permissions

# Permission Analyzer Scan recent session transcripts to find Bash commands you keep approving, cross-reference with current `settings.json`, and recommend adding the missing ones. **Primary goal**: Discover MISSING permissions from actual usage. **Secondary goal**: Clean up redundant/garbage entries. ## Usage `/phx:permissions [--days=14] [--dry-run]` — Scans session JSONL files, finds uncovered Bash commands, classifies risk, and recommends `settings.json` changes. Use `--dry-run` to preview without writing. ## Arguments `$ARGUMENTS` — `--days=N` (default: 14), `--dry-run` (preview only). ## Iron Laws 1. **NEVER auto-allow RED** — `rm`, `sudo`, `kill`, `curl|sh`, `mix ecto.reset`, `git push --force`, `chmod 777` 2. **Evidence-based only** — Only recommend commands actually approved in sessions 3. **Show before writing** — Present full diff, get explicit confirmation 4. **Preserve existing** — Merge, never overwrite ## Risk Classification | Level | Examples | Action | |-------|----------|--------| | GREEN | `ls`, `cat`, `grep`, `tail`, `which`, `mkdir`, `cd`, `mix test/compile/credo/format`, `git status/log/diff` | Auto-recommend | | YELLOW | `git add/commit/push`, `mix ecto.migrate`, `mix deps.get`, `npm install`, `docker build/run`, `source`, `mise exec` | Recommend with note | | RED | `rm -rf`, `sudo`, `kill`, `curl|sh`,`mix ecto.reset/drop`,`git push --force`,`git reset --hard` | Never recommend | ## Workflow ### Step 1: Extract Bash Commands from Session JSO...