The feature README's Security Notes describe a layout it stopped using

[blooop]

Found by a retrospective wf-review of #335/#362/#374 — none of the three was reviewed (Sourcery out of quota).

Two sections of one file, disagreeing

#362 moved ~/.claude from individual file mounts to a read-write directory mount, and wrote an honest account of the cost at README.md:98-115:

The cost is stated plainly: CLAUDE.md and settings.json are writable from the container. settings.json can name hook commands inline, so this is a real hole and not only a theoretical one.

450 lines below, ### What's Protected (Read-Only Mounts) still said:

• CLAUDE.md: Prevents prompt injection attacks that could modify your global instructions
• settings.json: Prevents config tampering
• Writable files are limited to authentication/state only
• All configuration and code execution files remain read-only

Every one of those is false under the current manifest, which mounts ~/.claude read-write and marks exactly five directories readonly: agents/, commands/, hooks/, skills/, wf-skills/. A reader who scrolls to a heading called "Security Notes" — which is what a reader assessing risk does — gets the pre-#362 answer.

What is actually reachable from the container, and now said so: the host's OAuth tokens in .credentials.json, the host's session transcripts for every project under projects/, and a hook command written into the host's settings.json, which is host command execution.

The five read-only mounts are not an escape boundary

README.md:113 and :380 stated the guarantee unqualified — "only the five named directories are proof against a prompt injection", "you cannot add or change an agent, command, hook or skill from within the container".

True of an unprivileged container. A container with CAP_SYS_ADMIN can mount -o remount,rw its own read-only bind mounts — and this repo's devcontainer is privileged: the docker-in-docker feature brings "privileged": true, as .devcontainer/devcontainer.json:76 notes in passing.

Both sentences are now qualified, and there is a short section saying what the five directories are and are not: protection against a prompt injection editing its own instructions, not against code actively trying to get out.

Why it drifted, and the guard

test_claude_code_feature_mounts.py binds the README to the manifest through READ_ONLY_HEADING = "### Read-Only Mounts (Security-Protected)" — one heading, by exact text. The stale claims lived under a different heading, so they were checked by nothing. That is the actual defect: the guard was addressed to a heading rather than to a property.

test_no_heading_claims_protection_for_a_writable_file asks every heading whose text contains "read-only" or "protected" whether it bullets a file that is writable, and asserts the set of such headings is non-empty first, so it cannot pass by matching nothing. Only bullets count, for documented_paths's existing reason: the prose under these headings discusses settings.json precisely to say it is not protected, and a substring match would fail on the sentence that fixes the problem.

Proven against the real defect. Restoring the two original bullets turns it red with the offending lines named:

"### What's Protected (Read-Only Mounts)" lists CLAUDE.md: - **CLAUDE.md**: Prevents prompt injection attacks...
"### What's Protected (Read-Only Mounts)" lists settings.json: - **settings.json**: Prevents config tampering

Verified

pixi run -q python -m pytest test/ --ignore=test/e2e: 284 passed (was 283 — the new test), 20 failed, byte-identical failures to pristine main in a scratch clone (they need a built dl). pixi run style 10.00/10.

Left for follow-ups

From the same review, not in this PR: install.sh:172-224's banner repeats the stale claims and still seeds {} into .credentials.json (the behaviour #362 removed from init-host.sh and pins against); init-host.sh:143 creates the OAuth-token directory with the ambient umask, measured 775, two lines above a mkdir -m 700 for ~/.ssh; TROUBLESHOOTING.md:166-185 answers a symptom that can no longer occur; and test_init_host_heals_stale_mounts.py:208 derives its parametrization from the current README when the heal exists for legacy mounts, which has silently dropped CLAUDE.md and settings.json from coverage. Full report on #374.

Also worth knowing: all six of #335's heal tests skip where no private mount namespace is available. If that guard fires on CI runners too, that fix has never been executed by a test.

🤖 Generated with Claude Code

Summary by Sourcery

Align the Claude Code feature's security documentation and regression coverage with its current mount behavior.

Bug Fixes:

• Correct inaccurate security documentation that described CLAUDE.md and settings.json as read-only despite the current writable directory mount.
• Clarify that the five read-only instruction directories do not protect against privileged container escape or remounting.

Enhancements:

• Document the actual writable data and host-impact risks exposed by the feature, including credentials, session transcripts, and host command execution through settings.json.

Documentation:

• Align the feature README's security notes, writable-path guidance, and mount limitations with the current container layout.

Tests:

• Add a regression test that checks every README heading claiming read-only or protected paths for writable files, preventing stale security claims from going undetected.

[sourcery-ai]

Sorry @blooop, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[sourcery-ai]

Reviewer's Guide

This PR reconciles the feature README’s security notes with the current ~/.claude read-write directory mount and privileged devcontainer model, then adds a heading-independent regression test to prevent writable files from being documented as protected again.

Flow diagram for heading-independent security documentation guard

flowchart TD
    Manifest[Feature mount manifest]
    Readme[README security headings and bullets]
    Test[test_no_heading_claims_protection_for_a_writable_file]
    Writable[Writable paths from manifest]
    Protected[Headings containing read-only or protected]
    Failure[Fail with offending heading and path]
    Pass[Pass when no writable file is claimed protected]

    Manifest --> Writable
    Readme --> Protected
    Writable --> Test
    Protected --> Test
    Test -->|overlap found| Failure
    Test -->|no overlap| Pass

Loading

File-Level Changes

Change	Details	Files
Correct the security documentation to match the current read-write directory mount and privileged-container behavior.	Replace stale claims that CLAUDE.md, settings.json, and all executable configuration remain read-only with the actual five read-only directories. Document exposure of OAuth credentials, cross-project transcripts, writable settings hooks, and the limitations of read-only mounts under CAP_SYS_ADMIN. Update configuration guidance and security recommendations to distinguish ordinary-process protection from container-escape protection.	.devcontainer/claude-code/README.md
Add a regression test that checks every README section making a read-only or protected claim for writable files.	Detect all protection-related headings instead of binding validation to one exact heading. Inspect only bullet entries and fail with the offending heading and path when CLAUDE.md or settings.json is listed as protected. Assert that at least one protection heading is found so the guard cannot pass vacuously.	test/unit/test_claude_code_feature_mounts.py

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.21%. Comparing base (a5f7ed8) to head (7c5783a).

Additional details and impacted files

Flag	Coverage Δ
python	42.98% <ø> (ø)
rust	95.57% <ø> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
shipped code (rust)	95.57% <ø> (+0.01%)	⬆️
harness and tooling (python)	42.98% <ø> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.