kritya 0.8.22-beta → 0.8.24-beta

package/README.md

@@ -50,7 +50,8 @@ review → fix` for building something new end-to-end
   state
 - **Office docs & notebooks** — read/write Word, Excel, PowerPoint, PDF,
   Jupyter
-- **Headless/CI mode** — scriptable, no-TTY runs for automation
+  - **Headless/CI mode** — scriptable, no-TTY runs for automation
+  - **Privacy mode** — `--privacy`, `KRITYA_PRIVACY=1`, or `"privacyMode": true` disables transcript, audit, and telemetry persistence
 
 ## Setup
 

package/dist/agent/loop.js

@@ -78,6 +78,14 @@ export class Agent {
     audit;
     /** OpenTelemetry-shaped tracer for the tool loop. No-op unless enabled. */
     tracer = NOOP_TRACER;
+    /**
+     * Fired around compact() so the UI can show a live "compacting…" indicator
+     * for the summarization call, which otherwise runs silently until it
+     * either finishes or fails (see onToolEnd's "compact" record for the
+     * after-the-fact summary).
+     */
+    onCompactStart;
+    onCompactEnd;
     /** OTLP metrics recorder for tool/turn durations. No-op unless enabled. */
     meter = NOOP_METER;
     /**
@@ -266,6 +274,7 @@ export class Agent {
         this.kill.assertLive();
         const compactSpan = this.tracer.startSpan("agent.compact", { parent: this.currentTurnSpan });
         const tokensBefore = this.lastPromptTokens;
+        this.onCompactStart?.();
         try {
             const note = await this.doCompact(signal, compactSpan);
             compactSpan.setStatus("OK");
@@ -279,6 +288,7 @@ export class Agent {
             compactSpan.setAttribute("kritya.prompt_tokens_before", tokensBefore);
             compactSpan.setAttribute("kritya.prompt_tokens_after", this.lastPromptTokens);
             compactSpan.end();
+            this.onCompactEnd?.();
         }
     }
     async doCompact(signal, compactSpan) {
@@ -444,6 +454,7 @@ export class Agent {
                 onTextDelta: handlers.onTextDelta,
                 onReasoningDelta: handlers.onReasoningDelta,
                 onRetry: handlers.onRetry,
+                onFallback: handlers.onFallback,
             }, signal, { tracer: this.tracer, parent: this.currentTurnSpan });
             let result;
             try {

package/dist/agent/toolExecutor.js

@@ -1,8 +1,29 @@
 import { classifyDanger } from "../permissions/danger.js";
-import { acknowledgeUnsandboxedFallback, sandboxFallbackWarning } from "../shell/sandbox.js";
+import { acknowledgeUnsandboxedFallback, sandboxAvailable, sandboxFallbackWarning, } from "../shell/sandbox.js";
 import { isPlanningDocWrite, loadProjectState } from "./workflow.js";
+import { redactSecrets } from "../tools/secretScan.js";
 /** How much tool output to hand the UI (it shows a preview and expands on toggle). */
 const PREVIEW_CHARS = 4000;
+/**
+ * Upper bound on a raw tool-call argument payload, checked before JSON.parse.
+ * Individual tools cap their own inputs where it matters (e.g. write_file
+ * content), but this is a backstop against a malformed or adversarial model
+ * response ballooning memory before any tool-specific validation runs.
+ */
+const MAX_ARGS_JSON_CHARS = 2_000_000;
+/**
+ * Backstop cap on what a tool can return to the model, applied after every
+ * tool call regardless of whether that tool already truncates its own
+ * output (most do, via truncateResult/truncateTail — see src/tools/common.ts
+ * — but this catches the ones that don't, or a tool with a bug).
+ */
+const MAX_TOOL_OUTPUT_CHARS = 200_000;
+function truncateToolOutput(output) {
+    if (output.length <= MAX_TOOL_OUTPUT_CHARS)
+        return output;
+    return (output.slice(0, MAX_TOOL_OUTPUT_CHARS) +
+        `\n... [truncated, ${output.length - MAX_TOOL_OUTPUT_CHARS} more characters]`);
+}
 /**
  * A tool outlived its deadline and was abandoned. Carries the tool's name so
  * the message handed back to the model names what to avoid retrying blindly.
@@ -96,6 +117,10 @@ export class ToolExecutor {
         const tool = this.tools.find((t) => t.name === name);
         if (!tool)
             return `Error: unknown tool "${name}"`;
+        if (argsJson.length > MAX_ARGS_JSON_CHARS) {
+            return (`Error: tool arguments for "${name}" are too large ` +
+                `(${argsJson.length} characters, max ${MAX_ARGS_JSON_CHARS}). Use a smaller input.`);
+        }
         let args;
         try {
             args = JSON.parse(argsJson);
@@ -105,7 +130,13 @@ export class ToolExecutor {
         }
         let summary;
         try {
-            summary = tool.summarize(args);
+            // A tool's own summarize() may embed raw values (a fetch_url query
+            // string, a search query, arbitrary text) that happen to contain a
+            // secret the model saw earlier in the conversation. This is the one
+            // chokepoint every tool's summary passes through before it's written
+            // to the audit log and telemetry, so redact here rather than trusting
+            // every individual tool to have already done it.
+            summary = redactSecrets(tool.summarize(args)).redacted;
         }
         catch {
             summary = name;
@@ -220,7 +251,21 @@ export class ToolExecutor {
                     diff = undefined;
                 }
             }
-            const decision = await handlers.requestPermission(tool.name, summary, diff, danger ?? undefined);
+            const permissionDetails = [
+                summary,
+                `workspace: ${host.ctx.workspace}`,
+                typeof args.path === "string" ? `affected path: ${args.path}` : undefined,
+                tool.name === "shell"
+                    ? `command: ${shellCommand}\nsandbox: ${host.ctx.sandboxMode === "off"
+                        ? "off"
+                        : sandboxAvailable()
+                            ? `${host.ctx.sandboxMode ?? "auto"} (available)`
+                            : `${host.ctx.sandboxMode ?? "auto"} (unavailable; unsandboxed)`}`
+                    : undefined,
+            ]
+                .filter(Boolean)
+                .join("\n");
+            const decision = await handlers.requestPermission(tool.name, permissionDetails, diff, danger ?? undefined);
             // A forced (danger) prompt does not grant a lasting allowance.
             if (danger === null)
                 host.permissions.record(tool.name, decision, args);
@@ -291,6 +336,7 @@ export class ToolExecutor {
                 if (post.output.trim())
                     output += `\n[postToolUse hook]: ${post.output.trim()}`;
             }
+            output = truncateToolOutput(output);
             const failed = tool.failed?.(output) ?? false;
             logToolOutcome(failed ? "error" : "ok");
             finishSpan(failed ? "ERROR" : "OK");

package/dist/audit/audit.js

@@ -3,7 +3,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { CONFIG_DIR } from "../config/config.js";
 import { hardenWindowsDir } from "../config/winAcl.js";
-import { debugLog } from "../config/debug.js";
+import { debugLog, warnPersistenceFailure } from "../config/debug.js";
 const GENESIS = "0".repeat(64);
 /**
  * Where all audit logs live, across every workspace (not scoped per-project).
@@ -108,7 +108,7 @@ export class AuditLog {
         }
         catch (err) {
             // best-effort
-            debugLog(`AuditLog.write(${this.file})`, err);
+            warnPersistenceFailure(`AuditLog.write(${this.file})`, err);
         }
     }
     ensureDir() {

package/dist/config/config.js

@@ -2,8 +2,110 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { hardenWindowsDir } from "./winAcl.js";
-import { debugLog } from "./debug.js";
+import { debugLog, warnUser } from "./debug.js";
 import { writeFileAtomicSync } from "../atomicWrite.js";
+import { assertJsonWithinLimits } from "./jsonSafety.js";
+/** KRITYA_PRIVACY wins over config.json; truthy values enable privacy mode. */
+export function privacyModeFor(config) {
+    const value = process.env.KRITYA_PRIVACY;
+    if (value !== undefined)
+        return /^(1|true|yes|on)$/i.test(value.trim());
+    return config.privacyMode === true;
+}
+/**
+ * Bounds on `mcpServers` entries (from config.json or a workspace's
+ * .mcp.json) — without these, an oversized or malicious server list could
+ * balloon memory, or a single field (a giant command string, thousands of
+ * headers) could be used to abuse whatever eventually consumes it (a shell
+ * spawn, an HTTP client). Real MCP server configs are tiny; these limits are
+ * generous multiples of anything legitimate.
+ */
+const MAX_MCP_SERVERS = 50;
+const MAX_MCP_COMMAND_LENGTH = 4096;
+const MAX_MCP_ARGS = 200;
+const MAX_MCP_ARG_LENGTH = 4096;
+const MAX_MCP_URL_LENGTH = 8192;
+const MAX_MCP_CWD_LENGTH = 4096;
+const MAX_MCP_MAP_ENTRIES = 200;
+const MAX_MCP_MAP_VALUE_LENGTH = 16384;
+function sanitizeMcpStringMap(rec, label) {
+    if (!rec)
+        return undefined;
+    const entries = Object.entries(rec);
+    const out = {};
+    let kept = 0;
+    for (const [k, v] of entries) {
+        if (kept >= MAX_MCP_MAP_ENTRIES) {
+            warnUser(label, new Error(`more than ${MAX_MCP_MAP_ENTRIES} entries; extra entries dropped`));
+            break;
+        }
+        if (typeof v !== "string" || v.length > MAX_MCP_MAP_VALUE_LENGTH) {
+            warnUser(label, new Error(`entry "${k}" exceeds ${MAX_MCP_MAP_VALUE_LENGTH} char limit; dropped`));
+            continue;
+        }
+        out[k] = v;
+        kept++;
+    }
+    return out;
+}
+/** Validates one server entry against the bounds above; returns null to drop the whole server. */
+export function sanitizeMcpServerConfig(name, cfg) {
+    if (typeof cfg.command === "string" && cfg.command.length > MAX_MCP_COMMAND_LENGTH) {
+        warnUser(`mcpServers.${name}.command`, new Error(`exceeds ${MAX_MCP_COMMAND_LENGTH} char limit; server dropped`));
+        return null;
+    }
+    if (typeof cfg.url === "string" && cfg.url.length > MAX_MCP_URL_LENGTH) {
+        warnUser(`mcpServers.${name}.url`, new Error(`exceeds ${MAX_MCP_URL_LENGTH} char limit; server dropped`));
+        return null;
+    }
+    if (typeof cfg.cwd === "string" && cfg.cwd.length > MAX_MCP_CWD_LENGTH) {
+        warnUser(`mcpServers.${name}.cwd`, new Error(`exceeds ${MAX_MCP_CWD_LENGTH} char limit; server dropped`));
+        return null;
+    }
+    let args = cfg.args;
+    if (args) {
+        if (args.length > MAX_MCP_ARGS) {
+            warnUser(`mcpServers.${name}.args`, new Error(`${args.length} args exceeds limit of ${MAX_MCP_ARGS}; extra args dropped`));
+            args = args.slice(0, MAX_MCP_ARGS);
+        }
+        if (args.some((a) => typeof a !== "string" || a.length > MAX_MCP_ARG_LENGTH)) {
+            warnUser(`mcpServers.${name}.args`, new Error(`an argument exceeds ${MAX_MCP_ARG_LENGTH} char limit; server dropped`));
+            return null;
+        }
+    }
+    return {
+        ...cfg,
+        args,
+        env: sanitizeMcpStringMap(cfg.env, `mcpServers.${name}.env`),
+        headers: sanitizeMcpStringMap(cfg.headers, `mcpServers.${name}.headers`),
+    };
+}
+/** Caps server count and validates each entry; oversized/malformed servers are dropped, not truncated. */
+export function sanitizeMcpServersRecord(servers, label = "mcpServers") {
+    if (!servers)
+        return undefined;
+    const names = Object.keys(servers);
+    if (names.length > MAX_MCP_SERVERS) {
+        warnUser(label, new Error(`${names.length} servers exceeds limit of ${MAX_MCP_SERVERS}; extra servers dropped`));
+    }
+    const out = {};
+    let kept = 0;
+    for (const name of names) {
+        if (kept >= MAX_MCP_SERVERS)
+            break;
+        const sanitized = sanitizeMcpServerConfig(name, servers[name]);
+        if (sanitized) {
+            out[name] = sanitized;
+            kept++;
+        }
+    }
+    return out;
+}
+function sanitizeCliConfig(config) {
+    if (!config.mcpServers)
+        return config;
+    return { ...config, mcpServers: sanitizeMcpServersRecord(config.mcpServers) };
+}
 export const CONFIG_DIR = path.join(os.homedir(), ".kritya");
 export const CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
 export const NVIDIA_BASE_URL = "https://integrate.api.nvidia.com/v1";
@@ -102,16 +204,25 @@ export function listProviders(config) {
         .map((name) => ({ name, hasKey: !!resolveProvider(config, name).apiKey }));
 }
 export function loadConfig() {
+    let raw;
     try {
-        const raw = fs.readFileSync(CONFIG_FILE, "utf8");
-        return JSON.parse(raw);
+        raw = fs.readFileSync(CONFIG_FILE, "utf8");
     }
     catch (err) {
-        // A missing file is normal on first run; a malformed one is worth being
-        // able to see when someone reports "my config isn't taking effect".
+        // A missing file is normal on first run.
         debugLog(`loadConfig(${CONFIG_FILE})`, err);
         return {};
     }
+    try {
+        assertJsonWithinLimits(raw, "config.json");
+        return sanitizeCliConfig(JSON.parse(raw));
+    }
+    catch (err) {
+        // Malformed or oversized — worth being able to see when someone reports
+        // "my config isn't taking effect".
+        warnUser(`loadConfig(${CONFIG_FILE})`, err);
+        return {};
+    }
 }
 /**
  * Persist `model` as the default for one provider, leaving every other

package/dist/config/debug.js

@@ -17,3 +17,66 @@ export function debugLog(context, err) {
         // stderr itself failing isn't something debug logging can do anything about
     }
 }
+/**
+ * For best-effort persistence that a user actually needs to know failed
+ * (session/audit/telemetry writes) — unlike debugLog, this always prints a
+ * short one-line warning to stderr, not just under KRITYA_DEBUG. The full
+ * stack trace still only shows up under KRITYA_DEBUG, via the debugLog call
+ * this makes internally.
+ */
+/**
+ * Contexts already warned about via warnUser() this process. Some of these
+ * (a telemetry sink retried every span, an append() called every turn) would
+ * otherwise print the same warning on every single failure — once per
+ * context is enough to tell the user something is wrong without flooding
+ * the terminal.
+ */
+const warnedContexts = new Set();
+export function warnUser(context, err) {
+    if (warnedContexts.has(context)) {
+        debugLog(context, err);
+        return;
+    }
+    warnedContexts.add(context);
+    const message = err instanceof Error ? err.message : String(err);
+    try {
+        process.stderr.write(`[kritya] warning: ${context} failed: ${message}\n`);
+    }
+    catch {
+        // stderr itself failing isn't something this can do anything about
+    }
+    debugLog(context, err);
+}
+/** Contexts currently warning via warnPersistenceFailure, in the order first seen. */
+const persistenceWarnings = [];
+const persistenceListeners = new Set();
+function notifyPersistenceListeners() {
+    const snapshot = [...persistenceWarnings];
+    for (const listener of persistenceListeners)
+        listener(snapshot);
+}
+/** Current persistence-failure warnings (session/audit/telemetry writes that failed this process). */
+export function activePersistenceWarnings() {
+    return [...persistenceWarnings];
+}
+/** Subscribe to persistence-warning changes. Returns an unsubscribe function. */
+export function onPersistenceWarning(listener) {
+    persistenceListeners.add(listener);
+    return () => persistenceListeners.delete(listener);
+}
+/**
+ * Like warnUser, but for the specific best-effort writes whose failure means
+ * silent data loss (session transcripts, audit log, telemetry) — a stderr
+ * line alone is easy to miss since Ink's full-screen redraws can immediately
+ * paint over it. Recorded once per context, same dedup as warnUser, so the
+ * UI badge doesn't grow without bound from a write that fails every turn.
+ */
+export function warnPersistenceFailure(context, err) {
+    const isNewContext = !warnedContexts.has(context);
+    warnUser(context, err);
+    if (isNewContext) {
+        const message = err instanceof Error ? err.message : String(err);
+        persistenceWarnings.push({ context, message });
+        notifyPersistenceListeners();
+    }
+}

package/dist/config/jsonSafety.js

@@ -0,0 +1,69 @@
+/**
+ * Shared bounds checks for JSON config files (config.json, .mcp.json) read
+ * from disk. These files are small by nature, so a huge file or pathological
+ * nesting is either corruption or a deliberately hostile input (e.g. a
+ * malicious .mcp.json checked into a repo someone was talked into trusting)
+ * — either way, better to refuse it than to hand an unbounded string or
+ * object graph to JSON.parse and whatever reads the result afterwards.
+ */
+/** Config files this small in practice; anything past this is refused outright. */
+export const MAX_CONFIG_JSON_BYTES = 5 * 1024 * 1024;
+/**
+ * Deep nesting costs stack frames in every recursive consumer downstream
+ * (JSON.stringify on save, object spreads, etc.), not just JSON.parse
+ * itself. Real configs nest a handful of levels deep at most.
+ */
+export const MAX_JSON_DEPTH = 64;
+export class JsonSafetyError extends Error {
+}
+/** Throws if `raw` is larger than `maxBytes` (measured in UTF-8 bytes, not chars). */
+export function assertJsonSizeWithinLimit(raw, maxBytes = MAX_CONFIG_JSON_BYTES, label = "JSON") {
+    if (Buffer.byteLength(raw, "utf8") > maxBytes) {
+        throw new JsonSafetyError(`${label} exceeds ${maxBytes} byte limit`);
+    }
+}
+/**
+ * Throws if the raw JSON text nests objects/arrays deeper than `maxDepth`.
+ * Scans the text directly rather than the parsed tree, so a hostile input is
+ * rejected before JSON.parse ever builds it. String contents (which may
+ * contain unbalanced-looking brace/bracket characters) are skipped rather
+ * than scanned, respecting escapes so an escaped quote doesn't end the
+ * string early.
+ */
+export function assertJsonDepthWithinLimit(raw, maxDepth = MAX_JSON_DEPTH, label = "JSON") {
+    let depth = 0;
+    let inString = false;
+    let escaped = false;
+    for (let i = 0; i < raw.length; i++) {
+        const ch = raw[i];
+        if (inString) {
+            if (escaped) {
+                escaped = false;
+            }
+            else if (ch === "\\") {
+                escaped = true;
+            }
+            else if (ch === '"') {
+                inString = false;
+            }
+            continue;
+        }
+        if (ch === '"') {
+            inString = true;
+        }
+        else if (ch === "{" || ch === "[") {
+            depth++;
+            if (depth > maxDepth) {
+                throw new JsonSafetyError(`${label} nests deeper than ${maxDepth} levels`);
+            }
+        }
+        else if (ch === "}" || ch === "]") {
+            depth--;
+        }
+    }
+}
+/** Runs both the size and depth checks together — the usual entry point before JSON.parse. */
+export function assertJsonWithinLimits(raw, label, maxBytes = MAX_CONFIG_JSON_BYTES, maxDepth = MAX_JSON_DEPTH) {
+    assertJsonSizeWithinLimit(raw, maxBytes, label);
+    assertJsonDepthWithinLimit(raw, maxDepth, label);
+}

package/dist/engine.js

@@ -1,6 +1,6 @@
 import path from "node:path";
 import { Agent } from "./agent/loop.js";
-import { CONFIG_DIR, legacyGlobalModel, loadConfig, loadDotEnv, resolveProvider, } from "./config/config.js";
+import { CONFIG_DIR, legacyGlobalModel, loadConfig, loadDotEnv, privacyModeFor, resolveProvider, } from "./config/config.js";
 import { DEFAULT_MODEL, contextWindowFor } from "./config/models.js";
 import { PermissionManager } from "./permissions/permissions.js";
 import { loadRules } from "./permissions/rules.js";
@@ -35,6 +35,7 @@ export async function createEngineSession(dir, opts = {}) {
     if (trustWorkspace)
         loadDotEnv([path.join(workspace, ".env")]);
     const config = loadConfig();
+    const privacyMode = privacyModeFor(config);
     const provider = resolveProvider(config, opts.provider);
     if (!provider.apiKey) {
         throw new Error(`No API key found for provider "${provider.name}". Set it via env var, a .env file, or ~/.kritya/config.json.`);
@@ -49,9 +50,11 @@ export async function createEngineSession(dir, opts = {}) {
     const client = provider.name === "switchyard"
         ? await createSwitchyardClient(provider.apiKey, sampling)
         : new ProviderClient(provider.apiKey, provider.baseUrl, sampling);
-    const session = new SessionStore(workspace);
+    const session = new SessionStore(workspace, privacyMode);
     session.start([]);
-    const sessionMeter = createMeter(session.id, config.otel);
+    const sessionMeter = privacyMode
+        ? createMeter(session.id, "off")
+        : createMeter(session.id, config.otel);
     // The crash path is fire-and-forget best-effort by Node's own constraints
     // (a crash handler can't reliably await async work), so this uses the
     // synchronous flush() rather than flushAndWait().
@@ -79,8 +82,10 @@ export async function createEngineSession(dir, opts = {}) {
     if (trustWorkspace) {
         agent.hooks = new HookRunner(loadHooks(workspace, trustWorkspace), workspace);
     }
-    agent.audit = AuditLog.forSession(session.id, config.audit);
-    agent.tracer = createTracer(session.id, config.otel);
+    agent.audit = privacyMode ? undefined : AuditLog.forSession(session.id, config.audit);
+    agent.tracer = privacyMode
+        ? createTracer(session.id, "off")
+        : createTracer(session.id, config.otel);
     agent.meter = sessionMeter;
     if (agent.hooks)
         agent.hooks.tracer = agent.tracer;

package/dist/headless.js

@@ -1,7 +1,7 @@
 import path from "node:path";
 import { Agent } from "./agent/loop.js";
 import { KillSwitchError } from "./agent/killSwitch.js";
-import { CONFIG_DIR, legacyGlobalModel, listProviders, loadConfig, loadDotEnv, resolveProvider, } from "./config/config.js";
+import { CONFIG_DIR, legacyGlobalModel, listProviders, loadConfig, loadDotEnv, privacyModeFor, resolveProvider, } from "./config/config.js";
 import { DEFAULT_MODEL, contextWindowFor } from "./config/models.js";
 import { PermissionManager } from "./permissions/permissions.js";
 import { loadRules } from "./permissions/rules.js";
@@ -78,6 +78,7 @@ export async function runHeadless(args) {
     if (trustWorkspace)
         loadDotEnv([path.join(workspace, ".env")]);
     const config = loadConfig();
+    const privacyMode = args.privacy === true || privacyModeFor(config);
     const provider = resolveProvider(config, args.provider || undefined);
     if (!provider.apiKey) {
         return finish(args, startedAt, {
@@ -102,12 +103,16 @@ export async function runHeadless(args) {
     const client = provider.name === "switchyard"
         ? await createSwitchyardClient(provider.apiKey, sampling)
         : new ProviderClient(provider.apiKey, provider.baseUrl, sampling);
-    const session = new SessionStore(workspace);
-    const initialHistory = args.continue ? (SessionStore.loadLatest(workspace) ?? []) : [];
+    const session = new SessionStore(workspace, privacyMode);
+    const initialHistory = !privacyMode && args.continue ? (SessionStore.loadLatest(workspace) ?? []) : [];
     session.start(initialHistory);
-    const sessionAudit = AuditLog.forSession(session.id, config.audit);
-    const sessionTracer = createTracer(session.id, config.otel);
-    const sessionMeter = createMeter(session.id, config.otel);
+    const sessionAudit = privacyMode ? undefined : AuditLog.forSession(session.id, config.audit);
+    const sessionTracer = privacyMode
+        ? createTracer(session.id, "off")
+        : createTracer(session.id, config.otel);
+    const sessionMeter = privacyMode
+        ? createMeter(session.id, "off")
+        : createMeter(session.id, config.otel);
     // A crash here orphans MCP children and background processes onto a CI
     // runner, where nothing will ever reap them. No terminal to restore. The
     // crash path is fire-and-forget best-effort by Node's own constraints (a

package/dist/hooks/hooks.js

@@ -5,6 +5,7 @@ import { CONFIG_DIR, scrubbedShellEnv } from "../config/config.js";
 import { safeCompileRegex } from "../tools/common.js";
 import { NOOP_TRACER } from "../telemetry/tracer.js";
 import { debugLog } from "../config/debug.js";
+import { redactSecrets } from "../tools/secretScan.js";
 const HOOK_TIMEOUT_MS = 30_000;
 export function loadHooks(workspace, trustWorkspace = true) {
     const merged = {};
@@ -85,7 +86,12 @@ export class HookRunner {
                 parent,
                 attributes: { "kritya.hook_command": def.command, "kritya.hook_tool": toolName },
             });
-            const { ok, output } = await execHook(def.command, this.workspace, env);
+            // Hook stdout/stderr is arbitrary command output — it can echo back
+            // whatever the command saw (an env var, a file's contents), so it goes
+            // through the same secret redaction as shell output before it's kept
+            // in the span or handed back to the model.
+            const { ok, output: rawOutput } = await execHook(def.command, this.workspace, env);
+            const output = redactSecrets(rawOutput).redacted;
             if (output)
                 outputs.push(output);
             if (!ok && event === "preToolUse" && def.blocking) {
@@ -107,7 +113,8 @@ export class HookRunner {
                 attributes: { "kritya.hook_command": def.command },
             });
             // stop hooks are best-effort; failures are ignored beyond the span.
-            const { ok, output } = await execHook(def.command, this.workspace, scrubbedShellEnv());
+            const { ok, output: rawOutput } = await execHook(def.command, this.workspace, scrubbedShellEnv());
+            const output = redactSecrets(rawOutput).redacted;
             span.setStatus(ok ? "OK" : "ERROR", ok ? undefined : output.slice(0, 500)).end();
         }
     }

package/dist/index.js

@@ -4,7 +4,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { render } from "ink";
 import { Agent } from "./agent/loop.js";
-import { CONFIG_DIR, legacyGlobalModel, loadConfig, loadDotEnv, resolveProvider, } from "./config/config.js";
+import { CONFIG_DIR, legacyGlobalModel, loadConfig, loadDotEnv, privacyModeFor, resolveProvider, } from "./config/config.js";
 import { DEFAULT_MODEL, contextWindowFor } from "./config/models.js";
 import { PermissionManager } from "./permissions/permissions.js";
 import { loadRules } from "./permissions/rules.js";
@@ -65,6 +65,7 @@ Headless / CI mode (no terminal UI, exits with 0 on success / 1 on failure):
                       since CI often checks out untrusted branches/PRs)
   --timeout <seconds> hard wall-clock cap for the whole run (default 1800)
   --non-interactive   accepted for compatibility; implied by --prompt
+  --privacy           do not persist transcripts, audit logs, or telemetry
 
 Inspect the local audit log:
   kritya audit --list | --verify [file] | --show [file]
@@ -93,6 +94,7 @@ function parseArgs(argv) {
         allowAll: false,
         trust: false,
         timeoutSeconds: 1800,
+        privacy: false,
     };
     for (let i = 0; i < argv.length; i++) {
         const a = argv[i];
@@ -124,6 +126,8 @@ function parseArgs(argv) {
             args.trust = true;
         else if (a === "--timeout")
             args.timeoutSeconds = Number(argv[++i]) || args.timeoutSeconds;
+        else if (a === "--privacy")
+            args.privacy = true;
         else if (a === "--non-interactive") {
             // implied by --prompt; accepted so scripts can pass it explicitly
         }
@@ -176,6 +180,7 @@ if (args.prompt) {
         allowAll: args.allowAll,
         trust: args.trust,
         timeoutSeconds: args.timeoutSeconds,
+        privacy: args.privacy,
     }).then((code) => process.exit(code));
 }
 else {
@@ -261,6 +266,7 @@ async function showAiDisclosureNotice() {
 }
 async function main() {
     const config = loadConfig();
+    const privacyMode = args.privacy || privacyModeFor(config);
     if (!isAiDisclosureShown(workspace)) {
         await showAiDisclosureNotice();
         markAiDisclosureShown(workspace);
@@ -312,18 +318,22 @@ async function main() {
     let client = provider.name === "switchyard"
         ? await createSwitchyardClient(apiKey, sampling)
         : new ProviderClient(apiKey, provider.baseUrl, sampling);
-    const session = new SessionStore(workspace);
+    const session = new SessionStore(workspace, privacyMode);
     // Shared by the main agent and every subagent it spawns, so a write
     // subagent's commits and a read-only subagent's tool calls land in the same
     // audit trail and trace tree as the turn that spawned them — an agent that
     // edits the repo should never do so off the record.
-    const sessionAudit = AuditLog.forSession(session.id, config.audit);
-    const sessionTracer = createTracer(session.id, config.otel);
-    const sessionMeter = createMeter(session.id, config.otel);
-    const initialHistory = args.continue ? (SessionStore.loadLatest(workspace) ?? []) : [];
-    const initialTasks = args.continue ? SessionStore.loadLatestTasks(workspace) : [];
+    const sessionAudit = privacyMode ? undefined : AuditLog.forSession(session.id, config.audit);
+    const sessionTracer = privacyMode
+        ? createTracer(session.id, "off")
+        : createTracer(session.id, config.otel);
+    const sessionMeter = privacyMode
+        ? createMeter(session.id, "off")
+        : createMeter(session.id, config.otel);
+    const initialHistory = !privacyMode && args.continue ? (SessionStore.loadLatest(workspace) ?? []) : [];
+    const initialTasks = !privacyMode && args.continue ? SessionStore.loadLatestTasks(workspace) : [];
     session.start(initialHistory);
-    const resumeSessions = args.resume ? SessionStore.listSessions(workspace) : [];
+    const resumeSessions = !privacyMode && args.resume ? SessionStore.listSessions(workspace) : [];
     // Filled in once the app is mounted, below; the crash handler needs a way to
     // tear the UI down and is installed before there is a UI to tear down.
     const ui = {};
@@ -360,9 +370,16 @@ async function main() {
     // hung collector can't stall shutdown) — cleanup()'s own sessionMeter.flush()
     // is fire-and-forget and would otherwise usually be discarded by the
     // process.exit() that follows it.
+    // SIGINT is included alongside SIGTERM/SIGHUP for the same reason: Ink's
+    // own Ctrl+C handling only fires when it can read a raw keypress from
+    // stdin (which itself falls through to "exit" → cleanup), but a SIGINT
+    // delivered directly to the process — `kill -INT`, a terminal that still
+    // sends a real signal instead of raw-mode bytes — bypasses that path
+    // entirely unless it's handled here too.
     for (const [sig, code] of [
         ["SIGTERM", 143],
         ["SIGHUP", 129],
+        ["SIGINT", 130],
     ]) {
         process.on(sig, () => {
             void (async () => {
@@ -670,5 +687,5 @@ async function main() {
             permissionRef.current = fn;
         }, onRequestElicitationReady: (fn) => {
             elicitationRef.current = fn;
-        } }));
+        }, privacyMode: privacyMode }));
 }