dotfiles

commit df81b5ef959958628cb209f6c001559e4ffc15aa
parent c9e83f6ec98b58478393ff90512d6877deae5d32
Author: Anders Hedman <anders.hedman01@gmail.com>
Date:   Mon, 28 Sep 2026 21:47:28 +0200

chore(opencode): allow jq/sort/uniq, git ls-files

Add jq, sort, uniq and git ls-files to the read-only shell allowlist so
agents can inspect and summarize output without an approval prompt.

Deny sort -o, which writes a file and would otherwise slip through the
new sort allow alongside the existing git --output and rg --pre denies.

Diffstat:
M
.config/opencode/opencode.jsonc
 | 
5
+++++

1 file changed, 5 insertions(+), 0 deletions(-)
diff --git a/.config/opencode/opencode.jsonc b/.config/opencode/opencode.jsonc
@@ -114,6 +114,9 @@
     { "action": "shell", "resource": "which*", "effect": "allow" },
     { "action": "shell", "resource": "command -v *", "effect": "allow" },
     { "action": "shell", "resource": "wc*", "effect": "allow" },
+    { "action": "shell", "resource": "jq*", "effect": "allow" },
+    { "action": "shell", "resource": "sort*", "effect": "allow" },
+    { "action": "shell", "resource": "uniq*", "effect": "allow" },
     { "action": "shell", "resource": "du*", "effect": "allow" },
     { "action": "shell", "resource": "df*", "effect": "allow" },
     { "action": "shell", "resource": "uname*", "effect": "allow" },
@@ -121,6 +124,7 @@
     // read-only git
     { "action": "shell", "resource": "git status*", "effect": "allow" },
     { "action": "shell", "resource": "git diff*", "effect": "allow" },
+    { "action": "shell", "resource": "git ls-files*", "effect": "allow" },
     { "action": "shell", "resource": "git log*", "effect": "allow" },
     { "action": "shell", "resource": "git grep*", "effect": "allow" },
     { "action": "shell", "resource": "git show*", "effect": "allow" },
@@ -208,6 +212,7 @@
     { "action": "shell", "resource": "git* --output*", "effect": "deny" },
     { "action": "shell", "resource": "rg* --pre *", "effect": "deny" },
     { "action": "shell", "resource": "rg* --pre=*", "effect": "deny" },
+    { "action": "shell", "resource": "sort* -o *", "effect": "deny" },
     // destructive: never auto-run (after the broader asks above)
     { "action": "shell", "resource": "rm -rf*", "effect": "deny" },
     { "action": "shell", "resource": "rm -fr*", "effect": "deny" },