vtcode_config/core/
security.rs

1use crate::env_helpers::default_true;
2use serde::{Deserialize, Serialize};
3
4/// Gatekeeper mitigation configuration (macOS only)
5#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
6#[derive(Debug, Clone, Deserialize, Serialize)]
7pub struct GatekeeperConfig {
8    /// Warn when a quarantined executable is detected
9    #[serde(default = "default_true")]
10    pub warn_on_quarantine: bool,
11
12    /// Attempt to clear quarantine automatically (opt-in)
13    #[serde(default)]
14    pub auto_clear_quarantine: bool,
15
16    /// Paths eligible for quarantine auto-clear
17    #[serde(default = "default_gatekeeper_auto_clear_paths")]
18    pub auto_clear_paths: Vec<String>,
19}
20
21/// Security configuration
22#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
23#[derive(Debug, Clone, Deserialize, Serialize)]
24pub struct SecurityConfig {
25    /// Require human confirmation for critical actions
26    #[serde(default = "default_true")]
27    pub human_in_the_loop: bool,
28
29    /// Require a successful write tool before accepting claims like
30    /// "I've updated the file" as applied. When true, such claims are
31    /// treated as proposals unless a write tool executed successfully.
32    #[serde(default = "default_true")]
33    pub require_write_tool_for_claims: bool,
34
35    /// Automatically apply detected patch blocks in assistant replies
36    /// when no write tool was executed. Defaults to false for safety.
37    #[serde(default)]
38    pub auto_apply_detected_patches: bool,
39
40    /// Enable zero-trust checks between components.
41    #[serde(default)]
42    pub zero_trust_mode: bool,
43
44    /// Encrypt payloads passed across executors.
45    #[serde(default)]
46    pub encrypt_payloads: bool,
47
48    /// Enable runtime integrity tagging for critical paths.
49    #[serde(default = "default_true")]
50    pub integrity_checks: bool,
51
52    /// Play terminal bell notification when HITL approval is required.
53    #[serde(default = "default_true")]
54    pub hitl_notification_bell: bool,
55
56    /// Gatekeeper mitigation options (macOS only)
57    #[serde(default)]
58    pub gatekeeper: GatekeeperConfig,
59}
60
61impl Default for SecurityConfig {
62    fn default() -> Self {
63        Self {
64            human_in_the_loop: default_true(),
65            require_write_tool_for_claims: default_true(),
66            auto_apply_detected_patches: false,
67            zero_trust_mode: true,
68            encrypt_payloads: true,
69            integrity_checks: default_true(),
70            hitl_notification_bell: default_true(),
71            gatekeeper: GatekeeperConfig::default(),
72        }
73    }
74}
75
76fn default_gatekeeper_auto_clear_paths() -> Vec<String> {
77    crate::constants::defaults::DEFAULT_GATEKEEPER_AUTO_CLEAR_PATHS
78        .iter()
79        .map(|s| s.to_string())
80        .collect()
81}
82
83impl Default for GatekeeperConfig {
84    fn default() -> Self {
85        Self {
86            warn_on_quarantine: default_true(),
87            auto_clear_quarantine: false,
88            auto_clear_paths: default_gatekeeper_auto_clear_paths(),
89        }
90    }
91}
vtcode_config/core/security.rs

vtcode_config/core/
security.rs
