Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: DiamondLightSource/python-copier-template
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: main
Choose a base ref
...
head repository: DiamondLightSource/python-copier-template
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: claude-sandbox
Choose a head ref
Checking mergeability… Don’t worry, you can still create the pull request.
  • 5 commits
  • 19 files changed
  • 2 contributors

Commits on Apr 29, 2026

  1. feat: Add optional Claude Code sandbox to devcontainer 

    Three new copier questions gate a sandboxed Claude Code setup:
add_claude (top-level — env var blockers, ~/.claude bind mount,
Claude Code CLI install, postCreate/postStart hooks, node, justfile);
install_gh and install_glab (each gated on add_claude — adds the CLI
install plus per-repo PAT volume mount and matching just recipe).

Breaks the template/.devcontainer symlink so devcontainer.json can be
Jinja-conditional. The meta repo's own .devcontainer/devcontainer.json
and Dockerfile become the add_claude=no baseline. A new
test_meta_matches_no_claude_template drift test renders the template
with all Claude opts off and byte-diffs the result against the meta
repo to catch divergence.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
    @gilesknap @claude
    gilesknap and claude committed Apr 29, 2026
    Configuration menu
    Copy the full SHA
    ae1670a View commit details
    Browse the repository at this point in the history

  2. fix: Disable port auto-detection, forward 8000 explicitly 

    VS Code's auto-detection races with sphinx-autobuild on container
restart and steals the port, breaking the live-reload docs preview.
Disable it and forward 8000 explicitly so the docs URL is stable.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
    @gilesknap @claude
    gilesknap and claude committed Apr 29, 2026
    Configuration menu
    Copy the full SHA
    5b874f9 View commit details
    Browse the repository at this point in the history

  3. Add claude sandbox (#337) 

    Three new copier questions gate a sandboxed Claude Code setup:
add_claude (top-level — env var blockers, ~/.claude bind mount, Claude
Code CLI install, postCreate/postStart hooks, node, justfile),
install_gh and install_glab (each gated on add_claude).
Breaks the template/.devcontainer symlink so devcontainer.json can be
Jinja-conditional. The meta repo's own .devcontainer/devcontainer.json
and Dockerfile become the add_claude=no baseline; a new
test_meta_matches_no_claude_template drift test enforces it.
Adds remote.autoForwardPorts: false and explicit forwardPorts: [8000] so
VS Code stops stealing sphinx-autobuild's port on restart (separate
commit).
    @gilesknap
    gilesknap authored Apr 29, 2026
    Configuration menu
    Copy the full SHA
    d645eb3 View commit details
    Browse the repository at this point in the history

  4. fix(claude-sandbox): close VS Code credential helper leak 

    VS Code's Dev Containers extension re-injects a /tmp credential bridge
after postStart runs, allowing host GitHub PATs to leak into the
container even with VSCODE_GIT_IPC_HANDLE blanked. Fix by:

- Use --unset-all (not =) for credential.helper, so the multi-valued
  entry VS Code writes is actually cleared.
- Remove /tmp/vscode-remote-containers-*.js so the bridge cannot answer
  even if a stale helper survives.
- Pin per-host helpers to command -v gh / glab so a stale host path
  (/usr/local/bin/gh) doesn't fall through to the next helper.
- Re-run cleanup on postAttachCommand because VS Code injects after
  postStartCommand has already finished.

Also:
- Install just explicitly when add_claude (recipes need it)
- Bump glab to 1.93.0
- Add CLAUDE.md describing sandbox boundaries and intentional exposures
  (NFS-mounted ~/.claude, /workspaces parent bind, --net=host)
- Link CLAUDE.md from README
    @gilesknap
    gilesknap committed Apr 29, 2026
    Configuration menu
    Copy the full SHA
    f2bcf25 View commit details
    Browse the repository at this point in the history

  5. fix(claude-sandbox): close VS Code credential helper leak (#338) 

    VS Code's Dev Containers extension re-injects a /tmp credential bridge
after postStart runs, allowing host GitHub PATs to leak into the
container even with VSCODE_GIT_IPC_HANDLE blanked. Fix by:

- Use --unset-all (not =) for credential.helper, so the multi-valued
entry VS Code writes is actually cleared.
- Remove /tmp/vscode-remote-containers-*.js so the bridge cannot answer
even if a stale helper survives.
- Pin per-host helpers to command -v gh / glab so a stale host path
(/usr/local/bin/gh) doesn't fall through to the next helper.
- Re-run cleanup on postAttachCommand because VS Code injects after
postStartCommand has already finished.

Also:
- Install just explicitly when add_claude (recipes need it)
- Bump glab to 1.93.0
- Add CLAUDE.md describing sandbox boundaries and intentional exposures
(NFS-mounted ~/.claude, /workspaces parent bind, --net=host)
- Link CLAUDE.md from README
    @gilesknap
    gilesknap authored Apr 29, 2026
    Configuration menu
    Copy the full SHA
    1189553 View commit details
    Browse the repository at this point in the history
Loading