feat(tools): permission policy, output overflow, stale file cleanup#266
Merged
feat(tools): permission policy, output overflow, stale file cleanup#266
Conversation
Phase C — Pattern-Based Permissions: - Add PermissionPolicy with glob matching, first-match-wins, case- insensitive input normalization (#248) - Migrate blocked_commands/confirm_patterns to permission rules with backward-compatible config aliases (#249) - Exclude fully-denied tools from system prompt via filtered formatting (#250) Phase D — Output Overflow: - Save full output to ~/.zeph/data/tool-output/{uuid}.txt when truncated, append path notice for LLM read access (#251) - Cleanup stale overflow files (>24h) on startup via spawn_blocking (#252) Security: case-insensitive glob matching prevents casing bypass on deny rules. Replace dirs-next with dirs 6.x. Closes #248, closes #249, closes #250, closes #251, closes #252
github-actions
bot
added
enhancement
Update mdBook pages (tools, configuration, security), CHANGELOG.md, and README.md to reflect pattern-based permission policy, output overflow to file, and stale cleanup.
github-actions
bot
added
documentation
Codecov Report❌ Patch coverage is
@@ Coverage Diff @@
## main #266 +/- ##
==========================================
+ Coverage 81.04% 81.23% +0.18%
==========================================
Files 81 83 +2
Lines 24220 24614 +394
==========================================
+ Hits 19630 19994 +364
- Misses 4590 4620 +30
🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Phase C — Pattern-Based Permissions (#248-#250):
PermissionPolicywith glob matching per tool, first-match-wins rule ordering,Askdefault fallbackblocked_commands/confirm_patternsauto-migrated to permission rules (backward compatible)ShellExecutorusesPermissionPolicy::check()instead of legacyfind_blocked_command()/find_confirm_command()ToolRegistry::format_for_prompt_filtered()Phase D — Output Overflow (#251-#252):
~/.zeph/data/tool-output/{uuid}.txtwhen exceedingMAX_TOOL_OUTPUT_CHARSspawn_blockingAdditional fixes:
dirs-next2.0 withdirs6.xpermission_policy()call in main.rsTest plan
Closes #248, closes #249, closes #250, closes #251, closes #252