Module verifier 

Pre-execution verification for tool calls.

Based on the TrustBench pattern (arXiv:2603.09157): intercept tool calls before execution to block or warn on destructive or injection patterns.

Blocklist separation

DESTRUCTIVE_PATTERNS (this module) is intentionally separate from DEFAULT_BLOCKED_COMMANDS in shell.rs. The two lists serve different purposes:

• DEFAULT_BLOCKED_COMMANDS — shell safety net: prevents the shell executor from running network tools (curl, wget, nc) and a few destructive commands. It is applied at tool-execution time by ShellExecutor.

• DESTRUCTIVE_PATTERNS — pre-execution guard: targets filesystem/system destruction commands (disk formats, wipefs, fork bombs, recursive permission changes). It runs before dispatch, in the LLM-call hot path, and must not be conflated with the shell safety net to avoid accidental allow-listing via config drift.

Overlap (3 entries: rm -rf /, mkfs, dd if=) is intentional — belt-and-suspenders.

Structs

DestructiveCommandVerifier

Verifier that blocks destructive shell commands (e.g., rm -rf /, dd, mkfs) before the shell tool executes them.

FirewallVerifier

Policy-enforcement verifier that inspects tool arguments for path traversal, environment-variable exfiltration, sensitive file access, and command chaining.

InjectionPatternVerifier

Verifier that blocks tool arguments containing SQL injection, command injection, or path traversal patterns. Applies to ALL tools using field-aware matching.

UrlGroundingVerifier

Verifier that blocks fetch and web_scrape calls when the requested URL was not explicitly provided by the user in the conversation.

Enums

VerificationResult

Result of a pre-execution verification check.

Traits

PreExecutionVerifier

Pre-execution verification trait. Implementations intercept tool calls before the executor runs them. Based on TrustBench pattern (arXiv:2603.09157).