Documentation
¶
Overview ¶
Package approval gates dangerous shell commands behind a user decision.
Pattern: safety.DetectDangerous flags a command -> Approver.Request asks the user how to proceed. Decisions cache for the session; AllowAlways persists via the caller-supplied callback (typically writes config.command_allowlist).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Approver ¶
Approver decides whether a flagged command may run. Implementations vary by surface: TUI shows a modal, headless reads stdin or honours --yes/--yolo.
type CLI ¶
type CLI struct {
// contains filtered or unexported fields
}
CLI is a stdin/stderr Approver for the headless surface. Prints the prompt to err, reads a single line from in, maps the first char to a Decision. Concurrent calls are serialised so prompts don't interleave.
func NewCLI ¶
NewCLI builds a CLI approver. Pass os.Stdin + os.Stderr for the normal case; override for tests.
type Cache ¶
type Cache struct {
// contains filtered or unexported fields
}
Cache wraps an inner Approver with session memory + a persistent allowlist. Lookup precedence: requireAlways (bypass) → persistent → session → inner.
func NewCache ¶
NewCache builds a Cache around inner. seed contains pattern keys already in the user's persistent allowlist. persist is invoked whenever a new key is granted AllowAlways; pass nil to disable persistence.
func NewCacheWithRequire ¶
func NewCacheWithRequire(inner Approver, seed []string, requireAlways []string, persist func(key string) error) *Cache
NewCacheWithRequire is NewCache plus a requireAlways set: keys in this set bypass the session AllowSession cache and re-prompt every call. Persistent AllowAlways grants still win.
func (*Cache) AlwaysAllowKeys ¶
AlwaysAllowKeys returns the union of session + persistent grants. Useful for tests and for showing the user what they've trusted.
func (*Cache) Flush ¶
func (c *Cache) Flush()
Flush blocks until all in-flight persistFunc goroutines complete. Call from the shutdown path so config.toml writes aren't lost on exit.
func (*Cache) Request ¶
Request consults the caches first, then defers to the inner Approver. AllowOnce never caches. AllowSession caches in-memory. AllowAlways caches + fires the persistFunc. Keys in requireAlways skip the session cache → the user must re-confirm each invocation. Persistent AllowAlways grants still win.
type Decision ¶
type Decision int
Decision is the user's choice when prompted about a dangerous command.
const ( // Deny: refuse this invocation. Model must try a different approach. Deny Decision = iota // AllowOnce: run this single invocation, do not cache. AllowOnce // AllowSession: run + cache the pattern key for the rest of the session. AllowSession // AllowAlways: run + persist the pattern key in the user's config. AllowAlways )
Source Files