gate

Documentation

Overview

Package gate is jess's preventive control: a fail-closed tool gate. Omitting an approver does not mean allow-all; it means deny anything not declared safe. Permissiveness is opt-in (AllowAll) and greppable.

Index

• func AllowAll() ac.ToolGate
• func Dangerous(cmd string) bool
• func New(p Policy) ac.ToolGate
• type Approver
• type Policy
• type Request
• type SafeTool

Functions

func AllowAll

func AllowAll() ac.ToolGate

AllowAll is the explicit, greppable opt-out: a gate that permits everything.

func Dangerous

func Dangerous(cmd string) bool

Dangerous is a conservative heuristic over a shell command string, ported in spirit from codebot's approval classifier. The daemon uses it inside its Approver to auto-prompt on risky bash even when a tool cannot mark itself Safe. Returns true when the command looks destructive.

func New

func New(p Policy) ac.ToolGate

New builds an agentcore.ToolGate from the policy.

Types

type Approver

type Approver func(ctx context.Context, r Request) (allow bool, reason string)

Approver decides one non-safe call. Return (true, reason) to allow.

type Policy

type Policy struct {
	Approver  Approver
	Audit     ledger.Sink
	AgentPath string

	// RunID and RequestRef tie a denied non-safe attempt to its run and request
	// for the recordDeniedAction chain entry. Both are nil-safe: when unset the
	// recorded Event simply omits the run id and the request ref. Wired by the
	// audit middleware (Task 9/10); the gate itself works without them.
	RunID      func() string
	RequestRef func() ledger.Ref
}

Policy configures the default gate.

type Request

type Request struct {
	Tool    string
	Label   string
	Preview string
	Args    []byte
}

Request is what an Approver sees for one non-safe call.

type SafeTool

type SafeTool interface{ Safe() bool }

SafeTool is the optional marker a tool implements to be auto-approved. Safe means read-only or bounded: its effect is obvious by construction.