Glob and Grep are separate tools from Read in Claude Code's permission
model — the agent was triggering permission prompts when trying to use
Glob on the host path even though Read was allowed.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Previous wording was unclear — agent kept using the virtual alias ~/gem
as a real filesystem path. New format uses a two-column table with
explicit examples showing the correct (real path + Read/Glob/Grep tools)
vs. incorrect (virtual path + Bash) usage.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Bash tool is sandboxed to workspace CWD regardless of settings.json — agent
was using Bash(ls) on mapped paths and getting blocked. CLAUDE.md now
explicitly tells the agent to use Read/Glob/Grep for external paths.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
deny always wins over allow in Claude Code — the Read(../**) deny rule
was silently blocking the explicitly allowed host paths. When mappings
exist, drop the ../** traversal guard and use explicit Read(./**) allow
instead of blanket Read.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- createClaudeConfig() adds Read/Write/Edit(<hostPath>/**) to allow list
for each path_mapping so Claude Code can actually access the directory
- createClaudeMd() shows agent both real path (to use) and virtual path
(to mention in responses) — previously only showed virtual path
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds optional path_mappings to agent.yaml so host directories are
transparently mapped to virtual paths in agent responses and CLAUDE.md.
Sanitizer replaces host paths (longest first, both slash styles) before
repoRoot/home substitutions. /new-agent accepts a host:virtual path
option with Windows-safe splitting and fs.existsSync validation.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
