vtcode_core/
tool_policy.rs

1//! Tool policy management system
2//!
3//! This module manages user preferences for tool usage, storing choices in
4//! the canonical user config directory's `tool-policy.json` to minimize repeated prompts while maintaining
5//! user control overwhich tools the agent can use.
6
7use indexmap::IndexSet;
8use regex::Regex;
9
10use crate::config::constants::tools;
11
12pub use crate::config::core::tools::ToolPolicy;
13
14mod alternative;
15mod manager;
16mod mcp;
17mod model;
18mod shell_approval;
19
20pub use self::alternative::{
21    AlternativeArgsPolicy, AlternativeDefaultPolicy, AlternativeToolPolicy, AlternativeToolPolicyConfig,
22};
23
24pub use self::manager::ToolPolicyManager;
25pub use self::mcp::{McpPolicyStore, McpProviderPolicy};
26pub use self::model::{
27    APPROVAL_CACHE_MAX_ENTRIES, ApprovalCacheConfig, PermissionPromptHandler, ToolConstraints, ToolExecutionDecision,
28    ToolPolicyConfig,
29};
30
31/// Memoized compiled approval regexes, keyed by the exact pattern list, so we
32/// don't recompile `Regex::new` on every approval-policy check.
33static APPROVAL_REGEX_CACHE: std::sync::Mutex<Option<(IndexSet<String>, Vec<Regex>)>> = std::sync::Mutex::new(None);
34
35const AUTO_ALLOW_TOOLS: &[&str] = &[
36    tools::START_PLANNING,
37    tools::TASK_TRACKER,
38    tools::MATRIX,
39    tools::RECORD_DECISION,
40    tools::READ_FILE,
41    // This tool dispatches to the interactive front-end wizard. Asking the
42    // user is safe and must not be intercepted by a second permission prompt.
43    tools::REQUEST_USER_INPUT,
44    // Whitelist the core execution tool itself; individual shell commands remain
45    // gated by command/sandbox approval policy.
46    tools::UNIFIED_EXEC,
47    // Internal PTY helpers used by tests and internal workflows.
48    tools::RUN_PTY_CMD,
49    tools::CREATE_PTY_SESSION,
50    tools::LIST_PTY_SESSIONS,
51    tools::SEND_PTY_INPUT,
52    tools::CLOSE_PTY_SESSION,
53    "cargo_check",
54    "cargo_test",
55    "git_status",
56    "git_diff",
57    "git_log",
58];
59
60const SHELL_APPROVAL_SCOPE_MARKER: &str = "|sandbox_permissions=";
61const DEFAULT_APPROVAL_SCOPE_SIGNATURE: &str = "sandbox_permissions=\"use_default\"|additional_permissions=null";
62const KNOWN_MUTATING_COMMANDS: &[&str] = &[
63    "awk", "cargo", "chmod", "chown", "cp", "curl", "dd", "install", "ln", "mkdir", "mv", "perl", "python", "python3",
64    "rm", "rmdir", "rsync", "ruby", "sh", "bash", "zsh", "tee", "touch", "truncate", "wget",
65];
66const MUTATING_OPTION_HINTS: &[&str] = &[
67    "--delete",
68    "--exec",
69    "--in-place",
70    "--output",
71    "--remove",
72    "--write",
73    "-delete",
74    "-exec",
75    "-execdir",
76    "-i",
77    "-o",
78];
79
80#[cfg(test)]
81mod tests;
vtcode_core/tool_policy.rs

vtcode_core/
tool_policy.rs
