@jaguilar87/gaia-ops 3.2.0 → 3.2.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,57 @@ All notable changes to the CLAUDE.md orchestrator instructions are documented in
|
|
|
5
5
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## [3.2.2] - 2025-12-09
|
|
9
|
+
|
|
10
|
+
### Enhanced Permissions System
|
|
11
|
+
|
|
12
|
+
Complete overhaul of the permissions configuration to implement "permissive-with-guardrails" strategy.
|
|
13
|
+
|
|
14
|
+
#### Changed
|
|
15
|
+
- **Comprehensive allow[] rules**: 331 specific read-only patterns for shell, git, kubernetes, helm, flux, terraform, aws, gcp, docker commands
|
|
16
|
+
- **Granular ask[] rules**: 162 modification operations that require user confirmation
|
|
17
|
+
- **Strict deny[] rules**: 73 destructive operations that are completely blocked
|
|
18
|
+
|
|
19
|
+
#### Fixed
|
|
20
|
+
- Removed duplicate patterns (`uname:*`, `xargs:*`)
|
|
21
|
+
- Fixed `gsutil rm -r:*::*` → `gsutil rm -r:*` (incorrect double colon)
|
|
22
|
+
- Added missing `git branch:*` to allow[] for `git branch -a`
|
|
23
|
+
|
|
24
|
+
#### Added
|
|
25
|
+
- **New test suite**: `tests/permissions-validation/test_permissions_validation.py`
|
|
26
|
+
- Emulates Claude Code's actual permission matching behavior
|
|
27
|
+
- 114 test cases across 13 categories
|
|
28
|
+
- Tests prefix matching with `:*` wildcard
|
|
29
|
+
- Validates precedence: Deny → Allow → Ask
|
|
30
|
+
|
|
31
|
+
#### Philosophy
|
|
32
|
+
- **Allow**: Read-only commands execute automatically (no confirmation)
|
|
33
|
+
- **Ask**: Modification commands require user approval (can be approved)
|
|
34
|
+
- **Deny**: Destructive commands are blocked (cannot be approved)
|
|
35
|
+
|
|
36
|
+
---
|
|
37
|
+
|
|
38
|
+
## [3.2.1] - 2025-12-06
|
|
39
|
+
|
|
40
|
+
### Security Fix - Permission Bypass Bug
|
|
41
|
+
|
|
42
|
+
**Critical security fix** for permission enforcement in `settings.template.json`.
|
|
43
|
+
|
|
44
|
+
#### Fixed
|
|
45
|
+
- **Removed generic `"Bash"` from `allow[]`**: The generic `"Bash"` permission was bypassing all specific `ask[]` rules like `"Bash(git push:*)"`, allowing T3 operations (git push, git commit) to execute without user confirmation.
|
|
46
|
+
- **Changed hook matcher from `"BashTool"` to `"Bash"`**: The PreToolUse and PostToolUse hooks were configured with matcher `"BashTool"` but Claude Code invokes the tool as `"Bash"`, causing hooks to never execute.
|
|
47
|
+
|
|
48
|
+
#### Root Cause Analysis
|
|
49
|
+
- See post-mortem: Generic permission `allow: ["Bash"]` has higher precedence than specific `ask: ["Bash(git push:*)"]` in Claude Code's permission evaluation.
|
|
50
|
+
- Hook matchers must match the exact tool name used by Claude Code.
|
|
51
|
+
|
|
52
|
+
#### Impact
|
|
53
|
+
- All git operations (push, commit, add) now correctly trigger "ask" confirmation
|
|
54
|
+
- PreToolUse hooks now execute for bash commands
|
|
55
|
+
- Security tier enforcement restored
|
|
56
|
+
|
|
57
|
+
---
|
|
58
|
+
|
|
8
59
|
## [3.2.0] - 2025-12-06
|
|
9
60
|
|
|
10
61
|
### Added - Episodic Memory P0+P1 Enhancements
|
package/package.json
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
"hooks": {
|
|
4
4
|
"PreToolUse": [
|
|
5
5
|
{
|
|
6
|
-
"matcher": "
|
|
6
|
+
"matcher": "Bash",
|
|
7
7
|
"hooks": [
|
|
8
8
|
{
|
|
9
9
|
"type": "command",
|
|
@@ -14,7 +14,7 @@
|
|
|
14
14
|
],
|
|
15
15
|
"PostToolUse": [
|
|
16
16
|
{
|
|
17
|
-
"matcher": "
|
|
17
|
+
"matcher": "Bash",
|
|
18
18
|
"hooks": [
|
|
19
19
|
{
|
|
20
20
|
"type": "command",
|
|
@@ -37,7 +37,6 @@
|
|
|
37
37
|
},
|
|
38
38
|
"permissions": {
|
|
39
39
|
"allow": [
|
|
40
|
-
"Bash",
|
|
41
40
|
"BashOutput",
|
|
42
41
|
"ExitPlanMode",
|
|
43
42
|
"Glob",
|
|
@@ -55,15 +54,330 @@
|
|
|
55
54
|
"Edit(/tmp/*)",
|
|
56
55
|
"Write(/tmp/*)",
|
|
57
56
|
"NotebookEdit",
|
|
57
|
+
|
|
58
58
|
"Bash(echo:*)",
|
|
59
59
|
"Bash(cat:*)",
|
|
60
|
-
"Bash(
|
|
61
|
-
"Bash(
|
|
62
|
-
"Bash(
|
|
63
|
-
"Bash(
|
|
64
|
-
"Bash(
|
|
65
|
-
"Bash(
|
|
66
|
-
"Bash(
|
|
60
|
+
"Bash(ls:*)",
|
|
61
|
+
"Bash(pwd:*)",
|
|
62
|
+
"Bash(cd:*)",
|
|
63
|
+
"Bash(head:*)",
|
|
64
|
+
"Bash(tail:*)",
|
|
65
|
+
"Bash(grep:*)",
|
|
66
|
+
"Bash(find:*)",
|
|
67
|
+
"Bash(which:*)",
|
|
68
|
+
"Bash(whoami:*)",
|
|
69
|
+
"Bash(hostname:*)",
|
|
70
|
+
"Bash(date:*)",
|
|
71
|
+
"Bash(uname:*)",
|
|
72
|
+
"Bash(env:*)",
|
|
73
|
+
"Bash(printenv:*)",
|
|
74
|
+
"Bash(wc:*)",
|
|
75
|
+
"Bash(sort:*)",
|
|
76
|
+
"Bash(uniq:*)",
|
|
77
|
+
"Bash(diff:*)",
|
|
78
|
+
"Bash(file:*)",
|
|
79
|
+
"Bash(stat:*)",
|
|
80
|
+
"Bash(realpath:*)",
|
|
81
|
+
"Bash(dirname:*)",
|
|
82
|
+
"Bash(basename:*)",
|
|
83
|
+
"Bash(tree:*)",
|
|
84
|
+
"Bash(du:*)",
|
|
85
|
+
"Bash(df:*)",
|
|
86
|
+
"Bash(free:*)",
|
|
87
|
+
"Bash(uptime:*)",
|
|
88
|
+
"Bash(ps:*)",
|
|
89
|
+
"Bash(top:*)",
|
|
90
|
+
"Bash(htop:*)",
|
|
91
|
+
"Bash(id:*)",
|
|
92
|
+
"Bash(groups:*)",
|
|
93
|
+
"Bash(getent:*)",
|
|
94
|
+
"Bash(locale:*)",
|
|
95
|
+
"Bash(timedatectl:*)",
|
|
96
|
+
"Bash(lsb_release:*)",
|
|
97
|
+
"Bash(arch:*)",
|
|
98
|
+
"Bash(nproc:*)",
|
|
99
|
+
"Bash(lscpu:*)",
|
|
100
|
+
"Bash(lsmem:*)",
|
|
101
|
+
"Bash(ip:*)",
|
|
102
|
+
"Bash(ifconfig:*)",
|
|
103
|
+
"Bash(netstat:*)",
|
|
104
|
+
"Bash(ss:*)",
|
|
105
|
+
"Bash(ping:*)",
|
|
106
|
+
"Bash(traceroute:*)",
|
|
107
|
+
"Bash(nslookup:*)",
|
|
108
|
+
"Bash(dig:*)",
|
|
109
|
+
"Bash(host:*)",
|
|
110
|
+
"Bash(curl:*)",
|
|
111
|
+
"Bash(wget:*)",
|
|
112
|
+
"Bash(nc:*)",
|
|
113
|
+
"Bash(telnet:*)",
|
|
114
|
+
"Bash(jq:*)",
|
|
115
|
+
"Bash(yq:*)",
|
|
116
|
+
"Bash(xargs:*)",
|
|
117
|
+
"Bash(awk:*)",
|
|
118
|
+
"Bash(sed:*)",
|
|
119
|
+
"Bash(cut:*)",
|
|
120
|
+
"Bash(tr:*)",
|
|
121
|
+
"Bash(tee:*)",
|
|
122
|
+
"Bash(read:*)",
|
|
123
|
+
"Bash(printf:*)",
|
|
124
|
+
"Bash(test:*)",
|
|
125
|
+
"Bash([:*)",
|
|
126
|
+
"Bash(true:*)",
|
|
127
|
+
"Bash(false:*)",
|
|
128
|
+
"Bash(exit:*)",
|
|
129
|
+
"Bash(return:*)",
|
|
130
|
+
"Bash(source:*)",
|
|
131
|
+
"Bash(.:*)",
|
|
132
|
+
"Bash(export:*)",
|
|
133
|
+
"Bash(set:*)",
|
|
134
|
+
"Bash(unset:*)",
|
|
135
|
+
"Bash(alias:*)",
|
|
136
|
+
"Bash(type:*)",
|
|
137
|
+
"Bash(command:*)",
|
|
138
|
+
"Bash(hash:*)",
|
|
139
|
+
"Bash(time:*)",
|
|
140
|
+
"Bash(timeout:*)",
|
|
141
|
+
"Bash(watch:*)",
|
|
142
|
+
"Bash(sleep:*)",
|
|
143
|
+
"Bash(wait:*)",
|
|
144
|
+
"Bash(kill:*)",
|
|
145
|
+
"Bash(pkill:*)",
|
|
146
|
+
"Bash(pgrep:*)",
|
|
147
|
+
"Bash(jobs:*)",
|
|
148
|
+
"Bash(fg:*)",
|
|
149
|
+
"Bash(bg:*)",
|
|
150
|
+
"Bash(nohup:*)",
|
|
151
|
+
"Bash(disown:*)",
|
|
152
|
+
"Bash(history:*)",
|
|
153
|
+
"Bash(fc:*)",
|
|
154
|
+
"Bash(pushd:*)",
|
|
155
|
+
"Bash(popd:*)",
|
|
156
|
+
"Bash(dirs:*)",
|
|
157
|
+
"Bash(tar:*)",
|
|
158
|
+
"Bash(gzip:*)",
|
|
159
|
+
"Bash(gunzip:*)",
|
|
160
|
+
"Bash(zip:*)",
|
|
161
|
+
"Bash(unzip:*)",
|
|
162
|
+
"Bash(base64:*)",
|
|
163
|
+
"Bash(md5sum:*)",
|
|
164
|
+
"Bash(sha256sum:*)",
|
|
165
|
+
"Bash(openssl:*)",
|
|
166
|
+
|
|
167
|
+
"Bash(git status:*)",
|
|
168
|
+
"Bash(git diff:*)",
|
|
169
|
+
"Bash(git log:*)",
|
|
170
|
+
"Bash(git show:*)",
|
|
171
|
+
"Bash(git branch:*)",
|
|
172
|
+
"Bash(git remote:*)",
|
|
173
|
+
"Bash(git fetch:*)",
|
|
174
|
+
"Bash(git stash list:*)",
|
|
175
|
+
"Bash(git describe:*)",
|
|
176
|
+
"Bash(git rev-parse:*)",
|
|
177
|
+
"Bash(git config --get:*)",
|
|
178
|
+
"Bash(git config --list:*)",
|
|
179
|
+
"Bash(git ls-files:*)",
|
|
180
|
+
"Bash(git ls-tree:*)",
|
|
181
|
+
"Bash(git cat-file:*)",
|
|
182
|
+
"Bash(git blame:*)",
|
|
183
|
+
"Bash(git shortlog:*)",
|
|
184
|
+
"Bash(git reflog:*)",
|
|
185
|
+
"Bash(git tag:*)",
|
|
186
|
+
"Bash(git for-each-ref:*)",
|
|
187
|
+
|
|
188
|
+
"Bash(aws sts:*)",
|
|
189
|
+
"Bash(aws configure list:*)",
|
|
190
|
+
"Bash(aws configure get:*)",
|
|
191
|
+
"Bash(aws ec2 describe-:*)",
|
|
192
|
+
"Bash(aws ec2 get-:*)",
|
|
193
|
+
"Bash(aws s3 ls:*)",
|
|
194
|
+
"Bash(aws s3api get-:*)",
|
|
195
|
+
"Bash(aws s3api head-:*)",
|
|
196
|
+
"Bash(aws s3api list-:*)",
|
|
197
|
+
"Bash(aws rds describe-:*)",
|
|
198
|
+
"Bash(aws iam get-:*)",
|
|
199
|
+
"Bash(aws iam list-:*)",
|
|
200
|
+
"Bash(aws lambda get-:*)",
|
|
201
|
+
"Bash(aws lambda list-:*)",
|
|
202
|
+
"Bash(aws logs describe-:*)",
|
|
203
|
+
"Bash(aws logs get-:*)",
|
|
204
|
+
"Bash(aws logs filter-:*)",
|
|
205
|
+
"Bash(aws cloudwatch describe-:*)",
|
|
206
|
+
"Bash(aws cloudwatch get-:*)",
|
|
207
|
+
"Bash(aws cloudwatch list-:*)",
|
|
208
|
+
"Bash(aws cloudformation describe-:*)",
|
|
209
|
+
"Bash(aws cloudformation get-:*)",
|
|
210
|
+
"Bash(aws cloudformation list-:*)",
|
|
211
|
+
"Bash(aws elbv2 describe-:*)",
|
|
212
|
+
"Bash(aws elb describe-:*)",
|
|
213
|
+
"Bash(aws route53 get-:*)",
|
|
214
|
+
"Bash(aws route53 list-:*)",
|
|
215
|
+
"Bash(aws secretsmanager get-:*)",
|
|
216
|
+
"Bash(aws secretsmanager list-:*)",
|
|
217
|
+
"Bash(aws secretsmanager describe-:*)",
|
|
218
|
+
"Bash(aws ssm get-:*)",
|
|
219
|
+
"Bash(aws ssm list-:*)",
|
|
220
|
+
"Bash(aws ssm describe-:*)",
|
|
221
|
+
"Bash(aws sns get-:*)",
|
|
222
|
+
"Bash(aws sns list-:*)",
|
|
223
|
+
"Bash(aws sqs get-:*)",
|
|
224
|
+
"Bash(aws sqs list-:*)",
|
|
225
|
+
"Bash(aws dynamodb describe-:*)",
|
|
226
|
+
"Bash(aws dynamodb list-:*)",
|
|
227
|
+
"Bash(aws dynamodb get-:*)",
|
|
228
|
+
"Bash(aws dynamodb scan:*)",
|
|
229
|
+
"Bash(aws dynamodb query:*)",
|
|
230
|
+
"Bash(aws ecr describe-:*)",
|
|
231
|
+
"Bash(aws ecr get-:*)",
|
|
232
|
+
"Bash(aws ecr list-:*)",
|
|
233
|
+
"Bash(aws eks describe-:*)",
|
|
234
|
+
"Bash(aws eks list-:*)",
|
|
235
|
+
"Bash(aws elasticache describe-:*)",
|
|
236
|
+
|
|
237
|
+
"Bash(gcloud version:*)",
|
|
238
|
+
"Bash(gcloud info:*)",
|
|
239
|
+
"Bash(gcloud auth:*)",
|
|
240
|
+
"Bash(gcloud config:*)",
|
|
241
|
+
"Bash(gcloud projects list:*)",
|
|
242
|
+
"Bash(gcloud projects describe:*)",
|
|
243
|
+
"Bash(gcloud compute instances list:*)",
|
|
244
|
+
"Bash(gcloud compute instances describe:*)",
|
|
245
|
+
"Bash(gcloud compute networks list:*)",
|
|
246
|
+
"Bash(gcloud compute networks describe:*)",
|
|
247
|
+
"Bash(gcloud compute networks subnets list:*)",
|
|
248
|
+
"Bash(gcloud compute networks subnets describe:*)",
|
|
249
|
+
"Bash(gcloud compute firewall-rules list:*)",
|
|
250
|
+
"Bash(gcloud compute firewall-rules describe:*)",
|
|
251
|
+
"Bash(gcloud compute addresses list:*)",
|
|
252
|
+
"Bash(gcloud compute addresses describe:*)",
|
|
253
|
+
"Bash(gcloud compute disks list:*)",
|
|
254
|
+
"Bash(gcloud compute disks describe:*)",
|
|
255
|
+
"Bash(gcloud compute images list:*)",
|
|
256
|
+
"Bash(gcloud compute images describe:*)",
|
|
257
|
+
"Bash(gcloud compute zones list:*)",
|
|
258
|
+
"Bash(gcloud compute regions list:*)",
|
|
259
|
+
"Bash(gcloud container clusters list:*)",
|
|
260
|
+
"Bash(gcloud container clusters describe:*)",
|
|
261
|
+
"Bash(gcloud container clusters get-credentials:*)",
|
|
262
|
+
"Bash(gcloud container node-pools list:*)",
|
|
263
|
+
"Bash(gcloud container node-pools describe:*)",
|
|
264
|
+
"Bash(gcloud sql instances list:*)",
|
|
265
|
+
"Bash(gcloud sql instances describe:*)",
|
|
266
|
+
"Bash(gcloud sql databases list:*)",
|
|
267
|
+
"Bash(gcloud sql users list:*)",
|
|
268
|
+
"Bash(gcloud redis instances list:*)",
|
|
269
|
+
"Bash(gcloud redis instances describe:*)",
|
|
270
|
+
"Bash(gcloud iam service-accounts list:*)",
|
|
271
|
+
"Bash(gcloud iam service-accounts describe:*)",
|
|
272
|
+
"Bash(gcloud iam service-accounts get-iam-policy:*)",
|
|
273
|
+
"Bash(gcloud iam roles list:*)",
|
|
274
|
+
"Bash(gcloud iam roles describe:*)",
|
|
275
|
+
"Bash(gcloud logging read:*)",
|
|
276
|
+
"Bash(gcloud logging logs list:*)",
|
|
277
|
+
"Bash(gcloud services list:*)",
|
|
278
|
+
"Bash(gcloud artifacts repositories list:*)",
|
|
279
|
+
"Bash(gcloud artifacts docker images list:*)",
|
|
280
|
+
"Bash(gsutil ls:*)",
|
|
281
|
+
"Bash(gsutil cat:*)",
|
|
282
|
+
"Bash(gsutil stat:*)",
|
|
283
|
+
"Bash(gsutil du:*)",
|
|
284
|
+
|
|
285
|
+
"Bash(kubectl get:*)",
|
|
286
|
+
"Bash(kubectl describe:*)",
|
|
287
|
+
"Bash(kubectl logs:*)",
|
|
288
|
+
"Bash(kubectl version:*)",
|
|
289
|
+
"Bash(kubectl config:*)",
|
|
290
|
+
"Bash(kubectl cluster-info:*)",
|
|
291
|
+
"Bash(kubectl api-resources:*)",
|
|
292
|
+
"Bash(kubectl api-versions:*)",
|
|
293
|
+
"Bash(kubectl explain:*)",
|
|
294
|
+
"Bash(kubectl top:*)",
|
|
295
|
+
"Bash(kubectl auth:*)",
|
|
296
|
+
"Bash(kubectl diff:*)",
|
|
297
|
+
"Bash(kubectl wait:*)",
|
|
298
|
+
|
|
299
|
+
"Bash(helm list:*)",
|
|
300
|
+
"Bash(helm status:*)",
|
|
301
|
+
"Bash(helm get:*)",
|
|
302
|
+
"Bash(helm template:*)",
|
|
303
|
+
"Bash(helm version:*)",
|
|
304
|
+
"Bash(helm repo list:*)",
|
|
305
|
+
"Bash(helm search:*)",
|
|
306
|
+
"Bash(helm show:*)",
|
|
307
|
+
"Bash(helm lint:*)",
|
|
308
|
+
"Bash(helm history:*)",
|
|
309
|
+
"Bash(helm env:*)",
|
|
310
|
+
|
|
311
|
+
"Bash(flux get:*)",
|
|
312
|
+
"Bash(flux check:*)",
|
|
313
|
+
"Bash(flux version:*)",
|
|
314
|
+
"Bash(flux logs:*)",
|
|
315
|
+
"Bash(flux stats:*)",
|
|
316
|
+
"Bash(flux tree:*)",
|
|
317
|
+
"Bash(flux diff:*)",
|
|
318
|
+
"Bash(flux events:*)",
|
|
319
|
+
|
|
320
|
+
"Bash(terraform version:*)",
|
|
321
|
+
"Bash(terraform show:*)",
|
|
322
|
+
"Bash(terraform output:*)",
|
|
323
|
+
"Bash(terraform state list:*)",
|
|
324
|
+
"Bash(terraform state show:*)",
|
|
325
|
+
"Bash(terraform validate:*)",
|
|
326
|
+
"Bash(terraform fmt:*)",
|
|
327
|
+
"Bash(terraform providers:*)",
|
|
328
|
+
"Bash(terraform graph:*)",
|
|
329
|
+
"Bash(terraform console:*)",
|
|
330
|
+
|
|
331
|
+
"Bash(terragrunt version:*)",
|
|
332
|
+
"Bash(terragrunt output:*)",
|
|
333
|
+
"Bash(terragrunt validate:*)",
|
|
334
|
+
"Bash(terragrunt graph-dependencies:*)",
|
|
335
|
+
"Bash(terragrunt render-json:*)",
|
|
336
|
+
"Bash(terragrunt hclfmt:*)",
|
|
337
|
+
|
|
338
|
+
"Bash(docker ps:*)",
|
|
339
|
+
"Bash(docker images:*)",
|
|
340
|
+
"Bash(docker logs:*)",
|
|
341
|
+
"Bash(docker inspect:*)",
|
|
342
|
+
"Bash(docker version:*)",
|
|
343
|
+
"Bash(docker info:*)",
|
|
344
|
+
"Bash(docker stats:*)",
|
|
345
|
+
"Bash(docker top:*)",
|
|
346
|
+
"Bash(docker port:*)",
|
|
347
|
+
"Bash(docker diff:*)",
|
|
348
|
+
"Bash(docker history:*)",
|
|
349
|
+
"Bash(docker network ls:*)",
|
|
350
|
+
"Bash(docker network inspect:*)",
|
|
351
|
+
"Bash(docker volume ls:*)",
|
|
352
|
+
"Bash(docker volume inspect:*)",
|
|
353
|
+
"Bash(docker compose ps:*)",
|
|
354
|
+
"Bash(docker compose logs:*)",
|
|
355
|
+
"Bash(docker compose config:*)",
|
|
356
|
+
|
|
357
|
+
"Bash(python:*)",
|
|
358
|
+
"Bash(python3:*)",
|
|
359
|
+
"Bash(pip list:*)",
|
|
360
|
+
"Bash(pip show:*)",
|
|
361
|
+
"Bash(pip freeze:*)",
|
|
362
|
+
"Bash(pip check:*)",
|
|
363
|
+
"Bash(node:*)",
|
|
364
|
+
"Bash(npm list:*)",
|
|
365
|
+
"Bash(npm view:*)",
|
|
366
|
+
"Bash(npm version:*)",
|
|
367
|
+
"Bash(npm outdated:*)",
|
|
368
|
+
"Bash(npm audit:*)",
|
|
369
|
+
"Bash(npx:*)",
|
|
370
|
+
"Bash(pnpm list:*)",
|
|
371
|
+
"Bash(yarn list:*)",
|
|
372
|
+
"Bash(go version:*)",
|
|
373
|
+
"Bash(go list:*)",
|
|
374
|
+
"Bash(go env:*)",
|
|
375
|
+
"Bash(rustc --version:*)",
|
|
376
|
+
"Bash(cargo --version:*)",
|
|
377
|
+
"Bash(java -version:*)",
|
|
378
|
+
"Bash(javac -version:*)",
|
|
379
|
+
"Bash(mvn --version:*)",
|
|
380
|
+
"Bash(gradle --version:*)"
|
|
67
381
|
],
|
|
68
382
|
"deny": [
|
|
69
383
|
"Bash(aws backup delete:*::*)",
|
|
@@ -122,7 +436,7 @@
|
|
|
122
436
|
"Bash(gcloud sql instances delete:*)",
|
|
123
437
|
"Bash(gcloud storage rm:*)",
|
|
124
438
|
"Bash(gsutil rb:*)",
|
|
125
|
-
"Bash(gsutil rm -r
|
|
439
|
+
"Bash(gsutil rm -r:*)",
|
|
126
440
|
"Bash(kubectl delete cluster:*)",
|
|
127
441
|
"Bash(kubectl delete clusterrole:*)",
|
|
128
442
|
"Bash(kubectl delete clusterrolebinding:*)",
|
|
@@ -146,9 +460,12 @@
|
|
|
146
460
|
"Bash(terragrunt apply:*)",
|
|
147
461
|
"Bash(terraform plan:*)",
|
|
148
462
|
"Bash(terragrunt plan:*)",
|
|
463
|
+
"Bash(terraform init:*)",
|
|
464
|
+
"Bash(terragrunt init:*)",
|
|
149
465
|
"Bash(flux delete:*)",
|
|
150
466
|
"Bash(flux suspend:*)",
|
|
151
467
|
"Bash(flux resume:*)",
|
|
468
|
+
"Bash(flux reconcile:*)",
|
|
152
469
|
"Bash(kubectl delete:*)",
|
|
153
470
|
"Bash(kubectl apply:*)",
|
|
154
471
|
"Bash(kubectl create:*)",
|
|
@@ -157,11 +474,21 @@
|
|
|
157
474
|
"Bash(kubectl scale:*)",
|
|
158
475
|
"Bash(kubectl set:*)",
|
|
159
476
|
"Bash(kubectl exec:*)",
|
|
477
|
+
"Bash(kubectl run:*)",
|
|
478
|
+
"Bash(kubectl edit:*)",
|
|
479
|
+
"Bash(kubectl label:*)",
|
|
480
|
+
"Bash(kubectl annotate:*)",
|
|
481
|
+
"Bash(kubectl taint:*)",
|
|
482
|
+
"Bash(kubectl cordon:*)",
|
|
483
|
+
"Bash(kubectl uncordon:*)",
|
|
160
484
|
"Bash(helm delete:*)",
|
|
161
485
|
"Bash(helm uninstall:*)",
|
|
162
486
|
"Bash(helm install:*)",
|
|
163
487
|
"Bash(helm upgrade:*)",
|
|
164
488
|
"Bash(helm rollback:*)",
|
|
489
|
+
"Bash(helm repo add:*)",
|
|
490
|
+
"Bash(helm repo update:*)",
|
|
491
|
+
"Bash(helm repo remove:*)",
|
|
165
492
|
"Bash(git push:*)",
|
|
166
493
|
"Bash(git pull:*)",
|
|
167
494
|
"Bash(git rebase:*)",
|
|
@@ -171,7 +498,17 @@
|
|
|
171
498
|
"Bash(git cherry-pick:*)",
|
|
172
499
|
"Bash(git commit:*)",
|
|
173
500
|
"Bash(git add:*)",
|
|
174
|
-
"Bash(git branch:*)",
|
|
501
|
+
"Bash(git branch -d:*)",
|
|
502
|
+
"Bash(git branch -D:*)",
|
|
503
|
+
"Bash(git branch -m:*)",
|
|
504
|
+
"Bash(git checkout -b:*)",
|
|
505
|
+
"Bash(git switch -c:*)",
|
|
506
|
+
"Bash(git stash:*)",
|
|
507
|
+
"Bash(git stash drop:*)",
|
|
508
|
+
"Bash(git stash pop:*)",
|
|
509
|
+
"Bash(git stash apply:*)",
|
|
510
|
+
"Bash(git clean:*)",
|
|
511
|
+
"Bash(git restore:*)",
|
|
175
512
|
"Bash(rm:*)",
|
|
176
513
|
"Bash(rmdir:*)",
|
|
177
514
|
"Bash(mv:*)",
|
|
@@ -179,6 +516,8 @@
|
|
|
179
516
|
"Bash(chmod:*)",
|
|
180
517
|
"Bash(chown:*)",
|
|
181
518
|
"Bash(mkdir:*)",
|
|
519
|
+
"Bash(touch:*)",
|
|
520
|
+
"Bash(ln:*)",
|
|
182
521
|
"Bash(aws cloudformation create-stack:*)",
|
|
183
522
|
"Bash(aws cloudformation update-stack:*)",
|
|
184
523
|
"Bash(aws ec2 create-:*)",
|
|
@@ -190,27 +529,96 @@
|
|
|
190
529
|
"Bash(aws iam attach-:*)",
|
|
191
530
|
"Bash(aws iam create-:*)",
|
|
192
531
|
"Bash(aws iam put-:*)",
|
|
532
|
+
"Bash(aws iam update-:*)",
|
|
193
533
|
"Bash(aws lambda create-function:*)",
|
|
194
534
|
"Bash(aws lambda update-:*)",
|
|
195
535
|
"Bash(aws rds create-:*)",
|
|
196
536
|
"Bash(aws rds modify-:*)",
|
|
537
|
+
"Bash(aws rds start-:*)",
|
|
538
|
+
"Bash(aws rds stop-:*)",
|
|
197
539
|
"Bash(aws s3 cp:*)",
|
|
198
540
|
"Bash(aws s3 mv:*)",
|
|
541
|
+
"Bash(aws s3 rm:*)",
|
|
542
|
+
"Bash(aws s3 sync:*)",
|
|
199
543
|
"Bash(aws s3api put-:*)",
|
|
544
|
+
"Bash(aws s3api create-:*)",
|
|
545
|
+
"Bash(aws sns create-:*)",
|
|
546
|
+
"Bash(aws sns publish:*)",
|
|
547
|
+
"Bash(aws sqs create-:*)",
|
|
548
|
+
"Bash(aws sqs send-:*)",
|
|
549
|
+
"Bash(aws secretsmanager create-:*)",
|
|
550
|
+
"Bash(aws secretsmanager put-:*)",
|
|
551
|
+
"Bash(aws secretsmanager update-:*)",
|
|
552
|
+
"Bash(aws ssm put-:*)",
|
|
553
|
+
"Bash(aws ssm send-:*)",
|
|
200
554
|
"Bash(gcloud compute instances create:*)",
|
|
201
555
|
"Bash(gcloud compute instances reset:*)",
|
|
202
556
|
"Bash(gcloud compute instances start:*)",
|
|
203
557
|
"Bash(gcloud compute instances stop:*)",
|
|
204
|
-
"Bash(gcloud compute
|
|
205
|
-
"Bash(gcloud compute :*
|
|
558
|
+
"Bash(gcloud compute disks create:*)",
|
|
559
|
+
"Bash(gcloud compute networks create:*)",
|
|
560
|
+
"Bash(gcloud compute networks subnets create:*)",
|
|
561
|
+
"Bash(gcloud compute firewall-rules create:*)",
|
|
562
|
+
"Bash(gcloud compute firewall-rules update:*)",
|
|
563
|
+
"Bash(gcloud compute addresses create:*)",
|
|
206
564
|
"Bash(gcloud container clusters create:*)",
|
|
207
565
|
"Bash(gcloud container clusters update:*)",
|
|
208
|
-
"Bash(gcloud
|
|
566
|
+
"Bash(gcloud container clusters resize:*)",
|
|
567
|
+
"Bash(gcloud container node-pools create:*)",
|
|
568
|
+
"Bash(gcloud container node-pools update:*)",
|
|
209
569
|
"Bash(gcloud sql instances create:*)",
|
|
210
|
-
"Bash(gcloud sql instances patch:*)"
|
|
570
|
+
"Bash(gcloud sql instances patch:*)",
|
|
571
|
+
"Bash(gcloud sql instances restart:*)",
|
|
572
|
+
"Bash(gcloud sql databases create:*)",
|
|
573
|
+
"Bash(gcloud sql users create:*)",
|
|
574
|
+
"Bash(gcloud sql users set-password:*)",
|
|
575
|
+
"Bash(gcloud redis instances create:*)",
|
|
576
|
+
"Bash(gcloud redis instances update:*)",
|
|
577
|
+
"Bash(gcloud iam service-accounts create:*)",
|
|
578
|
+
"Bash(gcloud iam service-accounts keys create:*)",
|
|
579
|
+
"Bash(gcloud projects add-iam-policy-binding:*)",
|
|
580
|
+
"Bash(gcloud functions deploy:*)",
|
|
581
|
+
"Bash(gsutil cp:*)",
|
|
582
|
+
"Bash(gsutil mv:*)",
|
|
583
|
+
"Bash(gsutil rm:*)",
|
|
584
|
+
"Bash(gsutil rsync:*)",
|
|
585
|
+
"Bash(gsutil mb:*)",
|
|
586
|
+
"Bash(docker build:*)",
|
|
587
|
+
"Bash(docker push:*)",
|
|
588
|
+
"Bash(docker pull:*)",
|
|
589
|
+
"Bash(docker run:*)",
|
|
590
|
+
"Bash(docker exec:*)",
|
|
591
|
+
"Bash(docker stop:*)",
|
|
592
|
+
"Bash(docker start:*)",
|
|
593
|
+
"Bash(docker restart:*)",
|
|
594
|
+
"Bash(docker rm:*)",
|
|
595
|
+
"Bash(docker rmi:*)",
|
|
596
|
+
"Bash(docker network create:*)",
|
|
597
|
+
"Bash(docker network rm:*)",
|
|
598
|
+
"Bash(docker volume create:*)",
|
|
599
|
+
"Bash(docker volume rm:*)",
|
|
600
|
+
"Bash(docker compose up:*)",
|
|
601
|
+
"Bash(docker compose down:*)",
|
|
602
|
+
"Bash(docker compose build:*)",
|
|
603
|
+
"Bash(npm install:*)",
|
|
604
|
+
"Bash(npm ci:*)",
|
|
605
|
+
"Bash(npm update:*)",
|
|
606
|
+
"Bash(npm uninstall:*)",
|
|
607
|
+
"Bash(npm publish:*)",
|
|
608
|
+
"Bash(npm run:*)",
|
|
609
|
+
"Bash(pnpm install:*)",
|
|
610
|
+
"Bash(pnpm add:*)",
|
|
611
|
+
"Bash(pnpm remove:*)",
|
|
612
|
+
"Bash(yarn install:*)",
|
|
613
|
+
"Bash(yarn add:*)",
|
|
614
|
+
"Bash(yarn remove:*)",
|
|
615
|
+
"Bash(pip install:*)",
|
|
616
|
+
"Bash(pip uninstall:*)",
|
|
617
|
+
"Bash(pip3 install:*)",
|
|
618
|
+
"Bash(pip3 uninstall:*)"
|
|
211
619
|
]
|
|
212
620
|
},
|
|
213
621
|
"environment": {
|
|
214
622
|
"mode": "development"
|
|
215
623
|
}
|
|
216
|
-
}
|
|
624
|
+
}
|