impresso-frontend/opencode.jsonc at develop · impresso/impresso-frontend · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
{
  "$schema": "https://opencode.ai/config.json",

  "permissions": [
    // Ask for anything not explicitly allowed below.
    { "action": "*", "resource": "*", "effect": "ask" },

    // Routine code inspection.
    { "action": "read", "resource": "*", "effect": "allow" },
    { "action": "glob", "resource": "*", "effect": "allow" },
    { "action": "skill", "resource": "*", "effect": "allow" },
    { "action": "question", "resource": "*", "effect": "allow" },

    // These remain explicit approval gates.
    { "action": "grep", "resource": "*", "effect": "ask" },
    { "action": "edit", "resource": "*", "effect": "ask" },
    { "action": "shell", "resource": "*", "effect": "ask" },
    { "action": "external_directory", "resource": "*", "effect": "ask" },
    { "action": "webfetch", "resource": "*", "effect": "ask" },
    { "action": "websearch", "resource": "*", "effect": "ask" },
    { "action": "subagent", "resource": "*", "effect": "ask" },

    // Enable Code Mode; nested tools still enforce their permissions.
    { "action": "execute", "resource": "*", "effect": "allow" }
  ],

  "experimental": {
    "policies": [
      // Allow edits to selected file types within this project.
      { "action": "permission", "resource": "edit:*.vue", "effect": "allow" },
      { "action": "permission", "resource": "edit:*.ts", "effect": "allow" },
      { "action": "permission", "resource": "edit:*.md", "effect": "allow" },

      // Block direct reads and edits of real environment files.
      { "action": "permission", "resource": "read:*.env", "effect": "deny" },
      { "action": "permission", "resource": "read:*.env.*", "effect": "deny" },
      { "action": "permission", "resource": "edit:*.env", "effect": "deny" },
      { "action": "permission", "resource": "edit:*.env.*", "effect": "deny" },

      // Allow example templates to follow ordinary permissions.
      { "action": "permission", "resource": "read:*.env.example", "effect": "allow" },
      { "action": "permission", "resource": "edit:*.env.example", "effect": "allow" },

      // Block direct reads of common credential locations.
      { "action": "permission", "resource": "read:*/.ssh/*", "effect": "deny" },
      { "action": "permission", "resource": "read:*/.aws/*", "effect": "deny" },
      { "action": "permission", "resource": "read:*/.kube/*", "effect": "deny" },
      { "action": "permission", "resource": "read:*.npmrc", "effect": "deny" },
      { "action": "permission", "resource": "read:*.netrc", "effect": "deny" },
      { "action": "permission", "resource": "read:*.pem", "effect": "deny" },
      { "action": "permission", "resource": "read:*.key", "effect": "deny" },

      // Allow project TypeScript checks and test commands.
      { "action": "permission", "resource": "shell:npx vue-tsc*", "effect": "allow" },
      { "action": "permission", "resource": "shell:npx tsc*", "effect": "allow" },
      { "action": "permission", "resource": "shell:npm run type-check*", "effect": "allow" },
      { "action": "permission", "resource": "shell:npm test*", "effect": "allow" },
      { "action": "permission", "resource": "shell:npm run test*", "effect": "allow" },
      { "action": "permission", "resource": "shell:npx prettier*", "effect": "allow" },
      { "action": "permission", "resource": "shell:npx eslint*", "effect": "allow" },
      { "action": "permission", "resource": "shell:find * -name *.ts", "effect": "allow" },

      // Hard-stop common privileged and remote mutation commands.
      { "action": "permission", "resource": "shell:sudo *", "effect": "deny" },
      { "action": "permission", "resource": "shell:git diff*", "effect": "allow" },
      { "action": "permission", "resource": "shell:git branch*", "effect": "allow" },
      { "action": "permission", "resource": "shell:git push *", "effect": "deny" }
    ]
  }
}