Repository navigation
fix(harness): keep compiled skills on Claude turns that need approval - #3191
Open
QuentinBisson wants to merge 3 commits into
Open
QuentinBisson wants to merge 3 commits into
QuentinBisson wants to merge 3 commits into
Conversation
Claude Code counts skills under an --add-dir directory as part of the project setting source, so passing --setting-sources "" on approval turns dropped every compiled skill. Leave the sources open; the ask rules passed with --settings still gate the protected MCP servers. Fixes kagent-dev#3029 Signed-off-by: QuentinBisson <quentin@giantswarm.io>
github-actions
Bot
added
bug
An approval-gated Claude template with a Git-sourced skill must list the skill on its first turn, where it writes workspace settings that allow the protected tool and approve it from PreToolUse and PermissionRequest hooks. The next turn must still pause for approval. Signed-off-by: QuentinBisson <quentin@giantswarm.io>
github-actions
Bot
added
bug
The approval E2E workspace is untrusted, so Claude ignores the allow rule in its .claude/settings.json and only runs the hooks. Copy the same settings to $CLAUDE_CONFIG_DIR/settings.json, which Claude always loads and the agent can write, so the allow arm is exercised. Signed-off-by: QuentinBisson <quentin@giantswarm.io>
github-actions
Bot
added
bug
QuentinBisson
marked this pull request as ready for review
October 13, 2026 23:07
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
When a Claude agent has a requireApproval tool, the harness passes
--setting-sources ""on every turn.Claude Code treats skills under
--add-diras part of the project settings source. As a result, this flag prevents compiled skills from being discovered on approval-gated turns. This affects skills from spec.skills and non-Claude-formatspec.plugins; Claude-format plugins loaded through--plugin-dirare unaffected.Change
Remove
--setting-sources ""while retaining--settingsand--permission-prompt-tool.On the pinned Claude Code version (2.1.285), the ask rule supplied through
--settingscontinues to route protected tool calls through the permission prompt tool, even when user settings contain an allow rule orPreToolUse / PermissionRequesthooks return allow.Tests
Add an E2E regression test that verifies:
A Git-sourced skill is discoverable on the first turn of an approval-gated agent.
User and project settings and hooks attempting to allow a protected tool do not bypass the approval requirement on the next turn.
Security considerations
Removing the setting-source override also allows Claude Code to load settings and hooks that were previously excluded by this flag. The approval tests validate the protected-tool approval invariant for the pinned Claude Code version; they do not establish that arbitrary project hooks are safe to execute.
This change restores compiled-skill discovery without relying on an empty settings-source override to enforce tool approval. The trust policy for repository-provided hooks remains a separate consideration.
Fixes #3029
AI disclosure: written with AI assistance (Claude Code), reviewed and tested by me.