feat(dis): flag forbidden-param permission rules CC silently ignores

Extends the DIS scanner and its shared permission-rules lib with a third
documented Claude Code permission footgun. Verified verbatim against
code.claude.com/docs/en/permissions (fetched 2026-06-19).

CC's Tool(param:value) matching (2.1.178) is off-limits for a tool's own
canonicalizing field — CC ignores such a rule and emits a startup warning,
because e.g. Bash(command:rm *) is bypassable by a compound command. The
forbidden fields: command (Bash/PowerShell), file_path (Read/Edit/Write),
path (Grep/Glob), notebook_path (NotebookEdit), url (WebFetch).

- lib/permission-rules.mjs: new forbiddenParamRule(entry) returning
  { tool, key, hint } or null. Only the param:value form (colon present)
  whose key equals the tool's forbidden field is flagged; Bash(npm:*),
  WebFetch(domain:host), Agent(model:opus), and Bash(command) (no colon)
  are left valid. FORBIDDEN_PARAMS map is the single source of truth.
- DIS: scans allow + deny + ask and splits severity by intent — deny/ask
  hits are false security (medium: the block never applies), allow hits are
  dead config (low: param:value matching is deny/ask-only). Two findings,
  permissions-hygiene, CA-DIS-NNN.
- 11 new tests (7 lib, 4 DIS) + 1 fixture forbidden-param-permissions
  (force-added past .gitignore .claude/). Suite 918 -> 929. Snapshot
  unchanged (SC-5 byte-equal), contamination grep clean, gitleaks clean.
  README/CLAUDE document the broadened DIS mandate; test badge synced.
  self-audit: PASS, configGrade A 97, pluginGrade A 100, scanners 13.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8

scanners/disabled-in-schema-scanner.mjs

@@ -22,7 +22,7 @@ import { readTextFile } from './lib/file-discovery.mjs';
 import { finding, scannerResult } from './lib/output.mjs';
 import { SEVERITY } from './lib/severity.mjs';
 import { parseJson } from './lib/yaml-parser.mjs';
-import { dominates, parseRule, isIneffectiveAllowGlob } from './lib/permission-rules.mjs';
+import { dominates, parseRule, isIneffectiveAllowGlob, forbiddenParamRule } from './lib/permission-rules.mjs';
 
 const SCANNER = 'DIS';
 
@@ -65,6 +65,28 @@ function findIneffectiveAllowGlobs(settings) {
   return allowList.filter(e => isIneffectiveAllowGlob(e));
 }
 
+/**
+ * Find permission rules CC silently ignores because their `Tool(param:value)`
+ * key is the tool's own canonicalizing field (`command`, `file_path`, `path`,
+ * `notebook_path`, `url`). Scans allow + deny + ask so severity can split:
+ * deny/ask hits are false security, allow hits are dead config. Returns array
+ * of { list, entry, tool, key, hint }.
+ */
+function findForbiddenParamRules(settings) {
+  if (!settings || typeof settings !== 'object') return [];
+  const perms = settings.permissions;
+  if (!perms || typeof perms !== 'object') return [];
+  const results = [];
+  for (const list of ['allow', 'deny', 'ask']) {
+    const arr = Array.isArray(perms[list]) ? perms[list] : [];
+    for (const entry of arr) {
+      const hit = forbiddenParamRule(entry);
+      if (hit) results.push({ list, entry, ...hit });
+    }
+  }
+  return results;
+}
+
 /**
  * Main scanner entry point.
  *
@@ -127,6 +149,57 @@ export async function scan(targetPath, discovery) {
         category: 'permissions-hygiene',
       }));
     }
+
+    const forbidden = findForbiddenParamRules(parsed);
+    const falseSecurity = forbidden.filter(x => x.list === 'deny' || x.list === 'ask');
+    const deadAllow = forbidden.filter(x => x.list === 'allow');
+
+    if (falseSecurity.length > 0) {
+      const evidence = falseSecurity.slice(0, 5)
+        .map(x => `${x.list}: "${x.entry}" → use ${x.hint}`)
+        .join('; ');
+      findings.push(finding({
+        scanner: SCANNER,
+        severity: SEVERITY.medium,
+        title: 'Permission rule silently ignored — deny/ask uses a forbidden param key',
+        description:
+          `${f.relPath || f.absPath} has ${falseSecurity.length} deny/ask ` +
+          `rule${falseSecurity.length === 1 ? '' : 's'} whose \`Tool(param:value)\` key is ` +
+          'the tool\'s own canonicalizing field (`command`/`file_path`/`path`/`notebook_path`/' +
+          '`url`). Claude Code ignores these and emits a startup warning, so the guard you ' +
+          'intended does NOT apply — the action you meant to block or gate is effectively ' +
+          'unrestricted.',
+        file: f.absPath,
+        evidence,
+        recommendation:
+          'Rewrite each rule with the tool\'s own specifier syntax (e.g. `Bash(rm *)`, ' +
+          '`Read(./path)`, `WebFetch(domain:host)`). As written these rules block nothing.',
+        category: 'permissions-hygiene',
+      }));
+    }
+
+    if (deadAllow.length > 0) {
+      const evidence = deadAllow.slice(0, 5)
+        .map(x => `allow: "${x.entry}" → use ${x.hint}`)
+        .join('; ');
+      findings.push(finding({
+        scanner: SCANNER,
+        severity: SEVERITY.low,
+        title: 'Permission rule silently ignored — allow uses a forbidden param key (dead config)',
+        description:
+          `${f.relPath || f.absPath} has ${deadAllow.length} permissions.allow ` +
+          `rule${deadAllow.length === 1 ? '' : 's'} using \`Tool(param:value)\` on the tool's ` +
+          'own canonicalizing field. `param:value` matching applies only to deny/ask rules; ' +
+          'allow rules use each tool\'s own specifier syntax. Claude Code ignores these and ' +
+          'emits a startup warning — they grant nothing.',
+        file: f.absPath,
+        evidence,
+        recommendation:
+          'Replace with the tool\'s specifier syntax (e.g. `Read(./path)`), or remove the ' +
+          'entry. As written it auto-approves nothing.',
+        category: 'permissions-hygiene',
+      }));
+    }
   }
 
   return scannerResult(SCANNER, 'ok', findings, filesScanned, Date.now() - start);

scanners/lib/permission-rules.mjs

@@ -123,3 +123,64 @@ export function isIneffectiveAllowGlob(entry) {
   }
   return true;
 }
+
+/**
+ * Tools whose canonicalizing input field collides with `Tool(param:value)`
+ * matching. CC ignores a rule whose param key is the tool's own field and
+ * emits a startup warning, because the rule would be bypassable (e.g. a
+ * compound command defeats `Bash(command:rm *)`).
+ *
+ * CC: "Fields that a tool already matches with its own canonicalizing rules are
+ * not matchable this way: `command` for Bash and PowerShell, `file_path` for
+ * Read, Edit, and Write, `path` for Grep and Glob, `notebook_path` for
+ * NotebookEdit, and `url` for WebFetch."
+ * (code.claude.com/docs/en/permissions — "Match by input parameter")
+ */
+const FORBIDDEN_PARAMS = Object.freeze({
+  Bash: 'command',
+  PowerShell: 'command',
+  Read: 'file_path',
+  Edit: 'file_path',
+  Write: 'file_path',
+  Grep: 'path',
+  Glob: 'path',
+  NotebookEdit: 'notebook_path',
+  WebFetch: 'url',
+});
+
+/** Correct specifier syntax to suggest in place of the forbidden param form. */
+const FORBIDDEN_PARAM_HINT = Object.freeze({
+  Bash: 'Bash(rm *)',
+  PowerShell: 'PowerShell(Remove-Item *)',
+  Read: 'Read(./path)',
+  Edit: 'Edit(/src/**)',
+  Write: 'Write(/src/**)',
+  Grep: 'a Read rule (covers Grep)',
+  Glob: 'a Read rule (covers Glob)',
+  NotebookEdit: 'Edit(/notebooks/**)',
+  WebFetch: 'WebFetch(domain:host)',
+});
+
+/**
+ * Is this entry a `Tool(param:value)` rule whose param KEY is the tool's own
+ * canonicalizing field? CC silently ignores these (any list) and emits a
+ * startup warning. Returns `{ tool, key, hint }` or `null`.
+ *
+ * Only the `param:value` form (a colon present) is forbidden — `Bash(command)`
+ * is a literal command-prefix match and stays valid. The key must equal the
+ * tool's forbidden field, so `Bash(npm:*)`, `WebFetch(domain:x)`, and
+ * `Agent(model:opus)` are NOT flagged.
+ * @param {string} entry
+ * @returns {{ tool: string, key: string, hint: string }|null}
+ */
+export function forbiddenParamRule(entry) {
+  const { tool, param } = parseRule(entry);
+  if (!tool || param === null) return null;
+  const forbidden = FORBIDDEN_PARAMS[tool];
+  if (!forbidden) return null;
+  const colon = param.indexOf(':');
+  if (colon === -1) return null; // no `param:value` — literal specifier, valid
+  const key = param.slice(0, colon).trim();
+  if (key !== forbidden) return null;
+  return { tool, key, hint: FORBIDDEN_PARAM_HINT[tool] };
+}