vetto 0.2.13

Daemon-less sandbox + security layer for AI coding agents (Landlock/Seatbelt, TUI statusline, post-session audit reports)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

# vetto policy profile: audit
# Same filesystem semantics as `default`. Intended to be combined with:
#   vetto --profile audit --observe-seccomp --jsonl session.jsonl --report html,md -- <agent>
# Enforcement is identical; this profile exists so audit-focused sessions are
# explicit in shell history and reports.

[filesystem]
allow_write = ["$PROJECT", "/tmp", "/dev/null"]

allow_read = [
  "/usr", "/bin", "/sbin", "/lib", "/lib64",
  "/dev/null", "/dev/zero", "/dev/urandom", "/dev/random",
  "/etc/ld.so.cache", "/etc/ssl", "/etc/resolv.conf", "/etc/ca-certificates", "/etc/pki",
  "/etc/hosts", "/etc/nsswitch.conf",
  "$HOME/.local/bin", "$HOME/.cargo/bin", "$HOME/.local/share",
  "$HOME/.cargo/registry", "$HOME/.cargo/git", "$HOME/.cargo/config.toml",
  "$HOME/.rustup",
  "$HOME/.npm/_cacache",
  "$HOME/.cache/pip", "$HOME/.cache/uv",
  "$HOME/go/pkg/mod",
  "$HOME/.local/share/pnpm/store",
  "$HOME/.gradle/caches", "$HOME/.m2/repository",
  "$HOME/.gitconfig",
]

[environment]
pass_through = [
  "HOME", "PATH", "SHELL", "USER", "LOGNAME",
  "TERM", "COLORTERM", "LANG", "LC_*",
  "TMPDIR", "PWD", "OLDPWD", "XDG_RUNTIME_DIR", "XDG_CONFIG_HOME",
  "NO_COLOR", "CI", "TERM_PROGRAM",
]

[display_only_deny]
paths = [
  "$HOME/.ssh", "$HOME/.aws", "$HOME/.gnupg",
  "$HOME/.npmrc", "$HOME/.git-credentials", "$HOME/.netrc",
  "$HOME/.cargo/credentials", "$HOME/.cargo/credentials.toml",
  "$HOME/.config/gh", "$HOME/.config/github-copilot",
  "$HOME/.config/gcloud", "$HOME/.kube", "$HOME/.docker/config.json",
  "$HOME/.claude", "$HOME/.codex",
  "$PROJECT/.env", "$PROJECT/.env.*",
  "$PROJECT/**/.env", "$PROJECT/**/.env.*",
  "$PROJECT/*.pem", "$PROJECT/**/*.pem",
  "$PROJECT/*.key", "$PROJECT/**/*.key",
  "$PROJECT/*.p12", "$PROJECT/**/*.p12",
  "$PROJECT/*.pfx", "$PROJECT/**/*.pfx",
  "$PROJECT/*.kdbx", "$PROJECT/**/*.kdbx",
  "$PROJECT/.[eE][nN][vV]", "$PROJECT/.[eE][nN][vV].*",
  "$PROJECT/**/.[eE][nN][vV]", "$PROJECT/**/.[eE][nN][vV].*",
  "$PROJECT/*.[pP][eE][mM]", "$PROJECT/**/*.[pP][eE][mM]",
  "$PROJECT/*.[kK][eE][yY]", "$PROJECT/**/*.[kK][eE][yY]",
  "$PROJECT/*.[pP]12", "$PROJECT/**/*.[pP]12",
  "$PROJECT/*.[pP][fF][xX]", "$PROJECT/**/*.[pP][fF][xX]",
  "$PROJECT/*.[kK][dD][bB][xX]", "$PROJECT/**/*.[kK][dD][bB][xX]",
]