Class: SwarmSDK::Permissions::ErrorFormatter

Inherits:
Object
  • Object
show all
Defined in:
lib/swarm_sdk/permissions/error_formatter.rb

Overview

ErrorFormatter generates user-friendly error messages for permission violations

Class Method Summary collapse

Class Method Details

.command_permission_denied(command:, allowed_patterns:, denied_patterns: [], matching_pattern: nil, tool_name:) ⇒ String

Generate a command permission denied error message

Parameters:

  • command (String) —

    The command that was denied

  • allowed_patterns (Array<Regexp>) —

    List of allowed command regex patterns

  • denied_patterns (Array<Regexp>) (defaults to: []) —

    List of denied command regex patterns

  • matching_pattern (String, nil) (defaults to: nil) —

    The specific pattern that blocked this command

  • tool_name (String) —

    Name of the tool (typically "bash")

Returns:

  • (String) —

    Formatted error message with system reminder



76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
 
# File 'lib/swarm_sdk/permissions/error_formatter.rb', line 76

def command_permission_denied(command:, allowed_patterns:, denied_patterns: [], matching_pattern: nil, tool_name:)
  # Build policy explanation
  policy_info = if matching_pattern && matching_pattern != "(not in allowed list)"
    # Show the specific denied pattern that blocked this command
    "Blocked by policy: #{matching_pattern}"
  elsif matching_pattern == "(not in allowed list)" && allowed_patterns.any?
    # Show allowed patterns when command doesn't match any
    patterns = allowed_patterns.map { |p| "  - #{p.source}" }.join("\n")
    "Command not in allowed list. Allowed command patterns:\n#{patterns}"
  elsif denied_patterns.any?
    # Show denied patterns
    patterns = denied_patterns.map { |p| "  - #{p.source}" }.join("\n")
    "Denied command patterns:\n#{patterns}"
  elsif allowed_patterns.any?
    # Show allowed patterns
    patterns = allowed_patterns.map { |p| "  - #{p.source}" }.join("\n")
    "Allowed command patterns (not matched):\n#{patterns}"
  else
    "No command policy configured"
  end

  reminder = "\n    <system-reminder>\n    PERMISSION DENIED: You do not have permission to execute command '\#{command}'.\n\n    \#{policy_info}\n\n    This is an UNRECOVERABLE error set by user policy. You MUST stop trying to execute commands matching this pattern.\n\n    Policy explanation:\n    - This policy blocks ALL commands matching the pattern, not just this specific command\n    - Do not attempt to execute other commands matching this pattern - they will also be denied\n    - Do not try to work around this restriction by modifying the command slightly\n    - The user has explicitly denied access to these commands via security policy\n\n    You should inform the user that you cannot proceed due to permission restrictions on this command.\n    </system-reminder>\n  REMINDER\n\n  \"Permission denied: Cannot execute command '\#{command}'\#{reminder}\"\nend\n"

.permission_denied(path:, allowed_patterns:, denied_patterns: [], matching_pattern: nil, tool_name:) ⇒ String

Generate a permission denied error message

Parameters:

  • path (String) —

    The path that was denied

  • allowed_patterns (Array<String>) —

    List of allowed path patterns

  • denied_patterns (Array<String>) (defaults to: []) —

    List of denied path patterns

  • matching_pattern (String, nil) (defaults to: nil) —

    The specific pattern that blocked this path

  • tool_name (String) —

    Name of the tool that was denied

Returns:

  • (String) —

    Formatted error message with system reminder



16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
 
# File 'lib/swarm_sdk/permissions/error_formatter.rb', line 16

def permission_denied(path:, allowed_patterns:, denied_patterns: [], matching_pattern: nil, tool_name:)
  operation_verb = case tool_name.to_s
  when "Read" then "read"
  when "Write" then "write to"
  when "Edit", "MultiEdit" then "edit"
  when "Glob" then "access directory"
  when "Grep" then "search in"
  else "access"
  end

  # Build policy explanation
  policy_info = if matching_pattern && matching_pattern != "(not in allowed list)"
    # Show the specific denied pattern that blocked this path
    "Blocked by policy: #{matching_pattern}"
  elsif matching_pattern == "(not in allowed list)" && allowed_patterns.any?
    # Show allowed patterns when path doesn't match any
    patterns = allowed_patterns.map { |p| "  - #{p}" }.join("\n")
    "Path not in allowed list. Allowed paths:\n#{patterns}"
  elsif denied_patterns.any?
    # Show denied patterns
    patterns = denied_patterns.map { |p| "  - #{p}" }.join("\n")
    "Denied paths:\n#{patterns}"
  elsif allowed_patterns.any?
    # Show allowed patterns
    patterns = allowed_patterns.map { |p| "  - #{p}" }.join("\n")
    "Allowed paths (not matched):\n#{patterns}"
  else
    "No access policy configured"
  end

  reminder = "\n    <system-reminder>\n    PERMISSION DENIED: You do not have permission to \#{operation_verb} '\#{path}'.\n\n    \#{policy_info}\n\n    This is an UNRECOVERABLE error set by user policy. You MUST stop trying to access files matching this pattern.\n\n    Policy explanation:\n    - This policy blocks ALL files matching the pattern, not just this specific file\n    - Do not attempt to access other files matching this pattern - they will also be denied\n    - Do not try to work around this restriction by using different tool arguments\n    - The user has explicitly denied access to these resources via security policy\n\n    You should inform the user that you cannot proceed due to permission restrictions on this file pattern.\n    </system-reminder>\n  REMINDER\n\n  \"Permission denied: Cannot \#{operation_verb} '\#{path}'\#{reminder}\"\nend\n"