feat(dis): flag forbidden-param permission rules CC silently ignores

Extends the DIS scanner and its shared permission-rules lib with a third
documented Claude Code permission footgun. Verified verbatim against
code.claude.com/docs/en/permissions (fetched 2026-06-19).

CC's Tool(param:value) matching (2.1.178) is off-limits for a tool's own
canonicalizing field — CC ignores such a rule and emits a startup warning,
because e.g. Bash(command:rm *) is bypassable by a compound command. The
forbidden fields: command (Bash/PowerShell), file_path (Read/Edit/Write),
path (Grep/Glob), notebook_path (NotebookEdit), url (WebFetch).

- lib/permission-rules.mjs: new forbiddenParamRule(entry) returning
  { tool, key, hint } or null. Only the param:value form (colon present)
  whose key equals the tool's forbidden field is flagged; Bash(npm:*),
  WebFetch(domain:host), Agent(model:opus), and Bash(command) (no colon)
  are left valid. FORBIDDEN_PARAMS map is the single source of truth.
- DIS: scans allow + deny + ask and splits severity by intent — deny/ask
  hits are false security (medium: the block never applies), allow hits are
  dead config (low: param:value matching is deny/ask-only). Two findings,
  permissions-hygiene, CA-DIS-NNN.
- 11 new tests (7 lib, 4 DIS) + 1 fixture forbidden-param-permissions
  (force-added past .gitignore .claude/). Suite 918 -> 929. Snapshot
  unchanged (SC-5 byte-equal), contamination grep clean, gitleaks clean.
  README/CLAUDE document the broadened DIS mandate; test badge synced.
  self-audit: PASS, configGrade A 97, pluginGrade A 100, scanners 13.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8

scanners/lib/permission-rules.mjs

@@ -123,3 +123,64 @@ export function isIneffectiveAllowGlob(entry) {
   }
   return true;
 }
+
+/**
+ * Tools whose canonicalizing input field collides with `Tool(param:value)`
+ * matching. CC ignores a rule whose param key is the tool's own field and
+ * emits a startup warning, because the rule would be bypassable (e.g. a
+ * compound command defeats `Bash(command:rm *)`).
+ *
+ * CC: "Fields that a tool already matches with its own canonicalizing rules are
+ * not matchable this way: `command` for Bash and PowerShell, `file_path` for
+ * Read, Edit, and Write, `path` for Grep and Glob, `notebook_path` for
+ * NotebookEdit, and `url` for WebFetch."
+ * (code.claude.com/docs/en/permissions — "Match by input parameter")
+ */
+const FORBIDDEN_PARAMS = Object.freeze({
+  Bash: 'command',
+  PowerShell: 'command',
+  Read: 'file_path',
+  Edit: 'file_path',
+  Write: 'file_path',
+  Grep: 'path',
+  Glob: 'path',
+  NotebookEdit: 'notebook_path',
+  WebFetch: 'url',
+});
+
+/** Correct specifier syntax to suggest in place of the forbidden param form. */
+const FORBIDDEN_PARAM_HINT = Object.freeze({
+  Bash: 'Bash(rm *)',
+  PowerShell: 'PowerShell(Remove-Item *)',
+  Read: 'Read(./path)',
+  Edit: 'Edit(/src/**)',
+  Write: 'Write(/src/**)',
+  Grep: 'a Read rule (covers Grep)',
+  Glob: 'a Read rule (covers Glob)',
+  NotebookEdit: 'Edit(/notebooks/**)',
+  WebFetch: 'WebFetch(domain:host)',
+});
+
+/**
+ * Is this entry a `Tool(param:value)` rule whose param KEY is the tool's own
+ * canonicalizing field? CC silently ignores these (any list) and emits a
+ * startup warning. Returns `{ tool, key, hint }` or `null`.
+ *
+ * Only the `param:value` form (a colon present) is forbidden — `Bash(command)`
+ * is a literal command-prefix match and stays valid. The key must equal the
+ * tool's forbidden field, so `Bash(npm:*)`, `WebFetch(domain:x)`, and
+ * `Agent(model:opus)` are NOT flagged.
+ * @param {string} entry
+ * @returns {{ tool: string, key: string, hint: string }|null}
+ */
+export function forbiddenParamRule(entry) {
+  const { tool, param } = parseRule(entry);
+  if (!tool || param === null) return null;
+  const forbidden = FORBIDDEN_PARAMS[tool];
+  if (!forbidden) return null;
+  const colon = param.indexOf(':');
+  if (colon === -1) return null; // no `param:value` — literal specifier, valid
+  const key = param.slice(0, colon).trim();
+  if (key !== forbidden) return null;
+  return { tool, key, hint: FORBIDDEN_PARAM_HINT[tool] };
+}