Enum CallSelector 

pub enum CallSelector {
    Tool(String),
    Matching {
        tool: String,
        args_match: BTreeMap<String, String>,
    },
}

Which calls in a trace a rule step refers to.

Sequence rules used to name a tool and nothing else, so the correlation class that motivated ADR-047 could not be written: “credential read followed by egress” is not a statement about two tool names, it is a statement about two calls, one of which is identified by what it was given (#2124). Both halves of that pair are ordinary bash in the trace that prompted it.

Untagged, so a bare string keeps meaning exactly what it meant before, including alias resolution through the policy. Every existing config parses unchanged; the object form is the new capability rather than a migration.

- type: never_after
  trigger: { tool: bash, args_match: { command: "\\.aws/credentials" } }
  forbidden: { tool: bash, args_match: { command: "^curl .*-d" } }

args_match is a conjunction: every named argument must be present and its value must match the regex. Values are matched against their JSON rendering, so a non-string argument is matchable without a separate syntax, and a missing argument fails the match rather than being skipped, because a rule that silently stops constraining is the failure this whole area exists to prevent.

Variants

Tool(String)

A tool name, resolved through policy aliases. The shape every pre-5.0.0 config uses.

Matching

A tool name plus a constraint on the call’s arguments.

Fields

tool: String

args_match: BTreeMap<String, String>

Implementations

impl CallSelector

pub fn tool(&self) -> &str

The tool name this selector names, for alias resolution and diagnostics.

pub fn args_match(&self) -> Option<&BTreeMap<String, String>>

The argument constraints, empty for a bare tool name.

Trait Implementations

impl Clone for CallSelector

fn clone(&self) -> CallSelector

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CallSelector

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for CallSelector

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Display for CallSelector

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Stable rule ids: a bare tool renders as itself, so ids of existing rules do not change.

impl From<&str> for CallSelector

fn from(s: &str) -> Self

Converts to this type from the input type.

impl PartialEq for CallSelector

fn eq(&self, other: &CallSelector) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for CallSelector

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for CallSelector