Build1 publisher3 min readPublished
A local gate of allow list, deny list, and secret detection decides what a prompt may carry off the laptop
A dev.to architecture review puts a local classification gate in front of the send, allowing three path globs and capping the pack at 40 files. The staging-hostname leak it warns about survives its own gate.
The Engineer · Build desk
What happened
- A dev.to architecture review treats each prompt as a network egress event and puts a local classification gate between the working tree and the remote model, governed by an egress_policy.yml with three allow globs.
- That policy caps a pack at 40 files and 65,536 bytes per file, and the post says any detected secret aborts the whole export at once.
- The five-pattern deny list stays on local disk and never ships with the pack, on the grounds that a remote generator does not need a map of the directories you keep closed.
- A disclosure at the foot says the piece was prepared as part of MonkeyCode's product outreach, whose free model access and free server option can fill the remote hop.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint Path globs decide exportability, so a helper module under src/ ships whatever internal hostnames it hardcodes. Covering the topology case the post itself flags requires a content classifier, which is a separate build.
- decision Adopting this makes egress_policy.yml a reviewed file with an owner, because the fastest way to get better answers out of a remote model is to widen the allow list toward ops/.
- cost Inspection is charged per prompt, not per session: every reworded resend needs another classification pass against the tree, and the developer pays that time.
- exposure A free inference tier puts the same operators and disks in Domain C as a paid one, so price changes nothing about who can read the pack.
Start with the two lists, because they are not doing the same job. The allow globs are `src/**/*.py`, `tests/**/*.py` and `README.md` [3]. Those three already exclude `.env` files, PEM keys and everything under `ops/`, which is what four of the five deny patterns name [4]. The deny list binds only where it overlaps the allow set: `src/config/secrets.py` matches both `src/**/*.py` and `**/*secret*`, and `tests/test_credentials.py` matches both [18]. So the perimeter is the allow list and the deny list is a tiebreaker on a narrow intersection. I'd take that ordering in any repo I own, because an allowlist fails closed the day someone adds a directory.
The caps are `max_file_bytes: 65536` and `max_pack_files: 40` [5]. Multiply them and the worst-case pack is 2,621,440 bytes, about 2.6 MB [17]. That ceiling is a design statement about what a generate prompt is for: allowed files fold into a narrow pack, denied files stay on disk, and a detected secret aborts the whole export [2].
Now the case the gate does not cover. The post's second failure mode is a helper module that hardcodes a staging hostname, and it argues that hostnames can be as sensitive as passwords because the name maps your network [11]. A path glob cannot see inside a file. `src/util/http.py` matches `src/**/*.py` and ships. Secret detection aborts on credential-shaped strings [2], and an internal hostname is not credential-shaped. For the gate to catch it, the classifier would have to read content and hold an inventory of your own internal names, which means maintaining a list of your DNS in a file you then have to keep out of the pack.
The four failure domains are the working tree, the classified pack, the remote generate service, and the reviewed patch [7]. The split is useful because of the asymmetry the post draws next: a leak in the pack is an export incident, a crash at the remote service is only downtime [8]. The line stays where it is when the capacity is free. "Courtesy does not move the trust boundary one inch," the post said [14].
The disclosure is at the foot: "This article was prepared as part of MonkeyCode's product outreach" [15]. The same post also says to run the gate on your machine and not on the generate host [13]. A vendor-adjacent piece telling you to keep the inspector off the vendor's hardware is the more useful half of the disclosure.
The record does not include the gate itself. The published listing stops at the docstring and the `from __future__ import annotations` line, and the post calls it "a labeled local example, not production magic" to be run on a disposable clone [16]. Every decision that matters lives in the code that follows: how paths are matched, what counts as a secret, whether a resend re-reads the tree the post says to re-scan every time [12]. Path classification plus secret patterns is a control I would default to for a prompt path. On the post's own list of failure modes, the staging hostname inside an allowed file still goes out with the pack.
What to watch
- Whether the full gate script is published, since the listing stops at the imports and the classification logic decides everything.
- Whether repos adopting this treat egress_policy.yml edits as reviewed changes, as the post asks, or let developers widen the allow list unreviewed.
- Whether MonkeyCode's free server option ends up doing any classification on the remote host, which the post tells operators not to do.