Still some rough edges, and definitely not security audited. :)
In essence: All commands are routed through ozm, which has a per project and global allow list and block list.
Otherwise asks the user and does its best remembering what the user allowed to execute including debug/one off scripts that the agents write. If a previously allowed files was changed, it shows a diff of what changed since the last execution.
https://github.com/kamyar/ozm - Oberzugriffsmeister (“chief access master”)
Still some rough edges, and definitely not security audited. :)
In essence: All commands are routed through ozm, which has a per project and global allow list and block list.
Otherwise asks the user and does its best remembering what the user allowed to execute including debug/one off scripts that the agents write. If a previously allowed files was changed, it shows a diff of what changed since the last execution.