claude adapter: let a workspace's .claude/settings.json widen headless --allowedTools

[matttready]

Claude Code -p gates non-safe Bash on the --allowedTools flag only — it does not read project settings files for that decision (verified 2.1.258). So a scheduled headless run whose Issue needs a project-specific command (a committed wrapper, git push, alice-workspace inbox push) hits an auto-denied approval prompt with nobody to answer it, and fails silently.

composeHeadlessCommand now reads <cwd>/.claude/settings.json permissions.allow and appends its Bash(...) / mcp__* entries to the locked four-shim list. Opt-in per workspace by committing that file; workspaces that ship none are unchanged. sandbox is intentionally not forwarded.

Tests: ai-config.spec.ts gains merge + malformed-file cases; tsc clean, 107 pass.

Suggested labels: workflow:parallel, theme:safety, area:settings, area:workspace, review:deep.

🤖 Generated with Claude Code

[vercel]

Someone is attempting to deploy a commit to the luokerenx4's Team Team on Vercel.

A member of the Team first needs to authorize it.

[matttready]

Gentle nudge — this one is small (1 source file + tests) and unblocks a real operational failure.

What breaks without it: a scheduled/headless harness run (claude -p) whose Issue needs a project-specific command — a committed wrapper script, git push, alice-workspace inbox push — hits an auto-denied permission prompt with nobody to answer it, and the run fails silently. Claude Code -p decides the non-safe Bash surface from the --allowedTools flag alone; it does not read .claude/settings.json permissions.allow for that gate (verified against 2.1.258).

Fix: composeHeadlessCommand reads <cwd>/.claude/settings.json permissions.allow and appends its Bash(...) / mcp__* entries to the locked shim list. A workspace opts in by committing that file; workspaces that ship none are unchanged. sandbox is intentionally not forwarded.

Verified end-to-end in production: with the workspace file in place, previously-blocked scheduled paper-trading bots (bash run_live.sh …, python3 <bot>/runner.py …) fired on schedule and executed. npx tsc --noEmit clean, ai-config.spec.ts +2 cases (107 pass).

CI hasn't run — looks like it needs a maintainer to approve the workflow for this fork PR (the only check showing is an unrelated Vercel deploy-preview auth failure).