From 2f00a9cab7f2a99cce2da91a724922817572dc02 Mon Sep 17 00:00:00 2001
From: Jeroen Schweitzer <jpmschweitzer@gmail.com>
Date: Sun, 9 Aug 2026 13:42:11 +0200
Subject: [PATCH] chore(claude): deny toj in the sub-repos

toj is now on the global PATH as /usr/local/bin/toj, so its scope boundary
had to stop being "the absolute path is inconvenient to type" and start
being a rule. Its repo and settings verbs operate on the workspace root; run
from inside this repo they answer about the wrong tree.

Both spellings are denied, bare and absolute, because a deny with one
spelling left open is decorative.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .claude/settings.json | 91 +++++++++++++++++++++----------------------
 1 file changed, 45 insertions(+), 46 deletions(-)

diff --git a/.claude/settings.json b/.claude/settings.json
index 2b94b38..4037328 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -13,57 +13,56 @@
       "Bash(docker logs library-desk:*)",
       "Bash(curl -s http://localhost:8089/*)"
     ],
-
     "deny": [
-      "Bash(sudo *)",
-      "Bash(su *)",
-
-      "Bash(rm -rf /*)",
-      "Bash(rm -rf ~*)",
-      "Bash(rm -rf $HOME*)",
-      "Bash(mkfs*)",
-      "Bash(dd if=*)",
-      "Bash(chmod 777 *)",
+      "Bash(/mnt/media/Projects/cladmin/ops/bin/toj)",
+      "Bash(/mnt/media/Projects/cladmin/ops/bin/toj:*)",
       "Bash(chmod -R 777 *)",
-
-      "Bash(find * -exec*)",
-      "Bash(find * -delete*)",
-
-      "Bash(git add -A*)",
-      "Bash(git * add -A*)",
-      "Bash(git add --all*)",
-      "Bash(git * add --all*)",
-      "Bash(git add .)",
-      "Bash(git * add .)",
-      "Bash(git push --force*)",
-      "Bash(git * push --force*)",
-      "Bash(git push -f*)",
-      "Bash(git * push -f*)",
-      "Bash(git reset --hard*)",
-      "Bash(git * reset --hard*)",
-      "Bash(git clean -fd*)",
-      "Bash(git * clean -fd*)",
-      "Bash(git clean -fdx*)",
-      "Bash(git * clean -fdx*)",
-      "Bash(git branch -D *)",
-      "Bash(git * branch -D *)",
-      "Bash(git checkout -- *)",
-      "Bash(git * checkout -- *)",
-      "Bash(git restore .*)",
-      "Bash(git * restore .*)",
-      "Bash(git commit --no-verify*)",
-      "Bash(git * commit --no-verify*)",
-      "Bash(git merge --no-ff*)",
-      "Bash(git * merge --no-ff*)",
-
-      "Bash(redis-cli * FLUSHALL*)",
-      "Bash(redis-cli FLUSHALL*)",
-      "Bash(redis-cli * FLUSHDB*)",
-      "Bash(redis-cli FLUSHDB*)",
+      "Bash(chmod 777 *)",
+      "Bash(dd if=*)",
       "Bash(dropdb *)",
+      "Bash(find * -delete*)",
+      "Bash(find * -exec*)",
+      "Bash(git * add --all*)",
+      "Bash(git * add -A*)",
+      "Bash(git * add .)",
+      "Bash(git * branch -D *)",
+      "Bash(git * checkout -- *)",
+      "Bash(git * clean -fd*)",
+      "Bash(git * clean -fdx*)",
+      "Bash(git * commit --no-verify*)",
+      "Bash(git * merge --no-ff*)",
+      "Bash(git * push --force*)",
+      "Bash(git * push -f*)",
+      "Bash(git * reset --hard*)",
+      "Bash(git * restore .*)",
+      "Bash(git add --all*)",
+      "Bash(git add -A*)",
+      "Bash(git add .)",
+      "Bash(git branch -D *)",
+      "Bash(git checkout -- *)",
+      "Bash(git clean -fd*)",
+      "Bash(git clean -fdx*)",
+      "Bash(git commit --no-verify*)",
+      "Bash(git merge --no-ff*)",
+      "Bash(git push --force*)",
+      "Bash(git push -f*)",
+      "Bash(git reset --hard*)",
+      "Bash(git restore .*)",
+      "Bash(mkfs*)",
       "Bash(psql * -c DROP*)",
       "Bash(psql * DROP DATABASE*)",
-      "Bash(psql * TRUNCATE*)"
+      "Bash(psql * TRUNCATE*)",
+      "Bash(redis-cli * FLUSHALL*)",
+      "Bash(redis-cli * FLUSHDB*)",
+      "Bash(redis-cli FLUSHALL*)",
+      "Bash(redis-cli FLUSHDB*)",
+      "Bash(rm -rf $HOME*)",
+      "Bash(rm -rf /*)",
+      "Bash(rm -rf ~*)",
+      "Bash(su *)",
+      "Bash(sudo *)",
+      "Bash(toj)",
+      "Bash(toj:*)"
     ]
   }
 }