Padreug
df0fd9a9ba
The forgejo-sandbox / reforge harness, lifted out of the machine config into a host-agnostic, generic engine anyone can consume with Nix. Two layers: - engine (this repo) — nixosModules.reforge stands up the sandbox forge, provisions role accounts + tokens, enforces branch protection, and puts the reforge-* CLI + forgejo-mcp on PATH. Carries no project specifics. - run config — per-project manifest/charter/agenda/issues an adopter fills in; scaffold one with the `reforge` flake template. Portability fixes vs the in-config version: - forgejo-mcp resolved from $REFORGE_MCP_BIN or PATH, never a named host (kills the nixosConfigurations.omni hardcode). - all instance data + paths parameterized via REFORGE_* env, baked into the reforge-scripts wrappers from module options (configDir, agentsDir, refsDir, org, port, tokenOwner, ...). - option namespace neutral (reforge.* not omni.packs.*); settings policies carry no absolute /etc/nixos paths. - role briefs + orchestrator playbook genericized: all project specifics point at the charter; refs corpus optional. Validated: nix flake check (eval) + builds of forgejo-mcp, reforge-scripts, and a module-eval check. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
64 lines
1.2 KiB
JSON
64 lines
1.2 KiB
JSON
{
|
|
"enableAllProjectMcpServers": true,
|
|
"permissions": {
|
|
"defaultMode": "acceptEdits",
|
|
"allow": [
|
|
"Read",
|
|
"Glob",
|
|
"Grep",
|
|
"Edit",
|
|
"Write",
|
|
|
|
"mcp__forgejo-sandbox",
|
|
|
|
"Bash(reforge-role:*)",
|
|
"Bash(nix build:*)",
|
|
|
|
"Bash(git -C:*)",
|
|
"Bash(git status)",
|
|
"Bash(git status:*)",
|
|
"Bash(git log:*)",
|
|
"Bash(git diff:*)",
|
|
"Bash(git show:*)",
|
|
|
|
"Bash(rg:*)",
|
|
"Bash(fd:*)",
|
|
"Bash(jq:*)",
|
|
"Bash(ls:*)",
|
|
"Bash(cat:*)",
|
|
"Bash(head:*)",
|
|
"Bash(tail:*)",
|
|
"Bash(wc:*)",
|
|
"Bash(echo:*)",
|
|
"Bash(pwd)",
|
|
"Bash(sleep:*)",
|
|
"Bash(date)",
|
|
"Bash(mkdir:*)"
|
|
],
|
|
"ask": [
|
|
"Bash(rm:*)",
|
|
"Bash(mv:*)",
|
|
"Bash(cp:*)"
|
|
],
|
|
"deny": [
|
|
"Bash(sudo:*)",
|
|
"Bash(sudo)",
|
|
"Bash(doas:*)",
|
|
"Bash(nixos-rebuild:*)",
|
|
"Bash(nh:*)",
|
|
"Bash(systemctl:*)",
|
|
"Bash(curl:*)",
|
|
"Bash(wget:*)",
|
|
"Bash(ssh:*)",
|
|
"Bash(scp:*)",
|
|
"Bash(rsync:*)",
|
|
"Bash(nc:*)",
|
|
"Bash(git push:*)",
|
|
"Bash(git remote:*)",
|
|
"Bash(reforge-reset:*)",
|
|
"WebFetch",
|
|
"WebSearch",
|
|
"mcp__forgejo-mcp"
|
|
]
|
|
}
|
|
}
|