tree b151ed19dd56c8be58ac934cb0b88df5dba589b5
parent 1b569a837831da11870aa77475aa94238a85a88a
author Jarek Potiuk <jarek@potiuk.com> 1777470552 +0200
committer Jarek Potiuk <jarek@potiuk.com> 1777470552 +0200
gpgsig -----BEGIN SSH SIGNATURE-----
 U1NIU0lHAAAAAQAAAhcAAAAHc3NoLXJzYQAAAAMBAAEAAAIBANx93zdjhrz8GnAP5uAC7N
 Ab2x9YW5hL0a8RpynuIDPjjbwV0skwzsODOtNhik2lUSBjMipu2cSzxrGeb7PSUPyU8KdI
 fXX5+cJBq0eiJrqwfEXMJgVmZcwHkJ0g9gA/KF5A//Ix6eV077o+zA+ZyyZb0OGIfCuBRb
 3fwmmLAXzFENZrx6YvrUXQkaj7yfmuNNZLea0A0peJdE1Nt1JaooUD8Ev7Izds4mmCoGJa
 3SjaFkdyrGl2bh01sHAiHy4p2yzRCSIeuruOvcsMY5QkeXIOpMoVjswrvvOgP4ugbUopD7
 7tdHOzaKqPlI0D4jhC6BCNq5GYx+gD4h1HfJYAXs7+lC4Fs3VCSfP+LrDNev+RCToBzIe5
 rCxLnEXPmA/tp9YYRCA3SB73ghYuwl+Q4TSR3Kk9YudUYufYhATE5+oxibOzDEXoa3xLVy
 JxSyHwvmuOQDW3SaOrcqL49GBAdRMLBY6MwvF5LdZ4yH6g6O1V+8+bTu/oIIysnKQn1YZW
 VOxhnhejr/KBG9TMtEz0vsFS7yuT2Yqp4ixhu9+XVpL+sqtWpgU/38NeY27xC24lBCTkAK
 ML5cxTqweVl+Us1KnsoOpOQlFfdmfUxhMXKArpklgtTzKXeZS9C+EfIG9HiXmQzqHk71OL
 dHf1eqDvXKk/+6k5B09aqY46LJa2Q3MtAAAAA2dpdAAAAAAAAAAGc2hhNTEyAAACFAAAAA
 xyc2Etc2hhMi01MTIAAAIAI7ta0+ohe4e79PqseDL4zmbCgc+Y5vU8hfkKE5wM5ota7cI3
 wLjMK8NbnP8p6Ny8t3buhYRk3aEHJLKS1NA6eG82Pzs6dcU029pqg8SVAh7jU5YhP8DkhW
 Mos70KE0ixfzD3CS8sbPYGzKj5+kaNjo38hCtFtKnLGrpyrWekVD/SB8K2jYh0GYvkNTlv
 BWIZqaLR1ykNVQyg379MT3vtWoRqupiLcH3CbY+D5LZdo1PQsvVFsrhqv2dLEcx9hoSBgb
 ho3mB2bjWzDLat1Qv2Vam7BB7aokfDElueAJfQFZ/+8KMdiJBm7uFhpeyv/XEYvvbnvGQa
 0EKg1qNEuqgnl2D+/ygoH/IF4Zyoz/5UL3fQfDUrxDdJcYYMSdsSgAKHutNDNIJsLoIxtN
 E6ouiLou2cTsT7lOn0jGetn1SJKgpE/oRGzHD7Q0efImKp2k8irBiK4RwUzEpPPo4hcSpH
 5FvlLgNXarl2kzH+9bm0LJ+39I42MZvpBtm7H8yMFGzB/Q8d3XDqAVQ1Pu1d0Uj4Jjc7yl
 RwVPqaB4nPArnRhu3jVM2IeKmCT7y6ObQfvJyHWRnMB0if/EvQniCNSp0gyim/sJT6UrPO
 5jTfx2DgKh/1Ro5Do0ZxsEre+uU4n0t8t5rj6NrD3ZyHvyerZkNtoNJHU00HaswRzFG9X2
 cEphc=
 -----END SSH SIGNATURE-----

fix(secure-agent-setup): allow gpg-agent socket + key paths in sandbox

The .claude/settings.json this PR ships denies all of ~/ from the
Bash sandbox, with only a tiny allowRead allowlist. That set
covers git/gh/uv but not commit signing — git users on Linux who
sign commits via gpg-agent (either gpg-format or ssh-format with
SSH_AUTH_SOCK pointing at gpg-agent's ssh-compat socket) hit:

    error: Couldn't get agent socket?
    fatal: failed to write commit object

on the first commit attempt inside the sandboxed session, because
~/.gnupg/ and /run/user/<UID>/gnupg/ are both behind the denyRead.

Adds two entries to sandbox.filesystem.allowRead:

  ~/.gnupg/             # gpg keyring + trustdb
  /run/user/*/gnupg/    # gpg-agent socket dir (the * is the UID)

Both are needed: the keyring so gpg can read the signing key
material, the runtime socket so gpg-agent / its ssh-compat s
can be reached. The * glob in the runtime path lets the same
allowRead work for any UID — Claude Code's sandbox allowRead
supports glob wildcards.

The matching documentation block in secure-agent-setup.md is
updated to mirror the new entries with inline comments.

Generated-by: Claude Code (Claude Opus 4.7)