crashlytics-install-permissions

---
name: crashlytics-install-permissions
description: Add Crashlytics plugin's read-only commands to your settings.json allowlist (no more permission prompts during /crash-report). Use when the user invokes /install-permissions.
version: 0.1.0
---

> Converted from Claude Code command `/install-permissions`.
> Review and adapt: hooks and MCP tool IDs may need manual mapping for Codex.
> Helper scripts ship in this skill's own `scripts/` directory. Replace
> `<this skill directory>` with the path Codex reported when it loaded this skill —
> a bare relative path would resolve against the repository under review instead.

# Install Crashlytics permissions

Adds the Crashlytics plugin's read-only Bash and MCP tools to your settings.json
allowlist so `/crashlytics:crash-report` runs without permission prompts.

**What gets added** — strictly read-only operations:
- git: `status`, `log`, `blame`, `diff`, `show`, `fetch`, `branch`, `remote`, `ls-tree`, `ls-files`, `rev-parse`, `merge-base`
- crashlytics scripts (validate-report.py, fetch-crash-data.py, check-prerequisites.sh)
- MCP read tools: `crashlytics_get_*`, `crashlytics_list_*`, `crashlytics_batch_get_events`, `crashlytics_get_report`, `firebase_get_*`, `firebase_list_*`

**What is NEVER added** — write/auth/destructive operations:
- `git push`, `git commit`, `git reset`, `git rebase`, `git clean`
- `crashlytics_update_issue`, `crashlytics_create_note`, `crashlytics_delete_note`
- `firebase_login`, `firebase_logout`, `firestore_*`, `auth_*`, `storage_*`, `messaging_*`, `realtimedatabase_*`, `remoteconfig_*`

## Step 1: Choose scope

```yaml
AskUserQuestion:
  questions:
    - question: "Where to install the allowlist?"
      header: "Scope"
      options:
        - label: "User-level (~/.claude/settings.json)"
          description: "Applies in every project. Recommended if you use the plugin in multiple repos."
        - label: "Project-level (.claude/settings.local.json)"
          description: "Only this project. Safer if you don't want global allowance."
      multiSelect: false
```

If User-level → SETTINGS_PATH = `~/.claude/settings.json`.
If Project-level → SETTINGS_PATH = `.claude/settings.local.json` (mkdir -p `.claude` if missing).

## Step 2: Read current settings

```yaml
Bash: test -f {SETTINGS_PATH} && echo EXISTS || echo NEW
Read tool: {SETTINGS_PATH}   # if EXISTS

If NEW:
  CURRENT = { "permissions": { "allow": [] } }
Else:
  CURRENT = <parsed JSON>
  Ensure permissions.allow exists, default to []
```

## Step 3: Compute the diff

```python
SAFE_SET = [
    # git read-only
    "Bash(git status:*)",
    "Bash(git log:*)",
    "Bash(git blame:*)",
    "Bash(git diff:*)",
    "Bash(git show:*)",
    "Bash(git fetch:*)",
    "Bash(git ls-tree:*)",
    "Bash(git ls-files:*)",
    "Bash(git rev-parse:*)",
    "Bash(git merge-base:*)",
    "Bash(git branch:*)",
    "Bash(git remote:*)",
    "Bash(git config --get:*)",

    # crashlytics scripts
    "Bash(<this skill directory>/scripts/check-prerequisites.sh:*)",
    "Bash(python3 <this skill directory>/scripts/validate-report.py:*)",
    "Bash(python3 <this skill directory>/scripts/fetch-crash-data.py:*)",

    # generic safe utils used by the plugin
    "Bash(test -f:*)",
    "Bash(touch .claude/crashlytics-prereqs-ok)",

    # MCP — read-only Crashlytics
    "mcp__plugin_crashlytics_firebase__crashlytics_get_issue",
    "mcp__plugin_crashlytics_firebase__crashlytics_batch_get_events",
    "mcp__plugin_crashlytics_firebase__crashlytics_list_events",
    "mcp__plugin_crashlytics_firebase__crashlytics_get_report",
    "mcp__plugin_crashlytics_firebase__crashlytics_list_notes",

    # MCP — read-only Firebase project info
    "mcp__plugin_crashlytics_firebase__firebase_get_environment",
    "mcp__plugin_crashlytics_firebase__firebase_list_apps",
    "mcp__plugin_crashlytics_firebase__firebase_get_project",
    "mcp__plugin_crashlytics_firebase__firebase_list_projects",
    "mcp__plugin_crashlytics_firebase__firebase_get_sdk_config",
]

EXISTING = set(CURRENT["permissions"]["allow"])
TO_ADD   = [r for r in SAFE_SET if r not in EXISTING]
```

If `TO_ADD` is empty → inform user "All Crashlytics permissions already present in {SETTINGS_PATH}." and exit.

## Step 4: Show diff and confirm

Print:

```
Adding {N} new rule(s) to {SETTINGS_PATH}:
  + Bash(git fetch:*)
  + Bash(git ls-tree:*)
  + ...
```

Then:

```yaml
AskUserQuestion:
  questions:
    - question: "Apply these changes to {SETTINGS_PATH}?"
      header: "Confirm"
      options:
        - label: "Yes, write the file"
          description: "Append the new rules to permissions.allow"
        - label: "Cancel"
          description: "Don't change anything"
      multiSelect: false
```

If Cancel → exit without writes.

## Step 5: Write merged settings

```yaml
NEW = CURRENT
NEW["permissions"]["allow"] = sorted(set(EXISTING) | set(SAFE_SET))

Write tool: {SETTINGS_PATH}
  contents: json.dumps(NEW, indent=2, ensure_ascii=False) + "\n"
```

For project-level path — `mkdir -p .claude` first if needed.

## Step 6: Confirm

Display:

```
Crashlytics allowlist installed.

  Scope: {scope}
  File:  {SETTINGS_PATH}
  Added: {N} rule(s)

Restart your current Claude Code session for permissions to take effect.
Run /crashlytics:crash-report again — no permission prompts on read-only steps.
```

## Notes

- The script never adds write/auth/destructive rules.
- The script never modifies `permissions.deny` or other settings sections.
- Existing rules are preserved (set-union merge, sorted output).
- Re-run anytime — duplicate rules are deduplicated.

## Long-term TODO

When Claude Code adds a `permissions` field to `plugin.json` for declarative
allowlists, this command becomes obsolete. Track Anthropic's plugin spec.

## Codex differences

- A non-interactive run (`codex exec`, CI) has nobody to answer a prompt: continue on defaults, honour whatever the invoking prompt already specified, and report which defaults were used. If the whole point of the command is to ask, say that it needs an interactive session and stop rather than inventing answers.

• SKILL.md 6 KB
• scripts/check-prerequisites.sh 1 KB
• scripts/fetch-crash-data.py 6 KB
• scripts/validate-report.py 21 KB