From 3f47dc169256e46fd64f0c167e38b065b5eba921 Mon Sep 17 00:00:00 2001 From: hugocasa Date: Wed, 12 Aug 2026 19:28:49 +0200 Subject: [PATCH] chore(security): deny agent edits to the permission hooks and project settings .claude/hooks/guard-rm-outside-tmp.sh and guard-main-branch.sh are the enforcement points for everything the permission rules are meant to catch, and nothing stopped an agent editing them. One sed -i disables the guard for every later command, silently, and the deny list in .claude/settings.json has the same exposure. Defence in depth rather than a boundary: an agent with arbitrary bash can still delete, and this may only close the Edit-tool path if Bash writes are not covered by Edit deny rules. It costs nothing and removes the cheapest way to turn the guards off. Changing them now means editing the files by hand, which is the intent. Co-Authored-By: Claude Opus 5 (1M context) --- .claude/settings.json | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.claude/settings.json b/.claude/settings.json index 641ea70b53..17d4b60967 100644 --- a/.claude/settings.json +++ b/.claude/settings.json @@ -70,7 +70,11 @@ "Edit(.env)", "Edit(.env.*)", "Edit(**/.env)", - "Edit(**/.env.*)" + "Edit(**/.env.*)", + "Edit(.claude/hooks/**)", + "Write(.claude/hooks/**)", + "Edit(.claude/settings.json)", + "Write(.claude/settings.json)" ], "ask": [ "Bash(rm:*)",