feat(safety): gate sensitive tools behind elevation and immutable denylist

2026-02-17 23:51:04 -08:00
parent 9345a864f4
commit 540f6780e6
10 changed files with 279 additions and 3 deletions
@@ -273,6 +273,12 @@ export function createMessageRouter(deps: {
        sender: senderId,
        tier: effectiveTier,
        autonomyLevel: deps.config.agents.autonomy_level ?? 'standard',
+        sensitiveMode: deps.config.agents.sensitive_mode,
+        immutableDenylist: deps.config.agents.immutable_denylist.map((rule) => ({
+          tool: rule.tool,
+          argsPattern: rule.args_pattern,
+          reason: rule.reason,
+        })),
        skillName: activeSkillName,
        skillPermissions: activeSkill?.manifest.permissions,
        allowedSecretScopes: activeSkill?.manifest.permissions?.secrets,