NCBM/plyngent
1
0
Fork 0
mirror of https://github.com/NCBM/plyngent.git synced 2026-07-23 05:55:16 +08:00
Code Issues Packages Projects Releases Wiki Activity

core/tools: classify destructive tools and clarify policy denies

Browse Source 
Add classify_danger for delete/move/overwrite paths, get_path_denylist,
and clearer path/command denial messages.
This commit is contained in:
worldmozara
2026-07-14 23:30:02 +08:00
parent 81a30d0e4d
commit 510dd67a54
5 changed files with 88 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_tools/test_workspace.py
+2 -2
View File
@@ -36,14 +36,14 @@ def test_path_denylist(workspace: object) -> None:
secrets.mkdir()
_ = (secrets / "key").write_text("k", encoding="utf-8")
set_path_denylist(["/secrets/"])
with pytest.raises(WorkspaceError, match="denied"):
with pytest.raises(WorkspaceError, match="matched '/secrets/'"):
_ = resolve_path("secrets/key")
set_path_denylist(None)
def test_command_denylist(workspace: object) -> None:
del workspace
with pytest.raises(WorkspaceError, match="denied"):
with pytest.raises(WorkspaceError, match="basename 'rm' is blocked"):
check_command_allowed(["rm", "-rf", "/"])
check_command_allowed(["echo", "ok"])
set_command_denylist(None)