@veda-hq/pariksha 0.5.9 → 0.5.11

package/README.md

@@ -4,8 +4,8 @@
 test-quality ratchets. Part of [Veda](https://github.com/veda-hq/veda).
 
 ```sh
-npx @veda-hq/pariksha@0.5.9 <check> [flags]
-npx @veda-hq/pariksha@0.5.9 --version
+npx @veda-hq/pariksha@0.5.11 <check> [flags]
+npx @veda-hq/pariksha@0.5.11 --version
 ```
 
 Every check exits 0 when the repository passes, 1 when it refuses something
@@ -463,10 +463,32 @@ refusal; a requirements file it cannot read or parse, or one listing no key,
 exits 2.
 
 `baselines/claude-settings.json` (`@veda-hq/pariksha/baselines/claude-settings.json`)
-is the permission baseline every repository agents work in keeps: allow
-`mcp__ccd_pr__set_monitor`, deny `Bash(*--no-verify*)`, ask
-`Bash(*git push*--force*)` and `Bash(*git push* -f*)`. Point `--require` at it
-in the package's install. Permission globs are a coarse backstop: they cannot
+is the permission baseline every repository agents work in keeps:
+
+- allow: edits inside the checkout; selected git commands (`status`,
+  `diff`, `log`, `show`, `branch`, `ls-remote`, `worktree list`) and gh
+  commands (`pr view`, `pr list`, `pr checks`, `run view`, `run list`,
+  `issue list`, and `pr comment`, which posts: agents leave their evidence
+  and thread replies on their own pull requests); a draft pull request
+  (`git push -u origin`, `gh pr create --draft`, `gh pr ready`); the desktop
+  app's pull request tools (`mcp__ccd_pr__bind_pr`, `get_status`,
+  `set_monitor`); reading a browser page; and `send_message` to the session
+  that started this one;
+- deny: `Bash(*--no-verify*)`;
+- ask: every push that rewrites or deletes published history (`--force`,
+  `-f`, `--mirror`, `--delete`, `-d`, `--prune`, a `+` or empty-source `:`
+  refspec, and the abbreviations git accepts), a forced branch delete
+  (`git branch -D`, `-df`, `-fd`, and any `-d`/`--delete` with
+  `-f`/`--force` in either order: the two globs `*-d*-f*` and `*-f*-d*`
+  also ask for a plain `-d` of a branch whose name holds `-f`, which errs
+  on the side of asking), and the
+  dependency commands `pnpm add`, `remove`, `update`, `npm install`,
+  `uninstall`, `update`, `yarn add` and `remove`. Ask beats allow, so these
+  hold inside the allowed `git push -u origin` and `git branch`. An edit of a
+  manifest is an edit like any other; the commands are what is asked.
+
+Point `--require` at it in the package's install. A repository's own rules
+go in its own requirements file beside it. Permission globs are a coarse backstop: they cannot
 tell `git commit -n` from `git log -n 5`, nor see `git -C dir push --force`.
 Parsing those is the job of a command guard such as kavach's `git_safety`.
 `permissions.defaultMode: "auto"` is not in it: Claude Code ignores `auto` in a

package/baselines/claude-settings.json

@@ -1,14 +1,64 @@
 {
   "permissions.allow": {
-    "includes": ["mcp__ccd_pr__set_monitor"],
-    "why": "an agent turns on the desktop app's CI monitor for the pull request it opens without a prompt"
+    "includes": [
+      "Edit(./**)",
+      "Write(./**)",
+      "NotebookEdit(./**)",
+      "Bash(git status:*)",
+      "Bash(git diff:*)",
+      "Bash(git log:*)",
+      "Bash(git show:*)",
+      "Bash(git branch:*)",
+      "Bash(git ls-remote:*)",
+      "Bash(git worktree list:*)",
+      "Bash(gh pr view:*)",
+      "Bash(gh pr list:*)",
+      "Bash(gh pr checks:*)",
+      "Bash(gh pr comment:*)",
+      "Bash(gh run view:*)",
+      "Bash(gh run list:*)",
+      "Bash(gh issue list:*)",
+      "Bash(git push -u origin:*)",
+      "Bash(gh pr create --draft:*)",
+      "Bash(gh pr ready:*)",
+      "mcp__ccd_pr__bind_pr",
+      "mcp__ccd_pr__get_status",
+      "mcp__ccd_pr__set_monitor",
+      "mcp__Claude_Browser__get_page_text",
+      "mcp__Claude_Browser__tabs_context",
+      "mcp__claude-code-remote__send_message"
+    ],
+    "why": "an agent edits inside its checkout, reads git and GitHub, publishes a draft pull request, binds it and turns on the desktop app's CI monitor, reads a page and reports to the session that started it, all without a prompt"
   },
   "permissions.deny": {
     "includes": ["Bash(*--no-verify*)"],
     "why": "no git command skips the repository's hooks"
   },
   "permissions.ask": {
-    "includes": ["Bash(*git push*--force*)", "Bash(*git push* -f*)"],
-    "why": "a force push rewrites published history, so a person approves each one"
+    "includes": [
+      "Bash(*git push*--force*)",
+      "Bash(*git push* -f*)",
+      "Bash(*git push*--for*)",
+      "Bash(*git push*--mi*)",
+      "Bash(*git push*--de*)",
+      "Bash(*git push*--pru*)",
+      "Bash(*git push* -d *)",
+      "Bash(*git push* +*)",
+      "Bash(*git push* :*)",
+      "Bash(*git branch* -D*)",
+      "Bash(*git branch*-d*-f*)",
+      "Bash(*git branch*-f*-d*)",
+      "Bash(*git branch* -df*)",
+      "Bash(*git branch* -fd*)",
+      "Bash(pnpm add:*)",
+      "Bash(pnpm remove:*)",
+      "Bash(pnpm update:*)",
+      "Bash(npm install:*)",
+      "Bash(npm uninstall:*)",
+      "Bash(npm update:*)",
+      "Bash(yarn add:*)",
+      "Bash(yarn remove:*)"
+    ],
+    "why": "a person approves each push that rewrites or deletes published history (a force push, a mirror, a delete, a prune, a + or empty-source refspec, and their abbreviations), each forced delete of a local branch, and each dependency command (add, remove, update)"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@veda-hq/pariksha",
-  "version": "0.5.9",
+  "version": "0.5.11",
   "description": "Repository checks: doc drift, rule enforcement, test-quality ratchets. Checks: authority-citations, boundary, codec-registry, coverage-by-type, coverage-exemptions, doc-budgets, env-gate-switches, export-deletions, fault-injection-registry, required-settings. Also markdownlint rules for Markdown that renders mangled: @veda-hq/pariksha/markdownlint.",
   "keywords": [
     "repository checks",