pub enum DangerTier {
Cosmetic,
Read,
ScopedWrite,
CrossWrite,
External,
Destructive,
ArbitraryExec,
}Expand description
Operation danger tier — property of what the agent is about to do, independent of who detected the request or what UX renders the approval.
Ordering is severity: Cosmetic < Read < ScopedWrite < CrossWrite
< External < Destructive < ArbitraryExec. Ord is the canonical
combinator — for a pipeline / list / compound, the tier is the max over
constituent commands.
Cosmetic is reserved for non-bash internal state (trait load/unload,
persona swap). Bash classification never returns Cosmetic — the
minimum is Read.
Variants§
Cosmetic
Internal state changes the agent makes about itself (non-bash only).
Read
Observation only — grep, rg, ls, cat, file reads.
ScopedWrite
Edits inside the current task radius — rm of named paths, single-file
edits, creating tracked files. Default for unknown bash primaries.
CrossWrite
Broad blast radius but reversible — multi-file rename, schema
migrations, git reset --hard, find -delete, git rebase.
External
Observable to others, recoverable — git push, PR comments, Slack,
deploy commands, curl -X POST and friends.
Destructive
Persistent system state, irreversible-ish — writes to dotfiles
(~/.zshrc, ~/.ssh/), /etc/, crontab, launchctl, network
binds to 0.0.0.0, force-push to protected branches.
ArbitraryExec
Fetched code piped to an interpreter, eval, -e/-c interpreters,
sudo, npx/uvx/pipx run of unpinned packages. The defining
invariant: the AST sees bytes, not behavior — the command’s effect
cannot be determined from its text alone.
Trait Implementations§
Source§impl Clone for DangerTier
impl Clone for DangerTier
Source§fn clone(&self) -> DangerTier
fn clone(&self) -> DangerTier
1.0.0 (const: unstable) · Source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source. Read more