Documentation
¶
Overview ¶
Package permissions re-exports the internal permissions package via type aliases so external consumers (e.g. iterion) get identity-compatible types without duplicating 1600+ lines of policy engine code.
Index ¶
- Constants
- Variables
- type Classifier
- type ClassifierCache
- type ClassifierLogger
- type Decision
- type HookPermissionOverride
- type LLMClassifier
- type LLMClassifierOption
- type Manager
- type PermissionContext
- type PermissionMode
- type PermissionOutcome
- type PermissionOverride
- type PermissionPolicy
- type PermissionPromptDecision
- type PermissionPrompter
- type PermissionRequest
- type Rule
- type RuleClassifier
- type Ruleset
- type Scope
Constants ¶
const ( ModeReadOnly = permissions.ModeReadOnly ModeWorkspaceWrite = permissions.ModeWorkspaceWrite ModeDangerFullAccess = permissions.ModeDangerFullAccess ModePrompt = permissions.ModePrompt ModeAllow = permissions.ModeAllow // CLI-facing aliases. ModeDefault = permissions.ModeDefault ModeAcceptEdits = permissions.ModeAcceptEdits ModeBypassPermissions = permissions.ModeBypassPermissions ModePlan = permissions.ModePlan )
const ( DecisionAsk = permissions.DecisionAsk DecisionAllow = permissions.DecisionAllow DecisionDeny = permissions.DecisionDeny )
const ( ScopeOnce = permissions.ScopeOnce ScopeAlways = permissions.ScopeAlways )
const ( OverrideAllow = permissions.OverrideAllow OverrideDeny = permissions.OverrideDeny OverrideAsk = permissions.OverrideAsk )
const DefaultLLMClassifierCacheSize = permissions.DefaultLLMClassifierCacheSize
DefaultLLMClassifierCacheSize is the FIFO eviction cap used by the default classifier cache.
const DefaultLLMClassifierCacheTTL = permissions.DefaultLLMClassifierCacheTTL
DefaultLLMClassifierCacheTTL is the TTL used by the default classifier cache.
const DefaultLLMClassifierModel = permissions.DefaultLLMClassifierModel
DefaultLLMClassifierModel is the default classification model used by NewLLMClassifier when no override is supplied.
Variables ¶
var LoadRuleset = permissions.LoadRuleset
LoadRuleset reads .claude/settings.json and returns a Ruleset.
var NewClassifierCache = permissions.NewClassifierCache
NewClassifierCache builds a TTL+FIFO classifier cache with the default size cap.
var NewClassifierCacheWithSize = permissions.NewClassifierCacheWithSize
NewClassifierCacheWithSize builds a TTL+FIFO classifier cache with a custom size cap.
var NewLLMClassifier = permissions.NewLLMClassifier
NewLLMClassifier builds an LLMClassifier with sensible defaults (RuleClassifier fast-path, in-memory cache, fail-safe to Ask).
var NewLLMClassifierManager = permissions.NewLLMClassifierManager
NewLLMClassifierManager returns a Manager pre-wired with an LLMClassifier.
var NewManager = permissions.NewManager
NewManager creates a Manager with the given mode and ruleset.
var NewPermissionContext = permissions.NewPermissionContext
NewPermissionContext creates a context with optional override.
var NewPermissionPolicy = permissions.NewPermissionPolicy
NewPermissionPolicy creates a policy with the given active mode.
var NewRuleClassifier = permissions.NewRuleClassifier
NewRuleClassifier returns a RuleClassifier with the documented default safe-list.
var ParsePermissionMode = permissions.ParsePermissionMode
ParsePermissionMode converts a CLI string to a PermissionMode.
var RulesetFromLists = permissions.RulesetFromLists
RulesetFromLists builds a Ruleset from plain allow/deny tool name slices.
var WithClassifierCache = permissions.WithClassifierCache
WithClassifierCache installs an in-memory decision cache.
var WithFallbackClassifier = permissions.WithFallbackClassifier
WithFallbackClassifier installs a Classifier consulted before the LLM.
var WithLogger = permissions.WithLogger
WithLogger installs an io.Writer for classifier diagnostics.
var WithMaxTokens = permissions.WithMaxTokens
WithMaxTokens caps the classifier model's response length.
Functions ¶
This section is empty.
Types ¶
type Classifier ¶
type Classifier = permissions.Classifier
Classifier evaluates a tool invocation under ModeAuto and returns a Decision.
type ClassifierCache ¶
type ClassifierCache = permissions.ClassifierCache
ClassifierCache is the in-memory TTL+FIFO cache used by LLMClassifier.
type ClassifierLogger ¶
type ClassifierLogger = permissions.ClassifierLogger
ClassifierLogger is the minimal logging surface Manager uses to surface classifier errors and panics. Set via Manager.SetClassifierLogger.
type HookPermissionOverride ¶
type HookPermissionOverride = permissions.HookPermissionOverride
HookPermissionOverride represents a hook's permission decision.
type LLMClassifier ¶
type LLMClassifier = permissions.LLMClassifier
LLMClassifier delegates Allow/Ask/Deny decisions to a small fast model, short-circuiting via a Fallback Classifier (typically RuleClassifier) for well-known cases.
type LLMClassifierOption ¶
type LLMClassifierOption = permissions.LLMClassifierOption
LLMClassifierOption configures an LLMClassifier built via NewLLMClassifier.
type PermissionContext ¶
type PermissionContext = permissions.PermissionContext
PermissionContext provides additional permission context supplied by hooks.
type PermissionMode ¶
type PermissionMode = permissions.PermissionMode
PermissionMode represents the security level of a session or tool requirement.
type PermissionOutcome ¶
type PermissionOutcome = permissions.PermissionOutcome
PermissionOutcome is the final authorization result.
type PermissionOverride ¶
type PermissionOverride = permissions.PermissionOverride
PermissionOverride represents a hook-provided override.
type PermissionPolicy ¶
type PermissionPolicy = permissions.PermissionPolicy
PermissionPolicy evaluates permission mode requirements plus allow/deny/ask rules.
type PermissionPromptDecision ¶
type PermissionPromptDecision = permissions.PermissionPromptDecision
PermissionPromptDecision is the outcome of prompting the user.
type PermissionPrompter ¶
type PermissionPrompter = permissions.PermissionPrompter
PermissionPrompter is the interface for interactive permission decisions.
type PermissionRequest ¶
type PermissionRequest = permissions.PermissionRequest
PermissionRequest describes a tool requesting permission.
type Rule ¶
type Rule = permissions.Rule
Rule is a single permission entry matching a tool and optionally an input pattern.
type RuleClassifier ¶
type RuleClassifier = permissions.RuleClassifier
RuleClassifier is the default Classifier with a conservative read-only safe-list.
type Ruleset ¶
type Ruleset = permissions.Ruleset
Ruleset is an ordered list of rules; the first match wins.
type Scope ¶
type Scope = permissions.Scope
Scope controls how long a user-granted decision is remembered.