security

package

Go to main page

Versions in this module

v0

v0.19.0

Aug 21, 2026

v0.18.1

Aug 20, 2026

Changes in this version

+ func APIDomainSources(cfg types.APIConfig) map[string]string

+ func APIDomains(cfg types.APIConfig) []string

+ func ParsePrivateCIDRs(cidrs []string) ([]*net.IPNet, error)

+ type EgressAttempt struct

+ Allowed bool

+ CorrelationID string

+ Domain string

+ TaskID string

type EgressConfig

+ AllowedPrivateCIDRs []string

+ AllowedTCP []string

type EgressEnforcer

+ AllowedPrivateCIDRs []*net.IPNet

type EgressProxy

+ func (p *EgressProxy) SOCKSURL() string

+ func (p *EgressProxy) SetTCPMatcher(m *TCPMatcher)

+ func (p *EgressProxy) ValidateAndDial(ctx context.Context, host, port string) (net.Conn, error)

+ type TCPMatcher struct

+ func NewTCPMatcher(entries []string) (*TCPMatcher, error)

+ func (m *TCPMatcher) Empty() bool

+ func (m *TCPMatcher) IsAllowed(host, port string) bool

v0.17.1

Jul 14, 2026

Changes in this version

+ type DeniedCommandPattern struct

+ LayerPath string

+ LayerSource string

+ Message string

+ Pattern string

+ func EffectiveDeniedCommandPatterns(layers []PolicyLayer) []DeniedCommandPattern

type PlatformPolicy

+ DeniedCommandPatterns []agentspec.CommandFilter

v0.17.0

Jul 13, 2026

Changes in this version

type PlatformPolicy

+ Guardrails map[string]any

v0.16.0

Jul 1, 2026

v0.15.0

Jun 15, 2026

Changes in this version

+ const DefaultSystemPolicyPath

+ const LayerSystem

+ const LayerUser

+ const LayerWorkspace

+ var DefaultCapabilityBundles = map[string][]string

+ var DefaultToolDomains = map[string][]string

+ func AuthDomains(cfg types.AuthConfig) []string

+ func EffectiveDeniedTools(forgeDenied []string, layers []PolicyLayer) []string

+ func EffectiveEgressAllowlist(cfg *types.ForgeConfig, layers []PolicyLayer) []string

+ func EffectiveToolCount(cfg *types.ForgeConfig, layers []PolicyLayer) int

+ func EgressClientFromContext(ctx context.Context) *http.Client

+ func EgressTransportFromContext(ctx context.Context) http.RoundTripper

+ func FormatViolations(violations []PolicyViolation) string

+ func GenerateAllowlistJSON(cfg *EgressConfig) ([]byte, error)

+ func GenerateK8sNetworkPolicy(agentID string, cfg *EgressConfig) ([]byte, error)

+ func InContainer() bool

+ func InferToolDomains(toolNames []string) []string

+ func IsBlockedIP(ip net.IP, allowPrivate bool) bool

+ func IsLocalhost(host string) bool

+ func LLMProviderDomains(cfg *types.ForgeConfig) []string

+ func LLMProviderEnvDomains(envVars map[string]string) []string

+ func MCPDomainSources(cfg types.MCPConfig) map[string]string

+ func MCPDomains(cfg types.MCPConfig) []string

+ func NewSafeTransport(resolver Resolver, allowPrivateIPs bool) *http.Transport

+ func OTelDomain(cfg types.TracingYAML) []string

+ func ParseStrictIPv4(s string) net.IP

+ func ResolveCapabilities(capabilities []string) []string

+ func SafeRedirectPolicy(maxRedirects int) func(*http.Request, []*http.Request) error

+ func SystemPolicyPath() string

+ func UserPolicyPath() string

+ func ValidateHostIP(host string) error

+ func WithEgressClient(ctx context.Context, client *http.Client) context.Context

+ func WorkspacePolicyPath() string

+ type ChannelSkip struct

+ Channel string

+ Layer string

+ LayerPath string

+ func EffectiveChannels(declared []string, layers []PolicyLayer) (effective []string, skipped []ChannelSkip)

+ type DomainMatcher struct

+ func NewDomainMatcher(mode EgressMode, domains []string) *DomainMatcher

+ func (m *DomainMatcher) IsAllowed(host string) bool

+ func (m *DomainMatcher) Mode() EgressMode

+ type EgressConfig struct

+ AllDomains []string

+ AllowPrivateIPs bool

+ AllowedDomains []string

+ Mode EgressMode

+ Profile EgressProfile

+ ToolDomains []string

+ func Resolve(profile, mode string, explicitDomains, toolNames, capabilities []string) (*EgressConfig, error)

+ type EgressEnforcer struct

+ AllowPrivateIPs bool

+ OnAttempt func(ctx context.Context, domain string, allowed bool)

+ func NewEgressEnforcer(base http.RoundTripper, mode EgressMode, domains []string, ...) *EgressEnforcer

+ func (e *EgressEnforcer) RoundTrip(req *http.Request) (*http.Response, error)

+ type EgressMode string

+ const ModeAllowlist

+ const ModeDenyAll

+ const ModeDevOpen

+ func DefaultMode() EgressMode

+ type EgressProfile string

+ const ProfilePermissive

+ const ProfileStandard

+ const ProfileStrict

+ func DefaultProfile() EgressProfile

+ type EgressProxy struct

+ OnAttempt func(domain string, allowed bool)

+ func NewEgressProxy(matcher *DomainMatcher, allowPrivateIPs bool) *EgressProxy

+ func (p *EgressProxy) ProxyURL() string

+ func (p *EgressProxy) Start(ctx context.Context) (string, error)

+ func (p *EgressProxy) Stop() error

+ type ModelMatcher struct

+ Name string

+ Provider string

+ func (m ModelMatcher) String() string

+ type PlatformPolicy struct

+ DeniedChannels []string

+ DeniedEgressDomains []string

+ DeniedTools []string

+ ForbiddenModels []ModelMatcher

+ MaxEgressAllowlistSize int

+ MaxToolCount int

+ func LoadPlatformPolicy(path string) (PlatformPolicy, error)

+ func ParsePlatformPolicy(data []byte) (PlatformPolicy, error)

+ func (p PlatformPolicy) ChannelDenied(name string) bool

+ func (p PlatformPolicy) EgressDomainDenied(domain string) bool

+ func (p PlatformPolicy) IsZero() bool

+ func (p PlatformPolicy) ModelForbidden(provider, name string) bool

+ func (p PlatformPolicy) ToolDenied(name string) bool

+ func (p PlatformPolicy) Validate() error

+ type PolicyLayer struct

+ Path string

+ Policy PlatformPolicy

+ Source string

+ func FirstLayerDenyingChannel(layers []PolicyLayer, name string) *PolicyLayer

+ func FirstLayerDenyingEgress(layers []PolicyLayer, domain string) *PolicyLayer

+ func FirstLayerDenyingTool(layers []PolicyLayer, name string) *PolicyLayer

+ func FirstLayerForbiddingModel(layers []PolicyLayer, provider, name string) *PolicyLayer

+ func LoadAllPolicyLayers() ([]PolicyLayer, error)

+ func MostRestrictiveEgressMax(layers []PolicyLayer) (int, *PolicyLayer)

+ func MostRestrictiveToolMax(layers []PolicyLayer) (int, *PolicyLayer)

+ type PolicyViolation struct

+ ForgeYAMLField string

+ Kind PolicyViolationKind

+ Layer string

+ LayerPath string

+ OffendingValue string

+ func EnforcePolicy(cfg *types.ForgeConfig, layers []PolicyLayer) []PolicyViolation

+ type PolicyViolationKind string

+ const ViolationDeniedEgress

+ const ViolationDeniedTool

+ const ViolationEgressBoundExceeded

+ const ViolationForbiddenModel

+ const ViolationToolBoundExceeded

+ type Resolver interface

+ LookupIPAddr func(ctx context.Context, host string) ([]net.IPAddr, error)

+ type SafeDialer struct

+ func NewSafeDialer(resolver Resolver, allowPrivateIPs bool) *SafeDialer

+ func (s *SafeDialer) SafeDialContext(ctx context.Context, network, addr string) (net.Conn, error)

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL