permission

package

v0.4.2 Latest Latest Go to latest Published: Nov 4, 2026 License: AGPL-3.0, Apache-2.0 Imports: 3 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/Bluestar-coder/ARTEX-RedTeam

Links

Open Source Insights

Documentation ¶

Overview ¶

Package permission is the agent's safety boundary. It models tool-call decisions (allow / deny / ask), six permission modes, allow/deny rule lists with deny-priority, and a host-provided interactive callback. The four-stage pipeline in Evaluate combines a tool's own CheckPermissions verdict with policy and mode to produce a final decision.

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type Behavior ¶

type Behavior string

Behavior is the kind of a permission decision.

const (
	Allow Behavior = "allow"
	Deny  Behavior = "deny"
	Ask   Behavior = "ask"
)

type CanUseTool ¶

type CanUseTool func(ctx context.Context, toolName string, input json.RawMessage, pc Context) Decision

CanUseTool is the host's interactive approval callback (CLI prompt, GUI, or automated policy). It is consulted only when the pipeline reaches the "ask" stage (FR-05.1, C-02).

type Context ¶

type Context struct {
	Mode       Mode
	WorkingDir string
	Allowed    []string
	Disallowed []string
}

Context is passed to a tool's CheckPermissions and the interactive callback.

type Decision ¶

type Decision struct {
	Behavior     Behavior
	UpdatedInput json.RawMessage // optional rewritten input (e.g. stripped flag)
	Message      string          // reason, shown to model on deny / to user on ask
	Suggestions  []Update        // optional "always allow" suggestions
}

Decision is the outcome of a permission check.

func Allowed ¶

func Allowed() Decision

Allowed / Denied / AskUser build common decisions.

func AskUser ¶

func AskUser(msg string) Decision

func Denied ¶

func Denied(msg string) Decision

func Evaluate ¶

func Evaluate(ctx context.Context, req Request) Decision

Evaluate runs the four-stage pipeline (FR-05.3) and returns the final decision. Order encodes deny-priority (FR-05.5): an explicit deny rule wins over every mode, including bypass.

type Mode ¶

type Mode string

Mode is a permission mode (FR-05.4).

const (
	ModeDefault     Mode = "default"           // ask for non-read-only unless a rule allows
	ModeAcceptEdits Mode = "acceptEdits"       // auto-allow file edits/writes
	ModeBypass      Mode = "bypassPermissions" // allow everything (except deny rules)
	ModePlan        Mode = "plan"              // read-only only
	ModeDontAsk     Mode = "dontAsk"           // never prompt; rules + read-only only
	ModeAuto        Mode = "auto"              // like dontAsk but allows tool's own allow verdict
)

type Request ¶

type Request struct {
	ToolName     string
	Input        json.RawMessage
	IsReadOnly   bool
	ToolDecision Decision // verdict from the tool's own CheckPermissions
	Ctx          Context
	Ask          CanUseTool
}

Request bundles everything Evaluate needs without importing the tool package.

type Update ¶

type Update struct {
	Type string `json:"type"` // e.g. "addAllowRule"
	Rule string `json:"rule"` // e.g. "Bash(git:*)"
}

Update is a persistence suggestion ("always allow this") surfaced to the host (FR-05.6).

Source Files ¶

View all Source files

permission.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL