From 6a412fe3e75e10546f0752f053fa5b7738b71e65 Mon Sep 17 00:00:00 2001 From: Luis Gonzalez Date: Fri, 7 Aug 2026 10:09:40 -0700 Subject: [PATCH] Tooling: security + permission hygiene from the 2026-08-06 audit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - .gitattributes: *.glb / *.gltf now route to LFS. glb is the primary Blender->Unity handoff and was committing as raw uncompressible blobs (verified: git check-attr returned "unspecified"). Existing files stay as plain blobs; new exports go to LFS. - settings.json deny-list: add git restore / git checkout -- / git stash. The list guarded the destructive commands that cannot lose work here and omitted the ones that can, in a tree that is routinely dirty. - settings.local.json: drop the blanket Bash(python *) allow (a full escape hatch past the deny-list beside it), drop the serena MCP entry (server removed 2026-07-07), and collapse 5 single-use literal command allows into two prefix rules. - workflow-patterns.md: stop telling subagents to prefer serena's find_symbol — that template made every spawned agent burn a turn on a tool-not-found error. Glob/Grep is now the primary instruction, matching memory-protocol.md and CLAUDE.md. Also done outside git: the leaked ghp_ PAT was stripped from the origin remote URL, and lfs.allowincompletepush was unset so a failed LFS upload fails the push loudly instead of reporting success. Co-Authored-By: Claude Opus 5 (1M context) --- .claude/settings.json | 6 +++++- .claude/skills/dots-dev/references/workflow-patterns.md | 2 +- .gitattributes | 2 ++ 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.claude/settings.json b/.claude/settings.json index 0eefc5599..97df95306 100644 --- a/.claude/settings.json +++ b/.claude/settings.json @@ -25,7 +25,11 @@ "Bash(git reset --hard:*)", "Bash(git push --force:*)", "Bash(git push -f:*)", - "Bash(git clean -fd:*)" + "Bash(git clean -fd:*)", + "Bash(git checkout -- :*)", + "Bash(git checkout .:*)", + "Bash(git restore:*)", + "Bash(git stash:*)" ] } } diff --git a/.claude/skills/dots-dev/references/workflow-patterns.md b/.claude/skills/dots-dev/references/workflow-patterns.md index 74776e994..e567a2cee 100644 --- a/.claude/skills/dots-dev/references/workflow-patterns.md +++ b/.claude/skills/dots-dev/references/workflow-patterns.md @@ -13,7 +13,7 @@ Two rules apply to every pattern here: Three read-only lens agents in `parallel()`; the orchestrator synthesizes the ≤400-word Project Brief and discards the raw returns. **A1 — Code/asset graph (read-only).** -> Map the code surface relevant to `{goal}`. Prefer serena `find_symbol`/`find_referencing_symbols`; if serena's C# LSP stalls on the Unity solution, use `Glob`/`Grep` on `Assets/_Project/**/*.cs` + `**/*.asmdef`. Identify the existing components/systems/bakers touching `{surface}`, the asmdef each lives in (Simulation / Client / Server / Authoring), and any `*Math.cs` helper or system you'd otherwise duplicate. `manage_scene get_hierarchy` for relevant subscenes. Return a terse symbol/asmdef map (names + paths), not file dumps. +> Map the code surface relevant to `{goal}`. Use `Glob`/`Grep` on `Assets/_Project/**/*.cs` + `**/*.asmdef` (serena was removed 2026-07-07 — C# nav is Glob/Grep). Identify the existing components/systems/bakers touching `{surface}`, the asmdef each lives in (Simulation / Client / Server / Authoring), and any `*Math.cs` helper or system you'd otherwise duplicate. `manage_scene get_hierarchy` for relevant subscenes. Return a terse symbol/asmdef map (names + paths), not file dumps. **A2 — Knowledge state (read-only).** > Search the in-repo vault (obsidian-cli) and `basic-memory` for design docs, decision records, and notes touching `{goal}`. Return: relevant doc paths, any **locked** decisions that constrain `{goal}`, open questions already recorded. Quote ≤2 load-bearing lines each; link by path otherwise. diff --git a/.gitattributes b/.gitattributes index 5eb962866..44758f6b6 100644 --- a/.gitattributes +++ b/.gitattributes @@ -85,6 +85,8 @@ Packages/packages-lock.json linguist-generated *.dxf lfs *.FBX lfs *.fbx lfs +*.glb lfs +*.gltf lfs *.jas lfs *.lws lfs *.lxo lfs