vetto 0.2.16

Daemon-less sandbox + security layer for AI coding agents (Landlock/Seatbelt, TUI statusline, post-session audit reports)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

[metadata]
name = "opencode"
description = "Safe compatibility roots for OpenCode CLI."

[filesystem]
allow_write = [
  "$HOME/.config/opencode",
  "$HOME/.local/share/opencode",
  "$HOME/.opencode",
  "$AGENT",
]
allow_read = [
  "$HOME/.config/opencode",
  "$HOME/.local/share/opencode",
  "$HOME/.opencode",
  "$HOME/.local/bin",
  "$AGENT",
]

[environment]
pass_through = [
  "OPENCODE_*",
  "OPENAI_API_KEY",
  "OPENAI_BASE_URL",
  "ANTHROPIC_API_KEY",
  "ANTHROPIC_BASE_URL",
  "OPENROUTER_API_KEY",
]

[display_only_deny]
paths = [
  "$AGENT/*.sock",
  "$AGENT/*.ipc",
]