Module config 

Edge-resolved configuration.

Config is the single value that carries all environment-derived state through the crate. Library code never reads std::env directly — the binary’s main resolves the env once into a Config and passes &Config down the call graph.

Why this lives here

Env reads are a side effect of the process boundary. Putting them in library functions makes the library:

• unsafe to test in parallel (process env is global mutable state)
• dependent on global ordering (which fn ran first wins)
• untestable without unsafe { set_var } in tests

By contrast, with Config resolved once at the outer rim and threaded through as &Config:

• tests construct a Config with literal field values; no env writes
• the only place that needs env-mock testing is Config::from_env_lookup, which is a pure function over an injectable lookup closure
• the binary’s main is the only place that calls Config::from_env (= std::env::var)

What env vars are read

Var	Field	Default
AGENTSEC_HOME	Paths::home	$HOME/.agentsec ↓
HOME	Paths::user_home (and home fallback)	.
ANTHROPIC_API_KEY	LlmConfig::api_key	None (semantic sanitize layer no-op)
AGENTSEC_LLM_MODEL	LlmConfig::model	claude-haiku-4-5-20251001

Structs

Config

All edge-resolved runtime configuration. Constructed once by the binary’s main and passed by reference to library functions.

LlmConfig

Semantic-sanitize-layer configuration. See crate::web::sanitize::semantic_layer for fail-open semantics.

Paths

Filesystem paths. See crate root §Runtime data root for the layout rules and crate root §Read-only invariants for what may / may not be written.

Constants

DEFAULT_LLM_MODEL

Default LLM model id used when AGENTSEC_LLM_MODEL is not set.