vetto 0.2.22

Daemon-less sandbox + security layer for AI coding agents (Landlock/Seatbelt, TUI statusline, post-session audit reports)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

//! Descendants inherit filesystem and network enforcement.  A setsid child is
//! intentionally included: FS-ONLY may not be able to reap it, but it still
//! must not escape Landlock or inherited seccomp.

#[cfg(target_os = "linux")]
use crate::common::*;

#[test]
#[cfg(target_os = "linux")]
fn detached_subagent_cannot_read_secrets_or_use_network() {
    if !have_landlock() {
        eprintln!("SKIP: no Linux enforcement tier on this machine");
        return;
    }
    ensure_fake_ssh_key();
    let project = TempProject::new("subagent");
    write_file(&project.path().join(".env"), "SUBAGENT_SECRET=1\n");
    let script = stage_fixture(project.path(), "subagent_attack.sh");
    let out = run_vetto_in(project.path(), &["--tui=none", "--", "sh", &script]);
    let text = stdout(&out);
    for marker in [
        "LEAK-SUBAGENT-SSH",
        "LEAK-SUBAGENT-ENV",
        "LEAK-SUBAGENT-NET",
    ] {
        assert!(
            !text.contains(marker),
            "subagent leaked via {marker}: {text}"
        );
    }
    assert!(
        text.contains("subagent-finished"),
        "stdout={text} stderr={}",
        stderr(&out)
    );
}

#[test]
#[cfg(not(target_os = "linux"))]
fn linux_only() {}