YAML Policy Engine with Glob-Based Guardrails

Declarative file-access, process, and port rules with glob matching plus runtime limits (max file size, max processes, max turns, timeout), enforced at container level and hot-appliable without a restart. The policy schema is portable to any Cobalt agent runtime, browser or not.

// Source: https://github.com/open-gitagent/clawless | License: MIT | Copyright 2025 Shreyas Kapale / Lyzr
// Provided via justclaw.it.com; keep this notice with the code.
// ─── Generic WebContainer Policy / Guardrail Engine ─────────────────────────

export type PolicyAction =
  | 'file.read'
  | 'file.write'
  | 'process.spawn'
  | 'server.bind'
  | 'env.configure'
  | 'tool.use'
  | 'git.clone'
  | 'git.push';

export interface FileRule {
  pattern: string;
  allow: boolean;
}

export interface ProcessRule {
  pattern: string;
  allow: boolean;
}

export interface PortRule {
  port: number | '*';
  allow: boolean;
}

export interface ToolRule {
  name: string;
  allow: boolean;
}

export interface RuntimeLimits {
  maxFileSize: number;
  maxProcesses: number;
  maxTurns: number;
  time

... (truncated -- full source via MCP)