# Default role: combined most-permissive settings from all tasks/roles
cwd: "{CWD}"
filesystem:
  ro:
    - "{XDG_CONFIG_HOME}/git"
    - "{HOME}/.ssh"
    - "{HOME}/.netrc"
    - "{HOME}/.local/share/anvillm/mail"
    - "/etc/gitconfig"
    - "/etc/gitattributes"
    - "/etc/ssh/ssh_config"
    - "/etc/ssh/ssh_known_hosts"
    - "/etc/magic"
    - "/var/log"
    - "/run/systemd"
    - "/var/log/journal"
    - "/etc/systemd"
    - "/proc"
    - "/sys"
    - "{HOME}/.jenkins"
    - "{HOME}/.psqlrc"
    - "{HOME}/.pgpass"
    - "{HOME}/.aws"
    - "{HOME}/.ansible"
    - "{HOME}/.ansible.cfg"
    - "{HOME}/.jira.d"
    - "{HOME}/.my.cnf"
    - "{HOME}/.mylogin.cnf"
    - "{XDG_CONFIG_HOME}/gh"
    - "{XDG_DATA_HOME}/gh/extensions"
    - "/dev"
  rw:
    - "{HOME}/.ssh/known_hosts"
    - "{HOME}/pCloudDrive"
    - "{HOME}/.pcloud"
    - "{HOME}/.git-credentials"
    - "{XDG_CONFIG_HOME}/git/credentials"
    - "{XDG_RUNTIME_DIR}/git/"
    - "{HOME}/.mcpt"
    - "{HOME}/doc"
    - "{HOME}/.gnupg"
    - "{XDG_DOCUMENTS_DIR}"
    - "{XDG_CONFIG_HOME}/.jira"
    - "{HOME}/.m2"
    - "{HOME}/.gradle"
    - "/var/run/docker.sock"
    - "{HOME}/.docker"
    - "{HOME}/.pnpm-store"
    - "{XDG_CONFIG_HOME}/yarn"
    - "{HOME}/.yarnrc.yml"
    - "{HOME}/.npmrc"
    - "{HOME}/.ansible/tmp"
    - "{XDG_RUNTIME_DIR}"
    - "{XDG_DATA_HOME}/containers"
    - "{XDG_CONFIG_HOME}/containers"
    - "{XDG_CONFIG_HOME}/pip"
    - "{HOME}/.pip"
    - "{HOME}/.cargo"
    - "{HOME}/.rustup"
    - "{XDG_CONFIG_HOME}/nvim"
    - "{XDG_CONFIG_HOME}/vim"
    - "{XDG_DATA_HOME}/nvim"
    - "{XDG_STATE_HOME}/nvim"
    - "{HOME}/.local/share/anvillm"
    - "{HOME}/.vimrc"
    - "{HOME}/.vim"
    - "{HOME}/.emacs.d"
    - "{HOME}/.config/emacs"
    - "/etc"
    - "/usr/local/etc"
    - "/dev/urandom"
    - "/dev/random"
    - "/dev/null"
    - "/dev/fuse"
  rox:
    - "{HOME}/go/bin"
    - "{HOME}/env"
    - "/proc/self/fd"
    - "/proc/self/cmdline"
  rwx:
    - "{CWD}"
    - "{PLAN9}"
    - "{HOME}/bin"
    - "{HOME}/mnt"
    - "{HOME}/.pyenv"
    - "{HOME}/.local/bin"
    - "{HOME}/.sdkman"
    - "{HOME}/go"
    - "{HOME}/.cache/go-build"
    - "{HOME}/opt"
    - "{HOME}/src"
    - "{HOME}/prj"
    - "{HOME}/.nvm"
    - "{HOME}/.please"
    - "{HOME}/.npm"
    - "{HOME}/.mcp-auth"
    - "{HOME}/.yarn"
env:
  - AGENT_SKILLS_PATH
  - NAMESPACE
  - OLLIE_9MOUNT
  - HOME
  - TMPDIR
  - AGENT_ID
  - PLAN9
  - JENKINS_USER_ID
  - JENKINS_API_TOKEN
  - JENKINS_MCP_AUTH
  - JIRA_API_TOKEN
  - BITBUCKET_ACCESS_TOKEN
  - BITBUCKET_TOKEN
  - BITBUCKET_USERNAME
  - PCLOUD_USER
  - EDITOR
  - GIT_SEQUENCE_EDITOR
  - SUPERPOWERD_SESSION_TOKEN
network:
  unrestricted: true