許可ルールを積み上げたセッションが毎ターン重くなる — ルールセットの棚卸しと、安全性を保ったまま数を減らす設計

#!/usr/bin/env python3
"""find_shadowed.py — 同一バケット内で他のルールに被覆されたルールを検出する。
 
使い方:
    python3 find_shadowed.py ~/.claude/settings.json
"""
import json
import re
import sys
from collections import defaultdict
from pathlib import Path
 
RULE_RE = re.compile(r"^(?P<tool>[A-Za-z_][\w-]*)(?:\((?P<arg>.*)\))?$")
 
 
def literal_prefix(pattern: str) -> str:
    """グロブの手前までのリテラル部分を返す。'rm -rf:*' → 'rm -rf:'"""
    out = []
    for ch in pattern:
        if ch in "*?[":
            break
        out.append(ch)
    return "".join(out)
 
 
def covers(broad: str, narrow: str) -> bool:
    """broad が narrow を飲み込んでいそうなら True（保守的な近似）。"""
    if broad == narrow:
        return False
    if not broad.endswith("*"):
        return False  # 末尾ワイルドカードのない広域ルールは判定しない
    bp = literal_prefix(broad)
    np = literal_prefix(narrow)
    if not bp:
        return True  # "*" は全部を飲む
    return np.startswith(bp)
 
 
def main(path: str):
    data = json.loads(Path(path).expanduser().read_text(encoding="utf-8"))
    perms = data.get("permissions", {})
    found = 0
 
    for bucket, rules in perms.items():
        groups = defaultdict(list)
        for rule in rules:
            m = RULE_RE.match(rule.strip())
            if not m or m.group("arg") is None:
                continue
            groups[m.group("tool")].append((rule, m.group("arg")))
 
        for tool, items in groups.items():
            for broad_rule, broad_arg in items:
                for narrow_rule, narrow_arg in items:
                    if covers(broad_arg, narrow_arg):
                        found += 1
                        print(f"[{bucket}] {narrow_rule}")
                        print(f"         ↑ {broad_rule} に被覆されています")
 
    print(f"\n被覆候補: {found} 件")
    print("※ 近似判定です。削除前に必ず1件ずつ目視で確認してください。")
    return found
 
 
if __name__ == "__main__":
    sys.exit(0 if main(sys.argv[1] if len(sys.argv) > 1 else "~/.claude/settings.json") == 0 else 0)

#!/usr/bin/env bash
# bench_turn.sh — ルールセットを差し替えてターン時間を比較する。
#
#   ./bench_turn.sh before.json after.json 10
#
set -euo pipefail
 
SETTINGS_A="${1:?比較元の settings.json}"
SETTINGS_B="${2:?比較先の settings.json}"
RUNS="${3:-10}"
PROMPT='Reply with exactly: ok'
 
run_set() {
  local label="$1" settings="$2"
  local times=()
 
  for i in $(seq 1 "$RUNS"); do
    local start end
    start=$(date +%s%N)
    CLAUDE_CONFIG_DIR="$(mktemp -d)" \
      claude -p "$PROMPT" \
      --settings "$settings" \
      --model haiku \
      > /dev/null 2>&1 || true
    end=$(date +%s%N)
    times+=( $(( (end - start) / 1000000 )) )
  done
 
  # 中央値で比較する（初回のウォームアップに引きずられないため）
  local sorted median
  sorted=$(printf '%s\n' "${times[@]}" | sort -n)
  median=$(printf '%s\n' "$sorted" | awk '{a[NR]=$1} END {print (NR%2) ? a[(NR+1)/2] : int((a[NR/2]+a[NR/2+1])/2)}')
  printf '%-10s median=%5s ms   min=%5s ms   max=%5s ms   n=%s\n' \
    "$label" "$median" "$(printf '%s\n' "$sorted" | head -1)" \
    "$(printf '%s\n' "$sorted" | tail -1)" "$RUNS"
  echo "$median"
}
 
echo "=== ルール数 ==="
for f in "$SETTINGS_A" "$SETTINGS_B"; do
  n=$(python3 -c "
import json,sys
p=json.load(open('$f')).get('permissions',{})
print(sum(len(v) for v in p.values()))
")
  printf '  %-40s %s rules\n' "$(basename "$f")" "$n"
done
echo
 
MED_A=$(run_set "before" "$SETTINGS_A" | tail -1)
MED_B=$(run_set "after"  "$SETTINGS_B" | tail -1)
 
echo
awk -v a="$MED_A" -v b="$MED_B" 'BEGIN {
  d = a - b
  printf "差分: %+d ms (%.1f%%)\n", -d, (d / a) * 100
}'

{
  "permissions": {
    "deny": [
      "Bash(rm -rf /:*)",
      "Bash(rm -rf ~:*)",
      "Bash(rm -rf /tmp:*)",
      "Bash(rm -rf /var:*)",
      "Bash(rm -rf ./node_modules:*)",
      "Read(./.env)",
      "Read(./.env.local)",
      "Read(./.env.production)",
      "Read(./config/secrets.yml)",
      "Read(./config/master.key)",
      "Bash(curl:*)",
      "Bash(wget:*)"
    ]
  }
}

{
  "permissions": {
    "deny": [
      "Bash(rm -rf:*)",
      "Read(./.env*)",
      "Read(./config/*.key)",
      "Read(./config/secrets*)",
      "Bash(curl:*)",
      "Bash(wget:*)"
    ],
    "allow": [
      "Bash(rm -rf ./node_modules)",
      "Bash(rm -rf ./.next)",
      "Read(./.env.example)"
    ]
  }
}

#!/usr/bin/env bash
# count_mcp_tools.sh — 接続中の MCP サーバとツール本数を数える。
set -euo pipefail
 
echo "=== 設定ファイル上のサーバ ==="
for f in "$HOME/.claude.json" ".mcp.json"; do
  [ -f "$f" ] || continue
  python3 - "$f" << 'PY'
import json, sys
from pathlib import Path
p = Path(sys.argv[1])
data = json.loads(p.read_text(encoding="utf-8"))
servers = data.get("mcpServers") or {}
# ~/.claude.json はプロジェクトごとに入れ子になっていることがある
for proj, cfg in (data.get("projects") or {}).items():
    for name in (cfg.get("mcpServers") or {}):
        servers.setdefault(f"{name} ({proj})", {})
print(f"  {p}: {len(servers)} servers")
for name in sorted(servers):
    print(f"    - {name}")
PY
done
 
echo
echo "=== 実際に開いているツール本数 ==="
claude mcp list 2>/dev/null | sed 's/^/  /' || echo "  (claude mcp list が取得できませんでした)"

{
  "mcpServers": {
    "deploy": {
      "command": "npx",
      "args": ["-y", "@example/deploy-mcp"],
      "env": { "DEPLOY_TOKEN": "${DEPLOY_TOKEN}" }
    }
  }
}