claude-code - 💡(How to fix) Fix Write deny rules not enforced via managed settings (.mobileconfig) [2 comments, 2 participants]

TL;DR

The Write deny rules for .env files are not being enforced, suggesting a potential issue with the rule parsing or application for write operations.

Guidance

• Review the parsing logic for Write deny rules to ensure it correctly interprets the **/.env and **/.env.* patterns.
• Verify that the Write deny rules are being applied at the correct level, considering the scope of the .mobileconfig profile and the com.anthropic.claudecode preference domain.
• Compare the implementation of Bash deny rules with Write deny rules to identify any discrepancies that might explain why Bash rules are enforced while Write rules are not.
• Test the Write deny rules with simpler patterns (e.g., Write(.env)) to see if the issue is related to the pattern complexity.
• Consider reopening or referencing related issues (#6699, #24846) to ensure that all aspects of deny rule enforcement have been addressed.

Example

No specific code example can be provided without more context on the implementation details of the deny rule parser and enforcer.

Notes

The issue seems to be specific to the Write deny rules and does not affect Bash deny rules, suggesting a targeted fix might be necessary. The environment and configuration (macOS 15, Claude Code latest, .mobileconfig managed settings) should be considered when troubleshooting.

Recommendation

Apply a workaround by manually configuring Write deny rules through an alternative method (if available) until the issue can be fully resolved, as the current implementation seems to have inconsistencies between Bash and Write rule enforcement.