // attribution in commit messages and force-push to a protected branch.
-    // Like pre-commit-check.sh it self-filters on the Bash command via stdin
-    // JSON, so the matcher is the tool name "Bash". Wired by default (was
-    // previously opt-in via the setup template, leaving force-push and
-    // attribution unguarded on a plain install).
-    const isAgentGuardEntry = (h) =>
+    // attribution in commit messages and force-push to a protected branch,
+    // and, only under MULTI_AGENT_UNATTENDED=1, outward writes, installs and
+    // writes into protected paths. It reads the tool name from stdin, so one
+    // script serves two matchers: "Bash" for commands and
+    // "Edit|Write|NotebookEdit" for file edits. Without the variable the
+    // file-edit entry allows every call.
+    const isGuardEntry = (h) =>
       Array.isArray(h.hooks) &&
       h.hooks.some(
         (sub) => typeof sub.command === "string" && sub.command.includes("agent-guard.sh"),
       );
-    if (!settings.hooks.PreToolUse.some(isAgentGuardEntry)) {
+    // Migrate a guard entry written under a `Bash(...)` command filter (which
+    // never fires) to the bare "Bash" tool-name matcher, in place.
+    for (const h of settings.hooks.PreToolUse) {
+      if (!isGuardEntry(h)) continue;
+      const m = String(h.matcher || "");
+      if (m !== "Bash" && (isBareBashMatcher(m) || m.startsWith("Bash("))) {
+        h.matcher = "Bash";
+        settingsChanged = true;
+      }
+      if (m === LEGACY_AGENT_GUARD_WEB_MATCHER) {
+        h.matcher = AGENT_GUARD_WEB_MATCHER;
+        settingsChanged = true;
+      }
+    }
+    const guardMatchers = [
+      ["Bash", "Checking commit/push safety (attribution + force-push)..."],
+      [AGENT_GUARD_FILE_MATCHER, "Checking the edit target..."],
+      [AGENT_GUARD_WEB_MATCHER, "Checking the fetch host..."],
+    ];
+    for (const [matcher, statusMessage] of guardMatchers) {
+      const present = settings.hooks.PreToolUse.some(
+        (h) =>
+          (matcher === "Bash" ? h.matcher === "Bash" : h.matcher === matcher) && isGuardEntry(h),
+      );
+      if (present) continue;
       settings.hooks.PreToolUse.push({
-        matcher: "Bash",
+        matcher,
         hooks: [
           {
             type: "command",
             command: "bash $HOME/.claude/scripts/agent-guard.sh",
-            timeout: 10,
-            statusMessage: "Checking commit/push safety (attribution + force-push)...",
+            timeout: AGENT_GUARD_TIMEOUT,
+            statusMessage,
           },
         ],
       });

package/install/codex.mjs

@@ -40,6 +40,7 @@ import {
   pluginsToDeliver,
 } from "./_plugin-skills.mjs";
 import {
+  copyExternalNotices,
   partitionExternalSkillsByPlugins,
   writeExternalSkillsManifest,
 } from "./_platform-filter.mjs";
@@ -426,6 +427,7 @@ function installSkillRefs(pipelineSrc, dest, home, platformFlag) {
     for (const name of keep) {
       count += copyTreeRewritten(join(externalSrc, name), join(dest, name));
     }
+    count += copyExternalNotices(externalSrc, dest);
     writeExternalSkillsManifest(dest, keep);
     console.log(
       `    -> stack filter (${selectionSource}): ${keep.length} kept, ${skipped.length} skipped`,

package/install/copilot.mjs

@@ -28,6 +28,7 @@ import {
 } from "./_common.mjs";
 import {
   EXTERNAL_SKILLS_MANIFEST,
+  copyExternalNotices,
   partitionExternalSkillsByPlugins,
   writeExternalSkillsManifest,
 } from "./_platform-filter.mjs";
@@ -428,6 +429,7 @@ function installSkills(opts) {
       copyDir(src, dst, { useSymlinks });
       copilotSkillCount += countFiles(src);
     }
+    copilotSkillCount += copyExternalNotices(sharedExternalSrc, dest);
     // Stale prune: a skill delivered by a previous, wider stack selection must
     // leave when the selection narrows, or the old stack lingers forever. Scope:
     // only dirs the previous manifest names (delivered by us), or - on a

package/install/index.mjs

@@ -21,6 +21,7 @@ import { installCodex } from "./codex.mjs";
 import { setDryRun, writeFile } from "./_common.mjs";
 import { sendInstallTelemetry } from "./_telemetry.mjs";
 import { applyUnattendedProfile, describeUnattendedProfile } from "./_unattended-profile.mjs";
+import { unattendedSettingsPath } from "../pipeline/lib/unattended-settings-location.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 /** Repository root (one level above install/). */
@@ -44,11 +45,9 @@ export async function runInstall(argv) {
     process.exit(3);
   }
 
-  const HOME = process.env.HOME || process.env.USERPROFILE;
+  const HOME = process.env.HOME;
   if (!HOME) {
-    console.error(
-      "Error: $HOME (or $USERPROFILE on Windows) is not set. Cannot determine installation directory.",
-    );
+    console.error("Error: $HOME is not set. Cannot determine installation directory.");
     process.exit(1);
   }
 
@@ -65,6 +64,7 @@ export async function runInstall(argv) {
     "--dry-run",
     "--prune-external",
     "--unattended",
+    "--unattended-sandbox",
   ];
   const KNOWN_PREFIXES = ["--platform="];
   const unknown = flags.filter(
@@ -93,7 +93,7 @@ export async function runInstall(argv) {
   const useSymlinks = flags.includes("--link");
   const indexOnly = flags.includes("--index-only");
   const pruneExternal = flags.includes("--prune-external");
-  const unattended = flags.includes("--unattended");
+  const unattended = flags.includes("--unattended") || flags.includes("--unattended-sandbox");
   const platformFlag = parsePlatformFlag(flags);
 
   const installerCtx = {
@@ -146,9 +146,9 @@ export async function runInstall(argv) {
  * contract: an installer that widens a permission set has to say what it is
  * about to allow while the person can still stop it, not report it afterwards.
  *
- * Claude Code only. The profile is a ~/.claude/settings.json shape, and writing
- * it for a host that does not read that file would be a line in a report that
- * nothing acts on.
+ * Claude Code only. The profile is a Claude Code settings file that the
+ * autopilot runner passes with `claude --settings`; writing it for a host that
+ * does not read it would be a line in a report that nothing acts on.
  *
  * @param {{home:string, forClaude:boolean, dryRun?:boolean}} opts
  */
@@ -158,23 +158,36 @@ function applyUnattended({ home, forClaude, dryRun = false }) {
     console.log("  --unattended applies to Claude Code only; nothing written.");
     return;
   }
-  let existing = [];
+  let current = {};
   try {
-    const settings = JSON.parse(readFileSync(join(home, ".claude", "settings.json"), "utf-8"));
-    existing = (settings?.permissions?.allow ?? []).map(String);
+    current = JSON.parse(readFileSync(unattendedSettingsPath(home), "utf-8")) || {};
   } catch {
-    // No settings file yet, or one that does not parse. Either way there is
+    // No profile file yet, or one that does not parse. Either way there is
     // nothing to mark as "already there"; applyUnattendedProfile decides what
     // to do about the unparseable case.
   }
   console.log("");
-  console.log(describeUnattendedProfile(existing));
   try {
+    console.log(describeUnattendedProfile(current, { home }));
     const res = applyUnattendedProfile({ home, dryRun });
     console.log("");
-    if (dryRun) console.log(`  (dry-run) would add ${res.added.length} entr(ies) to ${res.path}`);
-    else if (!res.added.length) console.log(`  nothing to add - ${res.path} already covers it`);
-    else console.log(`  added ${res.added.join(", ")} to ${res.path}`);
+    if (dryRun)
+      console.log(
+        `  (dry-run) would add ${res.added.length} entr(ies) to ${res.path} and move ${res.migrated.length} out of settings.json`,
+      );
+    else if (!res.added.length && !res.migrated.length)
+      console.log(`  nothing to add - ${res.path} already covers it`);
+    else {
+      if (res.added.length) console.log(`  added ${res.added.join(", ")} to ${res.path}`);
+      if (res.migrated.length)
+        console.log(
+          `  removed ${res.migrated.length} entr(ies) an earlier install wrote into ~/.claude/settings.json`,
+        );
+    }
+    if (res.warned.length)
+      console.log(
+        `  note: ~/.claude/settings.json allows ${res.warned.join(", ")}; it applies to unattended runs too`,
+      );
   } catch (err) {
     // A settings file we cannot parse is the user's, and rewriting it would
     // lose whatever is in there. Refusing loudly beats a silent overwrite.
@@ -288,7 +301,7 @@ function printSummary(opts) {
     console.log("    Everything installs and the pipeline runs, but a few shell");
     console.log("    helpers degrade quietly without it: cost summaries, the phase");
     console.log("    tracker's JSON reads, convention extraction and skill signing.");
-    console.log("    Install it (brew install jq / apt install jq) to get them back.");
+    console.log("    Install it (brew install jq) to get them back.");
     console.log("");
   }
   console.log("  Uninstall everything: npx @mmerterden/multi-agent-pipeline uninstall");

package/install/templates/claude-hooks.json

@@ -1,9 +1,9 @@
 {
-  "_readme": "Recommended Claude Code hooks for multi-agent-pipeline. Merge the `hooks` object into your ~/.claude/settings.json to make these deterministic, OS-enforced PreToolUse gates real (exit 2 blocks the tool call) rather than prompt-level hopes. Three PreToolUse gates ship here: (1) a staged-diff secret scan on git commit (pre-commit-check.sh); (2) an agent-guard on git commit + git push (agent-guard.sh) that blocks AI/assistant attribution in commit messages and force-push to a protected branch (main/master/develop); (3) a read-size gate on Read and Bash (check-read-size.sh), which inspects Read plus the shell commands that read a file whole (cat/head/tail/sed) and returns immediately for everything else, which routes an oversized read to a cheap worker instead of the caller's own rung. The first two inspect what a run WRITES; the third inspects what it pays to READ, and it is inert until `prefs.global.bulkRead.mode` is set to observe or enforce - so merging this block changes nothing until you opt in. All three are self-contained, fail-open on internal error, never execute the inspected command, and need no run-specific arguments, which is why they are naturally PreToolUse hooks. The other deterministic gates (evidence, consensus, intent, learnings) take run-specific arguments and are phase-enforced by the pipeline instead. Three capture hooks ship alongside them, and they are the reason a killed run no longer loses what it learned: (4) SessionEnd runs capture-flush.sh --if-stale, which writes a run's triage findings and durable learnings into the per-repo stores when the run never reached Phase 5 - previously every persistent write lived in Phase 5, the phase a run is LEAST likely to reach; the same hook runs note-session.sh, which records the mechanical shape of a NON-pipeline session (tools used, commands that failed, calls the user refused) so work done outside a run stops vanishing. (5) PreCompact runs capture-flush.sh - WITHOUT --if-stale, because the staleness test exists so a session exit does not re-flush a run that already finished, while a compaction is the moment un-flushed findings are actually at risk and both writes are idempotent, so the finished case costs two no-op writes. A compaction summarizes the conversation mid-phase: a long Phase 3 or Phase 4 can lose what it established before SessionEnd ever fires, which is the same failure that put the SessionEnd hook here one level down. (6) SessionStart runs capture-resume.sh, which prints at most two lines: an unfinished run and how to resume it, and a stale pipeline-observation queue. No capture hook calls a model, none reads a payload - note-session.sh keeps a command's first word and an exit code, never an argument or any output - and all exit 0 on every path, because a hook that fails a session over bookkeeping is worse than the bookkeeping it protects. multi-agent:setup offers to merge this block.",
+  "_readme": "Recommended Claude Code hooks for multi-agent-pipeline, the same registrations `install` writes into ~/.claude/settings.json (install/claude.mjs configureSettings). Merge the `hooks` object into your ~/.claude/settings.json to make these deterministic PreToolUse gates real (exit 2 blocks the tool call). A PreToolUse matcher is a regex over the TOOL NAME, so each gate registers on a tool name and reads the command from its stdin payload. Three PreToolUse gates ship here: (1) pre-commit-check.sh on Bash, which acts only on a `git commit` and blocks a secret in the staged diff; (2) agent-guard.sh on Bash, on Edit|Write|NotebookEdit, and on WebFetch plus every multi-agent-toolkit tool (WebFetch|mcp__multi-agent-toolkit__.*). Always, it blocks AI/assistant attribution in a commit message and a force-push, delete or mirror push to a protected branch (main/master/develop), including one inside a subshell or a `bash -c` / `eval` line. With MULTI_AGENT_UNATTENDED=1 in the hook's environment it also applies the unattended policy: no push, PR or tracker write, no Keychain read, no fetch outside the host allowlist (curl, WebFetch, the toolkit's web tools, agent_run_steps and open_url), no package install, and no write into a protected path (features/unattended-security.md); (3) check-read-size.sh on Read|Bash, which inspects Read plus the shell commands that read a file whole (cat/head/tail/sed), returns immediately for everything else, and routes an oversized read to a cheap worker instead of the caller's own rung; it is inert until `prefs.global.bulkRead.mode` is set to observe or enforce. Failure behaviour: pre-commit-check.sh and check-read-size.sh fail open on an internal error. agent-guard.sh fails open when attended, so a guard bug cannot break a legitimate tool call, and fails closed under MULTI_AGENT_UNATTENDED=1, where nobody is there to notice a gap. None of the three executes the inspected command, and none needs run-specific arguments. The other deterministic gates (evidence, consensus, intent, learnings) take run-specific arguments and are phase-enforced by the pipeline instead. Three capture hooks ship alongside them and block nothing: (4) SessionEnd runs capture-flush.sh --if-stale, which writes a run's triage findings and durable learnings into the per-repo stores when the run ended before Phase 5, where those writes otherwise happen; the same hook runs note-session.sh, which records the mechanical shape of a session outside the pipeline (tools used, commands that failed, calls the user refused). (5) PreCompact runs capture-flush.sh without --if-stale: a compaction summarizes the conversation mid-phase, so it is the moment unflushed findings are at risk, and both writes are idempotent, so a finished run costs two no-op writes. The staleness test exists only so a session exit does not re-flush a run that already finished. (6) SessionStart runs capture-resume.sh, which prints at most two lines: an unfinished run and how to resume it, and a stale pipeline-observation queue. No capture hook calls a model or reads a payload - note-session.sh keeps a command's first word and an exit code, never an argument or any output - and all exit 0 on every path, because a hook that fails a session over bookkeeping costs more than the bookkeeping. multi-agent:setup offers to merge this block.",
   "hooks": {
     "PreToolUse": [
       {
-        "matcher": "Bash(git commit:*)",
+        "matcher": "Bash",
         "hooks": [
           {
             "type": "command",
@@ -15,18 +15,29 @@
             "type": "command",
             "command": "bash $HOME/.claude/scripts/agent-guard.sh",
             "timeout": 10,
-            "statusMessage": "Checking commit for attribution..."
+            "statusMessage": "Checking commit/push safety (attribution + force-push)..."
           }
         ]
       },
       {
-        "matcher": "Bash(git push:*)",
+        "matcher": "Edit|Write|NotebookEdit",
         "hooks": [
           {
             "type": "command",
             "command": "bash $HOME/.claude/scripts/agent-guard.sh",
             "timeout": 10,
-            "statusMessage": "Checking push safety..."
+            "statusMessage": "Checking the edit target..."
+          }
+        ]
+      },
+      {
+        "matcher": "WebFetch|mcp__multi-agent-toolkit__.*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash $HOME/.claude/scripts/agent-guard.sh",
+            "timeout": 10,
+            "statusMessage": "Checking the fetch host..."
           }
         ]
       },

package/install/templates/copilot-instructions.md

@@ -345,7 +345,7 @@ prompt fatigue during long pipeline runs:
 - Git: `git`, `git add`, `git commit`, `git push`, `git worktree`, `git rebase`
 - GitHub CLI: `gh`, `gh api`, `gh issue`, `gh pr`, `gh repo`, `gh run`, `gh auth`, `gh auth switch`
 - Node/npm: `node`, `npm`, `npx`, `pnpm`
-- Keychain: `~/.copilot/lib/credential-store.sh` (canonical, cross-platform), `~/.copilot/scripts/keychain.py` (deterministic Python helper); `security`, `secret-tool`, and `cmdkey` are the underlying platform backends the helper dispatches to
+- Keychain: `~/.copilot/lib/credential-store.sh` (canonical), `~/.copilot/scripts/keychain.py` (deterministic Python helper); `security` is the macOS Keychain backend the helper wraps
 - Pipeline scripts: `bash` (invokes phase-tracker.sh, phase-banner.sh, etc.)
 
 Destructive commands (`rm -rf /`, `git push --force` to main, `chmod 777`) remain in `deny`

package/install/templates/multi-agent-autopilot-awake.plist.template

@@ -0,0 +1,48 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  multi-agent autopilot  -  keep the Mac awake for as long as the mode is on.
+
+  Rendered and installed ONLY by /multi-agent:autopilot-on (through
+  scripts/autopilot-awake.mjs) and removed by /multi-agent:autopilot-off. A
+  clean install writes nothing here.
+
+  A separate job from the schedule on purpose. The schedule's StartInterval does
+  not wake a sleeping Mac, so a machine that sleeps between ticks stops taking
+  work with nothing to say so. This job holds one assertion for as long as it is
+  loaded, and loading it is the same decision as turning the mode on.
+
+    -s  no system sleep; macOS honours it on AC power only
+    -i  no idle sleep; this one holds on battery as well
+    -d  the display stays on too - added only with awake.display: true
+
+  KeepAlive restarts caffeinate if anything ends it, so "on" cannot quietly
+  become "on, but sleeping".
+
+  autopilot-awake.mjs substitutes the two placeholders, LABEL and ARGS.
+-->
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>{{LABEL}}</string>
+
+  <key>ProgramArguments</key>
+  <array>
+{{ARGS}}
+  </array>
+
+  <key>RunAtLoad</key>
+  <true/>
+
+  <key>KeepAlive</key>
+  <true/>
+
+  <key>ProcessType</key>
+  <string>Background</string>
+
+  <!-- caffeinate prints nothing; there is no log worth keeping. -->
+  <key>StandardOutPath</key>
+  <string>/dev/null</string>
+  <key>StandardErrorPath</key>
+  <string>/dev/null</string>
+</dict>
+</plist>

package/install/templates/multi-agent-autopilot.plist.template

@@ -11,12 +11,13 @@
   that fired at boot could not read a single token - it would take items it could
   not work on and burn them. Automatic login means nothing to do after a restart.
 
-  StartInterval does NOT wake a sleeping Mac; it fires on the next wake. The mode
-  therefore holds its own sleep assertion while on AC and releases it on battery,
-  so an overnight queue keeps moving without flattening a laptop off the charger.
+  StartInterval does NOT wake a sleeping Mac; it fires on the next wake. The
+  awake agent (multi-agent-autopilot-awake.plist.template), installed and
+  removed with this one, keeps the Mac awake for as long as the mode is on, and
+  a tick also holds `caffeinate -s -w <pid>` while its session is in flight.
 
   {{PLACEHOLDERS}} are substituted by autopilot-on: NODE, TICK, LABEL, ROOT,
-  INTERVAL.
+  INTERVAL, HOME, CLAUDE.
 -->
 <plist version="1.0">
 <dict>
@@ -65,8 +66,14 @@
 
   <key>EnvironmentVariables</key>
   <dict>
+    <!-- launchd reads no login shell, so this is the whole PATH a tick sees.
+         ~/.local/bin is where the native installer puts `claude`. -->
     <key>PATH</key>
-    <string>/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
+    <string>{{HOME}}/.local/bin:/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
+    <!-- The absolute `claude` autopilot-on resolved in your shell, tried before
+         PATH. Empty when none was found, and then PATH decides. -->
+    <key>MA_AP_CLAUDE_INSTALLED_BIN</key>
+    <string>{{CLAUDE}}</string>
     <!-- No token is set here, deliberately. launchd plists are world-readable
          and get backed up; credentials are read from the keychain at tick time
          through credential-store.sh, which streams them over stdin so they never

package/install/unattended-profile-legacy.json

@@ -0,0 +1,80 @@
+{
+  "$comment": "The unattended profile as v20.2.1 wrote it into ~/.claude/settings.json, frozen: the signature install --unattended uses to recognise and remove those entries from the attended settings file. Rules only; the reasons are in that release's schema.",
+  "version": "20.2.1",
+  "defaultMode": "dontAsk",
+  "allow": [
+    "Read",
+    "Glob",
+    "Grep",
+    "Edit",
+    "Write",
+    "NotebookEdit",
+    "Agent",
+    "Skill",
+    "WebFetch",
+    "TaskCreate",
+    "TaskUpdate",
+    "TaskList",
+    "TaskGet",
+    "mcp__multi-agent-toolkit__*",
+    "Bash(git *)",
+    "Bash(gh *)",
+    "Bash(bash *)",
+    "Bash(node *)",
+    "Bash(python3 *)",
+    "Bash(jq *)",
+    "Bash(npm run *)",
+    "Bash(npm test *)",
+    "Bash(npm ci *)",
+    "Bash(npx *)",
+    "Bash(xcodebuild *)",
+    "Bash(xcrun *)",
+    "Bash(swift *)",
+    "Bash(./gradlew *)",
+    "Bash(pod install *)",
+    "Bash(pytest *)",
+    "Bash(go test *)",
+    "Bash(go build *)",
+    "Bash(cargo test *)",
+    "Bash(cargo build *)",
+    "Bash(make *)",
+    "Bash(ls *)",
+    "Bash(cat *)",
+    "Bash(head *)",
+    "Bash(tail *)",
+    "Bash(wc *)",
+    "Bash(find *)",
+    "Bash(grep *)",
+    "Bash(rg *)",
+    "Bash(sed *)",
+    "Bash(awk *)",
+    "Bash(sort *)",
+    "Bash(diff *)",
+    "Bash(mkdir *)",
+    "Bash(cp *)",
+    "Bash(mv *)",
+    "Bash(echo *)",
+    "Bash(printf *)",
+    "Bash(date *)",
+    "Bash(cd *)"
+  ],
+  "deny": [
+    "Bash(gh pr merge *)",
+    "Bash(git push *)",
+    "Bash(git push)",
+    "Read(~/.ssh/**)",
+    "Read(~/.aws/**)",
+    "Read(~/.gnupg/**)",
+    "Read(~/Library/Keychains/**)",
+    "Edit(~/.claude/settings.json)",
+    "Edit(~/.claude/scripts/**)",
+    "Edit(~/.claude/lib/**)",
+    "Edit(~/.claude/autopilot/**)",
+    "Edit(**/.github/workflows/**)",
+    "mcp__multi-agent-toolkit__research_*"
+  ],
+  "env": [
+    ["MCP_TOOLKIT_URL_POLICY", "strict"],
+    ["MCP_TOOLKIT_INDEX_DENY", "~/.ssh,~/.aws,~/.gnupg,~/Library/Keychains"]
+  ]
+}