feat(dis): flag forbidden-param permission rules CC silently ignores

Extends the DIS scanner and its shared permission-rules lib with a third
documented Claude Code permission footgun. Verified verbatim against
code.claude.com/docs/en/permissions (fetched 2026-06-19).

CC's Tool(param:value) matching (2.1.178) is off-limits for a tool's own
canonicalizing field — CC ignores such a rule and emits a startup warning,
because e.g. Bash(command:rm *) is bypassable by a compound command. The
forbidden fields: command (Bash/PowerShell), file_path (Read/Edit/Write),
path (Grep/Glob), notebook_path (NotebookEdit), url (WebFetch).

- lib/permission-rules.mjs: new forbiddenParamRule(entry) returning
  { tool, key, hint } or null. Only the param:value form (colon present)
  whose key equals the tool's forbidden field is flagged; Bash(npm:*),
  WebFetch(domain:host), Agent(model:opus), and Bash(command) (no colon)
  are left valid. FORBIDDEN_PARAMS map is the single source of truth.
- DIS: scans allow + deny + ask and splits severity by intent — deny/ask
  hits are false security (medium: the block never applies), allow hits are
  dead config (low: param:value matching is deny/ask-only). Two findings,
  permissions-hygiene, CA-DIS-NNN.
- 11 new tests (7 lib, 4 DIS) + 1 fixture forbidden-param-permissions
  (force-added past .gitignore .claude/). Suite 918 -> 929. Snapshot
  unchanged (SC-5 byte-equal), contamination grep clean, gitleaks clean.
  README/CLAUDE document the broadened DIS mandate; test badge synced.
  self-audit: PASS, configGrade A 97, pluginGrade A 100, scanners 13.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8

tests/lib/permission-rules.test.mjs

@@ -6,6 +6,7 @@ import {
   dominates,
   rulesIntersect,
   isIneffectiveAllowGlob,
+  forbiddenParamRule,
 } from '../../scanners/lib/permission-rules.mjs';
 
 describe('permission-rules — parseRule', () => {
@@ -109,6 +110,55 @@ describe('permission-rules — isIneffectiveAllowGlob (CC silently skips these a
   });
 });
 
+describe('permission-rules — forbiddenParamRule (CC ignores Tool(param:value) for the tool\'s own canonicalizing field)', () => {
+  // CC: "Fields that a tool already matches with its own canonicalizing rules
+  // are not matchable this way: command for Bash and PowerShell, file_path for
+  // Read/Edit/Write, path for Grep/Glob, notebook_path for NotebookEdit, and
+  // url for WebFetch. ... Claude Code ignores it and emits a startup warning."
+  // (code.claude.com/docs/en/permissions — "Match by input parameter")
+
+  it('flags command: for Bash and PowerShell', () => {
+    assert.equal(forbiddenParamRule('Bash(command:rm *)').key, 'command');
+    assert.equal(forbiddenParamRule('PowerShell(command:Remove-Item *)').key, 'command');
+  });
+
+  it('flags file_path: for Read/Edit/Write', () => {
+    assert.equal(forbiddenParamRule('Read(file_path:/etc/passwd)').key, 'file_path');
+    assert.equal(forbiddenParamRule('Edit(file_path:/src/x)').tool, 'Edit');
+    assert.equal(forbiddenParamRule('Write(file_path:/src/x)').tool, 'Write');
+  });
+
+  it('flags path: for Grep/Glob, notebook_path: for NotebookEdit, url: for WebFetch', () => {
+    assert.equal(forbiddenParamRule('Grep(path:/secrets)').key, 'path');
+    assert.equal(forbiddenParamRule('Glob(path:/secrets)').key, 'path');
+    assert.equal(forbiddenParamRule('NotebookEdit(notebook_path:/nb.ipynb)').key, 'notebook_path');
+    assert.equal(forbiddenParamRule('WebFetch(url:http://evil.com)').key, 'url');
+  });
+
+  it('returns a tool-specific correct-syntax hint', () => {
+    assert.match(forbiddenParamRule('Bash(command:rm *)').hint, /Bash\(/);
+    assert.match(forbiddenParamRule('WebFetch(url:http://x)').hint, /domain:/);
+  });
+
+  it('does NOT flag valid specifier/param syntax for the same tools', () => {
+    assert.equal(forbiddenParamRule('Bash(npm:*)'), null);        // npm: is a trailing-wildcard prefix, not command:
+    assert.equal(forbiddenParamRule('WebFetch(domain:good.com)'), null); // domain: is the valid WebFetch syntax
+    assert.equal(forbiddenParamRule('Read(./path)'), null);       // gitignore-style path, no param:value
+    assert.equal(forbiddenParamRule('Bash(command)'), null);      // literal command-prefix, no colon
+  });
+
+  it('does NOT flag param:value on tools that have no forbidden field', () => {
+    assert.equal(forbiddenParamRule('Agent(model:opus)'), null);
+    assert.equal(forbiddenParamRule('Bash(run_in_background:true)'), null);
+  });
+
+  it('bare tools and non-strings → null', () => {
+    assert.equal(forbiddenParamRule('Bash'), null);
+    assert.equal(forbiddenParamRule('Bash(*)'), null);
+    assert.equal(forbiddenParamRule(null), null);
+  });
+});
+
 describe('permission-rules — rulesIntersect (cross-scope conflict)', () => {
   it('exact same rule intersects', () => {
     assert.equal(rulesIntersect('Bash(npm run *)', 'Bash(npm run *)'), true);