pruff-skills 1.5.1 → 1.5.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli.mjs +14 -1
- package/package.json +1 -1
package/dist/cli.mjs
CHANGED
|
@@ -6667,6 +6667,7 @@ const DB_READER_SECRET_PREFIX = "pruff/db-reader/";
|
|
|
6667
6667
|
const DB_READER_ALLOW_ENTRY = "Bash(pruff-db-query:*)";
|
|
6668
6668
|
const DB_READER_VERIFY_DATABASE = "pruff-sii";
|
|
6669
6669
|
const DB_READER_SKILL = "prod-db-query";
|
|
6670
|
+
const DB_READER_RULE = "prod-db-reads";
|
|
6670
6671
|
const DB_READER_USER_ALLOW = ["Bash(pruff-db-query:*)", "Bash(pruff-db-verify:*)"];
|
|
6671
6672
|
const DB_READER_AUTO_MODE_ALLOW = "Read-only production queries through the pruff-db-query wrapper are allowed, including loops and pipes that run it across tenant databases: it connects as the engineer's personal SELECT-only MySQL user (no write grants, verified TLS, 5-connection cap), so it cannot modify production. This never covers Prisma with prod.env, mysql -u admin, the RDS host directly, or any write.";
|
|
6672
6673
|
const DB_READER_SCRIPTS = ["pruff-db-query", "pruff-db-verify"];
|
|
@@ -6797,6 +6798,18 @@ function mergeAllowlist(workspace) {
|
|
|
6797
6798
|
renameSync(tmp, path);
|
|
6798
6799
|
return "added";
|
|
6799
6800
|
}
|
|
6801
|
+
async function installReaderRule(workspace, note) {
|
|
6802
|
+
const target = join(workspace, ".claude", "rules", `${DB_READER_RULE}.md`);
|
|
6803
|
+
if (existsSync(target)) return;
|
|
6804
|
+
const content = await fetchCatalogFile(PRUFF_CATALOG, `rules/${DB_READER_RULE}.md`);
|
|
6805
|
+
if (!content) {
|
|
6806
|
+
note(`The ${DB_READER_RULE} rule could not be fetched — run ${import_picocolors.default.cyan(`npx pruff-skills rules add ${DB_READER_RULE}`)} from ${workspace}.`);
|
|
6807
|
+
return;
|
|
6808
|
+
}
|
|
6809
|
+
mkdirSync(dirname(target), { recursive: true });
|
|
6810
|
+
writeFileSync(target, stripFrontmatter(content));
|
|
6811
|
+
M.success(`Rule ${DB_READER_RULE} installed`);
|
|
6812
|
+
}
|
|
6800
6813
|
function allowInUserSettings(note) {
|
|
6801
6814
|
try {
|
|
6802
6815
|
writeClaudeSettings$1(addAllowEntries(readClaudeSettings$1(), DB_READER_USER_ALLOW, [DB_READER_AUTO_MODE_ALLOW]));
|
|
@@ -6901,7 +6914,7 @@ async function setupDbReader({ workspace, note }) {
|
|
|
6901
6914
|
for (const failure of hooks.failed) note(`Hook ${failure.name} not installed: ${failure.reason}`);
|
|
6902
6915
|
allowInUserSettings(note);
|
|
6903
6916
|
await installReaderSkill(workspace, note);
|
|
6904
|
-
|
|
6917
|
+
await installReaderRule(workspace, note);
|
|
6905
6918
|
}
|
|
6906
6919
|
const WORKSPACE_DIRS = [".claude/scripts"];
|
|
6907
6920
|
const sha256 = (content) => createHash("sha256").update(content).digest("hex");
|