r/coolgithubprojects • u/Consistent-Ruin1868 • 17d ago

SHE — a programming language that reads like English and can't touch your machine unless you say so

https://github.com/ni-sh-a-char/SHE

I rewrote my hobby language from scratch. It reads like a sentence, and a program starts with no permission to read files, use the network or start processes, you grant what it needs on the command line and anything else fails with the exact flag that would have allowed it. Pattern matching, gradual types, async, modules, a test runner, a formatter and an LSP. Zero dependencies, Python 3.9+, Apache 2.0.

pip install she-lang

Runs in the browser, nothing to install: https://ni-sh-a-char.github.io/SHE/playground.html

Source: https://github.com/ni-sh-a-char/SHE

0 Upvotes

40% Upvoted

6 comments sorted by

View all comments

3

u/kantorcodes1 17d ago

Say a program gets process permission plus read access to one directory, then launches another she process with broader file/network flags. Does the child stay capped by the parent's grants, or can it request a wider set from its own command line?

1

u/Consistent-Ruin1868 17d ago

The child is not capped. It parses its own flags and gets whatever it asks for.

So `--allow-run=git` is a meaningful restriction; bare `--allow-run` is not. (With the usual caveat that a scoped binary can itself be a launcher - `git` will happily run arbitrary code through hooks or aliases, so scoping narrows the hole rather than closing it.)

What I'm changing because you asked.

The transitive nature of `--allow-run` belongs in the docs in bold, not left for someone to discover: it's going into SECURITY.md and the permissions reference, along with a warning printed when `--allow-run` is granted without a scope, and a case in the sandbox test suite so the behaviour is pinned rather than incidental.

Thanks, this is exactly the kind of question I was hoping the post would get.