Check repository visibility before posting, and close gh and curl permission gaps

.claude/settings/permissions/bash.jsonc

@@ -54,44 +54,8 @@
       "Bash(gh search *)",
       "Bash(gh pr view *)",
       "Bash(gh pr diff *)",
-      // Local app interaction
-      // Claude currently has terrible support for this: https://github.com/anthropics/claude-code/issues/338    using `:*` as a pattern is not allowed (doesn't error, just doesn't really work), so have to specify _something_ between the colon and asterisk.
-      "Bash(curl http://localhost:1*)",
-      "Bash(curl http://localhost:2*)",
-      "Bash(curl http://localhost:3*)",
-      "Bash(curl http://localhost:4*)",
-      "Bash(curl http://localhost:5*)",
-      "Bash(curl http://localhost:6*)",
-      "Bash(curl http://localhost:7*)",
-      "Bash(curl http://localhost:8*)",
-      "Bash(curl http://localhost:9*)",
-      "Bash(curl -s http://localhost:1*)",
-      "Bash(curl -s http://localhost:2*)",
-      "Bash(curl -s http://localhost:3*)",
-      "Bash(curl -s http://localhost:4*)",
-      "Bash(curl -s http://localhost:5*)",
-      "Bash(curl -s http://localhost:6*)",
-      "Bash(curl -s http://localhost:7*)",
-      "Bash(curl -s http://localhost:8*)",
-      "Bash(curl -s http://localhost:9*)",
-      "Bash(curl \"http://localhost:1*)",
-      "Bash(curl \"http://localhost:2*)",
-      "Bash(curl \"http://localhost:3*)",
-      "Bash(curl \"http://localhost:4*)",
-      "Bash(curl \"http://localhost:5*)",
-      "Bash(curl \"http://localhost:6*)",
-      "Bash(curl \"http://localhost:7*)",
-      "Bash(curl \"http://localhost:8*)",
-      "Bash(curl \"http://localhost:9*)",
-      "Bash(curl -s \"http://localhost:1*)",
-      "Bash(curl -s \"http://localhost:2*)",
-      "Bash(curl -s \"http://localhost:3*)",
-      "Bash(curl -s \"http://localhost:4*)",
-      "Bash(curl -s \"http://localhost:5*)",
-      "Bash(curl -s \"http://localhost:6*)",
-      "Bash(curl -s \"http://localhost:7*)",
-      "Bash(curl -s \"http://localhost:8*)",
-      "Bash(curl -s \"http://localhost:9*)",
+      "Bash(gh repo view *)",
+      "Bash(gh repo clone *)",
       // Misc
       "Bash(amp *)",
       "Bash(atuin *)",
@@ -126,7 +90,7 @@
     ],
     "ask": [
       // let's hold off before we let it use the github CLI in any free running allow mode...I don't want it somehow approving PRs with the user's credentials
-      "Bash(gh repo *)",
+      "Bash(gh repo fork *)",
       "Bash(gh release *)",
       "Bash(gh secret *)",
       "Bash(gh ruleset *)",
@@ -146,6 +110,23 @@
       "Bash(gh pr ready *)",
       "Bash(gh pr review *)",
       "Bash(gh pr update-branch *)",
+      // Raw API access and the token itself would let Claude get around every gh rule in this file. Scripts that need the API (like the address-pr-comments skill) are reviewed and run gh api themselves.
+      "Bash(gh api *)",
+      "Bash(gh auth token*)",
+      "Bash(gh auth status *-t*)", // -t / --show-token prints the token
+      // Creating or changing repositories should be a deliberate human step, so run these yourself with `!`
+      "Bash(gh repo archive *)",
+      "Bash(gh repo autolink create *)",
+      "Bash(gh repo autolink new *)",
+      "Bash(gh repo autolink delete *)",
+      "Bash(gh repo create *)",
+      "Bash(gh repo new *)",
+      "Bash(gh repo delete *)",
+      "Bash(gh repo deploy-key *)",
+      "Bash(gh repo edit *)",
+      "Bash(gh repo rename *)",
+      "Bash(gh repo sync *)",
+      "Bash(gh repo unarchive *)",
       // Task must run the repo's own taskfiles, which are the reviewed ones. These flags are the only ways to point it elsewhere (there is no environment variable equivalent -- https://github.com/go-task/task/issues/1721 was closed as a duplicate with nothing implemented), and `/tmp` is writable without a prompt, so without these denials `Bash(task *)` would be an allow-anything entry.
       "Bash(task -t *)",
       "Bash(task --taskfile *)",

AGENTS.md

@@ -75,6 +75,10 @@ This project is a Copier template used to generate other copier templates. It is
 
 - Before saving any memory or adding any rule, explicitly ask the user whether the concept should be: (1) added to AGENTS.md as a general rule applicable across all projects, (2) added to AGENTS.md as a rule specific to this project, or (3) stored as a temporary local memory only relevant to the current active work. The devcontainer environment is ephemeral, so local memory files are rarely the right choice.
 
+## Public Repositories
+
+- Before posting to a repository (PR or issue text, comments, commit messages, file contents), check its visibility (`gh repo view <owner>/<repo> --json visibility`). In a public repository, never name, link to, or quote a private repository. Still say when relevant work happened in one, such as testing in a private repo that depends on this one, but anonymize it ("tested in a private repo") and give only the details needed to make the point.
+
 ## Tooling
 
 - Before hand-assembling a multi-step workflow, run `task --list` — it is probably already a task. Definitions live in `.config/taskfiles/`; the root `Taskfile.yaml` only includes them.