mirror of
https://github.com/cole-maxwell1/dotfiles.git
synced 2026-10-27 16:32:49 -05:00
chore: tighten permission rules and rename ibmi toolset to catalog
- Narrow blanket allow rules (npm, dotnet, grep, head, tail, echo, find) to explicit read-only commands; route npx/ruff format through ask - Deny privilege escalation via su and doas - Add read denies for env files, key material, SSH/cloud credentials, package-manager tokens, and container/kube configs - Add edit denies for dotfiles, .git internals, and git hook injection - Rename ibmi custom_tools toolset to catalog and enable builtin-tools with directory-based tool config and SELECTED_TOOLSETS=catalog - Document tool-preference rules and scratch workspace in AGENTS.md
This commit is contained in:
colem
@@ -1,3 +1,20 @@
|
||||
## Tool Preference: File Operations
|
||||
|
||||
Use the following tools instead of their bash equivalents. This is a hard rule, not a suggestion.
|
||||
|
||||
| Instead of | Use |
|
||||
| ----------------------- | ---------------------------------- |
|
||||
| `cat file` | Read tool |
|
||||
| `sed -n '10,20p' file` | Read tool with line range |
|
||||
| `grep pattern file` | Grep tool |
|
||||
| `find . -name "*.go"` | Glob tool |
|
||||
| `sed -i 's/x/y/' file` | Edit tool |
|
||||
| `awk '{print $1}' file` | Read tool, then process in-context |
|
||||
| `head` / `tail` file | Read tool with line range |
|
||||
| `ls`, `wc`, `sort` file | Read / Glob / List tool |
|
||||
|
||||
Only fall back to bash text-processing utilities (`awk`, `sed`, piped `grep`) when the operation genuinely requires shell composition the native tools cannot express — e.g., multi-stage pipelines, process substitution, or operating on command output rather than files. Do not use `cat`/`head`/`tail` to inspect file contents under any circumstance; the Read tool is strictly better for this and does not require permission approval. Note that these bash commands now require permission approval in the config — prefer the native tools to avoid the prompt.
|
||||
|
||||
# Response Tone
|
||||
|
||||
1. **Accuracy over agreeableness:** Do not open with compliments, validation, or social pleasantries. Begin every response with the substance of the answer. Praise is noise; signal is the goal.
|
||||
@@ -13,4 +30,9 @@
|
||||
2. **No Emojis:** NEVER use emojis in code comments, `README.md` files, or any other Markdown documentation. Maintain a purely professional, text-only formatting style.
|
||||
|
||||
# Git
|
||||
|
||||
When asked, write professional Git commit messages for requested changes. NEVER add an AI co-author tag to commit messages.
|
||||
|
||||
# Scratch Workspace
|
||||
|
||||
`/tmp/opencode` is the designated scratch directory for temporary files, downloaded artifacts, intermediate build outputs, logs, and similar transient data. Default to this location for any file that does not belong in the working tree. Avoid polluting the repository with throwaway scripts, fixtures, or downloads.
|
||||
|
||||
+4
-1
@@ -68,7 +68,10 @@ tools:
|
||||
TABLE_SCHEMA
|
||||
|
||||
toolsets:
|
||||
custom_tools:
|
||||
catalog:
|
||||
title: "Catalog Tools"
|
||||
description: >-
|
||||
System catalog introspection tools (QSYS2.SYSCOLUMNS, QSYS2.SYSTABLESTAT).
|
||||
tools:
|
||||
- get_column_info
|
||||
- count_total_records
|
||||
@@ -10,21 +10,18 @@
|
||||
"git diff *": "allow",
|
||||
"git show *": "allow",
|
||||
"git push *": "ask",
|
||||
// GNU Utils
|
||||
// Privilege escalation
|
||||
"sudo *": "deny",
|
||||
"su *": "deny",
|
||||
"doas *": "deny",
|
||||
// GNU Util
|
||||
"curl *": "ask",
|
||||
"wget *": "ask",
|
||||
"diff *": "allow",
|
||||
"npm *": "allow",
|
||||
"rm *": "ask",
|
||||
"rm -rf *": "deny",
|
||||
"grep *": "allow",
|
||||
"sort *": "allow",
|
||||
"head *": "allow",
|
||||
"tail *": "allow",
|
||||
"echo *": "allow",
|
||||
"which *": "allow",
|
||||
"find *": "allow",
|
||||
"ls *": "allow",
|
||||
"wc *": "allow",
|
||||
// Go
|
||||
@@ -33,29 +30,92 @@
|
||||
"go vet *": "allow",
|
||||
"go mod tidy": "allow",
|
||||
"go mod download": "allow",
|
||||
// Node.js
|
||||
"npm ci": "allow",
|
||||
"npm test": "allow",
|
||||
"npm run build": "allow",
|
||||
"npm run lint": "allow",
|
||||
"npm run typecheck": "allow",
|
||||
"npm run check": "allow",
|
||||
"npm ls *": "allow",
|
||||
"npm outdated": "allow",
|
||||
"npm audit *": "allow",
|
||||
"npx *": "ask",
|
||||
// Python
|
||||
"python -m unittest *": "allow",
|
||||
"python -m py_compile": "allow",
|
||||
"python3 -m unittest *": "allow",
|
||||
"python3 -m py_compile": "allow",
|
||||
"python -m venv .venv": "allow",
|
||||
"python3 -m venv .venv": "allow",
|
||||
"source .venv/bin/activate": "allow",
|
||||
"ruff check *": "allow",
|
||||
"ruff format --check *": "allow",
|
||||
"ruff format *": "ask",
|
||||
// Dotnet
|
||||
"dotnet *": "allow",
|
||||
"dotnet build *": "allow",
|
||||
"dotnet test *": "allow",
|
||||
"dotnet restore *": "allow",
|
||||
"dotnet format *": "allow",
|
||||
"dotnet vet *": "allow",
|
||||
"dotnet workload *": "ask",
|
||||
"dotnet run *": "allow",
|
||||
// Docker
|
||||
"docker ps *": "allow",
|
||||
"docker logs *": "allow",
|
||||
"docker compose logs *": "allow",
|
||||
},
|
||||
"read": {
|
||||
"/tmp/opencode": "allow",
|
||||
"/tmp/opencode/*": "allow",
|
||||
"~/.ssh/known_hosts": "allow",
|
||||
// Env / secrets — recursive + variants
|
||||
".env": "deny",
|
||||
".env.*": "deny",
|
||||
"**/.env": "deny",
|
||||
"**/.env.*": "deny",
|
||||
".secrets": "deny",
|
||||
"**/.secrets": "deny",
|
||||
".secrets.*": "deny",
|
||||
// Key material
|
||||
"*.key": "deny",
|
||||
"*.pem": "deny",
|
||||
"*.p12": "deny",
|
||||
"*.pfx": "deny",
|
||||
"*.keystore": "deny",
|
||||
"*.jks": "deny",
|
||||
"*.kdbx": "deny", // KeePass
|
||||
// SSH keys — all algorithms incl. FIDO
|
||||
"id_rsa": "deny",
|
||||
"id_ecdsa": "deny",
|
||||
"id_ed25519": "deny",
|
||||
"id_dsa": "deny",
|
||||
"id_ecdsa_sk": "deny",
|
||||
"id_ed25519_sk": "deny",
|
||||
"~/.ssh/id_*": "deny", // catch-all absolute
|
||||
"~/.ssh/config": "deny", // may contain HostName + IdentityFile
|
||||
// Cloud / service credentials
|
||||
".aws/credentials": "deny",
|
||||
"~/.ssh/known_hosts": "allow",
|
||||
"~/.aws/credentials": "deny",
|
||||
"~/.aws/config": "deny",
|
||||
"~/.config/gcloud/*": "deny",
|
||||
"~/.kube/config": "deny",
|
||||
"~/.npmrc": "deny", // often contains _authToken
|
||||
"~/.pypirc": "deny",
|
||||
"~/.netrc": "deny",
|
||||
"~/.docker/config.json": "deny",
|
||||
// Misc
|
||||
".npmrc": "deny", // project-local tokens
|
||||
"**/.npmrc": "deny",
|
||||
},
|
||||
"edit": {
|
||||
"/tmp/opencode": "allow",
|
||||
"/tmp/opencode/*": "allow",
|
||||
// Explicit deny for dotfiles reduces accidental writes
|
||||
".env*": "deny",
|
||||
".git/*": "deny",
|
||||
"**/.git/*": "deny",
|
||||
".hooks/*": "ask", // git hook injection
|
||||
},
|
||||
"grep": "allow",
|
||||
"glob": "allow",
|
||||
@@ -108,8 +168,9 @@
|
||||
"npx",
|
||||
"-y",
|
||||
"@ibm/ibmi-mcp-server@latest",
|
||||
"--builtin-tools",
|
||||
"--tools",
|
||||
"{env:HOME}/.config/opencode/mcp/ibmi-mcp-server/tools/custom-tools.yaml",
|
||||
"{env:HOME}/.config/opencode/mcp/ibmi-mcp-server/tools",
|
||||
],
|
||||
"enabled": false,
|
||||
"environment": {
|
||||
@@ -117,7 +178,8 @@
|
||||
"DB2i_USER": "{env:DB2i_USER}",
|
||||
"DB2i_PASS": "{env:DB2i_PASS}",
|
||||
"DB2i_PORT": "8076",
|
||||
"DB2i_IGNORE_UNAUTHORIZED": "true",
|
||||
"YAML_ALLOW_DUPLICATE_SOURCES": "true",
|
||||
"SELECTED_TOOLSETS": "catalog",
|
||||
},
|
||||
},
|
||||
},
|
||||
|
||||
Reference in New Issue
Block a user