For production repos, start with read/edit only and add shell when needed.
Deny network tools unless the task explicitly requires installs or API calls.
Re-state the allowlist at the top of long sessions after compacting.
If a tool prompt loops, stop and tighten the policy instead of approving blindly.
Smoke-test one small edit after changing tool permissions.
Change one variable at a time and confirm what actually helped.
If a company policy is involved, rule that out before chasing client settings.
Write the working steps into a short checklist for next time.
Export or screenshot a good setup so reinstalls are faster.
If it still flakes, retest on a clean network such as phone hotspot.