feat(safety): gate sensitive tools behind elevation and immutable denylist

2026-02-17 23:51:04 -08:00
parent 9345a864f4
commit 540f6780e6
10 changed files with 279 additions and 3 deletions
@@ -293,6 +293,12 @@ export class SessionBridge {
          agent: primaryTier,
          provider: config?.models.default.provider,
          autonomyLevel: config?.agents.autonomy_level ?? 'standard',
+          sensitiveMode: config?.agents.sensitive_mode ?? 'deny_without_elevation',
+          immutableDenylist: (config?.agents.immutable_denylist ?? []).map((rule) => ({
+            tool: rule.tool,
+            argsPattern: rule.args_pattern,
+            reason: rule.reason,
+          })),
        },
      });