Struct ReadPathSet 

pub struct ReadPathSet { /* private fields */ }

A compiled set of allowlist entries, bound to the run they were compiled for (tilde and relative entries were resolved at compile time).

Implementations

impl ReadPathSet

pub fn compile( raw: &[String], workdir: &Path, home: Option<&Path>, windows: bool, ) -> Result<Self, String>

Compile raw [read_paths] allow strings against a run’s workdir and home. windows selects Windows path semantics: /-normalization of the matched string and case-insensitive glob/regex matching (production passes cfg!(windows)).

Any invalid entry is a hard error naming the entry - a skipped entry would degrade the agent silently mid-run, and refusing loudly at compile (spawn) time is the same posture the sandbox config takes.

pub fn is_empty(&self) -> bool

Whether the set has no entries at all.

pub fn entries(&self) -> &[ReadPathEntry]

The compiled entries, for callers that report or display them.

pub fn matches(&self, canonical: &Path) -> bool

Whether the already-canonicalized canonical path matches any entry.

pub fn matches_lexically(&self, path: &Path) -> bool

Whether path matches any entry, comparing text instead of the filesystem: an Exact entry is a component-wise prefix test on the path as written, with no canonicalization.

matches is the enforcement path and must resolve symlinks; this is the reporting path, which must not. A grant naming a directory that does not exist yet, or one behind macOS’s /tmp -> /private/tmp link, is still a grant the user wrote, and telling them it is missing would be wrong. The trade is the other way too: a report is a pattern-level answer, so a run can still be refused at a path this says is covered.

Trait Implementations

impl Clone for ReadPathSet

fn clone(&self) -> ReadPathSet

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ReadPathSet

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ReadPathSet

fn default() -> ReadPathSet

Returns the “default value” for a type.