CB-559: drop .claude/settings.local.json from the default parity overlay

2026-08-14 20:56:16 +02:00
parent 2c3796d598
commit b414a74c26
3 changed files with 44 additions and 3 deletions
@@ -210,8 +210,14 @@ public record BridgedConfig(
            // worker the primary's IDE servers, which are bound to the primary's checkout — so its
            // navigation returned paths outside its own worktree. GitWorktrees now neutralizes that
            // file instead; a worker's tools are whatever its launcher mounts.
+            // .claude/settings.local.json is the sibling that was left behind: it pre-approves tools
+            // (mcp__context7__*, mcp__jetbrains, mcp__intellij-index, Workflow(code-review)) a worker
+            // must never hold, and enables MCP servers by name. Its grants are currently INERT because
+            // GitWorktrees.isolateToolSurface strips every worktree's server map to empty — the named
+            // servers do not exist there to be enabled. This is defence in depth, not a live fix: the
+            // worker stays isolated only because this separate mechanism already removes the servers.
            parityOverlay = (parityOverlay == null || parityOverlay.isEmpty())
-                    ? List.of(".claude/settings.local.json", ".env", ".envrc")
+                    ? List.of(".env", ".envrc")
                    : List.copyOf(parityOverlay);
            // gitTokenEnv stays null when unset (opt-in). gitHostEnv defaults so operators enabling
            // checkpoints need only set gitTokenEnv; it is injected only alongside a resolved token.