Struct NetworkDenyToolExecutor 

pub struct NetworkDenyToolExecutor { /* private fields */ }

Blocks network-egress tool calls for a single sub-agent spawn.

Wraps an ErasedToolExecutor and rejects two classes of call with ToolError::Blocked:

• Any call to a network-only tool (web_scrape, fetch, web_search) — blocked unconditionally, since these tools have no non-network purpose.
• bash tool calls whose command matches zeph_tools::NETWORK_COMMANDS (curl, wget, nc/ncat/netcat, ssh/scp/rsync, openssl s_client, socat, python3 -c/python -c/perl -e/ruby -e one-liners, and the /dev/tcp//dev/udp bash pseudo-devices).

All other tool calls pass through unchanged. Known gaps: MCP-provided tools (which may perform their own HTTP egress) are not inspected — see specs/069-threat-model/spec.md INVARIANT-5. The bash command match is a name/prefix blocklist (see zeph_tools::NETWORK_COMMANDS doc for its own residual gaps — flag insertion before -c/-e, versioned/alternate interpreter names, non-transparent wrapper commands like busybox) — this is a best-effort, tool/command-identity block, not a sandbox boundary.

Installed by build_filtered_executor (crate::manager::spawn) when the spawning task carries NetworkScope::Deny (spec 069-threat-model OQ-1). Unlike mutating ShellConfig’s allow_network field directly, this wrapper scopes the restriction to a single spawn without affecting the shared tool_executor used by the parent agent and sibling tasks.

Implementations

impl NetworkDenyToolExecutor

pub fn new(inner: Arc<dyn ErasedToolExecutor>) -> Self

Wrap inner, blocking network-egress tool calls for every call.

Trait Implementations

impl ErasedToolExecutor for NetworkDenyToolExecutor

fn execute_erased<'a>( &'a self, response: &'a str, ) -> Pin<Box<dyn Future<Output = Result<Option<ToolOutput>, ToolError>> + Send + 'a>>

fn execute_confirmed_erased<'a>( &'a self, response: &'a str, ) -> Pin<Box<dyn Future<Output = Result<Option<ToolOutput>, ToolError>> + Send + 'a>>

fn tool_definitions_erased(&self) -> Vec<ToolDef>

fn execute_tool_call_erased<'a>( &'a self, call: &'a ToolCall, ) -> Pin<Box<dyn Future<Output = Result<Option<ToolOutput>, ToolError>> + Send + 'a>>

fn execute_tool_call_confirmed_erased<'a>( &'a self, call: &'a ToolCall, ) -> Pin<Box<dyn Future<Output = Result<Option<ToolOutput>, ToolError>> + Send + 'a>>

Required (no default). TrustGateExecutor-style wrappers that override ToolExecutor::execute_tool_call_confirmed reach it through the blanket impl below. Other implementors should fall back to execute_tool_call_erased (normal enforcement path) unless they need to replicate confirmed-path-specific behavior (e.g. a fallback that only applies on the unconfirmed path must be mirrored explicitly, not assumed). See erased_tool_executor_no_inner_defaults! for leaf executors with no wrapped inner.

fn set_skill_env(&self, env: Option<HashMap<String, String>>)

Inject environment variables for the currently active skill. No-op by default.

fn set_effective_trust(&self, level: SkillTrustLevel)

Set the effective trust level for the currently active skill. No-op by default.

fn is_tool_retryable_erased(&self, tool_id: &str) -> bool

Whether the executor can safely retry this tool call on a transient error.

fn requires_confirmation_erased(&self, call: &ToolCall) -> bool

Return true when call would require user confirmation before execution.

fn checkpoint_undo_erased(&self, n: usize) -> CheckpointActionResult

Undo the last n checkpointed write commands.

fn checkpoint_redo_erased(&self) -> CheckpointActionResult

Redo the last undone checkpoint.

fn checkpoint_list_erased(&self) -> CheckpointListResult

List the current undo stack entries and redo depth.

fn is_tool_speculatable_erased(&self, tool_id: &str) -> bool

Whether a tool call can be safely dispatched speculatively.