configure-ai-agents adds google-analytics to Claude Code's sandbox network allowlist despite `analytics: false`

[mapleberry]

Current Behavior

nx configure-ai-agents --agents claude unconditionally appends www.google-analytics.com to sandbox.network.allowedDomains in .claude/settings.json, without checking whether the workspace has opted out of analytics.

My nx.json contains:

{
  "analytics": false
}

Running the command still produced:

   "hooks": { ... }
+  },
+  "sandbox": {
+    "network": {
+      "allowedDomains": ["www.google-analytics.com"]
+    }
   }
 }

The write happens in nx/src/ai/set-up-ai-agents/set-up-ai-agents.ts. The only condition guarding it is an idempotency check — is the domain already in the list — with no reference to the analytics setting:

sandbox: {
  ...json.sandbox,
  network: {
    ...json.sandbox?.network,
    allowedDomains: json.sandbox?.network?.allowedDomains?.includes(analyticsDomain)
      ? json.sandbox.network.allowedDomains
      : [...(json.sandbox?.network?.allowedDomains ?? []), analyticsDomain],
  },
},

analyticsDomain is defined in nx/src/ai/constants.ts as the GA4 Measurement Protocol host for Nx telemetry.

Expected Behavior

If the workspace has opted out of analytics ("analytics": false in nx.json, or the equivalent env/global opt-out), configure-ai-agents should not add the analytics host to the sandbox network allowlist. There is no reason to open a network path for events that will not be sent.

Two things make this worth guarding rather than leaving as harmless dead config:

1. It silently widens a security boundary. sandbox.network.allowedDomains is Claude Code's egress control. Entries are not scoped to Nx — allowlisting www.google-analytics.com permits any process in that sandbox to reach it, not just Nx's telemetry.
2. It contradicts an explicit user decision, in a tracked, committed project file. A setup command overriding a stated opt-out is surprising regardless of practical impact.

A note in the command's output when it does add the entry would also help; right now the only signal is the diff.

GitHub Repo

No response

Steps to Reproduce

1. In a workspace with "analytics": false in nx.json, and no sandbox key in .claude/settings.json
2. Run nx configure-ai-agents --agents claude --no-interactive
3. git diff .claude/settings.json — the sandbox.network.allowedDomains block has been added

Nx Report

Node           : 24.3.0
OS             : darwin-x64
Native Target  : x86_64-macos
pnpm           : 10.33.0
daemon         : Available

nx                     : 23.1.0
@nx/js                 : 23.1.0
@nx/eslint             : 23.1.0
@nx/workspace          : 23.1.0
@nx/devkit             : 23.1.0
@nx/module-federation  : 23.1.0
@nx/playwright         : 23.1.0
@nx/react              : 23.1.0
@nx/rollup             : 23.1.0
@nx/vite               : 23.1.0
@nx/vitest             : 23.1.0
@nx/web                : 23.1.0
typescript             : 6.0.2
---------------------------------------
Registered Plugins:
@nx/eslint/plugin
@nx/vite/plugin
@nx/vitest

Failure Logs

No response

Package Manager Version

pnpm 10.33.0

Operating System

• macOS
• Linux
• Windows
• Other