chore(claude): scope auto-mode environment rules to this project

[BigSimmo]

Summary

• Move the Claude Code auto-mode allow / soft_deny / environment block out of the machine-wide ~/.claude/settings.json and into this repository's own .claude/settings.json, verbatim and unmodified. The block describes this project specifically — the live Supabase project ref, the Railway production services, protected branches, secret locations, and the provider-confirmation boundary — so a machine-wide home for it meant any unrelated project opened on the same workstation inherited Database-specific rules.
• Project-scoped .claude/settings.local.json was considered and rejected: it is git-ignored globally, so it would have to be replicated by hand into every working copy (~75 worktrees on the primary workstation) and into every new one thereafter. The tracked .claude/settings.json is the only project-scoped location git distributes automatically.
• autoMode is a documented top-level settings key, and project settings layer over user settings, so the effective rules for this repository are unchanged.

No new information is published by this move. Every fact in the block already appears in the tracked AGENTS.md — the Supabase project ref, the Railway project and services, the bucket names, and the branch-protection posture. Secret names appear; secret values do not, and none were read or written during this change.

Verification

• tests/claude-code-settings.test.ts + tests/session-start-hook.test.ts — the two committed guards that parse .claude/settings.json:

 Test Files 2 passed (2)
Tests 100 passed (100)

• npx prettier --write .claude/settings.json → .claude/settings.json 256ms (unchanged) (already formatted; whole-tree prettier policy unchanged by this diff)
• Both files re-parsed after the move: autoMode absent from user settings, present in project settings with all 24 environment entries, 5 allow entries and 4 soft_deny entries intact; the project hooks block (SessionStart, PreCompact, PostToolUse, PreToolUse) is untouched.
• npm run verify:pr-local -- --dry-run --files .claude/settings.json inspected for scope.

Verification not run: the full npm run verify:pr-local gate. This diff is 41 added lines in a Claude Code configuration file with no executable, product, RAG, or schema surface; classifyPullRequestFiles returns clinicalRisk: false, operationalRisk: false, ragRanking: false, ui: false. The two committed tests that actually parse this file are the smallest checks capable of detecting a regression here, and both pass. CI's static-pr / pr-required aggregate still runs on this PR as the backstop.

Risk and rollout

• Risk: Low, and confined to local agent tooling. The realistic failure mode is that project-level autoMode is somehow not honoured where the user-level block was, which would silently drop the soft_deny guardrails on live Supabase pushes and provider-backed evals. That risk is mitigated but not eliminated: the settings schema documents autoMode as an unrestricted top-level key (unlike, say, sandbox.network.strictAllowlist, which explicitly ignores project settings), but this change was not verified against a live auto-mode classifier call. It costs nothing to notice — the repo's own permissions.deny / permissions.ask rules in the same file are an independent second layer over the same provider commands, and they are unchanged.
• Rollback: git revert this commit. The prior machine-wide block is also retained on the workstation at ~/.claude/settings.json.bak-2026-08-20.
• Provider or production effects: None. No provider, live Supabase, OpenAI, or Railway call was made; no environment value was read or printed.
• RAG impact: none

🤖 Generated with Claude Code

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your current included review allowance is based on your included PR review attempts over the past 7 days.

Next review available in:56 minutes

Limit details: You’ve used the included review currently available. Your 85 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 2a4e5716-97ee-479d-861d-a1e4e617a497

📥 Commits

Reviewing files that changed from the base of the PR and between 4685547 and a96f530.

📒 Files selected for processing (2)

• .claude/settings.json
• docs/branch-review-records/69c1ad571fe121333c48aba14a7725b42ff6eede02d4bb4298c972e81c267286.record.md

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:411ed4c9a9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".