Enum Action 

#[non_exhaustive]
pub enum Action {
    Shell {
        command: String,
    },
    ForeignShell {
        shell: String,
        command: String,
    },
    FsRead {
        path: String,
    },
    FsWrite {
        path: String,
    },
    Net {
        url: String,
    },
    Fetch {
        url: String,
    },
    WebSearch {
        query: String,
    },
    UnknownTool {
        host: String,
        tool: String,
        reads: Vec<String>,
        writes: Vec<String>,
        hosts: Vec<String>,
        commands: Vec<String>,
    },
    Unchecked {
        action: Box<Action>,
        reason: String,
    },
    Patch {
        writes: Vec<String>,
    },
    ReadFiles {
        paths: Vec<String>,
    },
    McpTool {
        name: String,
        reads: Vec<String>,
        writes: Vec<String>,
        hosts: Vec<String>,
        commands: Vec<String>,
        unchecked: Option<String>,
    },
}

A tool call as seen from a host, before classification.

Host adapters (openmoat-hosts) translate each payload into exactly one of these. Adapters never decide.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Shell

A shell command string as the host would execute it. A shell command line, exactly as the host would run it.

Fields

command: String

The command line.

ForeignShell

A command for a shell the classifier cannot read (Claude Code PowerShell). Never classified, so always unparseable: an ask, never an allow.

Fields

shell: String

The shell’s name, for reasons and the audit log.

command: String

The command line.

FsRead

A direct file read through a host tool (e.g. Claude Code Read). A file read by a host tool (Read, Glob, Grep, LSP, beforeReadFile).

Fields

path: String

Path as the tool gave it; normalised during classification.

FsWrite

A direct file write/edit through a host tool. A file write or edit by a host tool (Edit, Write, NotebookEdit).

Fields

path: String

Path as the tool gave it; normalised during classification.

Net

A network connection a host tool opens and may send data over (Claude Code Monitor WebSocket).

Fields

url: String

The URL as the tool gave it.

Fetch

A URL read by a host’s own fetch tool (Claude Code WebFetch): a request the agent cannot attach a body to, judged by fetch and net rules (ADR-017).

Fields

url: String

The URL as the tool gave it.

WebSearch

A query a host’s own web search tool (Claude Code and Cursor WebSearch) sends to the host’s search provider: judged by defaults.web.search.

Fields

query: String

The query as the tool gave it.

UnknownTool

A host tool the adapter cannot classify, judged by defaults.tool.unknown. What its arguments name is checked as well: every path and URL the adapter finds in them, and every shell command under a key such as command, so a tool OpenMoat does not know never runs unchecked.

Fields

host: String

The host’s id (cursor).

tool: String

The tool name as the host sent it.

reads: Vec<String>

Paths the call may read, found in its arguments.

writes: Vec<String>

Paths the call may write, found in its arguments.

hosts: Vec<String>

URLs or hosts the call may contact, found in its arguments.

commands: Vec<String>

Shell commands the call may run, found in its arguments.

Unchecked

A call the hook payload shows only in part: input typed into a shell that is already running, or a search over directories the payload does not name. action is decided as usual and the call is at least an ask (rule UNCHECKED_RULE), since reason names what OpenMoat cannot see.

Fields

action: Box<Action>

What the payload shows of the call.

reason: String

What it does not show.

Patch

A patch that edits several files in one call (Codex apply_patch): every path it adds, updates, deletes or moves to is written. Files changed by one multi-file patch (Codex apply_patch).

Fields

writes: Vec<String>

Every file the patch adds, updates, deletes or moves to.

ReadFiles

Files one tool call reads together (Claude Code SendFile, which sends their contents to another session): every path is read.

Fields

paths: Vec<String>

Every file the call reads.

McpTool

An MCP tool call, mcp__<server>__<tool>. Adapters that understand a server’s arguments add the paths and hosts the call touches so the usual fs.* and net rules apply to it as well.

Fields

name: String

mcp__<server>__<tool>.

reads: Vec<String>

Paths the call reads, derived from its arguments.

writes: Vec<String>

Paths the call writes, derived from its arguments.

hosts: Vec<String>

URLs or hosts the call contacts, derived from its arguments.

commands: Vec<String>

Shell commands the call may run, derived from its arguments where the host cannot tell an MCP tool from one of its own.

unchecked: Option<String>

The limit that stopped the adapter searching the arguments (nesting depth, number of paths and URLs). What was not searched may name a file or host, so the engine decides the call at least ask.

Implementations

impl Action

pub fn kind(&self) -> Kind

The kind of action as a user would describe it (Patch writes files).

pub fn mcp(name: impl Into<String>) -> Self

An MCP call whose arguments are not interpreted.

pub fn unknown_tool(host: impl Into<String>, tool: impl Into<String>) -> Self

An unknown tool of host whose arguments name nothing to check.

pub fn unchecked(action: Self, reason: impl Into<String>) -> Self

action, decided at least ask because reason names what the payload does not show (Action::Unchecked).

pub fn shown(&self) -> &Self

The action itself, without the Action::Unchecked wrapping around it.

Trait Implementations

impl Clone for Action

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Action

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Action

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for Action

impl PartialEq for Action

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for Action

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Action