Documentation
¶
Overview ¶
Package safe holds shared helpers for the "safe" command wrappers.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func PathWithin ¶
PathWithin reports whether target is root itself or a descendant of root. Both paths are cleaned lexically before comparison; callers that need symlinks resolved should pass paths through RealPath first.
func RealPath ¶
RealPath returns p as an absolute path with symlinks resolved. When the leaf does not exist yet (so it cannot be resolved directly), it resolves symlinks on the longest existing ancestor and re-appends the remaining suffix. This keeps two paths under the same real directory comparable even when the target has not been created yet (e.g. a bind-mount source directory).
Types ¶
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package dockercompose validates and runs docker compose invocations safely.
|
Package dockercompose validates and runs docker compose invocations safely. |
|
Package gh implements the "safe gh" wrapper: it parses a gh argv and reports invocations outside a narrow allowlist so the command layer can refuse them.
|
Package gh implements the "safe gh" wrapper: it parses a gh argv and reports invocations outside a narrow allowlist so the command layer can refuse them. |
|
Package git implements the "safe git" wrapper: it parses a git argv and reports known-dangerous invocations so the command layer can refuse them.
|
Package git implements the "safe git" wrapper: it parses a git argv and reports known-dangerous invocations so the command layer can refuse them. |
Click to show internal directories.
Click to hide internal directories.