dotfiles

commit 1e226f867b6547ca4c974c827286f7ec046e4239
parent 6a5ed4633b67332ab5ddf0f6f552942b8d0f3885
Author: Anders Hedman <anders.hedman01@gmail.com>
Date:   Tue, 22 Sep 2026 20:19:52 +0200

fix(opencode): order rm -rf /tmp rules last

The /tmp/opencode exceptions sat before the generic rm -rf deny, so last-match-wins kept them denied. Move them after the deny so they resolve to ask.

Diffstat:
M
.config/opencode/opencode.jsonc
 | 
5
+++--

1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/.config/opencode/opencode.jsonc b/.config/opencode/opencode.jsonc
@@ -169,8 +169,6 @@
     { "action": "shell", "resource": "mkdir*", "effect": "ask" },
     { "action": "shell", "resource": "touch*", "effect": "ask" },
     { "action": "shell", "resource": "rm *", "effect": "ask" },
-    { "action": "shell", "resource": "rm -rf /tmp/opencode/*", "effect": "ask" },
-    { "action": "shell", "resource": "rm -fr /tmp/opencode/*", "effect": "ask" },
     // environment $VAR
     { "action": "shell", "resource": "printenv *", "effect": "deny" },
     { "action": "shell", "resource": "env *", "effect": "deny" },
@@ -196,6 +194,9 @@
     { "action": "shell", "resource": "reboot*", "effect": "deny" },
     { "action": "shell", "resource": "mkfs*", "effect": "deny" },
     { "action": "shell", "resource": "dd *", "effect": "deny" },
+    // rm -rf exceptions
+    { "action": "shell", "resource": "rm -rf /tmp/opencode/*", "effect": "ask" },
+    { "action": "shell", "resource": "rm -fr /tmp/opencode/*", "effect": "ask" },
 
     // Files outside the workspace: confirm, but block secrets outright
     { "action": "external_directory", "resource": "*", "effect": "ask" },