ivy/allow

Allow Tool

Add tool patterns to the global Claude Code permissions managed by bin/sync-claude-settings.

Arguments

/allow git check-ignore
/allow limactl
/allow /think
/allow docs.rs

Instructions

1. Parse the pattern

Infer the full permission string from the argument:

| Input | Resulting pattern | Why | |-------|-------------------|-----| | git check-ignore | Bash(git check-ignore:*) | bare words → Bash | | limactl | Bash(limactl:*) | bare word → Bash | | /think | Skill(think:*) | leading slash → Skill | | /commit | Skill(commit:*) | leading slash → Skill | | docs.rs | WebFetch(domain:docs.rs) | looks like a domain → WebFetch | | raw.githubusercontent.com | WebFetch(domain:raw.githubusercontent.com) | domain → WebFetch | | Bash(make:*) | Bash(make:*) | already formatted | | Skill(think:*) | Skill(think:*) | already formatted | | WebFetch(domain:docs.rs) | WebFetch(domain:docs.rs) | already formatted |

Heuristics:

• Starts with / → Skill(<name>:*)
• Contains a . and looks like a domain (no spaces) → WebFetch(domain:<input>)
• Already wrapped in Bash(...), Skill(...), WebFetch(...), Read(...) → pass through
• Everything else → Bash(<input>:*)

2. Decision framework

A command belongs on the allow list based on its side-effect profile:

Allow (no confirmation needed):

• Pure reads — queries state, never mutates it (ps, stat, file, which, uname, dig)
• Pure transforms — reads stdin/files, writes only to stdout (sort, uniq, cut, jq, base64, shasum)
• Bounded benign writes — side effects are trivial and easily reversed (mkdir, touch, mktemp, rmdir empty dirs only)

Reject (warn, require explicit confirmation): A command does NOT belong if it can:

• Write to arbitrary files — tee, cp, mv, output redirection
• Execute arbitrary subcommands — xargs, sh, bash, eval, python, ruby, perl, node
• Publish or transmit data — curl, wget, ssh, scp, rsync, git push
• Destroy state — rm, kill, killall
• Escalate privileges — sudo, doas
• Mutate permissions or identity — chmod, chown
• Access or leak secrets — gpg, security, keychain, op, env, printenv, history
• Mutate cloud infra — aws, gcloud, az
• Mutate global config — git config (can write ~/.gitconfig via --global)

Warn and suggest narrowing for overly broad patterns:

• Bash(*) — universal wildcard
• Multi-subcommand tools where we already scope by subcommand: Bash(git:*), Bash(npm:*), Bash(gh:*)
• WebFetch(domain:*) — wildcard domain
• Read(...) / Edit(...) with broad paths — can expose or modify sensitive files

For reject and narrowing cases: explain which property is violated, suggest a safer alternative if possible, and ask the user to confirm. If they confirm, proceed.

3. Check for duplicates

Grep bin/sync-claude-settings for the exact resolved pattern. If it already exists, tell the user and stop.

4. Add the pattern

Edit bin/sync-claude-settings, inserting the new pattern into the set_permissions() function's allow array in alphabetical order among its peers.

5. Review the edit

Run git diff bin/sync-claude-settings and verify:

• Exactly one line was added
• The jq heredoc is still valid (no unclosed quotes)
• The pattern is in the correct alphabetical position

6. Apply and commit

bin/sync-claude-settings

Then use /commit to commit bin/sync-claude-settings.

Examples

/allow git check-ignore    → adds "Bash(git check-ignore:*)", applies, commits
/allow limactl             → adds "Bash(limactl:*)", applies, commits
/allow /think              → adds "Skill(think:*)", applies, commits
/allow docs.rs             → adds "WebFetch(domain:docs.rs)", applies, commits
/allow git push            → REJECTS: publishes to remote. Proceeds only if user confirms.
/allow printenv            → REJECTS: can leak secrets from environment. Proceeds only if user confirms.
/allow npm                 → NARROWS: too broad, suggests npm run, npm test, etc. Proceeds only if user confirms.