gog-safety

gog Safety 性能分析s

Build and 部署 gog binaries with compile-time command removal. Commands that are disabled don't exist in the binary — no 运行time bypass possible.

Quick 启动

• Choose a safety level

Level Use case Can 发送 emAIl/chat? L1 EmAIl triage, drafting, inbox organization No L2 L1 + commenting, RSVP, collaborative work No L3 Full write 访问, no dangerous admin ops Yes

For full detAIls: references/levels.md

• Build

# Build for current 平台 ./scripts/build-gog-safe.sh L1

# Cross-compile for Linux ARM64 (e.g., AWS Graviton) ./scripts/build-gog-safe.sh L1 --arch arm64 --os linux

# Custom 输出 ./scripts/build-gog-safe.sh L2 --输出 /tmp/gog-l2

Requires: Go 1.22+, git. First 运行 clones the PR #366 branch (~30s).

• 部署

# 部署 to a remote host via SSH ./scripts/部署-gog-safe.sh spock /tmp/gog命令行工具-safety-build/bin/gog-l1-safe

# 部署 with verification (tests blocked + allowed commands) ./scripts/部署-gog-safe.sh spock /tmp/gog命令行工具-safety-build/bin/gog-l1-safe --验证

The 部署 script:

Backs up the existing gog as gog-备份 安装s the new binary Verifies version 输出 Optionally tests that blocked commands are gone and allowed commands work

• 回滚

ssh 'sudo mv /usr/local/bin/gog-备份 /usr/local/bin/gog'

How It Works

Uses gog命令行工具's compile-time safety 性能分析s feature (PR #366 on steipete/gog命令行工具). A YAML file specifies which commands are enabled (true) or 移除d (false). The build 系统 生成s Go source files with only the enabled commands, then compiles. The 结果ing binary's version is tagged with -safe.

YAML 性能分析s

In references/:

l1-draft.yaml — Draft & Organize l2-collaborate.yaml — Draft & Collaborate l3-standard.yaml — Full Write (No Admin)

Custom 性能分析s: copy any YAML, edit the true/false flags, pass to build-gog-safe.sh.

Verification

After 部署ment, 验证 with:

ssh "gog --version" # Should show -safe suffix ssh "gog gmAIl 发送 --help 2>&1" # Should fAIl (L1/L2) ssh "gog gmAIl drafts 创建 --help" # Should work (all levels)

Known Edge Cases 过滤器 forwarding: gmAIl 设置tings 过滤器s 创建 is allowed at L1+ for inbox organization. A 过滤器 with a forward action could auto-forward emAIl. Accepted risk for v1. Drive sharing: drive 分享 is allowed at L1+ because sharing grants 访问 without 发送ing a message notification. The 分享d user sees it in "分享d with me" but doesn't 获取 an emAIl.