Struct SafetyConfig 

pub struct SafetyConfig {
    pub mode: SafetyMode,
    pub checkpoint_on_mutation: bool,
    pub network: NetworkPolicy,
    pub filesystem: FilesystemPolicy,
    pub overrides: Vec<PolicyOverride>,
    pub external_writes: FloorLevel,
    pub system_installs: FloorLevel,
    pub auto_classifier_model: Option<String>,
    pub allow_untrusted_headless_tools: bool,
}

Fields

mode: SafetyMode

checkpoint_on_mutation: bool

network: NetworkPolicy

Network access policy for shell commands. Deny installs the OS network kill-switch on Linux. See NetworkPolicy.

filesystem: FilesystemPolicy

Filesystem write policy for shell commands. Project confines writes to the project/temp//dev directories on Linux. See FilesystemPolicy.

overrides: Vec<PolicyOverride>

external_writes: FloorLevel

Enforcement floor for write-shaped MCP tools (no server-advertised readOnlyHint): allow | auto | ask | deny. Safety mode alone never authorizes an external side effect — with the default auto, even full_access routes MCP writes through the intent classifier (aligned runs silently, off-task escalates). allow restores the old unconditional-allow behavior.

system_installs: FloorLevel

Enforcement floor for machine-scoped package operations (npm -g, cargo install, pip install, brew/apt/winget installs) — same levels and default as external_writes. They mutate the MACHINE, not the project (outside checkpoint reach), so even full_access vets them. Project-local installs (npm install, cargo add) are untouched.

auto_classifier_model: Option<String>

Model id the Auto-mode safety classifier uses to vet borderline actions. None ⇒ vet with the session’s active model. Set this to point the vet at a cheaper/faster model than the one driving the work.

allow_untrusted_headless_tools: bool

Headless escape hatch: when true, non-replayable tools (web/mcp/ subagent/computer_use) are allowed to PROCEED on an Ask decision in a headless run (no approval UI) instead of being blocked. Default false — mermaid run in ask mode otherwise refuses these. Set via --allow-untrusted-tools or config for CI that needs them.

Trait Implementations

impl Clone for SafetyConfig

fn clone(&self) -> SafetyConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SafetyConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SafetyConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SafetyConfig

where SafetyConfig: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SafetyConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.