cageforge_backend_api/
capability.rs

1// SPDX-License-Identifier: Apache-2.0
2
3use std::fmt;
4
5use crate::BackendCapability;
6
7impl fmt::Display for BackendCapability {
8    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
9        let description = match self {
10            Self::CommandExecution => "command execution",
11            Self::WorkingDirectory => "working-directory resolution",
12            Self::StdioInherit => "inherited standard streams",
13            Self::StdioNull => "null standard streams",
14            Self::StdioPipe => "piped standard streams",
15            Self::TimeoutBackendDefault => "backend-default timeout",
16            Self::TimeoutLimit => "explicit timeout limits",
17            Self::TimeoutDisabled => "disabled automatic timeouts",
18            Self::FilesystemRestricted => "restricted filesystem enforcement",
19            Self::FilesystemUnrestricted => "unrestricted filesystem execution",
20            Self::FilesystemExternal => "external filesystem enforcement",
21            Self::FilesystemScopes => "filesystem scope resolution, including workspace roots",
22            Self::FilesystemExecutableMapping => "validated executable runtime-root mapping",
23            Self::FilesystemAbsoluteScopes => "absolute filesystem scope resolution",
24            Self::FilesystemWorkspaceScopes => "workspace-root filesystem scope resolution",
25            Self::FilesystemRootScopes => "system-root filesystem scope resolution",
26            Self::FilesystemMinimalScopes => "platform-minimal filesystem scope resolution",
27            Self::FilesystemTmpdirScopes => "temporary-directory filesystem scope resolution",
28            Self::FilesystemConventionalTemporaryScopes => {
29                "conventional temporary filesystem scope resolution"
30            }
31            Self::FilesystemGlobs => "filesystem deny-glob matching",
32            Self::FilesystemGlobScanDepth => {
33                "filesystem glob scan-depth semantics, including unbounded scans"
34            }
35            Self::FilesystemReadOnlySubpaths => "filesystem read-only subpaths",
36            Self::FilesystemMissingPathBehavior => {
37                "filesystem missing-path behavior (error or skip)"
38            }
39            Self::FilesystemProtectedPaths => "filesystem protected paths such as .git",
40            Self::NetworkDisabled => "disabled network enforcement",
41            Self::NetworkEnabled => "local network enforcement",
42            Self::NetworkExternal => "external network enforcement",
43            Self::NetworkDomainRules => "network domain rules",
44            Self::NetworkLocalAddressRestrictions => {
45                "network non-public and special-purpose address restrictions"
46            }
47            Self::NetworkResolvedTargets => "exact resolved network targets",
48            Self::NetworkLocalIpcIsolation => "pathname local-IPC isolation",
49            Self::NetworkLocalIpcRules => "per-path local-IPC allow rules",
50            Self::NetworkLocalIpcDenyRules => "explicit local-IPC deny rules",
51            Self::NetworkWindowsNamedPipeRules => "Windows named-pipe local-IPC rules",
52            Self::EnvironmentAll => "all inherited environment variables",
53            Self::EnvironmentCore => "backend-selected core environment variables",
54            Self::EnvironmentNone => "an empty inherited environment",
55            Self::EnvironmentFilters => "environment include and exclude filters",
56            Self::EnvironmentOverrides => "environment set and remove overrides",
57        };
58        formatter.write_str(description)
59    }
60}
cageforge_backend_api/capability.rs

cageforge_backend_api/
capability.rs
