mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-09-09 19:32:05 +02:00
docs(agents): clarify rule scope and remove permission templates
This commit is contained in:
Ryan Yin
+8
-2
@@ -9,7 +9,6 @@ The primary workflow is to symlink files from here into each agent runtime/confi
|
||||
|
||||
- `AGENTS.md`: global baseline rules for coding agents.
|
||||
- `evals/global-rules.md`: behavioral scenarios for validating changes to the global rules.
|
||||
- `permissions.md`: permission policies for agent tool access.
|
||||
- `install-rules.py`: installs the baseline by creating symlinks in supported agent config dirs.
|
||||
- `install-cli.md`: curated CLI install/update command snippets.
|
||||
- `install-skills.md`: curated `npx skills` command snippets.
|
||||
@@ -17,7 +16,7 @@ The primary workflow is to symlink files from here into each agent runtime/confi
|
||||
## Core workflow
|
||||
|
||||
1. Maintain shared rules in `agents/AGENTS.md`.
|
||||
2. Define permission policies in `agents/permissions.md`.
|
||||
2. Configure permissions directly in the agent runtime; auto-approval is generally used.
|
||||
3. Run `install-rules.py` to refresh symlinks in local agent homes.
|
||||
4. Use `install-cli.md` and `install-skills.md` as reference snippets when needed.
|
||||
|
||||
@@ -42,6 +41,13 @@ Behavior:
|
||||
- Missing destination directories are skipped.
|
||||
- Existing destination file/symlink is replaced with a symlink to this repo source file.
|
||||
|
||||
The installer links only `AGENTS.md`; it does not install permission configuration, skills, or CLIs.
|
||||
The repository-root `AGENTS.md` contains guidance for this Nix configuration repository. It is not
|
||||
the global rules source and is not installed by this script.
|
||||
|
||||
Auto-approval controls tool prompting. The global rules still define task authorization, safety, and
|
||||
secret handling.
|
||||
|
||||
## About `install-cli.md` and `install-skills.md`
|
||||
|
||||
Use them as snippet libraries:
|
||||
|
||||
@@ -1,175 +0,0 @@
|
||||
{
|
||||
"$schema": "https://opencode.ai/config.json",
|
||||
"permission": {
|
||||
"read": {
|
||||
"*": "allow",
|
||||
"*.env": "deny",
|
||||
"*.env.*": "deny",
|
||||
"*.env.example": "allow",
|
||||
"*.pem": "deny",
|
||||
"*.key": "deny",
|
||||
"*kubeconfig*": "deny",
|
||||
".ssh/**": "deny",
|
||||
".aws/**": "deny",
|
||||
".kube/**": "deny",
|
||||
".gnupg/**": "deny"
|
||||
},
|
||||
"edit": "allow",
|
||||
"glob": "allow",
|
||||
"grep": "allow",
|
||||
"task": "allow",
|
||||
"lsp": "allow",
|
||||
"skill": "allow",
|
||||
"question": "allow",
|
||||
"todowrite": "allow",
|
||||
"webfetch": "allow",
|
||||
"websearch": "allow",
|
||||
"external_directory": "ask",
|
||||
"doom_loop": "deny",
|
||||
"bash": {
|
||||
"*": "ask",
|
||||
"git status *": "allow",
|
||||
"git diff *": "allow",
|
||||
"git log *": "allow",
|
||||
"git show *": "allow",
|
||||
"git branch *": "allow",
|
||||
"git remote *": "allow",
|
||||
"git tag *": "allow",
|
||||
"git blame *": "allow",
|
||||
"git reflog *": "allow",
|
||||
"git stash list *": "allow",
|
||||
"git lfs *": "allow",
|
||||
"kubectl get *": "allow",
|
||||
"kubectl describe *": "allow",
|
||||
"kubectl logs *": "allow",
|
||||
"kubectl top *": "allow",
|
||||
"kubectl api-*": "allow",
|
||||
"kubectl config *": "allow",
|
||||
"kubectl explain *": "allow",
|
||||
"kubectl kustomize *": "allow",
|
||||
"kustomize *": "allow",
|
||||
"terraform plan *": "allow",
|
||||
"terraform show *": "allow",
|
||||
"terraform state *": "allow",
|
||||
"terraform output *": "allow",
|
||||
"terraform version *": "allow",
|
||||
"terraform providers *": "allow",
|
||||
"terraform fmt *": "allow",
|
||||
"gh repo view *": "allow",
|
||||
"gh repo list *": "allow",
|
||||
"gh issue view *": "allow",
|
||||
"gh issue list *": "allow",
|
||||
"gh pr view *": "allow",
|
||||
"gh pr list *": "allow",
|
||||
"gh pr diff *": "allow",
|
||||
"gh pr checks *": "allow",
|
||||
"gh api *": "allow",
|
||||
"gh search *": "allow",
|
||||
"gh gist list *": "allow",
|
||||
"gh gist view *": "allow",
|
||||
"gh release view *": "allow",
|
||||
"gh release list *": "allow",
|
||||
"gh workflow list *": "allow",
|
||||
"gh workflow view *": "allow",
|
||||
"gh run list *": "allow",
|
||||
"gh run view *": "allow",
|
||||
"gh status *": "allow",
|
||||
"gh auth status *": "allow",
|
||||
"helm list *": "allow",
|
||||
"helm get *": "allow",
|
||||
"helm show *": "allow",
|
||||
"helm search *": "allow",
|
||||
"helm repo *": "allow",
|
||||
"helm status *": "allow",
|
||||
"helm version *": "allow",
|
||||
"helm template *": "allow",
|
||||
"gcloud * list *": "allow",
|
||||
"gcloud * describe *": "allow",
|
||||
"gcloud * get-iam-policy *": "allow",
|
||||
"gcloud config *": "allow",
|
||||
"gcloud auth *": "allow",
|
||||
"gcloud version *": "allow",
|
||||
"nix eval *": "allow",
|
||||
"nix build *": "allow",
|
||||
"nix flake *": "allow",
|
||||
"nix profile *": "allow",
|
||||
"nix store *": "allow",
|
||||
"nix search *": "allow",
|
||||
"nix doctor *": "allow",
|
||||
"nixos-rebuild build *": "allow",
|
||||
"darwin-rebuild build *": "allow",
|
||||
"nom build *": "allow",
|
||||
"just --list *": "allow",
|
||||
"just --show *": "allow",
|
||||
"just --dry-run *": "allow",
|
||||
"statix check *": "allow",
|
||||
"deadnix *": "allow",
|
||||
"nixfmt *": "allow",
|
||||
"shellcheck *": "allow",
|
||||
"hadolint *": "allow",
|
||||
"actionlint *": "allow",
|
||||
"ruff check *": "allow",
|
||||
"clippy *": "allow",
|
||||
"prettier --check *": "allow",
|
||||
"tokei *": "allow",
|
||||
"systemctl status *": "allow",
|
||||
"systemctl list-*": "allow",
|
||||
"systemctl show *": "allow",
|
||||
"journalctl *": "allow",
|
||||
"lspci *": "allow",
|
||||
"lsusb *": "allow",
|
||||
"lsblk *": "allow",
|
||||
"df *": "allow",
|
||||
"free *": "allow",
|
||||
"uptime *": "allow",
|
||||
"uname *": "allow",
|
||||
"sensors *": "allow",
|
||||
"lsof *": "allow",
|
||||
"go version *": "allow",
|
||||
"go env *": "allow",
|
||||
"go list *": "allow",
|
||||
"go doc *": "allow",
|
||||
"go vet *": "allow",
|
||||
"cargo --version *": "allow",
|
||||
"cargo tree *": "allow",
|
||||
"cargo metadata *": "allow",
|
||||
"python3 --version *": "allow",
|
||||
"python3 -m py_compile *": "allow",
|
||||
"node --version *": "allow",
|
||||
"pnpm list *": "allow",
|
||||
"uv pip list *": "allow",
|
||||
"rg *": "allow",
|
||||
"fd *": "allow",
|
||||
"cp *": "allow",
|
||||
"mv *": "allow",
|
||||
"chmod *": "allow",
|
||||
"ls *": "allow",
|
||||
"cat *": "allow",
|
||||
"head *": "allow",
|
||||
"tail *": "allow",
|
||||
"wc *": "allow",
|
||||
"find *": "allow",
|
||||
"which *": "allow",
|
||||
"echo *": "allow",
|
||||
"pwd *": "allow",
|
||||
"date *": "allow",
|
||||
"env *": "allow",
|
||||
"printenv *": "allow",
|
||||
"file *": "allow",
|
||||
"stat *": "allow",
|
||||
"du *": "allow",
|
||||
"tree *": "allow",
|
||||
"bat *": "allow",
|
||||
"eza *": "allow",
|
||||
"jq *": "allow",
|
||||
"yq *": "allow",
|
||||
"tldr *": "allow",
|
||||
"mkdir *": "allow",
|
||||
"rmdir *": "allow",
|
||||
"grep *": "allow",
|
||||
"rm *": "ask",
|
||||
"rm -rf *": "ask",
|
||||
"sudo *": "deny"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,190 +0,0 @@
|
||||
# Permissions Configuration
|
||||
|
||||
This document records the current permission requirements for AI agents operating in this
|
||||
repository.
|
||||
|
||||
## Scope
|
||||
|
||||
| Environment | Policy |
|
||||
| ------------------------ | ------------------------------------------- |
|
||||
| **Personal workstation** | Restrictive - protect user's daily workflow |
|
||||
| **Homelab VMs** | Permissive - agents have full autonomy |
|
||||
|
||||
The permissions below apply to **personal workstation** only. For homelab VMs, almost everything is
|
||||
allowed except destructive operations on production systems.
|
||||
|
||||
## Default Policy
|
||||
|
||||
| Tool | Permission |
|
||||
| ---------------- | ---------- |
|
||||
| `*` (all others) | ask |
|
||||
|
||||
## File Read Permissions
|
||||
|
||||
| Pattern | Permission |
|
||||
| --------------- | ---------- |
|
||||
| `*` (all files) | allow |
|
||||
| `*.env` | deny |
|
||||
| `*.env.*` | deny |
|
||||
| `*.env.example` | allow |
|
||||
| `*.pem` | deny |
|
||||
| `*.key` | deny |
|
||||
| `*kubeconfig*` | deny |
|
||||
| `.ssh/**` | deny |
|
||||
| `.aws/**` | deny |
|
||||
| `.kube/**` | deny |
|
||||
| `.gnupg/**` | deny |
|
||||
|
||||
## Always Allowed Tools
|
||||
|
||||
These tools run without prompting:
|
||||
|
||||
- `glob`
|
||||
- `grep`
|
||||
- `lsp`
|
||||
- `question`
|
||||
- `skill`
|
||||
- `todowrite`
|
||||
- `webfetch`
|
||||
- `websearch`
|
||||
- `codesearch`
|
||||
- `edit` (covers `write` and `apply_patch`)
|
||||
|
||||
## Bash Command Permissions
|
||||
|
||||
### Always Allowed (Read-only operations)
|
||||
|
||||
**Git:**
|
||||
|
||||
- `git status`, `git diff`, `git log`, `git show`, `git branch`, `git remote`
|
||||
|
||||
**Kubernetes:**
|
||||
|
||||
- `kubectl get`, `kubectl describe`, `kubectl logs`, `kubectl top`
|
||||
- `kubectl api-resources`, `kubectl api-versions`
|
||||
- `kubectl config view`, `kubectl config get-contexts`
|
||||
- `kubectl explain`
|
||||
- `kubectl kustomize`, `kustomize build`, `kustomize version`
|
||||
|
||||
**Terraform:**
|
||||
|
||||
- `terraform plan`, `terraform show`, `terraform state list`, `terraform state show`
|
||||
- `terraform output`, `terraform version`, `terraform providers`, `terraform fmt`
|
||||
|
||||
**GitHub CLI:**
|
||||
|
||||
- `gh repo view/list`, `gh issue view/list`, `gh pr view/list/diff/checks`
|
||||
- `gh api`, `gh search`, `gh gist list/view`
|
||||
- `gh release view/list`, `gh workflow list/view`, `gh run list/view`
|
||||
- `gh status`, `gh auth status`
|
||||
|
||||
**Helm:**
|
||||
|
||||
- `helm list`, `helm get`, `helm show`, `helm search`
|
||||
- `helm repo list`, `helm status`, `helm version`, `helm template`
|
||||
|
||||
**Google Cloud:**
|
||||
|
||||
- `gcloud * list`, `gcloud * describe`, `gcloud * get-iam-policy`
|
||||
- `gcloud config list`, `gcloud auth list`, `gcloud version`
|
||||
|
||||
**Nix:**
|
||||
|
||||
- `nix eval`, `nix build`, `nix flake show`, `nix flake metadata`
|
||||
- `nix flake check`, `nix flake lock`
|
||||
- `nix profile list`, `nix profile history`
|
||||
- `nix store verify`, `nix store ls`, `nix store path-info`
|
||||
- `nix search`, `nix doctor`, `nix --version`
|
||||
- `nixos-rebuild build`, `darwin-rebuild build`
|
||||
- `nom build`
|
||||
|
||||
**Just:**
|
||||
|
||||
- `just --list`, `just --show`, `just --dry-run`
|
||||
|
||||
**Linters & Formatters:**
|
||||
|
||||
- `statix check`, `deadnix`, `nixfmt --check`
|
||||
- `shellcheck`, `hadolint`, `actionlint`
|
||||
- `ruff check`, `clippy`, `prettier --check`
|
||||
- `tokei`
|
||||
|
||||
**System diagnostics:**
|
||||
|
||||
- `systemctl status`, `systemctl list-units`, `systemctl show`
|
||||
- `journalctl -u`, `journalctl --since`
|
||||
- `lspci`, `lsusb`, `lsblk`, `df`, `free`, `uptime`, `uname -a`
|
||||
- `sensors`, `lsof`
|
||||
|
||||
**Git (extended):**
|
||||
|
||||
- `git tag`, `git blame`, `git reflog`, `git stash list`
|
||||
- `git lfs status`, `git lfs ls-files`
|
||||
|
||||
**Development tools:**
|
||||
|
||||
- `go version`, `go env`, `go list`, `go doc`, `go vet`
|
||||
- `cargo --version`, `cargo tree`, `cargo metadata`
|
||||
- `python3 --version`, `python3 -m py_compile`
|
||||
- `node --version`, `pnpm list`, `uv pip list`
|
||||
|
||||
**General utilities:**
|
||||
|
||||
- `rg`, `fd`, `cp`, `mv`, `chmod`
|
||||
- `ls`, `cat`, `head`, `tail`, `wc`, `find`, `which`
|
||||
- `echo`, `pwd`, `date`, `env`, `printenv`
|
||||
- `file`, `stat`, `du`, `tree`, `bat`, `eza`
|
||||
- `jq`, `yq`, `tldr`
|
||||
- `mkdir`, `rmdir`, `grep`
|
||||
|
||||
### Requires Confirmation
|
||||
|
||||
| Command | Permission |
|
||||
| ---------- | ---------- |
|
||||
| `rm *` | ask |
|
||||
| `rm -rf *` | ask |
|
||||
|
||||
### Always Denied
|
||||
|
||||
| Command | Permission |
|
||||
| -------- | ---------- |
|
||||
| `sudo *` | deny |
|
||||
|
||||
## Homelab VM Permissions
|
||||
|
||||
For agents running in dedicated homelab VMs, permissions are significantly relaxed:
|
||||
|
||||
| Category | Permission |
|
||||
| -------------------- | --------------------- |
|
||||
| `bash` | allow (most commands) |
|
||||
| `edit` | allow |
|
||||
| `write` | allow |
|
||||
| `task` | allow |
|
||||
| `external_directory` | allow |
|
||||
| `rm` | allow |
|
||||
|
||||
**Still restricted in homelab VMs:**
|
||||
|
||||
- Production cluster destructive operations (`kubectl delete`, `helm uninstall`)
|
||||
- Infrastructure teardown (`terraform destroy`)
|
||||
- Secret exposure in logs
|
||||
|
||||
## Other Tool Permissions
|
||||
|
||||
| Tool | Permission |
|
||||
| -------------------- | ---------- |
|
||||
| `edit` | allow |
|
||||
| `task` | ask |
|
||||
| `external_directory` | ask |
|
||||
| `doom_loop` | deny |
|
||||
|
||||
## Summary
|
||||
|
||||
- **Default policy**: All tools `ask` — only explicitly whitelisted tools auto-allow
|
||||
- **File operations**: `read`, `glob`, `grep`, `edit`, `write` all allowed in workspace
|
||||
- **Nix operations**: Build/eval/flake commands auto-allowed (writes to store only)
|
||||
- **Linting & formatting**: All check commands auto-allowed
|
||||
- **System diagnostics**: Read-only system info auto-allowed
|
||||
- **Sensitive files**: Credentials, keys, and cloud configs are blocked
|
||||
- **Bash commands**: Read-only ops auto-allowed; `rm` requires confirmation; `sudo` blocked
|
||||
- **Scope control**: `task` and `external_directory` require approval
|
||||
Reference in New Issue
Block a user