[themouette]

Summary

Improves capability security context to be more concise, actionable, and user-friendly. Reduces verbose warnings while adding critical runtime checks to prevent common issues.

Changes

Security Context Improvements

• Reduced verbosity: Security warnings reduced from 5-10 lines to 1-2 lines per capability
• Tone shift: Changed from prohibitive ("NEVER do X") to informative guidance
• Token efficiency: Net reduction of 23 lines across all capabilities

Affected capabilities:

• chromium: 13 lines → 3 lines (removed usage examples, kept essential warning)
• docker: 5 lines → 2 lines (focused on key risks: --privileged, socket mounting)
• gh: 4 lines → 2 lines (scopes and verification reminder)
• node: 5 lines → 2 lines (npm audit and review guidance)
• python: 5 lines → 2 lines (venv and review guidance)
• rust: 5 lines → 2 lines (cargo audit and build.rs warning)
• gpg: 6 lines → 2 lines (socket forwarding explanation)
• network-isolation: Removed aggressive "NEVER/DO NOT" language, kept policy info

Git Capability Enhancements

1. SSH Agent Detection

• Checks SSH_AUTH_SOCK availability at runtime
• Warns Claude NOT to reconfigure remotes or change URLs when SSH unavailable
• Provides clear guidance: ask user to push from host or enable SSH forwarding with claude-vm -A agent
• Problem solved: Prevents Claude from breaking remote configurations when trying to "fix" push issues

2. GPG Key Cache Check

• Fast, non-blocking check using --batch --pinentry-mode cancel + timeout 1 (< 1 second)
• Detects if GPG key is cached to prevent 30-second commit hangs
• Warns Claude upfront if key is not cached
• Problem solved: Prevents terrible UX of 30s timeout when committing with locked key

3. Conditional Signing Warning

• Signing warning only appears when commit.gpgsign = true
• Avoids confusion in projects without GPG signing
• Acknowledges that cache status is at startup and may expire during session

Benefits

• ✅ Better UX: Prevents 30s commit hangs with GPG key cache check
• ✅ Protects remotes: SSH agent detection prevents configuration mistakes
• ✅ More concise: Reduced token usage while maintaining security awareness
• ✅ More helpful: Informative guidance instead of prohibitive commands
• ✅ Context-aware: Conditional warnings only when relevant

Testing

Generated example context with all capabilities enabled to verify:

• All security context is concise and actionable
• SSH agent warning appears when SSH unavailable
• GPG key cache status shown when signing enabled
• No false confidence about key status (labeled "checked at startup")