Struct HushEngine 

pub struct HushEngine { /* private fields */ }

The main security enforcement engine

Implementations

impl HushEngine

pub fn new() -> Self

Create a new engine with default policy

pub fn builder(policy: Policy) -> HushEngineBuilder

pub fn with_policy(policy: Policy) -> Self

Create with a specific policy

pub fn from_ruleset(name: &str) -> Result<Self>

Create from a named ruleset

pub fn with_keypair(self, keypair: Keypair) -> Self

Set the signing keypair

pub fn with_generated_keypair(self) -> Self

Generate a new signing keypair

pub fn with_extra_guard<G>(self, guard: G) -> Self

where G: Guard + 'static,

Append an additional guard (evaluated after all built-in guards).

Note: when fail_fast is enabled, guards after the first violation (including extras) will not run.

pub fn with_extra_guard_box(self, guard: Box<dyn Guard>) -> Self

Append an additional guard (evaluated after all built-in guards).

Note: when fail_fast is enabled, guards after the first violation (including extras) will not run.

pub fn add_extra_guard<G>(&mut self, guard: G) -> &mut Self

where G: Guard + 'static,

Append an additional guard (evaluated after all built-in guards).

Note: when fail_fast is enabled, guards after the first violation (including extras) will not run.

pub fn add_extra_guard_box(&mut self, guard: Box<dyn Guard>) -> &mut Self

Append an additional guard (evaluated after all built-in guards).

Note: when fail_fast is enabled, guards after the first violation (including extras) will not run.

pub fn policy_hash(&self) -> Result<Hash>

Get the policy hash (derived from the policy YAML).

Note: this does not include any runtime extra_guards.

pub fn policy(&self) -> &Policy

Get the active policy.

pub fn policy_yaml(&self) -> Result<String>

Get the active policy YAML.

pub fn keypair(&self) -> Option<&Keypair>

Get the signing keypair, if configured.

pub async fn check_file_access( &self, path: &str, context: &GuardContext, ) -> Result<GuardResult>

Check a file access action

pub async fn check_file_write( &self, path: &str, content: &[u8], context: &GuardContext, ) -> Result<GuardResult>

Check a file write action

pub async fn check_egress( &self, host: &str, port: u16, context: &GuardContext, ) -> Result<GuardResult>

Check a network egress action

pub async fn check_shell( &self, command: &str, context: &GuardContext, ) -> Result<GuardResult>

Check a shell command action

pub async fn check_mcp_tool( &self, tool: &str, args: &Value, context: &GuardContext, ) -> Result<GuardResult>

Check an MCP tool invocation

pub async fn check_untrusted_text( &self, source: Option<&str>, text: &str, context: &GuardContext, ) -> Result<GuardResult>

Check untrusted text (e.g. fetched web content) for prompt-injection signals.

This uses GuardAction::Custom("untrusted_text", ...) and is evaluated by PromptInjectionGuard.

pub async fn check_patch( &self, path: &str, diff: &str, context: &GuardContext, ) -> Result<GuardResult>

Check a patch action

pub async fn check_action( &self, action: &GuardAction<'_>, context: &GuardContext, ) -> Result<GuardResult>

Check any action against all applicable guards

pub async fn check_action_report( &self, action: &GuardAction<'_>, context: &GuardContext, ) -> Result<GuardReport>

Check any action and return per-guard evidence plus the aggregated verdict.

pub async fn check_action_report_with_posture( &self, action: &GuardAction<'_>, context: &GuardContext, posture_state: &mut Option<PostureRuntimeState>, ) -> Result<PostureAwareReport>

Check an action and update posture runtime state (if posture is configured).

pub async fn create_receipt(&self, content_hash: Hash) -> Result<Receipt>

Create a receipt for the current session

pub async fn create_signed_receipt( &self, content_hash: Hash, ) -> Result<SignedReceipt>

Create and sign a receipt

pub async fn stats(&self) -> EngineStats

Get session statistics

pub async fn reset(&self)

Reset session state

Trait Implementations

impl Default for HushEngine

fn default() -> Self

Returns the “default value” for a type.