From 1277fa91d7e3daf87f87b1cd4d85df3eeaa6c62d Mon Sep 17 00:00:00 2001
From: gongzhiyong <gjgongzhiyonggj@outlook.com>
Date: Fri, 24 Apr 2026 22:47:20 +0800
Subject: [PATCH] chore(perms): unblock 'git reset --hard' (move from deny to
 prompt)

- Removed Bash(git reset --hard*) and Bash(git clean -fd*) from deny list.
- git reset --hard and git clean -fd are not in allow either, so Claude
  will prompt for confirmation each time (safest middle ground).
- git clean -fdx remains denied (removes ignored files = dangerous).
- Updated CLAUDE.md permission summary to reflect new model.
---
 .claude/settings.json | 2 --
 CLAUDE.md             | 5 ++++-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/.claude/settings.json b/.claude/settings.json
index 4548af8..06bbca5 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -321,8 +321,6 @@
       "Bash(git push -f*)",
       "Bash(git push origin main*)",
       "Bash(git push origin master*)",
-      "Bash(git reset --hard*)",
-      "Bash(git clean -fd*)",
       "Bash(git clean -fdx*)",
       "Bash(git commit --amend*)",
       "Bash(git filter-branch*)",
diff --git a/CLAUDE.md b/CLAUDE.md
index 3b891ad..d6828dc 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -131,8 +131,11 @@
 
 **硬拦截：**
 - ❌ 任何 Azure 资源的 create/update/delete/restart
-- ❌ `git push --force`、`git commit --amend`、`git reset --hard`
+- ❌ `git push --force`、`git commit --amend`、`git clean -fdx`
 - ❌ `gh pr merge`、`gh pr review --approve`
+
+**需人类每次确认（不在 deny 但也不在 allow）：**
+- ⚠️ `git reset --hard`（破坏性但有合法场景，每次 prompt 让人类决策）
 - ❌ `alembic downgrade`、生产 DB 的 DROP/UPDATE
 - ❌ `rm -rf /*`、`sudo`、`chmod 777`
 - ❌ 读取 `.env` / `secrets/**` / casdoor `app.conf`