claude-code-settings: add missing documented tools to permissionRule pattern

[asgeirtj]

What

Adds 17 tool names to the permissionRule pattern in claude-code-settings.json that are documented in the official Claude Code tools reference but were missing from the pattern:

AskUserQuestion, CronCreate, CronDelete, CronList, EndConversation, EnterPlanMode, ExitWorktree, ListAgents, ListMcpResourcesTool, PushNotification, ReadMcpResourceTool, RemoteTrigger, ReportFindings, ScheduleWakeup, SendMessage, SendUserFile, WaitForMcpServers

Why

Valid permission rules naming these tools (e.g. "deny": ["EnterPlanMode", "CronCreate"]) are flagged in editors with:

String does not match the pattern of "^((Agent|Artifact|Bash|…"

even though Claude Code accepts and enforces them. The asymmetry was confusing in practice: ExitPlanMode passed while its sibling EnterPlanMode was flagged, EnterWorktree passed while ExitWorktree was flagged.

Changes

• Merged the missing names into the pattern, keeping alphabetical order. Existing undocumented-but-real names (Cd, KillShell, MultiEdit) are kept.
• Extended src/test/claude-code-settings/permissions-advanced.json deny list to cover the added names.

Validation

• node cli.js check passes
• prettier --check passes on both files
• Spot-checked with schemasafe: the extended test file validates, and a bogus tool name (TotallyFakeTool) is still rejected

[github-actions]

Thanks for the PR!

This section of the codebase is owned by @domdomegg, @bogini, @sarahdeaton, and @ant-kurt - if they write a comment saying "LGTM" then it will be merged.

[miteshashar]

@asgeirtj It is not accurate to add any of these tools in the permissionRule pattern, since they do not require a permission, as listed in the permission table on the page you have linked. They are all no-ops.

Update
I further read the Why part and understand your point. I retract my statement above. I feel two patterns should be maintained, for allow and deny, otherwise allow would show options in the CLI for tools that do not need one.

[asgeirtj]

@miteshashar There is actually one exception which is the EndConversation tool so adding it deny is truly no-op.

https://code.claude.com/docs/en/tools-reference#endconversation-tool-behavior

And yes splitting totally makes sense, since some are no-op in the allow direction. I set some deny permissions on some tools which I never use as it removes the tool input schema injection for it for the model, saving tokens.

[miteshashar]

Following up since this thread is where it came from: the 18 missing tool names are in my v2.1.251 sync PR (#6273), credited to you.

The allow/deny split we discussed isn't in it — restricting allow to the permission-required tools would reject 16 names that validate today, including Read, so I've noted it as deferred in that PR's Skipped section rather than dropping it silently.