Files
Project-M/.claude/settings.json
T
kronic 6a412fe3e7 Tooling: security + permission hygiene from the 2026-08-06 audit
- .gitattributes: *.glb / *.gltf now route to LFS. glb is the primary
  Blender->Unity handoff and was committing as raw uncompressible blobs
  (verified: git check-attr returned "unspecified"). Existing files stay
  as plain blobs; new exports go to LFS.
- settings.json deny-list: add git restore / git checkout -- / git stash.
  The list guarded the destructive commands that cannot lose work here
  and omitted the ones that can, in a tree that is routinely dirty.
- settings.local.json: drop the blanket Bash(python *) allow (a full
  escape hatch past the deny-list beside it), drop the serena MCP entry
  (server removed 2026-07-07), and collapse 5 single-use literal command
  allows into two prefix rules.
- workflow-patterns.md: stop telling subagents to prefer serena's
  find_symbol — that template made every spawned agent burn a turn on a
  tool-not-found error. Glob/Grep is now the primary instruction, matching
  memory-protocol.md and CLAUDE.md.

Also done outside git: the leaked ghp_ PAT was stripped from the origin
remote URL, and lfs.allowincompletepush was unset so a failed LFS upload
fails the push loudly instead of reporting success.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-07 10:09:40 -07:00

36 lines
945 B
JSON

{
"permissions": {
"allow": [
"mcp__UnityMCP__read_console",
"mcp__UnityMCP__find_gameobjects",
"mcp__UnityMCP__find_in_file",
"mcp__UnityMCP__get_sha",
"mcp__UnityMCP__get_test_job",
"mcp__UnityMCP__unity_docs",
"mcp__UnityMCP__unity_reflect",
"mcp__UnityMCP__validate_script",
"mcp__UnityMCP__debug_request_context",
"mcp__UnityMCP__manage_script_capabilities",
"Bash(git status:*)",
"Bash(git diff:*)",
"Bash(git log:*)",
"Bash(git show:*)",
"Bash(git branch:*)",
"Bash(git add:*)",
"Bash(git commit:*)"
],
"deny": [
"Bash(rm -rf:*)",
"Bash(rm -fr:*)",
"Bash(git reset --hard:*)",
"Bash(git push --force:*)",
"Bash(git push -f:*)",
"Bash(git clean -fd:*)",
"Bash(git checkout -- :*)",
"Bash(git checkout .:*)",
"Bash(git restore:*)",
"Bash(git stash:*)"
]
}
}