Struct WorkspaceGuard 

pub struct WorkspaceGuard { /* private fields */ }

Workspace safety checks to prevent editing files outside the target workspace.

Implementations

impl WorkspaceGuard

pub fn new(workspace_root: impl AsRef<Path>) -> Result<Self, SafetyError>

Create a new workspace guard with the given root.

The workspace root will be canonicalized to handle symlinks correctly.

pub fn validate_path( &self, path: impl AsRef<Path>, ) -> Result<PathBuf, SafetyError>

Check if a path is safe to edit.

Returns the canonicalized absolute path if safe.

Note: This performs canonicalization at validation time. For maximum TOCTOU safety, callers should hold an open fd or re-validate immediately before write operations in adversarial environments.

pub fn revalidate(&self, path: &Path) -> Result<PathBuf, SafetyError>

Re-validate a previously-validated canonical path.

Call this immediately before write to close the TOCTOU window: the path is re-canonicalized and re-checked against workspace and forbidden boundaries.

pub fn workspace_root(&self) -> &Path

Get the workspace root.

Trait Implementations

impl Clone for WorkspaceGuard

fn clone(&self) -> WorkspaceGuard

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for WorkspaceGuard

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.