chore(claude): add read-only permission allowlist#88
Merged
Conversation
Scanned the 50 most recent session transcripts for repeated tool calls. Nearly all of the observed Bash traffic is already auto-allowed by Claude Code (echo/grep/ls/head/git status/git log/gh pr view/...), so only three patterns clear the bar of "repeated, read-only, and not already allowed". Deliberately excluded: awk, python3, bash, powershell.exe, just, deno, idris2 (interpreters / task runners — a wildcard on any of these is equivalent to allowing arbitrary code execution), and all mutating commands (rm, cp, mkdir, chmod, tee, git add/commit/push/worktree). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
🔍 Hypatia Security ScanFindings: 282 issues detected
View findings[
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/auth-method-batch-fix/main.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/category-batch-fix/main.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/missing-fields-batch-fix/main.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/cartridge-minter/mint.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/validate-cartridges/main.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/validate-cartridges/main_test.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/code-quality/sanctify-mcp/adapter/mod.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/infrastructure/hesiod-mcp/adapter/mod.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/research/bofig-mcp/adapter/mod.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/research/academic-workflow-mcp/adapter/mod.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
hyperpolymath
marked this pull request as ready for review
July 17, 2026 10:42
hyperpolymath
enabled auto-merge (squash)
July 17, 2026 10:42
hyperpolymath
disabled auto-merge
July 17, 2026 10:42
🔍 Hypatia Security ScanFindings: 282 issues detected
View findings[
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/auth-method-batch-fix/main.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/category-batch-fix/main.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/missing-fields-batch-fix/main.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/cartridge-minter/mint.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/validate-cartridges/main.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/validate-cartridges/main_test.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/code-quality/sanctify-mcp/adapter/mod.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/infrastructure/hesiod-mcp/adapter/mod.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/research/bofig-mcp/adapter/mod.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/research/academic-workflow-mcp/adapter/mod.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
hyperpolymath
added a commit
that referenced
this pull request
Jul 17, 2026
…y) (#92) Follow-up to #88 (read-only permission allowlist, merged). A second `/fewer-permission-prompts` pass over the 50 most-recent transcripts (2,132 Bash calls) surfaced two more repeated, read-only, not-already-allowed, non-arbitrary-execution entries: | Pattern | Count | Notes | |---------|-------|-------| | `Bash(actionlint *)` | 16 | GitHub Actions workflow linter — pure static analysis, no execution; heavily used by the ongoing CI/CD cleanup campaign | | `mcp__claude-in-chrome__get_page_text` | 3 | read-only page-text read | Deliberately excluded (same discipline as #88): mutation (`rm`, `git add/commit/push`, `cp`, `mkdir`, `chmod`), arbitrary execution (`python3`, `awk`, `bash`, `powershell.exe`, `idris2`, `zig`, `just`, `curl`), and `asciidoctor *` (it *writes* rendered output — only the already-listed `asciidoctor --version` is read-only). Base `.claude/settings.json` already carried the three #88 entries; this adds two, no removals. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds
.claude/settings.jsonwith a smallpermissions.allowlist, derived from scanning the 50 most-recently-modified session transcripts (~1,734 Bash calls) in~/.claude/projects/.Bash(uuidgen *)Bash(git ls-tree *)Bash(asciidoctor --version)Why the list is short
The scan's main finding is that the allowlist was never the bottleneck. After filtering, almost all repeated Bash traffic falls into one of three buckets:
echo,grep/rg,ls,head/tail,wc,find,sed,sort,jq, plus every read-onlygit(status,log,diff,show,branch,worktree list) andgh(pr view,repo view,apiGET) subcommand. These never prompt, so an entry would be inert.rm(86),git add(55),git commit(50),cp(49),git push(45),mkdir(41),chmod,tee. Excluded by design.awk(73),python3(60),bash(48),powershell.exe(27),just(17),deno,idris2. Excluded on principle: a wildcard on any interpreter or task runner grants the same power as a shell.awkis the notable judgement call — it's the single most-used non-auto-allowed command, butawkhassystem()andprint > file, which makesBash(awk *)an arbitrary-execution grant rather than a text-processing one.Two things worth a look
Bash(python3 *)is already allowed in.claude/settings.local.json. That is a standing arbitrary-code-execution grant. Worth removing if it wasn't a deliberate trade.settings.local.jsonhas ~15 one-offrgentries (Bash(rg -rn "sustainabot" -i /path -l)and similar) — exact-command approvals that will never match a second time. They're harmless but dead weight;rgis auto-allowed anyway.Scope
No
deny/askentries; no other settings touched..claude/settings.jsonis tracked (only*.local.jsonis gitignored), so this applies to anyone cloning the repo.🤖 Generated with Claude Code