jpmschweitzerandClaude Opus 5
1eb30a1460
Bash(reach) and Bash(reach *) join .claude/settings.json beside the pql pair. Two entries, not the one the ticket asked for: a rule ending in " *" does not match the bare word, and bare `reach` is a real invocation now that it prints the domain list. pql, make, cargo test and ruff check each carry a bare-form entry alongside the wildcard for exactly this reason, and adding only the wildcard would have left `reach` prompting while `reach check ...` did not. This is the line Q-124 was actually filed about. Ten hand-written Bash(tooling/...) entries each cover a single script and every unlisted tool prompts; one command with subcommands is one rule covering everything. The ten stay for now — the old scripts are still the working tools until T-1253. On verification, since the ticket warned specifically against declaring this done on the wrong evidence: real calls run clean, but that is NOT proof the rule matched. The same calls succeeded before the rule existed — there was no Bash(reach ...) entry in either settings file and no blanket grant — so the session was already permitting them and the observation cannot distinguish "the rule matched" from "the rule was never consulted". settings.json is read at session start, so this cannot be self-verified from the session that wrote it. Proof is a later session, in a prompting mode, where reach runs without asking. One accepted limitation, documented rather than worked around: rules prefix-match the whole command string, so an env-prefixed call like SR_REPO_ROOT=... reach ... will still prompt. An environment override is a real departure from normal invocation; the ordinary form is what needs to be frictionless. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
128 lines
3.0 KiB
JSON
128 lines
3.0 KiB
JSON
{
|
|
"env": {
|
|
"CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS": "1"
|
|
},
|
|
"teammateMode": "auto",
|
|
"permissions": {
|
|
"allow": [
|
|
"Bash(git add *)",
|
|
"Bash(git commit *)",
|
|
"Bash(git push *)",
|
|
"Bash(git fetch *)",
|
|
"Bash(git merge *)",
|
|
"Bash(git pull *)",
|
|
"Bash(git status *)",
|
|
"Bash(git log *)",
|
|
"Bash(git diff *)",
|
|
"Bash(git show *)",
|
|
"Bash(git checkout *)",
|
|
"Bash(git stash *)",
|
|
"Bash(git branch *)",
|
|
"Bash(git worktree *)",
|
|
"Bash(git config *)",
|
|
"Bash(git mv *)",
|
|
"Bash(git rm *)",
|
|
"Bash(git ls-tree *)",
|
|
"Bash(git rev-parse --show-toplevel)",
|
|
|
|
"Bash(tooling/db/audio-generate *)",
|
|
"Bash(tooling/db/audio-health)",
|
|
"Bash(tooling/db/audio-post *)",
|
|
"Bash(tooling/db/audio-batch *)",
|
|
|
|
"Bash(make *)",
|
|
"Bash(make)",
|
|
|
|
"Bash(pql)",
|
|
"Bash(pql *)",
|
|
|
|
"Bash(reach)",
|
|
"Bash(reach *)",
|
|
|
|
"Bash(tea *)",
|
|
"Bash(tooling/tea-comment *)",
|
|
"Bash(tooling/worktree-setup:*)",
|
|
|
|
"Bash(cargo test *)",
|
|
"Bash(cargo test)",
|
|
"Bash(cargo build *)",
|
|
"Bash(cargo build)",
|
|
"Bash(cargo check *)",
|
|
"Bash(cargo check)",
|
|
"Bash(cargo clippy *)",
|
|
"Bash(cargo clippy)",
|
|
"Bash(ruff check *)",
|
|
"Bash(ruff check)",
|
|
"Bash(tests/run-*)",
|
|
|
|
"Bash(godot4:*)",
|
|
"Bash(gdformat:*)",
|
|
"Bash(tooling/atlas:*)",
|
|
"Bash(tooling/validate-ron:*)",
|
|
"Bash(tooling/godot-cold-parse:*)",
|
|
"Bash(tooling/pr-watchlist-diff:*)",
|
|
|
|
"Bash(chmod *)",
|
|
"Bash(ls *)",
|
|
"Bash(find *)",
|
|
"Bash(list *)",
|
|
"Bash(tree *)",
|
|
"Bash(sed -n *)",
|
|
|
|
"Read(//var/mnt/data/projects/settled-reach/**)",
|
|
"Edit(//var/mnt/data/projects/settled-reach/**)",
|
|
"Read(//tmp/**)",
|
|
"Grep",
|
|
"Glob",
|
|
|
|
"Skill(git-commit)",
|
|
"Skill(whats-next)",
|
|
"Skill(pr-process)",
|
|
"Skill(pr-review)",
|
|
"Skill(ticket)",
|
|
"Skill(workshop-start)"
|
|
],
|
|
"deny": [
|
|
"Bash(git push --force *)",
|
|
"Bash(git push --force:*)",
|
|
"Bash(git push --force)",
|
|
"Bash(git reset --hard *)",
|
|
"Bash(git reset --hard:*)",
|
|
"Bash(git reset --hard)",
|
|
"Bash(git clean -f *)",
|
|
"Bash(git clean -f:*)",
|
|
"Bash(git clean -f)",
|
|
"Bash(rm -rf *)",
|
|
"Bash(rm -rf:*)"
|
|
],
|
|
"ask": [
|
|
"Edit(.claude/settings.json)",
|
|
"Edit(.claude/settings.local.json)",
|
|
"Edit(.claude/hooks/**)",
|
|
"Edit(.config/hooks/**)",
|
|
"Edit(.worktrees/**/.claude/settings.json)",
|
|
"Edit(.worktrees/**/.claude/hooks/**)",
|
|
"Edit(.worktrees/**/.config/hooks/**)"
|
|
]
|
|
},
|
|
"hooks": {
|
|
"PreToolUse": [
|
|
{
|
|
"matcher": "Bash",
|
|
"hooks": [
|
|
{
|
|
"type": "command",
|
|
"command": ".claude/hooks/git-lock-guard.sh",
|
|
"timeout": 5
|
|
},
|
|
{
|
|
"type": "command",
|
|
"command": ".claude/hooks/git-centralize-guard.sh",
|
|
"timeout": 5
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|