permissions

type Action ¶ added in v0.2.0

type Action string

Action represents the permission action to take for a tool invocation.

const (
	ActionAllow Action = "allow"
	ActionDeny  Action = "deny"
	ActionAsk   Action = "ask"
)

type ApprovalPolicy ¶ added in v0.2.0

type ApprovalPolicy struct {
	Name          string
	Tools         []string
	RiskLevel     string
	AutoApprove   bool
	RequireReason bool
	Timeout       time.Duration
	MaxPending    int
}

ApprovalPolicy defines rules for how approval requests are handled.

type ApprovalRequest ¶ added in v0.2.0

type ApprovalRequest struct {
	ID          string
	Tool        string
	Args        map[string]interface{}
	Risk        string
	Description string
	CreatedAt   time.Time
	Status      string // "pending", "approved", "denied", "expired"
	ExpiresAt   time.Time
	Reason      string
}

ApprovalRequest represents a request for approval of a high-risk operation.

type ApprovalWorkflow ¶ added in v0.2.0

type ApprovalWorkflow struct {
	Policies []ApprovalPolicy
	Pending  []*ApprovalRequest
	History  []*ApprovalRequest
	PromptFn func(*ApprovalRequest) (bool, string)
	// contains filtered or unexported fields
}

ApprovalWorkflow manages the approval process for destructive or high-risk operations.

func NewApprovalWorkflow(promptFn func(*ApprovalRequest) (bool, string)) *ApprovalWorkflow

func (wf *ApprovalWorkflow) AddPolicy(policy ApprovalPolicy)

func (wf *ApprovalWorkflow) Approve(id, reason string) error

func (wf *ApprovalWorkflow) CheckPolicy(tool string, risk string) *ApprovalPolicy

func (wf *ApprovalWorkflow) Deny(id, reason string) error

func (wf *ApprovalWorkflow) ExpirePending()

func (wf *ApprovalWorkflow) GetPending() []*ApprovalRequest

func (wf *ApprovalWorkflow) IsApproved(id string) bool

func (wf *ApprovalWorkflow) RequestApproval(tool string, args map[string]interface{}, risk string) (*ApprovalRequest, error)

type AskRecord ¶

type AskRecord struct {
	ToolName string
	Summary  string
	Allowed  bool
	Count    int
}

AskRecord records a permission decision.

type AutoModeState ¶

type AutoModeState struct {
	// contains filtered or unexported fields
}

AutoModeState tracks auto-allow decisions for learning user preferences.

func NewAutoModeState() *AutoModeState

func (a *AutoModeState) Record(toolName, summary string, allowed bool)

func (a *AutoModeState) ShouldAutoAllow(toolName, summary string) (bool, bool)

type BoundaryChecker ¶ added in v0.2.0

type BoundaryChecker struct {
	ProjectRoot     string
	AllowedPaths    []string
	BlockedPaths    []string
	AllowedCommands []string
	BlockedCommands []string
	MaxFileSize     int64
	MaxFiles        int
	FilesModified   int
	// contains filtered or unexported fields
}

BoundaryChecker enforces safety boundaries that prevent the agent from performing actions outside its authorized scope.

func NewBoundaryChecker(projectRoot string) *BoundaryChecker

func (bc *BoundaryChecker) CheckCommand(command string) *BoundaryViolation

func (bc *BoundaryChecker) CheckEnvironment(key string) *BoundaryViolation

func (bc *BoundaryChecker) CheckFileCount() *BoundaryViolation

func (bc *BoundaryChecker) CheckFileSize(path string, size int64) *BoundaryViolation

func (bc *BoundaryChecker) CheckNetwork(host string, port int) *BoundaryViolation

func (bc *BoundaryChecker) CheckPath(path string) *BoundaryViolation

func (bc *BoundaryChecker) IsWithinProject(path string) bool

func (bc *BoundaryChecker) RecordModification(path string)

func (bc *BoundaryChecker) RecordViolation(v *BoundaryViolation)

func (bc *BoundaryChecker) Summary() string

type BoundaryViolation ¶ added in v0.2.0

type BoundaryViolation struct {
	Type        string // "path", "command", "size", "count", "network", "env"
	Description string
	Attempted   string
	Allowed     string
	Severity    string // "LOW", "MEDIUM", "HIGH", "CRITICAL"
}

BoundaryViolation represents a single boundary violation detected by the checker.

type BypassKillswitch ¶

type BypassKillswitch struct {
	// contains filtered or unexported fields
}

BypassKillswitch disables permission checks globally.

func NewBypassKillswitch() *BypassKillswitch

func (b *BypassKillswitch) Disable()

func (b *BypassKillswitch) Enable()

func (b *BypassKillswitch) IsEnabled() bool

type Canonicalizer ¶ added in v0.2.0

type Canonicalizer struct{}

Canonicalizer normalizes shell commands for stable approval caching. It is stateless and safe for concurrent use.

func NewCanonicalizer() *Canonicalizer

func (c *Canonicalizer) Canonicalize(command string) string

func (c *Canonicalizer) ExtractBaseCommand(command string) string

func (c *Canonicalizer) ExtractSubcommand(command string) string

func (c *Canonicalizer) GeneratePattern(command string) string

func (c *Canonicalizer) IsBannedPrefix(command string) bool

func (c *Canonicalizer) IsEquivalent(cmd1, cmd2 string) bool

type CheckResult ¶ added in v0.2.0

type CheckResult struct {
	Package        string
	Safe           bool
	Advisories     []string
	Severity       string
	Recommendation string
	CheckedAt      time.Time
}

CheckResult represents the outcome of a package safety check.

type Classifier ¶

type Classifier struct {
	// contains filtered or unexported fields
}

Classifier classifies commands as safe or dangerous.

func NewClassifier() *Classifier

func (c *Classifier) Classify(command string) string

type ContentSource ¶ added in v0.2.0

type ContentSource string

const (
	SourceEmail     ContentSource = "email"
	SourceWebhook   ContentSource = "webhook"
	SourceAPI       ContentSource = "api"
	SourceBrowser   ContentSource = "browser"
	SourceWebSearch ContentSource = "web_search"
	SourceWebFetch  ContentSource = "web_fetch"
	SourceUnknown   ContentSource = "unknown"
)

type Destination ¶ added in v0.2.0

type Destination struct {
	Host       string
	Port       int
	Protocol   string
	Source     string
	Suspicious bool
}

Destination represents a network destination extracted from a command.

type EgressAttempt ¶ added in v0.2.0

type EgressAttempt struct {
	Command      string
	Destinations []Destination
	Allowed      bool
	Reason       string
}

EgressAttempt represents the result of inspecting a command for egress activity.

type EgressInspector ¶ added in v0.2.0

type EgressInspector struct {
	AllowedDomains   []string
	BlockedDomains   []string
	AllowedProtocols []string
	// contains filtered or unexported fields
}

EgressInspector detects and blocks data exfiltration attempts in shell commands by checking outbound network destinations before execution.

func NewEgressInspector() *EgressInspector

func (e *EgressInspector) AddAllowed(domain string)

func (e *EgressInspector) AddBlocked(domain string)

func (e *EgressInspector) ExtractNetcat(command string) []string

func (e *EgressInspector) ExtractSSHDests(command string) []string

func (e *EgressInspector) ExtractURLs(command string) []string

func (e *EgressInspector) FormatAttempt(attempt *EgressAttempt) string

func (e *EgressInspector) Inspect(command string) *EgressAttempt

func (e *EgressInspector) IsAllowed(host string) bool

func (e *EgressInspector) IsSuspicious(command string) bool

type Guardian ¶ added in v0.2.0

type Guardian struct {
	Enabled               bool
	Provider              string
	Model                 string
	Timeout               time.Duration
	MaxConsecutiveDenials int

	ChatFn func(ctx context.Context, prompt string) (string, error)
	// contains filtered or unexported fields
}

Guardian is an LLM-powered automatic permission reviewer that decides permissions on behalf of the user, reducing approval fatigue.

func NewGuardian(chatFn func(context.Context, string) (string, error)) *Guardian

func (g *Guardian) ResetCircuitBreaker()

func (g *Guardian) Review(ctx context.Context, req GuardianRequest) (*GuardianDecision, error)

type GuardianDecision ¶ added in v0.2.0

type GuardianDecision struct {
	Allowed    bool    `json:"allowed"`
	Reason     string  `json:"reason"`
	Confidence float64 `json:"confidence"`
}

GuardianDecision represents the guardian's decision on a permission request.

type GuardianRequest ¶ added in v0.2.0

type GuardianRequest struct {
	ToolName            string
	Arguments           map[string]interface{}
	ConversationContext string
	ProjectDescription  string
}

GuardianRequest represents a permission review request.

type InjectionPattern ¶ added in v0.2.0

type InjectionPattern struct {
	Name     string
	Pattern  *regexp.Regexp
	Severity string // "critical", "high", "medium", "low"
	Category string // "system_override", "data_exfil", "role_hijack", "instruction_leak"
}

InjectionPattern defines a single pattern used to detect prompt injection attempts.

type InjectionScanner ¶ added in v0.2.0

type InjectionScanner struct {
	Patterns  []*InjectionPattern
	Threshold float64
	// contains filtered or unexported fields
}

InjectionScanner detects malicious prompt injection attempts in user input and tool outputs.

func NewInjectionScanner() *InjectionScanner

func (s *InjectionScanner) DetectUnicodeAttacks(text string) []Threat

func (s *InjectionScanner) IsHighEntropy(text string) bool

func (s *InjectionScanner) Scan(text string) *ScanResult

func (s *InjectionScanner) ScanToolOutput(output string) *ScanResult

type InputSanitizer ¶ added in v0.2.0

type InputSanitizer struct {
	MaxLength        int
	StripInvisible   bool
	NormalizeUnicode bool
	// contains filtered or unexported fields
}

InputSanitizer cleans and validates all inputs before they reach the LLM, preventing injection, encoding attacks, and malformed data.

func NewInputSanitizer() *InputSanitizer

func (s *InputSanitizer) Sanitize(input string) *SanitizeResult

type MalwareEntry ¶ added in v0.2.0

type MalwareEntry struct {
	Package     string
	Ecosystem   string // "npm", "pypi", "go", "crates"
	Advisory    string
	Severity    string // "CRITICAL", "HIGH", "MEDIUM", "LOW"
	Description string
	DateAdded   time.Time
}

MalwareEntry represents a known malicious package in the database.

type OSVChecker ¶ added in v0.2.0

type OSVChecker struct {
	KnownMalware map[string]*MalwareEntry
	Cache        map[string]*CheckResult
	CacheTTL     time.Duration
	// contains filtered or unexported fields
}

OSVChecker checks packages against a known malware database before installation.

func NewOSVChecker() *OSVChecker

func (c *OSVChecker) CheckCommand(command string) *CheckResult

func (c *OSVChecker) CheckPackage(name, ecosystem string) *CheckResult

func (c *OSVChecker) DetectSuspiciousName(name string) []string

func (c *OSVChecker) IsTyposquat(name, ecosystem string) bool

func (c *OSVChecker) RefreshDatabase() error

type Rule ¶

type Rule struct {
	Tool    string `json:"tool"`    // tool name or "*" for all
	Pattern string `json:"pattern"` // glob pattern for arguments (e.g., "/tmp/*", "*.go", "go test*")
	Action  Action `json:"action"`
	Reason  string `json:"reason,omitempty"` // optional explanation
}

Rule defines a single permission rule mapping a tool and argument pattern to an action.

func Load(path string) ([]Rule, error)

func ParseRuleLine(line string) (*Rule, error)

type RuleSet ¶ added in v0.2.0

type RuleSet struct {
	Rules []Rule
	// contains filtered or unexported fields
}

RuleSet holds an ordered collection of permission rules.

func NewRuleSet() *RuleSet

func (rs *RuleSet) AddRule(rule Rule)

func (rs *RuleSet) Evaluate(toolName string, args map[string]interface{}) Action

func (rs *RuleSet) LoadFromFile(path string) error

func (rs *RuleSet) RemoveRule(index int) error

func (rs *RuleSet) SaveToFile(path string) error

type SanitizeChange ¶ added in v0.2.0

type SanitizeChange struct {
	Type        string // "stripped", "normalized", "truncated", "escaped"
	Position    int
	Original    string
	Replacement string
}

SanitizeChange describes a single modification made during sanitization.

func NormalizeHomoglyphs(text string) (string, []SanitizeChange)

func StripInvisibleChars(text string) (string, []SanitizeChange)

type SanitizeResult ¶ added in v0.2.0

type SanitizeResult struct {
	Clean       string
	Original    string
	Changes     []SanitizeChange
	WasModified bool
}

SanitizeResult holds the outcome of sanitizing an input string.

type ScanResult ¶ added in v0.2.0

type ScanResult struct {
	IsSafe         bool
	Threats        []Threat
	Score          float64
	Recommendation string
}

ScanResult contains the outcome of scanning text for injection attempts.

type ShadowedRuleDetector ¶

type ShadowedRuleDetector struct{}

ShadowedRuleDetector detects when permission rules shadow each other.

func (d *ShadowedRuleDetector) DetectShadowedRules(allowRules, denyRules []string) []string

type Threat ¶ added in v0.2.0

type Threat struct {
	Pattern  string
	Category string
	Severity string
	Match    string
	Position int
}

Threat represents a detected injection threat with context about the match.

type WrapOptions ¶ added in v0.2.0

type WrapOptions struct {
	Source         ContentSource
	Sender         string
	Subject        string
	IncludeWarning bool
}