claude-dev-env 8.16.0 → 8.17.0

package/.agents/skills/windows-scheduled-task/SKILL.md

@@ -20,6 +20,7 @@ description: >-
 - Status
 - Removal and teardown
 - Self-modification warning
+- Handing the elevated step to the operator
 - Verification
 - Files
 
@@ -36,6 +37,8 @@ prove the task by the artifact it changes.
 - Task Scheduler inherits none of the shell PATH. A bare executable name in the action fails at run time.
 - A helper under an installer-managed path deletes itself during an installer run.
 - `LastTaskResult: 0` from a run that took the idle branch says nothing about the branch that acts.
+- A `#Requires -RunAsAdministrator` line pasted at a prompt checks nothing. It applies only to a script file.
+- An elevated window opens in `C:\WINDOWS\system32`. A prompt in the user's home folder is usually unelevated.
 
 ## When this applies
 
@@ -134,6 +137,27 @@ instructions on a timer. A major upgrade can land mid-session while the agent ho
 Give the operator the teardown command, name the interval, and keep the interval wide enough for a
 session to finish between runs.
 
+## Handing the elevated step to the operator
+
+The operator runs the elevated part by hand, so hand it over as one block they paste into an
+Administrator window. Put the block in the message itself. A file to download adds a step and a
+path the browser can rename.
+
+Wrap the block in `& { ... }` and open it with an elevation check, so an unelevated paste stops
+with a clear line and changes nothing:
+
+```powershell
+& {
+$ErrorActionPreference = 'Stop'
+$IsAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
+if (-not $IsAdmin) { Write-Host 'NOT ELEVATED. Open PowerShell with Run as administrator and paste again.' -ForegroundColor Red; return }
+Register-ScheduledTask -TaskName $TaskName -Action $Action -Trigger $Trigger -Settings $Settings -Principal $Principal -Force
+}
+```
+
+The script block scopes `$ErrorActionPreference` and lets `return` end the paste. End the block
+with a status print the operator copies back, so the next step reads the result.
+
 ## Verification
 
 A run that takes the idle branch reports `LastTaskResult: 0`, and that result covers the idle branch

package/bin/install-plan.mjs

@@ -19,6 +19,10 @@
 import { existsSync, readFileSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { SETTINGS_FILE_NAME } from './install-constants.mjs';
+import {
+    emptyManagedPermissions,
+    managedPermissionsFromPackageSettings,
+} from './merge_managed_permissions.mjs';
 
 export const PREFLIGHT_ERROR_CODES = Object.freeze({
     SOURCE_CONFLICTS: 'source_conflicts',
@@ -353,7 +357,7 @@ export function buildUninstallPlan(input) {
             removableFiles: Object.freeze([]),
             skippedFiles: Object.freeze([]),
             allManifestFiles: Object.freeze([]),
-            managedPermissionDenyEntries: Object.freeze([]),
+            managedPermissions: Object.freeze(emptyManagedPermissions()),
             isNoOp: true,
         });
     }
@@ -374,12 +378,9 @@ export function buildUninstallPlan(input) {
     const allManifestFiles = Array.isArray(rawFiles)
         ? rawFiles.filter((eachPath) => typeof eachPath === 'string' && eachPath.trim() !== '')
         : [];
-    const rawManagedDeny = isManifestObject
-        ? manifest[MANIFEST_MANAGED_PERMISSIONS_KEY]?.deny
-        : null;
-    const managedPermissionDenyEntries = Array.isArray(rawManagedDeny)
-        ? rawManagedDeny.filter((eachEntry) => typeof eachEntry === 'string' && eachEntry.trim() !== '')
-        : [];
+    const managedPermissions = managedPermissionsFromPackageSettings({
+        permissions: isManifestObject ? manifest[MANIFEST_MANAGED_PERMISSIONS_KEY] : null,
+    });
 
     /** @type {string[]} */
     const removableFiles = [];
@@ -401,7 +402,7 @@ export function buildUninstallPlan(input) {
         removableFiles: Object.freeze(removableFiles),
         skippedFiles: Object.freeze(skippedFiles),
         allManifestFiles: Object.freeze(allManifestFiles),
-        managedPermissionDenyEntries: Object.freeze(managedPermissionDenyEntries),
+        managedPermissions: Object.freeze(managedPermissions),
         isNoOp: false,
     });
 }

package/bin/install.mjs

@@ -17,9 +17,13 @@ import {
 } from './expand_home_directory_tokens.mjs';
 import { EVER_SHIPPED_SKILL_NAMES } from './ever-shipped-skills.mjs';
 import {
-    managedDenyEntriesFromPackageSettings,
+    MANAGED_PERMISSION_LIST_NAMES,
+    countManagedPermissions,
+    emptyManagedPermissions,
+    managedPermissionsFromPackageSettings,
     mergeManagedPermissionsIntoSettings,
     pruneManagedPermissionsFromSettings,
+    retiredManagedPermissions,
 } from './merge_managed_permissions.mjs';
 import {
     SKIPPED_SOURCE_ENTRY_NAMES,
@@ -2085,84 +2089,87 @@ function writeManifest(installedFiles, skillNames, managedPermissions = null) {
         files: installedFiles,
         skills: skillNames,
     });
-    if (managedPermissions && Array.isArray(managedPermissions.deny) && managedPermissions.deny.length > 0) {
-        manifest[MANIFEST_MANAGED_PERMISSIONS_KEY] = {
-            deny: [...managedPermissions.deny],
-        };
+    if (managedPermissions && countManagedPermissions(managedPermissions) > 0) {
+        const manifestPermissions = {};
+        for (const eachListName of MANAGED_PERMISSION_LIST_NAMES) {
+            if (managedPermissions[eachListName].length > 0) {
+                manifestPermissions[eachListName] = [...managedPermissions[eachListName]];
+            }
+        }
+        manifest[MANIFEST_MANAGED_PERMISSIONS_KEY] = manifestPermissions;
     }
     writeFileSync(MANIFEST_FILE, JSON.stringify(manifest, null, 2) + '\n');
 }
 
 /**
- * Load package-owned deny entries from the package settings.json source.
+ * Load package-owned allow and deny rules from the package settings.json source.
  *
- * @returns {string[]}
+ * @returns {import('./merge_managed_permissions.mjs').ManagedPermissions}
  */
-function loadPackageManagedDenyEntries() {
+function loadPackageManagedPermissions() {
     const packageSettingsPath = join(PACKAGE_ROOT, SETTINGS_FILE_NAME);
     if (!existsSync(packageSettingsPath)) {
-        return [];
+        return emptyManagedPermissions();
     }
     try {
         const packageSettings = JSON.parse(readFileSync(packageSettingsPath, 'utf8'));
-        return managedDenyEntriesFromPackageSettings(packageSettings);
+        return managedPermissionsFromPackageSettings(packageSettings);
     } catch (parseError) {
         console.warn(
             `  Warning: could not read package ${SETTINGS_FILE_NAME} for managed permissions (${parseError.message})`,
         );
-        return [];
+        return emptyManagedPermissions();
     }
 }
 
 /**
- * Load deny entries an earlier manifest records as package-managed.
+ * Load the allow and deny rules an earlier manifest records as package-managed.
  *
- * @returns {string[]}
+ * @returns {import('./merge_managed_permissions.mjs').ManagedPermissions}
  */
-function loadPriorManagedDenyEntries() {
-    if (!existsSync(MANIFEST_FILE)) return [];
+function loadPriorManagedPermissions() {
+    if (!existsSync(MANIFEST_FILE)) return emptyManagedPermissions();
     try {
         const priorManifest = JSON.parse(readFileSync(MANIFEST_FILE, 'utf8'));
-        return managedDenyEntriesFromPackageSettings({
+        return managedPermissionsFromPackageSettings({
             permissions: priorManifest?.[MANIFEST_MANAGED_PERMISSIONS_KEY],
         });
     } catch {
-        return [];
+        return emptyManagedPermissions();
     }
 }
 
 /**
  * Reconcile package-managed permission defaults with ~/.claude/settings.json.
  *
- * @returns {{addedCount: number, alreadyPresentCount: number, removedCount: number, managedDenyEntries: string[]}}
+ * @returns {{addedCount: number, alreadyPresentCount: number, removedCount: number, managedPermissions: import('./merge_managed_permissions.mjs').ManagedPermissions}}
  */
 function mergeManagedPermissions() {
-    const allCurrentManagedDenyEntries = loadPackageManagedDenyEntries();
-    const allPriorManagedDenyEntries = loadPriorManagedDenyEntries();
-    const allCurrentManagedDenyEntrySet = new Set(allCurrentManagedDenyEntries);
-    const allRetiredManagedDenyEntries = allPriorManagedDenyEntries.filter(
-        eachEntry => !allCurrentManagedDenyEntrySet.has(eachEntry),
+    const currentManagedPermissions = loadPackageManagedPermissions();
+    const retiredPermissions = retiredManagedPermissions(
+        loadPriorManagedPermissions(),
+        currentManagedPermissions,
     );
-    const hasCurrentManagedDenyEntries = allCurrentManagedDenyEntries.length > 0;
-    const hasRetiredManagedDenyEntries = allRetiredManagedDenyEntries.length > 0;
-    if (!hasCurrentManagedDenyEntries && !hasRetiredManagedDenyEntries) {
+    const hasCurrentManagedPermissions = countManagedPermissions(currentManagedPermissions) > 0;
+    const hasRetiredManagedPermissions = countManagedPermissions(retiredPermissions) > 0;
+    if (!hasCurrentManagedPermissions && !hasRetiredManagedPermissions) {
         return {
             addedCount: 0,
             alreadyPresentCount: 0,
             removedCount: 0,
-            managedDenyEntries: [],
+            managedPermissions: emptyManagedPermissions(),
         };
     }
     const settingsPath = join(CLAUDE_HOME, SETTINGS_FILE_NAME);
     const settingsExisted = existsSync(settingsPath);
     const settings = loadClaudeSettingsObject(settingsPath);
-    const pruneOutcome = pruneManagedPermissionsFromSettings(settings, allRetiredManagedDenyEntries);
-    const mergeOutcome = hasCurrentManagedDenyEntries
-        ? mergeManagedPermissionsIntoSettings(settings, allCurrentManagedDenyEntries)
-        : { addedCount: 0, alreadyPresentCount: 0, managedDenyEntries: [] };
+    const pruneOutcome = pruneManagedPermissionsFromSettings(settings, retiredPermissions);
+    const mergeOutcome = hasCurrentManagedPermissions
+        ? mergeManagedPermissionsIntoSettings(settings, currentManagedPermissions)
+        : { addedCount: 0, alreadyPresentCount: 0, managedPermissions: emptyManagedPermissions() };
     const shouldWriteSettings = pruneOutcome.removedCount > 0
         || mergeOutcome.addedCount > 0
-        || (!settingsExisted && hasCurrentManagedDenyEntries);
+        || (!settingsExisted && hasCurrentManagedPermissions);
     if (shouldWriteSettings) {
         writeFileSync(settingsPath, JSON.stringify(settings, null, 4) + '\n');
     }
@@ -2846,13 +2853,14 @@ function executeInstallPlanMutations(plan, transactionHelpers) {
     const permissionMerge = mergeManagedPermissions();
     summary.managedPermissions = permissionMerge;
     if (permissionMerge.removedCount > 0) {
-        console.log(`  Permissions: ${permissionMerge.removedCount} retired managed deny(s) removed`);
+        console.log(`  Permissions: ${permissionMerge.removedCount} retired managed rule(s) removed`);
     }
-    if (permissionMerge.managedDenyEntries.length > 0) {
+    const managedRuleCount = countManagedPermissions(permissionMerge.managedPermissions);
+    if (managedRuleCount > 0) {
         console.log(
-            `  Permissions: ${permissionMerge.addedCount} managed deny(s) added, `
+            `  Permissions: ${permissionMerge.addedCount} managed rule(s) added, `
             + `${permissionMerge.alreadyPresentCount} already present `
-            + `(${permissionMerge.managedDenyEntries.length} package-owned)`,
+            + `(${managedRuleCount} package-owned)`,
         );
     }
 
@@ -2918,14 +2926,7 @@ function executeInstallPlanMutations(plan, transactionHelpers) {
     const manifestFiles = didPruneFinish
         ? manifestFilesWithFailedPrunes(allManagedInstalledFiles, failedPrunePaths)
         : unionOnComparisonKey(priorManifestFiles || [], allManagedInstalledFiles);
-    const managedPermissionDenyEntries = summary.managedPermissions.managedDenyEntries;
-    writeManifest(
-        manifestFiles,
-        manifestSkillNames,
-        managedPermissionDenyEntries.length > 0
-            ? { deny: managedPermissionDenyEntries }
-            : null,
-    );
+    writeManifest(manifestFiles, manifestSkillNames, summary.managedPermissions.managedPermissions);
     syncWrittenPaths([...allInstalledFiles, MANIFEST_FILE, plan.settingsPath, ...publishedPointerPaths]);
     throwIfFault(FAULT_PHASES.AFTER_MANIFEST_WRITE);
     console.log(`\nInstalled ${PACKAGE_NAME}:`);
@@ -3122,15 +3123,15 @@ function executeUninstallPlan(plan, helpers = {}) {
                 console.log(`  Session continuity: ${removedContinuityCount} hook registration(s) removed from settings.json`);
             }
         }
-        const managedDenyFromPlan = plan.managedPermissionDenyEntries.length > 0
-            ? plan.managedPermissionDenyEntries
-            : loadPackageManagedDenyEntries();
-        if (managedDenyFromPlan.length > 0) {
-            const pruneOutcome = pruneManagedPermissionsFromSettings(settings, managedDenyFromPlan);
+        const managedPermissionsFromPlan = countManagedPermissions(plan.managedPermissions) > 0
+            ? plan.managedPermissions
+            : loadPackageManagedPermissions();
+        if (countManagedPermissions(managedPermissionsFromPlan) > 0) {
+            const pruneOutcome = pruneManagedPermissionsFromSettings(settings, managedPermissionsFromPlan);
             if (pruneOutcome.removedCount > 0) {
                 didSettingsChange = true;
                 console.log(
-                    `  Permission entries removed from settings.json: ${pruneOutcome.removedCount} managed deny(s)`,
+                    `  Permission entries removed from settings.json: ${pruneOutcome.removedCount} managed rule(s)`,
                 );
             }
         }

package/bin/install.settings-defaults.test.mjs

@@ -17,7 +17,7 @@ import { fileURLToPath } from 'node:url';
 import { spawnSync } from 'node:child_process';
 
 import {
-    managedDenyEntriesFromPackageSettings,
+    managedPermissionsFromPackageSettings,
     mergeManagedPermissionsIntoSettings,
     pruneManagedPermissionsFromSettings,
 } from './merge_managed_permissions.mjs';
@@ -27,7 +27,10 @@ const PACKAGE_SETTINGS_PATH = join(PACKAGE_ROOT, 'settings.json');
 const INSTALL_ENTRY = join(PACKAGE_ROOT, 'bin', 'install.mjs');
 
 const EXPECTED_DENY_ENTRIES = [];
+const EXPECTED_ALLOW_ENTRIES = ['WebFetch(domain:docs.github.com)'];
 const SAMPLE_MANAGED_DENY_ENTRIES = ['Edit($HOME/.claude/managed-test/**)'];
+const SAMPLE_MANAGED_PERMISSIONS = { allow: [], deny: SAMPLE_MANAGED_DENY_ENTRIES };
+const SAMPLE_MANAGED_ALLOW_PERMISSIONS = { allow: ['WebFetch(domain:example.com)'], deny: [] };
 const LEGACY_MANAGED_DENY_ENTRIES = [
     'Edit($HOME/.claude/verification/**)',
     'Write($HOME/.claude/code-review-stamps/**)',
@@ -36,9 +39,9 @@ const LEGACY_MANAGED_DENY_ENTRIES = [
 ];
 const USER_OWNED_DENY_ENTRY = 'Bash(rm -rf /)';
 
-function packageDenyEntries() {
+function packageManagedPermissions() {
     const packageSettings = JSON.parse(readFileSync(PACKAGE_SETTINGS_PATH, 'utf8'));
-    return managedDenyEntriesFromPackageSettings(packageSettings);
+    return managedPermissionsFromPackageSettings(packageSettings);
 }
 
 function runInstallerInSandbox(sandboxHome, installerArguments = []) {
@@ -57,14 +60,16 @@ function runInstallerInSandbox(sandboxHome, installerArguments = []) {
     });
 }
 
-test('package settings.json publishes no managed deny entries', () => {
-    const denyEntries = packageDenyEntries();
-    assert.deepEqual(denyEntries, EXPECTED_DENY_ENTRIES);
+test('package settings.json publishes the GitHub docs fetch allow and no managed deny entries', () => {
+    assert.deepEqual(packageManagedPermissions(), {
+        allow: EXPECTED_ALLOW_ENTRIES,
+        deny: EXPECTED_DENY_ENTRIES,
+    });
 });
 
 test('an array-valued permissions field is replaced so managed denies survive a round trip', () => {
     const targetSettings = { permissions: [] };
-    const result = mergeManagedPermissionsIntoSettings(targetSettings, SAMPLE_MANAGED_DENY_ENTRIES);
+    const result = mergeManagedPermissionsIntoSettings(targetSettings, SAMPLE_MANAGED_PERMISSIONS);
     assert.equal(result.addedCount, SAMPLE_MANAGED_DENY_ENTRIES.length);
     assert.equal(Array.isArray(targetSettings.permissions), false);
     const roundTripped = JSON.parse(JSON.stringify(targetSettings));
@@ -98,7 +103,7 @@ test('mergeManagedPermissionsIntoSettings adds each managed deny exactly once',
             deny: ['Bash(rm -rf /)'],
         },
     };
-    const first = mergeManagedPermissionsIntoSettings(target, SAMPLE_MANAGED_DENY_ENTRIES);
+    const first = mergeManagedPermissionsIntoSettings(target, SAMPLE_MANAGED_PERMISSIONS);
     assert.equal(first.addedCount, SAMPLE_MANAGED_DENY_ENTRIES.length);
     assert.equal(first.alreadyPresentCount, 0);
     const managedDenyCount = target.permissions.deny.filter((each) => (
@@ -108,7 +113,7 @@ test('mergeManagedPermissionsIntoSettings adds each managed deny exactly once',
     assert.ok(target.permissions.deny.includes('Bash(rm -rf /)'));
     assert.deepEqual(target.permissions.allow, ['Bash(git status)']);
 
-    const second = mergeManagedPermissionsIntoSettings(target, SAMPLE_MANAGED_DENY_ENTRIES);
+    const second = mergeManagedPermissionsIntoSettings(target, SAMPLE_MANAGED_PERMISSIONS);
     assert.equal(second.addedCount, 0);
     assert.equal(second.alreadyPresentCount, SAMPLE_MANAGED_DENY_ENTRIES.length);
     assert.equal(
@@ -128,13 +133,27 @@ test('pruneManagedPermissionsFromSettings removes only package-owned deny entrie
             ],
         },
     };
-    const outcome = pruneManagedPermissionsFromSettings(target, SAMPLE_MANAGED_DENY_ENTRIES);
+    const outcome = pruneManagedPermissionsFromSettings(target, SAMPLE_MANAGED_PERMISSIONS);
     assert.equal(outcome.removedCount, SAMPLE_MANAGED_DENY_ENTRIES.length);
     assert.deepEqual(target.permissions.deny, ['Bash(rm -rf /)']);
     assert.deepEqual(target.permissions.allow, ['Bash(git status)']);
     assert.deepEqual(target.permissions.ask, ['Edit(./**)']);
 });
 
+test('mergeManagedPermissionsIntoSettings adds a managed allow once and prune removes only it', () => {
+    const target = { permissions: { allow: ['Bash(git status)'] } };
+    const first = mergeManagedPermissionsIntoSettings(target, SAMPLE_MANAGED_ALLOW_PERMISSIONS);
+    assert.equal(first.addedCount, 1);
+    const second = mergeManagedPermissionsIntoSettings(target, SAMPLE_MANAGED_ALLOW_PERMISSIONS);
+    assert.equal(second.addedCount, 0);
+    assert.deepEqual(target.permissions.allow, ['Bash(git status)', 'WebFetch(domain:example.com)']);
+    assert.equal(Object.hasOwn(target.permissions, 'deny'), false);
+
+    const outcome = pruneManagedPermissionsFromSettings(target, SAMPLE_MANAGED_ALLOW_PERMISSIONS);
+    assert.equal(outcome.removedCount, 1);
+    assert.deepEqual(target.permissions.allow, ['Bash(git status)']);
+});
+
 test('sandbox install keeps default managed denies empty on repeat', () => {
     const sandboxHome = mkdtempSync(join(tmpdir(), 'cde-settings-defaults-'));
     try {
@@ -146,16 +165,19 @@ test('sandbox install keeps default managed denies empty on repeat', () => {
         const firstSettings = JSON.parse(readFileSync(settingsPath, 'utf8'));
         const firstDeny = firstSettings.permissions?.deny ?? [];
         assert.deepEqual(firstDeny, EXPECTED_DENY_ENTRIES);
+        assert.deepEqual(firstSettings.permissions?.allow, EXPECTED_ALLOW_ENTRIES);
 
         const manifestPath = join(sandboxHome, '.claude', '.claude-dev-env-manifest.json');
         const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
         assert.deepEqual(manifest.managedPermissions?.deny ?? [], EXPECTED_DENY_ENTRIES);
+        assert.deepEqual(manifest.managedPermissions?.allow, EXPECTED_ALLOW_ENTRIES);
 
         const secondInstall = runInstallerInSandbox(sandboxHome, []);
         assert.equal(secondInstall.status, 0, secondInstall.stderr || secondInstall.stdout);
         const secondSettings = JSON.parse(readFileSync(settingsPath, 'utf8'));
         const secondDeny = secondSettings.permissions?.deny ?? [];
         assert.deepEqual(secondDeny, EXPECTED_DENY_ENTRIES);
+        assert.deepEqual(secondSettings.permissions?.allow, EXPECTED_ALLOW_ENTRIES);
     } finally {
         rmSync(sandboxHome, { recursive: true, force: true });
     }
@@ -186,11 +208,11 @@ test('a normal upgrade retires manifest-owned denies and preserves user entries'
 
         const upgradedSettings = JSON.parse(readFileSync(settingsPath, 'utf8'));
         assert.deepEqual(upgradedSettings.permissions?.deny, [USER_OWNED_DENY_ENTRY]);
-        assert.deepEqual(upgradedSettings.permissions?.allow, ['Bash(git status)']);
+        assert.deepEqual(upgradedSettings.permissions?.allow, ['Bash(git status)', ...EXPECTED_ALLOW_ENTRIES]);
         assert.deepEqual(upgradedSettings.permissions?.ask, ['Edit(./**)']);
 
         const upgradedManifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
-        assert.equal(Object.hasOwn(upgradedManifest, 'managedPermissions'), false);
+        assert.deepEqual(upgradedManifest.managedPermissions, { allow: EXPECTED_ALLOW_ENTRIES });
     } finally {
         rmSync(sandboxHome, { recursive: true, force: true });
     }
@@ -219,6 +241,9 @@ test('sandbox uninstall removes only package-owned permission entries and keeps
         for (const eachEntry of EXPECTED_DENY_ENTRIES) {
             assert.ok(!denyAfter.includes(eachEntry), `managed deny still present: ${eachEntry}`);
         }
+        for (const eachEntry of EXPECTED_ALLOW_ENTRIES) {
+            assert.ok(!(after.permissions?.allow ?? []).includes(eachEntry), `managed allow still present: ${eachEntry}`);
+        }
         assert.ok(denyAfter.includes('Bash(rm -rf /)'), 'user deny preserved');
         assert.ok((after.permissions?.allow ?? []).includes('Bash(git status)'), 'user allow preserved');
         assert.ok((after.permissions?.ask ?? []).includes('Edit(./**)'), 'user ask preserved');

package/bin/merge_managed_permissions.mjs

@@ -1,10 +1,11 @@
 /**
  * Merge package-owned permission defaults into a settings object.
  *
- * Ownership is the stable deny-entry string published in the package
- * settings.json. Install ensures each package deny appears once. Uninstall
- * removes only those package-owned identity strings and leaves every other
- * allow/ask/deny entry unchanged.
+ * Ownership is the stable rule string published in the package settings.json
+ * `permissions.allow` and `permissions.deny` lists. Install ensures each
+ * package rule appears once in its list. Uninstall removes only those
+ * package-owned rule strings and leaves every other allow/ask/deny entry
+ * unchanged.
  */
 
 /**
@@ -23,35 +24,91 @@
  */
 
 /**
- * Read the managed deny list from a package settings source object.
+ * @typedef {{
+ *   allow: string[],
+ *   deny: string[],
+ * }} ManagedPermissions
+ */
+
+export const MANAGED_PERMISSION_LIST_NAMES = Object.freeze(['allow', 'deny']);
+
+/**
+ * Build an empty managed-permissions record.
+ *
+ * @returns {ManagedPermissions}
+ */
+export function emptyManagedPermissions() {
+    return { allow: [], deny: [] };
+}
+
+/**
+ * Read the managed allow and deny lists from a package settings source object
+ * or a manifest record of the same shape.
  *
  * @param {SettingsObject | null | undefined} packageSettings
- * @returns {string[]}
+ * @returns {ManagedPermissions}
  */
-export function managedDenyEntriesFromPackageSettings(packageSettings) {
-    const denyList = packageSettings?.permissions?.deny;
-    if (!Array.isArray(denyList)) {
-        return [];
+export function managedPermissionsFromPackageSettings(packageSettings) {
+    const managedPermissions = emptyManagedPermissions();
+    for (const eachListName of MANAGED_PERMISSION_LIST_NAMES) {
+        const sourceList = packageSettings?.permissions?.[eachListName];
+        if (!Array.isArray(sourceList)) {
+            continue;
+        }
+        managedPermissions[eachListName] = sourceList.filter(
+            (eachEntry) => typeof eachEntry === 'string' && eachEntry.trim().length > 0,
+        );
     }
-    return denyList.filter((eachEntry) => typeof eachEntry === 'string' && eachEntry.length > 0);
+    return managedPermissions;
 }
 
 /**
- * Merge package-owned deny entries into target settings in place.
+ * Count the rules a managed-permissions record holds across every list.
  *
- * Existing allow/ask entries and non-package deny entries stay as written.
- * Package deny strings already present are not duplicated.
+ * @param {ManagedPermissions} managedPermissions
+ * @returns {number}
+ */
+export function countManagedPermissions(managedPermissions) {
+    return MANAGED_PERMISSION_LIST_NAMES.reduce(
+        (runningCount, eachListName) => runningCount + managedPermissions[eachListName].length,
+        0,
+    );
+}
+
+/**
+ * List the rules a prior record owned that the current record no longer owns.
+ *
+ * @param {ManagedPermissions} priorPermissions
+ * @param {ManagedPermissions} currentPermissions
+ * @returns {ManagedPermissions}
+ */
+export function retiredManagedPermissions(priorPermissions, currentPermissions) {
+    const retiredPermissions = emptyManagedPermissions();
+    for (const eachListName of MANAGED_PERMISSION_LIST_NAMES) {
+        const currentSet = new Set(currentPermissions[eachListName]);
+        retiredPermissions[eachListName] = priorPermissions[eachListName].filter(
+            (eachEntry) => !currentSet.has(eachEntry),
+        );
+    }
+    return retiredPermissions;
+}
+
+/**
+ * Merge package-owned allow and deny rules into target settings in place.
+ *
+ * Existing user entries stay as written. Package rules already present are
+ * not duplicated.
  *
  * @param {SettingsObject} targetSettings
- * @param {string[]} managedDenyEntries
- * @returns {{addedCount: number, alreadyPresentCount: number, managedDenyEntries: string[]}}
+ * @param {ManagedPermissions} managedPermissions
+ * @returns {{addedCount: number, alreadyPresentCount: number, managedPermissions: ManagedPermissions}}
  */
-export function mergeManagedPermissionsIntoSettings(targetSettings, managedDenyEntries) {
+export function mergeManagedPermissionsIntoSettings(targetSettings, managedPermissions) {
     if (!targetSettings || typeof targetSettings !== 'object' || Array.isArray(targetSettings)) {
         throw new TypeError('targetSettings must be a plain object');
     }
-    if (!Array.isArray(managedDenyEntries)) {
-        throw new TypeError('managedDenyEntries must be an array');
+    if (!managedPermissions || typeof managedPermissions !== 'object') {
+        throw new TypeError('managedPermissions must be an object of allow and deny lists');
     }
 
     if (
@@ -62,65 +119,78 @@ export function mergeManagedPermissionsIntoSettings(targetSettings, managedDenyE
         targetSettings.permissions = {};
     }
     const permissions = targetSettings.permissions;
-    if (!Array.isArray(permissions.deny)) {
-        permissions.deny = [];
-    }
 
     let addedCount = 0;
     let alreadyPresentCount = 0;
-    for (const eachEntry of managedDenyEntries) {
-        if (typeof eachEntry !== 'string' || eachEntry.length === 0) {
+    for (const eachListName of MANAGED_PERMISSION_LIST_NAMES) {
+        const managedEntries = managedPermissions[eachListName] ?? [];
+        if (managedEntries.length === 0) {
             continue;
         }
-        if (permissions.deny.includes(eachEntry)) {
-            alreadyPresentCount += 1;
-            continue;
+        if (!Array.isArray(permissions[eachListName])) {
+            permissions[eachListName] = [];
+        }
+        for (const eachEntry of managedEntries) {
+            if (typeof eachEntry !== 'string' || eachEntry.length === 0) {
+                continue;
+            }
+            if (permissions[eachListName].includes(eachEntry)) {
+                alreadyPresentCount += 1;
+                continue;
+            }
+            permissions[eachListName].push(eachEntry);
+            addedCount += 1;
         }
-        permissions.deny.push(eachEntry);
-        addedCount += 1;
     }
 
     return {
         addedCount,
         alreadyPresentCount,
-        managedDenyEntries: [...managedDenyEntries],
+        managedPermissions: {
+            allow: [...(managedPermissions.allow ?? [])],
+            deny: [...(managedPermissions.deny ?? [])],
+        },
     };
 }
 
 /**
- * Remove package-owned deny entries from target settings in place.
+ * Remove package-owned allow and deny rules from target settings in place.
  *
- * User allow, ask, and non-package deny entries remain. Empty permission
- * lists are dropped so uninstall leaves a clean settings object.
+ * User allow, ask, and deny entries the package does not own remain. Empty
+ * permission lists are dropped so uninstall leaves a clean settings object.
  *
  * @param {SettingsObject} targetSettings
- * @param {string[]} managedDenyEntries
+ * @param {ManagedPermissions} managedPermissions
  * @returns {{removedCount: number}}
  */
-export function pruneManagedPermissionsFromSettings(targetSettings, managedDenyEntries) {
+export function pruneManagedPermissionsFromSettings(targetSettings, managedPermissions) {
     if (!targetSettings?.permissions || typeof targetSettings.permissions !== 'object') {
         return { removedCount: 0 };
     }
     const permissions = targetSettings.permissions;
-    if (!Array.isArray(permissions.deny) || permissions.deny.length === 0) {
-        return { removedCount: 0 };
-    }
-
-    const managedSet = new Set(
-        managedDenyEntries.filter((eachEntry) => typeof eachEntry === 'string'),
-    );
-    const denyCountBefore = permissions.deny.length;
-    permissions.deny = permissions.deny.filter((eachEntry) => !managedSet.has(eachEntry));
-    const removedCount = denyCountBefore - permissions.deny.length;
 
-    if (permissions.deny.length === 0) {
-        delete permissions.deny;
+    let removedCount = 0;
+    for (const eachListName of MANAGED_PERMISSION_LIST_NAMES) {
+        if (!Array.isArray(permissions[eachListName])) {
+            continue;
+        }
+        const managedSet = new Set(
+            (managedPermissions?.[eachListName] ?? []).filter((eachEntry) => typeof eachEntry === 'string'),
+        );
+        const countBefore = permissions[eachListName].length;
+        permissions[eachListName] = permissions[eachListName].filter(
+            (eachEntry) => !managedSet.has(eachEntry),
+        );
+        removedCount += countBefore - permissions[eachListName].length;
     }
-    if (Array.isArray(permissions.allow) && permissions.allow.length === 0) {
-        delete permissions.allow;
+    if (removedCount === 0) {
+        return { removedCount };
     }
-    if (Array.isArray(permissions.ask) && permissions.ask.length === 0) {
-        delete permissions.ask;
+
+    for (const eachListName of ['allow', 'ask', 'deny']) {
+        if (Array.isArray(permissions[eachListName]) && permissions[eachListName].length === 0) {
+            delete permissions[eachListName];
+        }
     }
     if (Object.keys(permissions).length === 0) {
         delete targetSettings.permissions;

package/hooks/hooks_constants/working_style_prompt_constants.py

@@ -25,7 +25,9 @@ WORKING_STYLE_PROMPT = (
     "Deliver the requested work at its intended scope. Make routine judgment calls "
     "yourself. Ask for direction when different interpretations would produce "
     "materially different work. When a request seems mistaken or a better approach "
-    "exists, state the concern briefly and continue with the requested task. Finish "
+    "exists, state the concern briefly and continue with the requested task. "
+    "A request to remove something is complete once it is gone. Put nothing in its "
+    "place, and pass a replacement idea to the requester as a question. Finish "
     "the complete task and keep actions within the requested scope. "
     "When a request has multiple reasonable interpretations, state your understanding "
     "and the assumptions that shape the work. Ask one focused clarification question "

package/hooks/session/test_working_style_prompt.py

@@ -43,6 +43,8 @@ class TestWorkingStylePrompt:
         prompt_text = emitted["hookSpecificOutput"]["additionalContext"]
         assert "Document each task in a location that remains easy to find later." in prompt_text
         assert "Deliver the requested work at its intended scope." in prompt_text
+        assert "A request to remove something is complete once it is gone." in prompt_text
+        assert "pass a replacement idea to the requester as a question." in prompt_text
         assert "Use ELI5 for beginner framing, large visuals, minimal text" in prompt_text
         assert "one stable self-contained HTML artifact" in prompt_text
         assert "update-in-place continuity, and sharing" in prompt_text

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.16.0",
+    "version": "8.17.0",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/rules/review-closure-is-a-check.md

@@ -35,6 +35,8 @@ The driving account is the one that opened the pull request. Where the agent com
 
 A private repository that installs this package runs the same command from its own workflow, against the revision of this package that its workflow pins.
 
+A repository that merges through a merge queue also runs the check on `merge_group` and lists `Review closure` as a required check. The queue ref `gh-readonly-queue/<base>/pr-<number>-<sha>` names the pull request number the command takes. A finding posted while an entry waits in the queue then fails the queue build. Without that trigger, the entry merges on the verdict it carried when it joined the queue.
+
 ## Sibling rules
 
 | Rule | Role |

package/settings.json

@@ -1 +1,7 @@
-{}
+{
+    "permissions": {
+        "allow": [
+            "WebFetch(domain:docs.github.com)"
+        ]
+    }
+}