Struct NetworkPolicy 

pub struct NetworkPolicy {
    pub enabled: bool,
    pub allow_domains: Vec<String>,
    pub deny_domains: Vec<String>,
}

P4c (S2 module 5 tools.web, S2.1 dep “network sandbox rules”, S17): the network-domain policy a caller (SDK embedder) may install on a ToolContext so crate::tools::WebFetchTool/crate::tools::WebSearchTool respect it — see ToolContext::check_network. None on the context (the default) means no policy is configured, matching today’s honest gap (no P5 capabilities.permissions.sandbox.network engine exists yet, C3 — tracked, not hidden).

Fields

enabled: bool

Whether the policy is enforced at all. false behaves exactly like None on the context.

allow_domains: Vec<String>

If non-empty, only these hosts are allowed. BP-10: matched as crate::config::glob_match patterns through the one rule engine (domain(<entry>)), so a bare hostname still matches exactly as before and *.example.com now works too.

deny_domains: Vec<String>

These hosts are always denied, even if also present in allow_domains. Same pattern treatment as Self::allow_domains.

Implementations

impl NetworkPolicy

pub fn domain_rule_set(&self) -> (RuleSet, Decision)

BP-10 (catalog row “Allow/ask/deny rule language”, the DOMAIN subject): this policy’s two lists expressed IN the rule algebra — a crate::permissions::RuleSet of domain(...) patterns plus the baseline crate::permissions::Decision a host matching nothing gets.

An allowlist is not a deny rule: in a deny→ask→allow FIRST-MATCH engine “only these hosts” is expressed by the BASELINE being Deny, with each allowed host in the allow tier — a domain(*) deny rule would (correctly, per tier priority) also swallow the allowlist. Empty allow_domains keeps the baseline Allow, which is why a pure denylist behaves exactly as it did before this translation existed.

Trait Implementations

impl Clone for NetworkPolicy

fn clone(&self) -> NetworkPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for NetworkPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for NetworkPolicy

fn default() -> NetworkPolicy

Returns the “default value” for a type.