vendor the sandbox-routing hook and native MCP http transport

[m2ux]

Vendors the current Claude Code baseline into the deploy source, so the next deploy-cursor-workspace.sh run reproduces what is actually being run today rather than reverting it.

redirect-fs-mutation.py (new hook)

rm / mv / ln / chmod / chown / chgrp carry no allow rule and are rejected by compound-bash-allow.py's DENY_BINARIES, so a bare invocation reaches the user as a permission prompt. Because that hook's verdict is all-or-nothing per invocation, one such segment forfeits auto-approval for an entire chain — a 12-command chain whose only unmatched segment was rm -rf /tmp/scratch prompted in full.

The new hook returns deny with instructions to re-issue the command prefixed with sbx, but only when every path the segment mutates provably lies inside a root sbx binds read-write. Writable roots are derived the way bin/sbx derives them (/tmp, plus the git top-level of the launch cwd when under the projects base), so a redirect cannot hand back a command the sandbox would fail on with EROFS.

It stays silent — today's behaviour, a normal prompt — for anything it cannot prove: an operand outside the writable roots, .., a symlink crossing the boundary in either direction, a flag whose value is a separate token (-t, --reference), any --opt=value, dd (its if=/of= operands are not positional), or a relative operand in a chain that cds outside its first segment. Fails open on any parse error.

redirect-inline-eval.py's docstring previously disclaimed this case ("filesystem-mutating binaries ... are NOT forced"); it now points at the new hook and narrows its own disclaimer to dd and undecidable operand shapes.

Verified: 16 cases covering both directions, plus the hook firing on a real bare chmod and the re-issued sbx chmod auto-approving.

Native MCP http transport

merge_mcp_json generated the workflow-server entry as npx -y mcp-remote <url>. It now emits {"type": "http", "url": <url>}, and the two checked-in example configs carry the same shape so a hand-copied workspace matches a deployed one.

Note this is the transport shape Claude Code is being run with locally today; the same shape now also goes to .cursor/mcp.json, since deploy writes one merged document to both files.

Deliberately not included

• examples/cursor-workspace/.claude/rules/bash-composition.md — the rule prose still describes the pre-hook behaviour and lists dd among the sbx-able mutators. Updating it was explicitly declined earlier, so it is left alone; the vendored bundle therefore registers a hook its own rule text does not describe.
• workflow-canon skill — the vendored copy is newer than the live workspace copy (it carries the change-surface / I-O-contract-closure material the workspace lacks), so nothing was copied workspace-ward.
• Personal specialisation in ~/.claude/hooks — curl-allow.json and webfetch-allow.json name midnight-specific hosts and block-dynamic-shell.py hardcodes an absolute CLAUDE.md path. The generic vendored forms are correct for a portable baseline.

Checks

• bash -n scripts/deploy-cursor-workspace.sh passes; the embedded merge_mcp_json Python block compiles clean.
• All three settings/MCP JSON documents parse.
• Hook dry-run matrix passes in both directions.

🤖 Generated with Claude Code