openlatch-client 0.3.3

OpenLatch runtime enforcement node — the capture-and-enforce adapter that evaluates every covered action against a coding agent's Autonomy Zone before it runs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

# reqwest is built with `rustls-no-provider`, so `ClientBuilder::build()` panics unless a
# rustls CryptoProvider has been installed in the process. `core::egress` installs one and
# exposes the only sanctioned constructors; calling reqwest's directly compiles fine and then
# panics at runtime in any process that has not been through `main()` -- which is every unit
# test, every integration test, and any consumer of this crate as a library.
#
# This is a lint rather than a convention because two textual sweeps during the reqwest 0.13
# migration each missed a form: `Client::new()` hiding behind an earlier `Client::builder()`
# pass, then a bare `Client::new` function reference inside `LazyLock::new`. Name resolution
# catches those, and it also catches `use reqwest::Client as C; C::new()`, which no grep can.
# `Client::default` is deliberately absent: it resolves to a `Default` trait impl, not an
# inherent function, so clippy rejects the path as unreachable and -D warnings would fail the
# build. It is also not a real escape hatch -- `Default for Client` is implemented as `new()`,
# which this list already covers at the point it matters.
disallowed-methods = [
    { path = "reqwest::Client::new", reason = "use openlatch_client::egress::client() -- it installs the rustls CryptoProvider first" },
    { path = "reqwest::Client::builder", reason = "use openlatch_client::egress::client_builder()" },
    { path = "reqwest::ClientBuilder::new", reason = "use openlatch_client::egress::client_builder()" },
    { path = "reqwest::blocking::Client::new", reason = "use openlatch_client::egress::blocking_client()" },
    { path = "reqwest::blocking::Client::builder", reason = "use openlatch_client::egress::blocking_client_builder()" },
    { path = "reqwest::blocking::ClientBuilder::new", reason = "use openlatch_client::egress::blocking_client_builder()" },
    { path = "reqwest::get", reason = "builds a client with no CryptoProvider; use openlatch_client::egress::client()" },
    { path = "reqwest::blocking::get", reason = "builds a client with no CryptoProvider, and carries no timeout; use openlatch_client::egress::blocking_client_builder()" },
]