Struct ToolAskRule 

pub struct ToolAskRule {
    pub tool: String,
    pub command: Option<String>,
    pub command_exact: bool,
    pub path: Option<String>,
    pub workspace: Option<String>,
    pub action: PermissionAction,
}

Typed rule that controls whether a tool invocation is denied, allowed, or requires approval.

The action field governs what happens when this rule matches:

• "deny" — the tool call is blocked outright (highest priority).
• "ask" — the approval prompt is forced (default, backward compatible).
• "allow" — the tool call proceeds without asking.

Inside one ruleset layer, deny wins over ask, which wins over allow. Higher-priority layers are selected before action and specificity. Command-prefix-based deny and allow rules loaded from permissions.toml are also promoted into the execution-policy engine’s denied_prefixes / trusted_prefixes for arity-aware matching; path-only rules are evaluated separately.

Fields

tool: String

Name of the tool this rule applies to (e.g. "exec_shell", "edit_file").

command: Option<String>

Optional command prefix to match against (uses arity-aware matching).

command_exact: bool

Match command as the complete invocation instead of as a prefix.

Approval-card remembered grants set this so approving one safe command cannot silently authorize a later invocation with extra arguments.

path: Option<String>

Optional workspace-relative file path matched exactly after normalization.

workspace: Option<String>

Optional absolute workspace root that limits this rule to one repo.

Rules authored without a workspace retain the historical global scope.

action: PermissionAction

Action when this rule matches. Default: "ask" (backward compatible).

Implementations

impl ToolAskRule

pub fn new(tool: impl Into<String>) -> Self

Creates a new ask rule matching any invocation of the given tool.

pub fn exec_shell(command: impl Into<String>) -> Self

Creates an ask rule for exec_shell matching a specific command prefix.

pub fn file_path(tool: impl Into<String>, path: impl Into<String>) -> Self

Creates an ask rule for a file-tool matching a specific path pattern.

pub fn into_exact_workspace_allow(self, workspace: impl Into<String>) -> Self

Convert an exact rule candidate into a repo-scoped persistent allow.

Trait Implementations

impl Clone for ToolAskRule

fn clone(&self) -> ToolAskRule

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ToolAskRule

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ToolAskRule

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for ToolAskRule

impl PartialEq for ToolAskRule

fn eq(&self, other: &ToolAskRule) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for ToolAskRule

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for ToolAskRule