
A Nested Deny Is Not a Mod Approval
A user-installed mod that approves one nested piece of a compound shell is not proof deny is off. Print the nested rule, the approval source, and the named Claude Code owner before you file allow-broken.
14 posts tagged with #Claude-Code

A user-installed mod that approves one nested piece of a compound shell is not proof deny is off. Print the nested rule, the approval source, and the named Claude Code owner before you file allow-broken.

A missing always-ask prompt on a dangerous rm is not proof always-ask is off. Print the redirect, the prompt, and the named Claude Code owner before you file the ticket.

An every-run prompt on python3 -c is not proof that sandbox auto-allow is off. Print the equals matcher, the auto-allow setting, and the named Claude Code owner before you file an auto-allow-broken ticket.

A green /readyz is not proof Postgres is healthy. Print the ready status, the store probe, and the named gateway owner before you file an all-clear.

A permission rule that contains a NUL byte is not a wildcard allow. Print the rule bytes, the match-nothing result, and the named permission-rule owner before you file an allow-all ticket.

A docker glob that matches one command is not a sandbox exemption for npm ci && docker build. Print the glob, split every part, and name who owns sandbox.excludedCommands before you file a hole.

A failed local DNS lookup on a Claude apps gateway pod is not a missing host when the pod only talks through a forward proxy. Print the env, read the boot network line, and name who owns proxy-only egress.

A repo-root AGENTS.md is not Claude Code’s project instructions while CLAUDE.md or CLAUDE.local.md exists. Print the load line, open /config, and name who owns the instruction file.

A red WebFetch at five minutes is a download deadline, not a stuck model. Print the named CLI pin, the deadline env, and the named owner before you page the model.

A wall of HTTP 400s on a named Claude Code base URL is a schema reject, not a status outage. Print the 400 body, the named URL, and the named CLI pin before you page the gateway.

A remote or headless row that says waiting for your input is not done. Open the agent list, split Needs input from Working, and name who owns the CLI pin.

When a managed allow-list cannot be read, Claude Code now admits nothing. Classify the block, name who owns the file, then resume the coding agent.

An Organization policy line on /status can explain a miss. It does not prove the fleet policy loaded. Read claude doctor, name the proxy owner, then resume coding.

An interrupted MCP tool in a headless coding-agent session used to look finished. Treat empty completion as a bug until the harness asserts an interrupted error.
Also see: #Coding-Agents #Change-Control #Laravel #Claude-Code #Vue
Type at least 2 characters to search.