From 7d85b483fca36906673345ec7c06d0d36763d813 Mon Sep 17 00:00:00 2001
From: Dmitry <ada.dmitry@gmail.com>
Date: Wed, 13 May 2026 20:00:05 +0300
Subject: [PATCH] feat: add comprehensive auto-allow rules for Claude and Codex

---
 dot_claude/settings.json      | 143 +++++++++++++++++++++++++++++++++
 dot_codex/rules/default.rules | 144 +++++++++++++++++++++++++++++++---
 2 files changed, 278 insertions(+), 9 deletions(-)

diff --git a/dot_claude/settings.json b/dot_claude/settings.json
index 8847b81..1e743d4 100644
--- a/dot_claude/settings.json
+++ b/dot_claude/settings.json
@@ -31,6 +31,149 @@
       }
     }
   },
+  "permissions": {
+    "allow": [
+      "Bash(rtk *)",
+
+      "Bash(ls *)", "Bash(ls)",
+      "Bash(ll *)", "Bash(ll)",
+      "Bash(la *)", "Bash(la)",
+      "Bash(eza *)",
+      "Bash(find *)",
+      "Bash(fd *)",
+      "Bash(pwd)",
+      "Bash(which *)",
+      "Bash(type *)",
+      "Bash(command -v *)",
+      "Bash(whereis *)",
+
+      "Bash(cat *)",
+      "Bash(bat *)",
+      "Bash(head *)",
+      "Bash(tail *)",
+      "Bash(less *)",
+      "Bash(wc *)",
+      "Bash(file *)",
+      "Bash(stat *)",
+
+      "Bash(grep *)",
+      "Bash(rg *)",
+      "Bash(ag *)",
+      "Bash(echo *)",
+      "Bash(printf *)",
+      "Bash(sed *)",
+      "Bash(awk *)",
+      "Bash(cut *)",
+      "Bash(sort *)",
+      "Bash(uniq *)",
+      "Bash(tr *)",
+      "Bash(jq *)",
+
+      "Bash(mkdir *)",
+      "Bash(touch *)",
+      "Bash(cp *)",
+      "Bash(mv *)",
+      "Bash(chmod *)",
+      "Bash(chown *)",
+      "Bash(ln *)",
+
+      "Bash(git status *)", "Bash(git status)",
+      "Bash(git log *)",
+      "Bash(git diff *)",
+      "Bash(git show *)",
+      "Bash(git branch *)",
+      "Bash(git remote *)",
+      "Bash(git stash *)",
+      "Bash(git tag *)",
+      "Bash(git add *)",
+      "Bash(git commit *)",
+      "Bash(git checkout *)",
+      "Bash(git switch *)",
+      "Bash(git restore *)",
+      "Bash(git fetch *)",
+      "Bash(git pull *)",
+      "Bash(git push *)",
+      "Bash(git mv *)",
+      "Bash(git rm *)",
+      "Bash(git config *)",
+      "Bash(git blame *)",
+      "Bash(git describe *)",
+      "Bash(git shortlog *)",
+
+      "Bash(chezmoi *)",
+
+      "Bash(npm *)",
+      "Bash(npx *)",
+      "Bash(yarn *)",
+      "Bash(pnpm *)",
+      "Bash(node *)",
+      "Bash(bun *)",
+
+      "Bash(bundle *)",
+      "Bash(gem *)",
+      "Bash(ruby *)",
+      "Bash(rbenv *)",
+      "Bash(rspec *)",
+      "Bash(rails *)",
+      "Bash(bin/rails *)",
+
+      "Bash(python *)",
+      "Bash(python3 *)",
+      "Bash(pip *)",
+      "Bash(pip3 *)",
+      "Bash(uv *)",
+      "Bash(pytest *)",
+      "Bash(poetry *)",
+
+      "Bash(cargo *)",
+      "Bash(rustc *)",
+      "Bash(rustup *)",
+      "Bash(go *)",
+      "Bash(make *)",
+
+      "Bash(date *)", "Bash(date)",
+      "Bash(uname *)",
+      "Bash(hostname *)",
+      "Bash(whoami)",
+      "Bash(id)",
+      "Bash(env)", "Bash(env *)",
+      "Bash(printenv *)",
+      "Bash(ps *)",
+      "Bash(df *)",
+      "Bash(du *)",
+      "Bash(free *)",
+      "Bash(uptime)",
+      "Bash(lsof *)",
+      "Bash(ss *)",
+      "Bash(ip *)",
+      "Bash(ping *)",
+      "Bash(curl *)",
+      "Bash(wget *)",
+      "Bash(ssh *)",
+      "Bash(ssh-keygen *)",
+
+      "Bash(pacman -Q*)",
+      "Bash(pacman -Si *)",
+      "Bash(pacman -Ss *)",
+      "Bash(paru -Q*)",
+      "Bash(systemctl status *)",
+      "Bash(journalctl *)",
+
+      "Bash(resticprofile *)",
+      "Bash(restic *)",
+      "Bash(rclone *)",
+      "Bash(age *)",
+
+      "Bash(docker ps *)", "Bash(docker ps)",
+      "Bash(docker images *)", "Bash(docker images)",
+      "Bash(docker logs *)",
+      "Bash(docker inspect *)",
+      "Bash(docker exec *)",
+      "Bash(kubectl get *)",
+      "Bash(kubectl describe *)",
+      "Bash(kubectl logs *)"
+    ]
+  },
   "language": "Russian",
   "effortLevel": "high",
   "remoteControlAtStartup": false,
diff --git a/dot_codex/rules/default.rules b/dot_codex/rules/default.rules
index 413c1bb..36c37ca 100644
--- a/dot_codex/rules/default.rules
+++ b/dot_codex/rules/default.rules
@@ -1,9 +1,135 @@
-prefix_rule(pattern=["chmod", "-R", "u+w"], decision="allow")
-prefix_rule(pattern=["sudo", "chown"], decision="allow")
-prefix_rule(pattern=["bin/rails", "db:migrate", "RAILS_ENV=development"], decision="allow")
-prefix_rule(pattern=["bundle", "exec", "rspec"], decision="allow")
-prefix_rule(pattern=["bin/rails", "runner", "p User.roles; p User.new(role: :student).available_roles; p User.new(role: :admin).available_roles", "RAILS_ENV=development"], decision="allow")
-prefix_rule(pattern=["bin/rails", "db:schema:load", "RAILS_ENV=test"], decision="allow")
-prefix_rule(pattern=["bin/rails", "db:migrate:status", "RAILS_ENV=development"], decision="allow")
-prefix_rule(pattern=["/usr/bin/zsh", "-lc", "UV_CACHE_DIR=/tmp/uv-cache rtk uv lock"], decision="allow")
-prefix_rule(pattern=["/usr/bin/zsh", "-lc", "UV_CACHE_DIR=/tmp/uv-cache rtk uv run python project_web/manage.py check"], decision="allow")
+# ── Навигация и чтение ─────────────────────────────────────────────────────
+prefix_rule(pattern=["ls"], decision="allow")
+prefix_rule(pattern=["ll"], decision="allow")
+prefix_rule(pattern=["la"], decision="allow")
+prefix_rule(pattern=["eza"], decision="allow")
+prefix_rule(pattern=["find"], decision="allow")
+prefix_rule(pattern=["fd"], decision="allow")
+prefix_rule(pattern=["pwd"], decision="allow")
+prefix_rule(pattern=["which"], decision="allow")
+prefix_rule(pattern=["type"], decision="allow")
+prefix_rule(pattern=["whereis"], decision="allow")
+prefix_rule(pattern=["cat"], decision="allow")
+prefix_rule(pattern=["bat"], decision="allow")
+prefix_rule(pattern=["head"], decision="allow")
+prefix_rule(pattern=["tail"], decision="allow")
+prefix_rule(pattern=["less"], decision="allow")
+prefix_rule(pattern=["wc"], decision="allow")
+prefix_rule(pattern=["file"], decision="allow")
+prefix_rule(pattern=["stat"], decision="allow")
+
+# ── Поиск и текст ───────────────────────────────────────────────────────────
+prefix_rule(pattern=["grep"], decision="allow")
+prefix_rule(pattern=["rg"], decision="allow")
+prefix_rule(pattern=["ag"], decision="allow")
+prefix_rule(pattern=["echo"], decision="allow")
+prefix_rule(pattern=["printf"], decision="allow")
+prefix_rule(pattern=["sed"], decision="allow")
+prefix_rule(pattern=["awk"], decision="allow")
+prefix_rule(pattern=["cut"], decision="allow")
+prefix_rule(pattern=["sort"], decision="allow")
+prefix_rule(pattern=["uniq"], decision="allow")
+prefix_rule(pattern=["tr"], decision="allow")
+prefix_rule(pattern=["jq"], decision="allow")
+prefix_rule(pattern=["diff"], decision="allow")
+
+# ── Файловые операции ───────────────────────────────────────────────────────
+prefix_rule(pattern=["mkdir"], decision="allow")
+prefix_rule(pattern=["touch"], decision="allow")
+prefix_rule(pattern=["cp"], decision="allow")
+prefix_rule(pattern=["mv"], decision="allow")
+prefix_rule(pattern=["chmod"], decision="allow")
+prefix_rule(pattern=["chown"], decision="allow")
+prefix_rule(pattern=["ln"], decision="allow")
+
+# ── Git ─────────────────────────────────────────────────────────────────────
+prefix_rule(pattern=["git"], decision="allow")
+
+# ── Chezmoi ─────────────────────────────────────────────────────────────────
+prefix_rule(pattern=["chezmoi"], decision="allow")
+
+# ── Node.js ─────────────────────────────────────────────────────────────────
+prefix_rule(pattern=["npm"], decision="allow")
+prefix_rule(pattern=["npx"], decision="allow")
+prefix_rule(pattern=["yarn"], decision="allow")
+prefix_rule(pattern=["pnpm"], decision="allow")
+prefix_rule(pattern=["node"], decision="allow")
+prefix_rule(pattern=["bun"], decision="allow")
+
+# ── Ruby ────────────────────────────────────────────────────────────────────
+prefix_rule(pattern=["bundle"], decision="allow")
+prefix_rule(pattern=["gem"], decision="allow")
+prefix_rule(pattern=["ruby"], decision="allow")
+prefix_rule(pattern=["rbenv"], decision="allow")
+prefix_rule(pattern=["rspec"], decision="allow")
+prefix_rule(pattern=["rails"], decision="allow")
+prefix_rule(pattern=["bin/rails"], decision="allow")
+
+# ── Python ──────────────────────────────────────────────────────────────────
+prefix_rule(pattern=["python"], decision="allow")
+prefix_rule(pattern=["python3"], decision="allow")
+prefix_rule(pattern=["pip"], decision="allow")
+prefix_rule(pattern=["pip3"], decision="allow")
+prefix_rule(pattern=["uv"], decision="allow")
+prefix_rule(pattern=["pytest"], decision="allow")
+prefix_rule(pattern=["poetry"], decision="allow")
+
+# ── Rust / Go / Make ────────────────────────────────────────────────────────
+prefix_rule(pattern=["cargo"], decision="allow")
+prefix_rule(pattern=["rustc"], decision="allow")
+prefix_rule(pattern=["rustup"], decision="allow")
+prefix_rule(pattern=["go"], decision="allow")
+prefix_rule(pattern=["make"], decision="allow")
+
+# ── Системная информация ────────────────────────────────────────────────────
+prefix_rule(pattern=["date"], decision="allow")
+prefix_rule(pattern=["uname"], decision="allow")
+prefix_rule(pattern=["hostname"], decision="allow")
+prefix_rule(pattern=["whoami"], decision="allow")
+prefix_rule(pattern=["id"], decision="allow")
+prefix_rule(pattern=["env"], decision="allow")
+prefix_rule(pattern=["printenv"], decision="allow")
+prefix_rule(pattern=["ps"], decision="allow")
+prefix_rule(pattern=["df"], decision="allow")
+prefix_rule(pattern=["du"], decision="allow")
+prefix_rule(pattern=["free"], decision="allow")
+prefix_rule(pattern=["uptime"], decision="allow")
+prefix_rule(pattern=["lsof"], decision="allow")
+prefix_rule(pattern=["ss"], decision="allow")
+prefix_rule(pattern=["ip"], decision="allow")
+prefix_rule(pattern=["ping"], decision="allow")
+prefix_rule(pattern=["curl"], decision="allow")
+prefix_rule(pattern=["wget"], decision="allow")
+prefix_rule(pattern=["ssh"], decision="allow")
+prefix_rule(pattern=["ssh-keygen"], decision="allow")
+
+# ── Пакетный менеджер (только чтение) ───────────────────────────────────────
+prefix_rule(pattern=["pacman", "-Q"], decision="allow")
+prefix_rule(pattern=["pacman", "-Si"], decision="allow")
+prefix_rule(pattern=["pacman", "-Ss"], decision="allow")
+prefix_rule(pattern=["paru", "-Q"], decision="allow")
+prefix_rule(pattern=["systemctl", "status"], decision="allow")
+prefix_rule(pattern=["journalctl"], decision="allow")
+
+# ── Инструменты ─────────────────────────────────────────────────────────────
+prefix_rule(pattern=["resticprofile"], decision="allow")
+prefix_rule(pattern=["restic"], decision="allow")
+prefix_rule(pattern=["rclone"], decision="allow")
+prefix_rule(pattern=["age"], decision="allow")
+prefix_rule(pattern=["rtk"], decision="allow")
+
+# ── Docker / Kubernetes (только чтение) ────────────────────────────────────
+prefix_rule(pattern=["docker", "ps"], decision="allow")
+prefix_rule(pattern=["docker", "images"], decision="allow")
+prefix_rule(pattern=["docker", "logs"], decision="allow")
+prefix_rule(pattern=["docker", "inspect"], decision="allow")
+prefix_rule(pattern=["docker", "exec"], decision="allow")
+prefix_rule(pattern=["kubectl", "get"], decision="allow")
+prefix_rule(pattern=["kubectl", "describe"], decision="allow")
+prefix_rule(pattern=["kubectl", "logs"], decision="allow")
+
+# ── Shell wrappers ──────────────────────────────────────────────────────────
+prefix_rule(pattern=["/usr/bin/zsh", "-lc"], decision="allow")
+prefix_rule(pattern=["/bin/zsh", "-lc"], decision="allow")
+prefix_rule(pattern=["/usr/bin/bash", "-c"], decision="allow")
+prefix_rule(pattern=["/bin/bash", "-c"], decision="allow")