diff options
| -rw-r--r-- | hostnix/mojo/packages/claude-code/claude.sb | 5 | ||||
| -rw-r--r-- | hostnix/mojo/packages/claude-code/default.nix | 11 |
2 files changed, 12 insertions, 4 deletions
diff --git a/hostnix/mojo/packages/claude-code/claude.sb b/hostnix/mojo/packages/claude-code/claude.sb index 72797de..1117b18 100644 --- a/hostnix/mojo/packages/claude-code/claude.sb +++ b/hostnix/mojo/packages/claude-code/claude.sb @@ -293,4 +293,7 @@ ;; themselves. Otherwise it will set PATH to "" and disable colored output (allow file-read* (literal "/Users")) (allow file-read* (literal "/Users/joe")) -(allow file-read* (literal "/Users/joe/src")) +(allow file-read* (subpath "/Users/joe/src")) + +(allow file-read* (subpath (string-append (param "HOME_DIR") "/.dotfiles"))) +(deny file-read* (subpath (string-append (param "HOME_DIR") "/.dotfiles/tmp"))) diff --git a/hostnix/mojo/packages/claude-code/default.nix b/hostnix/mojo/packages/claude-code/default.nix index d8e333a..a9798fd 100644 --- a/hostnix/mojo/packages/claude-code/default.nix +++ b/hostnix/mojo/packages/claude-code/default.nix @@ -1,11 +1,16 @@ { writeShellScriptBin, claude-code }: writeShellScriptBin "claude" '' + if [[ $HOME/ = ''${PWD%/}/* ]]; then + echo "fatal: refusing to allow access to $PWD" >&2 + exit 1 + fi + exec /usr/bin/sandbox-exec -f ${./claude.sb} \ - -D TARGET_DIR=$HOME/src \ + -D TARGET_DIR="$(realpath "$PWD")" \ -D TMP_DIR=/tmp \ - -D HOME_DIR=$HOME \ - -D CACHE_DIR=$HOME/.cache \ + -D HOME_DIR="$HOME" \ + -D CACHE_DIR="$HOME/.cache" \ ${claude-code}/bin/claude \ --allow-dangerously-skip-permissions "$@" '' |