audit fixes (P9): narrow the agent push permissions and correct the assistant tooling config

[BigSimmo]

Summary

Audit remediation package P9 — Agent tooling and permissions, from docs/audit/full-repository-audit-2026-09-02.md (PR #2573). Findings fixed: M21, M35, L39, L40, L62, L102, L132.

The one that matters is M21. .claude/settings.json on main allows Bash(git push:*) — every spelling of push, with any arguments. The deny list only catches a force flag written immediately after git push or git push origin, so git push origin some-branch --force is auto-approved today with no prompt. This replaces the blanket allow with three specific safe spellings and grows the deny list from 15 entries to 40, covering force, force-with-lease, -f, +refs, delete, mirror, and main/master targets in every spelling the tool can produce.

An independent verification pass worked the matcher against ten dangerous spellings; all ten are denied:

Spelling	Result
git push --force	denied
git push --force-with-lease	denied
git push -f	denied
git push origin +refs/heads/x	denied
git push origin HEAD:main	denied
git push origin main	denied
git push --mirror	denied
git push --delete origin <branch>	denied
git push -u origin <feature>	prompts
git push (plain)	allowed — pushes the current branch

A residual gap remains, and it needs an owner decision — see "Known gap" below.

The rest: M35 widens the review-agent scope globs to the real src/lib/rag/** paths (the previous globs named src/lib/rag*.ts, which no longer exists). L40 adds the capitalised mcp__Supabase__* deny twins for all eleven lowercase rows, so the connector cannot be reached under its other spelling. L39 adds features=docs,development to the Supabase MCP entries. L62 makes the Cursor repo-auditor triage-only, matching its Claude twin. L102 removes a hard-coded workstation path. L132 strips a byte-order mark from .cursorignore.

Known gap — owner decision required

Bash(git push -u origin claude/:*) is a raw string-prefix allow. That means git push -u origin claude/some-branch --force and ... --no-verify match the allow and reach no deny rule — verified by running the settings file's own matcher against both. This is precisely the shape M21 exists to prevent.

It is not fixed here, for two reasons. First, this package still strictly improves on main, where force-pushing any branch is auto-approved. Second, closing it means removing the convenience allow, after which every branch push by an assistant session stops and asks — a real daily cost that is the owner's call, not automation's.

Recommended follow-up (not taken here): rather than removing the convenience rule, extend scripts/guard-push.mjs, which inspects the actual push rather than the command text and therefore cannot be dodged by a spelling. Today it only blocks a force-push when a pull request on that branch has auto-merge armed.

Findings in this package not fixed here, with reasons:

• L41 — pinning the Node and gh tarball checksums requires fetching upstream SHASUMS, a network call this work was not authorised to make.
• L61 — the pull-request-handoff hook wording is pinned the opposite way by two committed tests; changing it needs an owner ruling on which wording is correct, and touches files this package does not own.

RAG impact: none — assistant tooling configuration only; no retrieval, ranking, ordering, selection or product code changed.

Verification

• npm run verify:pr-local — - completed: check:runtime, check:installed-lock-parity, format:changed, check:diff-integrity, sitemap:check, check:repo-awareness-snapshot, docs:check-index, docs:check-inventory, docs:check-scripts, docs:check-links, check:branch-review-ledger, check:outstanding-issues, check:ledger-write-discipline, check:github-actions, check:ci-scope, check:gitleaks-pinned, check:ci-triage, check:pr-policy, check:gate-manifest, check:skills, check:pr-mergeability, check:verification-plan, lint, typecheck, test, check:rag:fixtures, check:medication-interactions, check:medication-lexicon-report · - failed: (none) · - not reached: (none) · Test Files 1128 passed | 1 skipped (1129) · Tests 15118 passed | 2 expected fail | 3 skipped (15123)
• npm run check:diff-integrity — [diff-integrity] PASS — 3 changed test file(s), 20 -> 32 test case(s), against base 51ddfcd83.
• npm run check:skills — Database skill system valid: 35 canonical skills, 8 aliases, 67 repository SKILL.md files across 4 surfaces.
• L132 verified byte-for-byte: origin/main's .cursorignore begins ef bb bf; this branch's begins 23 20 43. The mark is genuinely gone.
• M35 verified by existence check: src/lib/rag*.ts genuinely does not exist, and every file named in the new src/lib/rag/** scope does.

Build skipped by the gate's own classifier: Skipping build: no build-affecting source, config, package, or container changes detected.

Verification not run: npm run verify:ui — no UI surface changed; browser proof left to CI.
Verification not run: npm run verify:release — no release or handoff confidence is claimed.
Verification not run: provider-backed gates — nothing here reaches OpenAI, Supabase, Railway or Sentry at run time.

Risk and rollout

• Risk: low for the product (no product code changes), medium for developer workflow — a push spelling that used to be auto-approved may now prompt. That is the intended direction. Residual risk is the known gap above, which is narrower than the status quo on main, not wider.
• Rollback: revert this pull request's commits; each is one finding and reverts independently.
• Provider or production effects: None.
• RAG impact: none.

Notes

• No hook's exit behaviour or timeout was changed; the diff under .claude/hooks/ is empty, as docs/agents/claude-hook-scripts.md requires.
• No test was deleted, skipped or weakened; the case count rose from 20 to 32.
• origin/main was merged into this branch (not rebased) before gating.
• One owner per file across the remediation programme: no other open remediation pull request edits these files.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DHSyfuC6mS98ystWFiitAR

---

Generated by Claude Code

---

Note

Low Risk
No runtime clinical/RAG behavior changes; risk is limited to assistant developer workflow (more push prompts) and a documented residual force-push prefix gap on claude/* upstream pushes.

Overview
Audit P9 (agent tooling) — no application or RAG product code changes; only Claude/Cursor config, review-agent docs, and tests.

Git push permissions (M21) in .claude/settings.json drops the blanket Bash(git push:*) allow and replaces it with three explicit safe patterns (git push, git push origin HEAD, git push -u origin claude/:…). The deny list grows to cover force/force-with-lease, + refspecs, remote delete/mirror, --no-verify, and main/master targets in additional spellings. Supabase MCP write tools are denied under both mcp__supabase__* and mcp__Supabase__* connector spellings (L40).

Review-agent scopes (M35) retarget rag-retrieval-reviewer and clinical-governance-reviewer from obsolete src/lib/rag*.ts globs to src/lib/rag/** after the RAG tree move. New tests/agent-scopes.test.ts validates scope globs against the repo tree and Cursor “twin” contracts (repo-auditor triage-only, portable Supabase skill wording, BOM-free .cursorignore).

Cursor Supabase MCP (L39) adds features=docs,development to match Claude/Codex and avoid default database/debugging tools against the live project. Repo-auditor and Supabase Cursor skills are aligned with Claude (L62, L102); .cursorignore UTF-8 BOM removed (L132).

Tests expand claude-code-settings.test.ts for push tightening and Supabase deny twins; cursor-mcp-contract.test.ts asserts the restricted Supabase URL. PR notes a residual gap: git push -u origin claude/… --force can still match the convenience allow prefix.

^{Reviewed by Cursor Bugbot for commit 6ad1945. Configure here.}

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 9f165f78-dbda-41b1-bfa5-fc33655ea3c5

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_1dd796e5-0a29-4e76-a478-36f23fb229af)