Expand description
Execution sandbox: shared write-guard machinery and write-boundary policy.
The hook entry points are hidden subcommands on this binary (see cli), so
the installed PreToolUse hook invokes eval-magic guard <marker>,
eval-magic guard-codex <marker>, or the generic
eval-magic guard-hook --harness <name> <marker> — no separate hook script
to ship or locate. Each harness’s hook path, matcher, and verdict shape are
descriptor data rendered by the generic engine (crate::adapters::guard);
this module holds the shared marker/manifest/teardown machinery and the
boundary policy.
Re-exports§
pub use decide::GuardDecision;pub use decide::GuardMarker;pub use decide::decide;pub use guard::read_marker;pub use install::GUARD_MANIFEST;pub use install::GUARD_MARKER;pub use install::teardown_guard;pub use policy::classify_bash;pub use policy::is_shell_tool;pub use policy::is_under;pub use policy::is_under_any;pub use policy::is_write_tool;pub use policy::path_arg;