Module exec_policy 

Execution Policy Module

Provides types and managers for controlling command execution authorization, inspired by OpenAI Codex’s execution policy patterns.

Architecture

• approval: Approval requirement types (ExecApprovalRequirement, AskForApproval)
• policy: Policy definitions and rule matching (Policy, PrefixRule, Decision)
• parser: Policy file parsing (TOML, JSON, simple formats)
• manager: The central ExecPolicyManager coordinating all components

Example

use vtcode_core::exec_policy::{ExecPolicyManager, Decision};

let manager = ExecPolicyManager::with_defaults(workspace_root);
manager.add_prefix_rule(&["cargo".to_string()], Decision::Allow).await?;

let result = manager.check_approval(&["cargo", "build"]).await;

Modules

command_validation

Structs

ExecPolicyAmendment

A proposed amendment to the execution policy.

ExecPolicyConfig

Configuration for the execution policy manager.

ExecPolicyManager

Manages execution policies and authorization decisions.

Policy

Execution policy containing rules for command authorization.

PolicyEvaluation

Result of evaluating multiple commands against a policy.

PolicyFile

A serializable policy file format.

PolicyParser

Parser for policy files.

PolicyRule

A single rule in the policy file.

PrefixRule

A prefix-based rule for matching commands.

RejectConfig

Fine-grained rejection controls for approval prompts.

Enums

AskForApproval

Policy for when to ask for approval before executing commands.

Decision

Decision made by a policy rule.

ExecApprovalRequirement

Requirement for approval before executing a command.

RuleMatch

Result of matching a command against a rule.

Functions

default_exec_approval_requirement

Compute the default approval requirement for a tool invocation.

rules_layers

Canonical rule-file layers for workspace_root, highest precedence first: <workspace>/.vtcode/rules/*.rules (project rules) over ~/.vtcode/rules/*.rules (user rules). Files within a directory load in sorted order; missing directories yield no layers.

shared_exec_policy_manager_with_rules

Create a shared manager with the default rule layers for workspace_root auto-loaded (see rules_layers). Missing rule directories are fine; errors from unreadable or malformed files propagate.

Type Aliases

SharedExecPolicyManager

Shared reference to an ExecPolicyManager.