NewCommandAllowlist creates a new allowlist validator configured from environment.
()
| 114 | |
| 115 | // NewCommandAllowlist creates a new allowlist validator configured from environment. |
| 116 | func NewCommandAllowlist() *CommandAllowlist { |
| 117 | mode := SecurityModeStrict |
| 118 | if m := os.Getenv("CHATCLI_AGENT_SECURITY_MODE"); strings.EqualFold(m, "permissive") { |
| 119 | mode = SecurityModePermissive |
| 120 | } |
| 121 | |
| 122 | al := &CommandAllowlist{ |
| 123 | allowedCommands: DefaultAllowedCommands(), |
| 124 | mode: mode, |
| 125 | } |
| 126 | |
| 127 | // Add custom commands from CHATCLI_AGENT_ALLOWLIST env var (comma-separated) |
| 128 | if extra := os.Getenv("CHATCLI_AGENT_ALLOWLIST"); extra != "" { |
| 129 | for _, cmd := range strings.Split(extra, ",") { |
| 130 | cmd = strings.TrimSpace(cmd) |
| 131 | if cmd != "" { |
| 132 | al.allowedCommands[cmd] = "custom" |
| 133 | } |
| 134 | } |
| 135 | } |
| 136 | |
| 137 | return al |
| 138 | } |
| 139 | |
| 140 | // IsAllowed checks if a command is in the allowlist. |
| 141 | // Returns (allowed, category, reason). |
no test coverage detected