feat(nono): add restrictive core policy contract

2026-08-30 12:49:17 -04:00
parent 54c20e2012
commit 90f8090f61
19 changed files with 1862 additions and 9 deletions
@@ -0,0 +1,64 @@
+{
+  "extends": "default",
+  "meta": {
+    "name": "provider-morph",
+    "description": "Morph route with a Nono-mediated phantom credential"
+  },
+  "groups": {
+    "exclude": [
+      "homebrew_linux",
+      "homebrew_macos",
+      "system_read_linux_core",
+      "system_read_macos",
+      "system_write_linux",
+      "system_write_macos",
+      "user_tools"
+    ]
+  },
+  "workdir": {
+    "access": "none"
+  },
+  "network": {
+    "block": false,
+    "allow_domain": [],
+    "credentials": [
+      "morph"
+    ],
+    "custom_credentials": {
+      "morph": {
+        "upstream": "https://api.morphllm.com",
+        "credential_key": "MORPH_API_KEY",
+        "inject_header": "Authorization",
+        "credential_format": "Bearer {}",
+        "env_var": "MORPH_API_KEY"
+      }
+    }
+  },
+  "environment": {
+    "allow_vars": [
+      "HOME",
+      "LANG",
+      "LC_ALL",
+      "PATH",
+      "TERM",
+      "TMPDIR",
+      "XDG_CACHE_HOME",
+      "XDG_CONFIG_HOME",
+      "XDG_RUNTIME_DIR",
+      "XDG_STATE_HOME"
+    ],
+    "deny_vars": [
+      "ANTHROPIC_API_KEY",
+      "GH_TOKEN",
+      "GITHUB_TOKEN",
+      "MORPH_API_KEY",
+      "OPENAI_API_KEY",
+      "SSH_AUTH_SOCK"
+    ]
+  },
+  "open_urls": {
+    "allow_origins": [],
+    "allow_localhost": false
+  },
+  "allow_launch_services": false
+}