Struct ExecRequest 

pub struct ExecRequest { /* private fields */ }

Structured child execution request independent from CLI parsing.

Built via new followed by builder methods. Validates that the working directory exists and that a command is provided.

Implementations

impl ExecRequest

pub fn new( cwd: impl Into<PathBuf>, argv: Vec<String>, allowed_env: Vec<String>, ) -> Result<Self>

Create a validated execution request.

Returns Error::MissingCommand when argv is empty and Error::InvalidCwd when cwd is not an existing directory.

pub const fn with_stdio_policy(self, stdio_policy: StdioPolicy) -> Self

Set the child stdio handling policy.

pub fn with_env_policy( self, env_policy: EnvPolicy, denied_env: Vec<String>, ) -> Self

Set the environment policy and denied keys.

pub fn with_env(self, allowed_env: Vec<String>, denied_env: Vec<String>) -> Self

Set both allowed and denied environment keys.

Sets the policy to EnvPolicy::Allowlist.

pub const fn with_network_mode(self, network_mode: NetworkMode) -> Self

Set the child network isolation mode.

pub fn with_filesystem_policy( self, filesystem_policy: Option<FilesystemPolicy>, ) -> Result<Self>

Set the filesystem sandbox policy.

Some declares confinement, where an empty value confines read-only. None leaves the child unconfined by filesystem rules unless another isolation request applies. Returns an error when filesystem policy validation fails.

pub const fn with_proc_mode(self, proc_mode: ProcMode) -> Self

Set the /proc mount policy.

pub const fn with_agent_policy(self, agent_policy: AgentPolicy) -> Self

Set the host agent socket mount policy.

pub fn needs_isolation(&self) -> bool

Whether this request needs OS-level isolation.

Returns true when network isolation, a declared filesystem stance (an empty block confines read-only), or host agent socket access is requested.

pub fn cwd(&self) -> &Path

Child working directory.

pub fn argv(&self) -> &[String]

Child command argv, including program name at index zero.

pub fn allowed_env(&self) -> &[String]

Parent environment keys allowed in the child environment.

pub fn denied_env(&self) -> &[String]

Parent environment keys denied in blocklist mode.

pub const fn env_policy(&self) -> EnvPolicy

Child environment filtering policy.

pub const fn stdio_policy(&self) -> StdioPolicy

Child stdio handling policy.

pub const fn network_mode(&self) -> NetworkMode

Child network isolation policy.

pub fn filesystem_policy(&self) -> Option<&FilesystemPolicy>

Filesystem stance declared by the caller.

None means no filesystem confinement was declared; Some carries the controls, where an empty value confines read-only.

pub fn effective_filesystem_policy(&self) -> Cow<'_, FilesystemPolicy>

Filesystem controls in force under isolation.

Isolation paths call this after needs_isolation() returns true; a request that declared no filesystem block confines read-only through the empty policy, which both renderers treat as their closed-by-default base profile.

pub const fn proc_mode(&self) -> ProcMode

Proc filesystem mount policy.

pub const fn agent_policy(&self) -> AgentPolicy

Host agent socket mount policy.

Trait Implementations

impl Clone for ExecRequest

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ExecRequest

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for ExecRequest

impl PartialEq for ExecRequest

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for ExecRequest