lean_ctx/core/config/
risk.rs

1//! Risk classification for `config set` governance (#852).
2//!
3//! Most config keys are routine (cache sizes, density, theme) and are written
4//! without friction. A small set, however, changes lean-ctx's *security posture*
5//! (containment, secret redaction) or *network routing / data egress* (upstream
6//! redirects). Flipping one of those silently can weaken the user's machine or
7//! leak credentials to a provider, so `config set` shows a before→after review
8//! and requires confirmation (or `--yes`) before applying — mirroring the
9//! existing `yolo` / `secure` confirmation pattern.
10//!
11//! This is a deterministic, local-only lookup: no telemetry, no heuristics.
12
13/// A consequential config key and the one-line note explaining what changing it
14/// does. Returned by [`classify`]; `None` ⇒ a routine key, written directly.
15pub struct ConfigRisk {
16    /// Human-readable consequence of changing this key, shown in the review.
17    pub note: &'static str,
18}
19
20/// Classifies a fully-qualified config key (dot-path, e.g. `secret_detection.enabled`).
21///
22/// Returns a [`ConfigRisk`] for keys whose change is security- or
23/// egress-relevant; `None` for everything else.
24#[must_use]
25pub fn classify(key: &str) -> Option<ConfigRisk> {
26    let note = match key {
27        "path_jail" => {
28            "Path jail confines agent file access to the project root. Disabling it lets tools read and write any path on this machine."
29        }
30        "shell_security" => {
31            "Shell gating blocks dangerous commands via an allowlist. Lowering it (warn/off) lets the agent run any command."
32        }
33        "sandbox_level" => {
34            "Sandbox level governs how strictly tool execution is contained. Lowering it reduces isolation."
35        }
36        "secret_detection.enabled" => {
37            "Secret detection masks API keys and .env values before they reach the LLM. Disabling it can leak credentials to the provider."
38        }
39        "secret_detection.redact" => {
40            "Secret redaction masks detected secrets. Disabling it sends them verbatim to the provider."
41        }
42        "boundary_policy" => {
43            "Boundary policy controls what context is allowed to leave this machine. Relaxing it widens data egress."
44        }
45        "proxy.anthropic_upstream" | "proxy.openai_upstream" | "proxy.gemini_upstream" => {
46            "Redirects provider traffic to a custom upstream — every request and API key for this provider will flow through it."
47        }
48        _ => return None,
49    };
50    Some(ConfigRisk { note })
51}
52
53/// True if changing `key` is consequential enough to require a review.
54#[must_use]
55pub fn is_consequential(key: &str) -> bool {
56    classify(key).is_some()
57}
58
59#[cfg(test)]
60mod tests {
61    use super::*;
62
63    #[test]
64    fn security_keys_are_consequential() {
65        for key in [
66            "path_jail",
67            "shell_security",
68            "sandbox_level",
69            "secret_detection.enabled",
70            "secret_detection.redact",
71            "boundary_policy",
72            "proxy.openai_upstream",
73            "proxy.anthropic_upstream",
74            "proxy.gemini_upstream",
75        ] {
76            assert!(is_consequential(key), "{key} should be consequential");
77            assert!(!classify(key).unwrap().note.is_empty());
78        }
79    }
80
81    #[test]
82    fn routine_keys_are_not_consequential() {
83        for key in [
84            "theme",
85            "max_ram_percent",
86            "compression_level",
87            "proxy.port",
88            "proxy.effort",
89            "bm25_max_cache_mb",
90        ] {
91            assert!(!is_consequential(key), "{key} should be routine");
92        }
93    }
94}
lean_ctx/core/config/risk.rs

lean_ctx/core/config/
risk.rs
