vadimwit
072920ff0e
Claude must never execute destructive/irreversible commands (rm, git branch -d/-D, git push --delete, reset --hard, force-push, DROP, etc.) — it proposes them for the user to run. Enforced behaviorally in CLAUDE.md (authoritative) and as permissions.deny rules in .claude/settings.json (defense-in-depth). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
36 lines
1.2 KiB
JSON
36 lines
1.2 KiB
JSON
{
|
|
"$comment": "Team-shared restricted options. Destructive/irreversible commands are DENIED so Claude proposes them for the user to run instead of executing them. Authoritative policy: see the 'Destructive operations — NEVER delete' section of CLAUDE.md.",
|
|
"permissions": {
|
|
"deny": [
|
|
"Bash(rm:*)",
|
|
"Bash(rmdir:*)",
|
|
"Bash(git branch -d:*)",
|
|
"Bash(git branch -D:*)",
|
|
"Bash(git branch --delete:*)",
|
|
"Bash(git push --delete:*)",
|
|
"Bash(git push -d:*)",
|
|
"Bash(git push origin --delete:*)",
|
|
"Bash(git push github --delete:*)",
|
|
"Bash(git push origin -d:*)",
|
|
"Bash(git push github -d:*)",
|
|
"Bash(git tag -d:*)",
|
|
"Bash(git tag --delete:*)",
|
|
"Bash(git remote remove:*)",
|
|
"Bash(git remote rm:*)",
|
|
"Bash(git reset --hard:*)",
|
|
"Bash(git clean -f:*)",
|
|
"Bash(git clean -d:*)",
|
|
"Bash(git clean -x:*)",
|
|
"Bash(git push --force:*)",
|
|
"Bash(git push -f:*)",
|
|
"Bash(git push --force-with-lease:*)",
|
|
"Bash(git checkout --:*)",
|
|
"PowerShell(Remove-Item:*)",
|
|
"PowerShell(rm:*)",
|
|
"PowerShell(del:*)",
|
|
"PowerShell(rmdir:*)",
|
|
"PowerShell(Clear-Content:*)"
|
|
]
|
|
}
|
|
}
|