chore(claude): pick up the newer global hook changes

[m2ux]

Follow-up to #344. The global Claude config moved again while that PR was open — compound-bash-allow.py, redirect-inline-eval.py, a new compound-bash.json, and several more settings rules. #344 merged before these landed, so they are here.

The interesting part: compound-bash-allow.py is a merge, not a copy

The global copy is on a line of development that never received cd7bf3b, the commit that rewrote keyword handling in this tree. It has since gained subshell and brace-group unwrapping. So each side had something the other lacked:

	vendored (here)	global
[[ as a safe binary	yes	no
for headers	yes	no
done < input, break 2	yes	no
subshell ( … ) unwrapping	no	yes
brace groups { …; }	no	yes

Copying "latest global" over this file would have regressed the first three rows. What landed instead:

• Taken from global — strip_group_wrapper(), _iter_unquoted(), _TRAILING_REDIR, the group branch in is_segment_allowed(), and group-unwrapped in the single-command normalization list.
• Kept from here — the regex keyword machinery. Beyond covering more cases, it slices the original string rather than doing global's shlex.split → shlex.quote round-trip before rule matching; that requoting can quote a glob (*.txt) that a rule needs to match against.
• Newly wired — brace groups into the existing regexes: { as a prefix keyword, } as a bare one that may carry redirections ({ …; } > log).

Other changes

scripts/claude/hooks/redirect-inline-eval.py — straight forward port. Now also denies an interpreter reading its program from stdin: python3 - <<'EOF', bare python3 <<'EOF', cat x.py | node, deno run -. Inline eval by another spelling.

scripts/claude/hooks/compound-bash.json — new file; the loader already looked for it. Vendors the generic read-only additions (strings, diff, cmp, od, comm, join, sha256sum, md5sum). Added to the README layout.

examples/cursor-workspace/.claude/settings.template.json — collapse the four git rebase --abort/--continue/--quit/--skip rules into git rebase *; add git tag reads, worktree-remove under the projects root (plain and git -C forms), and docs.rs, which pairs with the cargo block and rust-analyzer plugin the template already ships.

Skipped as personal: docs.polkadot.com, paritytech.github.io, effortLevel.

examples/cursor-workspace/.claude/rules/bash-composition.md — document the stdin-eval denial. The global CLAUDE.md predates that hook change and does not mention it, so the vendored rule would otherwise ship a hook whose behaviour its own docs contradict.

Verification

• 15 compound-bash-allow.py cases — keyword machinery preserved (for headers incl. the arithmetic form, while, done <, break 2, [[), group unwrapping working (subshell fallback, subshell with trailing redirection, brace groups plain and redirected), deny paths still rejecting (rm -rf / under a keyword, inside a subshell, and chmod in a group body), and compound-bash.json extras taking effect.
• 10 redirect-inline-eval.py cases — all four stdin spellings denied plus -c; --version/-v probes, file arguments, deno run <file>, and already-sbx-prefixed commands all passing through.
• Full deploy into a throwaway dir — --dry-run skips the settings render, so it does not exercise the template. Renders valid JSON, no leftover placeholders, all hooks including the new compound-bash.json installed.

Re-ran against current main after rebasing off the merged #344.

Follow-up (not in this PR)

The global compound-bash-allow.py is missing cd7bf3b and this merge. Worth syncing that direction too, or the same divergence recurs on the next pass.

🤖 Generated with Claude Code