Struct PermissionEngine 

pub struct PermissionEngine { /* private fields */ }

Ordered list of permission rules consulted by the executor before every tool call.

Implementations

impl PermissionEngine

pub fn new() -> Self

pub fn add_rule(&mut self, rule: PermissionRule)

Append a rule; later rules override earlier ones when both match.

pub fn evaluate(&self, tool_name: &str) -> Option<RuleDecision>

Evaluate a tool by name only — ignores command/cwd filters.

Returns None if no rule matches, leaving the decision to the tool itself.

pub fn evaluate_call( &self, tool_name: &str, arguments: &Value, cwd: &Path, ) -> Option<RuleDecision>

Evaluate a tool call against all rules. Later rules override earlier ones.

pub fn evaluate_call_any( &self, tool_names: &[&str], arguments: &Value, cwd: &Path, ) -> Option<RuleDecision>

Evaluate a tool call against any accepted tool name for that tool.

This preserves the usual “last matching rule wins” behavior across canonical names and legacy aliases.

pub fn evaluate_shell_call( &self, shell_kind: ShellKind, tool_names: &[&str], command: &str, _arguments: &Value, cwd: &Path, ) -> Option<RuleDecision>

Evaluate a shell-style tool call using an extracted command prefix.

For rules with a command_prefix, the prefix is matched against the normalized command prefix produced by extract_command_prefix. This is stricter than raw string matching: it strips trailing arguments and redirects, but also refuses to match when the command contains injection-like constructs.

Rules without a command_prefix still match on tool name and cwd as usual, so a blanket deny_tool("Bash") continues to work.

Trait Implementations

impl Clone for PermissionEngine

fn clone(&self) -> PermissionEngine

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PermissionEngine

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for PermissionEngine

fn default() -> Self

Returns the “default value” for a type.