jorgex-stack 1.0.22 → 1.0.23

package/README.md

@@ -24,6 +24,8 @@ For development from a clone, run the same commands through `pnpm cli <command>`
 
 Every command supports `--dry-run`, `--yes`, and `--target-dir <dir>` for testing without touching the real config. Writes create automatic backups and verify idempotency; merges into user config are surgical (marked markdown sections, JSON/TOML upserts), so user-owned content is never touched.
 
+Permission defaults by runtime (what gets installed, what stays custom, and the read-anywhere limitations) are documented in [docs/references/permissions.md](docs/references/permissions.md).
+
 ### Modes: Human and Programmatic
 
 `install` and `sync` accept two mutually-exclusive installation modes. The choice is global (not per runtime) and is saved in `~/.jorgex-stack/install-mode.json` on first run; subsequent `sync` calls reuse it. Re-run `install` with `--mode` to switch.

package/dist/cli.js

@@ -614,11 +614,17 @@ ${agent.body}`,
   planMainConfig(canonical, ctx) {
     const file = path7.join(ctx.configDir, "opencode.json");
     const { pluginsDir } = this.paths(ctx.configDir);
-    const content = upsertJson(readTextIfExists(file), (root) => {
+    const original = readTextIfExists(file);
+    const contentSource = original === null || original.trim() === "" ? null : original;
+    const isFreshConfig = contentSource === null;
+    const content = upsertJson(contentSource, (root) => {
       root["$schema"] ??= "https://opencode.ai/config.json";
       const defaults = loadCanonicalDefaults(ctx.stackDir)["opencode"];
-      if (defaults?.["permission"] !== void 0 && !("permission" in root)) {
+      if (isFreshConfig && defaults?.["permission"] !== void 0) {
         root["permission"] = defaults["permission"];
+        ctx.warnings.push(
+          "OpenCode: fresh config enables read-anywhere via external_directory:*; edits, web egress and arbitrary bash remain approval-gated, but broad local reads can expose secrets not covered by deny rules."
+        );
       }
       const mcp = root["mcp"] ??= {};
       for (const [name, server] of Object.entries(canonical.servers)) {
@@ -818,12 +824,19 @@ ${agent.body}`,
   planHooks(canonical, ctx) {
     const actions = [];
     const { scriptsDir } = this.paths(ctx.configDir);
+    const original = readTextIfExists(path8.join(ctx.configDir, "settings.json"));
+    const contentSource = original === null || original.trim() === "" ? null : original;
     const settingsFile = path8.join(ctx.configDir, "settings.json");
-    let content = upsertNativeHooks(readTextIfExists(settingsFile), canonical, scriptsDir);
+    let content = upsertNativeHooks(contentSource, canonical, scriptsDir);
     const defaults = loadCanonicalDefaults(ctx.stackDir)["claude-code"];
-    if (defaults?.["permissions"] !== void 0) {
+    if (contentSource === null && defaults?.["permissions"] !== void 0) {
       content = upsertJson(content, (root) => {
-        if (!("permissions" in root)) root["permissions"] = defaults["permissions"];
+        if (root["permissions"] === void 0) {
+          root["permissions"] = defaults["permissions"];
+          ctx.warnings.push(
+            "Claude Code: fresh config enables read-anywhere via Read/Grep/Glob allow rules; shell, writes and web egress remain approval-gated, but broad local reads can expose secrets not covered by deny rules."
+          );
+        }
       });
     }
     actions.push({ kind: "write", target: settingsFile, content });
@@ -1026,13 +1039,52 @@ ${body}`
   },
   planMainConfig(canonical, ctx) {
     const file = path9.join(ctx.configDir, "config.toml");
-    let content = readTextIfExists(file);
-    const defaults = loadCanonicalDefaults(ctx.stackDir)["codex"] ?? {};
-    for (const [key, value] of Object.entries(defaults)) {
-      if (content !== null && new RegExp(`^\\s*${key}\\s*=`, "m").test(content)) continue;
-      const line = `${key} = ${tomlString(String(value))}
+    const original = readTextIfExists(file);
+    const contentSource = original === null || original.trim() === "" ? null : original;
+    let content = contentSource;
+    if (contentSource === null) {
+      const defaults = loadCanonicalDefaults(ctx.stackDir)["codex"] ?? {};
+      for (const [key, value] of Object.entries(defaults)) {
+        const line = `${key} = ${tomlString(String(value))}
 `;
-      content = content === null ? line : line + content;
+        content = content === null ? line : line + content;
+      }
+      ctx.warnings.push(
+        "Codex: fresh config enables read-anywhere via the jorgex-read-anywhere permission profile; broad local reads can expose secrets not covered by deny rules."
+      );
+      content = upsertTomlSection(content, "permissions.jorgex-read-anywhere", 'extends = ":workspace"');
+      content = upsertTomlSection(
+        content,
+        "permissions.jorgex-read-anywhere.filesystem",
+        [
+          '":root" = "read"',
+          '"*.env" = "deny"',
+          '"*.env.*" = "deny"',
+          '"~/.ssh/**" = "deny"',
+          '"~/.aws/credentials" = "deny"',
+          '"~/.npmrc" = "deny"',
+          '"~/.git-credentials" = "deny"',
+          '"**/id_rsa" = "deny"',
+          '"**/id_ed25519" = "deny"',
+          '"**/*.pem" = "deny"',
+          '"**/*.key" = "deny"'
+        ].join("\n")
+      );
+      content += [
+        '\n[permissions.jorgex-read-anywhere.filesystem.":workspace_roots"]',
+        '"." = "write"',
+        '"*.env" = "deny"',
+        '"*.env.*" = "deny"',
+        '".ssh/**" = "deny"',
+        '".aws/credentials" = "deny"',
+        '".npmrc" = "deny"',
+        '".git-credentials" = "deny"',
+        '"**/id_rsa" = "deny"',
+        '"**/id_ed25519" = "deny"',
+        '"**/*.pem" = "deny"',
+        '"**/*.key" = "deny"',
+        ""
+      ].join("\n");
     }
     for (const [name, server] of Object.entries(canonical.servers)) {
       const section = `mcp_servers.${name}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jorgex-stack",
-  "version": "1.0.22",
+  "version": "1.0.23",
   "description": "Harness multi-agente portable: instala la config JorgeX (agentes, skills, hooks, Engram, MCPs) en Claude Code, Codex CLI y OpenCode",
   "type": "module",
   "license": "MIT",

package/stack/config/defaults.json

@@ -1,17 +1,36 @@
 {
-  "$comment": "Permisos por defecto del stack: casi todo permitido, lo destructivo pregunta o se bloquea. REGLA DE ORO: cada bloque se escribe SOLO si el usuario aún no tiene esa clave en su config — si ya la tiene (suya o ajustada después), el sync no la toca jamás. Quitar o editar estos valores tras el install es seguro: pasan a ser config del usuario.",
+  "$comment": "Permisos por defecto del stack: cada bloque se escribe SOLO en config fresca o vacía; una config existente no se auto-expande jamás. OpenCode fresh default permite leer fuera del cwd, pero deja edit/bash en ask salvo allow explícito para lecturas seguras.",
   "opencode": {
     "permission": {
-      "edit": "allow",
-      "read": "allow",
+      "edit": "ask",
+      "read": {
+        "*": "allow",
+        "*.env": "deny",
+        "*.env.*": "deny",
+        "*.env.example": "allow",
+        "*/.ssh/*": "deny",
+        "*/.aws/credentials": "deny",
+        "*/.npmrc": "deny",
+        "*/.git-credentials": "deny",
+        "*/id_rsa": "deny",
+        "*/id_ed25519": "deny",
+        "*.pem": "deny",
+        "*.key": "deny"
+      },
+      "external_directory": {
+        "*": "allow"
+      },
       "glob": "allow",
       "grep": "allow",
       "list": "allow",
       "lsp": "allow",
-      "webfetch": "allow",
-      "websearch": "allow",
+      "webfetch": "ask",
+      "websearch": "ask",
       "bash": {
-        "*": "allow",
+        "*": "ask",
+        "git diff*": "ask",
+        "git log*": "allow",
+        "git status*": "allow",
         "rm *": "ask",
         "del *": "ask",
         "rmdir *": "ask",
@@ -25,13 +44,28 @@
   },
   "claude-code": {
     "permissions": {
-      "allow": ["Bash", "Edit", "Write", "WebFetch", "WebSearch"],
-      "ask": ["Bash(rm:*)", "Bash(rmdir:*)", "Bash(del:*)", "Bash(git push --force:*)"],
-      "deny": ["Bash(format:*)", "Bash(mkfs:*)", "Bash(dd:*)", "Bash(shred:*)", "Read(./.env)", "Read(./.env.*)"]
+      "allow": ["Read", "Grep", "Glob"],
+      "ask": ["Bash", "Edit", "Write", "WebFetch", "WebSearch", "Bash(rm:*)", "Bash(rmdir:*)", "Bash(del:*)", "Bash(git push --force:*)"],
+      "deny": [
+        "Bash(format:*)",
+        "Bash(mkfs:*)",
+        "Bash(dd:*)",
+        "Bash(shred:*)",
+        "Read(//**/.env)",
+        "Read(//**/.env.*)",
+        "Read(//**/.ssh/**)",
+        "Read(//**/.aws/credentials)",
+        "Read(//**/.npmrc)",
+        "Read(//**/.git-credentials)",
+        "Read(//**/id_rsa)",
+        "Read(//**/id_ed25519)",
+        "Read(//**/*.pem)",
+        "Read(//**/*.key)"
+      ]
     }
   },
   "codex": {
     "approval_policy": "on-request",
-    "sandbox_mode": "workspace-write"
+    "default_permissions": "jorgex-read-anywhere"
   }
 }