mojo: Allow git/jj to access their repo dirs from sandboxed claude

/usr/bin/git is an xcode-select shim that needs to stat
/Library/Developer/CommandLineTools to find the real git binary; the
sandbox denied that path by default, breaking git entirely.

Separately, when TARGET_DIR is a subdirectory of a larger repo, the
real .git/.jj directories live above TARGET_DIR and were unwritable,
breaking commits from within the subdirectory. default.nix now
resolves the real git/jj dirs at launch and passes them through as
GIT_DIR/JJ_DIR sandbox params.

1 files changed, 10 insertions, 0 deletions

diff --git a/hostnix/mojo/packages/claude-code/claude.sb b/hostnix/mojo/packages/claude-code/claude.sb
index 1117b18..3adb074 100644
--- a/hostnix/mojo/packages/claude-code/claude.sb
+++ b/hostnix/mojo/packages/claude-code/claude.sb
@@ -114,6 +114,10 @@
     ;; Project directory - primary workspace
     (subpath (param "TARGET_DIR"))
 
+    ;; Include .git and .jj directories in case the root is above TARGET_DIR.
+    (subpath (param "GIT_DIR"))
+    (subpath (param "JJ_DIR"))
+
     ;; Temporary directories
     (subpath (param "TMP_DIR"))
     (subpath "/tmp")
@@ -287,6 +291,12 @@
     (subpath "/Library/Java")
 )
 
+;; Xcode Command Line Tools - needed so /usr/bin/git (an xcode-select shim)
+;; can locate the real git binary
+(allow file-read*
+    (subpath "/Library/Developer/CommandLineTools")
+)
+
 ;; Generated allow-read rules for: /Users/joe/src
 ;; for some reason claude-code needs list access to all parent directories of TARGET_DIR
 ;; - it doesn't need access to read the contents of directories, only the directories