1 files changed, 44 insertions, 0 deletions

diff --git a/constrain/vr-only.rules b/constrain/vr-only.rules
new file mode 100644
index 0000000..54d3392
--- /dev/null
+++ b/constrain/vr-only.rules
@@ -0,0 +1,44 @@
+# codex execpolicy: force file reading through vr (which logs every read).
+# Activate:   cp vr-only.rules ~/.codex/rules/
+# Deactivate: rm ~/.codex/rules/vr-only.rules
+# The engine parses through `/bin/zsh -lc '...'` wrappers, so these match the
+# inner command. Editing tools (apply_patch) are unaffected — this only
+# constrains reading. Known hole: scripting runtimes can still open files;
+# uncomment the last block to close it at the cost of breaking legit scripts.
+
+prefix_rule(pattern=["vr"], decision="allow")
+
+prefix_rule(pattern=["cat"], decision="forbidden")
+prefix_rule(pattern=["head"], decision="forbidden")
+prefix_rule(pattern=["tail"], decision="forbidden")
+prefix_rule(pattern=["less"], decision="forbidden")
+prefix_rule(pattern=["more"], decision="forbidden")
+prefix_rule(pattern=["sed"], decision="forbidden")
+prefix_rule(pattern=["awk"], decision="forbidden")
+prefix_rule(pattern=["cut"], decision="forbidden")
+prefix_rule(pattern=["rg"], decision="forbidden")
+prefix_rule(pattern=["grep"], decision="forbidden")
+prefix_rule(pattern=["egrep"], decision="forbidden")
+prefix_rule(pattern=["fgrep"], decision="forbidden")
+prefix_rule(pattern=["find"], decision="forbidden")
+prefix_rule(pattern=["fd"], decision="forbidden")
+prefix_rule(pattern=["strings"], decision="forbidden")
+prefix_rule(pattern=["xxd"], decision="forbidden")
+prefix_rule(pattern=["hexdump"], decision="forbidden")
+prefix_rule(pattern=["od"], decision="forbidden")
+prefix_rule(pattern=["tac"], decision="forbidden")
+prefix_rule(pattern=["nl"], decision="forbidden")
+prefix_rule(pattern=["jj", "file", "show"], decision="forbidden")
+prefix_rule(pattern=["jj", "diff"], decision="forbidden")
+prefix_rule(pattern=["git", "show"], decision="forbidden")
+prefix_rule(pattern=["git", "diff"], decision="forbidden")
+prefix_rule(pattern=["git", "grep"], decision="forbidden")
+prefix_rule(pattern=["git", "cat-file"], decision="forbidden")
+prefix_rule(pattern=["git", "blame"], decision="forbidden")
+prefix_rule(pattern=["git", "log"], decision="forbidden")
+
+# prefix_rule(pattern=["python3"], decision="forbidden")
+# prefix_rule(pattern=["python"], decision="forbidden")
+# prefix_rule(pattern=["node"], decision="forbidden")
+# prefix_rule(pattern=["perl"], decision="forbidden")
+# prefix_rule(pattern=["ruby"], decision="forbidden")