Struct ReadPathPolicy 

pub struct ReadPathPolicy {
    pub agent: String,
    pub blueprint: ReadPathSet,
    pub grants: ReadPathSet,
    pub allow_blueprint: bool,
}

Everything read-path enforcement needs, resolved once at spawn.

blueprint is what the manifest declares; grants is what the user’s config allows ([security] read_paths plus [agent_read_paths.<name>]); allow_blueprint is the [security] allow_blueprint_read_paths override that honors declarations without itemized grants.

Fields

agent: String

The agent’s name, for error and warning text.

blueprint: ReadPathSet

Entries the blueprint declares.

grants: ReadPathSet

Entries the user’s config grants.

allow_blueprint: bool

Whether declarations are honored without itemized grants.

Implementations

impl ReadPathPolicy

pub fn inactive() -> Self

A policy that allows nothing beyond the workdir - the default for every agent whose blueprint has no [read_paths].

pub fn is_active(&self) -> bool

Whether the blueprint declares any read paths at all. When false, the resolver never consults this policy and the workdir sandbox behaves exactly as it always has.

pub fn decide(&self, canonical: &Path) -> ReadPathDecision

The double check: the blueprint must declare the path AND the user must grant it (itemized, or via the blanket override).

Trait Implementations

impl Clone for ReadPathPolicy

fn clone(&self) -> ReadPathPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ReadPathPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ReadPathPolicy

fn default() -> ReadPathPolicy

Returns the “default value” for a type.