fix(claude-permissions): deny git restore path discards like checkout

[kyle-sexton]

Summary

Closes the asymmetry where git checkout -- <path> was denied but git restore <path> was not.

Adds mirror deny rules for both spellings of discarding uncommitted working-tree changes:

• -- separator forms: git restore -- *, git restore * -- *
• Bare-path catch-all: git restore * (restore has no branch/ref ambiguity)
• Matching PowerShell(...) counterparts, including git * restore prefixed forms

Extends the component test to pin the new rules in CI. Bare git checkout <path> without -- is left unchanged — the glob grammar cannot distinguish a path from a branch name.

Test plan

• bash harness/shell/run-tests.sh components/claude-permissions/claude-permissions.test.sh — pass
• jq empty components/claude-permissions/claude-permissions.json — valid JSON
• CI green on merge

Related

Closes #334

  

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude finished @kyle-sexton's task in 4m 53s —— View job

---

Review: PR #351 — deny git restore path discards

Scope: components/claude-permissions/claude-permissions.json and components/claude-permissions/claude-permissions.test.sh (the only two files changed by this PR's single commit, verified via git show HEAD).

• Gather context (diff, CLAUDE.md, REVIEW.md, component README)
• Review claude-permissions.json rule additions
• Review claude-permissions.test.sh test additions
• Check for gaps / asymmetries in glob coverage
• Post findings

Posted 3 inline comments on claude-permissions.json:

1. 🔴 Important (L201) — the new bare Bash(git restore *) catch-all is a whole-string glob (per the component README's threat-model section), so it also denies git restore --staged <path>, a non-destructive unstage that never touches the working tree. That's broader than the PR's stated "discard" parity goal with checkout, and inconsistent with git reset <path> (the equivalent unstage form) staying ungated.
2. 🔴 Important (L239) — PowerShell(git * restore *) has no flag anchor (unlike sibling prefixed rules like git * push --force/git * reset --hard), so as an unanchored whole-string glob it matches any PowerShell git command whose args merely contain " restore " as a substring — e.g. git commit -m "please restore old default" — since "restore" is an ordinary word rather than a distinctive flag.
3. 🟡 Nit (L193) — Bash(git restore * -- *) and Bash(git restore -- *) (L196) are dead on arrival: both are fully subsumed by the bare Bash(git restore *) added in the same commit (L201). Same redundancy repeats in the PowerShell(git * restore …) block (L236 vs L239) and the PowerShell(git restore …) block (L317/L320 vs L325).

Additional non-blocking observation (not inline-commented, spans multiple lines): the file otherwise maintains strict ASCII-alphabetical sort within each array (confirmed against the pre-existing reset/switch deny groups, where *-prefixed forms sort before -/./: forms). The three new bare catch-alls (Bash(git restore *) [L201], PowerShell(git * restore *) [L239], PowerShell(git restore *) [L325]) are appended at the end of their respective restore subgroups instead of sorted in — each should sort immediately after the * :/) line and before the -- *) line, since * (0x2A) < - (0x2D) in ASCII.

Not reviewed: security-lane concerns are out of scope for this lane per REVIEW.md (this repo has no claude-security-review workflow gate mentioned in scope docs for this change, but the change itself is permissions-floor configuration, not application code, so no security-lane findings apply regardless).

Test coverage: claude-permissions.test.sh pins presence of the 8 new deny strings via jq -e ... index(...), consistent with the file's existing shallow existence-check style for other deny families — reasonable given the file's own precedent, though it wouldn't have caught findings #1/#2 above (those are about over-matching, not missing entries). The PR's test-plan checkboxes (harness test run, jq empty validity) are author-claimed and were not independently re-run by this review.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ebf74fdd20

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.

[kyle-sexton]

Addressed the Important reviews: dropped catch-all restore denies that blocked --staged / over-matched PowerShell; kept ---separator forms; documented the bare-path grammar limit. Re-running CI after the transient eol-renormalize TLS checkout failure. 🤖