validateStrictTools validates tools configuration in strict mode
(frontmatter map[string]any)
| 98 | |
| 99 | // validateStrictTools validates tools configuration in strict mode |
| 100 | func (c *Compiler) validateStrictTools(frontmatter map[string]any) error { |
| 101 | // Check tools section |
| 102 | toolsValue, exists := frontmatter["tools"] |
| 103 | if !exists { |
| 104 | strictModeValidationLog.Print("No tools section, skipping strict tools validation") |
| 105 | return nil |
| 106 | } |
| 107 | |
| 108 | toolsMap, ok := toolsValue.(map[string]any) |
| 109 | if !ok { |
| 110 | strictModeValidationLog.Print("tools is not a map, skipping strict tools validation") |
| 111 | return nil |
| 112 | } |
| 113 | |
| 114 | // Check if cache-memory is configured with scope: repo |
| 115 | cacheMemoryValue, hasCacheMemory := toolsMap["cache-memory"] |
| 116 | if hasCacheMemory { |
| 117 | strictModeValidationLog.Print("Checking cache-memory scope in strict mode") |
| 118 | // Helper function to check scope in a cache entry |
| 119 | checkScope := func(cacheMap map[string]any) error { |
| 120 | if scope, hasScope := cacheMap["scope"]; hasScope { |
| 121 | if scopeStr, ok := scope.(string); ok && scopeStr == "repo" { |
| 122 | strictModeValidationLog.Printf("Cache-memory repo scope validation failed") |
| 123 | return NewValidationError( |
| 124 | "tools.cache-memory.scope", |
| 125 | scopeStr, |
| 126 | "strict mode: cache-memory with 'scope: repo' is not allowed for security reasons; expected 'scope: workflow' to isolate cache data per workflow", |
| 127 | "Use workflow-scoped cache entries:\n\ntools:\n cache-memory:\n key: my-cache\n scope: workflow", |
| 128 | ) |
| 129 | } |
| 130 | } |
| 131 | return nil |
| 132 | } |
| 133 | |
| 134 | // Check if cache-memory is a map (object notation) |
| 135 | if cacheMemoryConfig, ok := cacheMemoryValue.(map[string]any); ok { |
| 136 | if err := checkScope(cacheMemoryConfig); err != nil { |
| 137 | return err |
| 138 | } |
| 139 | } |
| 140 | |
| 141 | // Check if cache-memory is an array (array notation) |
| 142 | if cacheMemoryArray, ok := cacheMemoryValue.([]any); ok { |
| 143 | for _, item := range cacheMemoryArray { |
| 144 | if cacheMap, ok := item.(map[string]any); ok { |
| 145 | if err := checkScope(cacheMap); err != nil { |
| 146 | return err |
| 147 | } |
| 148 | } |
| 149 | } |
| 150 | } |
| 151 | } |
| 152 | |
| 153 | return nil |
| 154 | } |