ArchitektApx auth-guard global-settings
Two-step flow, never skip step 1:
- Dry run and show the user what would change:
${CLAUDE_PLUGIN_ROOT}/bin/auth-guard-apply-settings.sh --dry-run
Exit 0 means everything is already present: tell the user, stop here. Exit 2 means there are pending additions: show them the printed list, briefly grouped (Read rules / Bash rules / sandbox credential files), and ask for confirmation.
- Apply only after the user confirms:
${CLAUDE_PLUGIN_ROOT}/bin/auth-guard-apply-settings.sh
Report the summary line and the backup path it printed.
Notes for your report:
- The merge is additive: existing settings entries are never removed, reordered, or overwritten. A timestamped backup is written before any change.
sandbox.enabledis set totrueif it was not already; mention this when it applies, since it changes how Bash commands run.- Some defaults are opinionated and can break tooling inside sessions: denying
~/.azurebreaksaz,~/.cloudflaredbreaks cloudflared tunnel commands. Mention this if the dry run shows those entries; the user can delete individual rules from settings.json afterwards. - Permission and sandbox changes generally apply to new sessions; suggest a restart to be safe.
Never edit settings.json directly yourself; all changes go through the script.