fix: keep gh api auto-approval read-only in Claude Code settings

[dennishavermans]

Summary

Bash(gh api repos*) in .claude/settings.json was added so the review-pr skill can fetch PR comments, reviews, and commits, and it sits in a block of otherwise read-only gh rules. A prefix rule cannot see the HTTP method, so the same rule also auto-approves writes. This PR adds a PreToolUse guard, in the same shape as the existing guard-protected-files.sh, that lets gh api reads through untouched and blocks anything that changes the request method.

Everything below was measured on Claude Code 2.1.238 before opening this PR (each rule set in a scratch settings.json passed via --settings, raw stream-json transcripts, probes against a repo name that does not exist so the API returns 404 and nothing changes):

Command	Rule as on main	Rule + this guard
gh api repos/linuxfoundation/crowd.dev/pulls/4548/comments --paginate	auto-approved (returns the PR's 21 inline comments)	auto-approved, unchanged
gh api repos/<owner>/<repo> -X DELETE	auto-approved	blocked by the guard
gh api repos/<owner>/<repo> -f description=x	auto-approved	blocked by the guard
gh api repos/<owner>/<repo>/git/refs/heads/main -X DELETE	auto-approved	blocked by the guard

Two details worth knowing:

• The POST case needs no -X: gh's own help says "adding request parameters will automatically switch the request method to POST", so any -f/-F ride-along turns an approved read into a write.
• With a default gh auth login token (repo scope, no delete_repo), repository deletion itself would fail at the API. What the repo scope does cover through this rule: deleting branches via git/refs, editing repository settings via PATCH, and deleting comments and releases.

The deny list already blocks git reset --hard* and rm -rf*, so this brings remote state in line with the protection local state already has.

Changes

• .claude/hooks/guard-gh-api.sh: blocks -X/--method and the parameter flags that imply POST (-f, -F, --field, --raw-field, --input) on gh api commands; exits 2 with an explanation. The flag scan runs on the raw hook input rather than an extracted command string, so a quote inside the command cannot hide a flag from the guard (unit-tested against a --jq '"' -X DELETE smuggle).
• .claude/settings.json: wires the guard into PreToolUse with a Bash matcher, next to the existing Edit|Write|MultiEdit guard.

The review-pr skill's three documented gh api calls (comments, reviews, commits) were re-run under the guarded config and still auto-approve.

Type of change

• Bug fix

JIRA ticket

n/a (external contribution; happy to reference one if a maintainer files it)

Notes for the reviewer

One deliberate trade-off: the guard blocks gh api writes outright rather than downgrading them to an approval prompt, matching the hard-deny style of your deny list. If you would rather keep human-approvable writes in interactive sessions, the exit-2 block can be swapped for a hook JSON permissionDecision: "ask"; I kept the measured, simpler contract. An alternative to all of this is deleting the Bash(gh api repos*) line and letting the three skill calls prompt each review session; the hook keeps the skill friction-free, which seemed closer to the intent of #4122.

Found while testing a static analysis tool for agent configuration files; every claim above was then verified by hand against Claude Code before this PR was opened.

[cursor]

PR Summary

Low Risk
Changes only Claude Code agent hooks and settings; no application runtime, auth, or data paths are affected.

Overview
The Bash(gh api repos*) permission auto-approves all gh api calls under that prefix, including DELETE/POST, because the allow list cannot distinguish HTTP method. This PR adds a PreToolUse guard on Bash commands so read-only gh api (e.g. for /review-pr) still passes while state-changing invocations are hard-blocked.

guard-gh-api.sh inspects the raw hook JSON for method/parameter flags (--method, --field, -X, -f/-F, etc.) that turn default GET into writes or POST, with exit code 2 and a clear stderr message. .claude/settings.json registers this hook next to the existing protected-files guard on the Bash matcher.

^{Reviewed by Cursor Bugbot for commit 4032ef2. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

All committers have signed the CLA.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Reviewed by Cursor Bugbot for commit f9f4653. Configure here.}