securitystate

type Label ¶

type Label string

const (
	LabelAdded      Label = "added"
	LabelRemoved    Label = "removed"
	LabelChanged    Label = "changed"
	LabelMalformed  Label = "malformed"
	LabelUnreadable Label = "unreadable"
	LabelMissing    Label = "missing"
)

type LayerKind ¶

type LayerKind string

const (
	LayerGlobal  LayerKind = "global"
	LayerProject LayerKind = "project"
	LayerLocal   LayerKind = "local"
)

type LayerSnapshot ¶

type LayerSnapshot struct {
	Kind    LayerKind
	Path    string
	Ignored bool
	Present bool
	Raw     map[string]any
}

LayerSnapshot is one settings layer as bootstrap admitted it, handed to a monitor so the baseline is the content the launch actually loaded rather than a later re-read. Ignored carries a configured project path the trust gate refused: it is retained so the launch can state what it is not watching, and the monitor never opens or locks it.

type Monitor ¶

type Monitor struct {
	// contains filtered or unexported fields
}

Monitor holds a runtime-local baseline of the protected settings the launch admitted and compares later checkpoint reads against it. It never touches the live authorization or configuration cache: a checkpoint reports what changed on disk and changes nothing.

func NewMonitor(layers []LayerSnapshot) *Monitor

func (m *Monitor) AdvanceBaseline(path string, prior, next Projection) bool

func (m *Monitor) Checkpoint() []Result

type Policy ¶

type Policy struct {
	// Entries must be absolute: a relative entry matches no endpoint and protects nothing.
	SettingsPaths []string
	Blocked       *permissions.BlockedPaths
}

func (p Policy) Guards() bool

func (p Policy) ProtectedIn(root string) ([]string, error)

func (p Policy) RefuseBlockedVCS(tool, cwd string, risky func(protectedIn func(root string) ([]string, error)) bool) *Refusal

func (p Policy) RefuseNominal(tool string, args map[string]any, home, baseDir string) *Refusal

func (p Policy) RefuseResolved(tool string, endpoints ...string) *Refusal

func (p Policy) RefuseShell(subjectKind, subject, folder string, candidates []string) *Refusal

func (p Policy) RefuseVCS(tool, cwd string, risky bool) *Refusal

type Projection ¶

type Projection struct {
	// contains filtered or unexported fields
}

Projection is the protected view of one settings layer. It holds credentials in memory and is only ever compared against another projection — never rendered, logged, hashed, or persisted.

func Project(raw map[string]any) Projection

type Refusal ¶

type Refusal struct {
	SubjectKind          string
	Subject              string
	PathScope            string
	Envelope             string
	Source               string
	Entry                string
	EntrySource          string
	ArgumentHash         string
	DirectRequestSubject string
}

func (r *Refusal) Error() string

type Result ¶

type Result struct {
	Kind        LayerKind
	Path        string
	Unavailable bool
	Reason      locks.LockReason
	Sections    []Section
	Labels      []Label
}

Result is one layer's checkpoint outcome. It is metadata only: no settings content, permission argument, credential, token, account identifier, or provider name reaches it. Unavailable means the layer could not be inspected under its lock and carries no labels, which is distinct from inspecting it and finding it unreadable.

type Section ¶

type Section string

Section names a protected area of a settings layer. The vocabulary is closed and never carries a configured provider name, which is unbounded user text.

const (
	SectionPermissions           Section = "permissions"
	SectionAuth                  Section = "auth"
	SectionProviderDestination   Section = "provider_destination"
	SectionProviderCredential    Section = "provider_credential"
	SectionProviderAuthHeader    Section = "provider_auth_header"
	SectionWebResearchCredential Section = "web_research_credential"
	SectionDeclaredCommands      Section = "declared_commands"
	SectionBlockedPaths          Section = "blocked_paths"
	SectionWritableFolders       Section = "writable_folders"
)