DRY up git permission rules: chezmoi-template one verb list across git / git -C / rtk git / chezmoi git

[nickvigilante]

Problem

home/dot_claude/settings.json hand-maintains git permission rules separately for several invocation prefixes, and they've already drifted:

• bare git … — Bash(git log *), Bash(git diff *), … plus the narrowed tag -l/remote -v/reflog show read forms.
• git -C * … — only a partial mirror (a subset of the verbs is duplicated).
• rtk git … — the rtk Bash hook rewrites git X → rtk git X, so deny rules must be mirrored under this prefix (see Harden distill skill, audit permission allowlist, track rtk hook #26).
• chezmoi git … — chezmoi's git passthrough; currently not covered at all.

Same story for the deny list (branch -d / -D / --delete), which today only mirrors git and rtk git.

Maintaining these by hand means every new allowed/denied git verb has to be added in up to four places — and the prefixes are already out of sync (git -C * partial, chezmoi git missing).

Proposal

Make settings.json a chezmoi template (settings.json.tmpl) and generate the git rules from a single source of truth:

• one list of read-only allow verbs: log *, diff *, show *, status *, blame *, tag -l*, tag, remote -v, remote show *, remote get-url *, ls-files *, stash list *, rev-parse *, describe *, worktree list *, for-each-ref *, shortlog *, reflog show *, reflog
• one list of deny verbs: branch -d *, branch -D *, branch --delete *
• one list of providers/prefixes: git, git -C *, rtk git, chezmoi git

A template loop then emits the cross-product as Bash(<provider> <verb>) into the allow / deny arrays. Adding a verb or a provider becomes a one-line change that fans out everywhere, in sync.

Notes / acceptance

• Only the git block is generated; the rest of settings.json (kubectl/helm entries, hooks, non-git tools) stays literal in the template.
• Emit valid JSON — handle trailing commas (build the list and toJson it, or guard the last element).
• Add a render check (a run_onchange_ step or dotfiles doctor assertion) that chezmoi cat ~/.claude/settings.json | jq . parses — a template bug must not silently break all permissions.
• Keep the rtk-rewrite invariant: the hook rewrites git … → rtk git …, so the rtk git deny mirror must remain (that's why branch-delete is denied under both prefixes — see Harden distill skill, audit permission allowlist, track rtk hook #26).
• Decide whether git -C * should compose with rtk/chezmoi (probably unnecessary — git -C is bare-git only).

Why now

Surfaced while hardening the permission allowlist in #26, where the rtk git deny mirrors were added by hand — exactly the maintenance burden this would remove.

[nickvigilante]

Generalize past git: this is an all-rtk-wrapped-providers problem

While verifying the allowlist I confirmed gh is wrapped by rtk exactly like git — rtk's own docs list git / gh / gt together as proxied version-control programs, and the hook rewrites gh X → rtk gh X the same way it rewrites git X → rtk git X. So the bare-prefix read-only allow rules (Bash(gh pr list *), Bash(git log *), …) don't match the command that actually runs after the hook rewrite, which is why those reads re-prompt.

This isn't git-specific. The same rewrite gap exists for every rtk-wrapped provider that has read-only allow rules today:

• git, gh, gt — version control
• kubectl (huge get/describe block today), docker, aws — orchestration/cloud
• cargo, npm / pnpm / npx — package managers
• go / golangci-lint, ruff / pytest / pip / mypy, rspec / rubocop / rake, dotnet, playwright / vitest / jest — build/test
• curl

Every bare read-only rule for those is silently not matching its rewritten rtk <prog> … form.

Revised proposal

Keep the template-the-cross-product idea from the original post, but widen the model from "git verbs × prefixes" to provider → {read-only allow verbs, deny verbs}, with rtk <provider> as a generated prefix for every wrapped provider (not just git):

• providers/prefixes become per-provider: each rtk-wrapped program emits both its bare form and its rtk <prog> form. git additionally composes with git -C * (bare-git only — rtk/chezmoi don't compose with -C).
• verb lists are per-provider (git's read verbs ≠ gh's ≠ kubectl's), so the single "one read-verb list" from the original proposal becomes a map keyed by provider.
• the deny mirror generalizes the same way (today only git/rtk git branch-delete; the loop fans deny verbs across the bare + rtk forms automatically).

The rtk-native commands (ls, tree, read, grep, wc, diff, du, df, ps) and meta commands (gain, discover, cc-economics, session, config show, --version/--help) stay literal — they have no bare equivalent and aren't part of the cross-product. Keep rtk proxy, rtk init, rtk hook, rtk config set out (mutating / arbitrary-command).

Already landed (interim, by hand)

claude/rtk-subcommands-allowlist-7x1h0w adds the read-only rtk git … and rtk gh … mirrors literally, plus a few state-free no-ops (echo "exit $?", pwd, true, :). Those literal rtk git/rtk gh blocks are exactly what this template should subsume and delete once it lands.

---

Generated by Claude Code

[nickvigilante]

Mechanism note: the prefix-fan-out this needs is now generalized in #37 (allowlist sync across equivalent prefixes). This issue is effectively the first concrete instance of that engine — the git + rtk-wrapped-provider verb lists would be reimplemented on top of #37's expansion rather than templating the git block in isolation. #36 tracks the complementary single-prefix (non-rtk) tools.

---

Generated by Claude Code