From df026b0628618c4f786c048b80033bc484475a2c Mon Sep 17 00:00:00 2001
From: Aram Grigoryan <132480+aram356@users.noreply.github.com>
Date: Tue, 19 May 2026 18:03:01 -0700
Subject: [PATCH] Fix malformed JSON in .claude/settings.json and expand
 allowlist

Remove the trailing comma after the last array element that made the
file invalid strict JSON. Add read-only gh CLI permissions to match
the gh-based PR/issue workflows documented in CLAUDE.md, and round out
the Chrome DevTools MCP allowlist with non-mutating observability
tools (screenshots, console/network inspection, snapshots, perf trace).

Mutating commands (gh pr create/comment/merge, gh issue create, page
interactions like click/fill/type_text) continue to require prompts.

Closes #721
Closes #722
---
 .claude/settings.json | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/.claude/settings.json b/.claude/settings.json
index 02b602d4..2c8df0d6 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -22,10 +22,32 @@
       "Bash(git branch:*)",
       "Bash(git diff:*)",
       "Bash(git log:*)",
+      "Bash(git show:*)",
       "Bash(git status:*)",
+      "Bash(gh pr view:*)",
+      "Bash(gh pr list:*)",
+      "Bash(gh pr diff:*)",
+      "Bash(gh pr checks:*)",
+      "Bash(gh issue view:*)",
+      "Bash(gh issue list:*)",
+      "Bash(gh run view:*)",
+      "Bash(gh run list:*)",
+      "Bash(gh repo view:*)",
       "mcp__plugin_chrome-devtools-mcp_chrome-devtools__new_page",
+      "mcp__plugin_chrome-devtools-mcp_chrome-devtools__list_pages",
+      "mcp__plugin_chrome-devtools-mcp_chrome-devtools__select_page",
+      "mcp__plugin_chrome-devtools-mcp_chrome-devtools__navigate_page",
+      "mcp__plugin_chrome-devtools-mcp_chrome-devtools__take_screenshot",
+      "mcp__plugin_chrome-devtools-mcp_chrome-devtools__take_snapshot",
+      "mcp__plugin_chrome-devtools-mcp_chrome-devtools__list_console_messages",
+      "mcp__plugin_chrome-devtools-mcp_chrome-devtools__get_console_message",
+      "mcp__plugin_chrome-devtools-mcp_chrome-devtools__list_network_requests",
+      "mcp__plugin_chrome-devtools-mcp_chrome-devtools__get_network_request",
+      "mcp__plugin_chrome-devtools-mcp_chrome-devtools__wait_for",
+      "mcp__plugin_chrome-devtools-mcp_chrome-devtools__performance_start_trace",
       "mcp__plugin_chrome-devtools-mcp_chrome-devtools__performance_stop_trace",
-      "mcp__plugin_chrome-devtools-mcp_chrome-devtools__evaluate_script",
+      "mcp__plugin_chrome-devtools-mcp_chrome-devtools__performance_analyze_insight",
+      "mcp__plugin_chrome-devtools-mcp_chrome-devtools__evaluate_script"
     ]
   },
   "enabledPlugins": {