cayu.tools.command_policy
Public Cayu API. Definitions are grouped by their public source module, and definitions from private implementation modules appear on their package’s page; adding a symbol does not move existing links. The import shown at each entry is a supported public namespace. Read the Python API overview and install the required extra.
ProcessCommandPolicy
Section titled “ProcessCommandPolicy”from cayu.tools import ProcessCommandPolicyDeny-by-default policy for model-controlled command execution.
Executable identities are matched exactly. Working-directory roots are
compared against the runner-resolved canonical_cwd supplied by
ExecCommandTool.
public_executable_names and public_environment_names explicitly attest
names safe for tool discovery and durable diagnostics; they grant no authority.
Unlisted names and all cwd paths and input values remain withheld.
diagnostic_profile_id is an optional public application label, not an
execution-profile fingerprint. Never put private values in publication fields.
Bases: CommandPolicy.
process_capabilities (property)
Section titled “process_capabilities (property)”ProcessCommandPolicy.process_capabilities() -> ProcessCommandCapabilitiesallowed_environment_names (property)
Section titled “allowed_environment_names (property)”ProcessCommandPolicy.allowed_environment_names() -> tuple[str, ...]Discover allowed override names without exposing any configured values.
execution_profile_identity (property)
Section titled “execution_profile_identity (property)”ProcessCommandPolicy.execution_profile_identity() -> ExecutionProfileBehaviorIdentity | NoneReturn a stable application declaration, or None when non-portable.
evaluate (method)
Section titled “evaluate (method)”async ProcessCommandPolicy.evaluate(ctx: ToolContext, request: CommandRequest) -> CommandPolicyResultinit (method)
Section titled “init (method)”ProcessCommandPolicy.__init__(*, allowed_executables: Iterable[str]=(), public_executable_names: Iterable[str]=(), public_environment_names: Iterable[str]=(), diagnostic_profile_id: str | None=None, approval_required_executables: Iterable[str]=(), allowed_cwds: Iterable[str]=(), allowed_env_names: Iterable[str]=(), allowed_env_values: Mapping[str, str] | None=None, max_env_value_bytes: int=DEFAULT_MAX_ENV_VALUE_BYTES, allow_stdin: bool=False, max_stdin_bytes: int=DEFAULT_MAX_STDIN_BYTES, max_timeout_s: int=MAX_TIMEOUT_SECONDS, shell_decision: CommandPolicyDecision=CommandPolicyDecision.DENY) -> None