Padreug
df0fd9a9ba
The forgejo-sandbox / reforge harness, lifted out of the machine config into a host-agnostic, generic engine anyone can consume with Nix. Two layers: - engine (this repo) — nixosModules.reforge stands up the sandbox forge, provisions role accounts + tokens, enforces branch protection, and puts the reforge-* CLI + forgejo-mcp on PATH. Carries no project specifics. - run config — per-project manifest/charter/agenda/issues an adopter fills in; scaffold one with the `reforge` flake template. Portability fixes vs the in-config version: - forgejo-mcp resolved from $REFORGE_MCP_BIN or PATH, never a named host (kills the nixosConfigurations.omni hardcode). - all instance data + paths parameterized via REFORGE_* env, baked into the reforge-scripts wrappers from module options (configDir, agentsDir, refsDir, org, port, tokenOwner, ...). - option namespace neutral (reforge.* not omni.packs.*); settings policies carry no absolute /etc/nixos paths. - role briefs + orchestrator playbook genericized: all project specifics point at the charter; refs corpus optional. Validated: nix flake check (eval) + builds of forgejo-mcp, reforge-scripts, and a module-eval check. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
133 lines
3 KiB
JSON
133 lines
3 KiB
JSON
{
|
|
"enableAllProjectMcpServers": true,
|
|
"env": {
|
|
"GIT_SSH_COMMAND": "false"
|
|
},
|
|
"permissions": {
|
|
"defaultMode": "acceptEdits",
|
|
"allow": [
|
|
"Read",
|
|
"Glob",
|
|
"Grep",
|
|
"Edit",
|
|
"Write",
|
|
"NotebookEdit",
|
|
|
|
"mcp__forgejo-sandbox",
|
|
|
|
"Bash(git status)",
|
|
"Bash(git status:*)",
|
|
"Bash(git diff)",
|
|
"Bash(git diff:*)",
|
|
"Bash(git log)",
|
|
"Bash(git log:*)",
|
|
"Bash(git show)",
|
|
"Bash(git show:*)",
|
|
"Bash(git branch)",
|
|
"Bash(git branch:*)",
|
|
"Bash(git add:*)",
|
|
"Bash(git commit:*)",
|
|
"Bash(git checkout:*)",
|
|
"Bash(git switch:*)",
|
|
"Bash(git restore:*)",
|
|
"Bash(git stash)",
|
|
"Bash(git stash:*)",
|
|
"Bash(git rev-parse:*)",
|
|
"Bash(git merge:*)",
|
|
"Bash(git rebase:*)",
|
|
"Bash(git clone http://localhost:*)",
|
|
"Bash(git fetch)",
|
|
"Bash(git fetch origin:*)",
|
|
"Bash(git pull)",
|
|
"Bash(git pull origin:*)",
|
|
"Bash(git push)",
|
|
"Bash(git push origin:*)",
|
|
"Bash(git push --set-upstream origin:*)",
|
|
"Bash(git push -u origin:*)",
|
|
"Bash(git config user.name:*)",
|
|
"Bash(git config user.email:*)",
|
|
|
|
"Bash(nix build:*)",
|
|
"Bash(nix develop:*)",
|
|
"Bash(nix flake check:*)",
|
|
"Bash(nix flake show:*)",
|
|
|
|
"Bash(python3:*)",
|
|
"Bash(pytest:*)",
|
|
"Bash(uv run:*)",
|
|
"Bash(uv sync:*)",
|
|
"Bash(poetry run:*)",
|
|
"Bash(poetry install:*)",
|
|
"Bash(npm run:*)",
|
|
"Bash(npm test:*)",
|
|
"Bash(npm ci)",
|
|
"Bash(npm install)",
|
|
"Bash(pnpm run:*)",
|
|
"Bash(pnpm test:*)",
|
|
"Bash(pnpm install)",
|
|
"Bash(node:*)",
|
|
"Bash(make:*)",
|
|
|
|
"Bash(rg:*)",
|
|
"Bash(fd:*)",
|
|
"Bash(jq:*)",
|
|
"Bash(diff:*)",
|
|
"Bash(sort:*)",
|
|
"Bash(uniq:*)",
|
|
"Bash(find:*)",
|
|
"Bash(xargs:*)",
|
|
"Bash(mkdir:*)",
|
|
"Bash(touch:*)",
|
|
"Bash(ls:*)",
|
|
"Bash(pwd)",
|
|
"Bash(which:*)",
|
|
"Bash(type:*)",
|
|
"Bash(env)",
|
|
"Bash(echo:*)",
|
|
"Bash(file:*)",
|
|
"Bash(stat:*)",
|
|
"Bash(wc:*)",
|
|
"Bash(head:*)",
|
|
"Bash(tail:*)",
|
|
"Bash(cat:*)"
|
|
],
|
|
"ask": [
|
|
"Bash(rm:*)",
|
|
"Bash(rmdir:*)",
|
|
"Bash(mv:*)",
|
|
"Bash(cp:*)",
|
|
"Bash(chmod:*)",
|
|
"Bash(chown:*)"
|
|
],
|
|
"deny": [
|
|
"Bash(sudo:*)",
|
|
"Bash(sudo)",
|
|
"Bash(doas:*)",
|
|
"Bash(su:*)",
|
|
"Bash(nixos-rebuild:*)",
|
|
"Bash(nh:*)",
|
|
"Bash(nix run:*)",
|
|
"Bash(git remote:*)",
|
|
"Bash(git push ssh:*)",
|
|
"Bash(git push git@:*)",
|
|
"Bash(git push https:*)",
|
|
"Bash(git clone ssh:*)",
|
|
"Bash(git clone git@:*)",
|
|
"Bash(git clone https:*)",
|
|
"Bash(git fetch https:*)",
|
|
"Bash(git fetch ssh:*)",
|
|
"Bash(curl:*)",
|
|
"Bash(wget:*)",
|
|
"Bash(ssh:*)",
|
|
"Bash(scp:*)",
|
|
"Bash(rsync:*)",
|
|
"Bash(nc:*)",
|
|
"Bash(systemctl:*)",
|
|
"Bash(docker:*)",
|
|
"Bash(podman:*)",
|
|
"WebFetch",
|
|
"WebSearch",
|
|
"mcp__forgejo-mcp"
|
|
]
|
|
}
|
|
}
|