fix(permissions): cli-pr-monitor --monitor-only を allow に追加し監視 wakeup の都度確認を解消

[aloekun]

問題: .claude/settings.json の ask に広域 Bash(*cli-pr-monitor.exe*) があり、read-only な
cli-pr-monitor.exe --monitor-only (CI/CodeRabbit 状態を見るだけの監視チェック) まで都度
許可確認が出ていた。post-PR monitor (ADR-018) は park + CronCreate wakeup で自動定期監視する
設計だが、毎 wakeup の監視コマンドが確認待ちで停止し、自動化が機能していなかった。

修正:

• allow に Bash(*cli-pr-monitor.exe* --monitor-only) を追加 (read-only 監視のみ許可。末尾に
  wildcard を置かず追加引数を弾く = --monitor-only --mark-notified 等で run_mark_notified()
  に dispatch される state 変更経路を防ぐ、pre-push security review 所見対応)
• ask から広域 Bash(*cli-pr-monitor.exe*) を削除 (ask > allow の precedence のため、
  広域 ask を残すと allow が効かない)

security 根拠:

• --monitor-only は外部に何も生成しない read-only (gh API で CI/CR 状態を取得するだけ)
• PR 作成 (pnpm create-pr) / merge (pnpm merge-pr / *cli-merge-pipeline.exe*) は ask の
  まま維持 → 外部可視成果物の生成ゲート (ADR-028 趣旨) は温存
• = 過度に広い gate を read-only に厳密に絞る変更であり、外部可視操作の緩和ではない

Summary by CodeRabbit

• Bug Fixes
  • 一部の監視系コマンドが、特定の条件では確認なしで実行されるようになりました。
  • これにより、関連する操作時の不要な確認プロンプトが減り、作業が少しスムーズになります。

[coderabbitai]

📝 Walkthrough

ウォークスルー

.claude/settings.json の permissions 設定を変更。Bash(*cli-pr-monitor.exe* --monitor-only) を allow に追加し、ask から Bash(*cli-pr-monitor.exe*) を削除した。

変更内容

Permissions設定変更

Layer / File(s)	Summary
permissions allow/ask 変更 .claude/settings.json	permissions.allow に Bash(*cli-pr-monitor.exe* --monitor-only) を追加し、permissions.ask から Bash(*cli-pr-monitor.exe*) を削除。ask には Bash(pnpm create-pr*) / Bash(pnpm merge-pr*) / Bash(*cli-merge-pipeline.exe*) が残る。

推定コードレビュー工数

🎯 1 (Trivial) | ⏱️ ~2 minutes

関連する可能性のあるPR

• aloekun/claude-code-hook-test#57: .claude/settings.json の permissions 設定で Bash(*cli-pr-monitor.exe*) の ask/allow 扱いを変更しており、今回と同一箇所の変更。

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	cli-pr-monitor の --monitor-only を allow に追加して確認プロンプトを減らす変更を正確に表しています。
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.claude/settings.json:
- Line 4: The allow pattern in the Claude settings does not match the actual
resume command, so monitoring restart will not be permitted. Update the Bash
allow entry in settings.json to match the top-level command string used by
RESUME_MONITORING_COMMAND, and verify it aligns with the real pnpm push
--monitor-only invocation rather than the cli-pr-monitor.exe wrapper.
- Around line 6-9: The ask gate in settings is missing direct invocations of
cli-pr-monitor.exe, so PR creation can bypass user prompting. Update the ask
entries in settings.json to also cover direct Bash calls to cli-pr-monitor.exe,
alongside the existing create-pr, merge-pr, and cli-merge-pipeline patterns, so
the default PR creation path in main.rs is always intercepted before running.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 1a6137e4-f5ff-445c-98ab-b1b508573700

📥 Commits

Reviewing files that changed from the base of the PR and between f8df9e4 and fa04cfc.

📒 Files selected for processing (1)

• .claude/settings.json