From a249fb78e097c9590d4d5a13f287d6c4f1f42f99 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 17 Jul 2026 09:24:07 +0100 Subject: [PATCH] chore(claude): add read-only permission allowlist MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Scanned the 50 most recent session transcripts for repeated tool calls. Nearly all of the observed Bash traffic is already auto-allowed by Claude Code (echo/grep/ls/head/git status/git log/gh pr view/...), so only three patterns clear the bar of "repeated, read-only, and not already allowed". Deliberately excluded: awk, python3, bash, powershell.exe, just, deno, idris2 (interpreters / task runners — a wildcard on any of these is equivalent to allowing arbitrary code execution), and all mutating commands (rm, cp, mkdir, chmod, tee, git add/commit/push/worktree). Co-Authored-By: Claude Opus 4.8 --- .claude/settings.json | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 .claude/settings.json diff --git a/.claude/settings.json b/.claude/settings.json new file mode 100644 index 0000000..19948e6 --- /dev/null +++ b/.claude/settings.json @@ -0,0 +1,9 @@ +{ + "permissions": { + "allow": [ + "Bash(uuidgen *)", + "Bash(git ls-tree *)", + "Bash(asciidoctor --version)" + ] + } +}