mirror of
https://github.com/hanzoai/dev.git
synced 2026-10-25 03:32:32 +00:00
zeekay
dae0dcad42
🎯 Major directory restructure and publication preparation:
**Directory Rename:**
- Renamed code-rs/ → hanzo-dev/ for better branding alignment
- Updated all build scripts, GitHub workflows, and documentation
- Fixed all path references across the codebase
**Publication Setup:**
- Updated workspace version to 0.6.0 (production ready)
- Configured main CLI crate as 'hanzo-dev' (available on crates.io)
- Set publish = true for core crates (hanzo-core, hanzo-tui)
- Added proper package metadata (description, license, repository, etc.)
- Maintained internal crate names to minimize dependency changes
**Updated Components:**
- package.json build scripts now reference hanzo-dev/
- GitHub Actions workflows updated for new directory structure
- build-fast.sh and related scripts updated
- Documentation and README references updated
- All Cargo.toml manifests updated with publication metadata
**Publishing Strategy:**
- Main binary: hanzo-dev (new, available for publication)
- Core library: hanzo-core (existing name, ready to publish)
- TUI library: hanzo-tui (existing name, ready to publish)
- Avoids conflict with existing Hanzo AI infrastructure crates
This prepares the codebase for official publication to crates.io while
maintaining full compatibility with the existing build system and
providing clear branding as 'Hanzo Dev' CLI tool.
75 lines
2.9 KiB
Markdown
75 lines
2.9 KiB
Markdown
# Execution policy
|
||
|
||
Every Code can enforce your own rules-based execution policy before it runs shell commands. Policies live in Starlark `.codexpolicy` files under `~/.code/policy` (Code still reads `~/.codex/policy` for backward compatibility).
|
||
|
||
## How to create and edit rules
|
||
|
||
### TUI interactions
|
||
|
||
Codex CLI will present the option to whitelist commands when a command causes a prompt.
|
||
|
||
<img width="513" height="168" alt="Screenshot 2025-12-04 at 9 23 54 AM" src="https://github.com/user-attachments/assets/4c8ee8ea-3101-4a81-bb13-3f4a9aa02502" />
|
||
|
||
Whitelisted commands will no longer require your permission to run in current and subsequent sessions.
|
||
|
||
Under the hood, when you approve and whitelist a command, codex will edit `~/.codex/rules/default.rules`.
|
||
|
||
### Editing `.rules` files
|
||
|
||
1. Create a policy directory: `mkdir -p ~/.code/policy`.
|
||
2. Add one or more `.codexpolicy` files in that folder. Code automatically loads every `.codexpolicy` file in there on startup.
|
||
3. Write `prefix_rule` entries to describe the commands you want to allow, prompt, or block:
|
||
|
||
```starlark
|
||
prefix_rule(
|
||
pattern = ["git", ["push", "fetch"]],
|
||
decision = "prompt", # allow | prompt | forbidden
|
||
match = [["git", "push", "origin", "main"]], # examples that must match
|
||
not_match = [["git", "status"]], # examples that must not match
|
||
)
|
||
```
|
||
|
||
- `pattern` is a list of shell tokens, evaluated from left to right; wrap tokens in a nested list to express alternatives (for example, match both `push` and `fetch`).
|
||
- `decision` sets the severity; Code picks the strictest decision when multiple rules match (forbidden > prompt > allow).
|
||
- `match` and `not_match` act as optional unit tests. Code validates them when it loads your policy, so you get feedback if an example has unexpected behavior.
|
||
|
||
In this example rule, if Code wants to run commands with the prefix `git push` or `git fetch`, it will first ask for user approval.
|
||
|
||
## Preview decisions
|
||
|
||
Use the `code execpolicy check` subcommand to preview decisions before you save a rule (see the [`codex-execpolicy` README](../code-rs/execpolicy/README.md) for syntax details):
|
||
|
||
```shell
|
||
code execpolicy check --policy ~/.code/policy/default.codexpolicy git push origin main
|
||
```
|
||
|
||
Pass multiple `--policy` flags to test how several files combine, and use `--pretty` for formatted JSON output. See the [`code-rs/execpolicy` README](../code-rs/execpolicy/README.md) for a more detailed walkthrough of the available syntax.
|
||
|
||
Example output when a rule matches:
|
||
|
||
```json
|
||
{
|
||
"matchedRules": [
|
||
{
|
||
"prefixRuleMatch": {
|
||
"matchedPrefix": ["git", "push"],
|
||
"decision": "prompt"
|
||
}
|
||
}
|
||
],
|
||
"decision": "prompt"
|
||
}
|
||
```
|
||
|
||
When no rules match, `matchedRules` is an empty array and `decision` is omitted.
|
||
|
||
```json
|
||
{
|
||
"matchedRules": []
|
||
}
|
||
```
|
||
|
||
## Status
|
||
|
||
`execpolicy` commands are still in preview. The API may have breaking changes in the future.
|