permissions-review

Scan recent session transcripts for commands that prompted, then add safe read-only patterns to the permissions.allow list in settings.json. The scanner script reports each blocked command signature with its frequency so you can allowlist the recurring ones.

Claude Code splits commands on pipes, semicolons, && and ||, then matches each segment independently against Bash() patterns in settings.json. Globs span spaces, and a trailing * requires at least one argument, so bare commands need their own entry.

Pure reads, diagnostics, type checkers, and log viewers are safe to allowlist. Never allowlist state mutations like git commit, docker rm, or npm install, and never wildcard interpreters or task runners since that permits arbitrary code execution.

Claude Code auto-approves a built-in set of read-only programs like cat, grep, and git status without consulting settings.json. Run the scanner with --show-auto-approved to see which commands the built-in set absorbed.

Universal read-only commands belong in the global ~/.claude/settings.json, while project-specific make targets and domain tools belong in the project's .claude/settings.json. Remove local entries already covered globally and promote entries that are project-agnostic.