Documentation
¶
Overview ¶
Package effects holds the sink catalogue: which calls can ultimately write a database, spawn a process, touch the filesystem, or leave the network (RFC-001 §5.2). The catalogue is data, not code — the default ships embedded, and workspaces extend it with .seamark/effects.yaml.
Detection is deliberately syntactic and matches call REFERENCES, not resolved edges: the interesting sinks (database/sql.Exec, subprocess.run) live in external dependencies the indexer never resolves. Direct tags land on the enclosing declaration; the indexer propagates them backwards along CALLS edges to fixpoint.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Catalog ¶
type Catalog struct {
// contains filtered or unexported fields
}
Catalog is the merged sink list, indexed for matching.
func Load ¶
Load returns the embedded catalogue merged with the workspace overlay at <root>/.seamark/effects.yaml (missing overlay is fine; a malformed one is an error — silently dropping the user's security config is worse).
func (*Catalog) MatchCommand ¶
MatchCommand returns tags for a shell command by its base name and argv tail. Subcommand candidates are non-flag tokens NOT preceded by a flag (a flag's separate value is skipped): `kubectl -n prod delete x` finds `delete`, while `terraform plan -out apply` does not find `apply`. Any candidate matching counts — for a security classifier a false positive beats a false negative.
func (*Catalog) MatchImport ¶
MatchImport returns tags for a call to name qualified through (or imported by name from) importPath.
func (*Catalog) MatchMethod ¶
MatchMethod returns tags for an attribute/method call by name.
type CommandSink ¶
type CommandSink struct {
Name string `yaml:"name"`
Subcommands []string `yaml:"subcommands"` // empty: any invocation matches
Tag string `yaml:"tag"`
}
CommandSink classifies a shell command for the gate.
type Sink ¶
type Sink struct {
Language string `yaml:"language"` // family key: go | ecma | python
Import string `yaml:"import"` // qualified through this import path
Names []string `yaml:"names"` // names for the import matcher
Method string `yaml:"method"` // any attribute/method call
Call string `yaml:"call"` // bare call
Tag string `yaml:"tag"`
}
Sink is one catalogue entry; exactly one matcher field is set.
Source Files