policy

package
v0.1.60 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 29, 2026 License: MIT Imports: 16 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func ApprovalFiles added in v0.1.15 

func ApprovalFiles(call core.ToolCall) []string

func ApprovalGrantKeysAllowAll added in v0.1.30 

func ApprovalGrantKeysAllowAll(granted map[string]bool, keys []string) bool

func ApprovalKey 

func ApprovalKey(call core.ToolCall) string

func ApprovalKeys added in v0.1.15 

func ApprovalKeys(call core.ToolCall) []string

func ApprovalKeysFileScoped added in v0.1.15 

func ApprovalKeysFileScoped(keys []string) bool

func ApprovalKeysForDecision added in v0.1.24 

func ApprovalKeysForDecision(call core.ToolCall, decision PolicyDecision) []string

func ApprovalKind added in v0.1.15 

func ApprovalKind(call core.ToolCall) string

func ApprovalMetadata added in v0.1.15 

func ApprovalMetadata(call core.ToolCall, keys []string, metadata map[string]any) map[string]any

func ApprovalRequestKeys added in v0.1.15 

func ApprovalRequestKeys(req ApprovalRequest) []string

func ApprovalScope 

func ApprovalScope(call core.ToolCall) string

func ApprovalSessionScope added in v0.1.15 

func ApprovalSessionScope(call core.ToolCall) string

func ApprovalSummary 

func ApprovalSummary(call core.ToolCall) string

func DecisionRequiresNonExternalApproval added in v0.1.58 

func DecisionRequiresNonExternalApproval(decision PolicyDecision) bool

func ExternalReadApprovalRootsForDecision added in v0.1.24 

func ExternalReadApprovalRootsForDecision(call core.ToolCall, decision PolicyDecision) []string

func ExternalReadApprovalRootsFromKeys added in v0.1.24 

func ExternalReadApprovalRootsFromKeys(keys []string) []string

func NormalizeShellApprovalCommand added in v0.1.15 

func NormalizeShellApprovalCommand(command string) string

func ShellApprovalKeys added in v0.1.17 

func ShellApprovalKeys(command string) []string

func ShellRiskDecision added in v0.1.17 

func ShellRiskDecision(call core.ToolCall) shellrisk.Decision

func ToolResultReadPath added in v0.1.58 

func ToolResultReadPath(dir string, call core.ToolCall) bool

toolResultReadPath extracts the file path from a read-only filesystem tool call and reports whether it falls inside the tool-results session directory, which should be auto-allowed without user approval.

func WriteStdinApprovalKey added in v0.1.44 

func WriteStdinApprovalKey(body map[string]any) string

Types

type ApprovalDecision added in v0.1.8 

type ApprovalDecision int
const (
	ApprovalDeny ApprovalDecision = iota
	ApprovalAllow
	ApprovalAllowForSession
	ApprovalCancel
)

func (ApprovalDecision) Approved added in v0.1.8 

func (d ApprovalDecision) Approved() bool

func (ApprovalDecision) Canceled added in v0.1.14 

func (d ApprovalDecision) Canceled() bool

func (ApprovalDecision) ForSession added in v0.1.8 

func (d ApprovalDecision) ForSession() bool

type ApprovalFunc 

type ApprovalFunc func(req ApprovalRequest) ApprovalDecision

type ApprovalRequest 

type ApprovalRequest struct {
	SessionID string
	ToolCall  core.ToolCall
	Spec      core.ToolSpec
	Reason    string
	Code      string
	Key       string
	Keys      []string
	Metadata  map[string]any
}

type ApprovalRequirement added in v0.1.24 

type ApprovalRequirement struct {
	Permission string
	Pattern    string
}

type DefaultToolPolicy 

type DefaultToolPolicy struct {
	Default       PermissionAction
	Rules         []PermissionRule
	WorkspaceRoot string
	WorktreeRoot  string
}

func (DefaultToolPolicy) Decide 

func (p DefaultToolPolicy) Decide(spec core.ToolSpec, call core.ToolCall) PolicyDecision

type ExecBoundaryRequest added in v0.1.44 

type ExecBoundaryRequest struct {
	Program string
	Argv    []string
	CWD     string
}

ExecBoundaryRequest is the structured command boundary used by an intercepting shell runtime when the shell is about to exec a concrete program. This is intentionally separate from write_stdin: terminal input is transport, while command policy belongs at the eventual program/argv boundary.

type PermissionAction added in v0.1.17 

type PermissionAction string
const (
	PermissionAllow PermissionAction = "allow"
	PermissionAsk   PermissionAction = "ask"
	PermissionDeny  PermissionAction = "deny"
)

func ParsePermissionAction added in v0.1.17 

func ParsePermissionAction(v string) (PermissionAction, error)

type PermissionConfig added in v0.1.18 

type PermissionConfig struct {
	Read              map[string]string
	Edit              map[string]string
	Shell             map[string]string
	Terminal          map[string]string
	ExternalDirectory map[string]string
	MCP               map[string]string
	Memory            map[string]string
	Task              map[string]string
	WebSearch         map[string]string
	WebFetch          map[string]string
	MutatingTool      map[string]string
}

func DefaultPermissionConfig added in v0.1.18 

func DefaultPermissionConfig() PermissionConfig

type PermissionRule added in v0.1.17 

type PermissionRule struct {
	Permission string
	Pattern    string
	Action     PermissionAction
}

func DefaultRules added in v0.1.17 

func DefaultRules() []PermissionRule

func RulesFromConfig added in v0.1.18 

func RulesFromConfig(config PermissionConfig) ([]PermissionRule, error)

func RulesFromMap added in v0.1.17 

func RulesFromMap(permission string, rules map[string]string) ([]PermissionRule, error)

type PolicyDecision 

type PolicyDecision struct {
	Allow                bool
	RequiresApproval     bool
	Reason               string
	Code                 string
	Phase                string
	MatchedRule          string
	Permission           string
	Pattern              string
	ApprovalRequirements []ApprovalRequirement
	AllowedRequirements  []ApprovalRequirement
}

type ReadOnlyTurnPolicy added in v0.1.17 

type ReadOnlyTurnPolicy struct {
	Base ToolPolicy
}

func (ReadOnlyTurnPolicy) Decide added in v0.1.17 

func (p ReadOnlyTurnPolicy) Decide(spec core.ToolSpec, call core.ToolCall) PolicyDecision

type RulePolicy added in v0.1.17 

type RulePolicy struct {
	Default       PermissionAction
	Rules         []PermissionRule
	WorkspaceRoot string
	WorktreeRoot  string
}

func (RulePolicy) Decide added in v0.1.17 

func (p RulePolicy) Decide(spec core.ToolSpec, call core.ToolCall) PolicyDecision

func (RulePolicy) DecideExecBoundary added in v0.1.44 

func (p RulePolicy) DecideExecBoundary(req ExecBoundaryRequest) PolicyDecision

type ScopedAllowPolicy added in v0.1.17 

type ScopedAllowPolicy struct {
	Base               ToolPolicy
	ShellAllowPrefixes []string
}

func (ScopedAllowPolicy) Decide added in v0.1.17 

func (p ScopedAllowPolicy) Decide(spec core.ToolSpec, call core.ToolCall) PolicyDecision

type SessionApprovalCache 

type SessionApprovalCache struct {
	// contains filtered or unexported fields
}

func NewSessionApprovalCache 

func NewSessionApprovalCache() *SessionApprovalCache

func (*SessionApprovalCache) Grant 

func (c *SessionApprovalCache) Grant(sessionID, key string)

func (*SessionApprovalCache) GrantAll added in v0.1.15 

func (c *SessionApprovalCache) GrantAll(sessionID string, keys []string)

func (*SessionApprovalCache) Has 

func (c *SessionApprovalCache) Has(sessionID, key string) bool

func (*SessionApprovalCache) HasAll added in v0.1.15 

func (c *SessionApprovalCache) HasAll(sessionID string, keys []string) bool

func (*SessionApprovalCache) IsLoaded 

func (c *SessionApprovalCache) IsLoaded(sessionID string) bool

func (*SessionApprovalCache) Merge 

func (c *SessionApprovalCache) Merge(sessionID string, keys map[string]bool)

func (*SessionApprovalCache) SetLoaded 

func (c *SessionApprovalCache) SetLoaded(sessionID string)

type ShellExecutionRequest added in v0.1.44 

type ShellExecutionRequest struct {
	Source  string
	Command string
	CWD     string
}

type ToolPolicy 

type ToolPolicy interface {
	Decide(spec core.ToolSpec, call core.ToolCall) PolicyDecision
}

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.