abi <abi/4.0>,
include <tunables/global>

# Local allow-list for AI coding tools that need unprivileged user namespaces
# for their own sandboxes on Ubuntu systems with
# kernel.apparmor_restrict_unprivileged_userns=1.

profile local-codex-cli /home/f/.codex/packages/standalone/releases/0.142.1-x86_64-unknown-linux-musl/bin/codex flags=(unconfined) {
  userns,

  include if exists <local/local-codex-cli>
}

profile local-openai-vscode-codex /home/f/.vscode-server/extensions/openai.chatgpt-26.616.81150-linux-x64/bin/linux-x86_64/codex flags=(unconfined) {
  userns,

  include if exists <local/local-openai-vscode-codex>
}

profile local-anthropic-claude-code /home/f/.vscode-server/extensions/anthropic.claude-code-2.1.191-linux-x64/resources/native-binary/claude flags=(unconfined) {
  userns,

  include if exists <local/local-anthropic-claude-code>
}

# Cline runs inside the VS Code Server extension host, which is this Node
# binary in the current Remote SSH server installation. This profile is broader
# than the tool-specific profiles above because multiple VS Code extensions
# share this host process.
profile local-vscode-server-node /home/f/.vscode-server/cli/servers/Stable-7e7950df89d055b5a378379db9ee14290772148a/server/node flags=(unconfined) {
  userns,

  include if exists <local/local-vscode-server-node>
}