version = 1
activePermissionProfile = "workspace"

[profiles.workspace]
description = "Read and edit the workspace, keep network disabled by default."

[permissions.workspace.filesystem]
":minimal" = "read"

[permissions.workspace.filesystem.":workspace_roots"]
"." = "write"
".git" = "read"
".codex" = "read"
".agents" = "read"
"**/*.env" = "deny"
".env" = "deny"
".env.*" = "deny"
".git/hooks/**" = "deny"

[permissions.workspace.filesystem.":tmpdir"]
"." = "write"

[permissions.workspace.filesystem.":slash_tmp"]
"." = "write"

[permissions.workspace.network]
enabled = false
allowLocalBinding = false

[permissions.workspace.dangerous]
allowAppleEvents = false
enableWeakerNestedSandbox = false
enableWeakerNetworkIsolation = false
allowAllUnixSockets = false

[tools.bash]
mode = "enforce"
defaultAction = "allow"
wrapWithSrt = true
srtBinary = "srt"
readOnlyCommands = []

[tools.bash.operations]
preset = "recommended"
block = ["~/.ssh/", "gh auth token", ".git/hooks"]
confirm = [
  "git push",
  "git commit",
  "git reset --hard",
  "git clean",
  "rm -r",
  "sudo",
  "curl | sh",
  "wget | bash",
  "scp",
  "rsync",
  "npm publish",
  "pnpm publish",
  "docker",
  "kubectl",
  "terraform",
  "aws",
  "gcloud",
  "az",
  "open",
  "osascript"
]

[[tools.bash.rules]]
id = "dangerous-shell-removal"
action = "block"
reason = "Command matches a configured destructive shell pattern."

[tools.bash.rules.match]
commandIncludes = ["rm -rf /", "sudo rm", "mkfs", "diskutil erase"]

[tools.read]
mode = "enforce"
defaultAction = "confirm"
pathFields = ["path"]

[tools.write]
mode = "enforce"
defaultAction = "confirm"
pathFields = ["path", "file_path"]

[tools.edit]
mode = "enforce"
defaultAction = "confirm"
pathFields = ["path", "file_path"]

[prompts]
noUiAction = "block"
confirmTitle = "Sandbox permission"
confirmMessage = "Allow {toolName} for {target}?"

[audit]
enabled = true
file = "audit.jsonl"

[runtime]
baseDir = "~/.pi/agent/extensions/pi-perm"
settingsDir = "runtime"
sessionAllowTtlMs = 1800000

[security]
userOnlyElevations = [
  "allowAppleEvents",
  "enableWeakerNestedSandbox",
  "enableWeakerNetworkIsolation",
  "allowAllUnixSockets",
  "allowDockerSocket"
]
