hitlservice

const (
	// ActionAllow passes the tool call through without any approval step.
	ActionAllow Action = "allow"
	// ActionApprove blocks execution and requests human approval before proceeding.
	ActionApprove Action = "approve"
	// ActionDeny rejects the tool call immediately with a soft message to the LLM.
	ActionDeny Action = "deny"
)

const (
	// OpEq requires the argument value to equal the condition value exactly.
	OpEq ConditionOp = "eq"
	// OpGlob matches the argument value against a glob pattern.
	// Both value and pattern are normalized with path.Clean before matching,
	// preventing path-traversal bypass (e.g. ./src/../etc/passwd → etc/passwd).
	// Supports * (within a path component), ? (single char), and ** (across separators).
	OpGlob ConditionOp = "glob"
	// OpHost treats the argument value as a URL and matches its host against a
	// comma-separated list of host patterns in Value. It is the policy-native
	// way to express SSRF-style host denial (e.g. webtools to localhost or a
	// cloud-metadata endpoint): the host is parsed out of the URL, so a trailing
	// :port or path cannot evade the match the way a raw URL glob can. IP
	// literals match exactly; bare names match the host and any subdomain
	// (api.example.com matches example.com).
	OpHost ConditionOp = "host"
	// OpCommandBlacklist matches the command basename against a comma-separated
	// list of denied commands. Used to block dangerous commands like rm, sudo, dd.
	OpCommandBlacklist ConditionOp = "command_blacklist"
	// OpCommandAskAlways matches the command basename against a comma-separated
	// list of commands that should always require human approval (e.g., rm, sudo, chmod).
	// Unlike OpCommandBlacklist which denies, this operator with action:"approve" creates
	// a HITL pause point for safety-critical commands.
	OpCommandAskAlways ConditionOp = "command_ask_always"
	// OpNoCommandSubstitution blocks commands containing shell substitution
	// patterns ($(), backticks, <(), >()) that could indicate command injection.
	OpNoCommandSubstitution ConditionOp = "no_command_substitution"
)