openmoat 0.8.0

Policy checks for AI coding agents: decides allow, defer, ask or deny for every tool call from Claude Code, Codex and Cursor, configures Claude Code's and Codex's own OS sandboxes from the same policy, and keeps a local audit log.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

use super::{Found, NPM_BEFORE, UV_EXCLUDE_NEWER, env};

/// 2026-10-03 15:00 UTC.
const NOW: i64 = 1_790_985_600_000 + 15 * 3_600_000;

/// The names [`env`] sets for a week, with `inherited` set in the
/// environment and `files` (name, text) in the project.
fn set(inherited: &[&str], files: &[(&str, &str)]) -> Vec<&'static str> {
    let found = Found {
        inherited: &|name| inherited.contains(&name),
        project_has: &|file| files.iter().any(|(f, _)| *f == file),
        project_file: &|file| {
            files
                .iter()
                .find(|(f, _)| *f == file)
                .map(|(_, text)| (*text).to_owned())
        },
    };
    env(7, NOW, &found).into_iter().map(|(n, _)| n).collect()
}

#[test]
fn both_tools_get_the_start_of_the_day_a_week_back() {
    let found = Found {
        inherited: &|_| false,
        project_has: &|_| false,
        project_file: &|_| None,
    };
    let week = "2026-09-26T00:00:00Z".to_owned();
    assert_eq!(
        env(7, NOW, &found),
        [(NPM_BEFORE, week.clone()), (UV_EXCLUDE_NEWER, week)]
    );
    assert!(env(0, NOW, &found).is_empty(), "0 days is off");
}

#[test]
fn the_persons_own_settings_are_kept() {
    assert_eq!(set(&["NPM_CONFIG_BEFORE"], &[]), [UV_EXCLUDE_NEWER]);
    assert_eq!(set(&[NPM_BEFORE], &[]), [UV_EXCLUDE_NEWER]);
    assert_eq!(set(&[UV_EXCLUDE_NEWER], &[]), [NPM_BEFORE]);
    let npmrc = [(".npmrc", "registry=x\n before = 2026-01-01\n")];
    assert_eq!(set(&[], &npmrc), [UV_EXCLUDE_NEWER]);
    let other_key = [(".npmrc", "before-script=x\n")];
    assert_eq!(set(&[], &other_key), [NPM_BEFORE, UV_EXCLUDE_NEWER]);
    let pyproject = [(
        "pyproject.toml",
        "[tool.uv]\nexclude-newer = \"2026-01-01\"\n",
    )];
    assert_eq!(set(&[], &pyproject), [NPM_BEFORE]);
    assert_eq!(
        set(&[], &[("uv.toml", "exclude-newer = \"1 week\"\n")]),
        [NPM_BEFORE]
    );
}

#[test]
fn a_uv_lockfile_keeps_uv_as_it_is() {
    assert_eq!(set(&[], &[("uv.lock", "")]), [NPM_BEFORE]);
}