Documentation
¶
Overview ¶
Package guard implements the safety boundary layer (docs §11): an audit log, user-configured intercept-rule evaluation, and Observer/G5 failure attribution. Every tool call passes through the PreToolUse hook before executing. (The RoE authorization-scope mechanism was removed; a replacement may be added later.) Destructive/exfil gating is no longer hard-coded here — it lives in the DB intercept rules (seeded as ordinary [内置] rules, so users can disable or delete them), evaluated via applyIntercept.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AttribSample ¶ added in v0.3.96
type AttribSample struct {
Tool string `json:"tool"`
Command string `json:"command,omitempty"`
TS int64 `json:"ts"`
}
AttribSample 是一条 blocked/error 归因的最近样本（B6）：planner 只看计数时对不上 「哪条命令被拦了」，复盘/换打法需要看实物。Command 截断到 attribSampleMax（防御 超长命令刷爆态势块），TS 用 Unix 秒便于展示时间。
type AuditEntry ¶
type AuditEntry struct {
TS int64 `json:"ts"`
Tool string `json:"tool"`
Action string `json:"action"` // allow|block
Reason string `json:"reason,omitempty"`
Command string `json:"command,omitempty"`
}
AuditEntry records one gated tool call.
type Guard ¶
type Guard struct {
// contains filtered or unexported fields
}
Guard enforces the side-effect policy via agent-core hooks.
func New ¶
func New() *Guard
New creates a Guard without user-configured intercept rules (used for pentest tasks where the Interceptor is not yet available).
func NewWithInterceptor ¶
func NewWithInterceptor(ic *intercept.Interceptor) *Guard
NewWithInterceptor creates a Guard with user-configured intercept rules.
func (*Guard) AttributionStats ¶ added in v0.3.96
AttributionStats (B6) 是 Attributions 的态势版：计数之外附每类最近样本 （samples."blocked"/"error" = [{tool,command,ts}...]，最多 3 条，command 截断）。 planner 看到「blocked×7 + 最近命令列表」就能对上号换打法，而不是只知道「被拦了」。 供 graph_overview 的 guard_attributions 块直插使用。
func (*Guard) Attributions ¶
Attributions returns failure-attribution counts (Observer / G5).
func (*Guard) Audit ¶
func (g *Guard) Audit() []AuditEntry
Audit returns a snapshot of recent gated calls (most recent last).
Source Files