64 lines
5.7 KiB
JSON
64 lines
5.7 KiB
JSON
{
|
|
"enabledPlugins": {
|
|
"rust-analyzer-lsp@claude-plugins-official": true
|
|
},
|
|
"permissions": {
|
|
"defaultMode": "auto"
|
|
},
|
|
"tui": "fullscreen",
|
|
"theme": "dark",
|
|
"autoMode": {
|
|
"soft_deny": [
|
|
"$defaults",
|
|
"Bash(podman rm:*) in /home/connor/projects/runway \u2014 destructive container removal",
|
|
"Bash(rm -rf:*) targeting baikal test containers in crates/runway-caldav/tests/baikal",
|
|
"Bash(podman rm -f:*) \u2014 destructive podman container removal, frequently used CLI in this environment",
|
|
"Bash(rm -rf ~/.env*) \u2014 sensitive credential files (.env, .env.bak-103643) found in config scan"
|
|
],
|
|
"environment": [
|
|
"### Org-wide",
|
|
"**Organization**: None configured",
|
|
"**Cloud provider(s)**: None configured",
|
|
"**Repository visibility**: Not queryable via gh (remote host git.rcjohnstone.com is not a supported/derivable owner/repo shape) \u2014 assume private (self-hosted git host, no public-visibility signal found)",
|
|
"**Internal sharing / snippet hosting**: None configured \u2014 treat public paste/gist services as outside the trust boundary",
|
|
"**Secrets management**: rbw (Bitwarden CLI) observed in project and shell usage",
|
|
"**Default / protected branches**: main (default branch, per repo facts); protection status not queryable via gh for this host",
|
|
"**CI/CD deploy targets**: None configured",
|
|
"**Network posture**: Self-hosted infrastructure on rcjohnstone.com domain and local network (10.x addresses observed); no cloud provider signals",
|
|
"**Source control**: ssh://git.rcjohnstone.com:2222/connor/runway.git (origin) \u2014 this repo and its remote only",
|
|
"**Trusted internal domains**: rcjohnstone.com (baikal.rcjohnstone.com, runway.rcjohnstone.com, auth.rcjohnstone.com, jellyfin.rcjohnstone.com, git.rcjohnstone.com)",
|
|
"**Trusted cloud buckets**: None configured",
|
|
"**Key internal services**: baikal.rcjohnstone.com (CalDAV test server), runway-backend (container/service host), immich.rcjohnstone.com, jellyfin.rcjohnstone.com, auth.rcjohnstone.com",
|
|
"**Internal package registry**: None configured",
|
|
"**Sensitive data locations & audiences**: .env / .env.local files (gitignored); any file or store holding personal data, confidential business data, credentials, regulated data, or similarly sensitive material \u2014 share only with audiences cleared at the named+specifics bar",
|
|
"**Data retention / declassification**: None configured",
|
|
"**Sensitive remote targets**: any namespace, host, or container whose name carries `prod` or `production` as a whole word or name segment",
|
|
"**Protected deployment namespaces / environments**: None configured \u2014 fall back to the Sensitive remote targets heuristic",
|
|
"**Protected IaC scopes**: IAM, RBAC, networking, quota, and node-pool resources; anything whose name or tag carries `prod` or `production` as a whole word or name segment",
|
|
"**Repository visibility**: assume private unless the remote host and repo name indicate otherwise, or a visibility check in the transcript shows public",
|
|
"**Secrets management**: rbw (Bitwarden CLI) used routinely in shell history and project transcripts",
|
|
"**Default / protected branches**: not queryable \u2014 repo has no configured remote",
|
|
"**Network posture**: home-lab/self-hosted services under rcjohnstone.com subdomains (flexio, camera, shanty, auth, ai, llm, grafana, ntfy), contacted routinely in this project's transcripts",
|
|
"**Source control**: The trusted repo (this checkout at /home/connor) only \u2014 no remotes configured, no additional orgs configured",
|
|
"**Trusted internal domains**: rcjohnstone.com and its subdomains (flexio., camera., shanty., auth., ai., llm., grafana., ntfy.) \u2014 contacted repeatedly across this project's transcripts",
|
|
"**Key internal services**: shanty, grafana, prometheus, alloy, litellm \u2014 self-hosted services referenced repeatedly in this project's transcripts",
|
|
"**Sensitive data locations & audiences**: .env and .env.bak-103643 (credential-bearing files found in config scan); rbw (password manager) vault contents; preserve exact handles when known and share only with audiences cleared at the [named+specifics] bar",
|
|
"**Sensitive remote targets**: any namespace, host, or container whose name carries `prod` or `production` as a whole word or name segment (hyphen/underscore/dot-delimited)",
|
|
"### User-specific",
|
|
"**Primary use of Claude Code**: software development (Rust/Leptos/Axum CalDAV client)",
|
|
"**Trusted repo**: /home/connor/projects/runway (working directory) and its remote ssh://git.rcjohnstone.com:2222/connor/runway.git \u2014 visibility assumed private per above, so confidential material is fine to commit here but secrets are never cleared into it by visibility alone",
|
|
"**Org-specific CLIs**: None configured",
|
|
"routine podman/systemctl/journalctl operations under this project's local/self-hosted infra",
|
|
"**Primary use of Claude Code**: personal/hobby systems administration \u2014 home-lab container management (podman/podman-compose), self-hosted services (rcjohnstone.com subdomains), and local system maintenance",
|
|
"**Trusted repo**: The git repository at /home/connor (its working directory) \u2014 no remotes configured, so scope is local-only; treat as private by default",
|
|
"**Org-specific CLIs**: None configured \u2014 but note routine personal use of podman, podman-compose, rbw, systemctl, journalctl, act_runner, ddns/ddns_update, sunshine, caddy in this environment",
|
|
"No \"routine under <user>/ prefix\" qualifiers found"
|
|
]
|
|
},
|
|
"statusLine": {
|
|
"type": "command",
|
|
"command": "python3 /home/connor/.claude/quota-statusline.py",
|
|
"refreshInterval": 60
|
|
}
|
|
}
|