agent.example.toml

# vt agent config — copy to ~/.config/vt/agent.toml (or point $VT_AGENT_CONFIG here).
#
# Consumed by `vt hook` (see docs/hook.md). This file is SEPARATE from
# config.toml because config.toml holds secrets (never sync it) whereas this
# file carries NO plaintext secrets — command/env-var names plus vt:// ciphertext
# values — so it is safe to commit / sync (e.g. symlink into a dotfiles repo).
#
# Decision per command:
#   * no matching rule          -> ACCEPT  (runs unchanged; the default)
#   * matching `block = true`   -> BLOCK   (refused)
#   * matching rule + one of its `env_vars` is a vt:// value
#                               -> REWRITE to `vt inject --only-env … -- bash -c '<cmd>'`
#
# Matching:
#   * `command` matches the argv[0] BASENAME (`gh`, `/usr/bin/gh`, `./gh`).
#   * `args` (optional) is a positional PREFIX of the tokens after the program,
#     so a rule can target a subcommand (`gh auth token`).
#   * BLOCK beats INJECT regardless of order: inject all of `gh`, yet still deny
#     the one subcommand that would print the secret back.
#   * `bash -c "…"` is opaque (the real program is hidden); see docs/hook.md.

[[rules]]
command  = "gh"
env_vars = ["GH_TOKEN"]

[[rules]]
command = "gh"
args    = ["auth", "token"]
block   = true
reason  = "refusing `gh auth token`: it would reveal the injected GH_TOKEN"

# More examples:
# [[rules]]
# command  = "psql"
# env_vars = ["PGPASSWORD", "DATABASE_URL"]
#
# [[rules]]
# command = "rm"
# block   = true
# reason  = "destructive command blocked for the agent"

# --- env-var VALUES (optional) ----------------------------------------------
# Instead of exporting secrets, you can store their (vt://) values here so the
# hook supplies them to matched commands. A rule must still NAME the var in its
# `env_vars`; this section provides the value. Values should be vt:// ciphertext
# (they get decrypted on use). Resolution precedence for each var (agent config
# WINS over the process env — a stray ambient value can't override a per-project
# config value):
#   [env.dirs."<longest matching PWD prefix>"]  >  [env.default]  >  process env
#
# Defaults — apply in every working directory:
# [env.default]
# GH_TOKEN = "vt://0defaultGhTokenCiphertext…"
#
# Per-directory overrides — keyed by absolute path (longest prefix of the
# command's CWD wins), so different projects get different tokens. A leading
# "~" / "~/" in the key is expanded to your home directory:
# [env.dirs."~/work/projA"]
# GH_TOKEN = "vt://0projAtokenCiphertext…"
#
# [env.dirs."/home/me/work/projB"]
# GH_TOKEN = "vt://0projBtokenCiphertext…"