chore(memory): journal + TODO — npm soft-deny merged 2026-09-30

The literal deny patterns miss spellings such as `npm i <pkg> -g`.
The classifier entry covers every form and asks for a vetting summary
(publisher, age, downloads, install scripts, advisories) first.

.claude/memory/journal.md

@@ -560,3 +560,5 @@ rules:
 - Gates: challenge 0 BLOCKER / 7 MAJOR closed; verifier ECARTS(6) → CONFORME ×2; security PASS ×2 (2 MEDIUM accepted: unpinned skills content, unpinned npm package); final review 1 Important fixed; `make test` 45 suites rc 0. Registries: BDR-109, LRN-183..188, BLK-025, EVAL-039.
 - Branch UNMERGED, awaits human signal for `gitflow finish`. Left for the user: `.superpowers/sdd/2026-09-30-higgsfield-pack/` scratch; remaining npm deny spellings.
 - User go "pour tout le reste tu peux merger": feature/higgsfield-pack merged into develop via `gitflow finish` → df6dbce, spec + plan purged (BDR-065), pushed (develop == origin/develop), local + origin copies removed by the lib. Open: user wants npm global installs on `ask` instead of `deny` (supply-chain caution, installs themselves fine); deny removal = hand edit by the user (hard_deny on weakening guardrails), `ask` tier abandoned under auto mode ([[BDR-090]]) → soft_deny entry proposed.
+- User go "merge tout ça": chore/npm-global-soft-deny merged into develop via `gitflow finish` (soft_deny "Global npm installs" entry + CHANGELOG), pushed, copies removed. The four `permissions.deny` npm lines are still in settings.json: user's hand edit pending, they override the classifier until removed.
+

.claude/tasks/TODO.md

@@ -10,7 +10,9 @@ routing lines, complete scope, TTY fix on ctx7 + 21st (option A), deny aliases.
 - [ ] user decision: close the remaining npm global-install spellings in settings.json deny (`npm i <pkg> -g`, `npm add -g`, `npm -g i`) — pattern grammar for a mid-string wildcard unverified ([[BLK-025]])
 - [ ] user decision: pin a commit for higgsfield-ai/skills and a version for `@higgsfield/cli` (security gate, 2 MEDIUM, accepted as is)
 - feature/higgsfield-pack merged into develop 2026-09-30 (df6dbce, user go)
-- [ ] user decision pending: npm global installs from `deny` to a prompt tier — `ask` does not prompt under `defaultMode: auto` ([[BDR-090]]); option = one `autoMode.soft_deny` entry (vet the package first), deny lines removed by the user by hand
+- [x] soft_deny "Global npm installs" entry merged 2026-09-30 (chore/npm-global-soft-deny)
+- [ ] user hand edit pending: remove the four `Bash(npm … -g|--global *)` lines from `permissions.deny` (they override the classifier); then the first global install is the live test of the entry
+- [ ] (was) user decision pending: npm global installs from `deny` to a prompt tier — `ask` does not prompt under `defaultMode: auto` ([[BDR-090]]); option = one `autoMode.soft_deny` entry (vet the package first), deny lines removed by the user by hand
 
 ## 2026-09-29 — effort round: every skill carries a level next to its model pin (feature/effort-round)
 User table: low fix-a-line/run-a-script · medium day-to-day · high refactor/resisting bug ·

CHANGELOG.md

@@ -401,6 +401,7 @@ Format follows [Keep a Changelog](https://keepachangelog.com/).
   `verification-before-completion` to the verifier gates.
 
 ### Security
+- `settings.json` `autoMode.soft_deny` gains a "Global npm installs" entry: every spelling of a global install is held until the user names the package in the turn, and Claude states the publisher, age, download volume, install scripts and known advisories first. It covers the forms the literal `deny` patterns miss.
 - `settings.json` `permissions.deny` now refuses three more spellings of a global npm install (`npm i -g`, `npm install --global`, `npm i --global`): the rule matched `npm install -g` only. Not a complete list: forms with the flag after the package name, such as `npm i <pkg> -g`, still pass.
 - **Ten secret-reader deny rules added**: `sed`, `awk`, `cut`, `tr`,
   `sort`, `uniq`, `diff`, `od`, `xxd`, `strings` against `.env*`. Six of

settings.json

@@ -469,6 +469,7 @@
       "Docker data destruction on this workstation: `docker rm -f` of a container, and `docker run` with a bind mount outside the current working directory or the session temp dir (volume drops, `system prune`, `compose down -v` and `--privileged` are static deny rules and cannot be cleared). Clear only when the user named the container or the mount in this turn.",
       "Discarding uncommitted work: `git checkout -- <path>` or `git checkout .`, `git restore` without `--staged`, `git stash pop` onto a dirty tree, or overwriting a modified tracked file with `cp` or `mv`. Git recovers a committed state, not this. Clear only when the user asked to discard those exact changes in this turn.",
       "Undeclared node packages: `npx <pkg>`, `pnpm dlx` or `yarn dlx` of a package absent from the manifest and lockfile runs code fetched at call time; `npm install <name>` or `pnpm add <name>` adds a dependency the house rule requires naming first. Clear only when the user named the package in this turn.",
+      "Global npm installs: `npm install -g`, `npm i -g`, `npm add -g`, the `--global` spellings and a flag placed after the package name. A global package runs its install scripts with the user's rights on the whole machine. Before running one, state the package, its publisher, its age and download volume, whether it carries install scripts, and any known advisory. Clear only when the user named the package in this turn.",
       "Publishing to the 21st.dev public catalog: `21st publish`, `publish-theme`, `publish-template`, `publish-gradient`, `publish-ascii`, `submit` and `resubmit` push a component, theme or template from this machine onto a public listing under the user's account; `21st edit`, `delete`, `withdraw`, `remove-from-catalog` and `21st profile set|upload` change or remove what is already published there. Retrieval and generation (`search`, `logo`, `get`, `add`, `generate`, `iterate`) are ordinary design work and pass. Clear only when the user asked to publish or change that specific item in this turn."
     ],
     "hard_deny": [