jpmschweitzerandClaude
6b1c892bc6
Commits a .claude/settings.json rather than leaving permissions to per-developer local state, and initialises a pql vault for this repo's tickets and internal decisions. Every git deny rule appears in both the `git <verb>` and `git * <verb>` forms. Only the second catches `git -C <path>`, and without it the whole deny list is decorative -- it looks like a policy and stops nothing. The allow list carries pql's absolute path alongside the bare name. pql is installed to ~/.local/bin, which is on the login PATH but not the one a non-interactive shell gets, so the bare-name rules match nothing on their own and every call would prompt anyway. .gitignore now covers .claude/settings.local.json, which is machine-local and must never be shared. `pql init` contributed the .pql/* rules with an exception for the changelog, which is the replication log of record and has to be committed for tickets to travel with a clone. Co-Authored-By: Claude <noreply@anthropic.com>
69 lines
1.9 KiB
JSON
69 lines
1.9 KiB
JSON
{
|
|
"permissions": {
|
|
"allow": [
|
|
"Bash(pql)",
|
|
"Bash(pql *)",
|
|
"Bash(/home/jpmschweitzer/.local/bin/pql:*)",
|
|
"Bash(git status:*)",
|
|
"Bash(git log:*)",
|
|
"Bash(git diff:*)",
|
|
"Bash(git branch:*)",
|
|
"Bash(make test:*)",
|
|
"Bash(make test-unit:*)",
|
|
"Bash(make test-contracts:*)",
|
|
"Bash(make lint:*)",
|
|
"Bash(make typecheck:*)",
|
|
"Bash(.venv/bin/python -m pytest:*)",
|
|
"Bash(.venv/bin/pytest:*)",
|
|
"Bash(pytest:*)",
|
|
"Bash(ruff check:*)",
|
|
"Bash(mypy:*)",
|
|
"Bash(docker logs tatlock:*)",
|
|
"Bash(curl -s http://localhost:8000/*)",
|
|
"Bash(curl -s http://localhost:8777/*)"
|
|
],
|
|
"deny": [
|
|
"Bash(sudo *)",
|
|
"Bash(su *)",
|
|
"Bash(rm -rf /*)",
|
|
"Bash(rm -rf ~*)",
|
|
"Bash(rm -rf $HOME*)",
|
|
"Bash(mkfs*)",
|
|
"Bash(dd if=*)",
|
|
"Bash(chmod 777 *)",
|
|
"Bash(chmod -R 777 *)",
|
|
"Bash(find * -exec*)",
|
|
"Bash(find * -delete*)",
|
|
"Bash(git add -A*)",
|
|
"Bash(git * add -A*)",
|
|
"Bash(git add --all*)",
|
|
"Bash(git * add --all*)",
|
|
"Bash(git add .)",
|
|
"Bash(git * add .)",
|
|
"Bash(git push --force*)",
|
|
"Bash(git * push --force*)",
|
|
"Bash(git push -f*)",
|
|
"Bash(git * push -f*)",
|
|
"Bash(git reset --hard*)",
|
|
"Bash(git * reset --hard*)",
|
|
"Bash(git clean -fd*)",
|
|
"Bash(git * clean -fd*)",
|
|
"Bash(git clean -fdx*)",
|
|
"Bash(git * clean -fdx*)",
|
|
"Bash(git branch -D *)",
|
|
"Bash(git * branch -D *)",
|
|
"Bash(git checkout -- *)",
|
|
"Bash(git * checkout -- *)",
|
|
"Bash(git restore .*)",
|
|
"Bash(git * restore .*)",
|
|
"Bash(git commit --no-verify*)",
|
|
"Bash(git * commit --no-verify*)",
|
|
"Bash(git merge --no-ff*)",
|
|
"Bash(git * merge --no-ff*)",
|
|
"Bash(redis-cli * FLUSHALL*)",
|
|
"Bash(redis-cli * FLUSHDB*)",
|
|
"Bash(ollama rm *)"
|
|
]
|
|
}
|
|
}
|