From d07ea186c0c20b9225ab088f6800cf3dbfc3ed37 Mon Sep 17 00:00:00 2001 From: marcin-kordas-hoc Date: Fri, 14 Aug 2026 15:28:20 +0000 Subject: [PATCH] chore: isolate public repo from internal MCP connectors (HOT-15476) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Handsoncode's 2026-08-03 AI usage policy update (HOT-15476) requires that AI sessions never mix Poufne/Ograniczone company data (ClickUp, Gmail, Slack, Fireflies, Google Drive/Calendar) with anything that can reach a public destination. This repo's origin/upstream both point straight at the public github.com/handsontable/hyperformula with no private staging, so the isolation has to be enforced at the tool-permission level instead. - .claude/settings.json: deny the account-level claude.ai MCP connector tool patterns (ClickUp/Gmail/Slack/Fireflies/Google Drive/Calendar) so a Claude Code session working in this directory cannot reach them even though they may be connected at the account level. Verified live: the connectors dropped out of the running session the moment this file was written. - .gitignore: stop tracking .infisical.json (Infisical workspaceId — infra inventory, personal-private-repos-only per Handsoncode's classification matrix) and the personal/local parts of .claude/ (settings.local.json, worktrees/, scheduled_tasks.lock), while keeping settings.json trackable since it's the repo-wide guardrail. --- .claude/settings.json | 12 ++++++++++++ .gitignore | 10 ++++++++++ 2 files changed, 22 insertions(+) create mode 100644 .claude/settings.json diff --git a/.claude/settings.json b/.claude/settings.json new file mode 100644 index 000000000..8d052549c --- /dev/null +++ b/.claude/settings.json @@ -0,0 +1,12 @@ +{ + "permissions": { + "deny": [ + "mcp__claude_ai_ClickUp__*", + "mcp__claude_ai_Gmail__*", + "mcp__claude_ai_Google_Calendar__*", + "mcp__claude_ai_Google_Drive__*", + "mcp__claude_ai_Slack__*", + "mcp__claude_ai_Fireflies__*" + ] + } +} diff --git a/.gitignore b/.gitignore index 886d7289b..7f6b5bb7c 100644 --- a/.gitignore +++ b/.gitignore @@ -31,3 +31,13 @@ docs/guide/built-in-functions.md # Wrangler (Cloudflare Workers) local state .wrangler .dev.vars* + +# Infisical local project link — contains workspaceId (infra inventory, HOT/SZBI: +# stays in personal private repos only, never in a public repo) +.infisical.json + +# Claude Code project-local state (personal, not shared) — .claude/settings.json +# itself IS meant to be committed (repo-wide guardrails), so only ignore the rest. +.claude/settings.local.json +.claude/worktrees/ +.claude/scheduled_tasks.lock