fix(claude): drop the :* suffix from the rm -rf /* deny rule

[paveg]

Why

Claude Code warns at startup:

Permission deny rule (~/.claude/settings.json): Bash(rm -rf /*:*) mixes * with the trailing :* prefix syntax, so it is matched as a literal prefix (the * is not expanded) and matches only commands containing a literal * at that position. Use Bash(rm -rf /*) for wildcard matching.

Per the permissions docs, a trailing :* is shorthand for a trailing *, and * has no escape in Bash rules. So the old line could never match the literal command rm -rf /*, which was its intent.

What

home/dot_claude/settings.json.tmpl, deny list:

-      "Bash(rm -rf /*:*)",
+      "Bash(rm -rf /*)",

Tradeoff

Bash(rm -rf /*) has no space before the *, so it matches rm -rf / followed by anything, including rm -rf /tmp/build. This is the only rule shape that covers rm -rf /*; if the broad deny gets in the way, the alternative is to delete the line.

Verification

chezmoi diff ~/.claude/settings.json shows the one-line rule change (plus unrelated pre-existing drift from Claude Code's own writes to the deployed file). Not applied yet; the startup warning should disappear after chezmoi apply and a restart.

🤖 Generated with Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: d3161d5

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR