feat: add comprehensive auto-allow rules for Claude and Codex
This commit is contained in:
Dmitry
@@ -31,6 +31,149 @@
|
||||
}
|
||||
}
|
||||
},
|
||||
"permissions": {
|
||||
"allow": [
|
||||
"Bash(rtk *)",
|
||||
|
||||
"Bash(ls *)", "Bash(ls)",
|
||||
"Bash(ll *)", "Bash(ll)",
|
||||
"Bash(la *)", "Bash(la)",
|
||||
"Bash(eza *)",
|
||||
"Bash(find *)",
|
||||
"Bash(fd *)",
|
||||
"Bash(pwd)",
|
||||
"Bash(which *)",
|
||||
"Bash(type *)",
|
||||
"Bash(command -v *)",
|
||||
"Bash(whereis *)",
|
||||
|
||||
"Bash(cat *)",
|
||||
"Bash(bat *)",
|
||||
"Bash(head *)",
|
||||
"Bash(tail *)",
|
||||
"Bash(less *)",
|
||||
"Bash(wc *)",
|
||||
"Bash(file *)",
|
||||
"Bash(stat *)",
|
||||
|
||||
"Bash(grep *)",
|
||||
"Bash(rg *)",
|
||||
"Bash(ag *)",
|
||||
"Bash(echo *)",
|
||||
"Bash(printf *)",
|
||||
"Bash(sed *)",
|
||||
"Bash(awk *)",
|
||||
"Bash(cut *)",
|
||||
"Bash(sort *)",
|
||||
"Bash(uniq *)",
|
||||
"Bash(tr *)",
|
||||
"Bash(jq *)",
|
||||
|
||||
"Bash(mkdir *)",
|
||||
"Bash(touch *)",
|
||||
"Bash(cp *)",
|
||||
"Bash(mv *)",
|
||||
"Bash(chmod *)",
|
||||
"Bash(chown *)",
|
||||
"Bash(ln *)",
|
||||
|
||||
"Bash(git status *)", "Bash(git status)",
|
||||
"Bash(git log *)",
|
||||
"Bash(git diff *)",
|
||||
"Bash(git show *)",
|
||||
"Bash(git branch *)",
|
||||
"Bash(git remote *)",
|
||||
"Bash(git stash *)",
|
||||
"Bash(git tag *)",
|
||||
"Bash(git add *)",
|
||||
"Bash(git commit *)",
|
||||
"Bash(git checkout *)",
|
||||
"Bash(git switch *)",
|
||||
"Bash(git restore *)",
|
||||
"Bash(git fetch *)",
|
||||
"Bash(git pull *)",
|
||||
"Bash(git push *)",
|
||||
"Bash(git mv *)",
|
||||
"Bash(git rm *)",
|
||||
"Bash(git config *)",
|
||||
"Bash(git blame *)",
|
||||
"Bash(git describe *)",
|
||||
"Bash(git shortlog *)",
|
||||
|
||||
"Bash(chezmoi *)",
|
||||
|
||||
"Bash(npm *)",
|
||||
"Bash(npx *)",
|
||||
"Bash(yarn *)",
|
||||
"Bash(pnpm *)",
|
||||
"Bash(node *)",
|
||||
"Bash(bun *)",
|
||||
|
||||
"Bash(bundle *)",
|
||||
"Bash(gem *)",
|
||||
"Bash(ruby *)",
|
||||
"Bash(rbenv *)",
|
||||
"Bash(rspec *)",
|
||||
"Bash(rails *)",
|
||||
"Bash(bin/rails *)",
|
||||
|
||||
"Bash(python *)",
|
||||
"Bash(python3 *)",
|
||||
"Bash(pip *)",
|
||||
"Bash(pip3 *)",
|
||||
"Bash(uv *)",
|
||||
"Bash(pytest *)",
|
||||
"Bash(poetry *)",
|
||||
|
||||
"Bash(cargo *)",
|
||||
"Bash(rustc *)",
|
||||
"Bash(rustup *)",
|
||||
"Bash(go *)",
|
||||
"Bash(make *)",
|
||||
|
||||
"Bash(date *)", "Bash(date)",
|
||||
"Bash(uname *)",
|
||||
"Bash(hostname *)",
|
||||
"Bash(whoami)",
|
||||
"Bash(id)",
|
||||
"Bash(env)", "Bash(env *)",
|
||||
"Bash(printenv *)",
|
||||
"Bash(ps *)",
|
||||
"Bash(df *)",
|
||||
"Bash(du *)",
|
||||
"Bash(free *)",
|
||||
"Bash(uptime)",
|
||||
"Bash(lsof *)",
|
||||
"Bash(ss *)",
|
||||
"Bash(ip *)",
|
||||
"Bash(ping *)",
|
||||
"Bash(curl *)",
|
||||
"Bash(wget *)",
|
||||
"Bash(ssh *)",
|
||||
"Bash(ssh-keygen *)",
|
||||
|
||||
"Bash(pacman -Q*)",
|
||||
"Bash(pacman -Si *)",
|
||||
"Bash(pacman -Ss *)",
|
||||
"Bash(paru -Q*)",
|
||||
"Bash(systemctl status *)",
|
||||
"Bash(journalctl *)",
|
||||
|
||||
"Bash(resticprofile *)",
|
||||
"Bash(restic *)",
|
||||
"Bash(rclone *)",
|
||||
"Bash(age *)",
|
||||
|
||||
"Bash(docker ps *)", "Bash(docker ps)",
|
||||
"Bash(docker images *)", "Bash(docker images)",
|
||||
"Bash(docker logs *)",
|
||||
"Bash(docker inspect *)",
|
||||
"Bash(docker exec *)",
|
||||
"Bash(kubectl get *)",
|
||||
"Bash(kubectl describe *)",
|
||||
"Bash(kubectl logs *)"
|
||||
]
|
||||
},
|
||||
"language": "Russian",
|
||||
"effortLevel": "high",
|
||||
"remoteControlAtStartup": false,
|
||||
|
||||
@@ -1,9 +1,135 @@
|
||||
prefix_rule(pattern=["chmod", "-R", "u+w"], decision="allow")
|
||||
prefix_rule(pattern=["sudo", "chown"], decision="allow")
|
||||
prefix_rule(pattern=["bin/rails", "db:migrate", "RAILS_ENV=development"], decision="allow")
|
||||
prefix_rule(pattern=["bundle", "exec", "rspec"], decision="allow")
|
||||
prefix_rule(pattern=["bin/rails", "runner", "p User.roles; p User.new(role: :student).available_roles; p User.new(role: :admin).available_roles", "RAILS_ENV=development"], decision="allow")
|
||||
prefix_rule(pattern=["bin/rails", "db:schema:load", "RAILS_ENV=test"], decision="allow")
|
||||
prefix_rule(pattern=["bin/rails", "db:migrate:status", "RAILS_ENV=development"], decision="allow")
|
||||
prefix_rule(pattern=["/usr/bin/zsh", "-lc", "UV_CACHE_DIR=/tmp/uv-cache rtk uv lock"], decision="allow")
|
||||
prefix_rule(pattern=["/usr/bin/zsh", "-lc", "UV_CACHE_DIR=/tmp/uv-cache rtk uv run python project_web/manage.py check"], decision="allow")
|
||||
# ── Навигация и чтение ─────────────────────────────────────────────────────
|
||||
prefix_rule(pattern=["ls"], decision="allow")
|
||||
prefix_rule(pattern=["ll"], decision="allow")
|
||||
prefix_rule(pattern=["la"], decision="allow")
|
||||
prefix_rule(pattern=["eza"], decision="allow")
|
||||
prefix_rule(pattern=["find"], decision="allow")
|
||||
prefix_rule(pattern=["fd"], decision="allow")
|
||||
prefix_rule(pattern=["pwd"], decision="allow")
|
||||
prefix_rule(pattern=["which"], decision="allow")
|
||||
prefix_rule(pattern=["type"], decision="allow")
|
||||
prefix_rule(pattern=["whereis"], decision="allow")
|
||||
prefix_rule(pattern=["cat"], decision="allow")
|
||||
prefix_rule(pattern=["bat"], decision="allow")
|
||||
prefix_rule(pattern=["head"], decision="allow")
|
||||
prefix_rule(pattern=["tail"], decision="allow")
|
||||
prefix_rule(pattern=["less"], decision="allow")
|
||||
prefix_rule(pattern=["wc"], decision="allow")
|
||||
prefix_rule(pattern=["file"], decision="allow")
|
||||
prefix_rule(pattern=["stat"], decision="allow")
|
||||
|
||||
# ── Поиск и текст ───────────────────────────────────────────────────────────
|
||||
prefix_rule(pattern=["grep"], decision="allow")
|
||||
prefix_rule(pattern=["rg"], decision="allow")
|
||||
prefix_rule(pattern=["ag"], decision="allow")
|
||||
prefix_rule(pattern=["echo"], decision="allow")
|
||||
prefix_rule(pattern=["printf"], decision="allow")
|
||||
prefix_rule(pattern=["sed"], decision="allow")
|
||||
prefix_rule(pattern=["awk"], decision="allow")
|
||||
prefix_rule(pattern=["cut"], decision="allow")
|
||||
prefix_rule(pattern=["sort"], decision="allow")
|
||||
prefix_rule(pattern=["uniq"], decision="allow")
|
||||
prefix_rule(pattern=["tr"], decision="allow")
|
||||
prefix_rule(pattern=["jq"], decision="allow")
|
||||
prefix_rule(pattern=["diff"], decision="allow")
|
||||
|
||||
# ── Файловые операции ───────────────────────────────────────────────────────
|
||||
prefix_rule(pattern=["mkdir"], decision="allow")
|
||||
prefix_rule(pattern=["touch"], decision="allow")
|
||||
prefix_rule(pattern=["cp"], decision="allow")
|
||||
prefix_rule(pattern=["mv"], decision="allow")
|
||||
prefix_rule(pattern=["chmod"], decision="allow")
|
||||
prefix_rule(pattern=["chown"], decision="allow")
|
||||
prefix_rule(pattern=["ln"], decision="allow")
|
||||
|
||||
# ── Git ─────────────────────────────────────────────────────────────────────
|
||||
prefix_rule(pattern=["git"], decision="allow")
|
||||
|
||||
# ── Chezmoi ─────────────────────────────────────────────────────────────────
|
||||
prefix_rule(pattern=["chezmoi"], decision="allow")
|
||||
|
||||
# ── Node.js ─────────────────────────────────────────────────────────────────
|
||||
prefix_rule(pattern=["npm"], decision="allow")
|
||||
prefix_rule(pattern=["npx"], decision="allow")
|
||||
prefix_rule(pattern=["yarn"], decision="allow")
|
||||
prefix_rule(pattern=["pnpm"], decision="allow")
|
||||
prefix_rule(pattern=["node"], decision="allow")
|
||||
prefix_rule(pattern=["bun"], decision="allow")
|
||||
|
||||
# ── Ruby ────────────────────────────────────────────────────────────────────
|
||||
prefix_rule(pattern=["bundle"], decision="allow")
|
||||
prefix_rule(pattern=["gem"], decision="allow")
|
||||
prefix_rule(pattern=["ruby"], decision="allow")
|
||||
prefix_rule(pattern=["rbenv"], decision="allow")
|
||||
prefix_rule(pattern=["rspec"], decision="allow")
|
||||
prefix_rule(pattern=["rails"], decision="allow")
|
||||
prefix_rule(pattern=["bin/rails"], decision="allow")
|
||||
|
||||
# ── Python ──────────────────────────────────────────────────────────────────
|
||||
prefix_rule(pattern=["python"], decision="allow")
|
||||
prefix_rule(pattern=["python3"], decision="allow")
|
||||
prefix_rule(pattern=["pip"], decision="allow")
|
||||
prefix_rule(pattern=["pip3"], decision="allow")
|
||||
prefix_rule(pattern=["uv"], decision="allow")
|
||||
prefix_rule(pattern=["pytest"], decision="allow")
|
||||
prefix_rule(pattern=["poetry"], decision="allow")
|
||||
|
||||
# ── Rust / Go / Make ────────────────────────────────────────────────────────
|
||||
prefix_rule(pattern=["cargo"], decision="allow")
|
||||
prefix_rule(pattern=["rustc"], decision="allow")
|
||||
prefix_rule(pattern=["rustup"], decision="allow")
|
||||
prefix_rule(pattern=["go"], decision="allow")
|
||||
prefix_rule(pattern=["make"], decision="allow")
|
||||
|
||||
# ── Системная информация ────────────────────────────────────────────────────
|
||||
prefix_rule(pattern=["date"], decision="allow")
|
||||
prefix_rule(pattern=["uname"], decision="allow")
|
||||
prefix_rule(pattern=["hostname"], decision="allow")
|
||||
prefix_rule(pattern=["whoami"], decision="allow")
|
||||
prefix_rule(pattern=["id"], decision="allow")
|
||||
prefix_rule(pattern=["env"], decision="allow")
|
||||
prefix_rule(pattern=["printenv"], decision="allow")
|
||||
prefix_rule(pattern=["ps"], decision="allow")
|
||||
prefix_rule(pattern=["df"], decision="allow")
|
||||
prefix_rule(pattern=["du"], decision="allow")
|
||||
prefix_rule(pattern=["free"], decision="allow")
|
||||
prefix_rule(pattern=["uptime"], decision="allow")
|
||||
prefix_rule(pattern=["lsof"], decision="allow")
|
||||
prefix_rule(pattern=["ss"], decision="allow")
|
||||
prefix_rule(pattern=["ip"], decision="allow")
|
||||
prefix_rule(pattern=["ping"], decision="allow")
|
||||
prefix_rule(pattern=["curl"], decision="allow")
|
||||
prefix_rule(pattern=["wget"], decision="allow")
|
||||
prefix_rule(pattern=["ssh"], decision="allow")
|
||||
prefix_rule(pattern=["ssh-keygen"], decision="allow")
|
||||
|
||||
# ── Пакетный менеджер (только чтение) ───────────────────────────────────────
|
||||
prefix_rule(pattern=["pacman", "-Q"], decision="allow")
|
||||
prefix_rule(pattern=["pacman", "-Si"], decision="allow")
|
||||
prefix_rule(pattern=["pacman", "-Ss"], decision="allow")
|
||||
prefix_rule(pattern=["paru", "-Q"], decision="allow")
|
||||
prefix_rule(pattern=["systemctl", "status"], decision="allow")
|
||||
prefix_rule(pattern=["journalctl"], decision="allow")
|
||||
|
||||
# ── Инструменты ─────────────────────────────────────────────────────────────
|
||||
prefix_rule(pattern=["resticprofile"], decision="allow")
|
||||
prefix_rule(pattern=["restic"], decision="allow")
|
||||
prefix_rule(pattern=["rclone"], decision="allow")
|
||||
prefix_rule(pattern=["age"], decision="allow")
|
||||
prefix_rule(pattern=["rtk"], decision="allow")
|
||||
|
||||
# ── Docker / Kubernetes (только чтение) ────────────────────────────────────
|
||||
prefix_rule(pattern=["docker", "ps"], decision="allow")
|
||||
prefix_rule(pattern=["docker", "images"], decision="allow")
|
||||
prefix_rule(pattern=["docker", "logs"], decision="allow")
|
||||
prefix_rule(pattern=["docker", "inspect"], decision="allow")
|
||||
prefix_rule(pattern=["docker", "exec"], decision="allow")
|
||||
prefix_rule(pattern=["kubectl", "get"], decision="allow")
|
||||
prefix_rule(pattern=["kubectl", "describe"], decision="allow")
|
||||
prefix_rule(pattern=["kubectl", "logs"], decision="allow")
|
||||
|
||||
# ── Shell wrappers ──────────────────────────────────────────────────────────
|
||||
prefix_rule(pattern=["/usr/bin/zsh", "-lc"], decision="allow")
|
||||
prefix_rule(pattern=["/bin/zsh", "-lc"], decision="allow")
|
||||
prefix_rule(pattern=["/usr/bin/bash", "-c"], decision="allow")
|
||||
prefix_rule(pattern=["/bin/bash", "-c"], decision="allow")
|
||||
|
||||
Reference in New Issue
Block a user