permissions

type Effect string

type GrantScope string

type Grantor struct {
	// contains filtered or unexported fields
}

type Options struct {
	// AllowInterpreters lifts the rules on `eval` and on interpreter
	// one-liners (python -c, node -e). The benchmark harnesses set it: their
	// tasks are interpreter-driven and run inside an OS sandbox, where a
	// one-liner grants nothing the task did not already have.
	AllowInterpreters bool
	// EditToolAvailable adds the rule against editing a file with sed -i,
	// which only makes sense when there is an Edit tool to use instead.
	EditToolAvailable bool
	// Strong says agent.profile is "strong". Rules written to stop a model
	// from working around the Edit tool do not apply to a model that reaches
	// for the right tool on its own, and refusing it only costs iterations.
	Strong bool
}

type Policy struct {
	// Builtin rules are kvit-coder's own and cannot be removed by config.
	Builtin []Rule
	// Config rules come from tools.shell.allowed_commands and
	// disallowed_commands.
	Config []Rule
	// Session rules were granted during this conversation, or in an earlier
	// one for this project or this machine.
	Session []Rule

	// AllowlistOnly makes anything not explicitly allowed a denial. It is set
	// when tools.shell.allowed_commands is non-empty, which is how that option
	// has always behaved.
	AllowlistOnly bool

	// AllowAsks answers yes to every command that would need permission,
	// except the ones marked Irreversible. --yolo sets it. A refusal stays a
	// refusal: this answers questions, and a denial was never a question.
	AllowAsks bool

	// HomeDir is used to recognise a command that would delete the home
	// directory. Empty falls back to the process's own home.
	HomeDir string
}

type Rule struct {
	Pattern string
	Effect  Effect
	Reason  string
	// Source says where the rule came from, for a message that explains
	// itself: "builtin", "config", "session", "project", "global".
	Source string
	// Irreversible says the command destroys something that cannot be got
	// back — a disk overwritten, a filesystem written over what was there.
	// Everything else asked about can be undone or lived with: a fetch can be
	// deleted, a listening port closed. It is the one thing --yolo does not
	// answer for you, because the reason an ask is safe to answer blind is
	// that a wrong answer can be corrected.
	Irreversible bool
}

type Scope struct {
	// Program is what is being run, with any directory prefix removed:
	// /usr/bin/curl and ./curl are both "curl".
	Program string
	// Args are the words after the program, as written.
	Args []string
	// Literal is the whole simple command as written, which is what a grant
	// names when the command cannot safely be generalized.
	Literal string
	// Paths are the arguments that name a file or directory.
	Paths []string
	// Generalizable says whether a grant for this scope may be widened to
	// "<program> *". It is false inside a loop or a conditional, where the
	// arguments come from the surrounding construct rather than from the text
	// in front of you: granting "rm *" on the strength of "for f in *; do rm
	// $f; done" would grant every rm there will ever be.
	Generalizable bool
}

type Store struct {
	// contains filtered or unexported fields
}

type Verdict struct {
	Effect Effect
	Scope  Scope
	Rule   Rule
	// AutoAllowed says this was a command someone would normally be asked
	// about, allowed because AllowAsks is set. The caller says so on the
	// terminal, so a run started with --yolo leaves a record of what it
	// decided rather than only of having been started.
	AutoAllowed bool
}