Documentation
¶
Overview ¶
Package dcg integrates Destructive Command Guard (dcg) as a pre-exec check for chat agent run_terminal and run_code tools.
Index ¶
- Constants
- func CommandForTool(tool string, args map[string]any) (command string, ok bool, err error)
- func Init()
- func MaterializeConfig() (string, error)
- func SetDefaultChecker(c Checker)
- func StripBypassEnv(env []string) []string
- func SynthCommand(language, code string) (string, error)
- func TruncateCommandForLog(command string) string
- type AllowAllChecker
- type BinaryChecker
- type BinaryCheckerOptions
- type Checker
- type Decision
- type DenyChecker
- type ErrorChecker
Constants ¶
const ReasonBlocked = "command blocked by dcg"
ReasonBlocked is the default denial message when dcg omits a reason.
Variables ¶
This section is empty.
Functions ¶
func CommandForTool ¶
CommandForTool extracts the command string to check for a tool call. ok is false when the tool is not guarded by dcg (caller should skip).
func Init ¶
func Init()
Init installs the process-wide BinaryChecker using the embedded config. When dcg is missing from PATH it logs a warning and installs an ErrorChecker so the first guarded tool call fails closed.
func MaterializeConfig ¶
MaterializeConfig writes the embedded dcg.toml to a temp file once and returns its path.
func SetDefaultChecker ¶
func SetDefaultChecker(c Checker)
SetDefaultChecker installs the process-wide checker used when ChatHookDeps.DCG is nil.
func StripBypassEnv ¶
StripBypassEnv returns env without DCG_BYPASS entries.
func SynthCommand ¶
SynthCommand builds a shell-shaped command string for dcg from run_code inputs. Language aliases match pkg/agent/coding run_code interpreters.
func TruncateCommandForLog ¶
TruncateCommandForLog shortens command strings for log lines.
Types ¶
type BinaryChecker ¶
type BinaryChecker struct {
// contains filtered or unexported fields
}
BinaryChecker invokes the dcg CLI with --robot test.
func NewBinaryChecker ¶
func NewBinaryChecker(opts BinaryCheckerOptions) *BinaryChecker
NewBinaryChecker builds a Checker that shells out to dcg.
type BinaryCheckerOptions ¶
type BinaryCheckerOptions struct {
// Path is the dcg executable path; empty uses LookPath("dcg").
Path string
// ConfigPath is passed as --config; required for production use.
ConfigPath string
// Runner overrides process execution (tests).
Runner commandRunner
}
BinaryCheckerOptions configures NewBinaryChecker.
type Checker ¶
type Checker interface {
// Check returns a Decision for command, or an error for fail-closed failures.
Check(ctx context.Context, command string) (Decision, error)
}
Checker evaluates a shell command string before execution.
func DefaultChecker ¶
func DefaultChecker() Checker
DefaultChecker returns the process-wide checker.
type Decision ¶
type Decision struct {
// Allow is true when dcg permits the command.
Allow bool
// Reason explains a denial when Allow is false.
Reason string
// RuleID is the matching dcg rule identifier when present.
RuleID string
// PackID is the matching dcg pack identifier when present.
PackID string
}
Decision is the outcome of a dcg command evaluation.
type DenyChecker ¶
type DenyChecker struct {
// Reason is returned on denial.
Reason string
}
DenyChecker denies every command with Reason (tests).
Source Files