feat(nono): add restrictive core policy contract

2026-08-30 12:49:17 -04:00
parent 54c20e2012
commit 90f8090f61
19 changed files with 1862 additions and 9 deletions
@@ -0,0 +1,87 @@
+{
+  "extends": "default",
+  "meta": {
+    "name": "pi-core-work",
+    "description": "Restrictive work Pi baseline without repository or provider access"
+  },
+  "groups": {
+    "exclude": [
+      "homebrew_linux",
+      "homebrew_macos",
+      "system_write_linux",
+      "system_write_macos",
+      "user_tools"
+    ]
+  },
+  "security": {
+    "signal_mode": "isolated",
+    "capability_elevation": false
+  },
+  "workdir": {
+    "access": "none"
+  },
+  "filesystem": {
+    "allow": [
+      "$XDG_CACHE_HOME/pi-sbx/work",
+      "$XDG_STATE_HOME/pi-sbx/work/agent",
+      "$XDG_STATE_HOME/pi-sbx/work/sessions"
+    ],
+    "read": [
+      "/home/jb/.bun/install/global/node_modules/@earendil-works/pi-coding-agent",
+      "/home/jb/.bun/install/global/node_modules/jiti"
+    ],
+    "allow_file": [
+      "/dev/null",
+      "/dev/stderr",
+      "/dev/stdout",
+      "/dev/tty"
+    ],
+    "read_file": [
+      "/home/jb/.pi/agent/AGENTS.md",
+      "/usr/bin/node"
+    ]
+  },
+  "linux": {
+    "af_unix_mediation": "pathname"
+  },
+  "network": {
+    "block": true
+  },
+  "environment": {
+    "allow_vars": [
+      "COLORTERM",
+      "HOME",
+      "LANG",
+      "LC_ALL",
+      "NO_COLOR",
+      "PATH",
+      "PI_SBX_PROVIDER",
+      "SHELL",
+      "TERM",
+      "TMPDIR",
+      "XDG_CACHE_HOME",
+      "XDG_CONFIG_HOME",
+      "XDG_RUNTIME_DIR",
+      "XDG_STATE_HOME"
+    ],
+    "deny_vars": [
+      "ANTHROPIC_API_KEY",
+      "GH_TOKEN",
+      "GITHUB_TOKEN",
+      "MORPH_API_KEY",
+      "OPENAI_API_KEY",
+      "SSH_AUTH_SOCK"
+    ],
+    "set_vars": {
+      "PI_CODING_AGENT_DIR": "$XDG_STATE_HOME/pi-sbx/work/agent",
+      "PI_CODING_AGENT_SESSION_DIR": "$XDG_STATE_HOME/pi-sbx/work/sessions",
+      "PI_SKIP_VERSION_CHECK": "1",
+      "PI_TELEMETRY": "0"
+    }
+  },
+  "open_urls": {
+    "allow_origins": [],
+    "allow_localhost": false
+  },
+  "allow_launch_services": false
+}