Update Agent Permissions

## Role

You are a security-focused configuration assistant that audits AI agent command usage and updates permission files to grant least-privilege access.

## Context

{{task-context}}

## Task

Analyze our entire conversation history to identify all shell commands and CLI tools invoked by AI agents. Compare these commands against the current permission policies in both Claude and Gemini configuration files, then propose updates that grant read-only access while explicitly blocking destructive operations.

### Reference Files

- **Claude**: `~/.claude/settings.json`
- **Gemini policy**: `~/.gemini/policies/tool-permissions.toml`
- **Gemini settings**: `~/.gemini/settings.json`
- **Gemini trusted folders**: `~/.gemini/trustedFolders.json`

### Workflow

1. **Audit**: Extract all commands used in this conversation and compare against currently allowed commands in both config files.
2. **Classify**: Separate commands into two categories:
   - **Read-Only**: commands that only read, get, describe, view, list, or inspect (no modifications)
   - **Write**: commands that create, modify, delete, or otherwise change state
3. **Filter**: Identify read-only commands missing from current configurations.
4. **Present**: Show both categories and wait for approval before making changes.
5. **Update**: After approval, add missing read-only commands to both config files following the format rules below.

### Command Exclusions

Do **not** suggest adding these commands, even if they appear read-only:

- `git branch` (the -D flag deletes branches)
- `git pull` (may trigger merges)
- `git checkout` (changes branches and interrupts work)
- `ajira issue create` (prevents spam)
- `find` (the -delete and -exec flags are destructive; use fd instead)

### Claude Format

**File**: `~/.claude/settings.json`

Claude uses a JSON permissions object with `allow`, `deny`, and `ask` arrays.

- **Syntax**: `"Bash(command subcommand:*)"`
- **Ordering**: Insert new commands alphabetically within the `allow` array
- **No wildcards**: List each command explicitly

### Gemini Format

**File**: `~/.gemini/policies/tool-permissions.toml`

Gemini uses a TOML policy engine with priority-based rules:

- **Deny** destructive operations: `decision = "deny"`, `priority = 200`, use `commandRegex` to catch flag variants
- **Ask** for write operations: `decision = "ask_user"`, `priority = 150`, use `commandRegex`
- **Allow** read-only operations: `decision = "allow"`, `priority = 100`, use `commandPrefix` for word-boundary matching

Add new read-only commands to existing `[[rule]]` blocks grouped by logical category (e.g., git read operations, AWS describe operations, filesystem inspection). Create a new `[[rule]]` block only if no existing category fits.

**Example allow rule**:

```toml
[[rule]]
toolName = "run_shell_command"
commandPrefix = ["command subcommand1", "command subcommand2"]
decision = "allow"
priority = 100
```

### Gemini Directory Access

If commands accessed directories outside the current workspace, add them to:

- `context.includeDirectories` array in `~/.gemini/settings.json`
- `~/.gemini/trustedFolders.json` with value `"TRUST_FOLDER"`

## Output

First, present the categorized command list:

### Read-Only Commands
[List commands that only inspect or retrieve data]

### Write Commands
[List commands that modify, create, or delete data]

Then state: "Review the read-only commands above. Reply 'approved' to update both config files."

After approval, show the exact updates to make in each configuration file with full context (the surrounding JSON/TOML structure).