chore: Expand Claude Code default permissions (#703)

Expands the default allowed permissions in `.claude/settings.json` from
17 to 136 entries, covering common development workflows for this
repository.

The previous settings were minimal and required frequent manual approval
for standard operations. This update pre-approves read-only and
commonly-used commands to improve developer experience with Claude Code.

**Added permissions:**
- File/directory operations (ls, find, cat, tree, mkdir, rm, mv, chmod)
- Full git command coverage (status, log, diff, show, branch, stash,
fetch, pull, add, commit, push, checkout, restore, reset, rebase,
bisect, rm, clone)
- GitHub CLI for PRs, issues, runs, and workflows
- pnpm/Node.js toolchain (run, test, build, dev, install, add, list,
why, outdated, update, exec, workspace/filter commands, turbo, vitest,
tsx)
- TypeScript and Biome linting commands
- Cloudflare Wrangler deployment commands
- Utility commands (grep, rg, jq, sort, awk, sed, curl, lsof, ps, pkill,
timeout, tee)
- WebFetch domains for framework documentation (Cloudflare, Hono, React,
Zod, Vercel AI SDK, GitHub, npm)
- MCP tool permissions for Sentry integrations
- WebSearch capability

Excludes npm/npx commands since this repo uses pnpm exclusively.

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: dcramer

.claude/settings.json

@@ -1,23 +1,146 @@
 {
   "permissions": {
     "allow": [
+      "Bash(ls:*)",
+      "Bash(pwd:*)",
+      "Bash(find:*)",
+      "Bash(file:*)",
+      "Bash(stat:*)",
+      "Bash(wc:*)",
+      "Bash(head:*)",
+      "Bash(tail:*)",
+      "Bash(cat:*)",
+      "Bash(tree:*)",
+      "Bash(mkdir:*)",
+      "Bash(rm:*)",
+      "Bash(mv:*)",
+      "Bash(chmod:*)",
+      "Bash(git status:*)",
+      "Bash(git log:*)",
+      "Bash(git diff:*)",
+      "Bash(git show:*)",
+      "Bash(git branch:*)",
+      "Bash(git remote:*)",
+      "Bash(git tag:*)",
+      "Bash(git stash:*)",
+      "Bash(git stash list:*)",
+      "Bash(git stash push:*)",
+      "Bash(git rev-parse:*)",
+      "Bash(git fetch:*)",
+      "Bash(git pull:*)",
+      "Bash(git add:*)",
+      "Bash(git commit:*)",
+      "Bash(git push:*)",
+      "Bash(git checkout:*)",
+      "Bash(git restore:*)",
+      "Bash(git reset:*)",
+      "Bash(git rebase:*)",
+      "Bash(git bisect:*)",
+      "Bash(git rm:*)",
+      "Bash(git clone:*)",
+      "Bash(gh pr view:*)",
+      "Bash(gh pr list:*)",
+      "Bash(gh pr checks:*)",
+      "Bash(gh pr diff:*)",
+      "Bash(gh pr create:*)",
+      "Bash(gh pr comment:*)",
+      "Bash(gh pr merge:*)",
+      "Bash(gh pr checkout:*)",
+      "Bash(gh issue view:*)",
+      "Bash(gh issue list:*)",
+      "Bash(gh issue create:*)",
+      "Bash(gh issue comment:*)",
+      "Bash(gh issue edit:*)",
+      "Bash(gh run view:*)",
+      "Bash(gh run list:*)",
+      "Bash(gh run logs:*)",
+      "Bash(gh repo view:*)",
+      "Bash(gh api:*)",
+      "Bash(gh workflow:*)",
+      "Bash(node:*)",
+      "Bash(pnpm run:*)",
+      "Bash(pnpm test:*)",
+      "Bash(pnpm build:*)",
+      "Bash(pnpm dev:*)",
+      "Bash(pnpm install:*)",
+      "Bash(pnpm add:*)",
+      "Bash(pnpm list:*)",
+      "Bash(pnpm why:*)",
+      "Bash(pnpm outdated)",
+      "Bash(pnpm update:*)",
+      "Bash(pnpm exec:*)",
+      "Bash(pnpm -w run:*)",
+      "Bash(pnpm -r list:*)",
+      "Bash(pnpm --filter:*)",
+      "Bash(pnpm turbo:*)",
+      "Bash(pnpm vitest:*)",
+      "Bash(pnpx vitest:*)",
+      "Bash(pnpx tsx:*)",
+      "Bash(pnpm tsc:*)",
+      "Bash(pnpm exec tsc:*)",
+      "Bash(pnpm run typecheck:*)",
+      "Bash(pnpm typecheck:*)",
+      "Bash(pnpm run check:*)",
+      "Bash(pnpm -w run lint:*)",
+      "Bash(pnpm -w run lint:fix)",
+      "Bash(pnpm lint:*)",
+      "Bash(pnpm biome lint:*)",
+      "Bash(biome lint:*)",
+      "Bash(pnpx wrangler:*)",
+      "Bash(pnpx wrangler versions upload:*)",
+      "Bash(pnpx wrangler delete:*)",
+      "Bash(grep:*)",
+      "Bash(rg:*)",
+      "Bash(jq:*)",
+      "Bash(sort:*)",
+      "Bash(awk:*)",
+      "Bash(sed:*)",
+      "Bash(curl:*)",
+      "Bash(lsof:*)",
+      "Bash(ps:*)",
+      "Bash(pkill:*)",
+      "Bash(timeout:*)",
+      "Bash(tee:*)",
+      "Bash(xargs kill:*)",
       "WebFetch(domain:mcp.sentry.dev)",
       "WebFetch(domain:docs.sentry.io)",
       "WebFetch(domain:develop.sentry.dev)",
       "WebFetch(domain:modelcontextprotocol.io)",
       "WebFetch(domain:docs.anthropic.com)",
-      "Bash(grep:*)",
-      "Bash(jq:*)",
-      "Bash(pnpx vitest:*)",
-      "Bash(pnpm test:*)",
-      "Bash(pnpm run typecheck:*)",
-      "Bash(pnpm run check:*)",
-      "Bash(pnpm run:*)",
-      "Bash(pnpx tsx:*)",
-      "Bash(gh pr checks:*)",
-      "Bash(gh pr view:*)",
-      "Bash(gh run view:*)",
-      "Bash(git status:*)"
+      "WebFetch(domain:developers.cloudflare.com)",
+      "WebFetch(domain:hono.dev)",
+      "WebFetch(domain:react.dev)",
+      "WebFetch(domain:zod.dev)",
+      "WebFetch(domain:sdk.vercel.ai)",
+      "WebFetch(domain:ai-sdk.dev)",
+      "WebFetch(domain:github.com)",
+      "WebFetch(domain:api.github.com)",
+      "WebFetch(domain:raw.githubusercontent.com)",
+      "WebFetch(domain:www.npmjs.com)",
+      "WebFetch(domain:localhost)",
+      "mcp__sentry__search_docs",
+      "mcp__sentry__get_doc",
+      "mcp__sentry__search_events",
+      "mcp__sentry__search_issues",
+      "mcp__sentry__get_issue_details",
+      "mcp__sentry__analyze_issue_with_seer",
+      "mcp__sentry__find_organizations",
+      "mcp__sentry__find_projects",
+      "mcp__sentry__find_releases",
+      "mcp__sentry__whoami",
+      "mcp__sentry-dev__find_projects",
+      "mcp__sentry-dev__find_organizations",
+      "mcp__sentry-dev__whoami",
+      "mcp__spotlight__get_errors",
+      "mcp__spotlight__get_local_errors",
+      "WebSearch",
+      "Skill(sentry-skills:commit)",
+      "Skill(sentry-skills:create-pr)",
+      "Skill(sentry-skills:code-review)",
+      "Skill(sentry-skills:find-bugs)",
+      "Skill(sentry-skills:deslop)",
+      "Skill(sentry-skills:iterate-pr)",
+      "Skill(sentry-skills:claude-settings-audit)"
     ],
     "deny": []
   },