From 3fbf0ea3c8b149a80de89b709ce957d092410242 Mon Sep 17 00:00:00 2001 From: colem Date: Tue, 4 Aug 2026 17:16:57 -0500 Subject: [PATCH] chore: tighten permission rules and rename ibmi toolset to catalog - Narrow blanket allow rules (npm, dotnet, grep, head, tail, echo, find) to explicit read-only commands; route npx/ruff format through ask - Deny privilege escalation via su and doas - Add read denies for env files, key material, SSH/cloud credentials, package-manager tokens, and container/kube configs - Add edit denies for dotfiles, .git internals, and git hook injection - Rename ibmi custom_tools toolset to catalog and enable builtin-tools with directory-based tool config and SELECTED_TOOLSETS=catalog - Document tool-preference rules and scratch workspace in AGENTS.md --- .config/opencode/AGENTS.md | 22 +++++ .../tools/{custom-tools.yaml => catalog.yaml} | 5 +- .config/opencode/opencode.jsonc | 84 ++++++++++++++++--- 3 files changed, 99 insertions(+), 12 deletions(-) rename .config/opencode/mcp/ibmi-mcp-server/tools/{custom-tools.yaml => catalog.yaml} (93%) diff --git a/.config/opencode/AGENTS.md b/.config/opencode/AGENTS.md index c50c7b6..2cfa0c5 100644 --- a/.config/opencode/AGENTS.md +++ b/.config/opencode/AGENTS.md @@ -1,3 +1,20 @@ +## Tool Preference: File Operations + +Use the following tools instead of their bash equivalents. This is a hard rule, not a suggestion. + +| Instead of | Use | +| ----------------------- | ---------------------------------- | +| `cat file` | Read tool | +| `sed -n '10,20p' file` | Read tool with line range | +| `grep pattern file` | Grep tool | +| `find . -name "*.go"` | Glob tool | +| `sed -i 's/x/y/' file` | Edit tool | +| `awk '{print $1}' file` | Read tool, then process in-context | +| `head` / `tail` file | Read tool with line range | +| `ls`, `wc`, `sort` file | Read / Glob / List tool | + +Only fall back to bash text-processing utilities (`awk`, `sed`, piped `grep`) when the operation genuinely requires shell composition the native tools cannot express — e.g., multi-stage pipelines, process substitution, or operating on command output rather than files. Do not use `cat`/`head`/`tail` to inspect file contents under any circumstance; the Read tool is strictly better for this and does not require permission approval. Note that these bash commands now require permission approval in the config — prefer the native tools to avoid the prompt. + # Response Tone 1. **Accuracy over agreeableness:** Do not open with compliments, validation, or social pleasantries. Begin every response with the substance of the answer. Praise is noise; signal is the goal. @@ -13,4 +30,9 @@ 2. **No Emojis:** NEVER use emojis in code comments, `README.md` files, or any other Markdown documentation. Maintain a purely professional, text-only formatting style. # Git + When asked, write professional Git commit messages for requested changes. NEVER add an AI co-author tag to commit messages. + +# Scratch Workspace + +`/tmp/opencode` is the designated scratch directory for temporary files, downloaded artifacts, intermediate build outputs, logs, and similar transient data. Default to this location for any file that does not belong in the working tree. Avoid polluting the repository with throwaway scripts, fixtures, or downloads. diff --git a/.config/opencode/mcp/ibmi-mcp-server/tools/custom-tools.yaml b/.config/opencode/mcp/ibmi-mcp-server/tools/catalog.yaml similarity index 93% rename from .config/opencode/mcp/ibmi-mcp-server/tools/custom-tools.yaml rename to .config/opencode/mcp/ibmi-mcp-server/tools/catalog.yaml index af5bf24..5a09e1a 100644 --- a/.config/opencode/mcp/ibmi-mcp-server/tools/custom-tools.yaml +++ b/.config/opencode/mcp/ibmi-mcp-server/tools/catalog.yaml @@ -68,7 +68,10 @@ tools: TABLE_SCHEMA toolsets: - custom_tools: + catalog: + title: "Catalog Tools" + description: >- + System catalog introspection tools (QSYS2.SYSCOLUMNS, QSYS2.SYSTABLESTAT). tools: - get_column_info - count_total_records diff --git a/.config/opencode/opencode.jsonc b/.config/opencode/opencode.jsonc index 6288911..915820c 100644 --- a/.config/opencode/opencode.jsonc +++ b/.config/opencode/opencode.jsonc @@ -10,21 +10,18 @@ "git diff *": "allow", "git show *": "allow", "git push *": "ask", - // GNU Utils + // Privilege escalation "sudo *": "deny", + "su *": "deny", + "doas *": "deny", + // GNU Util "curl *": "ask", "wget *": "ask", "diff *": "allow", - "npm *": "allow", "rm *": "ask", "rm -rf *": "deny", - "grep *": "allow", "sort *": "allow", - "head *": "allow", - "tail *": "allow", - "echo *": "allow", "which *": "allow", - "find *": "allow", "ls *": "allow", "wc *": "allow", // Go @@ -33,29 +30,92 @@ "go vet *": "allow", "go mod tidy": "allow", "go mod download": "allow", + // Node.js + "npm ci": "allow", + "npm test": "allow", + "npm run build": "allow", + "npm run lint": "allow", + "npm run typecheck": "allow", + "npm run check": "allow", + "npm ls *": "allow", + "npm outdated": "allow", + "npm audit *": "allow", + "npx *": "ask", // Python "python -m unittest *": "allow", "python -m py_compile": "allow", + "python3 -m unittest *": "allow", + "python3 -m py_compile": "allow", + "python -m venv .venv": "allow", "python3 -m venv .venv": "allow", "source .venv/bin/activate": "allow", "ruff check *": "allow", "ruff format --check *": "allow", + "ruff format *": "ask", // Dotnet - "dotnet *": "allow", + "dotnet build *": "allow", + "dotnet test *": "allow", + "dotnet restore *": "allow", + "dotnet format *": "allow", + "dotnet vet *": "allow", + "dotnet workload *": "ask", + "dotnet run *": "allow", // Docker "docker ps *": "allow", "docker logs *": "allow", "docker compose logs *": "allow", }, "read": { + "/tmp/opencode": "allow", + "/tmp/opencode/*": "allow", + "~/.ssh/known_hosts": "allow", + // Env / secrets — recursive + variants ".env": "deny", + ".env.*": "deny", + "**/.env": "deny", + "**/.env.*": "deny", ".secrets": "deny", + "**/.secrets": "deny", + ".secrets.*": "deny", + // Key material "*.key": "deny", "*.pem": "deny", + "*.p12": "deny", + "*.pfx": "deny", + "*.keystore": "deny", + "*.jks": "deny", + "*.kdbx": "deny", // KeePass + // SSH keys — all algorithms incl. FIDO "id_rsa": "deny", + "id_ecdsa": "deny", "id_ed25519": "deny", + "id_dsa": "deny", + "id_ecdsa_sk": "deny", + "id_ed25519_sk": "deny", + "~/.ssh/id_*": "deny", // catch-all absolute + "~/.ssh/config": "deny", // may contain HostName + IdentityFile + // Cloud / service credentials ".aws/credentials": "deny", - "~/.ssh/known_hosts": "allow", + "~/.aws/credentials": "deny", + "~/.aws/config": "deny", + "~/.config/gcloud/*": "deny", + "~/.kube/config": "deny", + "~/.npmrc": "deny", // often contains _authToken + "~/.pypirc": "deny", + "~/.netrc": "deny", + "~/.docker/config.json": "deny", + // Misc + ".npmrc": "deny", // project-local tokens + "**/.npmrc": "deny", + }, + "edit": { + "/tmp/opencode": "allow", + "/tmp/opencode/*": "allow", + // Explicit deny for dotfiles reduces accidental writes + ".env*": "deny", + ".git/*": "deny", + "**/.git/*": "deny", + ".hooks/*": "ask", // git hook injection }, "grep": "allow", "glob": "allow", @@ -108,8 +168,9 @@ "npx", "-y", "@ibm/ibmi-mcp-server@latest", + "--builtin-tools", "--tools", - "{env:HOME}/.config/opencode/mcp/ibmi-mcp-server/tools/custom-tools.yaml", + "{env:HOME}/.config/opencode/mcp/ibmi-mcp-server/tools", ], "enabled": false, "environment": { @@ -117,7 +178,8 @@ "DB2i_USER": "{env:DB2i_USER}", "DB2i_PASS": "{env:DB2i_PASS}", "DB2i_PORT": "8076", - "DB2i_IGNORE_UNAUTHORIZED": "true", + "YAML_ALLOW_DUPLICATE_SOURCES": "true", + "SELECTED_TOOLSETS": "catalog", }, }, },