clash_starlark 0.7.2

Starlark policy evaluator for Clash — compiles .star files to JSON policy
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52


clashbox = sandbox(
    name="clash_box",
    default=deny(),
    fs={
        glob("$HOME/.clash/**"): allow("r"),
        glob("$HOME/**"): allow("rx"),
    },
    net=allow(),
)

clash = {
    tool("Bash"): {
        "clash": {
            ("bug", "status"): allow(sandbox=clashbox),
            "policy": {
                ("list", "show", "explain"): allow(sandbox=clashbox),
                "schema": allow(),
                "edit": ask(sandbox=clashbox),
            },
        },
    },
}

_claude_fs = sandbox(
    name="claude_fs",
    fs={
        glob("$HOME/.claude/**"): allow("rwc"),
        glob("$TRANSCRIPT_DIR/**"): allow("r"),
    },
)

claude = {
    tool((
        "Agent",
        "AskUserQuestion",
        "EnterPlanMode",
        "ExitPlanMode",
        "Skill",
        "ToolSearch",
        "EnterWorktree",
        "TaskCreate",
        "TaskGet",
        "TaskList",
        "TaskOutput",
        "TaskStop",
        "TaskUpdate",
    )): allow(sandbox=_claude_fs),
}

# Merged dict of all builtin rules
builtins = merge(clash, claude)