pub struct CompiledPolicy<'p> { /* private fields */ }Expand description
A policy with all patterns compiled for one evaluation context.
Compile once per process (or per policy reload) and reuse for every tool call; compilation dominates the cost of a single decision.
Implementations§
Source§impl CompiledPolicy<'_>
impl CompiledPolicy<'_>
Sourcepub fn exposure(
&self,
action: &Action,
cwd: &str,
paths: &dyn PathResolver,
) -> Taint
pub fn exposure( &self, action: &Action, cwd: &str, paths: &dyn PathResolver, ) -> Taint
What running action in cwd exposed its session to: secret material
from a read the secrets-paths group names, untrusted content from a
fetch, a web search, an unknown tool or an MCP result. The caller passes only calls that ran; the parts
of an action that cannot be classified expose nothing they can name.
Sourcepub fn with_taint(
&self,
decision: Decision,
action: &Action,
paths: &dyn PathResolver,
taint: &Taint,
) -> Decision
pub fn with_taint( &self, decision: Decision, action: &Action, paths: &dyn PathResolver, taint: &Taint, ) -> Decision
decision for action, tightened by taint: after secret material,
network to any host but the secret’s own, and every MCP call, web
search and unknown tool (the hosts they reach are unknown), asks; after untrusted content, a write to
a protected path asks. Merging keeps the strictest verdict, so this
never loosens a decision.
Source§impl<'p> CompiledPolicy<'p>
impl<'p> CompiledPolicy<'p>
Sourcepub fn compile(
policy: &'p Policy,
ctx: &EvalContext,
) -> Result<Self, PolicyError>
pub fn compile( policy: &'p Policy, ctx: &EvalContext, ) -> Result<Self, PolicyError>
Compile every pattern of policy for ctx. Fails on a pattern that does
not compile, and on a moved_dirs entry whose default could alias every
pattern (empty, bare /, or not an absolute or ~/-rooted directory).
Sourcepub fn context(&self) -> &EvalContext
pub fn context(&self) -> &EvalContext
The context this was compiled for.
Sourcepub fn evaluate_atomic(&self, action: &AtomicAction) -> Option<Decision>
pub fn evaluate_atomic(&self, action: &AtomicAction) -> Option<Decision>
Evaluate one atomic action: deny → allow → ask → defer → default, with a
repository policy’s ask rules (Policy::repo_ask) tried before allow.
Returns None for a whole-pipeline atom that no rule mentions: pipelines
are only there so rules like curl * | sh can see across |; the
per-sub-command atoms carry the default verdict.
Source§impl CompiledPolicy<'_>
impl CompiledPolicy<'_>
Sourcepub fn decide(&self, action: &Action) -> Decision
pub fn decide(&self, action: &Action) -> Decision
Decide one host action without executable resolution.
Unparseable input yields the policy’s catch-all verdict (ask or
defer) with the parser’s reason, never allow.
Sourcepub fn atoms(
&self,
action: &Action,
paths: &dyn PathResolver,
) -> (Vec<AtomicAction>, Option<String>)
pub fn atoms( &self, action: &Action, paths: &dyn PathResolver, ) -> (Vec<AtomicAction>, Option<String>)
The atomic actions Self::decide_with evaluates for action, with an
extra atom for every path an unquoted glob operand names in the
directories paths lists, and for every read or write paths resolves
through a symlink; and the reason when part of the action cannot be
classified or a glob not expanded in full (ask).
Sourcepub fn pushes(&self, action: &Action) -> Vec<Push>
pub fn pushes(&self, action: &Action) -> Vec<Push>
The commands of action that publish local commits (git push, gh pr create), each with the directories it may run in. Only a shell command
has any.
Sourcepub fn decide_with(
&self,
action: &Action,
resolver: &dyn ProgramResolver,
paths: &dyn PathResolver,
) -> Decision
pub fn decide_with( &self, action: &Action, resolver: &dyn ProgramResolver, paths: &dyn PathResolver, ) -> Decision
Decide one host action, resolving shell programs through resolver so
that executables pins and installation pins are enforced, and paths
through paths so a symlink cannot move a read or write past a rule.