Files
Florian BRUNIAUX a9c610a9af fix(hook): respect Claude Code deny/ask permission rules on rewrite
The PreToolUse hook was emitting `permissionDecision: "allow"` on every
rewritten command, bypassing deny and ask rules in .claude/settings.json.

- Add `src/permissions.rs`: loads Bash deny/ask rules from all 4 Claude
  Code settings files (project + global, settings.json + settings.local.json),
  checks commands (including compound && / || / | / ;) and returns
  Allow / Deny / Ask verdict. 16 unit tests.
- Modify `src/rewrite_cmd.rs`: after finding a rewrite, check the original
  command against permissions. Exit 0 = allow (auto-approve rewrite),
  exit 2 = deny (passthrough, let CC native deny handle it),
  exit 3 = ask (print rewrite but no permissionDecision, CC prompts user).
- Update both hook files to handle exit codes 2 and 3. Version bumped 2→3.
- Bump `CURRENT_HOOK_VERSION` 2→3 in `hook_check.rs` so users with the old
  hook get the upgrade prompt.
- Fix set -euo pipefail bug in .claude/hooks/rtk-rewrite.sh: capture exit
  code with `|| EXIT_CODE=$?` instead of bare assignment.

Fixes #260

Signed-off-by: Florian BRUNIAUX <florian@bruniaux.com>
2026-03-20 14:09:29 +01:00
..