gongzhiyong
8ab440154b
Adds to permissions.allow: - ssh, scp, sftp (remote exec + file transfer) - ssh-add, ssh-keygen, ssh-copy-id (key management) - rsync (fast file sync) No Dockerfile change -> no rebuild needed; settings.json is bind-mounted into the container. After git pull, /exit + restart claude to reload.
538 lines
16 KiB
JSON
538 lines
16 KiB
JSON
{
|
|
"$schema": "https://json.schemastore.org/claude-code-settings.json",
|
|
"permissions": {
|
|
"allow": [
|
|
"Bash(ssh:*)",
|
|
"Bash(scp:*)",
|
|
"Bash(sftp:*)",
|
|
"Bash(ssh-add:*)",
|
|
"Bash(ssh-keygen:*)",
|
|
"Bash(ssh-copy-id:*)",
|
|
"Bash(rsync:*)",
|
|
"Bash(git status*)",
|
|
"Bash(git diff*)",
|
|
"Bash(git log*)",
|
|
"Bash(git show*)",
|
|
"Bash(git branch*)",
|
|
"Bash(git rev-parse*)",
|
|
"Bash(git blame*)",
|
|
"Bash(git ls-files*)",
|
|
"Bash(git config --get*)",
|
|
"Bash(git remote -v)",
|
|
"Bash(git remote show*)",
|
|
"Bash(git shortlog*)",
|
|
"Bash(git reflog*)",
|
|
"Bash(git checkout*)",
|
|
"Bash(git switch*)",
|
|
"Bash(git add*)",
|
|
"Bash(git commit*)",
|
|
"Bash(git pull*)",
|
|
"Bash(git fetch*)",
|
|
"Bash(git stash*)",
|
|
"Bash(git push origin*)",
|
|
"Bash(git cherry-pick*)",
|
|
"Bash(git restore*)",
|
|
"Bash(git tag*)",
|
|
"Bash(git cherry-pick --abort)",
|
|
"Bash(git merge --abort)",
|
|
"Bash(git rebase --abort)",
|
|
|
|
"Bash(gh auth status*)",
|
|
"Bash(gh pr view*)",
|
|
"Bash(gh pr list*)",
|
|
"Bash(gh pr diff*)",
|
|
"Bash(gh pr checks*)",
|
|
"Bash(gh pr status*)",
|
|
"Bash(gh pr create*)",
|
|
"Bash(gh pr comment*)",
|
|
"Bash(gh pr checkout*)",
|
|
"Bash(gh pr ready*)",
|
|
"Bash(gh pr edit*)",
|
|
"Bash(gh pr review --comment*)",
|
|
"Bash(gh issue view*)",
|
|
"Bash(gh issue list*)",
|
|
"Bash(gh issue create*)",
|
|
"Bash(gh issue comment*)",
|
|
"Bash(gh issue edit*)",
|
|
"Bash(gh issue close*)",
|
|
"Bash(gh issue reopen*)",
|
|
"Bash(gh run view*)",
|
|
"Bash(gh run list*)",
|
|
"Bash(gh run watch*)",
|
|
"Bash(gh run download*)",
|
|
"Bash(gh workflow view*)",
|
|
"Bash(gh workflow list*)",
|
|
"Bash(gh workflow run*)",
|
|
"Bash(gh repo view*)",
|
|
"Bash(gh repo list*)",
|
|
"Bash(gh repo clone*)",
|
|
"Bash(gh release view*)",
|
|
"Bash(gh release list*)",
|
|
"Bash(gh release download*)",
|
|
"Bash(gh api*)",
|
|
"Bash(gh secret list*)",
|
|
"Bash(gh label list*)",
|
|
"Bash(gh variable list*)",
|
|
"Bash(gh browse*)",
|
|
|
|
"Bash(az --version)",
|
|
"Bash(az --help*)",
|
|
"Bash(az account show*)",
|
|
"Bash(az account list*)",
|
|
"Bash(az account get-access-token*)",
|
|
"Bash(az group list*)",
|
|
"Bash(az group show*)",
|
|
"Bash(az containerapp list*)",
|
|
"Bash(az containerapp show*)",
|
|
"Bash(az containerapp logs show*)",
|
|
"Bash(az containerapp logs tail*)",
|
|
"Bash(az containerapp revision list*)",
|
|
"Bash(az containerapp revision show*)",
|
|
"Bash(az containerapp ingress show*)",
|
|
"Bash(az containerapp ingress cors show*)",
|
|
"Bash(az containerapp identity show*)",
|
|
"Bash(az containerapp env show*)",
|
|
"Bash(az containerapp env list*)",
|
|
"Bash(az containerapp env logs show*)",
|
|
"Bash(az containerapp job list*)",
|
|
"Bash(az containerapp job show*)",
|
|
"Bash(az containerapp job execution list*)",
|
|
"Bash(az containerapp job execution show*)",
|
|
"Bash(az containerapp replica list*)",
|
|
"Bash(az containerapp replica show*)",
|
|
"Bash(az keyvault list*)",
|
|
"Bash(az keyvault show*)",
|
|
"Bash(az keyvault secret list*)",
|
|
"Bash(az keyvault secret show*)",
|
|
"Bash(az keyvault secret list-versions*)",
|
|
"Bash(az keyvault key list*)",
|
|
"Bash(az keyvault key show*)",
|
|
"Bash(az keyvault certificate list*)",
|
|
"Bash(az keyvault certificate show*)",
|
|
"Bash(az acr list*)",
|
|
"Bash(az acr show*)",
|
|
"Bash(az acr repository list*)",
|
|
"Bash(az acr repository show*)",
|
|
"Bash(az acr repository show-tags*)",
|
|
"Bash(az acr repository show-manifests*)",
|
|
"Bash(az acr manifest list*)",
|
|
"Bash(az acr manifest show*)",
|
|
"Bash(az acr task list*)",
|
|
"Bash(az acr task show*)",
|
|
"Bash(az acr task show-run*)",
|
|
"Bash(az postgres server show*)",
|
|
"Bash(az postgres server list*)",
|
|
"Bash(az postgres flexible-server show*)",
|
|
"Bash(az postgres flexible-server list*)",
|
|
"Bash(az postgres flexible-server db list*)",
|
|
"Bash(az postgres flexible-server db show*)",
|
|
"Bash(az postgres flexible-server parameter show*)",
|
|
"Bash(az postgres flexible-server parameter list*)",
|
|
"Bash(az redis show*)",
|
|
"Bash(az redis list*)",
|
|
"Bash(az storage account show*)",
|
|
"Bash(az storage account list*)",
|
|
"Bash(az storage account show-connection-string*)",
|
|
"Bash(az storage blob list*)",
|
|
"Bash(az storage blob show*)",
|
|
"Bash(az storage container list*)",
|
|
"Bash(az storage container show*)",
|
|
"Bash(az staticwebapp list*)",
|
|
"Bash(az staticwebapp show*)",
|
|
"Bash(az staticwebapp environment list*)",
|
|
"Bash(az staticwebapp hostname list*)",
|
|
"Bash(az monitor metrics list*)",
|
|
"Bash(az monitor log-analytics workspace show*)",
|
|
"Bash(az monitor log-analytics query*)",
|
|
"Bash(az monitor alert list*)",
|
|
"Bash(az monitor activity-log list*)",
|
|
"Bash(az monitor diagnostic-settings list*)",
|
|
"Bash(az monitor diagnostic-settings show*)",
|
|
"Bash(az deployment group list*)",
|
|
"Bash(az deployment group show*)",
|
|
"Bash(az deployment sub list*)",
|
|
"Bash(az deployment sub show*)",
|
|
"Bash(az deployment operation group list*)",
|
|
"Bash(az deployment group what-if*)",
|
|
"Bash(az deployment sub what-if*)",
|
|
"Bash(az resource list*)",
|
|
"Bash(az resource show*)",
|
|
"Bash(az role assignment list*)",
|
|
"Bash(az role assignment show*)",
|
|
"Bash(az role definition list*)",
|
|
"Bash(az identity list*)",
|
|
"Bash(az identity show*)",
|
|
"Bash(az network vnet list*)",
|
|
"Bash(az network vnet show*)",
|
|
"Bash(az network private-endpoint list*)",
|
|
"Bash(az network private-endpoint show*)",
|
|
"Bash(az network nsg list*)",
|
|
"Bash(az network nsg show*)",
|
|
"Bash(az network public-ip list*)",
|
|
"Bash(az bicep build*)",
|
|
"Bash(az bicep decompile*)",
|
|
"Bash(az bicep version*)",
|
|
"Bash(az servicebus*show*)",
|
|
"Bash(az servicebus*list*)",
|
|
"Bash(az ad user show*)",
|
|
"Bash(az ad user list*)",
|
|
"Bash(az ad app show*)",
|
|
"Bash(az ad app list*)",
|
|
"Bash(az ad sp show*)",
|
|
"Bash(az ad sp list*)",
|
|
|
|
"Bash(npm install*)",
|
|
"Bash(npm ci*)",
|
|
"Bash(npm test*)",
|
|
"Bash(npm run*)",
|
|
"Bash(npm audit*)",
|
|
"Bash(npm outdated*)",
|
|
"Bash(npm list*)",
|
|
"Bash(npm view*)",
|
|
"Bash(pnpm install*)",
|
|
"Bash(pnpm run*)",
|
|
"Bash(pnpm test*)",
|
|
"Bash(pnpm list*)",
|
|
"Bash(pnpm outdated*)",
|
|
"Bash(pnpm audit*)",
|
|
"Bash(bun install*)",
|
|
"Bash(bun test*)",
|
|
"Bash(bun run*)",
|
|
"Bash(yarn*)",
|
|
"Bash(pip install*)",
|
|
"Bash(pip list*)",
|
|
"Bash(pip show*)",
|
|
"Bash(pip check*)",
|
|
"Bash(uv pip*)",
|
|
"Bash(uv run*)",
|
|
"Bash(uv sync*)",
|
|
"Bash(pytest*)",
|
|
"Bash(ruff*)",
|
|
"Bash(black*)",
|
|
"Bash(mypy*)",
|
|
"Bash(isort*)",
|
|
"Bash(flake8*)",
|
|
"Bash(pip-audit*)",
|
|
"Bash(alembic current*)",
|
|
"Bash(alembic heads*)",
|
|
"Bash(alembic history*)",
|
|
"Bash(alembic upgrade*)",
|
|
"Bash(alembic check*)",
|
|
"Bash(alembic revision --autogenerate*)",
|
|
"Bash(prisma validate*)",
|
|
"Bash(prisma migrate status*)",
|
|
"Bash(prisma migrate diff*)",
|
|
"Bash(prisma migrate dev*)",
|
|
"Bash(prisma migrate deploy*)",
|
|
"Bash(prisma generate*)",
|
|
"Bash(npx prisma*)",
|
|
"Bash(go build*)",
|
|
"Bash(go test*)",
|
|
"Bash(go vet*)",
|
|
"Bash(go fmt*)",
|
|
"Bash(go mod*)",
|
|
"Bash(go list*)",
|
|
"Bash(go version*)",
|
|
"Bash(go install*)",
|
|
"Bash(golangci-lint*)",
|
|
"Bash(govulncheck*)",
|
|
"Bash(make*)",
|
|
|
|
"Bash(docker compose build*)",
|
|
"Bash(docker compose config*)",
|
|
"Bash(docker compose ps*)",
|
|
"Bash(docker compose logs*)",
|
|
"Bash(docker compose exec*)",
|
|
"Bash(docker images*)",
|
|
"Bash(docker ps*)",
|
|
"Bash(docker inspect*)",
|
|
"Bash(docker logs*)",
|
|
"Bash(docker version*)",
|
|
"Bash(docker info*)",
|
|
|
|
"Bash(kubectl get*)",
|
|
"Bash(kubectl describe*)",
|
|
"Bash(kubectl logs*)",
|
|
"Bash(kubectl top*)",
|
|
"Bash(kubectl version*)",
|
|
"Bash(kubectl config get-contexts*)",
|
|
"Bash(kubectl config view*)",
|
|
|
|
"Bash(rg*)",
|
|
"Bash(fd*)",
|
|
"Bash(jq*)",
|
|
"Bash(yq*)",
|
|
"Bash(ls*)",
|
|
"Bash(cat*)",
|
|
"Bash(head*)",
|
|
"Bash(tail*)",
|
|
"Bash(wc*)",
|
|
"Bash(file*)",
|
|
"Bash(stat*)",
|
|
"Bash(du*)",
|
|
"Bash(df*)",
|
|
"Bash(find*)",
|
|
"Bash(which*)",
|
|
"Bash(whereis*)",
|
|
"Bash(type*)",
|
|
"Bash(env)",
|
|
"Bash(pwd)",
|
|
"Bash(date*)",
|
|
"Bash(echo*)",
|
|
"Bash(printf*)",
|
|
"Bash(uname*)",
|
|
"Bash(hostname*)",
|
|
"Bash(id*)",
|
|
"Bash(groups*)",
|
|
"Bash(ps*)",
|
|
"Bash(top -b*)",
|
|
"Bash(free*)",
|
|
"Bash(uptime*)",
|
|
|
|
"Bash(curl -s*)",
|
|
"Bash(curl -sL*)",
|
|
"Bash(curl -sI*)",
|
|
"Bash(curl -I*)",
|
|
"Bash(curl -o*)",
|
|
"Bash(curl --silent*)",
|
|
"Bash(curl --fail*)",
|
|
"Bash(wget -O*)",
|
|
"Bash(wget --quiet*)",
|
|
"Bash(grep*)",
|
|
"Bash(awk*)",
|
|
"Bash(sed -n*)",
|
|
"Bash(sort*)",
|
|
"Bash(uniq*)",
|
|
"Bash(cut*)",
|
|
"Bash(tr*)",
|
|
"Bash(xargs*)",
|
|
"Bash(tee*)",
|
|
"Bash(column*)",
|
|
"Bash(base64*)",
|
|
"Bash(md5sum*)",
|
|
"Bash(sha256sum*)",
|
|
|
|
"Bash(psql -c \\dt*)",
|
|
"Bash(psql -c \\dn*)",
|
|
"Bash(psql -c \\l*)",
|
|
"Bash(psql -c SELECT*)",
|
|
"Bash(redis-cli INFO*)",
|
|
"Bash(redis-cli DBSIZE*)",
|
|
"Bash(redis-cli KEYS*)",
|
|
"Bash(redis-cli GET*)",
|
|
"Bash(redis-cli TYPE*)",
|
|
"Bash(redis-cli PING*)"
|
|
],
|
|
"deny": [
|
|
"Bash(git push --force*)",
|
|
"Bash(git push -f*)",
|
|
"Bash(git push origin main*)",
|
|
"Bash(git push origin master*)",
|
|
"Bash(git clean -fdx*)",
|
|
"Bash(git commit --amend*)",
|
|
"Bash(git filter-branch*)",
|
|
"Bash(git filter-repo*)",
|
|
"Bash(git branch -D*)",
|
|
"Bash(git tag -d*)",
|
|
"Bash(git push*--delete*)",
|
|
|
|
"Bash(rm -rf /*)",
|
|
"Bash(rm -rf ~*)",
|
|
"Bash(rm -rf ~/*)",
|
|
"Bash(rm -rf /Volumes/*)",
|
|
"Bash(sudo*)",
|
|
"Bash(su*)",
|
|
"Bash(chmod 777*)",
|
|
"Bash(chown*)",
|
|
|
|
"Bash(docker system prune*)",
|
|
"Bash(docker volume rm*)",
|
|
"Bash(docker volume prune*)",
|
|
"Bash(docker image prune*)",
|
|
"Bash(docker rm*)",
|
|
"Bash(docker rmi*)",
|
|
|
|
"Bash(az login*)",
|
|
"Bash(az logout*)",
|
|
"Bash(az account set*)",
|
|
"Bash(az containerapp update*)",
|
|
"Bash(az containerapp create*)",
|
|
"Bash(az containerapp delete*)",
|
|
"Bash(az containerapp restart*)",
|
|
"Bash(az containerapp revision set-mode*)",
|
|
"Bash(az containerapp revision activate*)",
|
|
"Bash(az containerapp revision deactivate*)",
|
|
"Bash(az containerapp revision restart*)",
|
|
"Bash(az containerapp ingress update*)",
|
|
"Bash(az containerapp ingress cors update*)",
|
|
"Bash(az containerapp identity assign*)",
|
|
"Bash(az containerapp identity remove*)",
|
|
"Bash(az containerapp env create*)",
|
|
"Bash(az containerapp env update*)",
|
|
"Bash(az containerapp env delete*)",
|
|
"Bash(az containerapp job create*)",
|
|
"Bash(az containerapp job update*)",
|
|
"Bash(az containerapp job delete*)",
|
|
"Bash(az containerapp job start*)",
|
|
"Bash(az containerapp job stop*)",
|
|
"Bash(az deployment group create*)",
|
|
"Bash(az deployment group delete*)",
|
|
"Bash(az deployment sub create*)",
|
|
"Bash(az deployment sub delete*)",
|
|
"Bash(az keyvault create*)",
|
|
"Bash(az keyvault update*)",
|
|
"Bash(az keyvault delete*)",
|
|
"Bash(az keyvault secret set*)",
|
|
"Bash(az keyvault secret delete*)",
|
|
"Bash(az keyvault secret restore*)",
|
|
"Bash(az keyvault key create*)",
|
|
"Bash(az keyvault key delete*)",
|
|
"Bash(az keyvault key restore*)",
|
|
"Bash(az keyvault certificate create*)",
|
|
"Bash(az keyvault certificate delete*)",
|
|
"Bash(az acr create*)",
|
|
"Bash(az acr delete*)",
|
|
"Bash(az acr update*)",
|
|
"Bash(az acr login*)",
|
|
"Bash(az acr import*)",
|
|
"Bash(az acr build*)",
|
|
"Bash(az acr task create*)",
|
|
"Bash(az acr task update*)",
|
|
"Bash(az acr task delete*)",
|
|
"Bash(az acr task run*)",
|
|
"Bash(az acr repository delete*)",
|
|
"Bash(az acr repository untag*)",
|
|
"Bash(az postgres server create*)",
|
|
"Bash(az postgres server delete*)",
|
|
"Bash(az postgres server update*)",
|
|
"Bash(az postgres server restart*)",
|
|
"Bash(az postgres flexible-server create*)",
|
|
"Bash(az postgres flexible-server delete*)",
|
|
"Bash(az postgres flexible-server update*)",
|
|
"Bash(az postgres flexible-server restart*)",
|
|
"Bash(az postgres flexible-server start*)",
|
|
"Bash(az postgres flexible-server stop*)",
|
|
"Bash(az postgres flexible-server db create*)",
|
|
"Bash(az postgres flexible-server db delete*)",
|
|
"Bash(az redis create*)",
|
|
"Bash(az redis delete*)",
|
|
"Bash(az redis update*)",
|
|
"Bash(az redis regenerate-keys*)",
|
|
"Bash(az storage account create*)",
|
|
"Bash(az storage account delete*)",
|
|
"Bash(az storage account update*)",
|
|
"Bash(az storage blob upload*)",
|
|
"Bash(az storage blob delete*)",
|
|
"Bash(az storage blob copy*)",
|
|
"Bash(az storage container create*)",
|
|
"Bash(az storage container delete*)",
|
|
"Bash(az staticwebapp create*)",
|
|
"Bash(az staticwebapp delete*)",
|
|
"Bash(az staticwebapp update*)",
|
|
"Bash(az group create*)",
|
|
"Bash(az group delete*)",
|
|
"Bash(az group update*)",
|
|
"Bash(az resource create*)",
|
|
"Bash(az resource delete*)",
|
|
"Bash(az resource update*)",
|
|
"Bash(az resource move*)",
|
|
"Bash(az role assignment create*)",
|
|
"Bash(az role assignment delete*)",
|
|
"Bash(az identity create*)",
|
|
"Bash(az identity delete*)",
|
|
"Bash(az network vnet create*)",
|
|
"Bash(az network vnet delete*)",
|
|
"Bash(az network vnet update*)",
|
|
"Bash(az network nsg rule create*)",
|
|
"Bash(az network nsg rule delete*)",
|
|
|
|
"Bash(gh pr merge*)",
|
|
"Bash(gh pr close*)",
|
|
"Bash(gh pr review --approve*)",
|
|
"Bash(gh pr review --request-changes*)",
|
|
"Bash(gh release create*)",
|
|
"Bash(gh release delete*)",
|
|
"Bash(gh release edit*)",
|
|
"Bash(gh repo delete*)",
|
|
"Bash(gh repo archive*)",
|
|
"Bash(gh repo create*)",
|
|
"Bash(gh repo rename*)",
|
|
"Bash(gh repo transfer*)",
|
|
"Bash(gh secret set*)",
|
|
"Bash(gh secret delete*)",
|
|
"Bash(gh variable set*)",
|
|
"Bash(gh variable delete*)",
|
|
"Bash(gh workflow disable*)",
|
|
"Bash(gh workflow enable*)",
|
|
"Bash(gh label create*)",
|
|
"Bash(gh label delete*)",
|
|
"Bash(gh label edit*)",
|
|
|
|
"Bash(terraform destroy*)",
|
|
"Bash(terraform apply*)",
|
|
"Bash(terraform taint*)",
|
|
"Bash(terraform import*)",
|
|
|
|
"Bash(kubectl delete*)",
|
|
"Bash(kubectl apply*)",
|
|
"Bash(kubectl create*)",
|
|
"Bash(kubectl edit*)",
|
|
"Bash(kubectl patch*)",
|
|
"Bash(kubectl replace*)",
|
|
"Bash(kubectl scale*)",
|
|
"Bash(kubectl rollout*)",
|
|
"Bash(kubectl exec*)",
|
|
"Bash(kubectl cp*)",
|
|
|
|
"Bash(alembic downgrade*)",
|
|
"Bash(dropdb*)",
|
|
"Bash(createdb*)",
|
|
"Bash(pg_dump --clean*)",
|
|
"Bash(psql*DROP*)",
|
|
"Bash(psql*DELETE FROM*)",
|
|
"Bash(psql*TRUNCATE*)",
|
|
"Bash(psql*UPDATE*)",
|
|
"Bash(psql*production*)",
|
|
"Bash(redis-cli FLUSHDB*)",
|
|
"Bash(redis-cli FLUSHALL*)",
|
|
"Bash(redis-cli CONFIG*)",
|
|
"Bash(redis-cli DEBUG*)",
|
|
"Bash(redis-cli SHUTDOWN*)",
|
|
|
|
"Bash(ssh*)",
|
|
"Bash(scp*)",
|
|
"Bash(rsync --delete*)",
|
|
|
|
"Read(./**/.env)",
|
|
"Read(./**/.env.local)",
|
|
"Read(./**/.env.production)",
|
|
"Read(./**/.env.development)",
|
|
"Read(./**/secrets/**)",
|
|
"Read(./**/*.pem)",
|
|
"Read(./**/*.key)",
|
|
"Read(./casdoor-internal/conf/app.conf)",
|
|
"Write(./**/.env)",
|
|
"Write(./**/.env.local)",
|
|
"Write(./**/.env.production)",
|
|
"Write(./**/secrets/**)"
|
|
]
|
|
},
|
|
"env": {
|
|
"DISABLE_TELEMETRY": "0",
|
|
"CLAUDE_CODE_MAX_OUTPUT_TOKENS": "32000"
|
|
},
|
|
"hooks": {
|
|
"PreToolUse": [
|
|
{
|
|
"matcher": "Bash",
|
|
"hooks": [
|
|
{
|
|
"type": "command",
|
|
"command": "bash $CLAUDE_PROJECT_DIR/.claude/hooks/pre-commit-check.sh"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|