com.blockether.vis.internal.sandbox.scoped-policy — com.blockether/vis 0.3.4

Scoped access settings. Local policy can narrow, never expand, the host ceiling.

assert-bounded! clj

(assert-bounded! host candidate root)

Reject expanded grants after canonical path resolution, including symlink aliases.

check-tool-names! clj

(check-tool-names! target names)

Throw a 400 error for an entry of names that matches no tool of target.

effective-config clj

(effective-config db target)

Resolve access keys independently; unrelated configuration is not session-owned.

fields clj

set-setting! clj

(set-setting! db target id action given)

set-tool-names-fn! clj

(set-tool-names-fn! f)

Install f, which takes a workspace root and answers the tool names that a tool list can name there, or nil when it cannot tell.

setting? clj

(setting? id)

settings clj

(settings db target)

snapshot clj

(snapshot db session-id)

Use the current host ceiling if a later ancestor edit invalidates a local grant. A subagent gets its parent's policy, narrowed by its file grant.

tool-lists clj

(tool-lists db session-id)

The tool lists that apply to session-id, from each scope, least specific first, as {:allow names} and {:deny names} maps. A subagent also gets the lists of its parent.

tool-names clj

(tool-names target)

The tool names that a tool list can name in target, or nil when they are unknown.

tool-pattern clj

(tool-pattern s)

Compile one entry of a tool list. * matches any characters.

validate-candidate! clj

(validate-candidate! target candidate)

Validate a complete staged access configuration before any owner is written.