From 45f22049e02b3485e34c9475f1a3b29258700623 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 22 Sep 2026 14:35:05 +0000 Subject: [PATCH] chore(claude): deny the enqueue class and update_pull_request (objectui#9586) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Mirror of objectstack PR #18317 (ruling A on objectstack#18282) plus the one earlier entry this repo never received, objectstack PR #18276: - mcp__github__update_pull_request — arms a landing as a hidden side effect - mcp__github__enable_pr_auto_merge — the enqueue class - mcp__github__disable_pr_auto_merge — the enqueue class The deny array is now element-for-element identical to objectstack's, order included. `allow` and `hooks` are byte-identical to origin/main. No capability is lost: the only enqueue route either board uses is the REST proxy's `PUT .../pulls/{n}/ccr/auto_merge`, already an `allow` entry in this file. Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_01Wnstp2kTth7sGXfr8fXypc --- .../issue-9586-enqueue-class-deny-mirror.md | 21 +++++++++++++++++++ .claude/settings.json | 5 ++++- 2 files changed, 25 insertions(+), 1 deletion(-) create mode 100644 .changeset/issue-9586-enqueue-class-deny-mirror.md diff --git a/.changeset/issue-9586-enqueue-class-deny-mirror.md b/.changeset/issue-9586-enqueue-class-deny-mirror.md new file mode 100644 index 0000000000..38dcd4285e --- /dev/null +++ b/.changeset/issue-9586-enqueue-class-deny-mirror.md @@ -0,0 +1,21 @@ +--- +--- + +`.claude/settings.json` only — no released package source and no published contract field is +touched, so this declares **no release** with an empty frontmatter rather than a bump. The +declaration is written anyway because this repo's rule asks for a declaration once, not for a +release; `node scripts/check-changeset-presence.mjs` agrees on its own terms. + +objectui#9586 mirrors the enqueue-class lock objectstack landed in objectstack#18317, and the +one earlier entry this repo had also never received (objectstack#18276): + +- `permissions.deny` gains `mcp__github__enable_pr_auto_merge` and + `mcp__github__disable_pr_auto_merge` (the enqueue class, ruled closed on objectstack#18282) + plus `mcp__github__update_pull_request`, which arms a pull request's landing as a hidden side + effect of an unrelated field — the mechanism behind objectui#6183, where a governed draft + entered the merge queue and landed with no human approval. +- Nothing is lost by denying them: the only enqueue route either board actually uses is the + REST proxy's `PUT .../pulls/{n}/ccr/auto_merge`, which is already an `allow` entry in this + same file, and `gh pr ready` / `gh pr merge --auto` are untouched. +- The result is that this repo's deny array is now element-for-element identical to + objectstack's, order included — declared = enforced on both boards from one reading. diff --git a/.claude/settings.json b/.claude/settings.json index 2e2b0d19a5..30c3367037 100644 --- a/.claude/settings.json +++ b/.claude/settings.json @@ -17,6 +17,7 @@ "deny": [ "mcp__github__issue_write", "mcp__github__create_pull_request", + "mcp__github__update_pull_request", "mcp__github__add_issue_comment", "mcp__github__add_comment_to_pending_review", "mcp__github__add_reply_to_pull_request_comment", @@ -28,7 +29,9 @@ "mcp__github__sub_issue_write", "mcp__github__merge_pull_request", "mcp__github__create_repository", - "mcp__github__fork_repository" + "mcp__github__fork_repository", + "mcp__github__enable_pr_auto_merge", + "mcp__github__disable_pr_auto_merge" ] }, "hooks": {