Struct SecurityPolicy 

pub struct SecurityPolicy { /* private fields */ }

Validates tool invocations against security constraints: path restrictions, blocked commands, .git protection, and NAVI private storage.

Implementations

impl SecurityPolicy

pub fn new( project_root: PathBuf, data_dir: PathBuf, config: SecurityConfig, ) -> Result<Self>

Creates a new policy from the project root, data directory, and security config.

pub fn with_write_scope(self, scope: WritePathScope) -> Self

Returns a clone with a workflow worker write-path scope applied.

pub fn set_plan_mode(&self, active: bool, plan_file: Option<PathBuf>)

Enable/disable plan mode and set the only writable plan markdown path. Shared across policy clones via interior mutability.

pub fn plan_mode_active(&self) -> bool

Whether plan mode is currently active on this policy.

pub fn plan_file_path(&self) -> Option<PathBuf>

Absolute path of the session plan file (if set).

pub fn validate_path(&self, path: &Path, write: bool) -> SecurityDecision

Validates a file path, checking project restrictions, .git protection, and NAVI private storage.

pub fn validate_patch(&self, patch: &PatchProposal) -> SecurityDecision

Validates all paths in a patch proposal.

pub fn validate_command(&self, program: &str) -> SecurityDecision

Validates a command against the blocked-commands list, guarded-commands list, and approval config.

pub fn validate_plugin_path(&self, path: &Path) -> SecurityDecision

Validates a plugin library path, requiring approval unless external plugins are explicitly allowed.

pub fn validate_mcp_server(&self, server_id: &str) -> SecurityDecision

Validates an MCP server id against the configured allowlist.

When allowlist is non-empty, only server ids present in the list are allowed. An empty allowlist permits all MCP servers.

pub fn validate_tool_invocation( &self, definition: &ToolDefinition, invocation: &ToolInvocation, ) -> SecurityDecision

Validates a tool invocation by dispatching to the appropriate validator based on tool kind.

pub fn post_execution_effect_check( &self, tool_name: &str, paths: &[PathBuf], _command: Option<&str>, ) -> PostDecision

Performs a post-execution effect check on the paths touched by a tool.

Analyses created, modified, and deleted paths through the EffectAnalyzer and produces a PostDecision that the harness can act on (allow, ask, deny, or roll back).

tool_name is used for contextual messaging. paths are the filesystem paths the tool reported touching. command is the shell command string, if any (used for context, not analysed here).

pub fn project_root(&self) -> &Path

Returns the normalized project root used as the execution sandbox.

pub fn paths_restricted_to_project(&self) -> bool

Whether file-tool paths must stay inside the project root.

Always enforced in PermissionMode::Restricted. Outside Restricted, only the explicit restrict_paths_to_project config flag applies (default off), so AcceptEdits / Auto / YOLO keep agent agency unless the user opts into a project jail.

pub fn config(&self) -> &SecurityConfig

Returns a reference to the security configuration.

pub fn set_config(&mut self, config: SecurityConfig)

Replaces the security configuration used by subsequent validations.

pub fn data_dir(&self) -> &Path

Returns the NAVI data directory used for persistent storage (sessions, memory, plans, credentials, logs).

pub fn resolve_project_path(&self, path: &Path) -> PathBuf

Resolves relative tool paths against the project root instead of the process CWD. This keeps SDK/ACP embeddings from accidentally reading or writing outside the requested project when NAVI is launched elsewhere.

pub fn write_scope(&self) -> Option<&WritePathScope>

Returns the optional workflow write-path scope, if any.

pub fn normalize_invocation_paths( &self, invocation: &ToolInvocation, ) -> ToolInvocation

Returns a copy of the invocation with security-visible path fields made absolute under the project root.

pub fn is_path_denied(&self, path: &Path) -> bool

Check if a path matches any entry in the deny list.

Supports:

• Directory name prefixes: "node_modules" matches node_modules/foo/bar.js
• Glob patterns: "*.log" matches debug.log
• Exact path suffixes: "package-lock.json" matches foo/package-lock.json

pub fn filter_denied_lines(&self, text: &str) -> String

Filter text output by removing lines that reference denied paths.

Used by grep and fs_browser to prevent denied path references from entering the LLM context.

Trait Implementations

impl Clone for SecurityPolicy

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.