config

package
v0.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 6, 2026 License: MIT Imports: 12 Imported by: 0

Documentation

Overview

Package config loads layered security policies. Project policy is additive only.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Default

func Default(configDir string) (string, error)

func List

func List(configDir string) ([]string, error)

func PolicyPath

func PolicyPath(configDir, name string) string

func SetDefault

func SetDefault(configDir, name string) error

Types

type Config

type Config struct {
	Name       string
	StateDir   string
	Killswitch *Killswitch
	Patterns   []string
	AllowRead  []string
	JevScoring bool
	Mode       string
	Yolo       bool
	Injection  Injection
	Tests      []Test
	Asker      interface {
		Ask(context.Context, jev.Request) (*jev.Response, error)
	}
}

func Builtin

func Builtin(opts LoadOptions) (*Config, error)

Builtin has a small, conservative destructive-command blocklist. Scoring starts disabled because a Jev request on each hook adds latency.

func Load

func Load(opts LoadOptions) (*Config, error)

func LoadForHook

func LoadForHook(opts LoadOptions) (*Config, error)

LoadForHook keeps the embedded killswitch active when a local policy fails to load. The error is returned so the caller can record telemetry.

type Guard

type Guard struct {
	Workspace string
	AllowRead []string
}

Guard is a path-reference heuristic, not an operating-system sandbox.

func (Guard) Check

func (g Guard) Check(text string) (string, bool)

func (Guard) CheckPath

func (g Guard) CheckPath(path string) (string, bool)

func (Guard) CheckWorkDir

func (g Guard) CheckWorkDir(dir string) (string, bool)

type Injection

type Injection struct {
	Mode          string   `yaml:"mode" json:"mode"`
	Scan          string   `yaml:"scan" json:"scan"`
	MaxBytes      int      `yaml:"max_bytes" json:"max_bytes"`
	Tools         []string `yaml:"tools" json:"tools"`
	HeuristicHalt bool     `yaml:"heuristic_halt" json:"heuristic_halt"`
	HaltOn        string   `yaml:"halt_on" json:"halt_on"`
}

type Killswitch

type Killswitch struct {
	// contains filtered or unexported fields
}

func NewKillswitch

func NewKillswitch(patterns []string) (*Killswitch, error)

func (*Killswitch) Match

func (k *Killswitch) Match(command string) (string, bool)

type LoadOptions

type LoadOptions struct {
	ConfigDir, StateDir, WorkDir, Name string
	Environ                            []string
}

type Test

type Test struct {
	Command string `yaml:"command" json:"command"`
	Deny    bool   `yaml:"deny" json:"deny"`
}

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL