jpmschweitzerandClaude Opus 4.7
24237d2217
Shared-scope permissions so anyone cloning the repo inherits the same safety net. Allow list covers only the two explicit asks (git add, git commit). Deny list covers the usual destructive-command patterns: rm -rf on root/home, sudo rm/chmod/chown, mkfs, dd if=, git push --force variants, git reset --hard, git clean -fd/fdx, git branch -D, chmod 777. .claude/settings.local.json remains the empty per-user stub. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
32 lines
727 B
JSON
32 lines
727 B
JSON
{
|
|
"permissions": {
|
|
"allow": [
|
|
"Bash(git add *)",
|
|
"Bash(git commit *)"
|
|
],
|
|
"deny": [
|
|
"Bash(rm -rf /*)",
|
|
"Bash(rm -rf ~*)",
|
|
"Bash(rm -rf $HOME*)",
|
|
"Bash(sudo rm *)",
|
|
"Bash(sudo chmod *)",
|
|
"Bash(sudo chown *)",
|
|
"Bash(mkfs*)",
|
|
"Bash(mkfs.*)",
|
|
"Bash(dd if=*)",
|
|
"Bash(git push --force*)",
|
|
"Bash(git push -f*)",
|
|
"Bash(git push --force-with-lease*)",
|
|
"Bash(git reset --hard*)",
|
|
"Bash(git clean -fd*)",
|
|
"Bash(git clean -fdx*)",
|
|
"Bash(git clean -ffd*)",
|
|
"Bash(git branch -D *)",
|
|
"Bash(git checkout -- *)",
|
|
"Bash(git restore .*)",
|
|
"Bash(chmod -R 777 *)",
|
|
"Bash(chmod 777 *)"
|
|
]
|
|
}
|
|
}
|