[potiuk]

Summary

• setup_preflight.isolated.configured() counted sandbox.enabled in ~/.claude/settings.local.json. Claude Code loads a settings.local.json only from a project's .claude/, so that value sandboxes nothing and the check reported an unsandboxed machine as configured.
• configured() now reads only ~/.claude/settings.json at user scope. This reverses fix(setup): read the user's settings.local.json when checking for the isolated setup #1763, which added the read to match the status line; fix(agent-isolation): stop the status line reading ~/.claude/settings.local.json #1971 already removed it from the status line.
• isolated-setup-verify check 6 drops the file from its walk and reports ✗ when the sandbox is enabled only there, with the move-it remedy in remediation.md, so the affected user gets a cause rather than only the banner. The complete-upgrade out-of-sandbox read drops it too.
• The host-socket snippet in secure-agent-setup.md and the sandbox-diagnostics and adoption-and-setup specs follow.

Type of change

• Skill change (.claude/skills/<name>/) — eval fixtures updated below
• Python package (tools/*/ with pyproject.toml)
• Documentation (docs/, README.md, CONTRIBUTING.md)
• Other: the setup_preflight package shipped in the magpie-setup plugin

Test plan

• prek run --all-files: every hook passes except workspace pytest, where 4 tests in tools/agent-isolation/tests/test_gpg_touch_overlay.py fail locally; this PR does not touch that code
• prek run --files <changed files> passes
• uv run --project tools/setup-preflight pytest tools/setup-preflight/tests: 439 passed
• test_a_sandbox_only_in_the_user_settings_local_is_not_configured fails without the fix
• setup-complete-upgrade evals: 18 of 18 pass
• setup-isolated-setup-verify evals: 38 of 39 pass in the final full run, including the new case-25-sandbox-only-in-unloaded-file and the fixed case-23. case-7 failed on grader wording about SSH_AUTH_SOCK and passed on rerun alone. All runs are in the journals

RFC-AI-0004 compliance

• Sandbox — no new host access; configured() reads one file fewer

Linked issues

Refs #1763, #1971

Notes for reviewers (optional)

case-23 listed the gateway hooks in ~/.claude/settings.local.json and expected check 12a to pass, which contradicts check 12a itself, so the fixture now lists them in ~/.claude/settings.json.

configured() still returns early on a non-empty isolated_setup stamp, before it reads any settings, so a machine with a stamp reports configured whatever its settings say. It also ORs project and user scope, so a project enabled: false does not override a user true, and in a linked worktree it reads the worktree's settings rather than the main checkout's. All three are older than this PR and left for separate changes.

🤖 Generated with Claude Code