v7.1.1: settings.system.json ships redundant Write(<path>) permission rules — warning spam every launch

[gangwaydigital]

Version: 7.1.1 (Claude Code, macOS 27.0 arm64)

Summary

The permissions block in install/settings.system.json pairs every Edit(<glob>) file rule with a redundant Write(<glob>) twin. On current Claude Code, Write(<path-glob>) rules are not applied to file-permission checks — only Edit(...) rules cover file-editing tools (Write/Edit/MultiEdit/NotebookEdit). So each Write(<path>) entry prints a warning on every launch and otherwise does nothing.

Evidence

Headless launch (claude -p with the LifeOS system prompt) prints ~18 lines:

Permission allow rule (settings.json): Write(~/.claude/**) is not matched by file
  permission checks — only Edit(path) rules are. Use Edit(~/.claude/**) instead.
Permission deny rule (settings.json): Write(/etc/**) ... Use Edit(/etc/**) instead.
Permission ask rule (settings.json): Write(~/.claude/.env) ... Use Edit(~/.claude/.env) instead.

NOT a security issue

Every Write(<path>) already has an Edit(<path>) twin in the same allow/deny/ask list. So the protective deny rules (/etc, /System, /usr, /bin, /sbin, ~/.claude/projects/**/memory/**) and the .env ask rules ARE enforced via their Edit(...) twins. The Write(...) entries are pure redundant no-ops — cosmetic noise, emitted on every launch including headless bun run / cron spawnClaude() calls.

Affected entries (allow / deny / ask)

Write(~/.claude/**), Write(~/Projects/**), Write(~/Downloads/**), Write(/tmp/**), Write(/private/tmp/**), Write(**/tmp/**), Write(tmp/**), Write(/var/folders/**), Write(~/.claude/projects/**/memory/**), Write(/etc/**), Write(/System/**), Write(/usr/**), Write(/bin/**), Write(/sbin/**), Write(~/.claude/.env), Write(~/.claude/.env.*), Write(~/.claude/**/.env), Write(~/.claude/**/.env.*).

Proposed fix

Drop the Write(<path>) entries from settings.system.json — the Edit(<path>) twins already cover all file-editing tools. (If older harnesses still honored Write(<path>) path rules, version-gate; but on current Claude Code they only produce warnings.)