chore(claude): drop the no-op Write() twin of the treesitter deny
A Write(<path>) permission rule matches nothing. File permission checks consult only Edit(<path>) rules, which already cover every file-editing tool — Write, Edit and NotebookEdit alike. Claude Code now warns about the dead shape at session start. The Edit() rule directly above this one was doing the whole job, so the grammars were never unprotected and nothing changes here but the warning. Worth noting the general hazard though: a permission rule that silently matches nothing is indistinguishable from one that works, which is the same failure mode as the git prefix-pattern bypass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -39,7 +39,6 @@
|
|||||||
],
|
],
|
||||||
"deny": [
|
"deny": [
|
||||||
"Edit(//var/mnt/data/projects/treesitter/**)",
|
"Edit(//var/mnt/data/projects/treesitter/**)",
|
||||||
"Write(//var/mnt/data/projects/treesitter/**)",
|
|
||||||
"Bash(rm -rf /*)",
|
"Bash(rm -rf /*)",
|
||||||
"Bash(rm -rf ~*)",
|
"Bash(rm -rf ~*)",
|
||||||
"Bash(rm -rf $HOME*)",
|
"Bash(rm -rf $HOME*)",
|
||||||
|
|||||||
Reference in New Issue
Block a user