jpmschweitzerandClaude
5b4814a3cd
pql is now a bare word on PATH, which removed the long incantation that had been forcing --vault into every call by habit. Convenience lowered the cost of the wrong thing without lowering the cost of the right one: a three-word pql ticket new targets whichever vault the cwd happens to sit in, and there are nine of them with colliding id sequences. PQL_VAULT in each project settings file makes the vault a property of the session rather than of the working directory — the same lesson Rule 3 records for git -C, applied to pql. Verified the env var overrides cwd discovery, that an explicit --vault still beats the env var, and that the harness hot-reloads it without a restart. This does not make provenance visible: no output says which vault answered, so a forgotten --vault still returns a well-formed answer about the wrong dataset. That remains T-37. Co-Authored-By: Claude <noreply@anthropic.com>
71 lines
2.0 KiB
JSON
71 lines
2.0 KiB
JSON
{
|
|
"env": {
|
|
"PQL_VAULT": "/mnt/media/Projects/scheduler"
|
|
},
|
|
"permissions": {
|
|
"allow": [
|
|
"Bash(pql)",
|
|
"Bash(pql *)",
|
|
"Bash(/home/jpmschweitzer/.local/bin/pql:*)",
|
|
"Bash(git status:*)",
|
|
"Bash(git log:*)",
|
|
"Bash(git diff:*)",
|
|
"Bash(git branch:*)",
|
|
"Bash(.venv/bin/python -m pytest:*)",
|
|
"Bash(.venv/bin/pytest:*)",
|
|
"Bash(pytest:*)",
|
|
"Bash(docker logs scheduler:*)",
|
|
"Bash(curl -s http://localhost:8090/*)"
|
|
],
|
|
"deny": [
|
|
"Bash(/mnt/media/Projects/cladmin/ops/bin/toj)",
|
|
"Bash(/mnt/media/Projects/cladmin/ops/bin/toj:*)",
|
|
"Bash(chmod -R 777 *)",
|
|
"Bash(chmod 777 *)",
|
|
"Bash(dd if=*)",
|
|
"Bash(find * -delete*)",
|
|
"Bash(find * -exec*)",
|
|
"Bash(git * add --all*)",
|
|
"Bash(git * add -A*)",
|
|
"Bash(git * add .)",
|
|
"Bash(git * branch -D *)",
|
|
"Bash(git * checkout -- *)",
|
|
"Bash(git * clean -fd*)",
|
|
"Bash(git * clean -fdx*)",
|
|
"Bash(git * commit --no-verify*)",
|
|
"Bash(git * merge --no-ff*)",
|
|
"Bash(git * push --force*)",
|
|
"Bash(git * push -f*)",
|
|
"Bash(git * reset --hard*)",
|
|
"Bash(git * restore .*)",
|
|
"Bash(git add --all*)",
|
|
"Bash(git add -A*)",
|
|
"Bash(git add .)",
|
|
"Bash(git branch -D *)",
|
|
"Bash(git checkout -- *)",
|
|
"Bash(git clean -fd*)",
|
|
"Bash(git clean -fdx*)",
|
|
"Bash(git commit --no-verify*)",
|
|
"Bash(git merge --no-ff*)",
|
|
"Bash(git push --force*)",
|
|
"Bash(git push -f*)",
|
|
"Bash(git reset --hard*)",
|
|
"Bash(git restore .*)",
|
|
"Bash(mkfs*)",
|
|
"Bash(psql * -c DELETE FROM scheduled_tasks*)",
|
|
"Bash(psql * -c DROP*)",
|
|
"Bash(psql * DROP DATABASE*)",
|
|
"Bash(psql * TRUNCATE*)",
|
|
"Bash(redis-cli * FLUSHALL*)",
|
|
"Bash(redis-cli * FLUSHDB*)",
|
|
"Bash(rm -rf $HOME*)",
|
|
"Bash(rm -rf /*)",
|
|
"Bash(rm -rf ~*)",
|
|
"Bash(su *)",
|
|
"Bash(sudo *)",
|
|
"Bash(toj)",
|
|
"Bash(toj:*)"
|
|
]
|
|
}
|
|
}
|