install-permissions

Install Crashlytics permissions

Adds the Crashlytics plugin's read-only Bash and MCP tools to your settings.json allowlist so /crashlytics:crash-report runs without permission prompts.

What gets added — strictly read-only operations:

• git: status, log, blame, diff, show, fetch, branch, remote, ls-tree, ls-files, rev-parse, merge-base
• crashlytics scripts (validate-report.py, fetch-crash-data.py, check-prerequisites.sh)
• MCP read tools: crashlytics_get_*, crashlytics_list_*, crashlytics_batch_get_events, crashlytics_get_report, firebase_get_*, firebase_list_*

What is NEVER added — write/auth/destructive operations:

• git push, git commit, git reset, git rebase, git clean
• crashlytics_update_issue, crashlytics_create_note, crashlytics_delete_note
• firebase_login, firebase_logout, firestore_*, auth_*, storage_*, messaging_*, realtimedatabase_*, remoteconfig_*

Step 1: Choose scope

AskUserQuestion:
  questions:
    - question: "Where to install the allowlist?"
      header: "Scope"
      options:
        - label: "User-level (~/.claude/settings.json)"
          description: "Applies in every project. Recommended if you use the plugin in multiple repos."
        - label: "Project-level (.claude/settings.local.json)"
          description: "Only this project. Safer if you don't want global allowance."
      multiSelect: false

If User-level → SETTINGS_PATH = ~/.claude/settings.json. If Project-level → SETTINGS_PATH = .claude/settings.local.json (mkdir -p .claude if missing).

Step 2: Read current settings

Bash: test -f {SETTINGS_PATH} && echo EXISTS || echo NEW
Read tool: {SETTINGS_PATH}   # if EXISTS

If NEW:
  CURRENT = { "permissions": { "allow": [] } }
Else:
  CURRENT = <parsed JSON>
  Ensure permissions.allow exists, default to []

Step 3: Compute the diff

SAFE_SET = [
    # git read-only
    "Bash(git status:*)",
    "Bash(git log:*)",
    "Bash(git blame:*)",
    "Bash(git diff:*)",
    "Bash(git show:*)",
    "Bash(git fetch:*)",
    "Bash(git ls-tree:*)",
    "Bash(git ls-files:*)",
    "Bash(git rev-parse:*)",
    "Bash(git merge-base:*)",
    "Bash(git branch:*)",
    "Bash(git remote:*)",
    "Bash(git config --get:*)",

    # crashlytics scripts
    "Bash(${CLAUDE_PLUGIN_ROOT}/scripts/check-prerequisites.sh:*)",
    "Bash(python3 ${CLAUDE_PLUGIN_ROOT}/scripts/validate-report.py:*)",
    "Bash(python3 ${CLAUDE_PLUGIN_ROOT}/scripts/fetch-crash-data.py:*)",

    # generic safe utils used by the plugin
    "Bash(test -f:*)",
    "Bash(touch .claude/crashlytics-prereqs-ok)",

    # MCP — read-only Crashlytics
    "mcp__plugin_crashlytics_firebase__crashlytics_get_issue",
    "mcp__plugin_crashlytics_firebase__crashlytics_batch_get_events",
    "mcp__plugin_crashlytics_firebase__crashlytics_list_events",
    "mcp__plugin_crashlytics_firebase__crashlytics_get_report",
    "mcp__plugin_crashlytics_firebase__crashlytics_list_notes",

    # MCP — read-only Firebase project info
    "mcp__plugin_crashlytics_firebase__firebase_get_environment",
    "mcp__plugin_crashlytics_firebase__firebase_list_apps",
    "mcp__plugin_crashlytics_firebase__firebase_get_project",
    "mcp__plugin_crashlytics_firebase__firebase_list_projects",
    "mcp__plugin_crashlytics_firebase__firebase_get_sdk_config",
]

EXISTING = set(CURRENT["permissions"]["allow"])
TO_ADD   = [r for r in SAFE_SET if r not in EXISTING]