feat: harden Claude Code permissions around recoverable failure

[bertini36]

Description

The permission rules in .claude/settings.json were tuned for catastrophic system damage while leaving the likelier everyday accidents unguarded. Bash(rm -rf *) made legitimate deletes impossible yet let plain rm file through untouched, since the pattern required the -rf prefix. Discarding uncommitted work and pushing to main had no guard at all.

This reworks the permissions section around one idea: deny only what is unrecoverable, prompt for everything else.

Highlights

Inverted the rm policy. Every non-sudo rm now prompts. The deny list keeps only literal root and home wipes plus sudo rm, the cases with no recovery path.

Closed the uncommitted-work gap. git reset --hard and git clean now prompt. Neither leaves a reflog entry or a reachable object, so a mistake there is unrecoverable in a way that a bad commit is not.

Guarded pushes to protected branches with a hook, not a rule. A permission pattern only sees the command string, so it cannot know which branch a bare git push would land on, which is precisely the dangerous case. .claude/hooks/git-push-protected-branch.sh resolves the current branch and prompts when the push could reach main or master. It stays silent otherwise and defers to the normal rules.

Added a semantic layer via the auto mode classifier. Prefix rules are structurally blind to variants: rm -fr, a chained cd x && rm -rf y, and base64 ~/.ssh/id_rsa all slip past them. The classifier reads intent, so one rule covers every spelling. Secrets sit in hard_deny, which stated intent cannot clear; destructive git operations sit in soft_deny, since those are sometimes genuinely wanted. Both keep $defaults so the built-in rules still apply.

Switched the default model to opus. Unrelated to the permission work, but it belongs in this branch: /model had written it to the working copy and rebuilding the commits reverted it. Kept deliberately, and isolated in its own commit so it can be dropped without touching anything else.

Extended credential denies to ~/.aws/** and **/.env, which the previous ~/.ssh-only coverage missed.

Type of Change

• Workflow / tooling configuration

Test Procedure

The hook script was pipe-tested against synthesized PreToolUse payloads covering four cases: bare git push on main (prompts), explicit non-protected branch while standing on main (prompts, fail-safe), unrelated branch outside a git repo (silent), and explicit main in the command (prompts). Settings JSON and hook nesting validated with jq -e after each commit.

The hook resolves the actual push target rather than pattern-matching the command, so git push origin feat/x from main stays silent while git push, git push origin main, and git push origin HEAD:refs/heads/main all prompt. Verified across nine invocation forms from both a feature branch and main.

What could break: target resolution assumes a conventional git push [opts] [remote] [refspec] shape. Exotic forms (--mirror, a configured push.default of matching, multi-refspec pushes where an earlier refspec targets main) are not covered and fall through silently.

Live hook execution is not yet verified. New hook entries are not picked up by an already-running session, so this needs /hooks or a restart before the guard is active.

Post-deploy steps

1. Open /hooks once, or restart Claude Code, so the new PreToolUse entry is loaded. Until then the push guard is inert.
2. Confirm on the next real push from main that the prompt appears.

[Copilot]

Pull request overview

This PR hardens Claude Code’s tool permissions by shifting from “block only catastrophic patterns” to a layered model that (a) denies clearly unrecoverable actions, (b) prompts on common recoverable-but-risky actions, and (c) adds a PreToolUse hook to prompt when git push may target protected branches.

Changes:

• Reworked .claude/settings.json permission rules: expanded denies for irrecoverable damage, added prompts for rm, destructive git cleanup/reset, and gh pr merge, and introduced autoMode hard/soft deny classifiers.
• Added a PreToolUse bash hook to detect pushes that may hit main/master and request an “ask” permission decision.
• Extended credential read-deny coverage to include ~/.aws/** and **/.env.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
.claude/settings.json	Updates Claude Code permission rules, adds auto-mode classifiers, and wires a git push pre-hook.
.claude/hooks/git-push-protected-branch.sh	New PreToolUse hook that prompts when a push may target protected branches.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.claude/hooks/git-push-protected-branch.sh:23

• The push-target parsing only inspects the last non-flag positional argument (and treats options as ignorable), which can miss protected-branch pushes (e.g. multi-refspec git push origin main feature or --mirror/--all from a feature branch) and can also false-positive on tag-only pushes (git push origin --tags will currently prompt if you happen to be on main). Consider scanning all refspecs for a protected destination and treating --mirror/--all as always targeting protected branches when they exist; also treat --tags with no refspecs as tag-only (no branch target).

# With no refspec git pushes the current branch; otherwise the last refspec
# wins, and its destination is whatever follows the colon.
if [[ ${#args[@]} -le 1 ]]; then