Documentation
¶
Overview ¶
Package safety contains defense-in-depth guards for tool calls: secret redaction on tool output, and path / shell-command checks that refuse to read or mutate obviously sensitive targets even when the sandbox allows it.
Patterns and approach ported from crynta/terax-ai (Apache-2.0).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CheckReadable ¶
CheckReadable returns nil when path is safe to auto-read, or an error describing why it was refused. defense layer in front of the read tool — the sandbox is the primary boundary; this stops obvious secret exfil before bytes ever reach the model.
func CheckShellCommand ¶
CheckShellCommand heuristically blocks commands that almost certainly mean the model went off the rails. user approval is the primary gate; this just catches a few catastrophic shapes. matches happen on the trimmed command string, so leading/trailing whitespace is ignored.
func CheckWritable ¶
CheckWritable inherits all read restrictions and adds system-dir blocks. applies to write / patch / shell-redirect-target paths.
func DangerousKeys ¶
func DangerousKeys() []string
DangerousKeys returns every registered pattern key. Used by config validation to verify allowlist entries reference real patterns.
func DetectDangerous ¶
DetectDangerous returns the first matching pattern key + description, or empty strings + false when the command matches no dangerous pattern.
Types ¶
type DangerousPattern ¶
type DangerousPattern struct {
Re *regexp.Regexp
Key string // stable id for session cache + persistent allowlist
Desc string // shown to user when prompting
}
DangerousPattern flags commands that should prompt the user before running. Distinct from hardline rules in shell.go which refuse outright. Match → "ask first", not "deny".
type ProfileSafety ¶
type ProfileSafety struct {
// WriteRoot is a regex relative to cwd. When set AND no CLI --write-path-re
// is provided, edit/write/apply_patch tools refuse paths outside the root.
WriteRoot string
// ExtraSafeCommands extend sandbox.IsKnownSafe with profile-specific
// known-safe shell command prefixes (e.g. "kubectl get", "docker ps").
// merged at engine build time; never narrows the existing default list.
ExtraSafeCommands []string
// RequireApprovalKeys lists safety.DangerousPattern keys that must
// always re-prompt the user, bypassing the session AllowSession cache.
// Use for genuinely destructive operations where one "yes" should never
// trust the model for the rest of the session.
RequireApprovalKeys []string
// WarnOnDuplicateWrites flips the per-Run idempotency guard. When true,
// writing identical content to the same path twice without an intervening
// read prepends a one-shot warning to the next tool result.
WarnOnDuplicateWrites bool
}
ProfileSafety is the per-profile safety calibration that bee applies on top of the global Sandbox + Approval config. It lets the tiny profile (small local models that hallucinate paths and intents) be stricter by default without forcing every user to hand-edit config.
func DefaultsForProfile ¶
func DefaultsForProfile(name string) ProfileSafety
DefaultsForProfile returns the safety calibration bee ships for the named built-in profile. Unknown names return the zero value (no extra restrictions).
Tiny seeds the destructive-git set + recursive-delete keys into RequireApprovalKeys so a hallucinating local model can't burn the session AllowSession cache to ship `rm -rf /` or `git push --force` without re-confirming. Local-model UX is "one yes one operation" by design.
Source Files