( policy: SandboxPolicy | undefined, )
| 53 | } |
| 54 | |
| 55 | export function mapPolicyToClaudeFlags( |
| 56 | policy: SandboxPolicy | undefined, |
| 57 | ): ClaudePolicyFlags { |
| 58 | const allowedTools: Array<string> = [] |
| 59 | const disallowedTools: Array<string> = [] |
| 60 | if (!policy) return { allowedTools, disallowedTools } |
| 61 | |
| 62 | if (policy.capabilities?.fileWrite === 'deny') |
| 63 | disallowedTools.push(...WRITE_TOOLS) |
| 64 | if (policy.capabilities?.network === 'deny') |
| 65 | disallowedTools.push(...NETWORK_TOOLS) |
| 66 | |
| 67 | // Tool-name-level command rules map directly; everything else is left to the |
| 68 | // permission-prompt tool. |
| 69 | for (const pattern of policy.commands?.deny ?? []) { |
| 70 | if (BUILTIN_TOOL_NAMES.has(pattern)) disallowedTools.push(pattern) |
| 71 | } |
| 72 | for (const pattern of policy.commands?.allow ?? []) { |
| 73 | if (BUILTIN_TOOL_NAMES.has(pattern)) allowedTools.push(pattern) |
| 74 | } |
| 75 | |
| 76 | const result: ClaudePolicyFlags = { |
| 77 | allowedTools: [...new Set(allowedTools)], |
| 78 | disallowedTools: [...new Set(disallowedTools)], |
| 79 | } |
| 80 | if (policy.default !== undefined) |
| 81 | result.permissionMode = modeFor(policy.default) |
| 82 | return result |
| 83 | } |
no test coverage detected