Struct Boundary 

pub struct Boundary {
    pub roots: Option<Vec<PathBuf>>,
    pub allow_secrets: bool,
}

What this caller is allowed to index.

Two different callers, two different answers. The person typing semlith index owns the machine: they are held to the deny-list, because indexing a private key by accident is a mistake rather than a decision, and --include-secrets is how they say they meant it. An agent holding the agent key is held to both the deny-list and a boundary, because the whole of what that key can reach is what a leaked key can reach — and “every file this user can read” is too much for a credential that lives in a config file.

The default is the CLI’s: the deny-list, and no confinement.

Fields

roots: Option<Vec<PathBuf>>

Directories a path must be under. None means anywhere, which is what the command line gets.

allow_secrets: bool

Whether the deny-list is off for this run, which only the command line can ask for.

Implementations

impl Boundary

pub fn within(roots: Vec<PathBuf>) -> Self

Confine to these roots, and to the home directory.

pub fn refuses( &self, path: &Path, walked: bool, home: Option<&Path>, ) -> Option<Refusal>

Why this path may not be indexed, in a line naming the rule.

walked is whether the walk yielded this path or the caller named it, and it decides one rule only: the hidden-file rule. A dotfile the walk yielded is there because the user’s own .gitignore whitelisted it — dist/* then !dist/.gitkeep — and refusing it as hidden is the walk contradicting itself, which is what ended a run on the reporter’s Angular tree. A dotfile the caller named is still refused: semlith index ~/.npmrc is a mistake worth catching. Every other rule — the credential directories, the credential names — applies to both.

pub fn resolved(&self, home: Option<&Path>) -> ResolvedBoundary

This boundary with its roots resolved once, for a pass that asks about many paths. home is the canonical home directory, already resolved.

Trait Implementations

impl Clone for Boundary

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Boundary

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Boundary

fn default() -> Self

Returns the “default value” for a type.