chore(config): allow Bash(pql) in the permission allowlist (phase 4)

Completes the Phase 4 consumer cutover: adds Bash(pql) / Bash(pql *) to
.claude/settings.json so the pql workflow runs without prompts. Added manually by
the lead — the auto-mode classifier blocks an agent from self-widening wildcard Bash
permissions even via /update-config (a deliberate security boundary).

SR_DB_PATH and the Bash(tooling/db/*) allowlist stay until Phase 6 (rollback path).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

This commit is contained in:

jpmschweitzer

2026-06-06 13:07:22 +02:00

co-authored by

Claude Opus 4.8

parent 943f2e7749

commit c03a75e4c0

1 changed files with 3 additions and 0 deletions

									
										.claude/settings.json
									
		+3
		
												View File
												
				@@ -42,6 +42,9 @@

				      "Bash(make *)",

				      "Bash(make)",

				      "Bash(pql)",

				      "Bash(pql *)",

				      "Bash(tea *)",

				      "Bash(tooling/tea-comment *)",