49 lines
1.9 KiB
Go
49 lines
1.9 KiB
Go
package agentguard
|
|
|
|
// Notification is an actionable, non-sensitive operator message emitted when
|
|
// admission blocks a provider invocation.
|
|
type Notification struct {
|
|
Code BlockerCode
|
|
ProjectID string
|
|
ProviderID string
|
|
ProfileID string
|
|
Message string
|
|
SetupGuidance string
|
|
}
|
|
|
|
func notificationFor(blocker *Blocker) *Notification {
|
|
if blocker == nil {
|
|
return nil
|
|
}
|
|
guidance := "Revalidate the project registration and retry the blocked task."
|
|
switch blocker.Code {
|
|
case BlockerCodeMissingWorkspaceGrant:
|
|
guidance = "Register this project workspace and create a new canonical workspace grant."
|
|
case BlockerCodeWorkspaceNotCanonical,
|
|
BlockerCodeWorkspaceRootEscape,
|
|
BlockerCodeWorkspaceIdentityMismatch:
|
|
guidance = "Re-register the canonical workspace and recreate the task isolation view."
|
|
case BlockerCodeVCSMetadataNotAllowed:
|
|
guidance = "Add the exact worktree Git metadata roots to the workspace grant or use an isolated full clone."
|
|
case BlockerCodeIsolationRequired,
|
|
BlockerCodeWritableRootEscape,
|
|
BlockerCodeWritableConfinementUnavailable:
|
|
guidance = "Create a fresh task isolation whose writable roots are confined to the task view."
|
|
case BlockerCodeProviderUnattendedUnavailable:
|
|
guidance = "Choose a provider profile that declares unattended execution."
|
|
case BlockerCodeProviderApprovalBypassUnavailable:
|
|
guidance = "Enable the provider's supported approval-bypass mode or choose another eligible profile."
|
|
case BlockerCodeRevisionMismatch,
|
|
BlockerCodePermitInvalid,
|
|
BlockerCodePermitStale:
|
|
guidance = "Run admission again with the current grant, isolation, and provider profile revisions."
|
|
}
|
|
return &Notification{
|
|
Code: blocker.Code,
|
|
ProjectID: blocker.ProjectID,
|
|
ProviderID: blocker.ProviderID,
|
|
ProfileID: blocker.ProfileID,
|
|
Message: blocker.Message,
|
|
SetupGuidance: guidance,
|
|
}
|
|
}
|