Conversation
…ty extraction (BRO-216) capability_map.rs: - Extract binary name from bash/shell command before building exec:cmd:<binary> capability (e.g. "ls -la" → exec:cmd:ls, "/usr/bin/python3" → exec:cmd:python3) - Enables precise per-command whitelisting in PolicySet::free() - shell_without_arg falls back to exec:cmd:* wildcard - Updated tests to assert binary-level capability tokens shell_gate.rs (new): - ShellPolicy enum: Blocked | Whitelisted | Unrestricted - shell_policy_for(&PolicySet): derives policy from capability set - validate_shell_command(cmd, policy): validates command binary against policy - FREE_TIER_ALLOWED_COMMANDS: safe read-only whitelist constant - 20+ unit tests covering all tiers, path stripping, end-to-end denial lib.rs: export shell_gate module and public symbols Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…pace() (clippy) split_whitespace() already handles leading/trailing whitespace, making the preceding trim() call redundant. Fixes clippy::trim_split_whitespace lint. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
1 participant
Summary
exec:cmd:capabilities:capabilities_for_tool("bash", {"command": "ls -la"})now returnsexec:cmd:ls(binary only) instead ofexec:cmd:ls -la. This enables precise per-command whitelisting — theexec:cmd:lstoken matches exactly againstexec:cmd:lsinPolicySet::free().allow_capabilitiesshell_gatemodule: Documents and tests the two-layer shell enforcement model withShellPolicyenum,shell_policy_for(),validate_shell_command(), andFREE_TIER_ALLOWED_COMMANDSconstantArchitecture
Shell enforcement runs at two complementary layers:
aios-protocol+aios-policy):capabilities_for_tool("bash", input)returnsexec:cmd:<binary>. TheStaticPolicyEngineevaluates this against the session's policy — anonymous: immediately denied (no approval ticket); free: only whitelisted binaries allowed; pro/enterprise: all allowed via"*"wildcardbashtool is hidden from the LLM's tool list for anonymous/free tiersNew exports
Test plan
shell_derives_exec_cmd_binary_capability:"ls -la"→exec:cmd:lsshell_strips_path_prefix_from_binary:/usr/bin/python3 script.py→exec:cmd:python3shell_cap_is_denied_by_anonymous_policy:exec:cmd:*NOT in anonymous gateshell_gatetests: tier mapping, command validation, path stripping, end-to-end denialcargo test -p arcan-aios-adaptersDepends on: broomva/aiOS#3
Closes BRO-216
🤖 Generated with Claude Code