@akanjs/devkit 3.1.1 → 3.1.2-rc.1

package/akanConfig/akanConfig.test.ts

@@ -4,6 +4,7 @@ import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { AppExecutor, WorkspaceExecutor } from "../executors";
+import { NativeConfig } from "../mobile/nativeConfig";
 import type { PackageJson } from "../types";
 import { AkanAppConfig, AkanLibConfig, deriveDefaultAppId } from "./akanConfig";
 import type { LibConfigInput } from "./types";
@@ -165,6 +166,23 @@ describe("AkanAppConfig", () => {
     expect(unlocked).not.toContain("bun.lock");
   });
 
+  test("writes a Dockerfile for a local build that refuses docker build without an explicit build arg", () => {
+    const config = new AkanAppConfig(app, [], packageJson, {}, baseDevEnv);
+    const local = config.dockerfileFor("local");
+    const guard = local.split("\n").find((line) => line.includes("AKAN_ALLOW_LOCAL_IMAGE") && line.startsWith("RUN "));
+    if (!guard) throw new Error("expected the local image guard");
+    const run = (allow?: string) =>
+      Bun.spawnSync(["sh", "-c", guard.slice("RUN ".length)], {
+        env: { PATH: process.env.PATH ?? "", ...(allow ? { AKAN_ALLOW_LOCAL_IMAGE: allow } : {}) },
+      });
+
+    expect(local).toContain(`FROM ${pinnedBunImage}\nARG AKAN_ALLOW_LOCAL_IMAGE\nRUN if`);
+    expect(config.dockerfileFor("main")).not.toContain("AKAN_ALLOW_LOCAL_IMAGE");
+    expect(run().exitCode).toBe(1);
+    expect(run().stderr.toString()).toContain("--build-arg AKAN_ALLOW_LOCAL_IMAGE=1");
+    expect(run("1").exitCode).toBe(0);
+  });
+
   test("defaults both web surfaces on and keeps the image free of web env overrides", () => {
     const config = new AkanAppConfig(app, [], packageJson, {}, baseDevEnv);
 
@@ -220,6 +238,17 @@ describe("AkanAppConfig", () => {
     expect(config.dockerfile).toContain(`COPY . .\n${envBlock}\nCMD ["bun","main.js"]`);
   });
 
+  test('publishes localePrefix "as-needed" to the bundles and the image, and leaves the default out of the image', () => {
+    const asNeeded = new AkanAppConfig(app, [], packageJson, { i18n: { localePrefix: "as-needed" } }, baseDevEnv);
+    expect(process.env.AKAN_PUBLIC_LOCALE_PREFIX).toBe("as-needed");
+    expect(asNeeded.getProductionEnv().AKAN_PUBLIC_LOCALE_PREFIX).toBe("as-needed");
+    expect(asNeeded.dockerfile).toContain("ENV AKAN_PUBLIC_LOCALE_PREFIX=as-needed");
+
+    const always = new AkanAppConfig(app, [], packageJson, {}, baseDevEnv);
+    expect(process.env.AKAN_PUBLIC_LOCALE_PREFIX).toBe("always");
+    expect(always.getProductionEnv()).not.toHaveProperty("AKAN_PUBLIC_LOCALE_PREFIX");
+  });
+
   test("writes the Dockerfile instructions it wrote before its env came from getProductionEnv", () => {
     //? 9adfb95c's output for this config, less the blank lines its empty interpolations left and its floating tag.
     const before = [
@@ -679,6 +708,52 @@ describe("AkanAppConfig", () => {
     ).toThrow("native.updates in apps/portal/akan.config.ts has no url or publicKeys.");
   });
 
+  test("takes the page policy, the opener's links and the release checks from akan.config.ts into the native build", () => {
+    const updates = { url: "https://releases.example.com/portal", publicKey: "key=", expiresIn: 86_400 };
+    const native = new AkanAppConfig(
+      app,
+      [],
+      packageJson,
+      {
+        native: {
+          csp: { "connect-src": ["https://upload.example.com"] },
+          openUrls: ["https://*.example.com/*"],
+          updates,
+          targets: {
+            default: {},
+            kiosk: { csp: false, openUrls: ["*"], updates: { windowsSigners: ["AB12"] } },
+          },
+        },
+      },
+      baseDevEnv,
+    ).native;
+    const build = (name: string) =>
+      NativeConfig.build({
+        appPath: "/repo/apps/portal",
+        target: native.targets[name] as NonNullable<(typeof native.targets)[string]>,
+        webDir: "/web",
+        contributions: [],
+        locales: ["en"],
+        platform: "windows",
+        publicEnv: { AKAN_PUBLIC_APP_NAME: "portal", AKAN_PUBLIC_ENV: "main", AKAN_PUBLIC_SERVE_DOMAIN: "example.com" },
+      }).config;
+    const opener = (config: ReturnType<typeof build>) =>
+      config.capabilities?.[0]?.permissions.find((permission) => JSON.stringify(permission).includes("opener"));
+
+    const store = build("default");
+    expect(store.security?.csp).toMatchObject({
+      "connect-src": expect.arrayContaining(["https://upload.example.com"]),
+    });
+    expect(opener(store)).toEqual({ identifier: "opener:default", allow: [{ url: "https://*.example.com/*" }] });
+    expect(store.updates).toMatchObject({ expiresIn: 86_400 });
+    expect(store.updates).not.toHaveProperty("windowsSigners");
+
+    const kiosk = build("kiosk");
+    expect(kiosk.security).toBeUndefined();
+    expect(opener(kiosk)).toBe("opener:default");
+    expect(kiosk.updates).toMatchObject({ expiresIn: 86_400, windowsSigners: ["AB12"] });
+  });
+
   test("refuses updates holding both publicKey and publicKeys, a target's own key beside the section's list included", () => {
     const url = "https://releases.example.com/portal";
     const resolve = (native: object) =>

package/akanConfig/akanConfig.ts

@@ -227,6 +227,7 @@ export class AkanAppConfig implements AppConfigResult {
     this.i18n = resolveAkanI18nConfig(config?.i18n);
     process.env.AKAN_PUBLIC_DEFAULT_LOCALE = this.i18n.defaultLocale;
     process.env.AKAN_PUBLIC_LOCALES = this.i18n.locales.join(",");
+    process.env.AKAN_PUBLIC_LOCALE_PREFIX = this.i18n.localePrefix ?? "always";
     this.api = {
       prefix: normalizeRoutePrefix(config?.api?.prefix) ?? "/api",
       websocketPrefix: normalizeRoutePrefix(config?.api?.websocketPrefix) ?? "/ws",
@@ -468,6 +469,8 @@ export class AkanAppConfig implements AppConfigResult {
       "deepLinks",
       "updates",
       "devtools",
+      "csp",
+      "openUrls",
       "ios",
       "android",
       "desktop",
@@ -623,6 +626,7 @@ export class AkanAppConfig implements AppConfigResult {
       ...(this.basePaths.size ? { AKAN_PUBLIC_BASE_PATHS: [...this.basePaths].join(",") } : {}),
       AKAN_PUBLIC_DEFAULT_LOCALE: this.i18n.defaultLocale,
       AKAN_PUBLIC_LOCALES: this.i18n.locales.join(","),
+      ...(this.i18n.localePrefix === "as-needed" ? { AKAN_PUBLIC_LOCALE_PREFIX: this.i18n.localePrefix } : {}),
       AKAN_PUBLIC_API_PREFIX: this.api.prefix,
       AKAN_PUBLIC_WS_PREFIX: this.api.websocketPrefix,
       AKAN_PUBLIC_OPERATION_MODE: "cloud",
@@ -634,6 +638,11 @@ export class AkanAppConfig implements AppConfigResult {
       ...(this.web.csr ? {} : { AKAN_CSR: "false" }),
     };
   }
+  //? An image runs where the build cannot see, and AKAN_PUBLIC_ENV=local serves the dev routes to every caller there.
+  static readonly localImageGuard = [
+    "ARG AKAN_ALLOW_LOCAL_IMAGE",
+    `RUN if [ "$AKAN_ALLOW_LOCAL_IMAGE" != "1" ]; then echo "This build ran with AKAN_PUBLIC_ENV=local, which serves the dev routes to every caller. Build with the environment it deploys to, or pass --build-arg AKAN_ALLOW_LOCAL_IMAGE=1." >&2; exit 1; fi`,
+  ].join("\n");
   dockerfileFor(environment: string, { lockfile = true }: { lockfile?: boolean } = {}): string {
     return this.#makeDockerfile(environment, lockfile);
   }
@@ -643,8 +652,9 @@ export class AkanAppConfig implements AppConfigResult {
     const preRunScripts = this.#getDockerRunScripts(preRuns);
     const postRunScripts = this.#getDockerRunScripts(postRuns);
     const imageScript = this.#getDockerImageScript(image, DEFAULT_DOCKER_IMAGE);
+    const isLocal = (environment ?? this.baseDevEnv.env) === "local";
     const envLines = Object.entries(this.getProductionEnv(environment)).map(([key, value]) => `ENV ${key}=${value}`);
-    return `${imageScript}
+    return `${imageScript}${isLocal ? `\n${AkanAppConfig.localImageGuard}` : ""}
 RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends ca-certificates tzdata && rm -rf /var/lib/apt/lists/*
 RUN ln -sf /usr/share/zoneinfo/Asia/Seoul /etc/localtime
 ARG TARGETARCH

package/akanMcpContract.test.ts

@@ -1,5 +1,10 @@
 import { describe, expect, test } from "bun:test";
-import { createAkanValidationContract } from "./akanMcpContract";
+import { mkdir, symlink } from "node:fs/promises";
+import path from "node:path";
+import { createAkanValidationContract, workflowArtifactPath } from "./akanMcpContract";
+import { createTempApp, tempRoots } from "./testHelpers";
+
+const track = tempRoots();
 
 describe("createAkanValidationContract", () => {
   test("exposes reference-first tooling rollout gate semantics", () => {
@@ -35,3 +40,25 @@ describe("createAkanValidationContract", () => {
     );
   });
 });
+
+describe("workflowArtifactPath", () => {
+  test("keeps the plans and reports an MCP call names inside the workspace's workflow folder", async () => {
+    const { root, workspace } = track(await createTempApp("demo"));
+    const workflows = path.join(root, ".akan/workflows");
+    await mkdir(path.join(workflows, "plans"), { recursive: true });
+    await symlink(path.join(root, "package.json"), path.join(workflows, "plans/linked.json"));
+
+    expect(workflowArtifactPath(workspace, ".akan/workflows/plans/a.json")).toBe(path.join(workflows, "plans/a.json"));
+    expect(workflowArtifactPath(workspace, `${workflows}/runs/b.json`)).toBe(path.join(workflows, "runs/b.json"));
+    expect(workflowArtifactPath(workspace, "add-field-123")).toBe(path.join(workflows, "runs/add-field-123.json"));
+    for (const outside of [
+      "package.json",
+      `${root}/package.json`,
+      ".akan/workflows/../../package.json",
+      ".akan/workflows",
+      ".akan/workflows/plans/linked.json",
+      "/tmp/plan.json",
+    ])
+      expect(() => workflowArtifactPath(workspace, outside)).toThrow("MCP workflow files live under .akan/workflows/");
+  });
+});

package/akanMcpContract.ts

@@ -1,3 +1,4 @@
+import { lstatSync, realpathSync } from "node:fs";
 import path from "node:path";
 import { isRecord } from "akanjs/common";
 import { AkanContextAnalyzer, type AkanDiagnostic, type AkanModuleContext } from "./akanContext";
@@ -127,8 +128,55 @@ const isInspectAkanContextRequestType = (value: unknown): value is InspectAkanCo
 
 export const parseJsonOutput = (output: string) => JSON.parse(output) as unknown;
 
-export const workspacePath = (workspace: Workspace, filePath: string) =>
-  path.isAbsolute(filePath) ? filePath : path.join(workspace.workspaceRoot, filePath);
+const workflowArtifactDir = ".akan/workflows";
+const workflowRunIdPattern = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+
+const isInside = (base: string, target: string) => {
+  const relative = path.relative(base, target);
+  return !!relative && !relative.startsWith("..") && !path.isAbsolute(relative);
+};
+
+const hasEntry = (filePath: string) => {
+  try {
+    lstatSync(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+const realPathOfNearest = (filePath: string) => {
+  const rest: string[] = [];
+  let current = filePath;
+  while (!hasEntry(current) && path.dirname(current) !== current) {
+    rest.unshift(path.basename(current));
+    current = path.dirname(current);
+  }
+  return path.join(realpathSync(current), ...rest);
+};
+
+const staysInside = (workspaceRoot: string, root: string, resolved: string) => {
+  try {
+    const realRoot = realPathOfNearest(root);
+    return isInside(realPathOfNearest(workspaceRoot), realRoot) && isInside(realRoot, realPathOfNearest(resolved));
+  } catch {
+    return false;
+  }
+};
+
+//? An MCP caller acts on text it was shown, so the plans and reports it names stay in the workspace's workflow folder.
+export const workflowArtifactPath = (workspace: Workspace, filePath: string) => {
+  const root = path.resolve(workspace.workspaceRoot, workflowArtifactDir);
+  const resolved =
+    workflowRunIdPattern.test(filePath) && !filePath.endsWith(".json")
+      ? path.join(root, "runs", `${filePath}.json`)
+      : path.resolve(workspace.workspaceRoot, filePath);
+  if (!isInside(root, resolved) || !staysInside(workspace.workspaceRoot, root, resolved))
+    throw new Error(
+      `MCP workflow files live under ${workflowArtifactDir}/ of the workspace, not ${JSON.stringify(filePath)}.`,
+    );
+  return resolved;
+};
 
 export const defaultWorkflowPlanPath = (workflow: string, inputs: WorkflowPlanInputs) => {
   const slug = [
@@ -490,7 +538,7 @@ export const inspectAkanContext = async (
   if (props.request.type === "workflowDiagnostics") {
     const doctor = await AkanContextAnalyzer.doctor(workspace, {
       strict: true,
-      runIdOrPlan: workspacePath(workspace, props.request.runIdOrPlan),
+      runIdOrPlan: workflowArtifactPath(workspace, props.request.runIdOrPlan),
     });
     const toWorkflowDiagnostic = (
       { severity, code, message, scope }: AkanDiagnostic,

package/applicationBuildRunner.test.ts

@@ -84,6 +84,42 @@ console.info(new SampleService().name);
     }
   });
 
+  test("writes beside main.js the env its Dockerfile sets, so a host without the image runs the build as is", async () => {
+    const root = await mkdtemp(path.join(os.tmpdir(), "akan-build-meta-"));
+    const config = new AkanAppConfig(
+      { name: "portal" } as never,
+      [],
+      { name: "repo", version: "1.0.0", description: "repo" },
+      {},
+      { repoName: "akanjs", serveDomain: "akanjs.com", env: "local", portOffset: 0, workspaceRoot: root },
+    );
+    const app = {
+      getConfig: async () => config,
+      dist: new Executor("dist", root),
+      workspace: { workspaceRoot: root },
+      logger: { warn: () => undefined },
+    } as unknown as App;
+    const builtEnv = async () => JSON.parse(await readFile(path.join(root, "akan.env.json"), "utf8")) as object;
+    const dockerfileEnv = async () =>
+      Object.fromEntries(
+        (await readFile(path.join(root, "Dockerfile"), "utf8"))
+          .split("\n")
+          .filter((line) => line.startsWith("ENV "))
+          .map((line) => line.slice("ENV ".length).split(/=(.*)/s).slice(0, 2)),
+      );
+    try {
+      await new ApplicationBuildRunner(app, { environment: "debug" }).buildAppMeta();
+      expect(await builtEnv()).toEqual(config.getProductionEnv("debug"));
+      expect(await builtEnv()).toEqual(await dockerfileEnv());
+      expect(await builtEnv()).toMatchObject({ AKAN_PUBLIC_APP_NAME: "portal", AKAN_PUBLIC_ENV: "debug" });
+      await new ApplicationBuildRunner(app).buildAppMeta();
+      expect(await builtEnv()).toMatchObject({ AKAN_PUBLIC_ENV: "local" });
+      expect(await builtEnv()).toEqual(await dockerfileEnv());
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
   test("writes the pruned lockfile beside package.json, or warns and leaves the image's install unlocked", async () => {
     const root = await mkdtemp(path.join(os.tmpdir(), "akan-build-meta-"));
     const config = new AkanAppConfig(

package/applicationBuildRunner.ts

@@ -1,5 +1,6 @@
 import path from "node:path";
 import { toError } from "akanjs/common";
+import { BUILD_ENV_FILE } from "akanjs/server/lifecycle/buildEnv";
 import type { BunPlugin } from "bun";
 import { ProductionLockfile } from "./akanConfig/productionLockfile";
 import type {
@@ -240,13 +241,13 @@ export class ApplicationBuildRunner {
 
   async buildAppMeta() {
     const akanConfig = await this.#app.getConfig();
+    const environment = this.#environment ?? akanConfig.baseDevEnv.env;
     const packageJson = akanConfig.getProductionPackageJson();
     const lockfile = await this.#pruneLockfile(packageJson);
-    const dockerfile = akanConfig.dockerfileFor(this.#environment ?? akanConfig.baseDevEnv.env, {
-      lockfile: lockfile !== null,
-    });
+    const dockerfile = akanConfig.dockerfileFor(environment, { lockfile: lockfile !== null });
     await Promise.all([
       this.#app.dist.writeJson("package.json", packageJson),
+      this.#app.dist.writeJson(BUILD_ENV_FILE, akanConfig.getProductionEnv(environment)),
       ...(lockfile !== null
         ? [this.#app.dist.writeFile(`${this.#app.dist.cwdPath}/${ProductionLockfile.fileName}`, lockfile)]
         : []),

package/artifact/implicitRootLayout.ts

@@ -33,7 +33,7 @@ async function writeGeneratedOverridesLayoutFile(opts: {
   const filename = `${opts.key.replace(/^\.\//, "").replace(/[^a-zA-Z0-9]+/g, "_")}.tsx`;
   const absPath = path.join(path.resolve(opts.appCwdPath), IMPLICIT_OVERRIDES_DIR, filename);
   const source = `"use client";
-import { UiOverrideProvider } from "akanjs/ui";
+import { UiOverrideProvider } from "akanjs/ui/UiOverride/UiOverride.tsx";
 import { createElement, type ReactNode } from "react";
 import value from ${JSON.stringify(importSpecifier(absPath, opts.userAbsPath))};
 
@@ -213,11 +213,13 @@ ${guardExport}
 
 ${layoutSignature}({ children, params, searchParams }: LayoutProps) {
 ${layoutBinding}  return `;
+  //? System from its file, not the barrel: a dev registry compiles every module the barrel names, and with them the
+  //? optional peers (react-icons) an app drawing none of those components never installs.
   const source = opts.includeSystemProvider
     ? `import type { LayoutModule, LayoutProps, PageProps } from "akanjs/client";
 import { assertGuardOnChain, loadFonts, RouteGuards, resolveRouteModule, RouteHead } from "akanjs/client";
 import type { ReactNode } from "react";
-import { System } from "akanjs/ui";
+import { System } from "akanjs/ui/System/index.tsx";
 import type { McpAppRootProps } from "akanjs/webkit";
 import { env } from "@apps/${opts.appName}/env/env.client";
 import { allDictionary } from ${JSON.stringify(dictMacroSpecifier)};

package/cloud/globalConfig.test.ts

@@ -1,6 +1,24 @@
 import { describe, expect, test } from "bun:test";
+import { mkdir, stat } from "node:fs/promises";
+import path from "node:path";
+import { tempDirs } from "../testHelpers";
 import { GlobalConfig } from "./globalConfig";
 
+const tempHome = tempDirs("akan-global-config-");
+//* A child process, so `~/.akan` resolves under the temp HOME and never the person's own.
+const writeConfigUnder = async (home: string) => {
+  const proc = Bun.spawn(
+    [
+      "bun",
+      "-e",
+      `await (await import(${JSON.stringify(path.join(import.meta.dir, "globalConfig.ts"))})).GlobalConfig.setTestTargets({});`,
+    ],
+    { env: { ...process.env, HOME: home, USERPROFILE: home }, stdout: "pipe", stderr: "pipe" },
+  );
+  expect(await proc.exited).toBe(0);
+};
+const modeOf = async (target: string) => (await stat(target)).mode & 0o777;
+
 const workspace = (cloudHost: string | null) => ({ getConfig: async () => ({ cloudHost }) });
 
 describe("GlobalConfig", () => {
@@ -14,4 +32,20 @@ describe("GlobalConfig", () => {
     expect(await GlobalConfig.hostFor(workspace(null), "http://localhost:8283/")).toBe("http://localhost:8283");
     expect(await GlobalConfig.hostFor(workspace(null))).toBe(GlobalConfig.akanCloudHost);
   });
+
+  test.skipIf(process.platform === "win32")(
+    "keeps ~/.akan to its owner: a new one is made 0700 and a looser one it owns is tightened",
+    async () => {
+      const fresh = await tempHome();
+      await writeConfigUnder(fresh);
+      expect(await modeOf(path.join(fresh, ".akan"))).toBe(0o700);
+      expect(await modeOf(path.join(fresh, ".akan", "config.json"))).toBe(0o600);
+
+      const loose = await tempHome();
+      await mkdir(path.join(loose, ".akan"), { mode: 0o755 });
+      await writeConfigUnder(loose);
+      expect(await modeOf(path.join(loose, ".akan"))).toBe(0o700);
+    },
+    20_000,
+  );
 });

package/cloud/globalConfig.ts

@@ -1,4 +1,4 @@
-import { mkdir, rm, writeFile } from "node:fs/promises";
+import { rm, writeFile } from "node:fs/promises";
 import { trimTrailingSlashes } from "akanjs/common";
 import dayjs from "dayjs";
 import { FileSys } from "../fileSys";
@@ -36,7 +36,7 @@ export class GlobalConfig {
   // Holds the cloud jwt and refresh token, so owner-only 0600: written to a 0600 sibling and renamed over the file,
   // which also replaces a world-readable one and never shows another CLI process a half-written file.
   static async #setAkanGlobalConfig(akanConfig: AkanGlobalConfig) {
-    await mkdir(basePath, { recursive: true, mode: 0o700 });
+    FileSys.ensurePrivateDir(basePath);
     const temp = `${configPath}.${process.pid}.${crypto.randomUUID()}.tmp`;
     try {
       await writeFile(temp, JSON.stringify(akanConfig, null, 2), { mode: 0o600 });

package/codeAgent/agent/AkanCodeEnv.ts

@@ -0,0 +1,26 @@
+import { ShellOnlyEnv } from "../../shellOnlyEnv";
+
+export const akanCodeGuardedEnv = [
+  "AKAN_CODE_HOME",
+  "AKAN_CODE_CAN_PROMPT",
+  "AKAN_CODE_PROXY_URL",
+  "AKAN_CODE_PROXY_TOKEN",
+  "AKAN_CODE_PROXY_TOKEN_FILE",
+  "AKAN_CODE_PROXY_PROVIDERS",
+  "AKAN_CODE_RPC_TOKEN_FILE",
+] as const;
+
+export type AkanCodeGuardedEnvKey = (typeof akanCodeGuardedEnv)[number];
+
+// Each key moves the credential store, a confirmation or the model traffic.
+export class AkanCodeEnv {
+  static readonly #env = new ShellOnlyEnv(akanCodeGuardedEnv);
+
+  static get(key: AkanCodeGuardedEnvKey): string | undefined {
+    return AkanCodeEnv.#env.get(key);
+  }
+
+  static ignored() {
+    return AkanCodeEnv.#env.ignored();
+  }
+}

package/codeAgent/agent/AkanCodeServices.ts

@@ -10,6 +10,7 @@ import { akanCodePaths } from "./akanCodePaths";
 import { akanSystemPrompt } from "./akanSystemPrompt";
 import type { CodeAgentProxy } from "./CodeAgentProxy";
 import { CodeSessionIndex } from "./CodeSessionIndex";
+import { WorkspaceTrust } from "./WorkspaceTrust";
 
 export interface AkanCodeServicesOptions {
   workspaceRoot: string;
@@ -34,7 +35,7 @@ export class AkanCodeServices {
 
   // The engine locks and rewrites `authPath` itself, so two `akan code` refreshing a token at once cannot clobber it.
   static async runtime(workspaceRoot: string, proxy: CodeAgentProxy | null = null) {
-    mkdirSync(akanCodePaths.globalDir(), { recursive: true, mode: 0o700 });
+    akanCodePaths.ensureGlobalDir();
     const runtime = await ModelRuntime.create({
       //* Behind a proxy no real key may reach a request, so credentials live in a throwaway file.
       authPath: proxy
@@ -88,7 +89,9 @@ export class AkanCodeServices {
           : agentsFiles,
       }),
       appendSystemPrompt: [akanSystemPrompt(options.profile)],
-      additionalExtensionPaths: present(akanCodePaths.extensionsDir(options.workspaceRoot)),
+      additionalExtensionPaths: WorkspaceTrust.isTrusted(options.workspaceRoot, "extensions")
+        ? present(akanCodePaths.extensionsDir(options.workspaceRoot))
+        : [],
       additionalSkillPaths: AkanCodeServices.#skillPaths(options.profile, options.workspaceRoot),
       extensionFactories: options.extensions,
     };

package/codeAgent/agent/CodeAgent.ts

@@ -535,6 +535,13 @@ export class CodeAgent {
           const verdict = this.#gate.verdict(event.toolName, event.input);
           if (verdict.block) return this.#refuse(event.toolCallId, event.toolName, event.input, verdict.block);
           if (!verdict.approval) return undefined;
+          if (verdict.strict && !this.#profile.ui.canPrompt)
+            return this.#refuse(
+              event.toolCallId,
+              event.toolName,
+              event.input,
+              "This reaches a host outside the profile's list, which needs the user's approval, and nobody can be asked in this session. Use a listed host, or say what you need fetched.",
+            );
           const approved = await this.#requestApproval(event.toolCallId, event.toolName, event.input, verdict.approval);
           if (approved) return undefined;
           return this.#refuse(event.toolCallId, event.toolName, event.input, "The user declined this action.");