From 7f687cfb6efb713ede4060f68243e5237fc269bf Mon Sep 17 00:00:00 2001
From: Jerry <lishuai4415@gmail.com>
Date: Wed, 23 Sep 2026 07:55:50 -0600
Subject: [PATCH] fix(claude): scope allowlisted commands and drop the
 auto-format hook

- replace the Bash(pnpm *) wildcard (any script/exec/dlx execution) and
  npm run * with an enumerated list of low-risk commands; pnpm run/exec/
  dlx and everything else now go through the normal approval prompt
- remove the PostToolUse hook that ran 'pnpm format' after every
  Write/Edit: it executed a package.json script with zero interaction,
  so a tampered script in a merged PR meant arbitrary code execution on
  every contributor's machine (lint-staged already covers formatting)
- widen the env-file deny to **/.env* so nested env files are covered,
  and deny 'cat .env*' explicitly
- keep the CESIUM_ION_TOKEN env passthrough: local builds need it and
  the allowlist above no longer offers a prompt-free exfil path
---
 .claude/settings.json | 28 +++++++++++-----------------
 1 file changed, 11 insertions(+), 17 deletions(-)

diff --git a/.claude/settings.json b/.claude/settings.json
index 2da3035..a1912fc 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -1,30 +1,24 @@
 {
   "permissions": {
     "allow": [
-      "Bash(pnpm *)",
-      "Bash(npm run *)",
+      "Bash(pnpm install)",
+      "Bash(pnpm check)",
+      "Bash(pnpm test)",
+      "Bash(pnpm lint)",
+      "Bash(pnpm typecheck)",
+      "Bash(pnpm format)",
+      "Bash(pnpm build)",
+      "Bash(pnpm build:github)",
+      "Bash(pnpm preview)",
+      "Bash(pnpm size)",
       "Read(./**)",
       "WebFetch(domain:github.com)",
       "WebFetch(domain:npmjs.com)"
     ],
-    "deny": ["Read(.env)", "Read(.env.*)", "Bash(rm -rf *)"],
+    "deny": ["Read(**/.env)", "Read(**/.env.*)", "Bash(rm -rf *)", "Bash(cat .env*)"],
     "ask": ["Bash(git push *)"]
   },
   "env": {
     "CESIUM_ION_TOKEN": "${CESIUM_ION_TOKEN}"
-  },
-  "hooks": {
-    "PostToolUse": [
-      {
-        "matcher": "Write|Edit",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "pnpm format",
-            "timeout": 30
-          }
-        ]
-      }
-    ]
   }
 }