fix(sandbox): allow writes to plugin cache for uv-based hooks

technicalpickles · claude · technicalpickles · commit df71e046eb0f · 2026-04-07T16:18:32.000-04:00
Plugin hooks (tool-routing, buildkite) use `uv run` which needs to
create a .venv inside ~/.claude/plugins/cache/. Without write access,
every Bash tool call triggers PreToolUse hook errors.

Co-Authored-By: Claude Opus 4.6 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/claude/roles/base.jsonc b/claude/roles/base.jsonc
@@ -107,7 +107,9 @@
       "allowWrite": [
         // interactive terminals for things like lefthook interactive
         "/dev/ptmx",
-        "/dev/ttys*"
+        "/dev/ttys*",
+        // plugin hooks use uv run which needs to create .venv in cache
+        "~/.claude/plugins/cache"
       ]
     }
   },

Original file line number	Diff line number	Diff line change
`@@ -107,7 +107,9 @@`
`107`	`107`	`"allowWrite": [`
`108`	`108`	`// interactive terminals for things like lefthook interactive`
`109`	`109`	`"/dev/ptmx",`
`110`		`- "/dev/ttys*"`
	`110`	`+ "/dev/ttys*",`
	`111`	`+ // plugin hooks use uv run which needs to create .venv in cache`
	`112`	`+ "~/.claude/plugins/cache"`
`111`	`113`	`]`
`112`	`114`	`}`
`113`	`115`	`},`