Sign in

flagon-io/g1t

public

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

gitagentscloudflarerustforgemcp

g1t/crates/runner/src/guard.rs

1,030 lines40,431 bytesCodeBlame
1//! Guardrails inside the sandbox: the command rules the agent's harness
2//! enforces, its cost and time caps, and trusting the certificate the
3//! sandbox's HTTPS is re-signed with when its network is restricted.
4//!
5//! The runner service passes the run's guardrails as `GUARDRAILS`. Before
6//! Claude Code starts, `install` writes them where the harness reads them:
7//!
8//! - Claude Code's managed settings (`/etc/claude-code/managed-settings.json`,
9//! root-owned, which no other settings file can override) get a
10//! `PreToolUse` hook that runs this program in `MODE=guard` before every
11//! tool call, and `permissions.deny` rules as a second layer.
12//! - With the `sudo` rule on, the sandbox then gives up root, so the agent
13//! cannot change either. Where that cannot be done (no sudo), the same
14//! settings are passed with `--settings` instead.
15//!
16//! The hook (`hook_main`) decides with `decide`: a refused call is not
17//! made, Claude Code tells the agent why, and the refusal is appended to
18//! `DENIED_LOG`, which the harness reads and reports as a step of the run.
19//!
20//! Matching shell commands against rules is a guard against an agent's
21//! mistakes, not a sandbox: a command can always be written in a way no
22//! rule foresees. The network list, the credentials a sandbox holds, and
23//! branch protection on g1t's side are the hard boundaries.
24
25use std::collections::BTreeMap;
26use std::fmt;
27use std::io::{Read, Write};
28use std::path::Path;
29use std::process::{Command, Stdio};
30
31use serde::Deserialize;
32use serde_json::{Value, json};
33
34/// Where the guardrails are kept for the hook: root-owned where it can be.
35const POLICY_FILES: [&str; 2] = ["/etc/g1t/guard.json", "/work/.g1t/guard.json"];
36const MANAGED_SETTINGS: &str = "/etc/claude-code/managed-settings.json";
37/// Settings passed with `--settings` when the managed file cannot be written.
38pub const FALLBACK_SETTINGS: &str = "/work/.g1t/settings.json";
39/// Refusals, one per line, for the harness to report.
40pub const DENIED_LOG: &str = "/work/.g1t/denied.log";
41/// The certificate the sandbox's HTTPS is re-signed with, when it is guarded.
42const EGRESS_CA: &str = "/etc/cloudflare/certs/cloudflare-containers-ca.crt";
43const HOOK_COMMAND: &str = "MODE=guard /usr/local/bin/g1t-runner";
44
45/// The run's guardrails, as the runner service passes them.
46#[derive(Clone, Debug, Default, Deserialize)]
47#[serde(rename_all = "camelCase", default)]
48pub struct Policy {
49 pub rules: BTreeMap<String, bool>,
50 pub deny: Vec<String>,
51 pub budget_usd: Option<f64>,
52 /// This run's time cap, in minutes.
53 pub minutes: Option<u32>,
54 pub restrict_network: bool,
55 /// The branch everything lands on, when the runner knows it.
56 pub default_branch: Option<String>,
57}
58
59impl Policy {
60 pub fn from_env() -> Option<Policy> {
61 serde_json::from_str(&std::env::var("GUARDRAILS").ok()?).ok()
62 }
63
64 fn on(&self, rule: &str) -> bool {
65 self.rules.get(rule).copied().unwrap_or(false)
66 }
67}
68
69/// Why g1t stopped a run by itself: it reached a cap.
70#[derive(Debug, Clone, Copy, PartialEq, Eq)]
71pub enum Halted {
72 Budget,
73 Time,
74}
75
76impl Halted {
77 pub fn reason(self) -> &'static str {
78 match self {
79 Halted::Budget => "budget",
80 Halted::Time => "time",
81 }
82 }
83}
84
85impl fmt::Display for Halted {
86 fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
87 match self {
88 Halted::Budget => write!(f, "the run reached its cost cap"),
89 Halted::Time => write!(f, "the run reached its time cap"),
90 }
91 }
92}
93
94impl std::error::Error for Halted {}
95
96/// Whether a run failed because it reached a cap, rather than failing.
97pub fn is_halt(error: &anyhow::Error) -> bool {
98 error.downcast_ref::<Halted>().is_some()
99}
100
101/// Runs a command as root without asking. False where that is not allowed.
102fn sudo(args: &[&str], input: Option<&str>) -> bool {
103 let child = Command::new("sudo")
104 .arg("-n")
105 .args(args)
106 .stdin(if input.is_some() { Stdio::piped() } else { Stdio::null() })
107 .stdout(Stdio::null())
108 .stderr(Stdio::null())
109 .spawn();
110 let Ok(mut child) = child else {
111 return false;
112 };
113 if let (Some(input), Some(mut stdin)) = (input, child.stdin.take()) {
114 let _ = stdin.write_all(input.as_bytes());
115 }
116 child.wait().is_ok_and(|status| status.success())
117}
118
119/// Writes `contents` to a root-owned file that others can read.
120fn write_as_root(path: &str, contents: &str) -> bool {
121 let dir = Path::new(path).parent().and_then(Path::to_str).unwrap_or("/");
122 sudo(&["mkdir", "-p", dir], None)
123 && sudo(&["tee", path], Some(contents))
124 && sudo(&["chmod", "0644", path], None)
125}
126
127/// Trusts the certificate a guarded sandbox's HTTPS is re-signed with, so
128/// that git, package managers and this program can reach allowed hosts.
129/// Does nothing in a sandbox whose network is open. Called first thing,
130/// before any request is made.
131pub fn trust_egress_ca() {
132 const TRUSTED: &str = "/usr/local/share/ca-certificates/cloudflare-containers-ca.crt";
133 // Once per sandbox: the hooks run this program after every tool call.
134 if !Path::new(EGRESS_CA).exists() || Path::new(TRUSTED).exists() {
135 return;
136 }
137 let trusted = sudo(&["cp", EGRESS_CA, TRUSTED], None) && sudo(&["update-ca-certificates"], None);
138 if !trusted {
139 eprintln!("g1t-runner: could not trust the sandbox's egress certificate; HTTPS will fail");
140 }
141}
142
143/// The permission rules that back up each built-in rule. The hook is what
144/// enforces them; these are a second layer the harness applies itself.
145fn rule_patterns(rule: &str) -> &'static [&'static str] {
146 match rule {
147 "force_push" => &[
148 "Bash(git push --force:*)",
149 "Bash(git push -f:*)",
150 "Bash(git push --force-with-lease:*)",
151 "Bash(git push --mirror:*)",
152 ],
153 "rewrite_default_branch" => &[
154 "Bash(git filter-branch:*)",
155 "Bash(git filter-repo:*)",
156 "Bash(git replace:*)",
157 ],
158 "outside_workspace" => &[
159 "Read(//proc/**)",
160 "Read(//etc/claude-code/**)",
161 "Read(//etc/g1t/**)",
162 "Read(//work/.g1t/**)",
163 "Read(//work/g1t-mcp.json)",
164 "Read(//work/g1t-steer.json)",
165 "Read(~/.claude/**)",
166 ],
167 "print_env" => &["Bash(env)", "Bash(printenv:*)", "Bash(export -p)"],
168 "sudo" => &["Bash(sudo:*)", "Bash(su:*)", "Bash(doas:*)"],
169 _ => &[],
170 }
171}
172
173/// Claude Code's settings for a guarded run: the hook before every tool
174/// call, the permission rules, and nothing sent anywhere but the model.
175pub fn harness_settings(policy: &Policy) -> Value {
176 let mut deny: Vec<String> = Vec::new();
177 for (rule, on) in &policy.rules {
178 if *on {
179 deny.extend(rule_patterns(rule).iter().map(|pattern| (*pattern).to_owned()));
180 }
181 }
182 for pattern in &policy.deny {
183 if !deny.contains(pattern) {
184 deny.push(pattern.clone());
185 }
186 }
187 let mut settings = json!({
188 "permissions": { "deny": deny },
189 "hooks": {
190 "PreToolUse": [{
191 "matcher": "*",
192 "hooks": [{ "type": "command", "command": HOOK_COMMAND, "timeout": 10 }],
193 }],
194 },
195 });
196 if policy.restrict_network {
197 // Only the model and the allowed hosts are reachable: the harness
198 // is told not to try anything else.
199 settings["skipWebFetchPreflight"] = json!(true);
200 settings["env"] = json!({
201 "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1",
202 "DISABLE_TELEMETRY": "1",
203 "DISABLE_ERROR_REPORTING": "1",
204 "DISABLE_AUTOUPDATER": "1",
205 });
206 }
207 settings
208}
209
210/// What `install` managed to do.
211#[derive(Debug, Default)]
212pub struct Installed {
213 /// Settings to pass with `--settings`, when they could not be managed.
214 pub settings_file: Option<String>,
215 /// Whether the sandbox gave up root.
216 pub dropped_root: bool,
217}
218
219/// Puts the guardrails where the harness and the hook read them, then, if
220/// the `sudo` rule is on, gives up root for the rest of the sandbox.
221pub fn install(policy: &Policy, raw: &str) -> Installed {
222 let _ = std::fs::create_dir_all("/work/.g1t");
223 let _ = std::fs::write(DENIED_LOG, "");
224 let settings = harness_settings(policy).to_string();
225 let managed = write_as_root(POLICY_FILES[0], raw) && write_as_root(MANAGED_SETTINGS, &settings);
226 let mut installed = Installed::default();
227 if !managed {
228 let _ = std::fs::write(POLICY_FILES[1], raw);
229 if std::fs::write(FALLBACK_SETTINGS, &settings).is_ok() {
230 installed.settings_file = Some(FALLBACK_SETTINGS.to_owned());
231 }
232 }
233 if policy.on("sudo") && managed {
234 installed.dropped_root = sudo(&["rm", "-f", "/etc/sudoers.d/node"], None);
235 }
236 installed
237}
238
239/// A remote as `namespace/name`, lower case, whatever host or suffix it has.
240fn repo_of(remote: &str) -> String {
241 let path = remote.split("://").nth(1).map_or(remote, |rest| rest.split_once('/').map_or("", |(_, path)| path));
242 path.trim_end_matches('/').trim_end_matches(".git").to_lowercase()
243}
244
245/// Whether the checkout the agent works in is the repository's own: a
246/// branch of the repository itself (the default branch, or one pushed to
247/// it), never a fork. A fork's files are anyone's, so the harness must not
248/// load their CLAUDE.md, settings, hooks, MCP servers or commands. Same
249/// rule as the instructions the runner service reads (repo-instructions.ts).
250/// Unsure is untrusted.
251pub fn checkout_trusted(remote: Option<&str>, upstream: Option<&str>, repo: Option<&str>) -> bool {
252 let Some(remote) = remote.map(repo_of).filter(|remote| !remote.is_empty()) else {
253 return false;
254 };
255 let own = upstream
256 .map(repo_of)
257 .or_else(|| repo.map(|repo| repo.trim_matches('/').to_lowercase()))
258 .filter(|own| !own.is_empty());
259 own.is_some_and(|own| own == remote)
260}
261
262/// The same, from the sandbox's environment.
263pub fn checkout_trusted_from_env() -> bool {
264 let var = |name: &str| std::env::var(name).ok();
265 checkout_trusted(
266 var("GIT_REMOTE").as_deref(),
267 var("UPSTREAM_REMOTE").as_deref(),
268 var("G1T_REPO").as_deref(),
269 )
270}
271
272/// Flags that keep Claude Code from loading anything from an untrusted
273/// checkout: its `.claude/settings.json` and `settings.local.json` (with
274/// their hooks and permissions), its `.mcp.json`, and its commands and
275/// skills. Managed settings (the guard hook), `--settings` and
276/// `--mcp-config` still apply. CLAUDE.md is turned off by
277/// `UNTRUSTED_ENV`.
278pub const UNTRUSTED_FLAGS: [&str; 4] = ["--setting-sources", "user", "--strict-mcp-config", "--disable-slash-commands"];
279/// Turns off every CLAUDE.md, the checkout's included.
280pub const UNTRUSTED_ENV: (&str, &str) = ("CLAUDE_CODE_DISABLE_CLAUDE_MDS", "1");
281
282/// Refusals the hook has written since the last call, as run steps.
283#[derive(Default)]
284pub struct Denials {
285 seen: usize,
286}
287
288impl Denials {
289 pub fn take(&mut self) -> Vec<String> {
290 let Ok(text) = std::fs::read_to_string(DENIED_LOG) else {
291 return Vec::new();
292 };
293 let lines: Vec<String> = text.lines().map(str::to_owned).collect();
294 let new = lines.iter().skip(self.seen).cloned().collect();
295 self.seen = lines.len();
296 new
297 }
298}
299
300/// `MODE=guard`: Claude Code's `PreToolUse` hook. Reads the call on stdin;
301/// exits 2 with the reason on stderr to refuse it, which Claude Code shows
302/// the agent, and 0 to let it through.
303pub fn hook_main() -> i32 {
304 let mut input = String::new();
305 let _ = std::io::stdin().read_to_string(&mut input);
306 let Ok(call) = serde_json::from_str::<Value>(&input) else {
307 return 0;
308 };
309 let Some(policy) = POLICY_FILES
310 .iter()
311 .find_map(|path| std::fs::read_to_string(path).ok())
312 .and_then(|raw| serde_json::from_str::<Policy>(&raw).ok())
313 else {
314 return 0;
315 };
316 let tool = call["tool_name"].as_str().unwrap_or_default();
317 let home = std::env::var("HOME").unwrap_or_else(|_| "/home/node".to_owned());
318 let place = Place {
319 workdir: call["cwd"].as_str().unwrap_or(crate::WORKDIR).to_owned(),
320 home,
321 default_branch: policy
322 .default_branch
323 .clone()
324 .or_else(origin_default_branch)
325 .unwrap_or_else(|| "main".to_owned()),
326 };
327 let Some(reason) = decide(&policy, tool, &call["tool_input"], &place) else {
328 return 0;
329 };
330 let what = crate::progress::describe_tool(tool, &call["tool_input"]);
331 if let Ok(mut log) = std::fs::OpenOptions::new().create(true).append(true).open(DENIED_LOG) {
332 let _ = writeln!(log, "{}", crate::progress::one_line(&format!("Denied: {what} ({reason})")));
333 }
334 eprintln!(
335 "Blocked by g1t guardrails: {reason}. This project does not allow it. Do not try to get around it; if the task cannot be done without it, stop and say so in your summary."
336 );
337 2
338}
339
340/// The default branch of the clone's origin, if git knows it.
341fn origin_default_branch() -> Option<String> {
342 let output = Command::new("git")
343 .current_dir(crate::WORKDIR)
344 .args(["symbolic-ref", "--short", "refs/remotes/origin/HEAD"])
345 .output()
346 .ok()?;
347 let name = String::from_utf8_lossy(&output.stdout).trim().to_owned();
348 name.strip_prefix("origin/").map(str::to_owned)
349}
350
351/// Where a call is made from.
352pub struct Place {
353 pub workdir: String,
354 pub home: String,
355 pub default_branch: String,
356}
357
358/// Why a tool call is refused, or None to let it through.
359pub fn decide(policy: &Policy, tool: &str, input: &Value, place: &Place) -> Option<String> {
360 let field = |name: &str| input.get(name).and_then(Value::as_str).unwrap_or_default();
361 if tool == "Bash" {
362 let command = field("command");
363 for segment in segments(command) {
364 let words = words(&segment);
365 if let Some(reason) = builtin_shell(policy, &words, &segment, place) {
366 return Some(reason);
367 }
368 }
369 }
370 if let Some(path) = file_path(tool, input) {
371 let resolved = resolve(&path, place);
372 if policy.on("outside_workspace") && !inside_allowed(&resolved, place) {
373 return Some(format!("{resolved} is outside the project"));
374 }
375 }
376 custom(policy, tool, input, place)
377}
378
379/// The path a file tool works on.
380fn file_path(tool: &str, input: &Value) -> Option<String> {
381 let field = |name: &str| input.get(name).and_then(Value::as_str).map(str::to_owned);
382 match tool {
383 "Read" | "Write" | "Edit" | "MultiEdit" => field("file_path"),
384 "NotebookEdit" | "NotebookRead" => field("notebook_path"),
385 "Glob" | "Grep" | "LS" => field("path"),
386 _ => None,
387 }
388}
389
390/// `path` made absolute against the working directory, without `.` or
391/// `..`. Always with `/`, as in the sandbox.
392fn resolve(path: &str, place: &Place) -> String {
393 let expanded = match path.strip_prefix("~/") {
394 Some(rest) => format!("{}/{rest}", place.home),
395 None if path == "~" => place.home.clone(),
396 None => path.to_owned(),
397 };
398 let joined = if expanded.starts_with('/') {
399 expanded
400 } else {
401 format!("{}/{expanded}", place.workdir)
402 };
403 let mut parts: Vec<&str> = Vec::new();
404 for part in joined.split('/') {
405 match part {
406 "" | "." => {}
407 ".." => {
408 parts.pop();
409 }
410 name => parts.push(name),
411 }
412 }
413 format!("/{}", parts.join("/"))
414}
415
416/// Where file tools may go: the project, scratch space, and the caches
417/// where dependencies' sources are.
418fn inside_allowed(path: &str, place: &Place) -> bool {
419 let roots = [
420 crate::WORKDIR.to_owned(),
421 "/tmp".to_owned(),
422 format!("{}/.cargo/registry", place.home),
423 format!("{}/.cargo/git", place.home),
424 format!("{}/go/pkg/mod", place.home),
425 format!("{}/.rustup/toolchains", place.home),
426 ];
427 roots
428 .iter()
429 .any(|root| path == root || path.strip_prefix(root.as_str()).is_some_and(|rest| rest.starts_with('/')))
430}
431
432/// Paths of g1t's own a shell command may not touch.
433fn protected_paths(place: &Place) -> Vec<String> {
434 vec![
435 "/etc/claude-code".to_owned(),
436 "/etc/g1t".to_owned(),
437 "/etc/cloudflare".to_owned(),
438 "/work/.g1t".to_owned(),
439 "/work/g1t-mcp.json".to_owned(),
440 crate::steer::CONFIG.to_owned(),
441 format!("{}/.claude", place.home),
442 "~/.claude".to_owned(),
443 "$HOME/.claude".to_owned(),
444 ]
445}
446
447/// A shell command split into the commands it runs.
448pub fn segments(command: &str) -> Vec<String> {
449 let mut out = Vec::new();
450 let mut current = String::new();
451 let mut quote: Option<char> = None;
452 let chars: Vec<char> = command.chars().collect();
453 let mut i = 0;
454 while i < chars.len() {
455 let c = chars[i];
456 match quote {
457 Some(q) => {
458 if c == q {
459 quote = None;
460 }
461 current.push(c);
462 }
463 None if c == '\'' || c == '"' => {
464 quote = Some(c);
465 current.push(c);
466 }
467 None if c == ';' || c == '\n' || c == '|' || c == '&' => {
468 out.push(std::mem::take(&mut current));
469 // `&&` and `||` are one separator.
470 if (c == '|' || c == '&') && chars.get(i + 1) == Some(&c) {
471 i += 1;
472 }
473 }
474 None if c == '(' || c == ')' || c == '`' || (c == '$' && chars.get(i + 1) == Some(&'(')) => {
475 // A subshell or a command substitution runs a command of
476 // its own.
477 out.push(std::mem::take(&mut current));
478 }
479 None => current.push(c),
480 }
481 i += 1;
482 }
483 out.push(current);
484 out.into_iter()
485 .map(|segment| segment.split_whitespace().collect::<Vec<_>>().join(" "))
486 .filter(|segment| !segment.is_empty())
487 .collect()
488}
489
490/// A command's words, with quotes removed, leading `VAR=value`
491/// assignments and wrappers such as `nohup` skipped.
492pub fn words(segment: &str) -> Vec<String> {
493 let mut out = Vec::new();
494 let mut current = String::new();
495 let mut quote: Option<char> = None;
496 let mut started = false;
497 for c in segment.chars() {
498 match quote {
499 Some(q) if c == q => quote = None,
500 Some(_) => current.push(c),
501 None if c == '\'' || c == '"' => {
502 quote = Some(c);
503 started = true;
504 }
505 None if c.is_whitespace() => {
506 if started || !current.is_empty() {
507 out.push(std::mem::take(&mut current));
508 started = false;
509 }
510 }
511 None if c == '{' || c == '}' => {}
512 None => current.push(c),
513 }
514 }
515 if started || !current.is_empty() {
516 out.push(current);
517 }
518 let skip = out
519 .iter()
520 .take_while(|word| {
521 is_assignment(word)
522 || matches!(word.as_str(), "nohup" | "time" | "exec" | "command" | "builtin" | "then" | "do" | "else" | "!")
523 })
524 .count();
525 out.split_off(skip)
526}
527
528fn is_assignment(word: &str) -> bool {
529 word.split_once('=').is_some_and(|(name, _)| {
530 !name.is_empty() && name.chars().all(|c| c.is_ascii_alphanumeric() || c == '_')
531 })
532}
533
534/// The name of a program, without its directory.
535fn program(word: &str) -> &str {
536 word.rsplit('/').next().unwrap_or(word)
537}
538
539/// git's subcommand and its arguments, past options such as `-C dir`.
540fn git_command(words: &[String]) -> Option<(&str, &[String])> {
541 if words.first().map(|word| program(word)) != Some("git") {
542 return None;
543 }
544 let mut i = 1;
545 while i < words.len() {
546 let word = words[i].as_str();
547 if word == "-C" || word == "-c" || word == "--git-dir" || word == "--work-tree" {
548 i += 2;
549 } else if word.starts_with('-') {
550 i += 1;
551 } else {
552 return Some((word, &words[i + 1..]));
553 }
554 }
555 None
556}
557
558/// Whether a variable's name looks like it holds a secret.
559fn secret_name(name: &str) -> bool {
560 let upper = name.to_uppercase();
561 ["TOKEN", "KEY", "SECRET", "PASSWORD", "PASSWD", "CREDENTIAL", "AUTH"]
562 .iter()
563 .any(|part| upper.contains(part))
564}
565
566/// Variables a command reads, by name: `$NAME` and `${NAME}`.
567fn variables(segment: &str) -> Vec<String> {
568 let mut out = Vec::new();
569 let chars: Vec<char> = segment.chars().collect();
570 let mut i = 0;
571 while i < chars.len() {
572 if chars[i] == '$' {
573 let mut j = i + 1;
574 if chars.get(j) == Some(&'{') {
575 j += 1;
576 }
577 let start = j;
578 while j < chars.len() && (chars[j].is_ascii_alphanumeric() || chars[j] == '_') {
579 j += 1;
580 }
581 if j > start {
582 out.push(chars[start..j].iter().collect());
583 }
584 i = j;
585 } else {
586 i += 1;
587 }
588 }
589 out
590}
591
592/// The built-in rules, for one command of a shell line.
593fn builtin_shell(policy: &Policy, words: &[String], segment: &str, place: &Place) -> Option<String> {
594 let first = words.first().map(|word| program(word)).unwrap_or_default();
595 let args = words.get(1..).unwrap_or_default();
596
597 if policy.on("sudo") && matches!(first, "sudo" | "su" | "doas" | "pkexec") {
598 return Some("no sudo".to_owned());
599 }
600
601 if let Some((sub, rest)) = git_command(words) {
602 if sub == "push" {
603 let options: Vec<&str> = rest.iter().map(String::as_str).filter(|a| a.starts_with('-')).collect();
604 let positional: Vec<&str> = rest.iter().map(String::as_str).filter(|a| !a.starts_with('-')).collect();
605 let refspecs = positional.get(1..).unwrap_or_default();
606 if policy.on("force_push") {
607 let forced = options.iter().any(|option| {
608 matches!(*option, "--force" | "--mirror" | "--delete" | "--prune" | "--force-if-includes")
609 || option.starts_with("--force-with-lease")
610 || (!option.starts_with("--") && (option.contains('f') || option.contains('d')))
611 });
612 if forced || refspecs.iter().any(|spec| spec.starts_with('+') || spec.starts_with(':')) {
613 return Some("no force-pushing".to_owned());
614 }
615 }
616 if policy.on("rewrite_default_branch") {
617 let branch = place.default_branch.as_str();
618 let targets_default = refspecs.iter().any(|spec| {
619 let target = spec.rsplit(':').next().unwrap_or(spec).trim_start_matches('+');
620 target == branch || target == format!("refs/heads/{branch}")
621 });
622 if targets_default || options.contains(&"--all") {
623 return Some(format!("no pushing to {branch}, the default branch"));
624 }
625 }
626 }
627 if policy.on("rewrite_default_branch") {
628 let branch = place.default_branch.as_str();
629 let names_default = rest
630 .iter()
631 .any(|arg| arg == branch || *arg == format!("refs/heads/{branch}"));
632 let moves = rest
633 .iter()
634 .any(|arg| matches!(arg.as_str(), "-f" | "--force" | "-D" | "-d" | "--delete" | "-m" | "-M" | "--move"));
635 match sub {
636 "filter-branch" | "filter-repo" | "replace" => {
637 return Some("no rewriting history".to_owned());
638 }
639 "branch" if names_default && moves => {
640 return Some(format!("no moving or deleting {branch}, the default branch"));
641 }
642 "update-ref" if names_default => {
643 return Some(format!("no moving {branch}, the default branch"));
644 }
645 _ => {}
646 }
647 }
648 }
649
650 if policy.on("print_env") {
651 let prints = match first {
652 "printenv" => true,
653 // `env` alone, or with only options and assignments: no command.
654 "env" => args.iter().all(|arg| arg.starts_with('-') || is_assignment(arg)),
655 "export" | "declare" | "typeset" => args.is_empty() || args.iter().any(|arg| arg == "-p" || arg == "-x"),
656 "set" => args.is_empty(),
657 "compgen" => args.iter().any(|arg| arg == "-e" || arg == "-v"),
658 _ => false,
659 };
660 let environ = segment.contains("/proc/") && segment.contains("environ");
661 let secret = variables(segment).iter().any(|name| secret_name(name));
662 if prints || environ || secret {
663 return Some("no printing the environment".to_owned());
664 }
665 }
666
667 if policy.on("outside_workspace") {
668 let touched = protected_paths(place)
669 .into_iter()
670 .find(|path| segment.contains(path.as_str()));
671 if let Some(path) = touched {
672 return Some(format!("{path} is g1t's, not the project's"));
673 }
674 if segment.contains("/proc/") && segment.contains("environ") {
675 return Some("no reading other processes' environments".to_owned());
676 }
677 }
678 None
679}
680
681/// The tools a permission rule's tool name covers, as Claude Code reads
682/// them: an `Edit` rule covers every tool that writes a file.
683fn rule_covers(rule_tool: &str, tool: &str) -> bool {
684 match rule_tool {
685 "Edit" | "Write" => matches!(tool, "Edit" | "Write" | "MultiEdit" | "NotebookEdit"),
686 "Read" => matches!(tool, "Read" | "Glob" | "Grep" | "NotebookRead" | "LS"),
687 other => other == tool,
688 }
689}
690
691/// The workspace's own deny patterns.
692fn custom(policy: &Policy, tool: &str, input: &Value, place: &Place) -> Option<String> {
693 for pattern in &policy.deny {
694 let (rule_tool, spec) = match pattern.split_once('(') {
695 Some((name, rest)) => (name, rest.strip_suffix(')')),
696 None => (pattern.as_str(), None),
697 };
698 if !rule_covers(rule_tool, tool) {
699 continue;
700 }
701 let matched = match spec {
702 None => true,
703 Some(spec) if tool == "Bash" => {
704 let command = input.get("command").and_then(Value::as_str).unwrap_or_default();
705 segments(command).iter().any(|segment| shell_matches(spec, segment))
706 }
707 Some(spec) if rule_tool == "WebFetch" => {
708 let url = input.get("url").and_then(Value::as_str).unwrap_or_default();
709 let host = url.split("://").nth(1).unwrap_or(url).split(['/', ':']).next().unwrap_or_default();
710 let domain = spec.strip_prefix("domain:").unwrap_or(spec);
711 host == domain || host.ends_with(&format!(".{domain}"))
712 }
713 Some(spec) => match file_path(tool, input) {
714 Some(path) => {
715 let path = resolve(&path, place);
716 glob(&expand_rule_path(spec, place), &path)
717 }
718 None => false,
719 },
720 };
721 if matched {
722 return Some(format!("{pattern} is on this workspace's deny list"));
723 }
724 }
725 None
726}
727
728/// A rule's path made absolute, as Claude Code reads it: `//` is the root
729/// and `~/` the home directory; anything else is the project's.
730fn expand_rule_path(spec: &str, place: &Place) -> String {
731 if let Some(rest) = spec.strip_prefix("//") {
732 format!("/{rest}")
733 } else if let Some(rest) = spec.strip_prefix("~/") {
734 format!("{}/{rest}", place.home)
735 } else if let Some(rest) = spec.strip_prefix('/') {
736 format!("{}/{rest}", crate::WORKDIR)
737 } else {
738 format!("{}/{spec}", crate::WORKDIR)
739 }
740}
741
742/// Whether one command matches a `Bash(...)` rule: `prefix:*` for a
743/// command that starts with those words, `*` anywhere as a wildcard, or
744/// the exact command.
745pub fn shell_matches(spec: &str, segment: &str) -> bool {
746 let spec = spec.split_whitespace().collect::<Vec<_>>().join(" ");
747 let segment = words(segment).join(" ");
748 if let Some(prefix) = spec.strip_suffix(":*") {
749 return segment == prefix
750 || segment
751 .strip_prefix(prefix)
752 .is_some_and(|rest| rest.starts_with(' '));
753 }
754 if spec.contains('*') {
755 return wildcard(&spec, &segment, false);
756 }
757 segment == spec
758}
759
760/// A path glob: `**` crosses directories, `*` and `?` do not.
761pub fn glob(pattern: &str, path: &str) -> bool {
762 wildcard(pattern, path, true)
763}
764
765fn wildcard(pattern: &str, text: &str, paths: bool) -> bool {
766 let p: Vec<char> = pattern.chars().collect();
767 let t: Vec<char> = text.chars().collect();
768 fn go(p: &[char], t: &[char], paths: bool) -> bool {
769 match p.first() {
770 None => t.is_empty(),
771 Some('*') if paths && p.get(1) == Some(&'*') => {
772 let rest = if p.get(2) == Some(&'/') { &p[3..] } else { &p[2..] };
773 (0..=t.len()).any(|i| go(rest, &t[i..], paths))
774 || (p.get(2) == Some(&'/') && go(&p[2..], t, paths))
775 }
776 Some('*') => (0..=t.len())
777 .take_while(|i| !paths || *i == 0 || t[i - 1] != '/')
778 .any(|i| go(&p[1..], &t[i..], paths)),
779 Some('?') => !t.is_empty() && (!paths || t[0] != '/') && go(&p[1..], &t[1..], paths),
780 Some(c) => t.first() == Some(c) && go(&p[1..], &t[1..], paths),
781 }
782 }
783 go(&p, &t, paths)
784}
785
786#[cfg(test)]
787mod tests {
788 use super::*;
789
790 fn all_on() -> Policy {
791 Policy {
792 rules: ["force_push", "rewrite_default_branch", "outside_workspace", "print_env", "sudo"]
793 .into_iter()
794 .map(|rule| (rule.to_owned(), true))
795 .collect(),
796 ..Policy::default()
797 }
798 }
799
800 fn place() -> Place {
801 Place {
802 workdir: "/work/repo".to_owned(),
803 home: "/home/node".to_owned(),
804 default_branch: "main".to_owned(),
805 }
806 }
807
808 fn bash(policy: &Policy, command: &str) -> Option<String> {
809 decide(policy, "Bash", &json!({ "command": command }), &place())
810 }
811
812 #[test]
813 fn force_pushes_are_refused_however_written() {
814 let policy = all_on();
815 for command in [
816 "git push --force",
817 "git push origin feature -f",
818 "git push --force-with-lease=main origin feature",
819 "git -C /work/repo push origin +feature",
820 "cd x && git push origin :old",
821 "git push -fu origin feature",
822 "GIT_TRACE=1 git push --mirror",
823 ] {
824 assert_eq!(bash(&policy, command).as_deref(), Some("no force-pushing"), "{command}");
825 }
826 assert_eq!(bash(&policy, "git push origin feature"), None);
827 assert_eq!(bash(&policy, "git push -u origin feature"), None);
828 }
829
830 #[test]
831 fn the_default_branch_is_not_rewritten() {
832 let policy = all_on();
833 assert!(bash(&policy, "git push origin HEAD:main").is_some());
834 assert!(bash(&policy, "git push origin main").is_some());
835 assert!(bash(&policy, "git push origin feature:refs/heads/main").is_some());
836 assert!(bash(&policy, "git branch -f main HEAD~3").is_some());
837 assert!(bash(&policy, "git update-ref refs/heads/main abc123").is_some());
838 assert!(bash(&policy, "git filter-branch --tree-filter 'rm x' HEAD").is_some());
839 assert_eq!(bash(&policy, "git branch feature"), None);
840 assert_eq!(bash(&policy, "git rebase main"), None);
841 assert_eq!(bash(&policy, "git checkout main"), None);
842 }
843
844 #[test]
845 fn printing_the_environment_is_refused() {
846 let policy = all_on();
847 for command in [
848 "env",
849 "env | grep KEY",
850 "printenv ANTHROPIC_API_KEY",
851 "export -p",
852 "set",
853 "cat /proc/self/environ",
854 "echo $ANTHROPIC_API_KEY",
855 "curl -H \"Authorization: ${GITHUB_TOKEN}\" x",
856 ] {
857 assert_eq!(bash(&policy, command).as_deref(), Some("no printing the environment"), "{command}");
858 }
859 assert_eq!(bash(&policy, "env NODE_ENV=test npm test"), None);
860 assert_eq!(bash(&policy, "export PATH=$PATH:/x"), None);
861 assert_eq!(bash(&policy, "echo $HOME"), None);
862 assert_eq!(bash(&policy, "set -e"), None);
863 }
864
865 #[test]
866 fn sudo_is_refused() {
867 let policy = all_on();
868 assert_eq!(bash(&policy, "sudo apt-get install jq").as_deref(), Some("no sudo"));
869 assert_eq!(bash(&policy, "npm ci && sudo rm -rf /").as_deref(), Some("no sudo"));
870 assert_eq!(bash(&policy, "echo $(sudo cat /etc/shadow)").as_deref(), Some("no sudo"));
871 assert_eq!(bash(&policy, "npm test"), None);
872 // Quoted, it is text.
873 assert_eq!(bash(&policy, "echo 'do not use sudo'"), None);
874 }
875
876 #[test]
877 fn files_outside_the_project_are_refused() {
878 let policy = all_on();
879 let read = |path: &str| decide(&policy, "Read", &json!({ "file_path": path }), &place());
880 assert_eq!(read("/work/repo/src/lib.rs"), None);
881 assert_eq!(read("src/lib.rs"), None);
882 assert_eq!(read("/tmp/out.txt"), None);
883 assert_eq!(read("/home/node/.cargo/registry/src/serde/lib.rs"), None);
884 assert!(read("/etc/passwd").is_some());
885 assert!(read("../../etc/passwd").is_some());
886 assert!(read("/work/repo/../g1t-mcp.json").is_some());
887 assert!(read("~/.claude/settings.json").is_some());
888 assert!(decide(&policy, "Grep", &json!({ "pattern": "x", "path": "/etc" }), &place()).is_some());
889 assert!(bash(&policy, "cat /work/g1t-mcp.json").is_some());
890 assert!(bash(&policy, "cat ~/.claude/settings.json").is_some());
891 assert!(bash(&policy, "rm /work/.g1t/denied.log").is_some());
892 }
893
894 #[test]
895 fn rules_that_are_off_let_things_through() {
896 let policy = Policy::default();
897 assert_eq!(bash(&policy, "git push --force"), None);
898 assert_eq!(bash(&policy, "sudo true"), None);
899 assert_eq!(bash(&policy, "env"), None);
900 assert_eq!(decide(&policy, "Read", &json!({ "file_path": "/etc/passwd" }), &place()), None);
901 }
902
903 #[test]
904 fn custom_patterns_match_as_permission_rules_do() {
905 let policy = Policy {
906 deny: vec![
907 "Bash(terraform apply:*)".into(),
908 "Bash(rm -rf *)".into(),
909 "Edit(//etc/**)".into(),
910 "Read(secrets/**)".into(),
911 "WebFetch(domain:example.com)".into(),
912 "WebSearch".into(),
913 ],
914 ..Policy::default()
915 };
916 assert!(bash(&policy, "terraform apply -auto-approve").is_some());
917 assert!(bash(&policy, "cd infra && terraform apply").is_some());
918 assert_eq!(bash(&policy, "terraform applyx"), None);
919 assert_eq!(bash(&policy, "terraform plan"), None);
920 assert!(bash(&policy, "rm -rf build").is_some());
921 let write = |path: &str| decide(&policy, "Write", &json!({ "file_path": path }), &place());
922 assert!(write("/etc/hosts").is_some());
923 assert_eq!(write("/work/repo/etc/hosts"), None);
924 let read = |path: &str| decide(&policy, "Read", &json!({ "file_path": path }), &place());
925 assert!(read("secrets/prod/key.pem").is_some());
926 assert_eq!(read("src/secrets.rs"), None);
927 assert!(decide(&policy, "WebFetch", &json!({ "url": "https://docs.example.com/x" }), &place()).is_some());
928 assert_eq!(decide(&policy, "WebFetch", &json!({ "url": "https://example.org" }), &place()), None);
929 assert!(decide(&policy, "WebSearch", &json!({ "query": "x" }), &place()).is_some());
930 }
931
932 #[test]
933 fn commands_split_where_the_shell_does() {
934 assert_eq!(segments("a && b || c; d | e & f"), vec!["a", "b", "c", "d", "e", "f"]);
935 assert_eq!(segments("echo 'a; b' && c"), vec!["echo 'a; b'", "c"]);
936 assert_eq!(segments("x $(sudo y) `z`"), vec!["x", "sudo y", "z"]);
937 assert_eq!(words("FOO=1 nohup \"git\" push"), vec!["git", "push"]);
938 }
939
940 #[test]
941 fn globs_respect_directories() {
942 assert!(glob("/etc/**", "/etc/a/b"));
943 assert!(glob("/work/repo/**/*.pem", "/work/repo/a/b/key.pem"));
944 assert!(glob("/work/repo/**/*.pem", "/work/repo/key.pem"));
945 assert!(!glob("/work/repo/*.pem", "/work/repo/a/key.pem"));
946 assert!(glob("/work/repo/?.rs", "/work/repo/a.rs"));
947 }
948
949 #[test]
950 fn harness_settings_carry_the_hook_and_the_rules() {
951 let mut policy = all_on();
952 policy.deny = vec!["Bash(kubectl:*)".into()];
953 policy.restrict_network = true;
954 let settings = harness_settings(&policy);
955 let deny: Vec<&str> = settings["permissions"]["deny"]
956 .as_array()
957 .unwrap()
958 .iter()
959 .filter_map(Value::as_str)
960 .collect();
961 assert!(deny.contains(&"Bash(git push --force:*)"));
962 assert!(deny.contains(&"Bash(sudo:*)"));
963 assert!(deny.contains(&"Bash(kubectl:*)"));
964 assert_eq!(
965 settings["hooks"]["PreToolUse"][0]["hooks"][0]["command"],
966 "MODE=guard /usr/local/bin/g1t-runner"
967 );
968 assert_eq!(settings["env"]["CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC"], "1");
969
970 let open = harness_settings(&Policy::default());
971 assert_eq!(open["permissions"]["deny"].as_array().unwrap().len(), 0);
972 assert!(open.get("env").is_none());
973 // The hook runs whatever the rules, for the workspace's own patterns.
974 assert!(open["hooks"]["PreToolUse"].is_array());
975 }
976
977 #[test]
978 fn the_policy_reads_as_the_runner_sends_it() {
979 let policy: Policy = serde_json::from_str(
980 r#"{"rules":{"sudo":true,"print_env":false},"deny":["Bash(x:*)"],"budgetUsd":5,"minutes":90,"restrictNetwork":true,"defaultBranch":null}"#,
981 )
982 .unwrap();
983 assert!(policy.on("sudo"));
984 assert!(!policy.on("print_env"));
985 assert_eq!(policy.budget_usd, Some(5.0));
986 assert_eq!(policy.minutes, Some(90));
987 assert!(policy.restrict_network);
988 }
989
990 #[test]
991 fn only_the_repositorys_own_checkout_is_trusted() {
992 let repo = Some("acme/site");
993 // The default branch or a branch of the repository itself.
994 assert!(checkout_trusted(Some("https://g1t.sh/acme/site.git"), None, repo));
995 assert!(checkout_trusted(
996 Some("https://g1t.sh/Acme/Site"),
997 Some("https://g1t.sh/acme/site.git"),
998 None
999 ));
1000 // A fork's head, whoever's fork it is, g1t-agent's included.
1001 assert!(!checkout_trusted(Some("https://g1t.sh/g1t-agent/site-12.git"), None, repo));
1002 assert!(!checkout_trusted(
1003 Some("https://g1t.sh/someone/site.git"),
1004 Some("https://g1t.sh/acme/site.git"),
1005 repo
1006 ));
1007 // Not knowing is not trusting.
1008 assert!(!checkout_trusted(Some("https://g1t.sh/acme/site.git"), None, None));
1009 assert!(!checkout_trusted(None, None, repo));
1010 // A look-alike name is another repository.
1011 assert!(!checkout_trusted(Some("https://g1t.sh/acme/site-evil.git"), None, repo));
1012 }
1013
1014 #[test]
1015 fn untrusted_checkouts_load_nothing_of_their_own() {
1016 let flags = UNTRUSTED_FLAGS.join(" ");
1017 assert!(flags.contains("--setting-sources user"));
1018 assert!(!flags.contains("project") && !flags.contains("local"));
1019 assert!(flags.contains("--strict-mcp-config"));
1020 assert!(flags.contains("--disable-slash-commands"));
1021 assert_eq!(UNTRUSTED_ENV, ("CLAUDE_CODE_DISABLE_CLAUDE_MDS", "1"));
1022 }
1023
1024 #[test]
1025 fn halts_are_told_apart_from_failures() {
1026 assert!(is_halt(&anyhow::Error::new(Halted::Budget)));
1027 assert!(!is_halt(&anyhow::anyhow!("the agent reported an error")));
1028 assert_eq!(Halted::Time.reason(), "time");
1029 }
1030}