813bc46640
A WordPress-inspired CMS whose entire backend is PiCloud Rhai scripts deployed with pic apply, plus a SvelteKit frontend. Built to dogfood the project tool, CLI, and SDK; exercises docs/kv/files/users, docs+queue+cron +pubsub triggers, the transactional-outbox notification chain, a docs before-interceptor, set_if CAS, SSE, per-app CORS, env overlays, and a durable Workflow (validate -> enrich || seo -> publish -> finalize) started with workflow::start and polled with workflow::run_status, visualized live with Svelte Flow. FINDINGS.md / SECURITY.md capture every gap, surprise, and security issue found (each tagged [PiCloud] vs [CMS]); the platform fixes for the actionable ones ship in the preceding commit. Also folds in the read-only `pic` allowlist entries added to .claude/settings.json during the session (fewer-permission-prompts). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
229 lines
5.6 KiB
JSON
229 lines
5.6 KiB
JSON
{
|
|
"$schema": "https://json.schemastore.org/claude-code-settings.json",
|
|
"permissions": {
|
|
"allow": [
|
|
"Read",
|
|
"Edit",
|
|
"Write",
|
|
|
|
"Bash(cargo *)",
|
|
"Bash(rustc *)",
|
|
"Bash(rustup *)",
|
|
"Bash(rustfmt *)",
|
|
|
|
"Bash(npm *)",
|
|
"Bash(npx *)",
|
|
"Bash(node *)",
|
|
|
|
"Bash(git *)",
|
|
"Bash(gh *)",
|
|
|
|
"Bash(docker *)",
|
|
"Bash(docker compose *)",
|
|
|
|
"Bash(psql *)",
|
|
"Bash(pg_isready *)",
|
|
"Bash(pg_dump *)",
|
|
"Bash(pg_restore *)",
|
|
"Bash(createdb *)",
|
|
"Bash(dropdb *)",
|
|
|
|
"Bash(curl *)",
|
|
"Bash(wget *)",
|
|
"Bash(nc *)",
|
|
"Bash(ss *)",
|
|
"Bash(lsof *)",
|
|
"Bash(ping *)",
|
|
"Bash(dig *)",
|
|
"Bash(host *)",
|
|
|
|
"Bash(./target/debug/pic plan *)",
|
|
"Bash(./target/debug/pic config *)",
|
|
"Bash(./target/debug/pic whoami)",
|
|
"Bash(./target/debug/pic pull *)",
|
|
"Bash(./target/debug/pic apps domains ls *)",
|
|
"Bash(./target/debug/pic routes ls *)",
|
|
"Bash(./target/debug/pic kv get *)",
|
|
"Bash(./target/debug/pic kv ls *)",
|
|
"Bash(./target/debug/pic dead-letters ls *)",
|
|
"Bash(/home/fabi/PiCloud/target/debug/pic plan *)",
|
|
"Bash(/home/fabi/PiCloud/target/debug/pic config *)",
|
|
"Bash(/home/fabi/PiCloud/target/debug/pic whoami)",
|
|
"Bash(/home/fabi/PiCloud/target/debug/pic pull *)",
|
|
"Bash(/home/fabi/PiCloud/target/debug/pic apps domains ls *)",
|
|
"Bash(/home/fabi/PiCloud/target/debug/pic routes ls *)",
|
|
"Bash(/home/fabi/PiCloud/target/debug/pic kv get *)",
|
|
"Bash(/home/fabi/PiCloud/target/debug/pic kv ls *)",
|
|
"Bash(/home/fabi/PiCloud/target/debug/pic dead-letters ls *)",
|
|
|
|
"Bash(ls)",
|
|
"Bash(ls *)",
|
|
"Bash(pwd)",
|
|
"Bash(cd *)",
|
|
"Bash(find *)",
|
|
"Bash(grep *)",
|
|
"Bash(rg *)",
|
|
"Bash(fd *)",
|
|
"Bash(head *)",
|
|
"Bash(tail *)",
|
|
"Bash(wc *)",
|
|
"Bash(file *)",
|
|
"Bash(stat *)",
|
|
"Bash(du *)",
|
|
"Bash(df *)",
|
|
"Bash(tree *)",
|
|
"Bash(realpath *)",
|
|
"Bash(readlink *)",
|
|
"Bash(basename *)",
|
|
"Bash(dirname *)",
|
|
|
|
"Bash(mkdir *)",
|
|
"Bash(touch *)",
|
|
"Bash(cp *)",
|
|
"Bash(mv *)",
|
|
"Bash(ln *)",
|
|
"Bash(chmod *)",
|
|
"Bash(diff *)",
|
|
|
|
"Bash(echo *)",
|
|
"Bash(printf *)",
|
|
"Bash(jq *)",
|
|
"Bash(sed *)",
|
|
"Bash(awk *)",
|
|
"Bash(tr *)",
|
|
"Bash(cut *)",
|
|
"Bash(sort *)",
|
|
"Bash(uniq *)",
|
|
"Bash(xargs *)",
|
|
"Bash(tee *)",
|
|
|
|
"Bash(ps *)",
|
|
"Bash(pgrep *)",
|
|
"Bash(pkill *)",
|
|
"Bash(kill *)",
|
|
"Bash(sleep *)",
|
|
"Bash(timeout *)",
|
|
"Bash(time *)",
|
|
|
|
"Bash(env)",
|
|
"Bash(env *)",
|
|
"Bash(which *)",
|
|
"Bash(whoami)",
|
|
"Bash(hostname)",
|
|
"Bash(uname *)",
|
|
"Bash(date *)",
|
|
"Bash(true)",
|
|
"Bash(false)",
|
|
"Bash(set *)",
|
|
"Bash(export *)",
|
|
|
|
"Bash(python *)",
|
|
"Bash(python3 *)",
|
|
"Bash(pip *)",
|
|
"Bash(pip3 *)",
|
|
|
|
"Bash(tar *)",
|
|
"Bash(gzip *)",
|
|
"Bash(gunzip *)",
|
|
"Bash(zip *)",
|
|
"Bash(unzip *)",
|
|
"Bash(md5sum *)",
|
|
"Bash(sha256sum *)",
|
|
"Bash(openssl *)",
|
|
"Bash(base64 *)",
|
|
|
|
"Bash(PICLOUD_*)",
|
|
"Bash(POSTGRES_*)",
|
|
"Bash(DATABASE_URL=*)",
|
|
"Bash(RUST_LOG=*)",
|
|
"Bash(RUST_BACKTRACE=*)",
|
|
"Bash(PGPASSWORD=*)",
|
|
"Bash(PGHOST=*)",
|
|
"Bash(PGPORT=*)",
|
|
"Bash(PGUSER=*)",
|
|
"Bash(PGDATABASE=*)",
|
|
"Bash(NODE_ENV=*)",
|
|
"Bash(CI=*)",
|
|
"Bash(CARGO_*)",
|
|
|
|
"Bash(rm -rf target*)",
|
|
"Bash(rm -rf node_modules*)",
|
|
"Bash(rm -rf build*)",
|
|
"Bash(rm -rf .svelte-kit*)",
|
|
"Bash(rm -rf /tmp/picloud*)",
|
|
"Bash(rm /tmp/*)",
|
|
"Bash(rm -f /tmp/*)",
|
|
|
|
"Skill(simplify)",
|
|
"Skill(review)",
|
|
"Skill(security-review)",
|
|
"Skill(init)",
|
|
"Skill(update-config)",
|
|
"Skill(update-config:*)",
|
|
"Skill(fewer-permission-prompts)",
|
|
"Skill(claude-api)"
|
|
],
|
|
|
|
"deny": [
|
|
"Bash(git push --force *)",
|
|
"Bash(git push -f *)",
|
|
"Bash(git push --force-with-lease *)",
|
|
"Bash(git push origin main)",
|
|
"Bash(git push origin main *)",
|
|
"Bash(git push origin master)",
|
|
"Bash(git push origin master *)",
|
|
"Bash(git push origin :main)",
|
|
"Bash(git push origin :master)",
|
|
"Bash(git push --delete *)",
|
|
"Bash(git push --mirror *)",
|
|
"Bash(git branch -D *)",
|
|
"Bash(git branch --force *)",
|
|
"Bash(git reset --hard *)",
|
|
"Bash(git clean -fd*)",
|
|
"Bash(git clean -fx*)",
|
|
"Bash(git filter-branch *)",
|
|
"Bash(git update-ref -d *)",
|
|
"Bash(git remote remove *)",
|
|
|
|
"Bash(docker system prune *)",
|
|
"Bash(docker volume rm *)",
|
|
"Bash(docker volume prune *)",
|
|
"Bash(docker image prune -a*)",
|
|
"Bash(docker network prune *)",
|
|
"Bash(docker builder prune *)",
|
|
|
|
"Bash(rm -rf /)",
|
|
"Bash(rm -rf /bin*)",
|
|
"Bash(rm -rf /boot*)",
|
|
"Bash(rm -rf /dev*)",
|
|
"Bash(rm -rf /etc*)",
|
|
"Bash(rm -rf /lib*)",
|
|
"Bash(rm -rf /opt*)",
|
|
"Bash(rm -rf /proc*)",
|
|
"Bash(rm -rf /root*)",
|
|
"Bash(rm -rf /sbin*)",
|
|
"Bash(rm -rf /srv*)",
|
|
"Bash(rm -rf /sys*)",
|
|
"Bash(rm -rf /usr*)",
|
|
"Bash(rm -rf /var*)",
|
|
"Bash(rm -rf /home/fabi)",
|
|
"Bash(rm -rf /home/fabi/.*)",
|
|
"Bash(rm -rf ~)",
|
|
"Bash(rm -rf ~/.*)",
|
|
"Bash(rm -rf $HOME*)",
|
|
"Bash(rm -rf ${HOME}*)",
|
|
|
|
"Bash(chmod -R 777 *)",
|
|
"Bash(chown -R *)",
|
|
"Bash(dd if=*)",
|
|
"Bash(mkfs *)",
|
|
"Bash(mkfs.*)",
|
|
"Bash(sudo *)",
|
|
"Bash(su *)",
|
|
"Bash(su)",
|
|
"Bash(passwd *)",
|
|
"Bash(passwd)"
|
|
]
|
|
}
|
|
}
|