From 02fb4c8ae561e1f6e52ef4630084c2c8a5568eb8 Mon Sep 17 00:00:00 2001
From: AIOSAI <aipass.system@gmail.com>
Date: Thu, 23 Apr 2026 00:51:23 -0700
Subject: [PATCH] =?UTF-8?q?feat(system):=20security:=20expand=20git=20deny?=
 =?UTF-8?q?=20rules=20from=2010=20to=2023=20=E2=80=94=20block=20all=20muta?=
 =?UTF-8?q?ting=20git=20and=20all=20gh=20commands,=20only=20drone=20@git?=
 =?UTF-8?q?=20subcommands=20can=20modify=20git=20state?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: @devpulse <devpulse@aipass>
---
 .claude/settings.json | 29 +++++++++++++++++++++--------
 1 file changed, 21 insertions(+), 8 deletions(-)

diff --git a/.claude/settings.json b/.claude/settings.json
index f666cb82..2b04f68d 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -10,15 +10,28 @@
     ],
     "deny": [
       "EnterPlanMode",
-      "Bash(git add -f*)",
-      "Bash(git add --force*)",
+      "Bash(git add*)",
+      "Bash(git commit*)",
+      "Bash(git push*)",
+      "Bash(git pull*)",
+      "Bash(git merge*)",
+      "Bash(git rebase*)",
+      "Bash(git reset*)",
       "Bash(git checkout*)",
-      "Bash(git switch -c*)",
-      "Bash(git switch --create*)",
-      "Bash(git branch -c*)",
-      "Bash(git branch --copy*)",
-      "Bash(git branch -m*)",
-      "Bash(git branch --move*)",
+      "Bash(git switch*)",
+      "Bash(git branch*)",
+      "Bash(git cherry-pick*)",
+      "Bash(git stash*)",
+      "Bash(git tag*)",
+      "Bash(git revert*)",
+      "Bash(git rm*)",
+      "Bash(git mv*)",
+      "Bash(git clean*)",
+      "Bash(git restore*)",
+      "Bash(gh pr *)",
+      "Bash(gh issue *)",
+      "Bash(gh repo *)",
+      "Bash(gh api *)",
       "Read(/home/patrick/Patrick-Personal/**)",
       "Edit(/home/patrick/Patrick-Personal/**)",
       "Write(/home/patrick/Patrick-Personal/**)",