From ce396d2b437955612aa0e1b11da372a8e2e08528 Mon Sep 17 00:00:00 2001 From: Jeffrey Phillips Freeman Date: Sat, 2 May 2026 14:33:45 -0400 Subject: [PATCH] build: reordered agent perms --- .opencode/agents/async-agent-util.md | 10 +++++----- .opencode/agents/auto-agents.md | 10 +++++----- .opencode/agents/estimator-implementation.md | 10 +++++----- .opencode/agents/git-checkout-util.md | 10 +++++----- .opencode/agents/git-clone-util.md | 10 +++++----- .opencode/agents/git-commit-and-push-util.md | 10 +++++----- .opencode/agents/git-commit-util.md | 10 +++++----- .opencode/agents/git-create-commit-util.md | 10 +++++----- .opencode/agents/git-fetch-util.md | 10 +++++----- .opencode/agents/git-force-push-with-lease-util.md | 10 +++++----- .opencode/agents/git-isolator-util.md | 10 +++++----- .opencode/agents/git-push-util.md | 10 +++++----- .opencode/agents/git-rebase-and-push-util.md | 10 +++++----- .opencode/agents/git-rebase-util.md | 10 +++++----- .opencode/agents/git-stage-util.md | 10 +++++----- .opencode/agents/implementation-supervisor.md | 10 +++++----- .opencode/agents/pr-merge-supervisor.md | 10 +++++----- .opencode/agents/pr-merge-worker.md | 10 +++++----- .opencode/agents/pr-review-supervisor.md | 10 +++++----- .opencode/agents/pr-review-worker.md | 10 +++++----- .opencode/agents/session-health-full-util.md | 10 +++++----- .opencode/agents/session-health-quick-util.md | 10 +++++----- .opencode/agents/session-health-util.md | 10 +++++----- .opencode/agents/supervisor.md | 10 +++++----- .opencode/agents/task-implementor.md | 10 +++++----- .opencode/agents/tier-codex.md | 10 +++++----- .opencode/agents/tier-gpt5-mini.md | 10 +++++----- .opencode/agents/tier-gpt5-nano.md | 10 +++++----- .opencode/agents/tier-haiku.md | 10 +++++----- .opencode/agents/tier-o4-mini.md | 10 +++++----- .opencode/agents/tier-opus.md | 10 +++++----- .opencode/agents/tier-qwen.md | 10 +++++----- .opencode/agents/tier-sonnet.md | 10 +++++----- .opencode/agents/work-group-util.md | 10 +++++----- 34 files changed, 170 insertions(+), 170 deletions(-) diff --git a/.opencode/agents/async-agent-util.md b/.opencode/agents/async-agent-util.md index 52c09f9de..271ff6621 100644 --- a/.opencode/agents/async-agent-util.md +++ b/.opencode/agents/async-agent-util.md @@ -21,16 +21,16 @@ permission: "question": deny # All agents are supposed to be working in isolated repos in `/tmp`, so this forces that - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow # I don't think MCP permissions work, but just in case they do these two should be the only ones usually allowed "sequential-thinking*": allow diff --git a/.opencode/agents/auto-agents.md b/.opencode/agents/auto-agents.md index 47542c798..bf9732046 100644 --- a/.opencode/agents/auto-agents.md +++ b/.opencode/agents/auto-agents.md @@ -21,16 +21,16 @@ permission: "question": deny # All agents are supposed to be working in isolated repos in `/tmp`, so this forces that - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow # I don't think MCP permissions work, but just in case they do these two should be the only ones usually allowed "sequential-thinking*": allow diff --git a/.opencode/agents/estimator-implementation.md b/.opencode/agents/estimator-implementation.md index 466db7beb..8cc2a2931 100644 --- a/.opencode/agents/estimator-implementation.md +++ b/.opencode/agents/estimator-implementation.md @@ -23,16 +23,16 @@ permission: "question": deny # All agents are supposed to be working in isolated repos in `/tmp`, so this forces that - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow # I don't think MCP permissions work, but just in case they do these two should be the only ones usually allowed "sequential-thinking*": allow diff --git a/.opencode/agents/git-checkout-util.md b/.opencode/agents/git-checkout-util.md index 4ec6db530..ca7d25d3c 100644 --- a/.opencode/agents/git-checkout-util.md +++ b/.opencode/agents/git-checkout-util.md @@ -14,16 +14,16 @@ permission: "doom_loop": deny "question": deny - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow "sequential-thinking*": deny "context7*": deny diff --git a/.opencode/agents/git-clone-util.md b/.opencode/agents/git-clone-util.md index 08382b40a..9498a23f5 100644 --- a/.opencode/agents/git-clone-util.md +++ b/.opencode/agents/git-clone-util.md @@ -17,16 +17,16 @@ permission: "doom_loop": deny "question": deny - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow "sequential-thinking*": deny "context7*": deny diff --git a/.opencode/agents/git-commit-and-push-util.md b/.opencode/agents/git-commit-and-push-util.md index 944dbefce..aea02330d 100644 --- a/.opencode/agents/git-commit-and-push-util.md +++ b/.opencode/agents/git-commit-and-push-util.md @@ -16,16 +16,16 @@ permission: "doom_loop": deny "question": deny - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow "sequential-thinking*": deny "context7*": deny diff --git a/.opencode/agents/git-commit-util.md b/.opencode/agents/git-commit-util.md index 8bff7b307..ae0865c75 100644 --- a/.opencode/agents/git-commit-util.md +++ b/.opencode/agents/git-commit-util.md @@ -19,16 +19,16 @@ permission: "question": deny # All agents are supposed to be working in isolated repos in `/tmp`, so this forces that - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow # I don't think MCP permissions work, but just in case they do these two should be the only ones usually allowed "sequential-thinking*": allow diff --git a/.opencode/agents/git-create-commit-util.md b/.opencode/agents/git-create-commit-util.md index c4764cafa..7eaa2b32a 100644 --- a/.opencode/agents/git-create-commit-util.md +++ b/.opencode/agents/git-create-commit-util.md @@ -17,16 +17,16 @@ permission: "doom_loop": deny "question": deny - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow "sequential-thinking*": deny "context7*": deny diff --git a/.opencode/agents/git-fetch-util.md b/.opencode/agents/git-fetch-util.md index 39ac7b275..4c1dffcb5 100644 --- a/.opencode/agents/git-fetch-util.md +++ b/.opencode/agents/git-fetch-util.md @@ -14,16 +14,16 @@ permission: "doom_loop": deny "question": deny - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow "sequential-thinking*": deny "context7*": deny diff --git a/.opencode/agents/git-force-push-with-lease-util.md b/.opencode/agents/git-force-push-with-lease-util.md index 39da804b9..71569d75d 100644 --- a/.opencode/agents/git-force-push-with-lease-util.md +++ b/.opencode/agents/git-force-push-with-lease-util.md @@ -16,16 +16,16 @@ permission: "doom_loop": deny "question": deny - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow "sequential-thinking*": deny "context7*": deny diff --git a/.opencode/agents/git-isolator-util.md b/.opencode/agents/git-isolator-util.md index 0678a4d9e..62c73255f 100644 --- a/.opencode/agents/git-isolator-util.md +++ b/.opencode/agents/git-isolator-util.md @@ -20,16 +20,16 @@ permission: "question": deny # All agents are supposed to be working in isolated repos in `/tmp`, so this forces that - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow # I don't think MCP permissions work, but just in case they do these two should be the only ones usually allowed "sequential-thinking*": deny diff --git a/.opencode/agents/git-push-util.md b/.opencode/agents/git-push-util.md index b20fc81ef..82766cfaa 100644 --- a/.opencode/agents/git-push-util.md +++ b/.opencode/agents/git-push-util.md @@ -15,16 +15,16 @@ permission: "doom_loop": deny "question": deny - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow "sequential-thinking*": deny "context7*": deny diff --git a/.opencode/agents/git-rebase-and-push-util.md b/.opencode/agents/git-rebase-and-push-util.md index e0787139e..6835ae064 100644 --- a/.opencode/agents/git-rebase-and-push-util.md +++ b/.opencode/agents/git-rebase-and-push-util.md @@ -16,16 +16,16 @@ permission: "doom_loop": deny "question": deny - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow "sequential-thinking*": deny "context7*": deny diff --git a/.opencode/agents/git-rebase-util.md b/.opencode/agents/git-rebase-util.md index ab7f37322..3c6c92504 100644 --- a/.opencode/agents/git-rebase-util.md +++ b/.opencode/agents/git-rebase-util.md @@ -23,16 +23,16 @@ permission: read: allow grep: allow glob: allow - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow # I don't think MCP permissions work, but just in case they do these two should be the only ones usually allowed "sequential-thinking*": allow diff --git a/.opencode/agents/git-stage-util.md b/.opencode/agents/git-stage-util.md index 29c7b472a..3049ae275 100644 --- a/.opencode/agents/git-stage-util.md +++ b/.opencode/agents/git-stage-util.md @@ -15,16 +15,16 @@ permission: "doom_loop": deny "question": deny - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow "sequential-thinking*": deny "context7*": deny diff --git a/.opencode/agents/implementation-supervisor.md b/.opencode/agents/implementation-supervisor.md index 4f6e99677..0d5def40a 100644 --- a/.opencode/agents/implementation-supervisor.md +++ b/.opencode/agents/implementation-supervisor.md @@ -26,16 +26,16 @@ permission: "question": deny # All agents are supposed to be working in isolated repos in `/tmp`, so this forces that - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow # I don't think MCP permissions work, but just in case they do these two should be the only ones usually allowed "sequential-thinking*": deny diff --git a/.opencode/agents/pr-merge-supervisor.md b/.opencode/agents/pr-merge-supervisor.md index d7a10cbfb..679a3e170 100644 --- a/.opencode/agents/pr-merge-supervisor.md +++ b/.opencode/agents/pr-merge-supervisor.md @@ -19,16 +19,16 @@ permission: "question": deny # All agents are supposed to be working in isolated repos in `/tmp`, so this forces that - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow # I don't think MCP permissions work, but just in case they do these two should be the only ones usually allowed "sequential-thinking*": deny diff --git a/.opencode/agents/pr-merge-worker.md b/.opencode/agents/pr-merge-worker.md index c6cf8f6f9..f1676aa6a 100644 --- a/.opencode/agents/pr-merge-worker.md +++ b/.opencode/agents/pr-merge-worker.md @@ -19,16 +19,16 @@ permission: "question": deny # All agents are supposed to be working in isolated repos in `/tmp`, so this forces that - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow # I don't think MCP permissions work, but just in case they do these two should be the only ones usually allowed "sequential-thinking*": allow diff --git a/.opencode/agents/pr-review-supervisor.md b/.opencode/agents/pr-review-supervisor.md index b64877242..eaa34f9d7 100644 --- a/.opencode/agents/pr-review-supervisor.md +++ b/.opencode/agents/pr-review-supervisor.md @@ -22,16 +22,16 @@ permission: "question": deny # All agents are supposed to be working in isolated repos in `/tmp`, so this forces that - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow # I don't think MCP permissions work, but just in case they do these two should be the only ones usually allowed "sequential-thinking*": deny diff --git a/.opencode/agents/pr-review-worker.md b/.opencode/agents/pr-review-worker.md index f0ce42fc9..aeb40552f 100644 --- a/.opencode/agents/pr-review-worker.md +++ b/.opencode/agents/pr-review-worker.md @@ -23,16 +23,16 @@ permission: "question": deny # All agents are supposed to be working in isolated repos in `/tmp`, so this forces that - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow # I don't think MCP permissions work, but just in case they do these two should be the only ones usually allowed "sequential-thinking*": allow diff --git a/.opencode/agents/session-health-full-util.md b/.opencode/agents/session-health-full-util.md index 13867b31f..04264fcfd 100644 --- a/.opencode/agents/session-health-full-util.md +++ b/.opencode/agents/session-health-full-util.md @@ -18,16 +18,16 @@ permission: "doom_loop": deny "question": deny - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow "sequential-thinking*": allow "context7*": deny diff --git a/.opencode/agents/session-health-quick-util.md b/.opencode/agents/session-health-quick-util.md index 1484d3ac4..7455355b6 100644 --- a/.opencode/agents/session-health-quick-util.md +++ b/.opencode/agents/session-health-quick-util.md @@ -18,16 +18,16 @@ permission: "doom_loop": deny "question": deny - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow "sequential-thinking*": allow "context7*": deny diff --git a/.opencode/agents/session-health-util.md b/.opencode/agents/session-health-util.md index e9bc5cad4..257a05a85 100644 --- a/.opencode/agents/session-health-util.md +++ b/.opencode/agents/session-health-util.md @@ -18,16 +18,16 @@ permission: "doom_loop": deny "question": deny - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow "sequential-thinking*": allow "context7*": deny diff --git a/.opencode/agents/supervisor.md b/.opencode/agents/supervisor.md index 2bef1d1c5..5c6c5bbbc 100644 --- a/.opencode/agents/supervisor.md +++ b/.opencode/agents/supervisor.md @@ -18,16 +18,16 @@ permission: "question": deny # All agents are supposed to be working in isolated repos in `/tmp`, so this forces that - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow # I don't think MCP permissions work, but just in case they do these two should be the only ones usually allowed "sequential-thinking*": allow diff --git a/.opencode/agents/task-implementor.md b/.opencode/agents/task-implementor.md index 5ebbf8d7e..4c6a3e00e 100644 --- a/.opencode/agents/task-implementor.md +++ b/.opencode/agents/task-implementor.md @@ -25,16 +25,16 @@ permission: "question": deny # All agents are supposed to be working in isolated repos in `/tmp`, so this forces that - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow # I don't think MCP permissions work, but just in case they do these two should be the only ones usually allowed "sequential-thinking*": allow diff --git a/.opencode/agents/tier-codex.md b/.opencode/agents/tier-codex.md index e795185e7..27ee0f834 100644 --- a/.opencode/agents/tier-codex.md +++ b/.opencode/agents/tier-codex.md @@ -22,16 +22,16 @@ permission: "question": deny # All agents are supposed to be working in isolated repos in `/tmp`, so this forces that - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow # I don't think MCP permissions work, but just in case they do these two should be the only ones usually allowed "sequential-thinking*": deny diff --git a/.opencode/agents/tier-gpt5-mini.md b/.opencode/agents/tier-gpt5-mini.md index c345b57ef..23013af17 100644 --- a/.opencode/agents/tier-gpt5-mini.md +++ b/.opencode/agents/tier-gpt5-mini.md @@ -21,16 +21,16 @@ permission: "question": deny # All agents are supposed to be working in isolated repos in `/tmp`, so this forces that - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow # I don't think MCP permissions work, but just in case they do these two should be the only ones usually allowed "sequential-thinking*": deny diff --git a/.opencode/agents/tier-gpt5-nano.md b/.opencode/agents/tier-gpt5-nano.md index c4b1b1ef8..e6eeb835d 100644 --- a/.opencode/agents/tier-gpt5-nano.md +++ b/.opencode/agents/tier-gpt5-nano.md @@ -21,16 +21,16 @@ permission: "question": deny # All agents are supposed to be working in isolated repos in `/tmp`, so this forces that - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow # I don't think MCP permissions work, but just in case they do these two should be the only ones usually allowed "sequential-thinking*": deny diff --git a/.opencode/agents/tier-haiku.md b/.opencode/agents/tier-haiku.md index 94d3a1f75..b985c19b5 100644 --- a/.opencode/agents/tier-haiku.md +++ b/.opencode/agents/tier-haiku.md @@ -21,16 +21,16 @@ permission: "question": deny # All agents are supposed to be working in isolated repos in `/tmp`, so this forces that - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow # I don't think MCP permissions work, but just in case they do these two should be the only ones usually allowed "sequential-thinking*": deny diff --git a/.opencode/agents/tier-o4-mini.md b/.opencode/agents/tier-o4-mini.md index 4798d506e..c57de3c7a 100644 --- a/.opencode/agents/tier-o4-mini.md +++ b/.opencode/agents/tier-o4-mini.md @@ -21,16 +21,16 @@ permission: "question": deny # All agents are supposed to be working in isolated repos in `/tmp`, so this forces that - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow # I don't think MCP permissions work, but just in case they do these two should be the only ones usually allowed "sequential-thinking*": deny diff --git a/.opencode/agents/tier-opus.md b/.opencode/agents/tier-opus.md index bba321ea5..87afaa11d 100644 --- a/.opencode/agents/tier-opus.md +++ b/.opencode/agents/tier-opus.md @@ -22,16 +22,16 @@ permission: "question": deny # All agents are supposed to be working in isolated repos in `/tmp`, so this forces that - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow # I don't think MCP permissions work, but just in case they do these two should be the only ones usually allowed "sequential-thinking*": deny diff --git a/.opencode/agents/tier-qwen.md b/.opencode/agents/tier-qwen.md index cd9c170f0..77bff32d6 100644 --- a/.opencode/agents/tier-qwen.md +++ b/.opencode/agents/tier-qwen.md @@ -21,16 +21,16 @@ permission: "question": deny # All agents are supposed to be working in isolated repos in `/tmp`, so this forces that - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow # I don't think MCP permissions work, but just in case they do these two should be the only ones usually allowed "sequential-thinking*": deny diff --git a/.opencode/agents/tier-sonnet.md b/.opencode/agents/tier-sonnet.md index 0e8a49ac4..0066f6514 100644 --- a/.opencode/agents/tier-sonnet.md +++ b/.opencode/agents/tier-sonnet.md @@ -21,16 +21,16 @@ permission: "question": deny # All agents are supposed to be working in isolated repos in `/tmp`, so this forces that - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow # I don't think MCP permissions work, but just in case they do these two should be the only ones usually allowed "sequential-thinking*": deny diff --git a/.opencode/agents/work-group-util.md b/.opencode/agents/work-group-util.md index 3ecbbe943..00e3aa143 100644 --- a/.opencode/agents/work-group-util.md +++ b/.opencode/agents/work-group-util.md @@ -20,16 +20,16 @@ permission: "question": deny # All agents are supposed to be working in isolated repos in `/tmp`, so this forces that - read: - "*": allow - write: - "*": deny + external_directory: "/tmp/*": allow edit: "*": deny "/tmp/*": allow - external_directory: + write: + "*": deny "/tmp/*": allow + read: + "*": allow # MCP permissions "sequential-thinking*": allow