jpmschweitzerandClaude Opus 5
16348e2e89
A Write(<path>) permission rule matches nothing. File permission checks consult only Edit(<path>) rules, which already cover every file-editing tool — Write, Edit and NotebookEdit alike. Claude Code now warns about the dead shape at session start. All eight removed here sat directly beside their Edit() twin, so the allow grant over the repo tree and the ask gates guarding settings and hook files kept working throughout. Behaviour is unchanged. That ask block remains the pattern worth copying to the other repos in this tree — it is the only one that stops an agent quietly widening its own permissions, and it has to be ask rather than deny to stay fixable. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
125 lines
3.0 KiB
JSON
125 lines
3.0 KiB
JSON
{
|
|
"env": {
|
|
"CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS": "1"
|
|
},
|
|
"teammateMode": "auto",
|
|
"permissions": {
|
|
"allow": [
|
|
"Bash(git add *)",
|
|
"Bash(git commit *)",
|
|
"Bash(git push *)",
|
|
"Bash(git fetch *)",
|
|
"Bash(git merge *)",
|
|
"Bash(git pull *)",
|
|
"Bash(git status *)",
|
|
"Bash(git log *)",
|
|
"Bash(git diff *)",
|
|
"Bash(git show *)",
|
|
"Bash(git checkout *)",
|
|
"Bash(git stash *)",
|
|
"Bash(git branch *)",
|
|
"Bash(git worktree *)",
|
|
"Bash(git config *)",
|
|
"Bash(git mv *)",
|
|
"Bash(git rm *)",
|
|
"Bash(git ls-tree *)",
|
|
"Bash(git rev-parse --show-toplevel)",
|
|
|
|
"Bash(tooling/db/audio-generate *)",
|
|
"Bash(tooling/db/audio-health)",
|
|
"Bash(tooling/db/audio-post *)",
|
|
"Bash(tooling/db/audio-batch *)",
|
|
|
|
"Bash(make *)",
|
|
"Bash(make)",
|
|
|
|
"Bash(pql)",
|
|
"Bash(pql *)",
|
|
|
|
"Bash(tea *)",
|
|
"Bash(tooling/tea-comment *)",
|
|
"Bash(tooling/worktree-setup:*)",
|
|
|
|
"Bash(cargo test *)",
|
|
"Bash(cargo test)",
|
|
"Bash(cargo build *)",
|
|
"Bash(cargo build)",
|
|
"Bash(cargo check *)",
|
|
"Bash(cargo check)",
|
|
"Bash(cargo clippy *)",
|
|
"Bash(cargo clippy)",
|
|
"Bash(ruff check *)",
|
|
"Bash(ruff check)",
|
|
"Bash(tests/run-*)",
|
|
|
|
"Bash(godot4:*)",
|
|
"Bash(gdformat:*)",
|
|
"Bash(tooling/atlas:*)",
|
|
"Bash(tooling/validate-ron:*)",
|
|
"Bash(tooling/godot-cold-parse:*)",
|
|
"Bash(tooling/pr-watchlist-diff:*)",
|
|
|
|
"Bash(chmod *)",
|
|
"Bash(ls *)",
|
|
"Bash(find *)",
|
|
"Bash(list *)",
|
|
"Bash(tree *)",
|
|
"Bash(sed -n *)",
|
|
|
|
"Read(//var/mnt/data/projects/settled-reach/**)",
|
|
"Edit(//var/mnt/data/projects/settled-reach/**)",
|
|
"Read(//tmp/**)",
|
|
"Grep",
|
|
"Glob",
|
|
|
|
"Skill(git-commit)",
|
|
"Skill(whats-next)",
|
|
"Skill(pr-process)",
|
|
"Skill(pr-review)",
|
|
"Skill(ticket)",
|
|
"Skill(workshop-start)"
|
|
],
|
|
"deny": [
|
|
"Bash(git push --force *)",
|
|
"Bash(git push --force:*)",
|
|
"Bash(git push --force)",
|
|
"Bash(git reset --hard *)",
|
|
"Bash(git reset --hard:*)",
|
|
"Bash(git reset --hard)",
|
|
"Bash(git clean -f *)",
|
|
"Bash(git clean -f:*)",
|
|
"Bash(git clean -f)",
|
|
"Bash(rm -rf *)",
|
|
"Bash(rm -rf:*)"
|
|
],
|
|
"ask": [
|
|
"Edit(.claude/settings.json)",
|
|
"Edit(.claude/settings.local.json)",
|
|
"Edit(.claude/hooks/**)",
|
|
"Edit(.config/hooks/**)",
|
|
"Edit(.worktrees/**/.claude/settings.json)",
|
|
"Edit(.worktrees/**/.claude/hooks/**)",
|
|
"Edit(.worktrees/**/.config/hooks/**)"
|
|
]
|
|
},
|
|
"hooks": {
|
|
"PreToolUse": [
|
|
{
|
|
"matcher": "Bash",
|
|
"hooks": [
|
|
{
|
|
"type": "command",
|
|
"command": ".claude/hooks/git-lock-guard.sh",
|
|
"timeout": 5
|
|
},
|
|
{
|
|
"type": "command",
|
|
"command": ".claude/hooks/git-centralize-guard.sh",
|
|
"timeout": 5
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|