feat(claude-config-maintainer): add settings.local.json audit feature v1.2.0
Add 3 new commands for auditing and optimizing Claude Code permission configurations, leveraging the marketplace's multi-layer review architecture. New commands: - /config-audit-settings - 100-point scoring across redundancy, coverage, safety alignment, and profile fit - /config-optimize-settings - apply optimizations with dry-run, named profiles (conservative, reviewed, autonomous), consolidation modes - /config-permissions-map - Mermaid diagram of review layer coverage New skill: - settings-optimization.md - 7 sections covering file formats, syntax reference, consolidation rules, review-layer-aware recommendations, named profiles, scoring criteria, and hook detection Updated agent maintainer.md with new "Audit Settings Files" responsibility. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
@@ -0,0 +1,204 @@
|
||||
---
|
||||
name: config-audit-settings
|
||||
description: Audit settings.local.json for permission optimization opportunities
|
||||
---
|
||||
|
||||
# /config-audit-settings
|
||||
|
||||
Audit Claude Code `settings.local.json` permissions with 100-point scoring across redundancy, coverage, safety alignment, and profile fit.
|
||||
|
||||
## Skills to Load
|
||||
|
||||
Before executing, load:
|
||||
- `skills/visual-header.md`
|
||||
- `skills/settings-optimization.md`
|
||||
|
||||
## Visual Output
|
||||
|
||||
```
|
||||
+-----------------------------------------------------------------+
|
||||
| CONFIG-MAINTAINER - Settings Audit |
|
||||
+-----------------------------------------------------------------+
|
||||
```
|
||||
|
||||
## Usage
|
||||
|
||||
```
|
||||
/config-audit-settings # Full audit with recommendations
|
||||
/config-audit-settings --diagram # Include Mermaid diagram of review layer coverage
|
||||
```
|
||||
|
||||
## Workflow
|
||||
|
||||
### Step 1: Locate Settings Files
|
||||
|
||||
Search in order:
|
||||
1. `.claude/settings.local.json` (primary target)
|
||||
2. `.claude/settings.json` (shared config)
|
||||
3. `~/.claude.json` project entry (legacy)
|
||||
|
||||
Report which format is in use.
|
||||
|
||||
### Step 2: Parse Permission Arrays
|
||||
|
||||
Extract and analyze:
|
||||
- `permissions.allow` array
|
||||
- `permissions.deny` array
|
||||
- `permissions.ask` array (if present)
|
||||
- Legacy `allowedTools` array (if legacy format)
|
||||
|
||||
### Step 3: Run Pattern Consolidation Analysis
|
||||
|
||||
Using `settings-optimization.md` Section 3, detect:
|
||||
|
||||
| Check | Description |
|
||||
|-------|-------------|
|
||||
| Duplicates | Exact same pattern appearing multiple times |
|
||||
| Subsets | Narrower patterns covered by broader ones |
|
||||
| Merge candidates | 4+ similar patterns that could be consolidated |
|
||||
| Overly broad | Unscoped tool permissions (e.g., `Bash` without pattern) |
|
||||
| Stale entries | Patterns referencing non-existent paths |
|
||||
| Conflicts | Same pattern in both allow and deny |
|
||||
|
||||
### Step 4: Detect Active Marketplace Hooks
|
||||
|
||||
Read `plugins/*/hooks/hooks.json` files:
|
||||
|
||||
```bash
|
||||
# Check each plugin's hooks
|
||||
plugins/code-sentinel/hooks/hooks.json # PreToolUse security
|
||||
plugins/doc-guardian/hooks/hooks.json # PostToolUse drift detection
|
||||
plugins/project-hygiene/hooks/hooks.json # PostToolUse cleanup
|
||||
plugins/data-platform/hooks/hooks.json # PostToolUse schema diff
|
||||
plugins/contract-validator/hooks/hooks.json # Plugin validation
|
||||
```
|
||||
|
||||
Parse each to identify:
|
||||
- Hook event type (PreToolUse, PostToolUse)
|
||||
- Tool matchers (Write, Edit, MultiEdit, Bash)
|
||||
- Whether hook is command type (reliable) or prompt type (unreliable)
|
||||
|
||||
### Step 5: Map Review Layers to Directory Scopes
|
||||
|
||||
For each directory scope in `settings-optimization.md` Section 4:
|
||||
1. Count how many review layers are verified active
|
||||
2. Determine if auto-allow is justified (≥2 layers required)
|
||||
3. Note any scopes that lack coverage
|
||||
|
||||
### Step 6: Compare Against Recommended Profile
|
||||
|
||||
Based on review layer count:
|
||||
- 0-1 layers: Recommend `conservative` profile
|
||||
- 2+ layers: Recommend `reviewed` profile
|
||||
- CI/sandboxed: May recommend `autonomous` profile
|
||||
|
||||
Calculate profile fit percentage.
|
||||
|
||||
### Step 7: Generate Scored Report
|
||||
|
||||
Calculate scores using `settings-optimization.md` Section 6.
|
||||
|
||||
## Output Format
|
||||
|
||||
```
|
||||
Settings Efficiency Score: XX/100
|
||||
Redundancy: XX/25
|
||||
Coverage: XX/25
|
||||
Safety Alignment: XX/25
|
||||
Profile Fit: XX/25
|
||||
|
||||
Current Profile: [closest match or "custom"]
|
||||
Recommended Profile: [target based on review layers]
|
||||
|
||||
Issues Found:
|
||||
🔴 CRITICAL: [description]
|
||||
🟠 HIGH: [description]
|
||||
🟡 MEDIUM: [description]
|
||||
🔵 LOW: [description]
|
||||
|
||||
Active Review Layers Detected:
|
||||
✓ code-sentinel (PreToolUse: Write|Edit|MultiEdit)
|
||||
✓ doc-guardian (PostToolUse: Write|Edit|MultiEdit)
|
||||
✓ project-hygiene (PostToolUse: Write|Edit)
|
||||
✗ data-platform schema-diff (not detected)
|
||||
|
||||
Recommendations:
|
||||
1. [specific action with pattern]
|
||||
2. [specific action with pattern]
|
||||
...
|
||||
|
||||
Follow-Up Actions:
|
||||
1. Run /config-optimize-settings to apply recommendations
|
||||
2. Run /config-optimize-settings --dry-run to preview first
|
||||
3. Run /config-optimize-settings --profile=reviewed to apply profile
|
||||
```
|
||||
|
||||
## Diagram Output (--diagram flag)
|
||||
|
||||
When `--diagram` is specified, generate a Mermaid flowchart showing:
|
||||
|
||||
**Before generating:** Read `/mnt/skills/user/mermaid-diagrams/SKILL.md` for diagram requirements.
|
||||
|
||||
**Diagram structure:**
|
||||
- Left column: File operation types (Write, Edit, Bash)
|
||||
- Middle: Review layers that intercept each operation
|
||||
- Right column: Current permission status (auto-allowed, prompted, denied)
|
||||
|
||||
**Color coding:**
|
||||
- PreToolUse hooks: Blue
|
||||
- PostToolUse hooks: Green
|
||||
- Sprint Approval: Amber
|
||||
- PR Review: Purple
|
||||
|
||||
Example structure:
|
||||
```mermaid
|
||||
flowchart LR
|
||||
subgraph Operations
|
||||
W[Write]
|
||||
E[Edit]
|
||||
B[Bash]
|
||||
end
|
||||
|
||||
subgraph Review Layers
|
||||
CS[code-sentinel]
|
||||
DG[doc-guardian]
|
||||
PR[pr-review]
|
||||
end
|
||||
|
||||
subgraph Permission
|
||||
A[Auto-allowed]
|
||||
P[Prompted]
|
||||
D[Denied]
|
||||
end
|
||||
|
||||
W --> CS
|
||||
W --> DG
|
||||
E --> CS
|
||||
E --> DG
|
||||
CS --> A
|
||||
DG --> A
|
||||
B --> P
|
||||
|
||||
classDef preHook fill:#e3f2fd
|
||||
classDef postHook fill:#e8f5e9
|
||||
classDef prReview fill:#f3e5f5
|
||||
class CS preHook
|
||||
class DG postHook
|
||||
class PR prReview
|
||||
```
|
||||
|
||||
## Issue Severity Levels
|
||||
|
||||
| Severity | Icon | Examples |
|
||||
|----------|------|----------|
|
||||
| CRITICAL | 🔴 | Unscoped `Bash` in allow, missing deny for secrets |
|
||||
| HIGH | 🟠 | Overly broad patterns, missing MCP coverage |
|
||||
| MEDIUM | 🟡 | Subset redundancy, merge candidates |
|
||||
| LOW | 🔵 | Exact duplicates, minor optimizations |
|
||||
|
||||
## DO NOT
|
||||
|
||||
- Modify any files (this is audit only)
|
||||
- Recommend `autonomous` profile unless explicitly sandboxed environment
|
||||
- Recommend auto-allow for scopes with <2 verified review layers
|
||||
- Skip hook verification before making recommendations
|
||||
@@ -0,0 +1,243 @@
|
||||
---
|
||||
name: config-optimize-settings
|
||||
description: Optimize settings.local.json permissions based on audit recommendations
|
||||
---
|
||||
|
||||
# /config-optimize-settings
|
||||
|
||||
Optimize Claude Code `settings.local.json` permission patterns and apply named profiles.
|
||||
|
||||
## Skills to Load
|
||||
|
||||
Before executing, load:
|
||||
- `skills/visual-header.md`
|
||||
- `skills/settings-optimization.md`
|
||||
- `skills/pre-change-protocol.md`
|
||||
|
||||
## Visual Output
|
||||
|
||||
```
|
||||
+-----------------------------------------------------------------+
|
||||
| CONFIG-MAINTAINER - Settings Optimization |
|
||||
+-----------------------------------------------------------------+
|
||||
```
|
||||
|
||||
## Usage
|
||||
|
||||
```
|
||||
/config-optimize-settings # Apply audit recommendations
|
||||
/config-optimize-settings --dry-run # Preview only, no changes
|
||||
/config-optimize-settings --profile=reviewed # Apply named profile
|
||||
/config-optimize-settings --consolidate-only # Only merge/dedupe, no new rules
|
||||
```
|
||||
|
||||
## Options
|
||||
|
||||
| Option | Description |
|
||||
|--------|-------------|
|
||||
| `--dry-run` | Preview changes without applying |
|
||||
| `--profile=NAME` | Apply named profile (`conservative`, `reviewed`, `autonomous`) |
|
||||
| `--consolidate-only` | Only deduplicate and merge patterns, don't add new rules |
|
||||
| `--no-backup` | Skip backup (not recommended) |
|
||||
|
||||
## Workflow
|
||||
|
||||
### Step 1: Run Audit Analysis
|
||||
|
||||
Execute the same analysis as `/config-audit-settings`:
|
||||
1. Locate settings file
|
||||
2. Parse permission arrays
|
||||
3. Detect issues (duplicates, subsets, merge candidates, etc.)
|
||||
4. Verify active review layers
|
||||
5. Calculate current score
|
||||
|
||||
### Step 2: Generate Optimization Plan
|
||||
|
||||
Based on audit results, create a change plan:
|
||||
|
||||
**For `--consolidate-only`:**
|
||||
- Remove exact duplicates
|
||||
- Remove subset patterns covered by broader patterns
|
||||
- Merge similar patterns (4+ threshold)
|
||||
- Remove stale patterns for non-existent paths
|
||||
- Remove conflicting allow entries that are already denied
|
||||
|
||||
**For `--profile=NAME`:**
|
||||
- Calculate diff between current permissions and target profile
|
||||
- Show additions and removals
|
||||
- Preserve any custom deny rules not in profile
|
||||
|
||||
**For default (full optimization):**
|
||||
- Apply all consolidation changes
|
||||
- Add recommended patterns based on verified review layers
|
||||
- Suggest profile alignment if appropriate
|
||||
|
||||
### Step 3: Show Before/After Preview
|
||||
|
||||
**MANDATORY:** Always show preview before applying changes.
|
||||
|
||||
```
|
||||
Current Settings:
|
||||
allow: [12 patterns]
|
||||
deny: [4 patterns]
|
||||
|
||||
Proposed Changes:
|
||||
|
||||
REMOVE from allow (redundant):
|
||||
- Write(plugins/projman/*) [covered by Write(plugins/**)]
|
||||
- Write(plugins/git-flow/*) [covered by Write(plugins/**)]
|
||||
- Bash(git status) [covered by Bash(git *)]
|
||||
|
||||
ADD to allow (recommended):
|
||||
+ Bash(npm *) [2 review layers active]
|
||||
+ Bash(pytest *) [2 review layers active]
|
||||
|
||||
ADD to deny (security):
|
||||
+ Bash(curl * | bash*) [missing safety rule]
|
||||
|
||||
After Optimization:
|
||||
allow: [10 patterns]
|
||||
deny: [5 patterns]
|
||||
|
||||
Score Impact: 67/100 → 85/100 (+18 points)
|
||||
```
|
||||
|
||||
### Step 4: Request User Approval
|
||||
|
||||
Ask for confirmation before proceeding:
|
||||
|
||||
```
|
||||
Apply these changes to .claude/settings.local.json?
|
||||
[1] Yes, apply changes
|
||||
[2] No, cancel
|
||||
[3] Apply partial (select which changes)
|
||||
```
|
||||
|
||||
### Step 5: Create Backup
|
||||
|
||||
**Before any write operation:**
|
||||
|
||||
```bash
|
||||
# Backup location
|
||||
.claude/backups/settings.local.json.{YYYYMMDD-HHMMSS}
|
||||
```
|
||||
|
||||
Create the `.claude/backups/` directory if it doesn't exist.
|
||||
|
||||
### Step 6: Apply Changes
|
||||
|
||||
Write the optimized `settings.local.json` file.
|
||||
|
||||
### Step 7: Verify
|
||||
|
||||
Re-read the file and re-calculate the score to confirm improvement.
|
||||
|
||||
```
|
||||
Optimization Complete!
|
||||
|
||||
Backup saved: .claude/backups/settings.local.json.20260202-143022
|
||||
|
||||
Settings Efficiency Score: 85/100 (+18 from 67)
|
||||
Redundancy: 25/25 (+8)
|
||||
Coverage: 22/25 (+5)
|
||||
Safety Alignment: 23/25 (+3)
|
||||
Profile Fit: 15/25 (+2)
|
||||
|
||||
Changes applied:
|
||||
- Removed 3 redundant patterns
|
||||
- Added 2 recommended patterns
|
||||
- Added 1 safety deny rule
|
||||
```
|
||||
|
||||
## Profile Application
|
||||
|
||||
When using `--profile=NAME`:
|
||||
|
||||
### `conservative`
|
||||
```
|
||||
Switching to conservative profile...
|
||||
|
||||
This profile:
|
||||
- Allows: Read, Glob, Grep, LS, basic Bash commands
|
||||
- Allows: Write/Edit only for docs/
|
||||
- Denies: .env*, secrets/, rm -rf, sudo
|
||||
|
||||
All other Write/Edit operations will prompt for approval.
|
||||
```
|
||||
|
||||
### `reviewed`
|
||||
```
|
||||
Switching to reviewed profile...
|
||||
|
||||
Prerequisites verified:
|
||||
✓ code-sentinel hook active (PreToolUse)
|
||||
✓ doc-guardian hook active (PostToolUse)
|
||||
✓ 2+ review layers detected
|
||||
|
||||
This profile:
|
||||
- Allows: All file operations (Edit, Write, MultiEdit)
|
||||
- Allows: Scoped Bash commands (git, npm, python, etc.)
|
||||
- Denies: .env*, secrets/, rm -rf, sudo, curl|bash
|
||||
```
|
||||
|
||||
### `autonomous`
|
||||
```
|
||||
⚠️ WARNING: Autonomous profile requested
|
||||
|
||||
This profile allows unscoped Bash execution.
|
||||
Only use in fully sandboxed environments (CI, containers).
|
||||
|
||||
Confirm this is a sandboxed environment?
|
||||
[1] Yes, this is sandboxed - apply autonomous profile
|
||||
[2] No, cancel
|
||||
```
|
||||
|
||||
## Safety Rules
|
||||
|
||||
1. **ALWAYS backup before writing** (unless `--no-backup`)
|
||||
2. **NEVER remove deny rules without explicit confirmation**
|
||||
3. **NEVER add unscoped `Bash` to allow** — always use scoped patterns
|
||||
4. **Preview is MANDATORY** before applying changes
|
||||
5. **Verify review layers** before recommending broad permissions
|
||||
|
||||
## Output Format
|
||||
|
||||
### Dry Run Output
|
||||
|
||||
```
|
||||
+-----------------------------------------------------------------+
|
||||
| CONFIG-MAINTAINER - Settings Optimization |
|
||||
+-----------------------------------------------------------------+
|
||||
|
||||
DRY RUN - No changes will be made
|
||||
|
||||
[... preview content ...]
|
||||
|
||||
To apply these changes, run:
|
||||
/config-optimize-settings
|
||||
```
|
||||
|
||||
### Applied Output
|
||||
|
||||
```
|
||||
+-----------------------------------------------------------------+
|
||||
| CONFIG-MAINTAINER - Settings Optimization |
|
||||
+-----------------------------------------------------------------+
|
||||
|
||||
Optimization Applied Successfully
|
||||
|
||||
Backup: .claude/backups/settings.local.json.20260202-143022
|
||||
|
||||
[... summary of changes ...]
|
||||
|
||||
Score: 67/100 → 85/100
|
||||
```
|
||||
|
||||
## DO NOT
|
||||
|
||||
- Apply changes without showing preview
|
||||
- Remove deny rules silently
|
||||
- Add unscoped `Bash` permission
|
||||
- Skip backup without explicit `--no-backup` flag
|
||||
- Apply `autonomous` profile without sandbox confirmation
|
||||
- Recommend broad permissions without verifying review layers
|
||||
@@ -0,0 +1,256 @@
|
||||
---
|
||||
name: config-permissions-map
|
||||
description: Generate visual map of review layers and permission coverage
|
||||
---
|
||||
|
||||
# /config-permissions-map
|
||||
|
||||
Generate a Mermaid diagram showing the relationship between file operations, review layers, and permission status.
|
||||
|
||||
## Skills to Load
|
||||
|
||||
Before executing, load:
|
||||
- `skills/visual-header.md`
|
||||
- `skills/settings-optimization.md`
|
||||
|
||||
Also read: `/mnt/skills/user/mermaid-diagrams/SKILL.md` (for diagram requirements)
|
||||
|
||||
## Visual Output
|
||||
|
||||
```
|
||||
+-----------------------------------------------------------------+
|
||||
| CONFIG-MAINTAINER - Permissions Map |
|
||||
+-----------------------------------------------------------------+
|
||||
```
|
||||
|
||||
## Usage
|
||||
|
||||
```
|
||||
/config-permissions-map # Generate and display diagram
|
||||
/config-permissions-map --save # Save diagram to .mermaid file
|
||||
```
|
||||
|
||||
## Workflow
|
||||
|
||||
### Step 1: Detect Active Hooks
|
||||
|
||||
Read all plugin hooks from the marketplace:
|
||||
|
||||
```
|
||||
plugins/code-sentinel/hooks/hooks.json
|
||||
plugins/doc-guardian/hooks/hooks.json
|
||||
plugins/project-hygiene/hooks/hooks.json
|
||||
plugins/data-platform/hooks/hooks.json
|
||||
plugins/contract-validator/hooks/hooks.json
|
||||
plugins/cmdb-assistant/hooks/hooks.json
|
||||
```
|
||||
|
||||
For each hook, extract:
|
||||
- Event type (PreToolUse, PostToolUse, SessionStart, etc.)
|
||||
- Tool matchers (Write, Edit, MultiEdit, Bash patterns)
|
||||
- Hook command/script
|
||||
|
||||
### Step 2: Map Hooks to File Scopes
|
||||
|
||||
Create a mapping of which review layers cover which operations:
|
||||
|
||||
| Operation | PreToolUse Hooks | PostToolUse Hooks | Other Gates |
|
||||
|-----------|------------------|-------------------|-------------|
|
||||
| Write | code-sentinel | doc-guardian, project-hygiene | PR review |
|
||||
| Edit | code-sentinel | doc-guardian, project-hygiene | PR review |
|
||||
| MultiEdit | code-sentinel | doc-guardian | PR review |
|
||||
| Bash(git *) | git-flow | — | — |
|
||||
|
||||
### Step 3: Read Current Permissions
|
||||
|
||||
Load `.claude/settings.local.json` and parse:
|
||||
- `allow` array → auto-allowed operations
|
||||
- `deny` array → blocked operations
|
||||
- `ask` array → always-prompted operations
|
||||
|
||||
### Step 4: Generate Mermaid Flowchart
|
||||
|
||||
**Diagram requirements (from mermaid-diagrams skill):**
|
||||
- Use `classDef` for styling
|
||||
- Maximum 3 colors (blue, green, amber/purple)
|
||||
- Semantic arrow labels
|
||||
- Left-to-right flow
|
||||
|
||||
**Structure:**
|
||||
|
||||
```mermaid
|
||||
flowchart LR
|
||||
subgraph ops[File Operations]
|
||||
direction TB
|
||||
W[Write]
|
||||
E[Edit]
|
||||
ME[MultiEdit]
|
||||
BG[Bash git]
|
||||
BN[Bash npm]
|
||||
BO[Bash other]
|
||||
end
|
||||
|
||||
subgraph pre[PreToolUse Hooks]
|
||||
direction TB
|
||||
CS[code-sentinel<br/>Security Scan]
|
||||
GF[git-flow<br/>Branch Check]
|
||||
end
|
||||
|
||||
subgraph post[PostToolUse Hooks]
|
||||
direction TB
|
||||
DG[doc-guardian<br/>Drift Detection]
|
||||
PH[project-hygiene<br/>Cleanup]
|
||||
DP[data-platform<br/>Schema Diff]
|
||||
end
|
||||
|
||||
subgraph perm[Permission Status]
|
||||
direction TB
|
||||
AA[Auto-Allowed]
|
||||
PR[Prompted]
|
||||
DN[Denied]
|
||||
end
|
||||
|
||||
W -->|intercepted| CS
|
||||
W -->|tracked| DG
|
||||
E -->|intercepted| CS
|
||||
E -->|tracked| DG
|
||||
BG -->|checked| GF
|
||||
|
||||
CS -->|passed| AA
|
||||
DG -->|logged| AA
|
||||
GF -->|valid| AA
|
||||
BO -->|no hook| PR
|
||||
|
||||
classDef preHook fill:#e3f2fd,stroke:#1976d2
|
||||
classDef postHook fill:#e8f5e9,stroke:#388e3c
|
||||
classDef sprint fill:#fff3e0,stroke:#f57c00
|
||||
classDef prReview fill:#f3e5f5,stroke:#7b1fa2
|
||||
classDef allowed fill:#c8e6c9,stroke:#2e7d32
|
||||
classDef prompted fill:#fff9c4,stroke:#f9a825
|
||||
classDef denied fill:#ffcdd2,stroke:#c62828
|
||||
|
||||
class CS,GF preHook
|
||||
class DG,PH,DP postHook
|
||||
class AA allowed
|
||||
class PR prompted
|
||||
class DN denied
|
||||
```
|
||||
|
||||
### Step 5: Generate Coverage Summary Table
|
||||
|
||||
```
|
||||
Review Layer Coverage Summary
|
||||
=============================
|
||||
|
||||
| Directory Scope | Layers | Status | Recommendation |
|
||||
|--------------------------|--------|-----------------|----------------|
|
||||
| plugins/*/commands/*.md | 3 | ✓ Auto-allowed | — |
|
||||
| plugins/*/skills/*.md | 2 | ✓ Auto-allowed | — |
|
||||
| mcp-servers/**/*.py | 3 | ✓ Auto-allowed | — |
|
||||
| docs/** | 2 | ✓ Auto-allowed | — |
|
||||
| scripts/*.sh | 2 | ⚠ Prompted | Consider auto-allow |
|
||||
| .env* | 0 | ✗ Denied | Correct - secrets |
|
||||
| Root directory | 1 | ⚠ Prompted | Keep prompted |
|
||||
|
||||
Legend:
|
||||
✓ = Covered by ≥2 review layers, auto-allowed
|
||||
⚠ = Fewer than 2 layers or not allowed
|
||||
✗ = Explicitly denied
|
||||
```
|
||||
|
||||
### Step 6: Identify Gaps
|
||||
|
||||
Report any gaps in coverage:
|
||||
|
||||
```
|
||||
Coverage Gaps Detected:
|
||||
1. Bash(npm *) — not in allow list, but npm operations are common
|
||||
→ 2 review layers active, could be auto-allowed
|
||||
|
||||
2. mcp__data-platform__* — MCP server configured but tools not allowed
|
||||
→ Add to allow list to avoid prompts
|
||||
|
||||
3. scripts/*.sh — 2 review layers but still prompted
|
||||
→ Consider adding Write(scripts/**) to allow
|
||||
```
|
||||
|
||||
### Step 7: Output Diagram
|
||||
|
||||
Display the Mermaid diagram inline.
|
||||
|
||||
If `--save` flag is used:
|
||||
- Save to `.claude/permissions-map.mermaid`
|
||||
- Report the file path
|
||||
|
||||
## Output Format
|
||||
|
||||
```
|
||||
+-----------------------------------------------------------------+
|
||||
| CONFIG-MAINTAINER - Permissions Map |
|
||||
+-----------------------------------------------------------------+
|
||||
|
||||
Review Layer Status
|
||||
===================
|
||||
|
||||
PreToolUse Hooks (intercept before operation):
|
||||
✓ code-sentinel — Write, Edit, MultiEdit
|
||||
✓ git-flow — Bash(git checkout *), Bash(git commit *)
|
||||
|
||||
PostToolUse Hooks (track after operation):
|
||||
✓ doc-guardian — Write, Edit, MultiEdit
|
||||
✓ project-hygiene — Write, Edit
|
||||
✗ data-platform — not detected
|
||||
|
||||
Other Review Gates:
|
||||
✓ Sprint Approval (projman milestone workflow)
|
||||
✓ PR Review (pr-review multi-agent)
|
||||
|
||||
Permissions Flow Diagram
|
||||
========================
|
||||
|
||||
```mermaid
|
||||
[diagram here]
|
||||
```
|
||||
|
||||
Coverage Summary
|
||||
================
|
||||
|
||||
[table here]
|
||||
|
||||
Gaps & Recommendations
|
||||
======================
|
||||
|
||||
[gaps list here]
|
||||
```
|
||||
|
||||
## File Output (--save flag)
|
||||
|
||||
When `--save` is specified:
|
||||
|
||||
```
|
||||
Diagram saved to: .claude/permissions-map.mermaid
|
||||
|
||||
To view:
|
||||
- Open in VS Code with Mermaid extension
|
||||
- Paste into https://mermaid.live
|
||||
- Include in documentation with ```mermaid code fence
|
||||
```
|
||||
|
||||
## Color Scheme
|
||||
|
||||
| Element | Color | Hex |
|
||||
|---------|-------|-----|
|
||||
| PreToolUse hooks | Blue | #e3f2fd |
|
||||
| PostToolUse hooks | Green | #e8f5e9 |
|
||||
| Sprint/Planning gates | Amber | #fff3e0 |
|
||||
| PR Review | Purple | #f3e5f5 |
|
||||
| Auto-allowed | Light green | #c8e6c9 |
|
||||
| Prompted | Light yellow | #fff9c4 |
|
||||
| Denied | Light red | #ffcdd2 |
|
||||
|
||||
## DO NOT
|
||||
|
||||
- Generate diagrams without reading the mermaid-diagrams skill
|
||||
- Use more than 3 primary colors in the diagram
|
||||
- Skip the coverage summary table
|
||||
- Fail to identify coverage gaps
|
||||
Reference in New Issue
Block a user