# The "agent-safe" policy, installed with blinker: what the agent's
# Safe_Bash, and its file tools without asking, get in every project.
# Each project's safe policy includes it, and can change it. Copy it to
# policies/agent-safe.policy in blinker's config directory, or use
# /policy global, to change it for every project.

# type  access  pattern
# The project and the programs in $PATH: readable; .env files hidden.
include read
include toolchains
# Cargo's home, state and build caches: readable.
file    read    ${CARGO_HOME:-~/.cargo}
file    read    ${XDG_STATE_HOME:-~/.local/state}
file    read    ${XDG_CACHE_HOME:-~/.cache}
file    read    ~/Library/Caches
file    read    ${GOMODCACHE:-${GOPATH:-~/go}/pkg/mod}
file    read    ${GOCACHE:-${XDG_CACHE_HOME:-~/.cache}/go-build}
file    read    ${npm_config_cache:-~/.npm}
# Tools that run without asking.
tool    allow   Define
tool    allow   Usage