Claude Code’s permission rules match the literal text of a command, so you end up choosing between approving dozens of harmless commands a day, or writing a broad rule like Bash(git *) that also lets through git push --force. I got tired of both, so I wrote a set of PreToolUse hooks that read each command and decide whether its shape is safe and recoverable. They auto-approve things like read-only git commands, git add and git commit inside a worktree, and curl GETs whose flags are all on a known-safe list, and they prompt for everything else. They also deny chained commands, so that an approval only ever covers one command, rather than a harmless ls with an rm hiding behind a &&.

The most reusable one is probably command-allowlist-permissions.py, which auto-approves an allowlist of subcommands for wp, vip, localwp, gh, and glab. Adding another CLI only takes a new entry in its COMMANDS table. It parses wp db query SQL so that a SELECT passes and an UPDATE prompts, and it never auto-approves anything aimed at production. They all parse commands with shfmt --to-json to understand how Bash natively parses arguments.