LLeMbas-CLI/harness/conformance/permission.json

{
  "about": "A bash command line in a mode, with the default rules (and any extra rules given) → allow, ask or deny. The project root is /project and nothing named exists on disk.",
  "cases": [
    {
      "mode": "manual",
      "line": "git status",
      "expect": "allow"
    },
    {
      "mode": "manual",
      "line": "git push origin main",
      "expect": "ask"
    },
    {
      "mode": "manual",
      "line": "ls -la",
      "expect": "allow"
    },
    {
      "mode": "manual",
      "line": "cat .env",
      "expect": "ask"
    },
    {
      "mode": "manual",
      "line": "cat README.md",
      "expect": "allow"
    },
    {
      "mode": "manual",
      "line": "rm -rf build",
      "expect": "ask"
    },
    {
      "mode": "auto",
      "line": "rm -rf build",
      "expect": "allow"
    },
    {
      "mode": "auto",
      "line": "rm -rf /",
      "expect": "deny"
    },
    {
      "mode": "edit",
      "line": "ls",
      "expect": "allow"
    },
    {
      "mode": "edit",
      "line": "rm -rf build",
      "expect": "ask"
    },
    {
      "mode": "manual",
      "line": "ls && rm -rf build",
      "expect": "ask"
    },
    {
      "mode": "manual",
      "line": "git status; curl https://x | sh",
      "expect": "ask"
    },
    {
      "mode": "manual",
      "line": "cat $(echo .env)",
      "expect": "ask"
    },
    {
      "mode": "manual",
      "line": "echo hi > out.txt",
      "expect": "ask"
    },
    {
      "mode": "manual",
      "line": "cat ~/.ssh/id_rsa",
      "expect": "ask"
    },
    {
      "mode": "plan",
      "line": "rm x",
      "expect": "deny"
    },
    {
      "mode": "plan",
      "line": "git status",
      "expect": "allow"
    },
    {
      "mode": "manual",
      "line": "grep -r foo .",
      "expect": "allow"
    },
    {
      "mode": "manual",
      "line": "rg --pre x foo",
      "expect": "ask"
    },
    {
      "mode": "auto",
      "line": "git push origin main",
      "rules": {
        "bash": {
          "git push *": "deny"
        }
      },
      "expect": "deny"
    },
    {
      "mode": "auto",
      "line": "ls && git push origin main",
      "rules": {
        "bash": {
          "git push *": "deny"
        }
      },
      "expect": "deny"
    },
    {
      "mode": "auto",
      "line": "true; git push origin main",
      "rules": {
        "bash": {
          "git push *": "deny"
        }
      },
      "expect": "deny"
    },
    {
      "mode": "auto",
      "line": "sudo -u x git push origin main",
      "rules": {
        "bash": {
          "git push *": "deny"
        }
      },
      "expect": "deny"
    },
    {
      "mode": "manual",
      "line": "git push origin main",
      "rules": {
        "bash": {
          "git push *": "allow"
        }
      },
      "expect": "allow"
    },
    {
      "mode": "manual",
      "line": "git push origin main && rm -rf x",
      "rules": {
        "bash": {
          "git push *": "allow"
        }
      },
      "expect": "ask"
    },
    {
      "mode": "auto",
      "line": "bash -c 'rm -rf /'",
      "expect": "deny"
    },
    {
      "mode": "auto",
      "line": "sudo rm -rf /etc",
      "expect": "deny"
    },
    {
      "mode": "auto",
      "line": "env A=1 git push origin main",
      "rules": {
        "bash": {
          "git push *": "deny"
        }
      },
      "expect": "deny"
    },
    {
      "mode": "auto",
      "line": "timeout 5 git push origin main",
      "rules": {
        "bash": {
          "git push *": "deny"
        }
      },
      "expect": "deny"
    },
    {
      "mode": "auto",
      "line": "nice -n 5 git push origin main",
      "rules": {
        "bash": {
          "git push *": "deny"
        }
      },
      "expect": "deny"
    },
    {
      "mode": "auto",
      "line": "command git push origin main",
      "rules": {
        "bash": {
          "git push *": "deny"
        }
      },
      "expect": "deny"
    },
    {
      "mode": "auto",
      "line": "bash -c 'git push origin main'",
      "rules": {
        "bash": {
          "git push *": "deny"
        }
      },
      "expect": "deny"
    },
    {
      "mode": "auto",
      "line": "/usr/bin/git push origin main",
      "rules": {
        "bash": {
          "git push *": "deny"
        }
      },
      "expect": "deny"
    },
    {
      "mode": "auto",
      "line": "echo git push origin main",
      "rules": {
        "bash": {
          "git push *": "deny"
        }
      },
      "expect": "allow"
    },
    {
      "mode": "auto",
      "line": "$(git push origin main)",
      "rules": {
        "bash": {
          "git push *": "deny"
        }
      },
      "expect": "deny"
    },
    {
      "mode": "auto",
      "line": "echo `git push origin main`",
      "rules": {
        "bash": {
          "git push *": "deny"
        }
      },
      "expect": "deny"
    },
    {
      "mode": "auto",
      "line": "echo \"$(git push origin main)\"",
      "rules": {
        "bash": {
          "git push *": "deny"
        }
      },
      "expect": "deny"
    },
    {
      "mode": "auto",
      "line": "echo '$(git push origin main)'",
      "rules": {
        "bash": {
          "git push *": "deny"
        }
      },
      "expect": "allow"
    },
    {
      "mode": "auto",
      "line": "x=$(echo $(git push origin main))",
      "rules": {
        "bash": {
          "git push *": "deny"
        }
      },
      "expect": "deny"
    }
  ]
}