Struct ExfiltrationGuard 

pub struct ExfiltrationGuard { /* private fields */ }

Stateless exfiltration guard. All three scanners are independently toggled via config.

Construct once from ExfiltrationGuardConfig and store on the agent. Cheap to clone.

Implementations

impl ExfiltrationGuard

pub fn new(config: ExfiltrationGuardConfig) -> ExfiltrationGuard

Create a new guard from the given configuration.

pub fn scan_output(&self, text: &str) -> (String, Vec<ExfiltrationEvent>)

Scan LLM output text and strip external markdown images.

Returns the cleaned text and a list of ExfiltrationEvent::MarkdownImageBlocked for each image that was removed.

When block_markdown_images is false, returns the input unchanged.

Scanning coverage

• Inline images: ![alt](https://evil.com/track.gif)
• Reference-style images: ![alt][ref] + [ref]: https://evil.com/img
• Percent-encoded URLs inside already-captured groups: decoded before is_external_url()

Not covered (Phase 5, tracked in #1195)

• Percent-encoded scheme bypass: %68ttps://evil.com — the regex requires literal https?://, so a percent-encoded scheme is never captured. Fix requires pre-decoding the full input text before regex matching.
• HTML <img src="..."> tags
• Unicode zero-width joiner tricks (!\u{200B}[alt](url))
• Reference definitions inside fenced code blocks (false positive risk)

Panics

Panics if the compiled regex does not produce expected capture groups (compile-time guarantee — the regex patterns are validated via expect in LazyLock initializers).

pub fn validate_tool_call( &self, tool_name: &str, args_json: &str, flagged_urls: &HashSet<String>, ) -> Vec<ExfiltrationEvent>

Validate tool call arguments against a set of URLs flagged in untrusted content.

Parses args_json as a JSON value and extracts all string leaves recursively to avoid JSON-encoding bypasses (escaped slashes, unicode escapes, etc.).

Returns one ExfiltrationEvent::SuspiciousToolUrl per matching URL. When validate_tool_urls is false, always returns an empty vec.

Flag-only approach

Matching URLs are logged and counted but tool execution is NOT blocked. Blocking would break legitimate workflows where the same URL appears in both a search result and a subsequent fetch call. See design decision D1 in the architect handoff.

pub fn should_guard_memory_write( &self, has_injection_flags: bool, ) -> Option<ExfiltrationEvent>

Check whether a memory write should skip Qdrant embedding.

Returns Some(MemoryWriteGuarded) when has_injection_flags is true and guard_memory_writes is enabled. The caller should still save to SQLite for conversation continuity but omit the Qdrant embedding to prevent poisoned content from polluting semantic search results.

See design decision D2 in the architect handoff.

Trait Implementations

impl Clone for ExfiltrationGuard

fn clone(&self) -> ExfiltrationGuard

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ExfiltrationGuard

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.