fix(agent-isolation): stop the status line reading ~/.claude/settings.local.json - #1971

Summary

• sandbox-status-line.sh walked ~/.claude/settings.local.json before ~/.claude/settings.json and stopped at the first file that sets sandbox.enabled. Claude Code does not load a settings.local.json from the home directory (the guide already says so for the container-gateway hooks, see fix(agent-isolation): wire the container-gateway hooks where Claude Code loads them #1921), so a stale enabled: true there made the footer show [sandbox] / [sandbox-auto] for a session with no sandbox.
• The file is dropped from the walk; the script header, the section-5 comment and the precedence list in docs/setup/secure-agent-setup.md say why.
• Seen on a real machine: a synced ~/.claude/settings.json lost sandbox.enabled, the only remaining enabled: true sat in ~/.claude/settings.local.json, and the footer showed [sandbox-auto] while a sandboxed touch ~/x succeeded and ~/.aws/credentials was readable. Both were denied once /sandbox wrote the project file.

Type of change

• Python package (tools/*/ with pyproject.toml) — tools/agent-isolation script and tests
• Documentation (docs/, README.md, CONTRIBUTING.md)

Test plan

• Two new tests in TestSandboxTag: test_home_settings_local_is_not_read (only the home settings.local.json enables the sandbox) and test_home_settings_local_does_not_shadow_settings_json (it says true, ~/.claude/settings.json says false). Both fail on main and pass with the fix.
• uv run --project tools/agent-isolation pytest tools/agent-isolation/tests/test_sandbox_status_line.py: 17 passed
• prek run --files <changed files>: every hook passes except workspace-pytest, which fails only on three test_gpg_touch_overlay.py tests (test_wrapped_signer_record_is_cleaned_up[group-signal|dead-owner-sweep], test_failed_signer_publication_preserves_input_status_and_reminder). They fail the same way on unmodified main on this machine (macOS), so they are unrelated to this change.
• The isolated-setup-fingerprint hook regenerated FRAMEWORK_FINGERPRINT, since tools/agent-isolation/ changed.

RFC-AI-0004 compliance

• Sandbox — no new host access; the status line reads one file fewer, and can no longer report a sandbox that is not there

Linked issues

Refs #1921 (its reviewer notes list this script as a follow-up), Refs #1763

Notes for reviewers (optional)

• fix(setup): read the user's settings.local.json when checking for the isolated setup #1763 made setup_preflight.isolated.configured() read the home settings.local.json "matching the status line"; its evidence was that the footer showed a sandbox. With this fix the footer stops vouching for that file, and configured() has the same wrong assumption. I left it for a separate PR so this one stays to the one script.

🤖 Generated with Claude Code