feat(agent): add constrained allowed action surface for Agent

[ranjan42]

This PR restricts the Agent runtime in go-dav-os to operate through a constrained action surface (allowlist) and ensures safety validations are enforced securely, implementing the requirements for Issue #158 (parent: #150).

Key Changes

1. Fixed Allowlist Enforcement:

   • Modified ActionKind.Valid() in agent/types.go to act as the fixed allowlist.
   • Allowed safe actions: ActionListFiles, ActionReadFile, ActionStatFile, ActionShowHelp, ActionShowHistory, ActionShowVersion, ActionShowTicks, ActionShowMemoryMap, ActionSetMode.
   • Allowed risky actions: ActionDeleteFile, ActionWriteFile.

2. Explicit Risk Level Validation:

   • Added ExpectedRisk() to ActionKind to map each allowed action to its expected risk (RiskRisky for ActionDeleteFile and ActionWriteFile, and RiskSafe for others).
   • Enforced in validatePlan inside agent/runtime.go that action.Risk must match action.Kind.ExpectedRisk(). This prevents planners (including LLM-backed ones) from bypassing the confirmation safety gate by marking a risky action like delete or write as safe.

3. Fail-Closed Executor:

   • Enforced safety checks inside executor.go and runtime.go to ensure only allowlisted actions are executed.

4. Testing and Verification:

   • Updated unit tests in agent/agent_test.go to adapt to the allowlist.
   • Added new validation tests verifying risk mismatch rejection (TestValidatorRejectsRiskyActionMarkedAsSafe) and allowlist enforcement (TestValidatorAcceptsWriteFileAction).
   • Verified that all unit tests in the project (make test) compile and pass successfully.

[ranjan42]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[dmarro89]

Hi @ranjan42 thanks for contributing!
I think that the task scope is a bit changed. The PR is deleting the Write operation but actually it was implemented also if in the task I didn't updated the list - so I think that the Write should not be removed

[ranjan42]

Hi @ranjan42 thanks for contributing! I think that the task scope is a bit changed. The PR is deleting the Write operation but actually it was implemented also if in the task I didn't updated the list - so I think that the Write should not be removed

Hi @dmarro89 updated the PR

[ranjan42]

@codex help to review again - the new commit

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f7ca1f9de7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".