From 528960d20104f0accfbd480417e30bcb70f85810 Mon Sep 17 00:00:00 2001
From: fabi <fabi@mc02.dev>
Date: Wed, 29 Jul 2026 07:18:08 +0200
Subject: [PATCH] chore: take the Bash(*) permission change back out of the
 shared settings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`.claude/settings.json` is committed and applies to anyone who clones. Fabi's
local `allow: ["Bash(*)"]` plus deny list ended up in it, inside f0d69f1 — a
commit about the image decode guard, which has nothing to do with permissions.

That was my mistake, twice. The file was already modified when I started the
round: my `git status --short` check printed "(clean)" from an unconditional
`echo` rather than from the status output, so I read a dirty tree as clean. Then
`git add -A` swept it into an unrelated commit, and I reported afterwards that I
had left it untouched. Neither the check nor the claim was true.

Restores the shared file to its previous three narrow entries. The permission
setup itself is preserved, moved to `.claude/settings.local.json`, which
`.gitignore:34` covers precisely so per-user permissions stay per-user — the
existing 442 entries there are kept alongside it.

Not rewriting f0d69f1 to erase this: main is unpushed so it would be safe, but a
visible correction is worth more than a tidy history, and a rebase across the
merge commits carries more risk than the mistake does.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .claude/settings.json | 40 ++++------------------------------------
 1 file changed, 4 insertions(+), 36 deletions(-)

diff --git a/.claude/settings.json b/.claude/settings.json
index f079beb..3154583 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -1,41 +1,9 @@
 {
   "permissions": {
-    "allow": ["Bash(*)"],
-    "deny": [
-      "Bash(sudo *)",
-      "Bash(su *)",
-      "Bash(rm -rf /)",
-      "Bash(rm -rf /*)",
-      "Bash(rm -rf ~*)",
-      "Bash(rm -rf $HOME*)",
-      "Bash(rm -fr /*)",
-      "Bash(rm -rf --no-preserve-root*)",
-      "Bash(dd *)",
-      "Bash(mkfs*)",
-      "Bash(fdisk *)",
-      "Bash(parted *)",
-      "Bash(shutdown*)",
-      "Bash(reboot*)",
-      "Bash(halt*)",
-      "Bash(poweroff*)",
-      "Bash(systemctl stop *)",
-      "Bash(systemctl disable *)",
-      "Bash(chmod -R 777 /*)",
-      "Bash(chown -R * /)",
-      "Bash(git push --force*)",
-      "Bash(git push -f *)",
-      "Bash(git reset --hard origin/*)",
-      "Bash(git clean -fdx*)",
-      "Bash(docker system prune*)",
-      "Bash(docker volume prune*)",
-      "Bash(docker volume rm *)",
-      "Bash(docker rm -f *)",
-      "Bash(docker rmi -f *)",
-      "Bash(dropdb *)",
-      "Bash(psql * -c DROP*)",
-      "Bash(mysql * -e DROP*)",
-      "Bash(npm publish*)",
-      "Bash(cargo publish*)"
+    "allow": [
+      "Bash(cargo check *)",
+      "Bash(cargo clippy *)",
+      "Bash(git --no-pager diff *)"
     ]
   }
 }