From ba7f29ac44acf972ae8701c6300579994c46d4fe Mon Sep 17 00:00:00 2001 From: TGPSKI Date: Sun, 9 Aug 2026 02:55:55 -0700 Subject: [PATCH] personas: declare only the permissions that differ from the baseline MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A frontmatter `permission:` key replaces the corresponding block in opencode.json rather than merging into it. The previous `edit: allow` and `bash: allow` on the router and executor therefore discarded whatever deny-list the JSON defined — on a real config that means losing `~/.ssh/**`, `*secrets*`, `rm -rf *`, and `sudo *` for exactly the two personas that write files and run shell commands. - context-router and context-executor now declare only `task:`, inheriting every restriction the JSON imposes. - context-auditor's bash catch-all moves from `ask` to `deny`. The block replaces the JSON bash rules, so a catch-all `ask` would downgrade every hard deny there to a prompt. The auditor's command set is known, so denying the rest costs nothing. personas/README.md states the rule: override a permission key only to tighten it. --- personas/README.md | 20 ++++++++++++++++---- personas/context-auditor.md | 2 +- personas/context-executor.md | 2 -- personas/context-router.md | 2 -- 4 files changed, 17 insertions(+), 9 deletions(-) diff --git a/personas/README.md b/personas/README.md index 4fa6a09..3644fe4 100644 --- a/personas/README.md +++ b/personas/README.md @@ -74,15 +74,27 @@ JSON ones — enough to break pattern-based `permission.task` rules without a warning. The same ordering means the blocks below override `opencode.json`; if you centralize permissions there, strip them. +**Declare only what differs from the baseline.** A frontmatter `permission:` +key replaces the corresponding block in `opencode.json` rather than merging +into it. A config with a real deny-list there — `~/.ssh/**`, `*secrets*`, +`rm -rf *`, `sudo *` — loses it for any agent whose frontmatter says +`edit: allow` or `bash: allow`. So the router and the executor declare nothing +but `task:`, and inherit every restriction the JSON already imposes. Override a +key only to tighten it. + **`task: deny` on both subagents.** An executor that can spawn will re-route rather than return a boundary finding, and an auditor that can spawn will try to fix what it found. Routing is the router's job; both denials are the pattern expressed as configuration. -**The auditor's bash patterns.** `"*": ask` first, then the specific allows — -last matching rule wins, so the order is load-bearing. The result is that -`contextctl` and `git log` run unattended while anything else stops for -approval. Note what this does *not* buy: `bash` is a write vector regardless, +**The auditor's bash patterns.** `"*": deny` first, then the specific allows — +last matching rule wins, so the order is load-bearing. `contextctl` and +`git log` run unattended; nothing else runs at all. Deny rather than ask, +because this block replaces the JSON `bash` rules and a catch-all `ask` would +downgrade every hard deny there to a prompt. The auditor's command set is +known, so denying the rest costs nothing. + +Note what this does *not* buy: `bash` is a write vector wherever it is allowed, so the auditor's read-only property rests on `edit: deny` plus its prompt. Same rule as the pattern itself — coordination, not authorization. diff --git a/personas/context-auditor.md b/personas/context-auditor.md index 2d22420..b49bcb4 100644 --- a/personas/context-auditor.md +++ b/personas/context-auditor.md @@ -9,7 +9,7 @@ permission: edit: deny task: deny bash: - "*": ask + "*": deny "contextctl *": allow "go run *contextctl.go *": allow "git log *": allow diff --git a/personas/context-executor.md b/personas/context-executor.md index 5ac7828..182af70 100644 --- a/personas/context-executor.md +++ b/personas/context-executor.md @@ -7,8 +7,6 @@ description: >- mode: subagent temperature: 0.1 permission: - edit: allow - bash: allow task: deny --- diff --git a/personas/context-router.md b/personas/context-router.md index 21422c2..484384a 100644 --- a/personas/context-router.md +++ b/personas/context-router.md @@ -7,8 +7,6 @@ description: >- mode: primary temperature: 0.1 permission: - edit: allow - bash: allow task: allow ---