Crate vetto 

Reusable vetto components.

The binary in main is intentionally a thin session orchestrator. Keeping the implementation modules behind this library boundary lets integration tests, benchmarks, and downstream tooling use the same policy, sandbox, observation, PTY, and report code as the CLI.

Modules

audit

Audit history indexing, session security inspection, and daily digest.

classifier

Coarse classification of observed operations for stats and reports.

cli

config

Fully-parsed runtime configuration derived from the CLI and global config hierarchy.

cred_broker

Credential Broker (Feature 26).

daemon

Vetto Multiplexer Daemon and Session Orchestrator.

doctor

Optional diagnostics exposed by explicit actions only: doctor flags and the verify boundary battery. Probing is never implicit in policy loading or sandbox setup.

error

events

exit_codes

Stable exit codes and mapping functions for vetto.

history

Session history tracking and automated timeout estimation (--timeout auto).

init

Project ecosystem detection, interactive wizard, and tailored policy generation for vetto init.

logger

Logging: tracing diagnostics on STDERR (stdout belongs to the sandboxed agent’s pass-through and must never carry vetto output) + the JSONL event sink with BEST-EFFORT secret redaction.

mcp

MCP (Model Context Protocol) stdio JSON-RPC server implementation for vetto.

multi

Multi-agent orchestration primitives.

notify

Desktop notifications on security violations (Feature 41).

onboard

Zero-config AI agent onboarding and automatic detection.

policy

profile

Workspace profiles storage and dispatch.

pty

PTY plumbing for statusline pass-through and live ANSI/streaming redaction.

redteam

Red team attack battery for verifying sandbox containment and kernel isolation.

remote

Remote sandboxing client and server orchestration over SSH / loopback REST API.

report

Post-session audit reports (HTML / Markdown / JSON / SARIF).

rescue

sandbox

Sandbox backends and the fail-closed factory.

shim

Fast native shim dispatcher & recursion barrier (Step 15).

telemetry

Optional, privacy-preserving post-session telemetry.

tour

Interactive onboarding tutorial (vetto tour).

tui

Terminal UI: statusline pass-through + full dashboard.

verify

Boundary verification battery: prove from inside a throwaway sandbox that the resolved policy actually denies secret reads, host loopback connects, and writes outside every write root.

version

Release engineering, version banners, upgrade detection, and channel management.

watch

Watch Mode (Feature 35).

watchdog

Autonomous Loop & Token Burn Watchdog.