From 850d3d70fc28447ddd72794c2962621af39b9af1 Mon Sep 17 00:00:00 2001
From: Paul Rastoin <45004772+prastoin@users.noreply.github.com>
Date: Tue, 4 Aug 2026 10:11:38 +0200
Subject: [PATCH] chore(codeowners): guard .claude, .mcp.json and CLAUDE.md
 (#23734)

## What

Adds `.claude/`, `.mcp.json` and `CLAUDE.md` to CODEOWNERS.

## Why

These files configure the coding agent that maintainers attach to PRs:
`SessionStart` hooks, MCP servers, and agent instructions. They were
previously outside CODEOWNERS coverage (which only spanned `.github/`
and `.yarnrc.yml`), so a change to any of them could land on `main`
without core-team review.

CODEOWNERS gates merge approval only. It does not affect an unmerged
branch that a session merely checks out, so this closes the "malicious
agent config quietly lands on main" path, not fork-branch execution. It
is one layer, not the whole answer.


<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/23734?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->
---
 .github/CODEOWNERS | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index d1411a274d..28617a1780 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -4,3 +4,6 @@
 /.github/actions/      @charlesBochet @FelixMalfait @Weiko @prastoin @bosiraphael @etiennejouan @ijreilly @martmull @thomtrp
 /.github/dependabot.yml @charlesBochet @FelixMalfait @Weiko @prastoin @bosiraphael @etiennejouan @ijreilly @martmull @thomtrp
 /.yarnrc.yml           @charlesBochet @FelixMalfait @Weiko @prastoin @bosiraphael @etiennejouan @ijreilly @martmull @thomtrp
+/.claude/              @charlesBochet @FelixMalfait @Weiko @prastoin @bosiraphael @etiennejouan @ijreilly @martmull @thomtrp
+/.mcp.json             @charlesBochet @FelixMalfait @Weiko @prastoin @bosiraphael @etiennejouan @ijreilly @martmull @thomtrp
+/CLAUDE.md             @charlesBochet @FelixMalfait @Weiko @prastoin @bosiraphael @etiennejouan @ijreilly @martmull @thomtrp