vetto 0.2.16

Daemon-less sandbox + security layer for AI coding agents (Landlock/Seatbelt, TUI statusline, post-session audit reports)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

//! Coarse classification of observed operations for stats and reports.

use std::path::Path;

#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub enum Operation {
    FsRead,
    FsWrite,
    Exec,
    Net,
    Other,
}

impl Operation {
    pub fn label(&self) -> &'static str {
        match self {
            Operation::FsRead => "fs-read",
            Operation::FsWrite => "fs-write",
            Operation::Exec => "exec",
            Operation::Net => "net",
            Operation::Other => "other",
        }
    }
}

/// Best-effort classification of a filesystem path by extension.
pub fn classify_path(path: &str) -> Operation {
    let p = Path::new(path);
    let extension = p
        .extension()
        .and_then(|extension| extension.to_str())
        .map(str::to_ascii_lowercase);
    match extension.as_deref() {
        Some("sh") | Some("bash") | Some("zsh") | Some("exe") | Some("bin") => Operation::Exec,
        _ => Operation::FsRead,
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn classifies_extensions_without_touching_the_filesystem() {
        assert_eq!(classify_path("/tmp/run.SH"), Operation::Exec);
        assert_eq!(classify_path("/tmp/tool.BIN"), Operation::Exec);
        assert_eq!(classify_path("/tmp/project/src"), Operation::FsRead);
    }
}