Struct FirewallVerifier 

pub struct FirewallVerifier { /* private fields */ }

Policy-enforcement verifier that inspects tool arguments for path traversal, environment-variable exfiltration, sensitive file access, and command chaining.

Scope delineation with InjectionPatternVerifier

FirewallVerifier enforces configurable policy (blocked paths, env vars, sensitive file patterns). InjectionPatternVerifier performs regex-based injection pattern detection (prompt injection, SSRF, etc.). They are complementary — belt-and-suspenders, the same intentional overlap documented at the top of this module.

Both verifiers may produce Block for the same call (e.g. command chaining detected by both). The pipeline stops at the first Block result.

Implementations

impl FirewallVerifier

pub fn new(config: &FirewallVerifierConfig) -> Self

Build a FirewallVerifier from config.

Invalid glob patterns in blocked_paths are logged at WARN level and skipped.

Trait Implementations

impl Debug for FirewallVerifier

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PreExecutionVerifier for FirewallVerifier

fn name(&self) -> &'static str

Human-readable name for logging and TUI display.

fn verify(&self, tool_name: &str, args: &Value) -> VerificationResult

Verify whether a tool call should proceed.