agentshield/ir/
execution_surface.rs

1use serde::{Deserialize, Serialize};
2
3use super::{ArgumentSource, SourceLocation};
4
5/// Execution capabilities discovered through static analysis.
6#[derive(Debug, Clone, Default, Serialize, Deserialize)]
7pub struct ExecutionSurface {
8    /// Commands/subprocesses invoked.
9    pub commands: Vec<CommandInvocation>,
10    /// File I/O operations.
11    pub file_operations: Vec<FileOperation>,
12    /// Network I/O operations.
13    pub network_operations: Vec<NetworkOperation>,
14    /// Environment variable accesses.
15    pub env_accesses: Vec<EnvAccess>,
16    /// Dynamic code execution (eval, exec, etc.).
17    pub dynamic_exec: Vec<DynamicExec>,
18}
19
20#[derive(Debug, Clone, Serialize, Deserialize)]
21pub struct CommandInvocation {
22    /// e.g., "subprocess.run", "os.system"
23    pub function: String,
24    pub command_arg: ArgumentSource,
25    pub location: SourceLocation,
26}
27
28#[derive(Debug, Clone, Serialize, Deserialize)]
29pub struct FileOperation {
30    pub operation: FileOpType,
31    pub path_arg: ArgumentSource,
32    pub location: SourceLocation,
33}
34
35#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
36#[serde(rename_all = "snake_case")]
37pub enum FileOpType {
38    Read,
39    Write,
40    Delete,
41    List,
42    Chmod,
43}
44
45#[derive(Debug, Clone, Serialize, Deserialize)]
46pub struct NetworkOperation {
47    /// e.g., "requests.get", "fetch"
48    pub function: String,
49    pub url_arg: ArgumentSource,
50    /// GET, POST, etc.
51    pub method: Option<String>,
52    /// Does it send body/params?
53    pub sends_data: bool,
54    pub location: SourceLocation,
55}
56
57#[derive(Debug, Clone, Serialize, Deserialize)]
58pub struct EnvAccess {
59    pub var_name: ArgumentSource,
60    /// Whether the variable name looks sensitive (AWS_*, SECRET_*, API_KEY, etc.)
61    pub is_sensitive: bool,
62    pub location: SourceLocation,
63}
64
65#[derive(Debug, Clone, Serialize, Deserialize)]
66pub struct DynamicExec {
67    /// eval, exec, compile, __import__
68    pub function: String,
69    pub code_arg: ArgumentSource,
70    pub location: SourceLocation,
71}
agentshield/ir/execution_surface.rs

agentshield/ir/
execution_surface.rs
