vtcode_config/core/
security.rs

1use crate::env_helpers::default_true;
2use serde::{Deserialize, Serialize};
3use vtcode_commons::VtCodePaths;
4
5/// Gatekeeper mitigation configuration (macOS only)
6#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
7#[derive(Debug, Clone, Deserialize, Serialize)]
8pub struct GatekeeperConfig {
9    /// Warn when a quarantined executable is detected
10    #[serde(default = "default_true")]
11    pub warn_on_quarantine: bool,
12
13    /// Attempt to clear quarantine automatically (opt-in)
14    #[serde(default)]
15    pub auto_clear_quarantine: bool,
16
17    /// Paths eligible for quarantine auto-clear
18    #[serde(default = "default_gatekeeper_auto_clear_paths")]
19    pub auto_clear_paths: Vec<String>,
20}
21
22/// Security configuration
23#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
24#[derive(Debug, Clone, Deserialize, Serialize)]
25pub struct SecurityConfig {
26    /// Require human confirmation for critical actions
27    #[serde(default = "default_true")]
28    pub human_in_the_loop: bool,
29
30    /// Require a successful write tool before accepting claims like
31    /// "I've updated the file" as applied. When true, such claims are
32    /// treated as proposals unless a write tool executed successfully.
33    #[serde(default = "default_true")]
34    require_write_tool_for_claims: bool,
35
36    /// Automatically apply detected patch blocks in assistant replies
37    /// when no write tool was executed. Defaults to false for safety.
38    #[serde(default)]
39    auto_apply_detected_patches: bool,
40
41    /// Enable zero-trust checks between components.
42    #[serde(default)]
43    pub zero_trust_mode: bool,
44
45    /// Encrypt payloads passed across executors.
46    #[serde(default)]
47    encrypt_payloads: bool,
48
49    /// Enable runtime integrity tagging for critical paths.
50    #[serde(default = "default_true")]
51    pub integrity_checks: bool,
52
53    /// Play terminal bell notification when HITL approval is required.
54    #[serde(default = "default_true")]
55    pub hitl_notification_bell: bool,
56
57    /// Gatekeeper mitigation options (macOS only)
58    #[serde(default)]
59    pub gatekeeper: GatekeeperConfig,
60}
61
62impl Default for SecurityConfig {
63    fn default() -> Self {
64        Self {
65            human_in_the_loop: default_true(),
66            require_write_tool_for_claims: default_true(),
67            auto_apply_detected_patches: false,
68            zero_trust_mode: true,
69            encrypt_payloads: true,
70            integrity_checks: default_true(),
71            hitl_notification_bell: default_true(),
72            gatekeeper: GatekeeperConfig::default(),
73        }
74    }
75}
76
77fn default_gatekeeper_auto_clear_paths() -> Vec<String> {
78    let mut paths = vec![".vtcode/bin".to_string()];
79    if let Ok(resolver) = VtCodePaths::resolve() {
80        paths.push(resolver.executable_dir().display().to_string());
81        paths.push(resolver.legacy_dir().join("bin").display().to_string());
82    } else {
83        paths.push(".local/bin".to_string());
84    }
85    paths.sort();
86    paths.dedup();
87    paths
88}
89
90impl Default for GatekeeperConfig {
91    fn default() -> Self {
92        Self {
93            warn_on_quarantine: default_true(),
94            auto_clear_quarantine: false,
95            auto_clear_paths: default_gatekeeper_auto_clear_paths(),
96        }
97    }
98}
vtcode_config/core/security.rs

vtcode_config/core/
security.rs
