feat(dis): flag forbidden-param permission rules CC silently ignores

Extends the DIS scanner and its shared permission-rules lib with a third
documented Claude Code permission footgun. Verified verbatim against
code.claude.com/docs/en/permissions (fetched 2026-06-19).

CC's Tool(param:value) matching (2.1.178) is off-limits for a tool's own
canonicalizing field — CC ignores such a rule and emits a startup warning,
because e.g. Bash(command:rm *) is bypassable by a compound command. The
forbidden fields: command (Bash/PowerShell), file_path (Read/Edit/Write),
path (Grep/Glob), notebook_path (NotebookEdit), url (WebFetch).

- lib/permission-rules.mjs: new forbiddenParamRule(entry) returning
  { tool, key, hint } or null. Only the param:value form (colon present)
  whose key equals the tool's forbidden field is flagged; Bash(npm:*),
  WebFetch(domain:host), Agent(model:opus), and Bash(command) (no colon)
  are left valid. FORBIDDEN_PARAMS map is the single source of truth.
- DIS: scans allow + deny + ask and splits severity by intent — deny/ask
  hits are false security (medium: the block never applies), allow hits are
  dead config (low: param:value matching is deny/ask-only). Two findings,
  permissions-hygiene, CA-DIS-NNN.
- 11 new tests (7 lib, 4 DIS) + 1 fixture forbidden-param-permissions
  (force-added past .gitignore .claude/). Suite 918 -> 929. Snapshot
  unchanged (SC-5 byte-equal), contamination grep clean, gitleaks clean.
  README/CLAUDE document the broadened DIS mandate; test badge synced.
  self-audit: PASS, configGrade A 97, pluginGrade A 100, scanners 13.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8

scanners/disabled-in-schema-scanner.mjs

@@ -22,7 +22,7 @@ import { readTextFile } from './lib/file-discovery.mjs';
 import { finding, scannerResult } from './lib/output.mjs';
 import { SEVERITY } from './lib/severity.mjs';
 import { parseJson } from './lib/yaml-parser.mjs';
-import { dominates, parseRule, isIneffectiveAllowGlob } from './lib/permission-rules.mjs';
+import { dominates, parseRule, isIneffectiveAllowGlob, forbiddenParamRule } from './lib/permission-rules.mjs';
 
 const SCANNER = 'DIS';
 
@@ -65,6 +65,28 @@ function findIneffectiveAllowGlobs(settings) {
   return allowList.filter(e => isIneffectiveAllowGlob(e));
 }
 
+/**
+ * Find permission rules CC silently ignores because their `Tool(param:value)`
+ * key is the tool's own canonicalizing field (`command`, `file_path`, `path`,
+ * `notebook_path`, `url`). Scans allow + deny + ask so severity can split:
+ * deny/ask hits are false security, allow hits are dead config. Returns array
+ * of { list, entry, tool, key, hint }.
+ */
+function findForbiddenParamRules(settings) {
+  if (!settings || typeof settings !== 'object') return [];
+  const perms = settings.permissions;
+  if (!perms || typeof perms !== 'object') return [];
+  const results = [];
+  for (const list of ['allow', 'deny', 'ask']) {
+    const arr = Array.isArray(perms[list]) ? perms[list] : [];
+    for (const entry of arr) {
+      const hit = forbiddenParamRule(entry);
+      if (hit) results.push({ list, entry, ...hit });
+    }
+  }
+  return results;
+}
+
 /**
  * Main scanner entry point.
  *
@@ -127,6 +149,57 @@ export async function scan(targetPath, discovery) {
         category: 'permissions-hygiene',
       }));
     }
+
+    const forbidden = findForbiddenParamRules(parsed);
+    const falseSecurity = forbidden.filter(x => x.list === 'deny' || x.list === 'ask');
+    const deadAllow = forbidden.filter(x => x.list === 'allow');
+
+    if (falseSecurity.length > 0) {
+      const evidence = falseSecurity.slice(0, 5)
+        .map(x => `${x.list}: "${x.entry}" → use ${x.hint}`)
+        .join('; ');
+      findings.push(finding({
+        scanner: SCANNER,
+        severity: SEVERITY.medium,
+        title: 'Permission rule silently ignored — deny/ask uses a forbidden param key',
+        description:
+          `${f.relPath || f.absPath} has ${falseSecurity.length} deny/ask ` +
+          `rule${falseSecurity.length === 1 ? '' : 's'} whose \`Tool(param:value)\` key is ` +
+          'the tool\'s own canonicalizing field (`command`/`file_path`/`path`/`notebook_path`/' +
+          '`url`). Claude Code ignores these and emits a startup warning, so the guard you ' +
+          'intended does NOT apply — the action you meant to block or gate is effectively ' +
+          'unrestricted.',
+        file: f.absPath,
+        evidence,
+        recommendation:
+          'Rewrite each rule with the tool\'s own specifier syntax (e.g. `Bash(rm *)`, ' +
+          '`Read(./path)`, `WebFetch(domain:host)`). As written these rules block nothing.',
+        category: 'permissions-hygiene',
+      }));
+    }
+
+    if (deadAllow.length > 0) {
+      const evidence = deadAllow.slice(0, 5)
+        .map(x => `allow: "${x.entry}" → use ${x.hint}`)
+        .join('; ');
+      findings.push(finding({
+        scanner: SCANNER,
+        severity: SEVERITY.low,
+        title: 'Permission rule silently ignored — allow uses a forbidden param key (dead config)',
+        description:
+          `${f.relPath || f.absPath} has ${deadAllow.length} permissions.allow ` +
+          `rule${deadAllow.length === 1 ? '' : 's'} using \`Tool(param:value)\` on the tool's ` +
+          'own canonicalizing field. `param:value` matching applies only to deny/ask rules; ' +
+          'allow rules use each tool\'s own specifier syntax. Claude Code ignores these and ' +
+          'emits a startup warning — they grant nothing.',
+        file: f.absPath,
+        evidence,
+        recommendation:
+          'Replace with the tool\'s specifier syntax (e.g. `Read(./path)`), or remove the ' +
+          'entry. As written it auto-approves nothing.',
+        category: 'permissions-hygiene',
+      }));
+    }
   }
 
   return scannerResult(SCANNER, 'ok', findings, filesScanned, Date.now() - start);