NewSensitiveReadPaths creates a read path validator configured from environment.
()
| 22 | |
| 23 | // NewSensitiveReadPaths creates a read path validator configured from environment. |
| 24 | func NewSensitiveReadPaths() *SensitiveReadPaths { |
| 25 | s := &SensitiveReadPaths{ |
| 26 | workspaceStrict: !strings.EqualFold(os.Getenv("CHATCLI_AGENT_WORKSPACE_STRICT"), "false"), |
| 27 | allowKubeconfig: strings.EqualFold(os.Getenv("CHATCLI_AGENT_ALLOW_KUBECONFIG"), "true"), |
| 28 | } |
| 29 | |
| 30 | // Parse extra allowed read paths (colon-separated) |
| 31 | if extra := os.Getenv("CHATCLI_AGENT_EXTRA_READ_PATHS"); extra != "" { |
| 32 | for _, p := range strings.Split(extra, ":") { |
| 33 | p = strings.TrimSpace(p) |
| 34 | if p != "" { |
| 35 | s.extraReadPaths = append(s.extraReadPaths, p) |
| 36 | } |
| 37 | } |
| 38 | } |
| 39 | |
| 40 | return s |
| 41 | } |
| 42 | |
| 43 | // IsReadAllowed checks whether the given path is safe to read in agent mode. |
| 44 | // workspace is the current working directory / project root. |
no outgoing calls