lkn
/
ollie-core
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
243 Commits 1 Branch 0 Tags 17 MiB
Commit Graph

5 Commits

Author SHA1 Message Date
Levi Neely 13590a84e7 implement TrustedTools: explicit trust replaces implicit allow-all 
- Add TrustedToolsSetter interface and SetTrustedTools to execute.Server
- Add allowed(): trusted tools return true; untrusted with no Confirm
  return false (deny by default). Confirm returns true=allow, consistent
  with allowed() semantics throughout.
- BuildAgentEnv wires cfg.TrustedTools into the execute server

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-14 17:52:37 +02:00
Levi Neely 5d86326edf execute: language-specific dangerous patterns; skip domain-specific tools 
universalPatterns: mkfs, dd if=/dev/, sudo/su, /etc/shadow|sudoers
bashPatterns: rm -rf flag syntax, fork bomb, redirects, eval "...$"
pythonPatterns: shutil.rmtree, os.system/subprocess with rm -rf, os.remove on sys paths
perlPatterns: system/exec/backtick with rm -rf, unlink glob on sys paths
luaPatterns: os.execute/io.popen with rm -rf, os.remove on sys paths
Domain-specific tools (awk, sed, jq, ed, bc, expect) skip validation.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-14 13:36:18 +02:00
Levi Neely 2d122c70dd gate file tools with sandbox path checks 
file_read, file_write, file_edit, file_grep, and file_glob now check
paths against the sandbox config before operating. Same policy that
landrun enforces on execute_code, applied at the application level.

- Add sandbox.LoadMerged: loads base config + named layer, graceful
  fallback if layer missing. Replaces duplicated logic in execute.
- Add sandbox.CheckPath: resolves symlinks, expands templates, checks
  path against allowed entries (RO/ROX for read, RW/RWX for write).
- file.Server.checkAccess wires the check into every file dispatch.
 2026-04-13 18:37:17 +02:00
Levi Neely 1b44244f81 cleanup tools 2026-04-12 16:26:50 +02:00
Levi Neely a3e1a078c4 refactor: move mcp/tools/execute to pkg/ for external consumability 
internal/mcp      → pkg/mcp         (MCP client, concrete)
internal/tools    → pkg/tools        (Executor interface + MCPExecutor)
internal/exec     → pkg/tools/execute (builtin sandbox executor, split by tool)

Split exec.go into executor.go (sandbox runner), pipe.go (BuildPipeline/PipeStep),
tool.go (ReadTool), and code.go (execute_code is Executor.Execute with trusted=false).

All three packages are now importable by consumers outside this module.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-09 21:59:01 +02:00