From 4a8f0884fed10b63783bb4c7b66ea151140798cb Mon Sep 17 00:00:00 2001 From: Jeroen Schweitzer Date: Sat, 8 Aug 2026 15:18:08 +0200 Subject: [PATCH] chore(claude): drop the blanket awk grant MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bash(awk *) traded a single permission prompt for an unbounded write grant — awk writes files via print redirection, so the rule permitted arbitrary filesystem writes under the guise of a text-processing tool. Scripts that call awk internally are unaffected: permission rules match the top-level command string only, so make targets and ci/test.sh keep working. Only direct awk invocation now prompts. Shell glue needed more than once belongs in a named make target that can be allowlisted for what it actually does. Co-Authored-By: Claude Opus 5 (1M context) --- .claude/settings.json | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.claude/settings.json b/.claude/settings.json index ad8060bf..38936081 100644 --- a/.claude/settings.json +++ b/.claude/settings.json @@ -35,8 +35,7 @@ "Bash(pql)", "Bash(pql *)", "Bash(clide)", - "Bash(clide *)", - "Bash(awk *)" + "Bash(clide *)" ], "deny": [ "Edit(//var/mnt/data/projects/treesitter/**)",