connor
e6644d0616
Replaces the previous repo, which had split into two histories that never met (mainframe on a dead GitLab remote, the laptops on Gitea) with 146 dirty files across three machines and the NAS never enrolled at all. Branch-per-machine is gone. One main, with host differences expressed as small files under hosts/<hostname>/ rather than as branches, so there is nothing to merge. The reconciled zsh layer reduces 15-33 line forks to 1-7 effective lines per host; distro differences (oh-my-zsh prefix, syntax-highlighting path, fd vs fdfind) are probed in common/ instead. Fresh history: the old one carried six plaintext credentials, 45 MB of mail caches, browser caches and vendored binaries. 5,096 tracked files and 144 MB become 462 files and 2.6 MB. The .gitignore is now an allowlist, which is what keeps that true. Root cause of the rot: ~/.local/bin was a symlink to scripts/ with GOPATH inside it, so every go install wrote into version control (2.2 GB on the work laptop). PATH now points at the repo instead of the reverse. Also: Hyprland replaces sway and is sourced in two halves so $browser is defined before use; singleton automations carry ConditionHost= alongside host-layer-only placement; ddns moves from cron to a guarded timer; package manifests and pkg-snapshot/pkg-restore replace the X11-era install_scripts/; networkmanager-dmenu added to system76 (the binding always existed, the package never did).
61 lines
5.7 KiB
JSON
61 lines
5.7 KiB
JSON
{
|
|
"enabledPlugins": {
|
|
"rust-analyzer-lsp@claude-plugins-official": true
|
|
},
|
|
"tui": "fullscreen",
|
|
"theme": "dark",
|
|
"autoMode": {
|
|
"soft_deny": [
|
|
"$defaults",
|
|
"Bash(podman rm:*) in /home/connor/docs/projects/runway \u2014 destructive container removal",
|
|
"Bash(rm -rf:*) targeting baikal test containers in crates/runway-caldav/tests/baikal",
|
|
"Bash(podman rm -f:*) \u2014 destructive podman container removal, frequently used CLI in this environment",
|
|
"Bash(rm -rf ~/.env*) \u2014 sensitive credential files (.env, .env.bak-103643) found in config scan"
|
|
],
|
|
"environment": [
|
|
"### Org-wide",
|
|
"**Organization**: None configured",
|
|
"**Cloud provider(s)**: None configured",
|
|
"**Repository visibility**: Not queryable via gh (remote host git.rcjohnstone.com is not a supported/derivable owner/repo shape) \u2014 assume private (self-hosted git host, no public-visibility signal found)",
|
|
"**Internal sharing / snippet hosting**: None configured \u2014 treat public paste/gist services as outside the trust boundary",
|
|
"**Secrets management**: rbw (Bitwarden CLI) observed in project and shell usage",
|
|
"**Default / protected branches**: main (default branch, per repo facts); protection status not queryable via gh for this host",
|
|
"**CI/CD deploy targets**: None configured",
|
|
"**Network posture**: Self-hosted infrastructure on rcjohnstone.com domain and local network (10.x addresses observed); no cloud provider signals",
|
|
"**Source control**: ssh://git.rcjohnstone.com:2222/connor/runway.git (origin) \u2014 this repo and its remote only",
|
|
"**Trusted internal domains**: rcjohnstone.com (baikal.rcjohnstone.com, runway.rcjohnstone.com, auth.rcjohnstone.com, jellyfin.rcjohnstone.com, git.rcjohnstone.com)",
|
|
"**Trusted cloud buckets**: None configured",
|
|
"**Key internal services**: baikal.rcjohnstone.com (CalDAV test server), runway-backend (container/service host), immich.rcjohnstone.com, jellyfin.rcjohnstone.com, auth.rcjohnstone.com",
|
|
"**Internal package registry**: None configured",
|
|
"**Sensitive data locations & audiences**: .env / .env.local files (gitignored); any file or store holding personal data, confidential business data, credentials, regulated data, or similarly sensitive material \u2014 share only with audiences cleared at the named+specifics bar",
|
|
"**Data retention / declassification**: None configured",
|
|
"**Sensitive remote targets**: any namespace, host, or container whose name carries `prod` or `production` as a whole word or name segment",
|
|
"**Protected deployment namespaces / environments**: None configured \u2014 fall back to the Sensitive remote targets heuristic",
|
|
"**Protected IaC scopes**: IAM, RBAC, networking, quota, and node-pool resources; anything whose name or tag carries `prod` or `production` as a whole word or name segment",
|
|
"**Repository visibility**: assume private unless the remote host and repo name indicate otherwise, or a visibility check in the transcript shows public",
|
|
"**Secrets management**: rbw (Bitwarden CLI) used routinely in shell history and project transcripts",
|
|
"**Default / protected branches**: not queryable \u2014 repo has no configured remote",
|
|
"**Network posture**: home-lab/self-hosted services under rcjohnstone.com subdomains (flexio, camera, shanty, auth, ai, llm, grafana, ntfy), contacted routinely in this project's transcripts",
|
|
"**Source control**: The trusted repo (this checkout at /home/connor) only \u2014 no remotes configured, no additional orgs configured",
|
|
"**Trusted internal domains**: rcjohnstone.com and its subdomains (flexio., camera., shanty., auth., ai., llm., grafana., ntfy.) \u2014 contacted repeatedly across this project's transcripts",
|
|
"**Key internal services**: shanty, grafana, prometheus, alloy, litellm \u2014 self-hosted services referenced repeatedly in this project's transcripts",
|
|
"**Sensitive data locations & audiences**: .env and .env.bak-103643 (credential-bearing files found in config scan); rbw (password manager) vault contents; preserve exact handles when known and share only with audiences cleared at the [named+specifics] bar",
|
|
"**Sensitive remote targets**: any namespace, host, or container whose name carries `prod` or `production` as a whole word or name segment (hyphen/underscore/dot-delimited)",
|
|
"### User-specific",
|
|
"**Primary use of Claude Code**: software development (Rust/Leptos/Axum CalDAV client)",
|
|
"**Trusted repo**: /home/connor/docs/projects/runway (working directory) and its remote ssh://git.rcjohnstone.com:2222/connor/runway.git \u2014 visibility assumed private per above, so confidential material is fine to commit here but secrets are never cleared into it by visibility alone",
|
|
"**Org-specific CLIs**: None configured",
|
|
"routine podman/systemctl/journalctl operations under this project's local/self-hosted infra",
|
|
"**Primary use of Claude Code**: personal/hobby systems administration \u2014 home-lab container management (podman/podman-compose), self-hosted services (rcjohnstone.com subdomains), and local system maintenance",
|
|
"**Trusted repo**: The git repository at /home/connor (its working directory) \u2014 no remotes configured, so scope is local-only; treat as private by default",
|
|
"**Org-specific CLIs**: None configured \u2014 but note routine personal use of podman, podman-compose, rbw, systemctl, journalctl, act_runner, ddns/ddns_update, sunshine, caddy in this environment",
|
|
"No \"routine under <user>/ prefix\" qualifiers found"
|
|
]
|
|
},
|
|
"statusLine": {
|
|
"type": "command",
|
|
"command": "python3 /home/connor/.claude/quota-statusline.py",
|
|
"refreshInterval": 60
|
|
}
|
|
}
|