opencode.ci.jsonc
Rama main · réplica de lectura del repositorio original.
{
// ci-full, loaded from the trusted base checkout: keep in step with opencode.jsonc except agent permissions (file tools, shell allowlist, no prompts).
"$schema": "https://opencode.ai/config.json",
// Nothing here may reach into the PR tree: no `instructions`, no `skills`, no plugins.
"update": "disable",
"share": "disabled",
"snapshots": false,
// LSP servers would build the PR (rust-analyzer runs build scripts and proc macros).
"lsp": false,
"formatter": false,
// Policies refuse every other provider, including the bundled free ones; a review talks to one endpoint only.
"policies": [
{ "action": "provider.use", "resource": "*", "effect": "deny" },
{ "action": "provider.use", "resource": "anthropic-review", "effect": "allow" }
],
"providers": {
"anthropic-review": {
"name": "Anthropic (review)",
// Bundled in the opencode binary; its default endpoint is https://api.anthropic.com/v1.
"package": "@opencode/ai/providers/anthropic",
// Not ANTHROPIC_API_KEY, so no other provider opencode knows about can pick the key up.
"env": ["ANTHROPIC_REVIEW_API_KEY"],
"models": {
"claude-sonnet-5-5": {
"name": "Claude Sonnet 5.5",
// REVIEW_MODEL_VARIANT and REVIEW_COORDINATOR_VARIANT pick one; opencode sends adaptive thinking and "output_config": { "effort": "<id>" }.
"variants": [
{ "id": "low", "settings": { "thinking": { "type": "adaptive" }, "effort": "low" } },
{ "id": "medium", "settings": { "thinking": { "type": "adaptive" }, "effort": "medium" } },
{ "id": "high", "settings": { "thinking": { "type": "adaptive" }, "effort": "high" } },
{ "id": "xhigh", "settings": { "thinking": { "type": "adaptive" }, "effort": "xhigh" } },
{ "id": "max", "settings": { "thinking": { "type": "adaptive" }, "effort": "max" } }
],
"limit": { "context": 1000000, "output": 128000 }
}
}
},
// Denied by the policy above; kept so switching back needs no new provider block.
"deepseek-review": {
"name": "DeepSeek (review)",
// Bundled in the opencode binary, so nothing is installed at run time.
"package": "@opencode/ai/providers/openai-compatible",
"env": ["DEEPSEEK_API_KEY"],
"settings": { "baseURL": "https://api.deepseek.com" },
// DeepSeek reads max_tokens and returns its reasoning as reasoning_content.
"compatibility": { "maxTokensField": "max_tokens", "reasoningField": "reasoning_content" },
"models": {
"deepseek-flash": {
"name": "DeepSeek-V4.1-Flash",
// Selected with REVIEW_MODEL_VARIANT=max; opencode sends "reasoning_effort": "max".
"variants": [{ "id": "max", "settings": { "reasoningEffort": "max" } }],
"limit": { "context": 1048576, "output": 393216 }
}
}
}
},
"model": "anthropic-review/claude-sonnet-5-5",
// Last match wins after opencode's built-in defaults, so nothing asks; the shell allowlist guards cost, not secrets (see README).
"agents": {
"ai-review-security": {
"mode": "primary",
"model": "anthropic-review/claude-sonnet-5-5",
"permissions": [
{ "action": "*", "resource": "*", "effect": "allow" },
{ "action": "webfetch", "resource": "*", "effect": "deny" },
{ "action": "websearch", "resource": "*", "effect": "deny" },
{ "action": "subagent", "resource": "*", "effect": "deny" },
{ "action": "question", "resource": "*", "effect": "deny" },
{ "action": "execute", "resource": "*", "effect": "deny" },
{ "action": "skill", "resource": "*", "effect": "deny" },
{ "action": "shell", "resource": "*", "effect": "deny" },
{ "action": "shell", "resource": "git diff *", "effect": "allow" },
{ "action": "shell", "resource": "git log *", "effect": "allow" },
{ "action": "shell", "resource": "git show *", "effect": "allow" },
{ "action": "shell", "resource": "git blame *", "effect": "allow" },
{ "action": "shell", "resource": "git ls-files *", "effect": "allow" },
{ "action": "shell", "resource": "git status *", "effect": "allow" },
{ "action": "shell", "resource": "git rev-parse *", "effect": "allow" },
{ "action": "shell", "resource": "git merge-base *", "effect": "allow" },
{ "action": "shell", "resource": "git cat-file -p *", "effect": "allow" },
{ "action": "shell", "resource": "git cat-file -t *", "effect": "allow" },
{ "action": "shell", "resource": "git cat-file -s *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager diff *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager log *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager show *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager blame *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager ls-files *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager status *", "effect": "allow" },
{ "action": "shell", "resource": "rg *", "effect": "allow" },
{ "action": "shell", "resource": "grep *", "effect": "allow" },
{ "action": "shell", "resource": "cat *", "effect": "allow" },
{ "action": "shell", "resource": "ls *", "effect": "allow" },
{ "action": "shell", "resource": "head *", "effect": "allow" },
{ "action": "shell", "resource": "tail *", "effect": "allow" },
{ "action": "shell", "resource": "find *", "effect": "allow" },
{ "action": "shell", "resource": "sed -n *", "effect": "allow" },
{ "action": "shell", "resource": "wc *", "effect": "allow" },
{ "action": "shell", "resource": "tail -f *", "effect": "deny" },
{ "action": "shell", "resource": "tail * -f *", "effect": "deny" },
{ "action": "shell", "resource": "tail -F *", "effect": "deny" },
{ "action": "shell", "resource": "tail * -F *", "effect": "deny" },
{ "action": "shell", "resource": "tail --follow*", "effect": "deny" },
{ "action": "shell", "resource": "tail * --follow*", "effect": "deny" },
{ "action": "shell", "resource": "find -exec *", "effect": "deny" },
{ "action": "shell", "resource": "find * -exec *", "effect": "deny" },
{ "action": "shell", "resource": "find -execdir *", "effect": "deny" },
{ "action": "shell", "resource": "find * -execdir *", "effect": "deny" },
{ "action": "shell", "resource": "find -ok *", "effect": "deny" },
{ "action": "shell", "resource": "find * -ok *", "effect": "deny" },
{ "action": "shell", "resource": "find -okdir *", "effect": "deny" },
{ "action": "shell", "resource": "find * -okdir *", "effect": "deny" },
{ "action": "shell", "resource": "find -delete *", "effect": "deny" },
{ "action": "shell", "resource": "find * -delete *", "effect": "deny" },
{ "action": "shell", "resource": "find -fprint *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fprint *", "effect": "deny" },
{ "action": "shell", "resource": "find -fprint0 *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fprint0 *", "effect": "deny" },
{ "action": "shell", "resource": "find -fprintf *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fprintf *", "effect": "deny" },
{ "action": "shell", "resource": "find -fls *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fls *", "effect": "deny" },
{ "action": "shell", "resource": "cat /*", "effect": "deny" },
{ "action": "shell", "resource": "cat * /*", "effect": "deny" },
{ "action": "shell", "resource": "cat *../*", "effect": "deny" },
{ "action": "shell", "resource": "cat *=/*", "effect": "deny" },
{ "action": "shell", "resource": "cat *environ*", "effect": "deny" },
{ "action": "shell", "resource": "head /*", "effect": "deny" },
{ "action": "shell", "resource": "head * /*", "effect": "deny" },
{ "action": "shell", "resource": "head *../*", "effect": "deny" },
{ "action": "shell", "resource": "head *=/*", "effect": "deny" },
{ "action": "shell", "resource": "head *environ*", "effect": "deny" },
{ "action": "shell", "resource": "tail /*", "effect": "deny" },
{ "action": "shell", "resource": "tail * /*", "effect": "deny" },
{ "action": "shell", "resource": "tail *../*", "effect": "deny" },
{ "action": "shell", "resource": "tail *=/*", "effect": "deny" },
{ "action": "shell", "resource": "tail *environ*", "effect": "deny" },
{ "action": "shell", "resource": "grep /*", "effect": "deny" },
{ "action": "shell", "resource": "grep * /*", "effect": "deny" },
{ "action": "shell", "resource": "grep *../*", "effect": "deny" },
{ "action": "shell", "resource": "grep *=/*", "effect": "deny" },
{ "action": "shell", "resource": "grep *environ*", "effect": "deny" },
{ "action": "shell", "resource": "rg /*", "effect": "deny" },
{ "action": "shell", "resource": "rg * /*", "effect": "deny" },
{ "action": "shell", "resource": "rg *../*", "effect": "deny" },
{ "action": "shell", "resource": "rg *=/*", "effect": "deny" },
{ "action": "shell", "resource": "rg *environ*", "effect": "deny" },
{ "action": "shell", "resource": "sed /*", "effect": "deny" },
{ "action": "shell", "resource": "sed * /*", "effect": "deny" },
{ "action": "shell", "resource": "sed *../*", "effect": "deny" },
{ "action": "shell", "resource": "sed *=/*", "effect": "deny" },
{ "action": "shell", "resource": "sed *environ*", "effect": "deny" },
{ "action": "shell", "resource": "wc /*", "effect": "deny" },
{ "action": "shell", "resource": "wc * /*", "effect": "deny" },
{ "action": "shell", "resource": "wc *../*", "effect": "deny" },
{ "action": "shell", "resource": "wc *=/*", "effect": "deny" },
{ "action": "shell", "resource": "wc *environ*", "effect": "deny" },
{ "action": "shell", "resource": "*>*", "effect": "deny" }
]
},
"ai-review-correctness": {
"mode": "primary",
"model": "anthropic-review/claude-sonnet-5-5",
"permissions": [
{ "action": "*", "resource": "*", "effect": "allow" },
{ "action": "webfetch", "resource": "*", "effect": "deny" },
{ "action": "websearch", "resource": "*", "effect": "deny" },
{ "action": "subagent", "resource": "*", "effect": "deny" },
{ "action": "question", "resource": "*", "effect": "deny" },
{ "action": "execute", "resource": "*", "effect": "deny" },
{ "action": "skill", "resource": "*", "effect": "deny" },
{ "action": "shell", "resource": "*", "effect": "deny" },
{ "action": "shell", "resource": "git diff *", "effect": "allow" },
{ "action": "shell", "resource": "git log *", "effect": "allow" },
{ "action": "shell", "resource": "git show *", "effect": "allow" },
{ "action": "shell", "resource": "git blame *", "effect": "allow" },
{ "action": "shell", "resource": "git ls-files *", "effect": "allow" },
{ "action": "shell", "resource": "git status *", "effect": "allow" },
{ "action": "shell", "resource": "git rev-parse *", "effect": "allow" },
{ "action": "shell", "resource": "git merge-base *", "effect": "allow" },
{ "action": "shell", "resource": "git cat-file -p *", "effect": "allow" },
{ "action": "shell", "resource": "git cat-file -t *", "effect": "allow" },
{ "action": "shell", "resource": "git cat-file -s *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager diff *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager log *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager show *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager blame *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager ls-files *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager status *", "effect": "allow" },
{ "action": "shell", "resource": "rg *", "effect": "allow" },
{ "action": "shell", "resource": "grep *", "effect": "allow" },
{ "action": "shell", "resource": "cat *", "effect": "allow" },
{ "action": "shell", "resource": "ls *", "effect": "allow" },
{ "action": "shell", "resource": "head *", "effect": "allow" },
{ "action": "shell", "resource": "tail *", "effect": "allow" },
{ "action": "shell", "resource": "find *", "effect": "allow" },
{ "action": "shell", "resource": "sed -n *", "effect": "allow" },
{ "action": "shell", "resource": "wc *", "effect": "allow" },
{ "action": "shell", "resource": "tail -f *", "effect": "deny" },
{ "action": "shell", "resource": "tail * -f *", "effect": "deny" },
{ "action": "shell", "resource": "tail -F *", "effect": "deny" },
{ "action": "shell", "resource": "tail * -F *", "effect": "deny" },
{ "action": "shell", "resource": "tail --follow*", "effect": "deny" },
{ "action": "shell", "resource": "tail * --follow*", "effect": "deny" },
{ "action": "shell", "resource": "find -exec *", "effect": "deny" },
{ "action": "shell", "resource": "find * -exec *", "effect": "deny" },
{ "action": "shell", "resource": "find -execdir *", "effect": "deny" },
{ "action": "shell", "resource": "find * -execdir *", "effect": "deny" },
{ "action": "shell", "resource": "find -ok *", "effect": "deny" },
{ "action": "shell", "resource": "find * -ok *", "effect": "deny" },
{ "action": "shell", "resource": "find -okdir *", "effect": "deny" },
{ "action": "shell", "resource": "find * -okdir *", "effect": "deny" },
{ "action": "shell", "resource": "find -delete *", "effect": "deny" },
{ "action": "shell", "resource": "find * -delete *", "effect": "deny" },
{ "action": "shell", "resource": "find -fprint *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fprint *", "effect": "deny" },
{ "action": "shell", "resource": "find -fprint0 *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fprint0 *", "effect": "deny" },
{ "action": "shell", "resource": "find -fprintf *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fprintf *", "effect": "deny" },
{ "action": "shell", "resource": "find -fls *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fls *", "effect": "deny" },
{ "action": "shell", "resource": "cat /*", "effect": "deny" },
{ "action": "shell", "resource": "cat * /*", "effect": "deny" },
{ "action": "shell", "resource": "cat *../*", "effect": "deny" },
{ "action": "shell", "resource": "cat *=/*", "effect": "deny" },
{ "action": "shell", "resource": "cat *environ*", "effect": "deny" },
{ "action": "shell", "resource": "head /*", "effect": "deny" },
{ "action": "shell", "resource": "head * /*", "effect": "deny" },
{ "action": "shell", "resource": "head *../*", "effect": "deny" },
{ "action": "shell", "resource": "head *=/*", "effect": "deny" },
{ "action": "shell", "resource": "head *environ*", "effect": "deny" },
{ "action": "shell", "resource": "tail /*", "effect": "deny" },
{ "action": "shell", "resource": "tail * /*", "effect": "deny" },
{ "action": "shell", "resource": "tail *../*", "effect": "deny" },
{ "action": "shell", "resource": "tail *=/*", "effect": "deny" },
{ "action": "shell", "resource": "tail *environ*", "effect": "deny" },
{ "action": "shell", "resource": "grep /*", "effect": "deny" },
{ "action": "shell", "resource": "grep * /*", "effect": "deny" },
{ "action": "shell", "resource": "grep *../*", "effect": "deny" },
{ "action": "shell", "resource": "grep *=/*", "effect": "deny" },
{ "action": "shell", "resource": "grep *environ*", "effect": "deny" },
{ "action": "shell", "resource": "rg /*", "effect": "deny" },
{ "action": "shell", "resource": "rg * /*", "effect": "deny" },
{ "action": "shell", "resource": "rg *../*", "effect": "deny" },
{ "action": "shell", "resource": "rg *=/*", "effect": "deny" },
{ "action": "shell", "resource": "rg *environ*", "effect": "deny" },
{ "action": "shell", "resource": "sed /*", "effect": "deny" },
{ "action": "shell", "resource": "sed * /*", "effect": "deny" },
{ "action": "shell", "resource": "sed *../*", "effect": "deny" },
{ "action": "shell", "resource": "sed *=/*", "effect": "deny" },
{ "action": "shell", "resource": "sed *environ*", "effect": "deny" },
{ "action": "shell", "resource": "wc /*", "effect": "deny" },
{ "action": "shell", "resource": "wc * /*", "effect": "deny" },
{ "action": "shell", "resource": "wc *../*", "effect": "deny" },
{ "action": "shell", "resource": "wc *=/*", "effect": "deny" },
{ "action": "shell", "resource": "wc *environ*", "effect": "deny" },
{ "action": "shell", "resource": "*>*", "effect": "deny" }
]
},
"ai-review-code-quality": {
"mode": "primary",
"model": "anthropic-review/claude-sonnet-5-5",
"permissions": [
{ "action": "*", "resource": "*", "effect": "allow" },
{ "action": "webfetch", "resource": "*", "effect": "deny" },
{ "action": "websearch", "resource": "*", "effect": "deny" },
{ "action": "subagent", "resource": "*", "effect": "deny" },
{ "action": "question", "resource": "*", "effect": "deny" },
{ "action": "execute", "resource": "*", "effect": "deny" },
{ "action": "skill", "resource": "*", "effect": "deny" },
{ "action": "shell", "resource": "*", "effect": "deny" },
{ "action": "shell", "resource": "git diff *", "effect": "allow" },
{ "action": "shell", "resource": "git log *", "effect": "allow" },
{ "action": "shell", "resource": "git show *", "effect": "allow" },
{ "action": "shell", "resource": "git blame *", "effect": "allow" },
{ "action": "shell", "resource": "git ls-files *", "effect": "allow" },
{ "action": "shell", "resource": "git status *", "effect": "allow" },
{ "action": "shell", "resource": "git rev-parse *", "effect": "allow" },
{ "action": "shell", "resource": "git merge-base *", "effect": "allow" },
{ "action": "shell", "resource": "git cat-file -p *", "effect": "allow" },
{ "action": "shell", "resource": "git cat-file -t *", "effect": "allow" },
{ "action": "shell", "resource": "git cat-file -s *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager diff *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager log *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager show *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager blame *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager ls-files *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager status *", "effect": "allow" },
{ "action": "shell", "resource": "rg *", "effect": "allow" },
{ "action": "shell", "resource": "grep *", "effect": "allow" },
{ "action": "shell", "resource": "cat *", "effect": "allow" },
{ "action": "shell", "resource": "ls *", "effect": "allow" },
{ "action": "shell", "resource": "head *", "effect": "allow" },
{ "action": "shell", "resource": "tail *", "effect": "allow" },
{ "action": "shell", "resource": "find *", "effect": "allow" },
{ "action": "shell", "resource": "sed -n *", "effect": "allow" },
{ "action": "shell", "resource": "wc *", "effect": "allow" },
{ "action": "shell", "resource": "tail -f *", "effect": "deny" },
{ "action": "shell", "resource": "tail * -f *", "effect": "deny" },
{ "action": "shell", "resource": "tail -F *", "effect": "deny" },
{ "action": "shell", "resource": "tail * -F *", "effect": "deny" },
{ "action": "shell", "resource": "tail --follow*", "effect": "deny" },
{ "action": "shell", "resource": "tail * --follow*", "effect": "deny" },
{ "action": "shell", "resource": "find -exec *", "effect": "deny" },
{ "action": "shell", "resource": "find * -exec *", "effect": "deny" },
{ "action": "shell", "resource": "find -execdir *", "effect": "deny" },
{ "action": "shell", "resource": "find * -execdir *", "effect": "deny" },
{ "action": "shell", "resource": "find -ok *", "effect": "deny" },
{ "action": "shell", "resource": "find * -ok *", "effect": "deny" },
{ "action": "shell", "resource": "find -okdir *", "effect": "deny" },
{ "action": "shell", "resource": "find * -okdir *", "effect": "deny" },
{ "action": "shell", "resource": "find -delete *", "effect": "deny" },
{ "action": "shell", "resource": "find * -delete *", "effect": "deny" },
{ "action": "shell", "resource": "find -fprint *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fprint *", "effect": "deny" },
{ "action": "shell", "resource": "find -fprint0 *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fprint0 *", "effect": "deny" },
{ "action": "shell", "resource": "find -fprintf *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fprintf *", "effect": "deny" },
{ "action": "shell", "resource": "find -fls *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fls *", "effect": "deny" },
{ "action": "shell", "resource": "cat /*", "effect": "deny" },
{ "action": "shell", "resource": "cat * /*", "effect": "deny" },
{ "action": "shell", "resource": "cat *../*", "effect": "deny" },
{ "action": "shell", "resource": "cat *=/*", "effect": "deny" },
{ "action": "shell", "resource": "cat *environ*", "effect": "deny" },
{ "action": "shell", "resource": "head /*", "effect": "deny" },
{ "action": "shell", "resource": "head * /*", "effect": "deny" },
{ "action": "shell", "resource": "head *../*", "effect": "deny" },
{ "action": "shell", "resource": "head *=/*", "effect": "deny" },
{ "action": "shell", "resource": "head *environ*", "effect": "deny" },
{ "action": "shell", "resource": "tail /*", "effect": "deny" },
{ "action": "shell", "resource": "tail * /*", "effect": "deny" },
{ "action": "shell", "resource": "tail *../*", "effect": "deny" },
{ "action": "shell", "resource": "tail *=/*", "effect": "deny" },
{ "action": "shell", "resource": "tail *environ*", "effect": "deny" },
{ "action": "shell", "resource": "grep /*", "effect": "deny" },
{ "action": "shell", "resource": "grep * /*", "effect": "deny" },
{ "action": "shell", "resource": "grep *../*", "effect": "deny" },
{ "action": "shell", "resource": "grep *=/*", "effect": "deny" },
{ "action": "shell", "resource": "grep *environ*", "effect": "deny" },
{ "action": "shell", "resource": "rg /*", "effect": "deny" },
{ "action": "shell", "resource": "rg * /*", "effect": "deny" },
{ "action": "shell", "resource": "rg *../*", "effect": "deny" },
{ "action": "shell", "resource": "rg *=/*", "effect": "deny" },
{ "action": "shell", "resource": "rg *environ*", "effect": "deny" },
{ "action": "shell", "resource": "sed /*", "effect": "deny" },
{ "action": "shell", "resource": "sed * /*", "effect": "deny" },
{ "action": "shell", "resource": "sed *../*", "effect": "deny" },
{ "action": "shell", "resource": "sed *=/*", "effect": "deny" },
{ "action": "shell", "resource": "sed *environ*", "effect": "deny" },
{ "action": "shell", "resource": "wc /*", "effect": "deny" },
{ "action": "shell", "resource": "wc * /*", "effect": "deny" },
{ "action": "shell", "resource": "wc *../*", "effect": "deny" },
{ "action": "shell", "resource": "wc *=/*", "effect": "deny" },
{ "action": "shell", "resource": "wc *environ*", "effect": "deny" },
{ "action": "shell", "resource": "*>*", "effect": "deny" }
]
},
"ai-review-performance": {
"mode": "primary",
"model": "anthropic-review/claude-sonnet-5-5",
"permissions": [
{ "action": "*", "resource": "*", "effect": "allow" },
{ "action": "webfetch", "resource": "*", "effect": "deny" },
{ "action": "websearch", "resource": "*", "effect": "deny" },
{ "action": "subagent", "resource": "*", "effect": "deny" },
{ "action": "question", "resource": "*", "effect": "deny" },
{ "action": "execute", "resource": "*", "effect": "deny" },
{ "action": "skill", "resource": "*", "effect": "deny" },
{ "action": "shell", "resource": "*", "effect": "deny" },
{ "action": "shell", "resource": "git diff *", "effect": "allow" },
{ "action": "shell", "resource": "git log *", "effect": "allow" },
{ "action": "shell", "resource": "git show *", "effect": "allow" },
{ "action": "shell", "resource": "git blame *", "effect": "allow" },
{ "action": "shell", "resource": "git ls-files *", "effect": "allow" },
{ "action": "shell", "resource": "git status *", "effect": "allow" },
{ "action": "shell", "resource": "git rev-parse *", "effect": "allow" },
{ "action": "shell", "resource": "git merge-base *", "effect": "allow" },
{ "action": "shell", "resource": "git cat-file -p *", "effect": "allow" },
{ "action": "shell", "resource": "git cat-file -t *", "effect": "allow" },
{ "action": "shell", "resource": "git cat-file -s *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager diff *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager log *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager show *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager blame *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager ls-files *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager status *", "effect": "allow" },
{ "action": "shell", "resource": "rg *", "effect": "allow" },
{ "action": "shell", "resource": "grep *", "effect": "allow" },
{ "action": "shell", "resource": "cat *", "effect": "allow" },
{ "action": "shell", "resource": "ls *", "effect": "allow" },
{ "action": "shell", "resource": "head *", "effect": "allow" },
{ "action": "shell", "resource": "tail *", "effect": "allow" },
{ "action": "shell", "resource": "find *", "effect": "allow" },
{ "action": "shell", "resource": "sed -n *", "effect": "allow" },
{ "action": "shell", "resource": "wc *", "effect": "allow" },
{ "action": "shell", "resource": "tail -f *", "effect": "deny" },
{ "action": "shell", "resource": "tail * -f *", "effect": "deny" },
{ "action": "shell", "resource": "tail -F *", "effect": "deny" },
{ "action": "shell", "resource": "tail * -F *", "effect": "deny" },
{ "action": "shell", "resource": "tail --follow*", "effect": "deny" },
{ "action": "shell", "resource": "tail * --follow*", "effect": "deny" },
{ "action": "shell", "resource": "find -exec *", "effect": "deny" },
{ "action": "shell", "resource": "find * -exec *", "effect": "deny" },
{ "action": "shell", "resource": "find -execdir *", "effect": "deny" },
{ "action": "shell", "resource": "find * -execdir *", "effect": "deny" },
{ "action": "shell", "resource": "find -ok *", "effect": "deny" },
{ "action": "shell", "resource": "find * -ok *", "effect": "deny" },
{ "action": "shell", "resource": "find -okdir *", "effect": "deny" },
{ "action": "shell", "resource": "find * -okdir *", "effect": "deny" },
{ "action": "shell", "resource": "find -delete *", "effect": "deny" },
{ "action": "shell", "resource": "find * -delete *", "effect": "deny" },
{ "action": "shell", "resource": "find -fprint *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fprint *", "effect": "deny" },
{ "action": "shell", "resource": "find -fprint0 *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fprint0 *", "effect": "deny" },
{ "action": "shell", "resource": "find -fprintf *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fprintf *", "effect": "deny" },
{ "action": "shell", "resource": "find -fls *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fls *", "effect": "deny" },
{ "action": "shell", "resource": "cat /*", "effect": "deny" },
{ "action": "shell", "resource": "cat * /*", "effect": "deny" },
{ "action": "shell", "resource": "cat *../*", "effect": "deny" },
{ "action": "shell", "resource": "cat *=/*", "effect": "deny" },
{ "action": "shell", "resource": "cat *environ*", "effect": "deny" },
{ "action": "shell", "resource": "head /*", "effect": "deny" },
{ "action": "shell", "resource": "head * /*", "effect": "deny" },
{ "action": "shell", "resource": "head *../*", "effect": "deny" },
{ "action": "shell", "resource": "head *=/*", "effect": "deny" },
{ "action": "shell", "resource": "head *environ*", "effect": "deny" },
{ "action": "shell", "resource": "tail /*", "effect": "deny" },
{ "action": "shell", "resource": "tail * /*", "effect": "deny" },
{ "action": "shell", "resource": "tail *../*", "effect": "deny" },
{ "action": "shell", "resource": "tail *=/*", "effect": "deny" },
{ "action": "shell", "resource": "tail *environ*", "effect": "deny" },
{ "action": "shell", "resource": "grep /*", "effect": "deny" },
{ "action": "shell", "resource": "grep * /*", "effect": "deny" },
{ "action": "shell", "resource": "grep *../*", "effect": "deny" },
{ "action": "shell", "resource": "grep *=/*", "effect": "deny" },
{ "action": "shell", "resource": "grep *environ*", "effect": "deny" },
{ "action": "shell", "resource": "rg /*", "effect": "deny" },
{ "action": "shell", "resource": "rg * /*", "effect": "deny" },
{ "action": "shell", "resource": "rg *../*", "effect": "deny" },
{ "action": "shell", "resource": "rg *=/*", "effect": "deny" },
{ "action": "shell", "resource": "rg *environ*", "effect": "deny" },
{ "action": "shell", "resource": "sed /*", "effect": "deny" },
{ "action": "shell", "resource": "sed * /*", "effect": "deny" },
{ "action": "shell", "resource": "sed *../*", "effect": "deny" },
{ "action": "shell", "resource": "sed *=/*", "effect": "deny" },
{ "action": "shell", "resource": "sed *environ*", "effect": "deny" },
{ "action": "shell", "resource": "wc /*", "effect": "deny" },
{ "action": "shell", "resource": "wc * /*", "effect": "deny" },
{ "action": "shell", "resource": "wc *../*", "effect": "deny" },
{ "action": "shell", "resource": "wc *=/*", "effect": "deny" },
{ "action": "shell", "resource": "wc *environ*", "effect": "deny" },
{ "action": "shell", "resource": "*>*", "effect": "deny" }
]
},
"ai-review-documentation": {
"mode": "primary",
"model": "anthropic-review/claude-sonnet-5-5",
"permissions": [
{ "action": "*", "resource": "*", "effect": "allow" },
{ "action": "webfetch", "resource": "*", "effect": "deny" },
{ "action": "websearch", "resource": "*", "effect": "deny" },
{ "action": "subagent", "resource": "*", "effect": "deny" },
{ "action": "question", "resource": "*", "effect": "deny" },
{ "action": "execute", "resource": "*", "effect": "deny" },
{ "action": "skill", "resource": "*", "effect": "deny" },
{ "action": "shell", "resource": "*", "effect": "deny" },
{ "action": "shell", "resource": "git diff *", "effect": "allow" },
{ "action": "shell", "resource": "git log *", "effect": "allow" },
{ "action": "shell", "resource": "git show *", "effect": "allow" },
{ "action": "shell", "resource": "git blame *", "effect": "allow" },
{ "action": "shell", "resource": "git ls-files *", "effect": "allow" },
{ "action": "shell", "resource": "git status *", "effect": "allow" },
{ "action": "shell", "resource": "git rev-parse *", "effect": "allow" },
{ "action": "shell", "resource": "git merge-base *", "effect": "allow" },
{ "action": "shell", "resource": "git cat-file -p *", "effect": "allow" },
{ "action": "shell", "resource": "git cat-file -t *", "effect": "allow" },
{ "action": "shell", "resource": "git cat-file -s *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager diff *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager log *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager show *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager blame *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager ls-files *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager status *", "effect": "allow" },
{ "action": "shell", "resource": "rg *", "effect": "allow" },
{ "action": "shell", "resource": "grep *", "effect": "allow" },
{ "action": "shell", "resource": "cat *", "effect": "allow" },
{ "action": "shell", "resource": "ls *", "effect": "allow" },
{ "action": "shell", "resource": "head *", "effect": "allow" },
{ "action": "shell", "resource": "tail *", "effect": "allow" },
{ "action": "shell", "resource": "find *", "effect": "allow" },
{ "action": "shell", "resource": "sed -n *", "effect": "allow" },
{ "action": "shell", "resource": "wc *", "effect": "allow" },
{ "action": "shell", "resource": "tail -f *", "effect": "deny" },
{ "action": "shell", "resource": "tail * -f *", "effect": "deny" },
{ "action": "shell", "resource": "tail -F *", "effect": "deny" },
{ "action": "shell", "resource": "tail * -F *", "effect": "deny" },
{ "action": "shell", "resource": "tail --follow*", "effect": "deny" },
{ "action": "shell", "resource": "tail * --follow*", "effect": "deny" },
{ "action": "shell", "resource": "find -exec *", "effect": "deny" },
{ "action": "shell", "resource": "find * -exec *", "effect": "deny" },
{ "action": "shell", "resource": "find -execdir *", "effect": "deny" },
{ "action": "shell", "resource": "find * -execdir *", "effect": "deny" },
{ "action": "shell", "resource": "find -ok *", "effect": "deny" },
{ "action": "shell", "resource": "find * -ok *", "effect": "deny" },
{ "action": "shell", "resource": "find -okdir *", "effect": "deny" },
{ "action": "shell", "resource": "find * -okdir *", "effect": "deny" },
{ "action": "shell", "resource": "find -delete *", "effect": "deny" },
{ "action": "shell", "resource": "find * -delete *", "effect": "deny" },
{ "action": "shell", "resource": "find -fprint *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fprint *", "effect": "deny" },
{ "action": "shell", "resource": "find -fprint0 *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fprint0 *", "effect": "deny" },
{ "action": "shell", "resource": "find -fprintf *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fprintf *", "effect": "deny" },
{ "action": "shell", "resource": "find -fls *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fls *", "effect": "deny" },
{ "action": "shell", "resource": "cat /*", "effect": "deny" },
{ "action": "shell", "resource": "cat * /*", "effect": "deny" },
{ "action": "shell", "resource": "cat *../*", "effect": "deny" },
{ "action": "shell", "resource": "cat *=/*", "effect": "deny" },
{ "action": "shell", "resource": "cat *environ*", "effect": "deny" },
{ "action": "shell", "resource": "head /*", "effect": "deny" },
{ "action": "shell", "resource": "head * /*", "effect": "deny" },
{ "action": "shell", "resource": "head *../*", "effect": "deny" },
{ "action": "shell", "resource": "head *=/*", "effect": "deny" },
{ "action": "shell", "resource": "head *environ*", "effect": "deny" },
{ "action": "shell", "resource": "tail /*", "effect": "deny" },
{ "action": "shell", "resource": "tail * /*", "effect": "deny" },
{ "action": "shell", "resource": "tail *../*", "effect": "deny" },
{ "action": "shell", "resource": "tail *=/*", "effect": "deny" },
{ "action": "shell", "resource": "tail *environ*", "effect": "deny" },
{ "action": "shell", "resource": "grep /*", "effect": "deny" },
{ "action": "shell", "resource": "grep * /*", "effect": "deny" },
{ "action": "shell", "resource": "grep *../*", "effect": "deny" },
{ "action": "shell", "resource": "grep *=/*", "effect": "deny" },
{ "action": "shell", "resource": "grep *environ*", "effect": "deny" },
{ "action": "shell", "resource": "rg /*", "effect": "deny" },
{ "action": "shell", "resource": "rg * /*", "effect": "deny" },
{ "action": "shell", "resource": "rg *../*", "effect": "deny" },
{ "action": "shell", "resource": "rg *=/*", "effect": "deny" },
{ "action": "shell", "resource": "rg *environ*", "effect": "deny" },
{ "action": "shell", "resource": "sed /*", "effect": "deny" },
{ "action": "shell", "resource": "sed * /*", "effect": "deny" },
{ "action": "shell", "resource": "sed *../*", "effect": "deny" },
{ "action": "shell", "resource": "sed *=/*", "effect": "deny" },
{ "action": "shell", "resource": "sed *environ*", "effect": "deny" },
{ "action": "shell", "resource": "wc /*", "effect": "deny" },
{ "action": "shell", "resource": "wc * /*", "effect": "deny" },
{ "action": "shell", "resource": "wc *../*", "effect": "deny" },
{ "action": "shell", "resource": "wc *=/*", "effect": "deny" },
{ "action": "shell", "resource": "wc *environ*", "effect": "deny" },
{ "action": "shell", "resource": "*>*", "effect": "deny" }
]
},
"ai-review-release": {
"mode": "primary",
"model": "anthropic-review/claude-sonnet-5-5",
"permissions": [
{ "action": "*", "resource": "*", "effect": "allow" },
{ "action": "webfetch", "resource": "*", "effect": "deny" },
{ "action": "websearch", "resource": "*", "effect": "deny" },
{ "action": "subagent", "resource": "*", "effect": "deny" },
{ "action": "question", "resource": "*", "effect": "deny" },
{ "action": "execute", "resource": "*", "effect": "deny" },
{ "action": "skill", "resource": "*", "effect": "deny" },
{ "action": "shell", "resource": "*", "effect": "deny" },
{ "action": "shell", "resource": "git diff *", "effect": "allow" },
{ "action": "shell", "resource": "git log *", "effect": "allow" },
{ "action": "shell", "resource": "git show *", "effect": "allow" },
{ "action": "shell", "resource": "git blame *", "effect": "allow" },
{ "action": "shell", "resource": "git ls-files *", "effect": "allow" },
{ "action": "shell", "resource": "git status *", "effect": "allow" },
{ "action": "shell", "resource": "git rev-parse *", "effect": "allow" },
{ "action": "shell", "resource": "git merge-base *", "effect": "allow" },
{ "action": "shell", "resource": "git cat-file -p *", "effect": "allow" },
{ "action": "shell", "resource": "git cat-file -t *", "effect": "allow" },
{ "action": "shell", "resource": "git cat-file -s *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager diff *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager log *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager show *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager blame *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager ls-files *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager status *", "effect": "allow" },
{ "action": "shell", "resource": "rg *", "effect": "allow" },
{ "action": "shell", "resource": "grep *", "effect": "allow" },
{ "action": "shell", "resource": "cat *", "effect": "allow" },
{ "action": "shell", "resource": "ls *", "effect": "allow" },
{ "action": "shell", "resource": "head *", "effect": "allow" },
{ "action": "shell", "resource": "tail *", "effect": "allow" },
{ "action": "shell", "resource": "find *", "effect": "allow" },
{ "action": "shell", "resource": "sed -n *", "effect": "allow" },
{ "action": "shell", "resource": "wc *", "effect": "allow" },
{ "action": "shell", "resource": "tail -f *", "effect": "deny" },
{ "action": "shell", "resource": "tail * -f *", "effect": "deny" },
{ "action": "shell", "resource": "tail -F *", "effect": "deny" },
{ "action": "shell", "resource": "tail * -F *", "effect": "deny" },
{ "action": "shell", "resource": "tail --follow*", "effect": "deny" },
{ "action": "shell", "resource": "tail * --follow*", "effect": "deny" },
{ "action": "shell", "resource": "find -exec *", "effect": "deny" },
{ "action": "shell", "resource": "find * -exec *", "effect": "deny" },
{ "action": "shell", "resource": "find -execdir *", "effect": "deny" },
{ "action": "shell", "resource": "find * -execdir *", "effect": "deny" },
{ "action": "shell", "resource": "find -ok *", "effect": "deny" },
{ "action": "shell", "resource": "find * -ok *", "effect": "deny" },
{ "action": "shell", "resource": "find -okdir *", "effect": "deny" },
{ "action": "shell", "resource": "find * -okdir *", "effect": "deny" },
{ "action": "shell", "resource": "find -delete *", "effect": "deny" },
{ "action": "shell", "resource": "find * -delete *", "effect": "deny" },
{ "action": "shell", "resource": "find -fprint *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fprint *", "effect": "deny" },
{ "action": "shell", "resource": "find -fprint0 *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fprint0 *", "effect": "deny" },
{ "action": "shell", "resource": "find -fprintf *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fprintf *", "effect": "deny" },
{ "action": "shell", "resource": "find -fls *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fls *", "effect": "deny" },
{ "action": "shell", "resource": "cat /*", "effect": "deny" },
{ "action": "shell", "resource": "cat * /*", "effect": "deny" },
{ "action": "shell", "resource": "cat *../*", "effect": "deny" },
{ "action": "shell", "resource": "cat *=/*", "effect": "deny" },
{ "action": "shell", "resource": "cat *environ*", "effect": "deny" },
{ "action": "shell", "resource": "head /*", "effect": "deny" },
{ "action": "shell", "resource": "head * /*", "effect": "deny" },
{ "action": "shell", "resource": "head *../*", "effect": "deny" },
{ "action": "shell", "resource": "head *=/*", "effect": "deny" },
{ "action": "shell", "resource": "head *environ*", "effect": "deny" },
{ "action": "shell", "resource": "tail /*", "effect": "deny" },
{ "action": "shell", "resource": "tail * /*", "effect": "deny" },
{ "action": "shell", "resource": "tail *../*", "effect": "deny" },
{ "action": "shell", "resource": "tail *=/*", "effect": "deny" },
{ "action": "shell", "resource": "tail *environ*", "effect": "deny" },
{ "action": "shell", "resource": "grep /*", "effect": "deny" },
{ "action": "shell", "resource": "grep * /*", "effect": "deny" },
{ "action": "shell", "resource": "grep *../*", "effect": "deny" },
{ "action": "shell", "resource": "grep *=/*", "effect": "deny" },
{ "action": "shell", "resource": "grep *environ*", "effect": "deny" },
{ "action": "shell", "resource": "rg /*", "effect": "deny" },
{ "action": "shell", "resource": "rg * /*", "effect": "deny" },
{ "action": "shell", "resource": "rg *../*", "effect": "deny" },
{ "action": "shell", "resource": "rg *=/*", "effect": "deny" },
{ "action": "shell", "resource": "rg *environ*", "effect": "deny" },
{ "action": "shell", "resource": "sed /*", "effect": "deny" },
{ "action": "shell", "resource": "sed * /*", "effect": "deny" },
{ "action": "shell", "resource": "sed *../*", "effect": "deny" },
{ "action": "shell", "resource": "sed *=/*", "effect": "deny" },
{ "action": "shell", "resource": "sed *environ*", "effect": "deny" },
{ "action": "shell", "resource": "wc /*", "effect": "deny" },
{ "action": "shell", "resource": "wc * /*", "effect": "deny" },
{ "action": "shell", "resource": "wc *../*", "effect": "deny" },
{ "action": "shell", "resource": "wc *=/*", "effect": "deny" },
{ "action": "shell", "resource": "wc *environ*", "effect": "deny" },
{ "action": "shell", "resource": "*>*", "effect": "deny" }
]
},
"ai-review-frontend": {
"mode": "primary",
"model": "anthropic-review/claude-sonnet-5-5",
"permissions": [
{ "action": "*", "resource": "*", "effect": "allow" },
{ "action": "webfetch", "resource": "*", "effect": "deny" },
{ "action": "websearch", "resource": "*", "effect": "deny" },
{ "action": "subagent", "resource": "*", "effect": "deny" },
{ "action": "question", "resource": "*", "effect": "deny" },
{ "action": "execute", "resource": "*", "effect": "deny" },
{ "action": "skill", "resource": "*", "effect": "deny" },
{ "action": "shell", "resource": "*", "effect": "deny" },
{ "action": "shell", "resource": "git diff *", "effect": "allow" },
{ "action": "shell", "resource": "git log *", "effect": "allow" },
{ "action": "shell", "resource": "git show *", "effect": "allow" },
{ "action": "shell", "resource": "git blame *", "effect": "allow" },
{ "action": "shell", "resource": "git ls-files *", "effect": "allow" },
{ "action": "shell", "resource": "git status *", "effect": "allow" },
{ "action": "shell", "resource": "git rev-parse *", "effect": "allow" },
{ "action": "shell", "resource": "git merge-base *", "effect": "allow" },
{ "action": "shell", "resource": "git cat-file -p *", "effect": "allow" },
{ "action": "shell", "resource": "git cat-file -t *", "effect": "allow" },
{ "action": "shell", "resource": "git cat-file -s *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager diff *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager log *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager show *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager blame *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager ls-files *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager status *", "effect": "allow" },
{ "action": "shell", "resource": "rg *", "effect": "allow" },
{ "action": "shell", "resource": "grep *", "effect": "allow" },
{ "action": "shell", "resource": "cat *", "effect": "allow" },
{ "action": "shell", "resource": "ls *", "effect": "allow" },
{ "action": "shell", "resource": "head *", "effect": "allow" },
{ "action": "shell", "resource": "tail *", "effect": "allow" },
{ "action": "shell", "resource": "find *", "effect": "allow" },
{ "action": "shell", "resource": "sed -n *", "effect": "allow" },
{ "action": "shell", "resource": "wc *", "effect": "allow" },
{ "action": "shell", "resource": "tail -f *", "effect": "deny" },
{ "action": "shell", "resource": "tail * -f *", "effect": "deny" },
{ "action": "shell", "resource": "tail -F *", "effect": "deny" },
{ "action": "shell", "resource": "tail * -F *", "effect": "deny" },
{ "action": "shell", "resource": "tail --follow*", "effect": "deny" },
{ "action": "shell", "resource": "tail * --follow*", "effect": "deny" },
{ "action": "shell", "resource": "find -exec *", "effect": "deny" },
{ "action": "shell", "resource": "find * -exec *", "effect": "deny" },
{ "action": "shell", "resource": "find -execdir *", "effect": "deny" },
{ "action": "shell", "resource": "find * -execdir *", "effect": "deny" },
{ "action": "shell", "resource": "find -ok *", "effect": "deny" },
{ "action": "shell", "resource": "find * -ok *", "effect": "deny" },
{ "action": "shell", "resource": "find -okdir *", "effect": "deny" },
{ "action": "shell", "resource": "find * -okdir *", "effect": "deny" },
{ "action": "shell", "resource": "find -delete *", "effect": "deny" },
{ "action": "shell", "resource": "find * -delete *", "effect": "deny" },
{ "action": "shell", "resource": "find -fprint *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fprint *", "effect": "deny" },
{ "action": "shell", "resource": "find -fprint0 *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fprint0 *", "effect": "deny" },
{ "action": "shell", "resource": "find -fprintf *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fprintf *", "effect": "deny" },
{ "action": "shell", "resource": "find -fls *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fls *", "effect": "deny" },
{ "action": "shell", "resource": "cat /*", "effect": "deny" },
{ "action": "shell", "resource": "cat * /*", "effect": "deny" },
{ "action": "shell", "resource": "cat *../*", "effect": "deny" },
{ "action": "shell", "resource": "cat *=/*", "effect": "deny" },
{ "action": "shell", "resource": "cat *environ*", "effect": "deny" },
{ "action": "shell", "resource": "head /*", "effect": "deny" },
{ "action": "shell", "resource": "head * /*", "effect": "deny" },
{ "action": "shell", "resource": "head *../*", "effect": "deny" },
{ "action": "shell", "resource": "head *=/*", "effect": "deny" },
{ "action": "shell", "resource": "head *environ*", "effect": "deny" },
{ "action": "shell", "resource": "tail /*", "effect": "deny" },
{ "action": "shell", "resource": "tail * /*", "effect": "deny" },
{ "action": "shell", "resource": "tail *../*", "effect": "deny" },
{ "action": "shell", "resource": "tail *=/*", "effect": "deny" },
{ "action": "shell", "resource": "tail *environ*", "effect": "deny" },
{ "action": "shell", "resource": "grep /*", "effect": "deny" },
{ "action": "shell", "resource": "grep * /*", "effect": "deny" },
{ "action": "shell", "resource": "grep *../*", "effect": "deny" },
{ "action": "shell", "resource": "grep *=/*", "effect": "deny" },
{ "action": "shell", "resource": "grep *environ*", "effect": "deny" },
{ "action": "shell", "resource": "rg /*", "effect": "deny" },
{ "action": "shell", "resource": "rg * /*", "effect": "deny" },
{ "action": "shell", "resource": "rg *../*", "effect": "deny" },
{ "action": "shell", "resource": "rg *=/*", "effect": "deny" },
{ "action": "shell", "resource": "rg *environ*", "effect": "deny" },
{ "action": "shell", "resource": "sed /*", "effect": "deny" },
{ "action": "shell", "resource": "sed * /*", "effect": "deny" },
{ "action": "shell", "resource": "sed *../*", "effect": "deny" },
{ "action": "shell", "resource": "sed *=/*", "effect": "deny" },
{ "action": "shell", "resource": "sed *environ*", "effect": "deny" },
{ "action": "shell", "resource": "wc /*", "effect": "deny" },
{ "action": "shell", "resource": "wc * /*", "effect": "deny" },
{ "action": "shell", "resource": "wc *../*", "effect": "deny" },
{ "action": "shell", "resource": "wc *=/*", "effect": "deny" },
{ "action": "shell", "resource": "wc *environ*", "effect": "deny" },
{ "action": "shell", "resource": "*>*", "effect": "deny" }
]
},
"ai-review-qa": {
"mode": "primary",
"model": "anthropic-review/claude-sonnet-5-5",
"permissions": [
{ "action": "*", "resource": "*", "effect": "allow" },
{ "action": "webfetch", "resource": "*", "effect": "deny" },
{ "action": "websearch", "resource": "*", "effect": "deny" },
{ "action": "subagent", "resource": "*", "effect": "deny" },
{ "action": "question", "resource": "*", "effect": "deny" },
{ "action": "execute", "resource": "*", "effect": "deny" },
{ "action": "skill", "resource": "*", "effect": "deny" },
{ "action": "shell", "resource": "*", "effect": "deny" },
{ "action": "shell", "resource": "git diff *", "effect": "allow" },
{ "action": "shell", "resource": "git log *", "effect": "allow" },
{ "action": "shell", "resource": "git show *", "effect": "allow" },
{ "action": "shell", "resource": "git blame *", "effect": "allow" },
{ "action": "shell", "resource": "git ls-files *", "effect": "allow" },
{ "action": "shell", "resource": "git status *", "effect": "allow" },
{ "action": "shell", "resource": "git rev-parse *", "effect": "allow" },
{ "action": "shell", "resource": "git merge-base *", "effect": "allow" },
{ "action": "shell", "resource": "git cat-file -p *", "effect": "allow" },
{ "action": "shell", "resource": "git cat-file -t *", "effect": "allow" },
{ "action": "shell", "resource": "git cat-file -s *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager diff *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager log *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager show *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager blame *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager ls-files *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager status *", "effect": "allow" },
{ "action": "shell", "resource": "rg *", "effect": "allow" },
{ "action": "shell", "resource": "grep *", "effect": "allow" },
{ "action": "shell", "resource": "cat *", "effect": "allow" },
{ "action": "shell", "resource": "ls *", "effect": "allow" },
{ "action": "shell", "resource": "head *", "effect": "allow" },
{ "action": "shell", "resource": "tail *", "effect": "allow" },
{ "action": "shell", "resource": "find *", "effect": "allow" },
{ "action": "shell", "resource": "sed -n *", "effect": "allow" },
{ "action": "shell", "resource": "wc *", "effect": "allow" },
{ "action": "shell", "resource": "tail -f *", "effect": "deny" },
{ "action": "shell", "resource": "tail * -f *", "effect": "deny" },
{ "action": "shell", "resource": "tail -F *", "effect": "deny" },
{ "action": "shell", "resource": "tail * -F *", "effect": "deny" },
{ "action": "shell", "resource": "tail --follow*", "effect": "deny" },
{ "action": "shell", "resource": "tail * --follow*", "effect": "deny" },
{ "action": "shell", "resource": "find -exec *", "effect": "deny" },
{ "action": "shell", "resource": "find * -exec *", "effect": "deny" },
{ "action": "shell", "resource": "find -execdir *", "effect": "deny" },
{ "action": "shell", "resource": "find * -execdir *", "effect": "deny" },
{ "action": "shell", "resource": "find -ok *", "effect": "deny" },
{ "action": "shell", "resource": "find * -ok *", "effect": "deny" },
{ "action": "shell", "resource": "find -okdir *", "effect": "deny" },
{ "action": "shell", "resource": "find * -okdir *", "effect": "deny" },
{ "action": "shell", "resource": "find -delete *", "effect": "deny" },
{ "action": "shell", "resource": "find * -delete *", "effect": "deny" },
{ "action": "shell", "resource": "find -fprint *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fprint *", "effect": "deny" },
{ "action": "shell", "resource": "find -fprint0 *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fprint0 *", "effect": "deny" },
{ "action": "shell", "resource": "find -fprintf *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fprintf *", "effect": "deny" },
{ "action": "shell", "resource": "find -fls *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fls *", "effect": "deny" },
{ "action": "shell", "resource": "cat /*", "effect": "deny" },
{ "action": "shell", "resource": "cat * /*", "effect": "deny" },
{ "action": "shell", "resource": "cat *../*", "effect": "deny" },
{ "action": "shell", "resource": "cat *=/*", "effect": "deny" },
{ "action": "shell", "resource": "cat *environ*", "effect": "deny" },
{ "action": "shell", "resource": "head /*", "effect": "deny" },
{ "action": "shell", "resource": "head * /*", "effect": "deny" },
{ "action": "shell", "resource": "head *../*", "effect": "deny" },
{ "action": "shell", "resource": "head *=/*", "effect": "deny" },
{ "action": "shell", "resource": "head *environ*", "effect": "deny" },
{ "action": "shell", "resource": "tail /*", "effect": "deny" },
{ "action": "shell", "resource": "tail * /*", "effect": "deny" },
{ "action": "shell", "resource": "tail *../*", "effect": "deny" },
{ "action": "shell", "resource": "tail *=/*", "effect": "deny" },
{ "action": "shell", "resource": "tail *environ*", "effect": "deny" },
{ "action": "shell", "resource": "grep /*", "effect": "deny" },
{ "action": "shell", "resource": "grep * /*", "effect": "deny" },
{ "action": "shell", "resource": "grep *../*", "effect": "deny" },
{ "action": "shell", "resource": "grep *=/*", "effect": "deny" },
{ "action": "shell", "resource": "grep *environ*", "effect": "deny" },
{ "action": "shell", "resource": "rg /*", "effect": "deny" },
{ "action": "shell", "resource": "rg * /*", "effect": "deny" },
{ "action": "shell", "resource": "rg *../*", "effect": "deny" },
{ "action": "shell", "resource": "rg *=/*", "effect": "deny" },
{ "action": "shell", "resource": "rg *environ*", "effect": "deny" },
{ "action": "shell", "resource": "sed /*", "effect": "deny" },
{ "action": "shell", "resource": "sed * /*", "effect": "deny" },
{ "action": "shell", "resource": "sed *../*", "effect": "deny" },
{ "action": "shell", "resource": "sed *=/*", "effect": "deny" },
{ "action": "shell", "resource": "sed *environ*", "effect": "deny" },
{ "action": "shell", "resource": "wc /*", "effect": "deny" },
{ "action": "shell", "resource": "wc * /*", "effect": "deny" },
{ "action": "shell", "resource": "wc *../*", "effect": "deny" },
{ "action": "shell", "resource": "wc *=/*", "effect": "deny" },
{ "action": "shell", "resource": "wc *environ*", "effect": "deny" },
{ "action": "shell", "resource": "*>*", "effect": "deny" }
]
},
"ai-review-coordinator": {
"mode": "primary",
"model": "anthropic-review/claude-sonnet-5-5",
"permissions": [
{ "action": "*", "resource": "*", "effect": "allow" },
{ "action": "webfetch", "resource": "*", "effect": "deny" },
{ "action": "websearch", "resource": "*", "effect": "deny" },
{ "action": "subagent", "resource": "*", "effect": "deny" },
{ "action": "question", "resource": "*", "effect": "deny" },
{ "action": "execute", "resource": "*", "effect": "deny" },
{ "action": "skill", "resource": "*", "effect": "deny" },
{ "action": "shell", "resource": "*", "effect": "deny" },
{ "action": "shell", "resource": "git diff *", "effect": "allow" },
{ "action": "shell", "resource": "git log *", "effect": "allow" },
{ "action": "shell", "resource": "git show *", "effect": "allow" },
{ "action": "shell", "resource": "git blame *", "effect": "allow" },
{ "action": "shell", "resource": "git ls-files *", "effect": "allow" },
{ "action": "shell", "resource": "git status *", "effect": "allow" },
{ "action": "shell", "resource": "git rev-parse *", "effect": "allow" },
{ "action": "shell", "resource": "git merge-base *", "effect": "allow" },
{ "action": "shell", "resource": "git cat-file -p *", "effect": "allow" },
{ "action": "shell", "resource": "git cat-file -t *", "effect": "allow" },
{ "action": "shell", "resource": "git cat-file -s *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager diff *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager log *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager show *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager blame *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager ls-files *", "effect": "allow" },
{ "action": "shell", "resource": "git --no-pager status *", "effect": "allow" },
{ "action": "shell", "resource": "rg *", "effect": "allow" },
{ "action": "shell", "resource": "grep *", "effect": "allow" },
{ "action": "shell", "resource": "cat *", "effect": "allow" },
{ "action": "shell", "resource": "ls *", "effect": "allow" },
{ "action": "shell", "resource": "head *", "effect": "allow" },
{ "action": "shell", "resource": "tail *", "effect": "allow" },
{ "action": "shell", "resource": "find *", "effect": "allow" },
{ "action": "shell", "resource": "sed -n *", "effect": "allow" },
{ "action": "shell", "resource": "wc *", "effect": "allow" },
{ "action": "shell", "resource": "tail -f *", "effect": "deny" },
{ "action": "shell", "resource": "tail * -f *", "effect": "deny" },
{ "action": "shell", "resource": "tail -F *", "effect": "deny" },
{ "action": "shell", "resource": "tail * -F *", "effect": "deny" },
{ "action": "shell", "resource": "tail --follow*", "effect": "deny" },
{ "action": "shell", "resource": "tail * --follow*", "effect": "deny" },
{ "action": "shell", "resource": "find -exec *", "effect": "deny" },
{ "action": "shell", "resource": "find * -exec *", "effect": "deny" },
{ "action": "shell", "resource": "find -execdir *", "effect": "deny" },
{ "action": "shell", "resource": "find * -execdir *", "effect": "deny" },
{ "action": "shell", "resource": "find -ok *", "effect": "deny" },
{ "action": "shell", "resource": "find * -ok *", "effect": "deny" },
{ "action": "shell", "resource": "find -okdir *", "effect": "deny" },
{ "action": "shell", "resource": "find * -okdir *", "effect": "deny" },
{ "action": "shell", "resource": "find -delete *", "effect": "deny" },
{ "action": "shell", "resource": "find * -delete *", "effect": "deny" },
{ "action": "shell", "resource": "find -fprint *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fprint *", "effect": "deny" },
{ "action": "shell", "resource": "find -fprint0 *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fprint0 *", "effect": "deny" },
{ "action": "shell", "resource": "find -fprintf *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fprintf *", "effect": "deny" },
{ "action": "shell", "resource": "find -fls *", "effect": "deny" },
{ "action": "shell", "resource": "find * -fls *", "effect": "deny" },
{ "action": "shell", "resource": "cat /*", "effect": "deny" },
{ "action": "shell", "resource": "cat * /*", "effect": "deny" },
{ "action": "shell", "resource": "cat *../*", "effect": "deny" },
{ "action": "shell", "resource": "cat *=/*", "effect": "deny" },
{ "action": "shell", "resource": "cat *environ*", "effect": "deny" },
{ "action": "shell", "resource": "head /*", "effect": "deny" },
{ "action": "shell", "resource": "head * /*", "effect": "deny" },
{ "action": "shell", "resource": "head *../*", "effect": "deny" },
{ "action": "shell", "resource": "head *=/*", "effect": "deny" },
{ "action": "shell", "resource": "head *environ*", "effect": "deny" },
{ "action": "shell", "resource": "tail /*", "effect": "deny" },
{ "action": "shell", "resource": "tail * /*", "effect": "deny" },
{ "action": "shell", "resource": "tail *../*", "effect": "deny" },
{ "action": "shell", "resource": "tail *=/*", "effect": "deny" },
{ "action": "shell", "resource": "tail *environ*", "effect": "deny" },
{ "action": "shell", "resource": "grep /*", "effect": "deny" },
{ "action": "shell", "resource": "grep * /*", "effect": "deny" },
{ "action": "shell", "resource": "grep *../*", "effect": "deny" },
{ "action": "shell", "resource": "grep *=/*", "effect": "deny" },
{ "action": "shell", "resource": "grep *environ*", "effect": "deny" },
{ "action": "shell", "resource": "rg /*", "effect": "deny" },
{ "action": "shell", "resource": "rg * /*", "effect": "deny" },
{ "action": "shell", "resource": "rg *../*", "effect": "deny" },
{ "action": "shell", "resource": "rg *=/*", "effect": "deny" },
{ "action": "shell", "resource": "rg *environ*", "effect": "deny" },
{ "action": "shell", "resource": "sed /*", "effect": "deny" },
{ "action": "shell", "resource": "sed * /*", "effect": "deny" },
{ "action": "shell", "resource": "sed *../*", "effect": "deny" },
{ "action": "shell", "resource": "sed *=/*", "effect": "deny" },
{ "action": "shell", "resource": "sed *environ*", "effect": "deny" },
{ "action": "shell", "resource": "wc /*", "effect": "deny" },
{ "action": "shell", "resource": "wc * /*", "effect": "deny" },
{ "action": "shell", "resource": "wc *../*", "effect": "deny" },
{ "action": "shell", "resource": "wc *=/*", "effect": "deny" },
{ "action": "shell", "resource": "wc *environ*", "effect": "deny" },
{ "action": "shell", "resource": "*>*", "effect": "deny" }
]
}
}
}