c0c3483f02
22 files per locked §Initial capability atom inventory: policy/no-git-ops/ (gate: PreToolUse:Bash, bypass ORCHESTRATOR_META) scope/files-whitelist/ (gate + verify worktree) scope/files-denylist/ (gate + verify worktree) quality/constructor-pattern/ (verify worktree) quality/cargo-check-green/ (verify both — worktree short-circuit + simulated-merge) quality/tests-green/ (verify both) safety/no-dep-bump/ (gate + verify both) output/report-format/ (verify worktree) output/severity-grade/ (verify worktree) tools/read-only/ (gate: deny Edit/Write) tools/cargo-only-bash/ (gate: Bash allowlist) All capability.toml share [capability]/[restricts]/[parameterized]/[text]/ [gate]/[verify] section layout. rust-module paths pre-wired to match phase-3 file layout. All text.md under 200 words, imperative, self-contained (composer concatenates with --- separator). Cross-refs to rule files preserved: - policy::no-git-ops → RULE 0.13 (orchestrator-branch-first.md) - quality::constructor-pattern → RULE ZERO (code-style.md) - output::severity-grade → debugging.md §Security Review - safety::no-dep-bump → supply-chain rationale Agent attempted wc -w for word counts — sandbox correctly denied Bash per RULE 0.13, observable reinforcement of the very policy this capability encodes. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
29 lines
677 B
TOML
29 lines
677 B
TOML
[capability]
|
|
name = "tools::cargo-only-bash"
|
|
category = "tools"
|
|
version = "1.0"
|
|
description = "Restrict Bash to cargo and a handful of safe read/navigate/cleanup helpers."
|
|
rationale = "Bash is the highest-blast-radius tool. A narrow allowlist keeps agents on the cargo + inspect loop and prevents accidental `curl | sh`, `npm install`, or `sudo` escalation."
|
|
|
|
[restricts]
|
|
tool-patterns = [
|
|
'^cargo( |$)',
|
|
'^mkdir( |$)',
|
|
'^ls( |$)',
|
|
'^cat( |$)',
|
|
'^grep( |$)',
|
|
'^find( |$)',
|
|
'^rm -rf /tmp/',
|
|
]
|
|
tools-denied = []
|
|
|
|
[parameterized]
|
|
accepts = []
|
|
|
|
[text]
|
|
path = "text.md"
|
|
|
|
[gate]
|
|
rust-module = "gates::tools_cargo_only_bash"
|
|
event = "PreToolUse:Bash"
|
|
severity = "block"
|