Command-Aware Permissions

from praisonaiagents import Agent
from praisonaiagents.approval.protocols import ApprovalConfig

agent = Agent(
    name="Safe Worker",
    instructions="Run shell commands safely",
    approval=ApprovalConfig(permissions={
        "bash:rm *": "deny",
        "write:/etc/*": "deny",
        "*": "allow",
    }),
)

# All of these are now blocked, even though previously only the first was:
#   cd /tmp && rm -rf x
#   ls; rm -rf x
#   echo $(rm -rf x)
#   cat foo > /etc/hosts
agent.start("Tidy up /tmp")

from praisonaiagents import Agent
from praisonaiagents.approval.protocols import ApprovalConfig

agent = Agent(
    name="Safe Windows Worker",
    instructions="Run shell commands safely on Windows",
    approval=ApprovalConfig(permissions={
        "bash:Remove-Item *": "deny",
        "bash:*": "allow",
    }),
)

# All of these are blocked by the single Remove-Item deny above:
#   powershell -Command "Remove-Item C:\tmp\x"
#   pwsh -c "Remove-Item .\out.txt"
#   powershell -NoProfile -Command "Remove-Item .\x"
#   powershell -Command "& { Remove-Item .\x }"
#   powershell -EncodedCommand <base64-of-'Remove-Item .\x'>
agent.start("Clean up temp files")

from praisonaiagents import Agent
from praisonaiagents.approval.protocols import ApprovalConfig

agent = Agent(
    name="Windows Worker",
    instructions="Only write inside the workspace",
    approval=ApprovalConfig(permissions={"bash:*": "allow"}),
)

# Inside workspace → allowed
#   powershell -Command "Set-Content .\note.txt hi"
#
# Outside workspace → prompts (external_dir:* boundary fires)
#   powershell -Command "Remove-Item C:\Users\Public\secret.txt"
#   powershell -NoProfile -Command "Remove-Item C:\outside\x"
#   powershell -EncodedCommand <base64-of-'Remove-Item C:\outside\x'>
agent.start("Save today's notes")

from praisonaiagents import Agent
from praisonaiagents.approval.protocols import ApprovalConfig

agent = Agent(
    name="Safe Worker",
    instructions="Run shell commands safely",
    approval=ApprovalConfig(permissions={
        "bash:rm *": "deny",
        "bash:*": "allow",
    }),
)

# The single bash:rm * deny now catches every wrapper-prefixed form:
#   sudo rm -rf x
#   sudo -u root rm -rf x
#   env FOO=1 rm -rf x
#   /bin/rm -rf x
#   nice -n 5 rm -rf x
#   timeout 5s rm -rf x
#   xargs rm x
#   bash -c 'rm -rf x'
agent.start("Clean up temp files")

from praisonaiagents import Agent
from praisonaiagents.approval.protocols import ApprovalConfig

agent = Agent(
    name="Safe Worker",
    instructions="Run shell commands safely",
    approval=ApprovalConfig(permissions={
        "bash:rm *": "deny",
        "bash:*": "allow",
    }),
)

# All of these now trigger ASK (or hit the explicit deny), not silent allow:
#   rm${IFS}-rf${IFS}/tmp/data      → ASK
#   rm -rf ${TARGET}                → ASK
#   rm -rf $HOME/downloads          → ASK
#   rm -rf /tmp/foo                 → DENY (matches bash:rm *)
agent.start("Clean up temp files")

from praisonaiagents import Agent
from praisonaiagents.approval.protocols import ApprovalConfig

agent = Agent(
    name="Safe Worker",
    instructions="Run shell commands safely",
    approval=ApprovalConfig(permissions={
        "bash:rm *": "deny",
        "bash:*": "allow",
    }),
)

# Unbalanced quote → ASK (explicit deny still wins if one matches):
#   echo 'x; rm -rf x      → ASK
agent.start("Print a status line")

from praisonaiagents import Agent
from praisonaiagents.permissions import PermissionManager

# Rule engine has always understood argument-scoped patterns —
# since PR #4234 the enforcement path does too.
manager = PermissionManager(storage_dir=".praisonai/permissions")
manager.load_rules_from_config({"bash:rm *": "deny"})

agent = Agent(name="Safe Worker", instructions="Run shell commands safely")
agent._permission_manager = manager

# Blocked — argument-scoped rule fires at the deny gate
agent._check_tool_approval_sync("execute_command", {"command": "rm -rf /tmp/x"})
# → {"permission_denied": True, "error": "Tool 'execute_command' blocked by permission policy"}

# Allowed — same tool, different args
agent._check_tool_approval_sync("execute_command", {"command": "ls -la"})
# → None (no denial)

from praisonaiagents.approval.protocols import ApprovalDecision

# Approval backend rewrites args from safe to dangerous — re-authorised
decision = ApprovalDecision(
    approved=True,
    reason="mock",
    modified_args={"command": "rm -rf /tmp/x"},  # was originally "ls -la"
)
# The gate re-runs on modified_args before dispatch — the rewritten
# 'rm -rf' matches "bash:rm *" deny and the call is blocked.

from praisonaiagents.permissions import PermissionManager, PermissionRule, PermissionAction

manager = PermissionManager()

manager.add_rule(PermissionRule(pattern="bash:*", action=PermissionAction.ALLOW))
manager.add_rule(PermissionRule(pattern="bash:cat *", action=PermissionAction.ASK))

result = manager.check("bash:ls && cat foo")
print(result.action)  # ASK — because cat triggered ask, and ask beats allow

approval=ApprovalConfig(permissions={
    "bash:rm *": "deny",
    "bash:mv *": "deny",
    "bash:dd *": "deny",
    "*": "allow",
})

approval=ApprovalConfig(permissions={
    "write:/etc/*": "deny",
    "*": "allow",
})

praisonai run "Deploy check" \
  --permission-default deny \
  --allow 'bash:git *'