From 24237d221754736885ff0fe0cf3756bbe05fb000 Mon Sep 17 00:00:00 2001
From: Jeroen Schweitzer <jpmschweitzer@gmail.com>
Date: Sun, 19 Apr 2026 18:19:40 +0200
Subject: [PATCH] add project permissions: allow git add/commit, deny
 destructive patterns

Shared-scope permissions so anyone cloning the repo inherits the same
safety net. Allow list covers only the two explicit asks (git add, git
commit). Deny list covers the usual destructive-command patterns:
rm -rf on root/home, sudo rm/chmod/chown, mkfs, dd if=, git push --force
variants, git reset --hard, git clean -fd/fdx, git branch -D, chmod 777.

.claude/settings.local.json remains the empty per-user stub.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .claude/settings.json | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 .claude/settings.json

diff --git a/.claude/settings.json b/.claude/settings.json
new file mode 100644
index 0000000..e87252d
--- /dev/null
+++ b/.claude/settings.json
@@ -0,0 +1,31 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(git add *)",
+      "Bash(git commit *)"
+    ],
+    "deny": [
+      "Bash(rm -rf /*)",
+      "Bash(rm -rf ~*)",
+      "Bash(rm -rf $HOME*)",
+      "Bash(sudo rm *)",
+      "Bash(sudo chmod *)",
+      "Bash(sudo chown *)",
+      "Bash(mkfs*)",
+      "Bash(mkfs.*)",
+      "Bash(dd if=*)",
+      "Bash(git push --force*)",
+      "Bash(git push -f*)",
+      "Bash(git push --force-with-lease*)",
+      "Bash(git reset --hard*)",
+      "Bash(git clean -fd*)",
+      "Bash(git clean -fdx*)",
+      "Bash(git clean -ffd*)",
+      "Bash(git branch -D *)",
+      "Bash(git checkout -- *)",
+      "Bash(git restore .*)",
+      "Bash(chmod -R 777 *)",
+      "Bash(chmod 777 *)"
+    ]
+  }
+}