openmoat 0.12.1

# OpenMoat default policy, schema v1 (docs/POLICY.md).
# Evaluation: deny → allow → ask → defaults. Strictest verdict wins across the
# atomic actions of one tool call. `${project}` is the trusted project root.
# Deny rules are absolute (allow can never override them), so deny-by-default
# for a whole kind is expressed via `defaults`, with allow rules as the holes.
version: 1
defaults:
  "*": ask
  net: deny          # outbound network: only hosts listed under allow
  fetch: ask         # a host fetch tool (WebFetch) reading an unlisted URL: no request body, so ask (ADR-017)

deny:
  - id: secrets-paths
    reason: secret material
    fs.read: &secret-paths
      - "~/.ssh/**"
      - "~/.aws/**"
      - "~/.gnupg/**"
      - "~/.config/gh/**"
      - "~/.netrc"
      - "~/.docker/config.json"
      - "~/.kube/**"
      - "~/.config/gcloud/**"
      - "~/.azure/**"
      # package-registry and git credential stores
      - "~/.git-credentials"
      - "~/.npmrc"
      - "~/.pypirc"
      - "~/.cargo/credentials"
      - "~/.cargo/credentials.toml"
      # shell history holds pasted tokens and passwords
      - "~/.zsh_history"
      - "~/.bash_history"
      - "**/.env"
      - "**/.env.*"
      - "**/.envrc"
      # committed templates of .env carry no values
      - "!**/.env.example"
      - "!**/.env.sample"
      - "!**/.env.template"
      - "~/Library/Keychains/**"
    fs.write: *secret-paths
  - id: env-secrets
    reason: secret environment variable
    env.read: ["*_KEY", "*_TOKEN", "*_SECRET", "*_PASSWORD", "AWS_*", "GITHUB_TOKEN", "NPM_TOKEN"]
  - id: env-dump
    reason: prints every environment variable, secrets included
    shell:
      - "env $"
      - "env -0 $"
      - "env --null $"
      - "*/env $"
      - "printenv $"
      - "printenv -0 $"
      - "printenv --null $"
      - "*/printenv $"
      - "set $"
      - "export $"
      - "export -p $"
      - "declare $"
      - "declare -p $"
      - "declare -x $"
      - "typeset $"
      - "typeset -p $"
      - "typeset -x $"
  - id: env-poison
    reason: changes how later commands resolve or load code
    env.set: ["PATH", "LD_PRELOAD", "LD_LIBRARY_PATH", "DYLD_*", "NODE_OPTIONS", "PYTHONPATH", "GIT_*", "BASH_ENV", "ENV", "PROMPT_COMMAND", "MOAT_*"]
  - id: pipe-to-shell
    reason: executes remote or decoded content
    shell:
      - "curl * | {sh,bash,zsh,dash,ksh,fish}"
      - "curl * | {python*,node,perl,ruby,php,deno,bun,pwsh}"
      - "wget * | {sh,bash,zsh,dash,ksh,fish}"
      - "wget * | {python*,node,perl,ruby,php,deno,bun,pwsh}"
      # decoder stages are reported as a canonical `<decoder> -d | <interpreter>` pipeline
      - "* -d | {sh,bash,zsh,dash,ksh,fish}"
      - "* -d | {python*,node,perl,ruby,php,deno,bun,pwsh}"
      - "eval *"
  - id: destructive
    reason: irreversible damage
    # removing, moving or replacing the home directory or the root itself, however the
    # command spells the path (`~/`, `$HOME`, `${HOME}`, `/Users/me/`, `~/x/..`); paths
    # below them are not matched
    fs.write: ["~", "/"]
    shell:
      # what that cannot see: an unexpanded `*` operand (the shell expands it to every
      # entry) and `//` (canonicalised as a network root); shell-only, so no OS layer
      # receives these spellings (`[{]`, `[}]` and `[*]` are literal characters)
      - "rm * {//,/[*],~/[*],$HOME/[*],$[{]HOME[}]/[*]}"
      - "rm -rf --no-preserve-root*"
      # git takes an unambiguous prefix of a long option (`--del` is `--delete`), so
      # `--for*` and `--de*`: no other `git push` option starts with either
      - "git push --for*"
      - "git push -f*"
      # a `+` refspec, and force flags after the remote or bundled with other short options
      - "git push * +*"
      - "git push * --for*"
      - "git push * -f*"
      - "git push * -[!o-]*f*"
      # deleting a remote branch: an empty source refspec (`:main`), `--delete`, `-d`
      - "git push * :?*"
      - "git push * --de*"
      - "git push * -d*"
      - "git push * -[!o-]*d*"
      - "git reset --hard*"
      - "git clean -fdx*"
      - "git branch -D *"
      - "git stash drop*"
      - "git stash clear*"
      - "sudo *"
      - "mkfs*"
      - "dd if=*"
      - "shutdown *"
      - "reboot"
  - id: kernel-self
    reason: OpenMoat protects its own policy, hooks and binary
    fs.write:
      # the state and host directories themselves: renaming, deleting or replacing
      # one with a link removes every pinned file and hook inside it at once
      - "~/.moat"
      - "~/.claude"
      - "~/.codex"
      - "~/.cursor"
      - "**/.moat"
      - "**/.claude"
      - "**/.codex"
      - "**/.cursor"
      - "~/.moat/**"
      - "~/.claude/settings.json"
      - "~/.claude/settings.local.json"
      - "~/.codex/**"
      - "~/.cursor/hooks.json"
      - "~/.cursor/sandbox.json"
      - "**/.claude/settings.json"
      - "**/.claude/settings.local.json"
      - "**/.cursor/hooks.json"
      - "**/.cursor/sandbox.json"
      - "**/.codex/hooks.json"
      - "**/.moat/**"
      # the binary every installed hook runs
      - "**/bin/moat"
      - "**/bin/moat.exe"
      # Scoop: apps/moat/current (the junction hooks run through) and each
      # apps/moat/<version> it may point at (ADR-016)
      - "**/apps/moat/current"
      - "**/apps/moat/*/moat.exe"
    shell:
      - "moat policy *"
      - "moat init*"
      - "moat doctor*"
      - "moat allow*"
      - "moat trust*"
      - "moat edit*"
      - "*/moat policy *"
      - "*/moat init*"
      - "*/moat doctor*"
      - "*/moat allow*"
      - "*/moat trust*"
      - "*/moat edit*"
      - "moat uninstall*"
      - "*/moat uninstall*"
      - "moat sandbox sync*"
      - "*/moat sandbox sync*"
      # pseudo-terminal wrappers that fake the terminal `allow`/`edit`/`trust`/`uninstall`/`sandbox sync`/`doctor --accept` require
      - "{script,*/script,unbuffer,tmux,*/tmux,screen,*/screen} * moat sandbox sync*"
      - "{script,*/script,unbuffer,tmux,*/tmux,screen,*/screen} * */moat sandbox sync*"
      - "script * moat {allow,doctor,edit,init,policy,trust,uninstall}*"
      - "script * */moat {allow,doctor,edit,init,policy,trust,uninstall}*"
      - "script * '*moat {allow,doctor,edit,init,policy,trust,uninstall,sandbox*sync}*'"
      - "expect * '*moat {allow,doctor,edit,init,policy,trust,uninstall,sandbox*sync}*'"
      - "unbuffer * moat {allow,doctor,edit,init,policy,trust,uninstall}*"
      - "unbuffer * */moat {allow,doctor,edit,init,policy,trust,uninstall}*"
      - "*/script * moat {allow,doctor,edit,init,policy,trust,uninstall}*"
      - "*/script * */moat {allow,doctor,edit,init,policy,trust,uninstall}*"
      - "*/script * '*moat {allow,doctor,edit,init,policy,trust,uninstall,sandbox*sync}*'"
      - "*/expect * '*moat {allow,doctor,edit,init,policy,trust,uninstall,sandbox*sync}*'"
      # Python's pty module, terminal multiplexers and macOS Terminal scripting (ADR-014)
      - "{python*,*/python*} * '*pty*spawn*(*moat*{allow,doctor,edit,init,policy,trust,uninstall,sandbox*sync}*'"
      - "{tmux,*/tmux,screen,*/screen} * moat {allow,doctor,edit,init,policy,trust,uninstall}*"
      - "{tmux,*/tmux,screen,*/screen} * */moat {allow,doctor,edit,init,policy,trust,uninstall}*"
      - "{tmux,*/tmux,screen,*/screen} * '*moat {allow,doctor,edit,init,policy,trust,uninstall,sandbox*sync}*'"
      - "{osascript,*/osascript} * '*moat {allow,doctor,edit,init,policy,trust,uninstall,sandbox*sync}*'"
      # a bare `moat` (the home screen asks to accept drift or approve an ask) under the
      # same wrappers; patterns are prefixes, so these deny any `moat` command run in them
      - "{script,*/script,unbuffer,*/unbuffer,tmux,*/tmux,screen,*/screen} * {moat,*/moat}"
      - "{script,*/script,tmux,*/tmux,screen,*/screen} * '{moat,*/moat}'*"
      - "{expect,*/expect} * '*spawn {moat,*/moat}{;,\n,'}*"
      - "{python*,*/python*} * '*pty*spawn*(*\"{moat,*/moat}\"{],)}*'"
      - "{osascript,*/osascript} * '*\"{moat,*/moat}\"*'"
  - id: shell-rc
    reason: edits persist into every future shell session
    fs.write: ["~/.zshrc", "~/.bashrc", "~/.bash_profile", "~/.profile", "~/.zprofile", "~/.zshenv"]
  - id: cloud-metadata
    reason: instance metadata and link-local services hand out cloud credentials
    # a `net` deny also covers `fetch` (ADR-017), so a fetch tool cannot read them either
    net: ["169.254.*", "fe80:*", "fd00:ec2::254", "100.100.100.200", "metadata.google.internal", "metadata.goog"]

allow:
  - id: project-fs
    # the root itself too: a search with no path reads the whole project
    fs.read: ["${project}", "${project}/**"]
    fs.write: ["${project}/**", "!${project}/.git/**", "!${project}/.moat/**"]
  - id: dev-shell
    shell:
      - "git status*"
      - "git diff*"
      - "git log*"
      - "git show*"
      - "git branch*"
      - "git add *"
      - "git commit *"
      - "git checkout *"
      - "git switch *"
      - "git fetch*"
      - "git pull*"
      - "git rebase *"
      - "git stash*"
      - "ls*"
      - "cat *"
      - "head *"
      - "tail *"
      - "grep *"
      - "rg *"
      - "find *"
      - "pwd"
      - "echo *"
      - "which *"
      - "true"
      - "jq *"
      # moving around and everyday file operations; every path operand is also an
      # fs atom (resolved through cd and symlinks), so outside the project these ask
      - "cd"
      - "cd *"
      - "pushd *"
      - "popd"
      - "mkdir *"
      - "touch *"
      - "cp *"
      - "mv *"
      - "rm *"
      - "npm test*"
      - "npm run *"
      - "pnpm test*"
      - "pnpm run *"
      - "pnpm build*"
      - "pnpm lint*"
      - "pnpm typecheck*"
      - "pnpm exec *"
      - "yarn exec *"
      - "yarn test*"
      - "yarn run *"
      - "yarn build*"
      - "yarn lint*"
      - "cargo build*"
      - "cargo test*"
      - "cargo check*"
      - "cargo clippy*"
      - "cargo fmt*"
      - "cargo run*"
      - "cargo doc*"
      - "cargo bench*"
      - "cargo nextest*"
      - "cargo tree*"
      - "cargo metadata*"
      - "go test*"
      - "go build*"
      - "go vet*"
      - "swift test*"
      - "swift build*"
      - "pytest*"
      - "python -m pytest*"
      - "python3 -m pytest*"
      # the directory operands are fs.write atoms, so outside the project these ask
      - "python -m venv *"
      - "python3 -m venv *"
      # the project's own virtual environment, as written: any other spelling or file asks
      - "source .venv/bin/activate $"
      - ". .venv/bin/activate $"
      - "source venv/bin/activate $"
      - ". venv/bin/activate $"
      - "make $"
      - "make test*"
      - "make build*"
      - "make check*"
      - "make lint*"
      # options that run another program or write outside the command's own output (ADR-012)
      # recursive removal, and checkouts that discard uncommitted work, stay at ask
      - "!rm *-*r*"
      - "!rm *-*R*"
      - "!git checkout * ."
      - "!git checkout * -- *"
      - "!git checkout * -f*"
      - "!git checkout * --force*"
      - "!find * -exec*"
      - "!find * -ok*"
      - "!find * -delete*"
      - "!find * -fprint*"
      - "!find * -fls*"
      - "!rg * --pre"
      - "!rg * --pre=*"
      - "!git * --upload-pack*"
      - "!git * --receive-pack*"
      - "!go * -exec*"
      - "!go * -toolexec*"
      - "!go * -vettool*"
      - "!cargo * --config*"
      # rebase options that run commands (`--exec`, `-x`), open the todo list
      # (`--interactive`, `-i`, `--edit-todo`), resume a todo list that may hold `exec`
      # lines (`--continue`, `--skip`) or run a `git-merge-<name>` program (`--strategy`,
      # `-s`); git takes an unambiguous prefix of a long option, so `--ex*` is `--exec`
      - "!git rebase * --ex*"
      - "!git rebase * --in*"
      - "!git rebase * --ed*"
      - "!git rebase * --con*"
      - "!git rebase * --sk*"
      - "!git rebase * --str*"
      - "!git rebase * -[ixs]*"
      - "!git rebase * -[!-]*[ixs]*"
      # venv `--clear` empties an existing directory, `--upgrade-deps` downloads
      # packages; argparse also takes a prefix of a long option
      - "!python* -m venv * --cl*"
      - "!python* -m venv * --u*"
  - id: dev-readonly
    reason: read-only inspection tools and non-secret variables
    shell:
      - "wc *"
      - "diff *"
      - "tree*"
      - "docker ps*"
      - "docker images*"
      - "docker logs *"
      - "docker version*"
      - "gh pr view*"
      - "gh pr list*"
      - "gh pr diff*"
      - "gh pr checks*"
      - "gh issue view*"
      - "gh issue list*"
      - "gh run list*"
      - "gh run view*"
      - "gh repo view*"
      - "!* --output*"
      - "!* -o *"
    env.read: ["PATH", "HOME", "USER", "SHELL", "PWD", "LANG", "TERM", "TMPDIR", "EDITOR"]
  - id: dev-tools
    shell:
      - "tsc*"
      - "eslint *"
      - "prettier *"
      - "biome *"
      - "vitest*"
      - "jest*"
      - "mocha*"
      - "ruff *"
      - "black *"
      - "mypy *"
      - "golangci-lint*"
  - id: text-tools
    reason: read-only text tools; the classifier reads their options and scripts (shell/text.rs)
    shell:
      - "sed *"
      - "awk *"
      - "sort *"
      - "uniq *"
      - "cut *"
      # what the classifier cannot prove read-only is reported as `<program> @<argument>`
      - "!{sed,awk,sort,uniq,cut} @*"
  - id: registries
    net:
      - "api.github.com"
      - "github.com"
      - "registry.npmjs.org"
      - "crates.io"
      - "static.crates.io"
      - "index.crates.io"
      - "proxy.golang.org"
      - "pypi.org"
      - "files.pythonhosted.org"
  - id: safe-mcp
    mcp: ["mcp__github__search_*", "mcp__github__get_*", "mcp__filesystem__read_*", "mcp__filesystem__list_*"]

ask:
  - id: installs
    reason: new dependency
    shell: ["npm install *", "npm i *", "npm ci*", "pnpm add *", "pnpm install*", "pnpm dlx *", "yarn add *", "yarn install*", "yarn dlx *", "npx *", "npm exec *", "npm x *", "pip install *", "pip3 install *", "cargo add *", "cargo install *", "brew install *", "gem install *"]
  - id: push
    reason: publishes to a remote
    shell: ["git push *", "npm publish*", "pnpm publish*", "yarn publish*", "cargo publish*", "gh release *"]
  - id: local-net
    reason: local service; may expose a control API (Docker, databases, cloud agents)
    net: ["localhost", "127.0.0.1", "::1"]

executables: {}

# What the host sandboxes OpenMoat configures (ADR-018) may read beyond the project:
# system and toolchain locations every build reads. Only OS layers use this list;
# the hook still applies the rules above to these reads (ask), and secrets-paths
# still wins inside them. Writes stay project-only. Missing paths are harmless.
sandbox:
  read_roots:
    - /usr
    - /bin
    - /sbin
    - /lib
    - /lib64
    - /etc
    - /opt
    - /nix
    - /snap
    - /System
    - /Library
    - /Applications/Xcode.app
    - /private/etc
    - /tmp
    - /private/tmp
    - /var/folders
    - /private/var/folders
    - ~/.gitconfig
    - ~/.cargo
    - ~/.rustup
    - ~/.npm
    - ~/.nvm
    - ~/.pyenv
    - ~/.local/bin
    - ~/go