open/config-audit
1
0
Fork 0
Code Issues Releases 1 Activity

feat(set): validate autoMode structure + flag it in shared settings (CA-SET)

Browse source 
settings-validator now validates the autoMode block (auto-mode classifier
config). Structure (medium): autoMode must be an object whose only keys are
environment/allow/soft_deny/hard_deny, each a string array ("$defaults" is a
valid entry); flags not-an-object, unknown-subkey, not-string-array. Dead-config
(low): Claude Code does not read autoMode from shared project settings
(.claude/settings.json), so an autoMode block committed there has no effect —
keyed on file.scope === 'project'.

Both premises primary-source-verified (code.claude.com/docs/en/auto-mode-config).
The plan's "test per-file scope first" gate passed: ConfigFile already carries
scope. SET is in the orchestrator; SC-5 re-checked, byte-equal (snapshot fixture
has no autoMode). Fixtures force-added (.claude/ is gitignored).

Tests +5 (944->949). Scanner count unchanged (13). --json/--raw byte-stable.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8
This commit is contained in:
Kjell Tore Guttormsen 2026-06-19 22:14:26 +02:00
commit 3633571c7e
8 changed files with 225 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

22
CLAUDE.md
View file

@ -221,6 +221,28 @@ claimed CC "suggests the parent directory when an entry points at a file"; that
primary-source-verified conditions. `skills` is deliberately *not* in `SHADOWING_PATH_FIELDS`
(it adds to the default scan, never shadows).
### SET scanner — autoMode validation (`CA-SET`)
Per-file check in `settings-validator.mjs` (`autoMode` was in `KNOWN_KEYS` but had no nested
validation). Two sub-checks, both primary-source-verified against
`code.claude.com/docs/en/auto-mode-config`:
1. **Structure** (severity **MEDIUM**): `autoMode`, if present, must be an object whose only keys
are `environment`/`allow`/`soft_deny`/`hard_deny` (`AUTO_MODE_SUBKEYS`), each a **string
array** (the literal `"$defaults"` is a valid entry, so it passes the string check for free).
`problem` ∈ `not-an-object` / `unknown-subkey` / `not-string-array` in `details`.
2. **Dead-config** (severity **LOW**): Claude Code does **not** read `autoMode` from *shared*
project settings — verbatim: *"The classifier does not read `autoMode` from shared project
settings in `.claude/settings.json`, so a checked-in repo cannot inject its own allow rules."*
The check keys on **`file.scope === 'project'`** (file-discovery's `classifyScope` returns
`'project'` for a committed `.claude/settings.json`; `'local'`/`'user'`/`'managed'` are read and
not flagged). `problem: 'shared-project-scope'`. This is why the plan's "test per-file scope
first" gate passed — `ConfigFile` already carries `scope`.
The two sub-checks are independent (a malformed autoMode in shared scope yields both). SET is in the
orchestrator, so SC-5 was re-checked after this change — byte-equal (the snapshot fixture has no
`autoMode`, so the block never fires there).
## Gotchas
- Session directories accumulate — use `/config-audit cleanup` to manage