Skip to content

feat: Update DevContainer Claude settings with Elu-co-jp common configurations #189

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
keito4 merged 4 commits into from
Dec 30, 2025
Merged

feat: Update DevContainer Claude settings with Elu-co-jp common configurations #189

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d760dba
feat: Update DevContainer Claude settings with Elu-co-jp common confi…
keito4 Dec 30, 2025
f7e90ad
fix: Add comprehensive deny list for destructive commands
keito4 Dec 30, 2025
675bee8
fix: Add helm uninstall, supabase db reset, and supabase functions to…
keito4 Dec 30, 2025
988257a
feat: Add sync-claude-settings command for collecting common settings
keito4 Dec 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
258 changes: 230 additions & 28 deletions .devcontainer/claude-settings.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,68 +1,270 @@
{
"$schema": "https://json.schemastore.org/claude-code-settings.json",
"permissions": {
"allow": [
"WebSearch",
"WebFetch(domain:supabase.com)",
"WebFetch(domain:github.com)",
"WebFetch(domain:docs.github.com)",
"WebFetch(domain:npmjs.com)",
"WebFetch(domain:www.npmjs.com)",
"WebFetch(domain:docs.recall.ai)",
"WebFetch(domain:docs.smith.langchain.com)",
"WebFetch(domain:docs.langchain.com)",
"WebFetch(domain:docs.n8n.io)",
"WebFetch(domain:community.n8n.io)",
"WebFetch(domain:raw.githubusercontent.com)",
"WebFetch(domain:artifacthub.io)",
"WebFetch(domain:developers.notion.com)",
"mcp__ide__getDiagnostics",
"Bash(ls:*)",
"Bash(cat:*)",
"Bash(find:*)",
"Bash(grep:*)",
"Bash(rg:*)",
"Bash(sed:*)",
"Bash(awk:*)",
"Bash(mkdir:*)",
"Bash(touch:*)",
"Bash(cp:*)",
"Bash(mv:*)",
"Bash(rm:*)",

@coderabbitai coderabbitai Bot Dec 30, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Expand deny rules to protect against additional destructive rm patterns.

While lines 290-291 deny rm -rf / and rm -rf /*, the broad Bash(rm:*) permission still allows highly destructive patterns such as:

  • rm -rf . (deletes current directory)
  • rm -rf * (deletes all files in current directory)
  • rm -rf ../* (deletes parent directory contents)

Consider adding explicit deny rules for these patterns to prevent accidental data loss.

🔎 Suggested additional deny rules

Add these entries to the deny array:

       "Bash(rm -rf /)",
       "Bash(rm -rf /*)"
+      "Bash(rm -rf .)",
+      "Bash(rm -rf *)",
+      "Bash(rm -rf ../*)",
+      "Bash(rm -rf .*)"
     ],
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
"Bash(rm:*)",
"Bash(rm -rf /)",
"Bash(rm -rf /*)",
"Bash(rm -rf .)",
"Bash(rm -rf *)",
"Bash(rm -rf ../*)",
"Bash(rm -rf .*)"
🤖 Prompt for AI Agents 
In .devcontainer/claude-settings.json around line 31, the current deny rules
block only `rm -rf /` and `rm -rf /*` but still permit dangerous `rm` patterns
via "Bash(rm:*)"; update the deny array to add explicit entries for common
destructive variants such as `rm -rf .`, `rm -rf *`, `rm -rf ./*`, `rm -rf ../*`
(and their quoted/escaped forms as appropriate) so these commands are matched
and blocked; ensure the new deny entries follow the same pattern/format as
existing rules and include both plain and glob/relative variants to cover
typical shells and expansions.

"Bash(chmod:*)",
"Bash(ln:*)",
"Bash(curl:*)",
"Bash(wget:*)",
"Bash(zip:*)",
"Bash(unzip:*)",
"Bash(tar:*)",
"Bash(tree:*)",
"Bash(du:*)",
"Bash(host:*)",
"Bash(lsof:*)",
"Bash(pkill:*)",
"Bash(kill:*)",
"Bash(echo:*)",
"Bash(printf:*)",
"Bash(export:*)",
"Bash(source:*)",
"Bash(env:*)",
"Bash(bash:*)",
"Bash(true)",
"Bash(node:*)",

"Bash(git status:*)",
"Bash(git diff:*)",
"Bash(python3:*)",
"Bash(deno:*)",
"Bash(deno test:*)",
"Bash(deno fmt:*)",
"Bash(deno lint:*)",
"Bash(deno check:*)",
"Bash(deno run:*)",
"Bash(npm:*)",
"Bash(npm install:*)",
"Bash(npm uninstall:*)",
"Bash(npm ci:*)",
"Bash(npm ls:*)",
"Bash(npm view:*)",
"Bash(npm update:*)",
"Bash(npm run:*)",
"Bash(npm run dev:*)",
"Bash(npm run build:*)",
"Bash(npm run lint:*)",
"Bash(npm run type-check:*)",
"Bash(npm run typecheck:*)",
"Bash(npm run format:*)",
"Bash(npm run format:check:*)",
"Bash(npm run ci:check:*)",
"Bash(npm run test:*)",
"Bash(npm test:*)",
"Bash(npm audit:*)",
"Bash(npm outdated:*)",
"Bash(npm pack:*)",
"Bash(npm exec:*)",
"Bash(pnpm:*)",
"Bash(pnpm add:*)",
"Bash(pnpm run lint:*)",
"Bash(pnpm tsc:*)",
"Bash(pnpm run build:*)",
"Bash(npx:*)",
"Bash(npx tsc:*)",
"Bash(npx tsx:*)",
"Bash(npx eslint:*)",
"Bash(npx prettier:*)",
"Bash(npx next:*)",
"Bash(npx next lint:*)",
"Bash(npx vitest:*)",
"Bash(npx vitest run:*)",
"Bash(npx vitest list:*)",
"Bash(npx playwright:*)",
"Bash(npx playwright test:*)",
"Bash(npx husky:*)",
"Bash(npx husky init:*)",
"Bash(npx npm-check-updates:*)",
"Bash(npx complexity-report:*)",
"Bash(timeout:*)",
"Bash(timeout 10 npm start)",
"Bash(timeout 10s npm run dev)",
"Bash(timeout 60 npx vitest:*)",
"Bash(timeout 90 npm run:*)",
"Bash(timeout 90 npx vitest run:*)",
"Bash(timeout 120 npm run build:*)",
"Bash(git:*)",
"Bash(git add:*)",
"Bash(git commit:*)",
"Bash(git push:*)",
"Bash(git checkout:*)",
"Bash(git pull:*)",
"Bash(git fetch:*)",
"Bash(git merge:*)",
"Bash(git checkout:*)",
"Bash(git reset:*)",
"Bash(git restore:*)",
"Bash(git stash:*)",
"Bash(git rm:*)",

"Bash(gh issue list:*)",
"Bash(gh issue view:*)",
"Bash(gh repo view:*)",
"Bash(gh pr create:*)",
"Bash(git status:*)",
"Bash(git diff:*)",
"Bash(git remote set-url:*)",
"Bash(git cherry-pick:*)",
"Bash(git branch:*)",
"Bash(git rebase:*)",
"Bash(git clone:*)",
"Bash(git tag:*)",
"Bash(git rev-parse:*)",
"Bash(git check-ignore:*)",
"Bash(gh:*)",
"Bash(gh pr:*)",
"Bash(gh pr list:*)",
"Bash(gh pr view:*)",
"Bash(gh pr diff:*)",
"Bash(gh pr create:*)",
"Bash(gh pr edit:*)",
"Bash(gh pr merge:*)",
"Bash(gh pr checkout:*)",
"Bash(gh pr checks:*)",
"Bash(gh run view:*)",
"Bash(gh issue list:*)",
"Bash(gh issue view:*)",
"Bash(gh issue create:*)",
"Bash(gh issue edit:*)",
"Bash(gh repo view:*)",
"Bash(gh run list:*)",

"Bash(gh run view:*)",
"Bash(gh run watch:*)",
"Bash(gh workflow:*)",
"Bash(gh workflow run:*)",
"Bash(gh release view:*)",
"Bash(gh auth:*)",
"Bash(gh api:*)",
"Bash(gh repo set-default:*)",
"Bash(gh repo fork:*)",
"Bash(supabase:*)",
"Bash(supabase status:*)",
"Bash(supabase start:*)",
"Bash(supabase stop:*)",
"Bash(supabase db:*)",
"Bash(supabase db reset:*)",
"Bash(supabase migration:*)",
"Bash(supabase seed:*)",
"Bash(supabase secrets:*)",
"Bash(supabase secrets list:*)",
"Bash(supabase functions:*)",
"Bash(supabase functions serve:*)",

@coderabbitai coderabbitai Bot Dec 30, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Critical conflict: deny rule blocks allowed supabase functions serve.

Line 166 explicitly allows Bash(supabase functions serve:*), but lines 286-287 deny Bash(supabase functions) and Bash(supabase functions:*). The deny pattern Bash(supabase functions:*) will match and block supabase functions serve, preventing the intended functionality.

If supabase functions serve should remain allowed for local development, the deny rules need to be more specific. If all functions operations should be blocked, remove line 166 from the allow list.

🔎 Proposed fix to allow serve while blocking other functions operations

Option 1: Make deny rules more specific (if serve should be allowed)

-      "Bash(supabase functions)",
-      "Bash(supabase functions:*)",
+      "Bash(supabase functions deploy)",
+      "Bash(supabase functions deploy:*)",
+      "Bash(supabase functions delete)",
+      "Bash(supabase functions delete:*)",

Option 2: Remove the allow rule (if no functions operations should be allowed)

       "Bash(supabase secrets list:*)",
-      "Bash(supabase functions serve:*)",
       "Bash(supabase logs:*)",

Also applies to: 286-287

🤖 Prompt for AI Agents 
.devcontainer/claude-settings.json lines 166 and 286-287: the allow entry at
line 166 permits "Bash(supabase functions serve:*)" but the deny entries at
286-287 include "Bash(supabase functions)" and "Bash(supabase functions:*)",
which will block the intended serve command; to fix, either remove the allow at
line 166 if no functions commands should be permitted, or narrow the deny
patterns so they do not match the serve subcommand (e.g., deny only specific
subcommands like "deploy", "invoke", etc., or use a deny pattern that excludes
"serve"), ensuring the allow for serve remains effective.

"Bash(supabase logs:*)",
"Bash(supabase projects api-keys:*)",
"Bash(npx supabase:*)",
"Bash(npx supabase db reset:*)",
"Bash(npx supabase db push:*)",
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Resolved
"Bash(npx supabase db describe:*)",
"Bash(npx supabase db remote:*)",
"Bash(npx supabase migration:*)",
"Bash(npx supabase migration up:*)",
"Bash(npx supabase gen types typescript:*)",
"mcp__plugin_supabase-toolkit_supabase__list_tables",
"mcp__plugin_supabase-toolkit_supabase__get_project_url",
"Bash(psql:*)",
"Bash(PGPASSWORD=postgres psql:*)",
"Bash(docker:*)",
"Bash(docker build:*)",
"Bash(docker exec:*)",
"Bash(docker logs:*)",
"Bash(docker-compose:*)",
"Bash(kubectl:*)",
"Bash(kubectl get:*)",
"Bash(kubectl describe:*)",
"Bash(kubectl logs:*)",
"Bash(kubectl exec:*)",
"Bash(kubectl top:*)",
"Bash(kubectl delete pods:*)",
"Bash(kubectl delete pod:*)",
"Bash(kubectl wait:*)",
"Bash(kubectl rollout restart:*)",
"Bash(kubectl rollout status:*)",

"Bash(kubectl patch:*)",
"Bash(kubectl run:*)",
"Bash(helm:*)",
"Bash(helm list:*)",
"Bash(helm status:*)",

"Bash(helm uninstall:*)",
"Bash(helm upgrade:*)",
"Bash(helm show chart:*)",
"Bash(helm show values:*)",
"Bash(helm repo add:*)",
"Bash(minikube image load:*)",
"Bash(terraform:*)",
"Bash(terraform apply:*)",
"Bash(aws:*)",
"Bash(aws s3:*)",
"Bash(aws sts:*)",
"Bash(aws iam list-users:*)",
"Bash(aws iam list-groups:*)",
"Bash(aws iam get-user:*)",
"Bash(aws iam list-groups-for-user:*)",
"Bash(aws iam list-attached-user-policies:*)",
"Bash(aws sso-admin:*)",
"Bash(aws sso-admin list-instances:*)",
"Bash(aws identitystore list-users:*)",
"Bash(aws organizations list-organizational-units-for-parent:*)",
"Bash(aws organizations list-accounts:*)",
"Bash(aws events list-rules:*)",
"Bash(aws logs:*)",
"Bash(az account:*)",
"Bash(az account show:*)",
"Bash(az ad app show:*)",
"Bash(az ad app permission admin-consent:*)",
"Bash(az ad app permission list:*)",
"Bash(az ad sp show:*)",
"Bash(gcloud:*)",
"Bash(gcloud config list:*)",
"Bash(gcloud config get-value project)",
"Bash(gcloud config get-value account)",
"Bash(gcloud config set project:*)",
"Bash(gcloud auth list:*)",
"Bash(gcloud auth activate-service-account:*)",
"Bash(gcloud auth application-default set-quota-project:*)",
"Bash(gcloud projects list)",
"Bash(gcloud projects create:*)",
"Bash(gcloud beta billing accounts list)",
"Bash(gcloud beta billing projects link:*)",
"Bash(gcloud secrets versions access:*)",
"Bash(gcloud container operations list:*)",

"Bash(npm install)",
"Bash(npm install:*)",
"Bash(npm run dev:*)",
"Bash(npm run lint)",
"Bash(npm run lint:*)",
"Bash(npm run format:*)",
"Bash(npm run type-check:*)",
"Bash(npm run ci:check:*)",
"Bash(npx:*)",
"Bash(gcloud container clusters:*)",
"Bash(gcloud container clusters get-credentials:*)",
"Bash(gcloud compute machine-types describe:*)",
"Bash(vercel:*)",
"Bash(vercel env:*)",
"Bash(wscat:*)",

"WebSearch",
"WebFetch(domain:github.com)",
"WebFetch(domain:raw.githubusercontent.com)"
"Bash(openssl rand:*)",
"Bash(uv run:*)",
"Bash(uv sync:*)",
"Bash(supervisorctl:*)",
"Bash(supervisorctl stop:*)",
"Bash(supervisord:*)",
"Bash(act:*)",
"Bash(afplay:*)"
],
"deny": [
"Bash(npx supabase db push)",
"Bash(npx supabase db push:*)",
"Bash(npx supabase migration squash)",
"Bash(npx supabase migration squash:*)"
],
"deny": [],
"ask": []
}
}