colem 3fbf0ea3c8 chore: tighten permission rules and rename ibmi toolset to catalog ...

- Narrow blanket allow rules (npm, dotnet, grep, head, tail, echo, find)
  to explicit read-only commands; route npx/ruff format through ask
- Deny privilege escalation via su and doas
- Add read denies for env files, key material, SSH/cloud credentials,
  package-manager tokens, and container/kube configs
- Add edit denies for dotfiles, .git internals, and git hook injection
- Rename ibmi custom_tools toolset to catalog and enable builtin-tools
  with directory-based tool config and SELECTED_TOOLSETS=catalog
- Document tool-preference rules and scratch workspace in AGENTS.md

2026-08-04 17:16:57 -05:00

..

nvim

Remove: plenary.nvim

2026-04-26 11:46:25 -05:00

opencode

chore: tighten permission rules and rename ibmi toolset to catalog

2026-08-04 17:16:57 -05:00