.claude_permissions

# Claude Code Permissions for AWS Spot Deployer Project
# This file defines allowed commands and operations for the AWS Spot Instance deployment tool.
# It ensures Claude can operate effectively while maintaining security boundaries.

# =============================================================================
# PROJECT DIRECTORY CONSTRAINTS
# =============================================================================

# All operations must be performed within the project directory
# Working directory: /Users/daaronch/code/personal-examples/databricks-with-bacalhau/spot
# Local environment: Uses .venv and local Python/UV installations
# No global system modifications allowed

# =============================================================================
# PYTHON EXECUTION AND PACKAGE MANAGEMENT
# =============================================================================

# UV package manager operations (local environment only)
allow: uv run -s deploy_spot.py *
allow: uv run -s deploy_spot_complete.py *
allow: uv run -s deploy_spot_portable.py *
allow: uv run -s test_smoke.py
allow: uv run -s build_clean.py
allow: uv run -s util/get_available_regions.py *
allow: uv run -s util/get_ubuntu_amis.py *
allow: uv run -s util/update_config_with_regions.py *
allow: uv run -s delete_vpcs.py

# Python execution (local environment)
allow: python deploy_spot.py *
allow: python deploy_spot_complete.py *
allow: python deploy_spot_portable.py *
allow: python test_smoke.py
allow: python build_clean.py
allow: python -m unittest test_smoke
allow: python -m pip install *

# Python virtual environment operations
allow: .venv/bin/python *
allow: source .venv/bin/activate

# =============================================================================
# BINARY EXECUTION AND TESTING
# =============================================================================

# Execute built binaries for testing
allow: ./dist/aws-spot-deployer *
allow: ./dist/aws-spot-deployer-complete *
allow: ./dist/aws-spot-deployer-final *
allow: ./dist/aws-spot-deployer-test *
allow: ./dist/aws-spot-deployer-working *

# Make binaries executable
allow: chmod +x dist/*
allow: chmod 755 dist/*

# =============================================================================
# BUILD SYSTEM AND COMPILATION
# =============================================================================

# PyInstaller operations for binary building
allow: pyinstaller *.spec
allow: pyinstaller aws-spot-deployer.spec
allow: pyinstaller aws-spot-deployer-complete.spec
allow: pyinstaller deploy_spot.py
allow: pyinstaller deploy_spot_complete.py

# Build system dependencies
allow: pip install pyinstaller
allow: python -m pip install pyinstaller

# =============================================================================
# FILE SYSTEM OPERATIONS
# =============================================================================

# File listing and directory operations (local directory only)
allow: ls *
allow: ls -la *
allow: ls -l dist/
allow: ls *.py *.spec
allow: tree
allow: find . -name "*.py"
allow: find . -name "*.spec"

# File operations for development
allow: cp *.py *
allow: cp *.spec *
allow: cp config.yaml_example config.yaml
allow: mv *.py *
allow: mv *.spec *
allow: rm *.py
allow: rm *.spec
allow: rm -f *.py
allow: rm -f *.spec
allow: rm -f debug_deploy_spot.log
allow: rm -f machines.db

# Directory cleanup operations
allow: rm -rf build/
allow: rm -rf dist/
allow: rm -rf __pycache__/
allow: shutil.rmtree("build")
allow: shutil.rmtree("dist")
allow: shutil.rmtree("__pycache__")

# =============================================================================
# DEVELOPMENT AND TESTING TOOLS
# =============================================================================

# Code quality and formatting
allow: ruff check .
allow: ruff format .
allow: black *.py
allow: flake8 *.py
allow: mypy *.py

# Git operations (local repository only)
allow: git status
allow: git add *.py *.spec *.md
allow: git commit -m "*"
allow: git diff
allow: git log --oneline
allow: git branch
allow: git checkout *

# =============================================================================
# CONFIGURATION AND DATA FILES
# =============================================================================

# Configuration file operations
allow: cat config.yaml*
allow: cat *.json
allow: cat *.csv
allow: cat debug_deploy_spot.log
allow: head -n * *.log
allow: tail -n * *.log

# JSON and CSV data operations
allow: jq . *.json
allow: python -m json.tool *.json

# =============================================================================
# AWS AND CLOUD OPERATIONS (LOCAL ENVIRONMENT ONLY)
# =============================================================================

# AWS CLI operations (using local AWS config)
allow: aws configure list
allow: aws sts get-caller-identity
allow: aws ec2 describe-regions
allow: aws ec2 describe-instances
allow: aws configure set *

# Environment variable operations (local scope)
allow: export AWS_PROFILE=*
allow: export AWS_REGION=*
allow: export PYTHONPATH=*
allow: env | grep AWS
allow: env | grep PYTHON

# =============================================================================
# SYSTEM INFORMATION (READ-ONLY)
# =============================================================================

# System information for debugging
allow: which python
allow: which python3
allow: which uv
allow: which pyinstaller
allow: which aws
allow: python --version
allow: uv --version
allow: aws --version

# Process and resource monitoring
allow: ps aux | grep python
allow: ps aux | grep aws-spot-deployer
allow: du -sh dist/
allow: wc -l *.py
allow: file dist/*

# =============================================================================
# NETWORKING AND CONNECTIVITY (LOCAL TESTING ONLY)
# =============================================================================

# Local connectivity testing (no external calls)
allow: ping -c 1 127.0.0.1
allow: curl -I http://localhost:*
allow: netstat -an | grep :*

# =============================================================================
# DOCUMENTATION AND HELP
# =============================================================================

# Help and documentation access
allow: man *
allow: help *
allow: python -m pydoc *
allow: python -c "help(*)"

# =============================================================================
# FORBIDDEN OPERATIONS
# =============================================================================

# These operations are explicitly forbidden for security:
deny: rm -rf /
deny: rm -rf ~
deny: rm -rf /*
deny: sudo *
deny: chmod 777 *
deny: chown *
deny: curl http://*
deny: wget http://*
deny: ssh *
deny: scp *
deny: rsync *
deny: docker *
deny: systemctl *
deny: service *
deny: crontab *
deny: pip install --global *
deny: npm install -g *

# Network operations outside local testing
deny: curl https://*
deny: wget https://*
deny: nc *
deny: telnet *

# System configuration changes
deny: /etc/*
deny: /usr/*
deny: /var/*
deny: ~/.bashrc
deny: ~/.zshrc
deny: ~/.profile

# =============================================================================
# ENVIRONMENT CONSTRAINTS
# =============================================================================

# Working directory must remain in project root
working_directory: /Users/daaronch/code/personal-examples/databricks-with-bacalhau/spot

# Python environment constraints
python_env: .venv/bin/python
package_manager: uv
dependency_scope: local

# File operation scope
file_scope: ./
max_file_size: 100MB
allowed_extensions: .py, .spec, .yaml, .yml, .json, .csv, .md, .txt, .log, .sh

# AWS operations scope
aws_config_scope: local
aws_profile_scope: current_user
no_global_aws_changes: true

# =============================================================================
# SPECIAL PERMISSIONS FOR THIS PROJECT
# =============================================================================

# Allow reading project-specific files
allow_read: deploy_spot*.py
allow_read: test_*.py
allow_read: build_*.py
allow_read: *.spec
allow_read: config.yaml*
allow_read: *.md
allow_read: *.json
allow_read: *.csv
allow_read: debug_*.log

# Allow writing to project outputs
allow_write: dist/
allow_write: build/
allow_write: *.log
allow_write: machines.db
allow_write: config.yaml
allow_write: *.json
allow_write: *.csv

# Allow execution of project binaries
allow_execute: dist/aws-spot-deployer*
allow_execute: *.py (local scope only)

# =============================================================================
# USAGE NOTES
# =============================================================================

# This permissions file ensures:
# 1. All operations stay within the project directory
# 2. No global system modifications
# 3. Local Python/UV environment usage
# 4. AWS operations use local configuration only
# 5. Build and test operations are fully enabled
# 6. Security boundaries are maintained
# 7. Development workflow is unimpeded

# To use this file:
# 1. Place in project root as .claude_permissions
# 2. Claude will automatically respect these constraints
# 3. All operations will be scoped to local environment
# 4. No additional permission requests needed for listed operations