Module rewrite 

A guard that fixes a command instead of only refusing it.

ljos-policyd answers allow\trewrite\tLINE when the line should run as LINE. The guard judges LINE again. A runner whose PreToolUse hook can replace the tool input gets LINE back as that input. A runner without that field is refused with LINE named. A LINE the guard does not accept as it stands refuses the call. The original line never runs.

The local table names a fix in a policyd refusal it knows. That call stays a deny, so a runner that drops an updated input still refuses it.

Structs

Rewrite

Enums

Outcome

What the hook does with a call that has a rewrite.

Constants

RELAY_VAR

Set on the inner ljos hook a runner relay starts. The relay renders a decision and a reason but no updated input, so an allow that carries one would run the line as written.

Functions

answer

The hook’s answer when the call has a rewrite, else None and the usual answer stands.

answer_with

answer for a known outcome. A refusal is the runner’s deny. A line to run is the updated input where the runner takes one. A runner that cannot take one is refused with the new line named, so the original line never runs.

from_policyd

The new line in a policyd rewrite answer, allow\trewrite\tLINE. This is the one place that format is read.

local

The local table’s fix for line, refused with code: python x.py ARGS becomes uv run x.py ARGS, the arguments kept as written.

pick

What the hook does with a tool call that has a rewrite, or None when it has none and the usual answer stands.