claudy 0.8.0

Modern multi-provider launcher for Claude CLI
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87

use crate::config::registry::GuardSettings;
use crate::ports::guard_ports::{GuardAction, GuardPolicy};

/// MVP inline `GuardPolicy`: direct mapping from `GuardSettings`.
pub struct SettingsPolicy {
    settings: GuardSettings,
}

impl SettingsPolicy {
    pub fn new(settings: GuardSettings) -> Self {
        SettingsPolicy { settings }
    }
}

impl GuardPolicy for SettingsPolicy {
    fn action_for(&self, _provider_id: &str, finding_kind: &str) -> GuardAction {
        if finding_kind == "image" {
            if self.settings.strip_images {
                GuardAction::Redact
            } else {
                GuardAction::Allow
            }
        } else if finding_kind == "rrn" {
            // Checksum-validated RRN is severity Critical — redact floor.
            super::scan::critical_pii_action(match self.settings.on_secret {
                crate::config::registry::SecretPolicy::Allow => GuardAction::Allow,
                crate::config::registry::SecretPolicy::Redact => GuardAction::Redact,
                crate::config::registry::SecretPolicy::Warn => GuardAction::Warn,
                crate::config::registry::SecretPolicy::Block => GuardAction::Block,
            })
        } else if matches!(finding_kind, "local_path" | "phone" | "bank_account") {
            // KoreanPii / FileSystemPath: record-only. Redacting paths or
            // routine PII breaks coding sessions; the ledger still shows them.
            GuardAction::Warn
        } else {
            match self.settings.on_secret {
                crate::config::registry::SecretPolicy::Allow => GuardAction::Allow,
                crate::config::registry::SecretPolicy::Redact => GuardAction::Redact,
                crate::config::registry::SecretPolicy::Warn => GuardAction::Warn,
                crate::config::registry::SecretPolicy::Block => GuardAction::Block,
            }
        }
    }

    fn is_trusted(&self, provider_id: &str) -> bool {
        self.settings
            .trusted_providers
            .iter()
            .any(|p| p == provider_id)
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::config::registry::SecretPolicy;

    fn settings(on_secret: SecretPolicy, strip_images: bool) -> GuardSettings {
        GuardSettings {
            strip_images,
            on_secret,
            trusted_providers: vec!["native".to_string()],
        }
    }

    #[test]
    fn secret_action_mapped_from_settings() {
        let policy = SettingsPolicy::new(settings(SecretPolicy::Warn, true));
        assert_eq!(policy.action_for("zai", "api_key"), GuardAction::Warn);
        assert_eq!(policy.action_for("native", "aws_key"), GuardAction::Warn);
    }

    #[test]
    fn image_action_respects_strip_images() {
        let policy = SettingsPolicy::new(settings(SecretPolicy::Redact, false));
        assert_eq!(policy.action_for("zai", "image"), GuardAction::Allow);
        let policy = SettingsPolicy::new(settings(SecretPolicy::Redact, true));
        assert_eq!(policy.action_for("zai", "image"), GuardAction::Redact);
    }

    #[test]
    fn trusted_provider_lookup() {
        let policy = SettingsPolicy::new(settings(SecretPolicy::Redact, true));
        assert!(policy.is_trusted("native"));
        assert!(!policy.is_trusted("zai"));
    }
}