Lucas WintherandClaude Opus 5.5
0ece4b3a2a
Root AGENTS.md is now the single source of truth for coding agents; CLAUDE.md, GEMINI.md and docs/CLAUDE.md are pointers. The product spec moves from docs/CLAUDE.md to PRODUCT.md, DESIGN.md records the shipped visual system, and docs/PERMISSIONS.md defines agent permission tiers rendered to .claude/, .codex/ and .gemini/. Adds docs/specs/ and docs/plans/, logs issues noticed (not fixed) in WorkBreakdown.md. Co-Authored-By: Claude Opus 5.5 <[email protected]>
24 lines
1.6 KiB
Plaintext
24 lines
1.6 KiB
Plaintext
# Rendered from docs/PERMISSIONS.md — change both in one commit.
|
|
# No allow rules on purpose: in Codex `allow` means "run outside the sandbox".
|
|
|
|
# Deny
|
|
prefix_rule(pattern = ["git", "push", ["--force", "-f", "--force-with-lease"]], decision = "forbidden",
|
|
justification = "Force-push rewrites shared history.")
|
|
prefix_rule(pattern = ["git", "reset", "--hard"], decision = "forbidden", justification = "Discards work.")
|
|
prefix_rule(pattern = ["git", "clean"], decision = "forbidden", justification = "Deletes untracked files.")
|
|
prefix_rule(pattern = ["git", "add", ["-f", "--force"]], decision = "forbidden",
|
|
justification = "Stages ignored files, e.g. secrets.")
|
|
prefix_rule(pattern = ["git", "commit", ["--no-verify", "-n"]], decision = "forbidden", justification = "Skips hooks.")
|
|
prefix_rule(pattern = ["rm", ["-r", "-R", "-rf", "-fr", "-Rf", "-fR", "--recursive"]], decision = "forbidden",
|
|
justification = "Recursive delete.")
|
|
prefix_rule(pattern = ["sudo"], decision = "forbidden", justification = "No privilege escalation.")
|
|
# Ask
|
|
prefix_rule(pattern = ["git", ["push", "merge", "rebase", "switch", "restore"]], decision = "prompt")
|
|
prefix_rule(pattern = ["git", "commit", "--amend"], decision = "prompt")
|
|
prefix_rule(pattern = ["rm"], decision = "prompt")
|
|
prefix_rule(pattern = ["bun", ["add", "remove", "update", "upgrade", "patch", "x"]], decision = "prompt")
|
|
prefix_rule(pattern = ["bunx"], decision = "prompt")
|
|
prefix_rule(pattern = ["docker"], decision = "prompt")
|
|
prefix_rule(pattern = ["pip", "install"], decision = "prompt")
|
|
prefix_rule(pattern = ["python3", "-m", "pip", "install"], decision = "prompt")
|