ddadminandClaude Opus 4.6
3c690bdb12
- Зачем:
- Codex-ревью выявило permission bypass через Bash(timeout *) и
сохраняющиеся safety prompts на $() и > в bash-командах.
- Что:
- permission сужен до Bash(timeout 600 codex exec *), rm-паттерны конкретизированы.
- REVIEW_ID использует $RANDOM для энтропии, resume пишет в файл вместо pipe.
- добавлен TODO в AGENTS.md: план замены bash-паттернов на нативные инструменты.
- Проверка:
- /codex-review при следующем использовании.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
123 lines
2.9 KiB
JSON
123 lines
2.9 KiB
JSON
{
|
|
"permissions": {
|
|
"allow": [
|
|
"Bash(cat *)",
|
|
"Bash(ls)",
|
|
"Bash(ls *)",
|
|
"Bash(wc *)",
|
|
"Bash(head *)",
|
|
"Bash(tail *)",
|
|
"Bash(find *)",
|
|
"Bash(tree)",
|
|
"Bash(tree *)",
|
|
"Bash(file *)",
|
|
"Bash(stat *)",
|
|
"Bash(diff *)",
|
|
"Bash(realpath *)",
|
|
"Bash(readlink *)",
|
|
"Bash(basename *)",
|
|
"Bash(dirname *)",
|
|
"Bash(sort *)",
|
|
"Bash(uniq *)",
|
|
"Bash(cut *)",
|
|
"Bash(awk *)",
|
|
"Bash(sed *)",
|
|
"Bash(grep *)",
|
|
"Bash(rg *)",
|
|
"Bash(jq *)",
|
|
"Bash(yq *)",
|
|
"Bash(tr *)",
|
|
"Bash(echo *)",
|
|
"Bash(printf *)",
|
|
"Bash(which *)",
|
|
"Bash(type *)",
|
|
"Bash(command -v *)",
|
|
"Bash(env)",
|
|
"Bash(env *)",
|
|
"Bash(printenv)",
|
|
"Bash(printenv *)",
|
|
"Bash(pwd)",
|
|
"Bash(uname *)",
|
|
"Bash(whoami)",
|
|
"Bash(id)",
|
|
"Bash(date)",
|
|
"Bash(date *)",
|
|
"Bash(hostname)",
|
|
"Bash(git log*)",
|
|
"Bash(git diff*)",
|
|
"Bash(git status*)",
|
|
"Bash(git show*)",
|
|
"Bash(git branch*)",
|
|
"Bash(git remote -v*)",
|
|
"Bash(git remote show*)",
|
|
"Bash(git tag*)",
|
|
"Bash(git stash list*)",
|
|
"Bash(git rev-parse*)",
|
|
"Bash(git ls-files*)",
|
|
"Bash(git blame*)",
|
|
"Bash(git shortlog*)",
|
|
"Bash(git config --get*)",
|
|
"Bash(git config --list*)",
|
|
"Bash(git fetch*)",
|
|
"Bash(git add*)",
|
|
"Bash(docker ps*)",
|
|
"Bash(docker logs*)",
|
|
"Bash(docker inspect*)",
|
|
"Bash(docker images*)",
|
|
"Bash(docker stats*)",
|
|
"Bash(docker info*)",
|
|
"Bash(docker version*)",
|
|
"Bash(docker compose ps*)",
|
|
"Bash(docker compose logs*)",
|
|
"Bash(docker compose:*)",
|
|
"Bash(docker restart:*)",
|
|
"Bash(docker exec:*)",
|
|
"Bash(docker run:*)",
|
|
"Bash(docker stop:*)",
|
|
"Bash(docker rm:*)",
|
|
"Bash(curl *)",
|
|
"Bash(wget *)",
|
|
"Bash(mkdir *)",
|
|
"Bash(cp *)",
|
|
"Bash(mv *)",
|
|
"Bash(touch *)",
|
|
"Bash(chmod *)",
|
|
"Bash(ln *)",
|
|
"Bash(npm *)",
|
|
"Bash(npx *)",
|
|
"Bash(yarn *)",
|
|
"Bash(pnpm *)",
|
|
"Bash(bun *)",
|
|
"Bash(go *)",
|
|
"Bash(cargo *)",
|
|
"Bash(make *)",
|
|
"Bash(python *)",
|
|
"Bash(python3 *)",
|
|
"Bash(pip *)",
|
|
"Bash(pip3 *)",
|
|
"Bash(pytest *)",
|
|
"Bash(node *)",
|
|
"Bash(deno *)",
|
|
"Bash(stow *)",
|
|
"Bash(gh api:*)",
|
|
"Bash(gh search:*)",
|
|
"Bash(gh issue:*)",
|
|
"Bash(gh repo:*)",
|
|
"Bash(codex *)",
|
|
"Bash(timeout 600 codex exec *)",
|
|
"Bash(rm -f /tmp/claude-diff-*)",
|
|
"Bash(rm -f /tmp/claude-plan-*)",
|
|
"Bash(rm -f /tmp/codex-review-*)",
|
|
"WebSearch",
|
|
"mcp__claude_ai_Context7__resolve-library-id",
|
|
"Write(/tmp/claude-plan-*)",
|
|
"Write(/tmp/claude-diff-*)",
|
|
"Write(/tmp/codex-review-*)"
|
|
]
|
|
},
|
|
"statusLine": {
|
|
"type": "command",
|
|
"command": "bash ~/.claude/statusline-command.sh"
|
|
}
|
|
}
|