Initial opencode‑tinfoil nono profile repository

2026-08-12 18:26:06 +01:00
commit cd26906105
7 changed files with 320 additions and 0 deletions
@@ -0,0 +1,148 @@
+{
+  "meta": {
+    "name": "opencode-tinfoil",
+    "description": "OpenCode sandbox with Tinfoil enclave and LLM API access"
+  },
+  "groups": {
+    "include": ["deny_credentials"]
+  },
+  "commands": {
+    "allow": [
+      "git",
+      "node",
+      "npm",
+      "npx",
+      "bun",
+      "python3",
+      "python",
+      "pip",
+      "pip3",
+      "cargo",
+      "rustc",
+      "go",
+      "tinfoil"
+    ],
+    "deny": [
+      "sudo",
+      "su",
+      "doas",
+      "pkexec",
+      "passwd",
+      "chsh",
+      "usermod",
+      "useradd",
+      "deluser",
+      "rm -rf /",
+      "mkfs",
+      "dd",
+      "fdisk",
+      "parted"
+    ]
+  },
+  "workdir": {
+    "access": "readwrite"
+  },
+  "filesystem": {
+    "allow": [
+      "."
+    ],
+    "read": [
+      "${HOME}/.config/opencode",
+      "${HOME}/.local/share/opencode",
+      "${HOME}/.opencode",
+      "${HOME}/.claude",
+      "${HOME}/.gitconfig",
+      "${HOME}/.ssh/config",
+      "${HOME}/.tinfoil",
+      "/etc/ssl",
+      "/etc/pki",
+      "/usr/share/ca-certificates",
+      "/usr/local/share/ca-certificates",
+      "/tmp"
+    ],
+    "write": [
+      "${HOME}/.config/opencode",
+      "${HOME}/.local/share/opencode",
+      "${HOME}/.opencode",
+      "${HOME}/.claude",
+      "/tmp"
+    ],
+    "deny": [
+      "${HOME}/.ssh/id_*",
+      "${HOME}/.gnupg",
+      "${HOME}/.aws",
+      "${HOME}/.azure",
+      "${HOME}/.gcp",
+      "${HOME}/.kube",
+      "${HOME}/.docker/config.json",
+      "${HOME}/.netrc",
+      "${HOME}/.npmrc",
+      "/etc/shadow",
+      "/etc/passwd",
+      "/etc/hosts"
+    ]
+  },
+  "network": {
+    "block": false,
+    "allow_domain": [
+      "api.openai.com",
+      "api.anthropic.com",
+      "api.groq.com",
+      "api.together.xyz",
+      "api.openrouter.com",
+      "generativelanguage.googleapis.com",
+      "api.mistral.ai",
+      "api.cohere.com",
+      "api.x.ai",
+      "api.deepseek.com",
+      "api.perplexity.ai",
+      "api.gemini.google.com",
+      "api.fireworks.ai",
+      "api.replicate.com",
+      "api.ollama.local",
+      "llm.api.cloudflare.com",
+      "api.scaleway.ai",
+      "api.alibabacloud.com",
+      "api.moonshot.cn",
+      "api.minimaxi.com",
+      "api.stepfun.com",
+      "api.01.ai",
+      "inference.tinfoil.sh",
+      "*.tinfoil.sh",
+      "api.tinfoil.sh",
+      "containers.tinfoil.sh",
+      "ghcr.io",
+      "registry.npmjs.org",
+      "npmjs.org",
+      "github.com",
+      "raw.githubusercontent.com",
+      "objects.githubusercontent.com",
+      "huggingface.co",
+      "cdn.jsdelivr.net",
+      "unpkg.com",
+      "esm.sh",
+      "deno.land",
+      "crates.io",
+      "index.crates.io",
+      "static.crates.io",
+      "proxy.golang.org",
+      "sum.golang.org",
+      "pypi.org",
+      "files.pythonhosted.org",
+      "download.pytorch.org"
+    ]
+  },
+  "environment": {
+    "set_vars": {
+      "OPENCODE_CONFIG_DIR": "${HOME}/.config/opencode",
+      "TINFOIL_CONFIG_DIR": "${HOME}/.tinfoil"
+    },
+    "deny_vars": [
+      "AWS_SECRET_ACCESS_KEY",
+      "AWS_ACCESS_KEY_ID",
+      "AZURE_CLIENT_SECRET",
+      "GCP_PRIVATE_KEY",
+      "KUBECONFIG"
+    ]
+  }
+}