Struct SecurityGuard 

pub struct SecurityGuard { /* private fields */ }

Per-session security orchestrator

Subsystems (TaintRegistry, PrivacyClassifier, AuditLog) are lazily initialized on first access via OnceLock. This avoids allocating a HashMap (taint), compiling regex (classifier), and creating a 10,000- capacity Vec (audit) when the corresponding feature is disabled.

Implementations

impl SecurityGuard

pub fn new(session_id: String, config: SecurityConfig) -> Self

Create a new SecurityGuard without registering hooks.

Call [register_hooks] separately with a real HookEngine to register security hooks. This avoids the previous bug where hooks were registered to a temporary engine that was immediately dropped.

pub fn register_hooks(&self, hook_engine: &HookEngine)

Register security hooks with the given engine.

Must be called with a long-lived HookEngine — not a temporary. Safe to call multiple times (idempotent: skips if hooks already registered).

pub fn taint_input(&self, text: &str)

Classify input text and register any detected sensitive data as tainted

pub fn sanitize_output(&self, text: &str) -> String

Sanitize output text by redacting tainted and classified sensitive data

pub fn wipe(&self)

Securely wipe all session security state

pub fn teardown(&self, hook_engine: &HookEngine)

Unregister all hooks from the engine

pub fn audit_entries(&self) -> Vec<AuditEntry>

Get audit log entries

pub fn get_taint_registry(&self) -> &Arc<RwLock<TaintRegistry>>

Get the taint registry (read-only access)