vikingowl
03c470bf65
6 permission modes: - default: prompt for every tool invocation - accept_edits: auto-allow file ops, prompt for bash/destructive - bypass: allow everything (deny rules still enforced) - deny: deny all unless explicit allow rule - plan: read-only tools only - auto: auto-allow read-only, prompt for writes 7-step decision flow: deny rules (bypass-immune) → safety checks (.env, .git, credentials, ssh keys) → bypass → allow rules → mode-specific → prompt. Compound bash command decomposition via mvdan.cc/sh AST parser. Splits on && and || but preserves pipes as single units. Deny from any subcommand denies the entire compound. 15 permission tests.
30 lines
918 B
Go
30 lines
918 B
Go
package permission
|
|
|
|
// Mode controls the overall permission behavior.
|
|
type Mode string
|
|
|
|
const (
|
|
// ModeDefault prompts the user for each tool invocation.
|
|
ModeDefault Mode = "default"
|
|
// ModeAcceptEdits auto-allows file edits + reads, prompts for bash/destructive.
|
|
ModeAcceptEdits Mode = "accept_edits"
|
|
// ModeBypass allows everything without prompting.
|
|
ModeBypass Mode = "bypass"
|
|
// ModeDeny denies everything unless an explicit allow rule matches.
|
|
ModeDeny Mode = "deny"
|
|
// ModePlan allows only read-only tools, blocks all writes.
|
|
ModePlan Mode = "plan"
|
|
// ModeAuto uses task type + tool risk scoring to decide.
|
|
// Low-risk read-only tools auto-allow, everything else prompts.
|
|
ModeAuto Mode = "auto"
|
|
)
|
|
|
|
// Valid returns true if the mode is recognized.
|
|
func (m Mode) Valid() bool {
|
|
switch m {
|
|
case ModeDefault, ModeAcceptEdits, ModeBypass, ModeDeny, ModePlan, ModeAuto:
|
|
return true
|
|
}
|
|
return false
|
|
}
|