 read-only    
 


      -    :  ,      -   .  read-only    , guardrails  ,          ,     ,        .     PowerShell 5.1  BOM  ANSI  , -    ,            Ollama .   ,       ,        .





 

 read-only    





 read-only    





    ,       





 


 ,              .       ,    : , ,   ,      - .       ,   .

       ,      ,      .     :   ,  .

  : , ,       ,         .         -,      :  ,  ,     ,      .      :   .         ,    .




 1.   read-only


        ,   .  ,    :    , -  ,       .   ,  ,        -     Windows.

     :     .

  ,    ,      .   ,  , ,            ,   ,   .

  ,   .        readonly: true,      :

function Test-JobAllowed($job) {

$txt = (('{0} {1} {2}' -f $job.id, $job.title, ($job.cmd -join ' '))).ToLower()

foreach ($flag in '-executionpolicy bypass', '-noprofile', '-windowstyle hidden', '-noninteractive') {

$txt = $txt.Replace($flag, ' ')

}

foreach ($w in $script:BlockedJobWords) {

if ($txt.Contains($w)) { return @{ ok = $false; why = "blocked word in job definition: '$w'" } }

}

if (-not $job.readonly) { return @{ ok = $false; why = 'job is not marked readonly' } }

foreach ($c in $job.cmd) {

if ($c -match '[;&|`$><]' -or $c -match '^--(force|exec)') { return @{ ok = $false; why = 'suspicious argument: ' + $c } }

}

return @{ ok = $true; why = '' }

}

 if (-not $job.readonly)                 ?.  :   .




 2. -,      


   -    .    GUARDRAILS.md     Test-JobAllowed:

login  password  credential  secret  token  cookie  purchase  buy  pay  invoice

withdraw  deposit  register  signup  delete  remove-item  format  install  uninstall

shutdown  reboot  registry import  .reg  captcha  bypass  proxy-rotation  mass-invite




  .


   .

   ,     (https://www.litres.ru/book/shadrin-borisovich-danil/park-read-only-agentov-na-svoiom-pk-74708629/)  .

      Visa, MasterCard, Maestro,    ,   ,     ,  PayPal, WebMoney, ., QIWI ,       .


