feat(claude-code): add managed_settings input for policy delivery via /etc/claude-code by morganl-ant · Pull Request #863 · coder/registry

morganl-ant · 2026-04-22T20:22:36Z

Problem

The module configures Claude Code's permission posture by reaching around the permission system rather than through it:

scripts/install.sh writes bypassPermissionsModeAccepted, autoModeAccepted, and primaryApiKey directly into the user-writable ~/.claude.json. Any process in the workspace can read the API key or flip the acceptance flags back.
scripts/start.sh adds --dangerously-skip-permissions to every task launch, even when the template author set an explicit permission_mode. The README has to carry a security warning telling people the module bypasses permission checks.
permission_mode, allowed_tools, and disallowed_tools each plumb through a different ad-hoc path (CLI flag, coder subcommand) instead of a single policy surface.

Change

Add a managed_settings input that renders to /etc/claude-code/managed-settings.d/10-coder.json. Claude Code reads that drop-in directory at startup with the highest configuration precedence (above ~/.claude/settings.json and project settings), so template authors get an admin-controlled policy file that users inside the workspace cannot override. The mechanism is a local file read with no API call, so it works identically for the Anthropic API, AWS Bedrock, Google Vertex AI, and AI Bridge / AI Gateway.

managed_settings = {
  permissions = {
    defaultMode                  = "acceptEdits"
    disableBypassPermissionsMode = "disable"
    deny                         = ["Bash(curl:*)", "WebFetch"]
  }
}

Supporting changes:

install.sh writes the policy file (root-owned, 0644) and stops writing bypassPermissionsModeAccepted, autoModeAccepted, and primaryApiKey into ~/.claude.json. The API key is already exported via coder_env as CLAUDE_API_KEY; duplicating it on disk is unnecessary. hasCompletedOnboarding stays because there is no env-var alternative for it.
start.sh only adds --dangerously-skip-permissions for tasks when no explicit permission_mode is set (same fix as fix(claude-code): don't pass --dangerously-skip-permissions in auto mode #846; included here so this PR is self-contained, happy to drop if fix(claude-code): don't pass --dangerously-skip-permissions in auto mode #846 lands first).
permission_mode, allowed_tools, and disallowed_tools are marked deprecated and shimmed into managed_settings.permissions for one release when managed_settings is not provided.
README security warning rewritten to point at the policy mechanism instead of telling people the module is unsafe by design.

Relationship to #861

#861 strips this module to install-and-configure and removes permission_mode / allowed_tools / disallowed_tools outright. managed_settings is the natural replacement for those: it is install-time (survives the start.sh removal), it covers everything the dropped variables did plus hooks, env, model, apiKeyHelper, and the rest of the settings schema, and it does not require the module to know anything about how Claude is launched. If #861 lands first I will rebase this on top and drop the deprecation shim and the start.sh hunk.

Validation

terraform fmt / terraform validate clean
New tests: claude-managed-settings-written, claude-managed-settings-legacy-shim, claude-no-policy-keys-in-claudejson, plus an assertion in claude-auto-permission-mode that --dangerously-skip-permissions is absent when a mode is set
Manually verified /etc/claude-code/managed-settings.d/*.json precedence in the Claude Code CLI source

Closes #818. Relates to #284, #846, #861.

Disclosure: I work at Anthropic on the Claude Code team. Happy to adjust scope or split this further if that is easier to review.

matifali · 2026-04-25T06:29:45Z

This would need rebasing after #861 is merged. Thanks for your contribution.

… /etc/claude-code Re-authored on top of the post-coder#861 install-only module. Adds a managed_settings variable that the install script writes to /etc/claude-code/managed-settings.d/10-coder.json. Claude Code reads this drop-in directory at startup with the highest configuration precedence, so template authors get an admin-controlled policy file that users inside the workspace cannot override. The mechanism is a local file read with no API call, so it works identically for the Anthropic API, AWS Bedrock, Google Vertex AI, and AI Gateway. Compared to the original PR against v4.x, this drops the deprecation shim for permission_mode/allowed_tools/disallowed_tools (those vars are gone in v5) and the start.sh changes (start.sh is gone). The ~/.claude.json policy-key removal is also dropped from this PR scope since the surrounding configure_standalone_mode logic changed substantially in coder#861; can revisit separately if wanted.

morganl-ant · 2026-04-27T23:26:56Z

Rebased onto post-#861 main. Scope is now smaller: just the managed_settings input writing /etc/claude-code/managed-settings.d/10-coder.json. The deprecation shim and ~/.claude.json key removal from the original PR are no longer needed since #861 dropped those vars and writes.

…ude.json These flags pre-accept the permission-mode confirmation dialogs in a user-writable file. Permission posture is the managed_settings input's job (delivered via /etc/claude-code/managed-settings.d/, root-owned, not user-overridable). Onboarding-bypass keys (hasCompletedOnboarding, hasAcknowledgedCostThreshold, project trust) stay since there is no managed-settings equivalent for those.

matifali

I like the flexibility this PR adds. I think this supercedes #866 and covers the use case.

matifali · 2026-04-28T05:27:40Z

-        .autoModeAccepted = true |
-        .bypassPermissionsModeAccepted = true |


Why did we remove this? AFAIK, these were needed for skipping the welcome wizard.

I think the reason they are removing them is because you are able to set these same behaviors through managed settings. Which is probably better than us pre-seeding it for all users in this hacky unobservable way.

Although I think we should probably test this a bit more before committing since we want to make sure this won't introduce too big of a behavioral shift in the module for users who have this running in a task workflow.

This serves the standalone mode, which we need to set anyway when a user provides a workdir. I don't see how that would work if we remove this. I am all good if we can do it more systematically. But if a user starts Claude via coder_script in a specific workdir, they should not be greeted with a config wizard.

You know I think you are right here. These are mostly just for the dialogue boxes unless they get suppressed now somehow.

DevelopmentCats · 2026-04-28T16:02:12Z

+    managed_settings = {
+      permissions = {
+        defaultMode                  = "acceptEdits"
+        disableBypassPermissionsMode = "disable"
+        deny                         = ["Bash(rm -rf*)"]


@matifali for reference this is how you would pass similar behavior through managed settings rather than pre-seeding it.

So essentially someone could set defaultMode=auto and same with the rest for claude-code running for tasks and this would work over even the settings.json

DevelopmentCats · 2026-04-28T16:10:50Z

Everything looks good here for me @morganl-ant I will go ahead and test this and approve it from my end once done.

DevelopmentCats · 2026-04-28T18:18:54Z

@morganl-ant @matifali

I have tested this and it works properly with agentapi/tasks provided you do the following in the new module

  claude_managed_settings = {
    permissions = {
      defaultMode = "bypassPermissions"
      allow       = ["*"]
      deny        = []
    }
    # Skip the first-run theme picker / onboarding prompts.
    theme                  = "dark"
    hasCompletedOnboarding = true
  }

matifali · 2026-04-28T18:22:37Z

@DevelopmentCats, I guess we can safely remove (deprecate) the workdir input then.

DevelopmentCats · 2026-04-28T18:24:37Z

@DevelopmentCats, I guess we can safely remove (deprecate) the workdir input then.

Yeah we definitely can if the only thing that was holding us back was project level configs.

Resolve conflict in main.test.ts: keep both managed-settings tests (from this PR) and telemetry tests (from coder#862/main).

DevelopmentCats · 2026-04-29T19:00:48Z

@matifali I think we are good to merge this. If we decide later that we want to add back the part where we auto fill the config info the managed settings to bypass the prompts by default, but its probably fine to let the users or administrator decide what they need for the managed settings in the module to make it perform how they'd like. Especially with the move to agents.

matifali · 2026-04-29T19:19:05Z

@DevelopmentCats Can you test the coder_app example use case? If it can start Claude without user needing to do anything I am fine merging this.

DevelopmentCats · 2026-04-29T19:19:54Z

@DevelopmentCats Can you test the coder_app example use case? If it can start Claude without user needing to do anything I am fine merging this.

Yeah I will test and provide a picture

matifali · 2026-04-29T19:22:47Z

@DevelopmentCats can also update example with required settings (if needed)

DevelopmentCats · 2026-04-29T20:12:23Z

@morganl-ant Is there a way to suppress either of these Claude-Code CLI alerts through a setting that can be done through managed_settings?

morganl-ant mentioned this pull request Apr 22, 2026

RFC: claude-code task status via lifecycle hooks instead of system-prompt + MCP #867

Open

morganl-ant marked this pull request as ready for review April 22, 2026 20:57

matifali added the version:minor Add to PRs requiring a minor version upgrade label Apr 23, 2026

morganl-ant force-pushed the anthropic/managed-settings branch from 913224b to 4b83931 Compare April 27, 2026 23:26

matifali approved these changes Apr 28, 2026

View reviewed changes

matifali mentioned this pull request Apr 28, 2026

feat(claude-code): add api_key_helper for short-lived credentials; mark anthropic_api_key sensitive #865

Open

DevelopmentCats reviewed Apr 28, 2026

View reviewed changes

DevelopmentCats mentioned this pull request Apr 29, 2026

feat(claude-code): add transcript_retention_days and Stop-hook idle sentinel #866

Open

Merge branch 'main' into anthropic/managed-settings

7bd449d

Resolve conflict in main.test.ts: keep both managed-settings tests (from this PR) and telemetry tests (from coder#862/main).

docs(claude-code): bump version references in README to 5.2.0

3b399bb

DevelopmentCats added version:minor Add to PRs requiring a minor version upgrade and removed version:minor Add to PRs requiring a minor version upgrade labels Apr 29, 2026

		.autoModeAccepted = true \|
		.bypassPermissionsModeAccepted = true \|

Conversation

morganl-ant commented Apr 22, 2026

Problem

Change

Relationship to #861

Validation

Uh oh!

matifali commented Apr 25, 2026

Uh oh!

morganl-ant commented Apr 27, 2026

Uh oh!

matifali left a comment

Choose a reason for hiding this comment

Uh oh!

matifali Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

DevelopmentCats Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

matifali Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

DevelopmentCats Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

DevelopmentCats Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

DevelopmentCats commented Apr 28, 2026

Uh oh!

DevelopmentCats commented Apr 28, 2026

Uh oh!

matifali commented Apr 28, 2026

Uh oh!

DevelopmentCats commented Apr 28, 2026

Uh oh!

DevelopmentCats commented Apr 29, 2026

Uh oh!

matifali commented Apr 29, 2026

Uh oh!

DevelopmentCats commented Apr 29, 2026

Uh oh!

matifali commented Apr 29, 2026

Uh oh!

DevelopmentCats commented Apr 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

DevelopmentCats Apr 28, 2026 •

edited

Loading

DevelopmentCats Apr 28, 2026 •

edited

Loading