Update Claude Code permissions

[erawat]

Automated update of .claude/settings.json from dev-ai-playbooks.

This is a full overwrite of the permissions file (allow + deny lists) to keep
this repo's Claude Code permissions in sync with the canonical template. If
this repo has custom allow entries not present in dev-ai-playbooks (e.g.
phpunit, npm, or other project-specific commands), check the diff before
merging -- they will be removed by this PR and need to be re-added by hand.

Source checksum: 8cd91c129334

---

This PR was created automatically. It only affects what Bash commands Claude
Code can run in this repo -- no application code is changed.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request performs an automated synchronization of the Claude Code configuration file. It updates the allowed and denied Bash command patterns to ensure the repository adheres to current security best practices defined in the central dev-ai-playbooks, effectively hardening the environment against accidental destructive operations.

Highlights

• Permission Synchronization: Updated .claude/settings.json to align with the canonical dev-ai-playbooks template.
• Enhanced Security: Expanded the deny list to include various destructive rm patterns and specific forced push variations.
• Command Allowlist Adjustments: Refined git status permissions and added git push capabilities to the allowlist.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Generative AI Prohibited Use Policy, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request updates the Claude settings to allow certain git push commands while adding specific deny rules for force pushes and recursive file removals. The review feedback identifies a critical security vulnerability where git push could be exploited for command injection via the --exec or --receive-pack flags, and suggests expanding the rm deny list to cover additional destructive command combinations.

[gemini-code-assist]

BLOCKER: Allowing git push* without restricting --exec and --receive-pack flags introduces a critical security vulnerability.

An agent can execute arbitrary local bash commands by running git push with the --exec or --receive-pack option pointing to a local repository path (e.g., git push --exec="id" .). Since git push* is in the allow list, this command would be executed automatically without user prompting.

Please add explicit deny rules for --exec and --receive-pack to prevent this command-injection vector.

      "Bash(git push* --force*)",
      "Bash(git push* +*)",
      "Bash(git push* -f*)",
      "Bash(git push* -uf*)",
      "Bash(git push* -vf*)",
      "Bash(git push* -qf*)",
      "Bash(git push* -nf*)",
      "Bash(git push* -df*)",
      "Bash(git push* --exec*)",
      "Bash(git push* --receive-pack*)"

References

1. Section 2 (Security): Parameterized queries used, all user input validated/escaped before use, no hardcoded secrets. ^(link)

[gemini-code-assist]

WARNING: The current rm deny list does not cover several common recursive/force delete combinations, such as using --force with -r/-R or --recursive. This allows Claude to potentially prompt for or execute destructive commands like rm -r --force or rm --force -r.

Additionally, please note that simple glob matching is sensitive to whitespace; extra spaces (e.g., rm -rf) can bypass these rules.

Let's expand the deny list to cover these additional --force combinations.

      "Bash(rm -rf*)",
      "Bash(rm -fr*)",
      "Bash(rm -Rf*)",
      "Bash(rm -fR*)",
      "Bash(rm -r -f*)",
      "Bash(rm -f -r*)",
      "Bash(rm -R -f*)",
      "Bash(rm -f -R*)",
      "Bash(rm --recursive*)",
      "Bash(rm -r --force*)",
      "Bash(rm -R --force*)",
      "Bash(rm --force -r*)",
      "Bash(rm --force -R*)",
      "Bash(rm --force --recursive*)",
      "Bash(rm --recursive --force*)"

References

1. Section 4 (Code Quality): Naming is clear, self-documenting, and follows project conventions. ^(link)