Add Claude Code permissions with sshpass read-only rules

Allow read-only remote commands via sshpass (cat, ls, find, grep, dtc,
dpkg, nvidia-smi, etc.) while denying destructive operations (rm -rf,
mkfs, reboot, shutdown, dd). Also includes standard local tool permissions
for git, build system, deployment, and common CLI utilities.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ymodlin

.claude/settings.json

@@ -0,0 +1,134 @@
+{
+  "permissions": {
+    "allow": [
+      "Read",
+      "Glob",
+      "Grep",
+      "Edit",
+      "Write",
+      "NotebookEdit",
+      "WebFetch",
+      "WebSearch",
+
+      "Bash(git status*)",
+      "Bash(git diff*)",
+      "Bash(git log*)",
+      "Bash(git show*)",
+      "Bash(git branch*)",
+      "Bash(git fetch*)",
+      "Bash(git rebase*)",
+      "Bash(git apply*)",
+      "Bash(git worktree*)",
+      "Bash(git show-branch*)",
+      "Bash(git tag*)",
+      "Bash(git stash*)",
+      "Bash(git checkout*)",
+      "Bash(git add*)",
+      "Bash(git commit*)",
+      "Bash(git rev-parse*)",
+      "Bash(git merge-base*)",
+      "Bash(gh *)",
+
+      "Bash(./setup_workspace.sh*)",
+      "Bash(./apply_patches.sh*)",
+      "Bash(./build_all.sh*)",
+      "Bash(make *)",
+
+      "Bash(./scripts/deploy_kernel*)",
+      "Bash(ssh *)",
+      "Bash(scp *)",
+
+      "Bash(sshpass *cat *)",
+      "Bash(sshpass *ls *)",
+      "Bash(sshpass *find *)",
+      "Bash(sshpass *grep *)",
+      "Bash(sshpass *head *)",
+      "Bash(sshpass *tail *)",
+      "Bash(sshpass *wc *)",
+      "Bash(sshpass *file *)",
+      "Bash(sshpass *stat *)",
+      "Bash(sshpass *md5sum *)",
+      "Bash(sshpass *xxd *)",
+      "Bash(sshpass *diff *)",
+      "Bash(sshpass *strings *)",
+      "Bash(sshpass *echo *)",
+      "Bash(sshpass *test *)",
+      "Bash(sshpass *which *)",
+      "Bash(sshpass *uname*)",
+      "Bash(sshpass *hostname*)",
+      "Bash(sshpass *df *)",
+      "Bash(sshpass *du *)",
+      "Bash(sshpass *lsblk*)",
+      "Bash(sshpass *blkid*)",
+      "Bash(sshpass *mount*)",
+      "Bash(sshpass *lsmod*)",
+      "Bash(sshpass *dmesg*)",
+      "Bash(sshpass *ip *)",
+      "Bash(sshpass *free*)",
+      "Bash(sshpass *uptime*)",
+      "Bash(sshpass *whoami*)",
+      "Bash(sshpass *id *)",
+      "Bash(sshpass *ps *)",
+      "Bash(sshpass *dpkg *)",
+      "Bash(sshpass *nvidia-smi*)",
+      "Bash(sshpass *nvcc *)",
+      "Bash(sshpass *dtc *)",
+      "Bash(sshpass *modinfo *)",
+      "Bash(sshpass *efibootmgr*)",
+      "Bash(sshpass *nv_update_engine --help*)",
+      "Bash(sshpass *nv_bootloader_payload_updater --help*)",
+      "Bash(sshpass *nv_bootloader_payload_updater --print*)",
+      "Bash(sshpass *parted*print*)",
+
+      "Bash(python3 *)",
+      "Bash(pytest *)",
+      "Bash(python3 test/*)",
+
+      "Bash(cppcheck *)",
+
+      "Bash(ls *)",
+      "Bash(find *)",
+      "Bash(grep *)",
+      "Bash(cat *)",
+      "Bash(head *)",
+      "Bash(tail *)",
+      "Bash(wc *)",
+      "Bash(diff *)",
+      "Bash(file *)",
+      "Bash(realpath *)",
+      "Bash(nproc*)",
+      "Bash(which *)",
+      "Bash(tee *)",
+      "Bash(mkdir *)",
+      "Bash(cp *)",
+      "Bash(mv *)",
+      "Bash(ln *)",
+      "Bash(tar *)",
+      "Bash(wget *)",
+      "Bash(curl *)",
+
+      "Bash(v4l2-ctl *)",
+      "Bash(media-ctl *)",
+      "Bash(lsmod*)",
+      "Bash(dmesg*)",
+      "Bash(sudo dmesg*)",
+      "Bash(uname *)"
+    ],
+    "deny": [
+      "Bash(git push --force*)",
+      "Bash(git reset --hard*)",
+      "Bash(git clean -f*)",
+      "Bash(rm -rf /*)",
+
+      "Bash(sshpass *rm -rf*)",
+      "Bash(sshpass *rm -r *)",
+      "Bash(sshpass *mkfs*)",
+      "Bash(sshpass *dd if=*)",
+      "Bash(sshpass *reboot*)",
+      "Bash(sshpass *shutdown*)",
+      "Bash(sshpass *poweroff*)",
+      "Bash(sshpass *halt*)",
+      "Bash(sshpass *flash*)"
+    ]
+  }
+}