vtcode_config/core/
security.rs

1use serde::{Deserialize, Serialize};
2
3/// Gatekeeper mitigation configuration (macOS only)
4#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
5#[derive(Debug, Clone, Deserialize, Serialize)]
6pub struct GatekeeperConfig {
7    /// Warn when a quarantined executable is detected
8    #[serde(default = "default_true")]
9    pub warn_on_quarantine: bool,
10
11    /// Attempt to clear quarantine automatically (opt-in)
12    #[serde(default)]
13    pub auto_clear_quarantine: bool,
14
15    /// Paths eligible for quarantine auto-clear
16    #[serde(default = "default_gatekeeper_auto_clear_paths")]
17    pub auto_clear_paths: Vec<String>,
18}
19
20/// Security configuration
21#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
22#[derive(Debug, Clone, Deserialize, Serialize)]
23pub struct SecurityConfig {
24    /// Require human confirmation for critical actions
25    #[serde(default = "default_true")]
26    pub human_in_the_loop: bool,
27
28    /// Require a successful write tool before accepting claims like
29    /// "I've updated the file" as applied. When true, such claims are
30    /// treated as proposals unless a write tool executed successfully.
31    #[serde(default = "default_true")]
32    pub require_write_tool_for_claims: bool,
33
34    /// Automatically apply detected patch blocks in assistant replies
35    /// when no write tool was executed. Defaults to false for safety.
36    #[serde(default)]
37    pub auto_apply_detected_patches: bool,
38
39    /// Enable zero-trust checks between components.
40    #[serde(default)]
41    pub zero_trust_mode: bool,
42
43    /// Encrypt payloads passed across executors.
44    #[serde(default)]
45    pub encrypt_payloads: bool,
46
47    /// Enable runtime integrity tagging for critical paths.
48    #[serde(default = "default_true")]
49    pub integrity_checks: bool,
50
51    /// Play terminal bell notification when HITL approval is required.
52    #[serde(default = "default_true")]
53    pub hitl_notification_bell: bool,
54
55    /// Gatekeeper mitigation options (macOS only)
56    #[serde(default)]
57    pub gatekeeper: GatekeeperConfig,
58}
59
60impl Default for SecurityConfig {
61    fn default() -> Self {
62        Self {
63            human_in_the_loop: default_true(),
64            require_write_tool_for_claims: default_true(),
65            auto_apply_detected_patches: false,
66            zero_trust_mode: true,
67            encrypt_payloads: true,
68            integrity_checks: default_true(),
69            hitl_notification_bell: default_true(),
70            gatekeeper: GatekeeperConfig::default(),
71        }
72    }
73}
74
75#[inline]
76const fn default_true() -> bool {
77    true
78}
79
80fn default_gatekeeper_auto_clear_paths() -> Vec<String> {
81    crate::constants::defaults::DEFAULT_GATEKEEPER_AUTO_CLEAR_PATHS
82        .iter()
83        .map(|s| s.to_string())
84        .collect()
85}
86
87impl Default for GatekeeperConfig {
88    fn default() -> Self {
89        Self {
90            warn_on_quarantine: default_true(),
91            auto_clear_quarantine: false,
92            auto_clear_paths: default_gatekeeper_auto_clear_paths(),
93        }
94    }
95}
96
97#[cfg(test)]
98#[path = "security_test.rs"]
99mod security_test;
vtcode_config/core/security.rs

vtcode_config/core/
security.rs
