Struct RuleSet 

pub struct RuleSet {
    pub deny: Vec<String>,
    pub ask: Vec<String>,
    pub allow: Vec<String>,
}

A first-match deny→ask→allow rule set (§2 module 11, C5). Each list holds pattern strings in one of two forms:

• "toolname" / "toolname*" (a bare glob, crate::config::glob_match syntax) — matches by TOOL NAME only, e.g. "tools_question", "bash*".
• "toolname(cmdglob)" — matches tool name (itself a glob) AND the canonicalized command/path text (also a glob) against RuleSet::evaluate’s subject argument, e.g. "bash(rm -rf*)", "read(*.env)", "write(.git/**)". The read(...)/write(...) pseudo-tool names are how path rules (module 11’s “read/write path rules”) and protected paths (module 13, via crate::permissions::protected_path_rules) both reuse this one engine instead of inventing a parallel path-matching mechanism.
• "*" — matches everything (any tool, any subject).

Fields

deny: Vec<String>

Hard floor — checked first; a match here can never be overridden.

ask: Vec<String>

Checked second.

allow: Vec<String>

Checked last.

Implementations

impl RuleSet

pub fn is_empty(&self) -> bool

Whether this rule set has no rules in any tier (a no-op engine — every decision falls through to the caller’s default).

pub fn evaluate(&self, tool: &str, subject: Option<&str>) -> Option<Decision>

deny→ask→allow first-match, generically, against tool + subject (the canonical command text, a resolved path, or None for a tool call this rule set has no richer subject for — see rule_matches’s doc comment on why a None subject only matches bare tool-name-glob rules, never a tool(pattern) rule). Returns None when nothing in any tier matches — the caller decides the fallback (see evaluate_command/evaluate_path).

Trait Implementations

impl Clone for RuleSet

fn clone(&self) -> RuleSet

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RuleSet

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for RuleSet

fn default() -> RuleSet

Returns the “default value” for a type.

impl Eq for RuleSet

impl PartialEq for RuleSet

fn eq(&self, other: &RuleSet) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for RuleSet