1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
|
# codex execpolicy: force file reading through notevi (which logs every read).
# Activate: cp notevi-only.rules ~/.codex/rules/
# Deactivate: rm ~/.codex/rules/notevi-only.rules
# The engine parses through `/bin/zsh -lc '...'` wrappers, so these match the
# inner command. Editing tools (apply_patch) are unaffected — this only
# constrains reading. Known hole: scripting runtimes can still open files;
# uncomment the last block to close it at the cost of breaking legit scripts.
prefix_rule(pattern=["notevi"], decision="allow")
prefix_rule(pattern=["cat"], decision="forbidden")
prefix_rule(pattern=["head"], decision="forbidden")
prefix_rule(pattern=["tail"], decision="forbidden")
prefix_rule(pattern=["less"], decision="forbidden")
prefix_rule(pattern=["more"], decision="forbidden")
prefix_rule(pattern=["sed"], decision="forbidden")
prefix_rule(pattern=["awk"], decision="forbidden")
prefix_rule(pattern=["cut"], decision="forbidden")
prefix_rule(pattern=["rg"], decision="forbidden")
prefix_rule(pattern=["grep"], decision="forbidden")
prefix_rule(pattern=["egrep"], decision="forbidden")
prefix_rule(pattern=["fgrep"], decision="forbidden")
prefix_rule(pattern=["find"], decision="forbidden")
prefix_rule(pattern=["fd"], decision="forbidden")
prefix_rule(pattern=["strings"], decision="forbidden")
prefix_rule(pattern=["xxd"], decision="forbidden")
prefix_rule(pattern=["hexdump"], decision="forbidden")
prefix_rule(pattern=["od"], decision="forbidden")
prefix_rule(pattern=["tac"], decision="forbidden")
prefix_rule(pattern=["nl"], decision="forbidden")
prefix_rule(pattern=["jj", "file", "show"], decision="forbidden")
prefix_rule(pattern=["jj", "diff"], decision="forbidden")
prefix_rule(pattern=["git", "show"], decision="forbidden")
prefix_rule(pattern=["git", "diff"], decision="forbidden")
prefix_rule(pattern=["git", "grep"], decision="forbidden")
prefix_rule(pattern=["git", "cat-file"], decision="forbidden")
prefix_rule(pattern=["git", "blame"], decision="forbidden")
prefix_rule(pattern=["git", "log"], decision="forbidden")
# prefix_rule(pattern=["python3"], decision="forbidden")
# prefix_rule(pattern=["python"], decision="forbidden")
# prefix_rule(pattern=["node"], decision="forbidden")
# prefix_rule(pattern=["perl"], decision="forbidden")
# prefix_rule(pattern=["ruby"], decision="forbidden")
|
