vetto 0.2.19

Daemon-less sandbox + security layer for AI coding agents (Landlock/Seatbelt, TUI statusline, post-session audit reports)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73

# vetto policy profile: default
# $PROJECT expands to the sandboxed working directory, $HOME to the user home.
# Globs are resolved at LOAD TIME into concrete paths (see ARCHITECTURE.md).

[filesystem]
# Project + temp: read-write. /dev/null is writable so shell redirections
# like `>/dev/null` keep working (it is a pure sink, never a secret).
allow_write = ["$PROJECT", "/tmp", "/dev/null"]

# System + toolchains + dependency caches: read-only
allow_read = [
  "/usr", "/bin", "/sbin", "/lib", "/lib64",
  "/dev/null", "/dev/zero", "/dev/urandom", "/dev/random",
  "/etc/ld.so.cache", "/etc/ssl", "/etc/resolv.conf", "/etc/ca-certificates", "/etc/pki",
  "/etc/hosts", "/etc/nsswitch.conf",
  "$HOME/.local/bin", "$HOME/.cargo/bin", "$HOME/.local/share",
  "$HOME/.cargo/registry", "$HOME/.cargo/git", "$HOME/.cargo/config.toml",
  "$HOME/.rustup",
  "$HOME/.npm/_cacache",
  "$HOME/.cache/pip", "$HOME/.cache/uv",
  "$HOME/go/pkg/mod",
  "$HOME/.local/share/pnpm/store",
  "$HOME/.gradle/caches", "$HOME/.m2/repository",
  "$HOME/.gitconfig",
]

# Only these safe session variables reach the agent. Exact names are allowed;
# a trailing `*` is a prefix pattern. Credential variables (GH_TOKEN,
# OPENAI_API_KEY, AWS_*, ANTHROPIC_API_KEY) are intentionally absent.
[environment]
pass_through = [
  "HOME", "PATH", "SHELL", "USER", "LOGNAME",
  "TERM", "COLORTERM", "LANG", "LC_*",
  "TMPDIR", "PWD", "OLDPWD", "XDG_RUNTIME_DIR", "XDG_CONFIG_HOME",
  "NO_COLOR", "CI", "TERM_PROGRAM",
]

# Resource ceilings applied right before the agent execve. Any --limits CLI
# value merges strictest-wins on top of these; file_size_bytes stays unset
# (no ceiling on created file sizes).
[limits]
cpu_seconds = 14400
address_space_bytes = 8589934592
processes = 2048
open_files = 1024


[display_only_deny]
# NOT an enforcement mechanism by itself. Documentation + doctor probes;
# on Linux Tier FULL these paths are additionally masked with bind-mount
# overlays (/dev/null or empty tmpfs) inside the sandbox mount namespace.
paths = [
  "$HOME/.ssh", "$HOME/.aws", "$HOME/.gnupg",
  "$HOME/.npmrc", "$HOME/.git-credentials", "$HOME/.netrc",
  "$HOME/.cargo/credentials", "$HOME/.cargo/credentials.toml",
  "$HOME/.config/gh", "$HOME/.config/github-copilot",
  "$HOME/.config/gcloud", "$HOME/.kube", "$HOME/.docker/config.json",
  "$HOME/.claude", "$HOME/.codex",
  "$PROJECT/.env", "$PROJECT/.env.*",
  "$PROJECT/**/.env", "$PROJECT/**/.env.*",
  "$PROJECT/*.pem", "$PROJECT/**/*.pem",
  "$PROJECT/*.key", "$PROJECT/**/*.key",
  "$PROJECT/*.p12", "$PROJECT/**/*.p12",
  "$PROJECT/*.pfx", "$PROJECT/**/*.pfx",
  "$PROJECT/*.kdbx", "$PROJECT/**/*.kdbx",
  "$PROJECT/.[eE][nN][vV]", "$PROJECT/.[eE][nN][vV].*",
  "$PROJECT/**/.[eE][nN][vV]", "$PROJECT/**/.[eE][nN][vV].*",
  "$PROJECT/*.[pP][eE][mM]", "$PROJECT/**/*.[pP][eE][mM]",
  "$PROJECT/*.[kK][eE][yY]", "$PROJECT/**/*.[kK][eE][yY]",
  "$PROJECT/*.[pP]12", "$PROJECT/**/*.[pP]12",
  "$PROJECT/*.[pP][fF][xX]", "$PROJECT/**/*.[pP][fF][xX]",
  "$PROJECT/*.[kK][dD][bB][xX]", "$PROJECT/**/*.[kK][dD][bB][xX]",
]