@praxis.guard/auditor-cli 0.0.35 → 0.0.36
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/policies.v1.json
CHANGED
|
@@ -526,6 +526,146 @@
|
|
|
526
526
|
"rm": "DESTRUCTIVE"
|
|
527
527
|
}
|
|
528
528
|
},
|
|
529
|
+
"kubectl": {
|
|
530
|
+
"__root__": {
|
|
531
|
+
"annotate": "MUTATE",
|
|
532
|
+
"api-resources": "READ",
|
|
533
|
+
"api-versions": "READ",
|
|
534
|
+
"attach": "MUTATE",
|
|
535
|
+
"autoscale": "MUTATE",
|
|
536
|
+
"completion": "READ",
|
|
537
|
+
"cordon": "MUTATE",
|
|
538
|
+
"cp": "MUTATE",
|
|
539
|
+
"debug": "MUTATE",
|
|
540
|
+
"delete": "DESTRUCTIVE",
|
|
541
|
+
"describe": "READ",
|
|
542
|
+
"diff": "READ",
|
|
543
|
+
"drain": "DESTRUCTIVE",
|
|
544
|
+
"edit": "MUTATE",
|
|
545
|
+
"events": "READ",
|
|
546
|
+
"exec": "MUTATE",
|
|
547
|
+
"explain": "READ",
|
|
548
|
+
"expose": "MUTATE",
|
|
549
|
+
"get": "READ",
|
|
550
|
+
"help": "READ",
|
|
551
|
+
"kustomize": "READ",
|
|
552
|
+
"label": "MUTATE",
|
|
553
|
+
"logs": "READ",
|
|
554
|
+
"patch": "MUTATE",
|
|
555
|
+
"port-forward": "MUTATE",
|
|
556
|
+
"proxy": "MUTATE",
|
|
557
|
+
"replace": "MUTATE",
|
|
558
|
+
"run": "MUTATE",
|
|
559
|
+
"scale": "MUTATE",
|
|
560
|
+
"taint": "MUTATE",
|
|
561
|
+
"uncordon": "MUTATE",
|
|
562
|
+
"version": "READ",
|
|
563
|
+
"wait": "READ",
|
|
564
|
+
"__default__": "MUTATE"
|
|
565
|
+
},
|
|
566
|
+
"apply": {
|
|
567
|
+
"edit-last-applied": "MUTATE",
|
|
568
|
+
"set-last-applied": "MUTATE",
|
|
569
|
+
"view-last-applied": "READ",
|
|
570
|
+
"__default__": "MUTATE",
|
|
571
|
+
"*": "MUTATE"
|
|
572
|
+
},
|
|
573
|
+
"auth": {
|
|
574
|
+
"can-i": "READ",
|
|
575
|
+
"reconcile": "MUTATE",
|
|
576
|
+
"whoami": "READ",
|
|
577
|
+
"__default__": "MUTATE",
|
|
578
|
+
"*": "MUTATE"
|
|
579
|
+
},
|
|
580
|
+
"certificate": {
|
|
581
|
+
"approve": "MUTATE",
|
|
582
|
+
"deny": "MUTATE",
|
|
583
|
+
"__default__": "MUTATE",
|
|
584
|
+
"*": "MUTATE"
|
|
585
|
+
},
|
|
586
|
+
"cluster-info": {
|
|
587
|
+
"dump": "READ",
|
|
588
|
+
"__default__": "READ",
|
|
589
|
+
"*": "READ"
|
|
590
|
+
},
|
|
591
|
+
"config": {
|
|
592
|
+
"current-context": "READ",
|
|
593
|
+
"delete-cluster": "DESTRUCTIVE",
|
|
594
|
+
"delete-context": "DESTRUCTIVE",
|
|
595
|
+
"delete-user": "DESTRUCTIVE",
|
|
596
|
+
"get-clusters": "READ",
|
|
597
|
+
"get-contexts": "READ",
|
|
598
|
+
"get-users": "READ",
|
|
599
|
+
"rename-context": "MUTATE",
|
|
600
|
+
"set": "MUTATE",
|
|
601
|
+
"set-cluster": "MUTATE",
|
|
602
|
+
"set-context": "MUTATE",
|
|
603
|
+
"set-credentials": "MUTATE",
|
|
604
|
+
"unset": "MUTATE",
|
|
605
|
+
"use-context": "MUTATE",
|
|
606
|
+
"view": "READ",
|
|
607
|
+
"__default__": "MUTATE",
|
|
608
|
+
"*": "MUTATE"
|
|
609
|
+
},
|
|
610
|
+
"create": {
|
|
611
|
+
"clusterrole": "MUTATE",
|
|
612
|
+
"clusterrolebinding": "MUTATE",
|
|
613
|
+
"configmap": "MUTATE",
|
|
614
|
+
"cronjob": "MUTATE",
|
|
615
|
+
"deployment": "MUTATE",
|
|
616
|
+
"ingress": "MUTATE",
|
|
617
|
+
"job": "MUTATE",
|
|
618
|
+
"namespace": "MUTATE",
|
|
619
|
+
"poddisruptionbudget": "MUTATE",
|
|
620
|
+
"priorityclass": "MUTATE",
|
|
621
|
+
"quota": "MUTATE",
|
|
622
|
+
"role": "MUTATE",
|
|
623
|
+
"rolebinding": "MUTATE",
|
|
624
|
+
"secret": "MUTATE",
|
|
625
|
+
"service": "MUTATE",
|
|
626
|
+
"serviceaccount": "MUTATE",
|
|
627
|
+
"token": "MUTATE",
|
|
628
|
+
"__default__": "MUTATE",
|
|
629
|
+
"*": "MUTATE"
|
|
630
|
+
},
|
|
631
|
+
"kuberc": {
|
|
632
|
+
"set": "MUTATE",
|
|
633
|
+
"view": "READ",
|
|
634
|
+
"__default__": "MUTATE",
|
|
635
|
+
"*": "MUTATE"
|
|
636
|
+
},
|
|
637
|
+
"plugin": {
|
|
638
|
+
"list": "READ",
|
|
639
|
+
"__default__": "MUTATE",
|
|
640
|
+
"*": "MUTATE"
|
|
641
|
+
},
|
|
642
|
+
"rollout": {
|
|
643
|
+
"history": "READ",
|
|
644
|
+
"pause": "MUTATE",
|
|
645
|
+
"restart": "MUTATE",
|
|
646
|
+
"resume": "MUTATE",
|
|
647
|
+
"status": "READ",
|
|
648
|
+
"undo": "MUTATE",
|
|
649
|
+
"__default__": "MUTATE",
|
|
650
|
+
"*": "MUTATE"
|
|
651
|
+
},
|
|
652
|
+
"set": {
|
|
653
|
+
"env": "MUTATE",
|
|
654
|
+
"image": "MUTATE",
|
|
655
|
+
"resources": "MUTATE",
|
|
656
|
+
"selector": "MUTATE",
|
|
657
|
+
"serviceaccount": "MUTATE",
|
|
658
|
+
"subject": "MUTATE",
|
|
659
|
+
"__default__": "MUTATE",
|
|
660
|
+
"*": "MUTATE"
|
|
661
|
+
},
|
|
662
|
+
"top": {
|
|
663
|
+
"node": "READ",
|
|
664
|
+
"pod": "READ",
|
|
665
|
+
"__default__": "READ",
|
|
666
|
+
"*": "READ"
|
|
667
|
+
}
|
|
668
|
+
},
|
|
529
669
|
"mcp": {
|
|
530
670
|
"user-salai-MCP": {
|
|
531
671
|
"get_my_cart": "READ",
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"governed-tools.d.ts","sourceRoot":"","sources":["../../src/shell/governed-tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAIrD,8FAA8F;AAC9F,eAAO,MAAM,4BAA4B,EAAE,MAAM,
|
|
1
|
+
{"version":3,"file":"governed-tools.d.ts","sourceRoot":"","sources":["../../src/shell/governed-tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAIrD,8FAA8F;AAC9F,eAAO,MAAM,4BAA4B,EAAE,MAAM,EAMhD,CAAC;AAIF,QAAA,MAAM,qBAAqB,kCAAmC,CAAC;AAC/D,QAAA,MAAM,uBAAuB,2BAA4B,CAAC;AAE1D,MAAM,MAAM,iBAAiB,GAAG;IAC9B,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,CAAC;AAEF,wBAAgB,gBAAgB,IAAI,GAAG,CAAC,MAAM,CAAC,CAI9C;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,MAAM,EAAE,CAG5E;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,UAAU,GAAG,iBAAiB,CAM9E;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAOvG;AAWD;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,MAAM,EACf,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GACpC,OAAO,CAUT;AAED,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,CAAC"}
|
|
@@ -1,6 +1,12 @@
|
|
|
1
1
|
import { parseShellTokens } from "./parse-segments.js";
|
|
2
2
|
/** @deprecated Use `listShellGovernedTools(policy)` — policy keys are the source of truth. */
|
|
3
|
-
export const DEFAULT_GOVERNED_SHELL_TOOLS = [
|
|
3
|
+
export const DEFAULT_GOVERNED_SHELL_TOOLS = [
|
|
4
|
+
"gcloud",
|
|
5
|
+
"firebase",
|
|
6
|
+
"gh",
|
|
7
|
+
"git",
|
|
8
|
+
"kubectl",
|
|
9
|
+
];
|
|
4
10
|
const DEFAULT_POLICY_EXCLUDE = new Set(["mcp"]);
|
|
5
11
|
const DEFAULT_PRELUDE_VERBS = ["cd", "pushd", "popd"];
|
|
6
12
|
const DEFAULT_PRIVILEGE_VERBS = ["sudo", "doas"];
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"governed-tools.js","sourceRoot":"","sources":["../../src/shell/governed-tools.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,8FAA8F;AAC9F,MAAM,CAAC,MAAM,4BAA4B,GAAa,
|
|
1
|
+
{"version":3,"file":"governed-tools.js","sourceRoot":"","sources":["../../src/shell/governed-tools.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,8FAA8F;AAC9F,MAAM,CAAC,MAAM,4BAA4B,GAAa;IACpD,QAAQ;IACR,UAAU;IACV,IAAI;IACJ,KAAK;IACL,SAAS;CACV,CAAC;AAEF,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAEhD,MAAM,qBAAqB,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAC/D,MAAM,uBAAuB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAU,CAAC;AAO1D,MAAM,UAAU,gBAAgB;IAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAC;IAChE,IAAI,CAAC,OAAO;QAAE,OAAO,sBAAsB,CAAC;IAC5C,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAkB;IACvD,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAkB;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,OAAO;QACL,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,qBAAqB;QACzF,eAAe,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,uBAAuB;KAClG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAa,EAAE,aAAgC;IACtF,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAChE,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa,EAAE,WAAgC;IAC3E,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACpC,IAAI,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAe,EACf,iBAAqC;IAErC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,iBAAiB,IAAI,4BAA4B,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IAC/C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,oBAAoB,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,CAAC"}
|