jpmschweitzerandClaude Opus 5
189489e747
tools/ts-wasm/build.sh compiles straight out of the working trees under /var/mnt/data/projects/treesitter, so editing a grammar source or a highlights query silently changes the wasm and native artefacts. The divergence is invisible: treesitter is not itself a repo, so the cross-repo status sweeps report it as "not a git repo" and never descend into the ~49 sub-checkouts. A stray edit shows only in that one checkout's git status, which nothing routinely reads, and survives until someone re-clones. Guards the plausible accident — hand-editing a grammar while chasing a highlighting bug. It does not constrain Bash, so it is a guardrail against silent divergence rather than a hard boundary. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
71 lines
1.8 KiB
JSON
71 lines
1.8 KiB
JSON
{
|
|
"permissions": {
|
|
"allow": [
|
|
"Skill(pql)",
|
|
"Skill(clide)",
|
|
"Skill(whats-next)",
|
|
"Skill(git-commit)",
|
|
"Bash(git add *)",
|
|
"Bash(git commit *)",
|
|
"Bash(git status *)",
|
|
"Bash(git diff *)",
|
|
"Bash(git log *)",
|
|
"Bash(git show *)",
|
|
"Bash(git branch *)",
|
|
"Bash(git checkout *)",
|
|
"Bash(git switch *)",
|
|
"Bash(git merge *)",
|
|
"Bash(git rebase *)",
|
|
"Bash(git stash *)",
|
|
"Bash(git fetch *)",
|
|
"Bash(git pull *)",
|
|
"Bash(git push *)",
|
|
"Bash(git tag *)",
|
|
"Bash(git remote *)",
|
|
"Bash(git rev-parse *)",
|
|
"Bash(git symbolic-ref *)",
|
|
"Bash(git ls-remote *)",
|
|
"Bash(git config *)",
|
|
"Bash(git blame *)",
|
|
"Bash(git shortlog *)",
|
|
"Bash(git cherry-pick *)",
|
|
"Bash(dart *)",
|
|
"Bash(flutter *)",
|
|
"Bash(make *)",
|
|
"Bash(pql)",
|
|
"Bash(pql *)",
|
|
"Bash(clide)",
|
|
"Bash(clide *)",
|
|
"Bash(awk *)"
|
|
],
|
|
"deny": [
|
|
"Edit(//var/mnt/data/projects/treesitter/**)",
|
|
"Write(//var/mnt/data/projects/treesitter/**)",
|
|
"Bash(rm -rf /*)",
|
|
"Bash(rm -rf ~*)",
|
|
"Bash(rm -rf $HOME*)",
|
|
"Bash(sudo rm *)",
|
|
"Bash(sudo chmod *)",
|
|
"Bash(sudo chown *)",
|
|
"Bash(mkfs*)",
|
|
"Bash(mkfs.*)",
|
|
"Bash(dd if=*)",
|
|
"Bash(git push --force*)",
|
|
"Bash(git push -f*)",
|
|
"Bash(git push --force-with-lease*)",
|
|
"Bash(git reset --hard*)",
|
|
"Bash(git clean -fd*)",
|
|
"Bash(git clean -fdx*)",
|
|
"Bash(git clean -ffd*)",
|
|
"Bash(git branch -D *)",
|
|
"Bash(git checkout -- *)",
|
|
"Bash(git restore .*)",
|
|
"Bash(chmod -R 777 *)",
|
|
"Bash(chmod 777 *)",
|
|
"Bash(git add -A*)",
|
|
"Bash(git add --all*)",
|
|
"Bash(git add .)"
|
|
]
|
|
}
|
|
}
|