permissions-audit

To audit Claude permissions, parse JSON from global ~/.claude/settings.local.json and per-repository .claude/settings.local.json files under ghq root. It compares wildcard and command-name containment rules to detect redundancies, empty arrays, and inconsistent declarations, generating a categorized Markdown report.

Redundant permission rules in settings.local.json occur when project-level allow patterns overlap with the global baseline or use overly broad wildcards. Auditing compares these patterns to identify coverage overlaps, remove noise, and prevent accidental over-permissioning.

Yes, you can automatically refactor inconsistent permissions in settings.local.json. The audit applies backup-first corrections with JSON validation, providing clear rollback instructions to safely remove empty arrays and promote cross-project patterns to global settings.

The best way to clean up empty arrays in Claude permissions is running an audit that flags them across ghq-managed repositories and global settings. It recommends removals and optionally applies safe, backup-first automated refactoring to validate the JSON structure.

Yes, ghq is required to locate and collect project-level .claude/settings.local.json files. The audit scans the ghq root repositories to compare project-level permissions against the global baseline and propose global promotions or removals.

Wildcard pattern matching during a Claude settings audit compares command-name containment rules and wildcard patterns between global and project-level permissions. It detects overly broad declarations and surfaces patterns used across multiple projects for potential global promotion.