Struct SecurityConfig 

pub struct SecurityConfig {
    pub gateway_api_key: Option<String>,
    pub allowed_read_paths: Vec<PathBuf>,
    pub allowed_write_paths: Vec<PathBuf>,
    pub approval_mode: String,
    pub rate_limit_rpm: Option<u32>,
    pub terminal_sandbox: TerminalSandbox,
    pub terminal_sandbox_image: String,
    pub terminal_sandbox_opts: Vec<String>,
}

Security-related settings grouped together (mirrors CompressionConfig / NetworkConfig pattern).

Fields

gateway_api_key: Option<String>

Bearer token required on /chat* endpoints. None = open (warn at startup).

allowed_read_paths: Vec<PathBuf>

Allowed root paths for read_file tool. Defaults to cwd + home.

allowed_write_paths: Vec<PathBuf>

Allowed root paths for write_file tool. Defaults to cwd only.

approval_mode: String

Command approval mode: “auto” | “smart” | “deny”. Default “smart”.

rate_limit_rpm: Option<u32>

Per-IP rate limit in requests/minute. None = disabled.

terminal_sandbox: TerminalSandbox

Terminal execution sandbox. Default “none” (direct host execution).

terminal_sandbox_image: String

Docker image used when terminal_sandbox = docker. Default “ubuntu:24.04”.

terminal_sandbox_opts: Vec<String>

Extra docker run flags appended after the hardened defaults. Example: ["--network=none", "--memory=512m", "--cpus=0.5"]

Trait Implementations

impl Clone for SecurityConfig

fn clone(&self) -> SecurityConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecurityConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SecurityConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SecurityConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.