chore: tighten permission rules and rename ibmi toolset to catalog

- Narrow blanket allow rules (npm, dotnet, grep, head, tail, echo, find) to explicit read-only commands; route npx/ruff format through ask - Deny privilege escalation via su and doas - Add read denies for env files, key material, SSH/cloud credentials, package-manager tokens, and container/kube configs - Add edit denies for dotfiles, .git internals, and git hook injection - Rename ibmi custom_tools toolset to catalog and enable builtin-tools with directory-based tool config and SELECTED_TOOLSETS=catalog - Document tool-preference rules and scratch workspace in AGENTS.md
2026-10-27 16:32:49 -05:00 · 2026-08-04 17:16:57 -05:00
parent 0729882658
commit 3fbf0ea3c8
3 changed files with 99 additions and 12 deletions
@@ -0,0 +1,77 @@
+sources:
+  ibmi-system:
+    host: ${DB2i_HOST}
+    user: ${DB2i_USER}
+    password: ${DB2i_PASS}
+
+tools:
+  get_column_info:
+    source: ibmi-system
+    description: >-
+      Retrieve a table's column details like TABLE_NAME, SYSTEM_TABLE_NAME,
+      COLUMN_NAME, SYSTEM_COLUMN_NAME, DATA_TYPE, LENGTH, NUMERIC_SCALE,
+      IS_NULLABLE, COLUMN_HEADING, COLUMN_TEXT from the system catalog for the
+      specified table.
+    parameters:
+      - name: table_name
+        type: string
+        description: "The name of the table to retrieve columns for."
+        required: true
+    statement: |
+      SELECT
+          TABLE_NAME,
+          SYSTEM_TABLE_NAME,
+          COLUMN_NAME,
+          SYSTEM_COLUMN_NAME,
+          DATA_TYPE,
+          LENGTH,
+          NUMERIC_SCALE,
+          IS_NULLABLE,
+          COLUMN_HEADING,
+          COLUMN_TEXT
+      FROM
+          QSYS2.SYSCOLUMNS
+      WHERE
+          TABLE_NAME = UPPER(:table_name)
+      ORDER BY
+          TABLE_NAME,
+          ORDINAL_POSITION
+
+  count_total_records:
+    source: ibmi-system
+    description: >-
+      Return the total row count for a table by reading the Db2 for i
+      catalog statistic QSYS2.SYSTABLESTAT.NUMBER_ROWS. Optionally
+      provide table_schema to disambiguate tables that share a name
+      across libraries.
+    parameters:
+      - name: table_name
+        type: string
+        description: "The name of the table to count records for."
+        required: true
+      - name: table_schema
+        type: string
+        description: "Schema/library holding the table. Example: 'MYLIB'."
+        required: true
+    statement: |
+      SELECT
+          TABLE_SCHEMA,
+          TABLE_NAME,
+          NUMBER_ROWS AS TOTAL_RECORDS,
+          LAST_USED_TIMESTAMP
+      FROM
+          QSYS2.SYSTABLESTAT
+      WHERE
+          TABLE_NAME = UPPER(:table_name)
+          AND (:table_schema IS NULL OR TABLE_SCHEMA = UPPER(:table_schema))
+      ORDER BY
+          TABLE_SCHEMA
+
+toolsets:
+  catalog:
+    title: "Catalog Tools"
+    description: >-
+      System catalog introspection tools (QSYS2.SYSCOLUMNS, QSYS2.SYSTABLESTAT).
+    tools:
+      - get_column_info
+      - count_total_records