fix(agent): request approval for protected path access

2026-09-25 15:44:46 +08:00
parent 0eab59c52e
commit 7f4918a1de
9 changed files with 214 additions and 78 deletions
@@ -14,42 +14,45 @@
  },
  "permission": {
    "*": "ask",
-    "external_directory": "deny",
+    "external_directory": {
+      "*": "ask",
+      "/app/.opencode/skills/*": "allow"
+    },
    "read": {
      "*": "allow",
-      ".env": "deny",
-      ".env.*": "deny",
-      "*.env": "deny",
-      "**/.env": "deny",
-      "**/.env.*": "deny",
-      "**/*.env": "deny",
-      "data/**": "deny",
-      "**/data/**": "deny",
-      "logs/**": "deny",
-      "**/logs/**": "deny"
+      ".env": "ask",
+      ".env.*": "ask",
+      "*.env": "ask",
+      "**/.env": "ask",
+      "**/.env.*": "ask",
+      "**/*.env": "ask",
+      "data/**": "ask",
+      "**/data/**": "ask",
+      "logs/**": "ask",
+      "**/logs/**": "ask"
    },
    "edit": {
      "*": "ask",
-      ".env": "deny",
-      ".env.*": "deny",
-      "*.env": "deny",
-      "**/.env": "deny",
-      "**/.env.*": "deny",
-      "**/*.env": "deny",
-      "data/**": "deny",
-      "**/data/**": "deny",
-      "logs/**": "deny",
-      "**/logs/**": "deny"
+      ".env": "ask",
+      ".env.*": "ask",
+      "*.env": "ask",
+      "**/.env": "ask",
+      "**/.env.*": "ask",
+      "**/*.env": "ask",
+      "data/**": "ask",
+      "**/data/**": "ask",
+      "logs/**": "ask",
+      "**/logs/**": "ask"
    },
    "bash": {
      "*": "ask",
      "rm *": "ask",
-      "rm -rf *": "deny",
-      "rm -fr *": "deny",
-      "rm -r -f *": "deny",
-      "rm -f -r *": "deny",
-      "rm --recursive --force *": "deny",
-      "rm --force --recursive *": "deny",
+      "rm -rf *": "ask",
+      "rm -fr *": "ask",
+      "rm -r -f *": "ask",
+      "rm -f -r *": "ask",
+      "rm --recursive --force *": "ask",
+      "rm --force --recursive *": "ask",
      "rmdir *": "ask",
      "mv *": "ask",
      "chmod *": "ask",
@@ -57,7 +60,7 @@
      "sudo *": "ask",
      "curl *": "ask",
      "wget *": "ask",
-      "*.env*": "deny"
+      "*.env*": "ask"
    },
    "question": "allow",
    "activity_update": "allow",