Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
View Source
var DefaultDeniedPaths = []string{
".git/**",
"**/.git/**",
".env",
"**/.env",
"**/.env.*",
".ssh/**",
"**/.ssh/**",
"**/id_rsa",
"**/*.pem",
}
DefaultDeniedPaths protects the things an unattended run must never touch: version control internals, credentials, and SSH keys.
Functions ¶
func New ¶
New registers policy/deny-dangerous-shell: Deny bash commands matching known destructive patterns (rm -rf /).
Best practices:
- A backstop, not a sandbox: keep it on, but do not rely on it alone.
func NewPathDenylist ¶
func NewPathDenylist(cfg PathDenylistConfig) (agentkit.Policy, error)
NewPathDenylist registers policy/path-denylist: Deny tool calls whose path argument matches a glob.
Best practices:
- Mandatory alongside approval/auto-allow, which does no filtering of its own.
func NewShellAllowlist ¶
func NewShellAllowlist(cfg ShellAllowlistConfig) (agentkit.Policy, error)
NewShellAllowlist registers policy/shell-allowlist: Gate shell commands by command prefix.
Best practices:
- Chained commands are checked segment by segment regardless of strict, so `git status && rm -rf /` cannot ride in on an allowed prefix.
- Under an unattended run this replaces human judgement: prefer strict with a narrow allow list over approval/auto-allow on its own.
Types ¶
type PathDenylistConfig ¶
type PathDenylistConfig struct {
// Deny holds glob patterns matched against the path argument; ** spans directories. Empty falls back to DefaultDeniedPaths (.git, .env, .ssh, *.pem).
Deny []string `json:"deny"`
// Tools limits enforcement to these tool names; empty means every tool taking a path.
Tools []string `json:"tools"`
}
type ShellAllowlistConfig ¶
type ShellAllowlistConfig struct {
// Allow holds command prefixes that may run, e.g. "go test", "git status".
Allow []string `json:"allow"`
// Deny holds command prefixes that never run; checked before Allow.
Deny []string `json:"deny"`
// Strict denies anything outside Allow. Without it, unlisted commands fall through to ask, so the approval provider still gets a say.
Strict bool `json:"strict"`
// Tool is shell tool name to guard; defaults to "bash".
Tool string `json:"tool"`
}
Source Files
Click to show internal directories.
Click to hide internal directories.