kritya 0.8.25-beta → 0.8.26-beta

package/dist/agent/loop.js

@@ -45,6 +45,15 @@ export class Agent {
     dryRunMode = false;
     /** When true, file-edit tools auto-approve without prompting (see ACCEPT_EDITS_TOOL_NAMES). */
     acceptEdits = false;
+    /**
+     * When true, EVERY tool call auto-approves without prompting — including
+     * `shell` and classifyDanger-flagged destructive commands, unlike
+     * `acceptEdits`. Only reachable from the UI when the sandbox is active
+     * (see sandboxAvailable in shell/sandbox.ts), since that's the safety net
+     * this mode leans on instead of a human in the loop. Deny rules and the
+     * kill switch still apply regardless of this flag.
+     */
+    bypassMode = false;
     /**
      * Whether a human can see and respond to a permission prompt right now.
      * True by default (the CLI and its subagents render one); headless runs

package/dist/agent/toolExecutor.js

@@ -236,8 +236,17 @@ export class ToolExecutor {
             danger === null &&
             tool.requiresPermission &&
             ACCEPT_EDITS_TOOL_NAMES.has(tool.name);
+        // Unlike autoApproveEdit, this covers every tool — including `shell` and
+        // classifyDanger-flagged destructive commands — since bypassMode leans on
+        // the sandbox (not a human) to contain the blast radius. planMode/dryRunMode
+        // already returned above, so this can't apply while either is on.
+        const autoApproveBypass = host.bypassMode;
         let source;
-        if (autoApproveEdit) {
+        if (autoApproveBypass) {
+            host.onAutoApprove?.();
+            source = "bypass-mode";
+        }
+        else if (autoApproveEdit) {
             host.onAutoApprove?.();
             source = "accept-edits";
         }

package/dist/commands/registry.js

@@ -232,6 +232,10 @@ async function runPhase(ctx, phase) {
         ctx.agent.acceptEdits = false;
         ctx.setAcceptEdits(false);
     }
+    if (wantPlanMode && ctx.bypassMode) {
+        ctx.agent.bypassMode = false;
+        ctx.setBypassMode(false);
+    }
     saveProjectState(ctx.workspace, project.name, phase);
     const artifact = artifactPath(project.name, phase);
     ctx.addItem({

package/dist/ui/AiDisclosurePrompt.js

@@ -19,5 +19,5 @@ export function AiDisclosurePrompt({ onDismiss }) {
         const id = setInterval(() => setBlinkOn((v) => !v), BLINK_INTERVAL_MS);
         return () => clearInterval(id);
     }, []);
-    return (_jsxs(Box, { flexDirection: "column", borderStyle: "round", paddingX: 1, children: [_jsx(Text, { children: "kritya is an AI agent" }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { children: "You are interacting with an AI system: kritya reads/writes files and runs shell commands here, acting on an AI model's output \u2014 not a human." }) }), _jsx(Text, { children: "Mutating actions ask for approval first." }), _jsx(Text, { children: "Details: /help, SECURITY.md (EU AI Act Art. 50)." }), _jsx(Box, { marginTop: 1, children: _jsxs(Text, { children: ["Shown once. ", _jsx(Text, { color: "yellow", children: blinkOn ? "AI Disclosure" : " " })] }) }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { children: "Press Enter to continue\u2026" }) })] }));
+    return (_jsxs(Box, { flexDirection: "column", borderStyle: "round", paddingX: 1, children: [_jsx(Text, { children: "kritya is an AI agent" }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { children: "It reads files, edits your project, and runs commands \u2014 driven by an AI model, not a human. You approve changes before they happen." }) }), _jsx(Text, { dimColor: true, children: "Details: /help, SECURITY.md (EU AI Act Art. 50)." }), _jsx(Box, { marginTop: 1, children: _jsxs(Text, { children: ["Shown once. ", _jsx(Text, { color: "yellow", children: blinkOn ? "AI Disclosure" : " " })] }) }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { children: "Press Enter to continue\u2026" }) })] }));
 }

package/dist/ui/App.js

@@ -125,7 +125,7 @@ export function App({ agent, workspace, modelRef, providerRef, config, resumedCo
             .catch(() => { });
     }, [workspace]);
     useEffect(refreshFileList, [refreshFileList]);
-    const { items, addItem, phase, setPhase, stream, thinking, activity, setActivity, runningPhase, setRunningPhase, workflow, refreshWorkflow, permission, elicitation, inFlight, model, provider, servedModel, totalUsage, totalCost, tasks, setTasks, ctxPct, setCtxPct, tokenBudget, budgetPct, budgetUsed, budgetStopped, resetBudget, setBudgetLimit, branch, planMode, setPlanMode, dryRunMode, killed, killReason, engageKill, releaseKill, acceptEdits, setAcceptEdits, autoApprovedCount, cycleMode, onAcceptEditsConfirm, abortRef, setModelEverywhere, setProviderEverywhere, costReport, runAgent, runWebSearch, onPermissionDecision, onElicitationDecision, onResumeSelect, requestPermission, requestElicitation, persistenceWarningCount, } = useAgent({
+    const { items, addItem, phase, setPhase, stream, thinking, activity, setActivity, runningPhase, setRunningPhase, workflow, refreshWorkflow, permission, elicitation, inFlight, model, provider, servedModel, totalUsage, totalCost, tasks, setTasks, ctxPct, setCtxPct, tokenBudget, budgetPct, budgetUsed, budgetStopped, resetBudget, setBudgetLimit, branch, planMode, setPlanMode, dryRunMode, killed, killReason, engageKill, releaseKill, acceptEdits, setAcceptEdits, bypassMode, setBypassMode, autoApprovedCount, cycleMode, onAcceptEditsConfirm, onBypassModeConfirm, abortRef, setModelEverywhere, setProviderEverywhere, costReport, runAgent, runWebSearch, onPermissionDecision, onElicitationDecision, onResumeSelect, requestPermission, requestElicitation, persistenceWarningCount, } = useAgent({
         agent,
         workspace,
         modelRef,
@@ -258,6 +258,15 @@ export function App({ agent, workspace, modelRef, providerRef, config, resumedCo
                 onAcceptEditsConfirm(false);
             return;
         }
+        // First-time auto/bypass-mode confirmation: Yes proceeds, anything else cancels.
+        if (phase === "confirmBypassMode") {
+            const c = _input.toLowerCase();
+            if (c === "y" || key.return)
+                onBypassModeConfirm(true);
+            else if (c === "n" || key.escape)
+                onBypassModeConfirm(false);
+            return;
+        }
         // History recall with ↑/↓ when no autocomplete popup is open.
         if (phase === "input" && !suggestions.length && !fileSuggestions.length) {
             const hist = inputHistory.current;
@@ -320,6 +329,8 @@ export function App({ agent, workspace, modelRef, providerRef, config, resumedCo
             planMode,
             acceptEdits,
             setAcceptEdits,
+            bypassMode,
+            setBypassMode,
             tokenBudget,
             budgetPct,
             budgetUsed,
@@ -444,7 +455,7 @@ export function App({ agent, workspace, modelRef, providerRef, config, resumedCo
             addItem({ kind: "info", text: `Attached ${images.length} image(s).` });
         await runAgent(await expandMentions(text), images);
     };
-    return (_jsxs(Box, { flexDirection: "column", children: [_jsx(Static, { items: items, children: (item) => _jsx(TranscriptItem, { item: item, verbose: verbose, stdout: stdout }, item.id) }, staticKey), stream ? (_jsx(Box, { marginBottom: 1, children: _jsx(Markdown, { text: tailForViewport(stream, terminalColumns(stdout), terminalRows(stdout)), streaming: true }) })) : null, tasks.length > 0 && (_jsx(Box, { flexDirection: "column", borderStyle: "round", borderColor: "blue", paddingX: 1, width: Math.min(terminalColumns(stdout) - 2, Math.max(...tasks.map((t) => stringWidth(t.text))) + 6), children: tasks.map((t, i) => (_jsxs(Text, { color: t.status === "done" ? "green" : t.status === "in_progress" ? "yellow" : undefined, dimColor: t.status === "pending", children: [t.status === "done" ? "☑" : t.status === "in_progress" ? "◐" : "☐", " ", t.text] }, i))) })), phase === "working" && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Spinner, { label: 
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsx(Static, { items: items, children: (item) => _jsx(TranscriptItem, { item: item, verbose: verbose, stdout: stdout }, item.id) }, staticKey), firstLaunch && items.length <= 1 && phase === "input" && (_jsxs(Box, { flexDirection: "column", marginBottom: 1, paddingLeft: 2, children: [_jsx(Text, { dimColor: true, children: "Try asking:" }), _jsx(Text, { dimColor: true, children: " \u00B7 Explain this codebase" }), _jsx(Text, { dimColor: true, children: " \u00B7 Find and fix failing tests" }), _jsx(Text, { dimColor: true, children: " \u00B7 Review my uncommitted changes" }), _jsx(Text, { dimColor: true, children: " \u00B7 Add a new feature" }), _jsx(Text, { dimColor: true, children: " \u00B7 /help for commands" })] })), stream ? (_jsx(Box, { marginBottom: 1, children: _jsx(Markdown, { text: tailForViewport(stream, terminalColumns(stdout), terminalRows(stdout)), streaming: true }) })) : null, tasks.length > 0 && (_jsx(Box, { flexDirection: "column", borderStyle: "round", borderColor: "blue", paddingX: 1, width: Math.min(terminalColumns(stdout) - 2, Math.max(...tasks.map((t) => stringWidth(t.text))) + 6), children: tasks.map((t, i) => (_jsxs(Text, { color: t.status === "done" ? "green" : t.status === "in_progress" ? "yellow" : undefined, dimColor: t.status === "pending", children: [t.status === "done" ? "☑" : t.status === "in_progress" ? "◐" : "☐", " ", t.text] }, i))) })), phase === "working" && (_jsxs(Box, { flexDirection: "column", children: [_jsx(Spinner, { label: 
                         // The workflow prefix rides on every branch, not just "thinking":
                         // during a phase you want to know which phase a tool call belongs
                         // to just as much as which phase is being reasoned about.
@@ -471,7 +482,7 @@ export function App({ agent, workspace, modelRef, providerRef, config, resumedCo
                                     }
                                     addItem({ kind: "user", text: `${text} (queued)` });
                                     void expandMentions(text).then((t) => agent.queueSteer(t));
-                                }, placeholder: "steer the agent\u2026 (Enter to queue)" })] })] })), phase === "permission" && permission && (_jsx(PermissionPrompt, { toolName: permission.toolName, summary: permission.summary, diff: permission.diff, warning: permission.warning, onDecision: onPermissionDecision })), phase === "elicitation" && elicitation && (_jsx(ElicitationPrompt, { message: elicitation.message, fields: elicitation.fields, onDecision: onElicitationDecision })), phase === "confirmMode" && (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: "green", paddingX: 1, children: [_jsx(Text, { bold: true, color: "green", children: "Switch to accept-edits mode?" }), _jsx(Text, { children: "File writes and edits will auto-approve without asking." }), _jsx(Text, { dimColor: true, children: "Destructive shell commands (rm -rf, force-push, etc.) always still ask, in every mode." }), _jsx(Text, { dimColor: true, children: "Shift+Tab again moves to dry-run mode; once more back to normal." }), _jsx(Box, { marginTop: 1, children: _jsxs(Text, { children: [_jsx(Text, { color: "green", children: "Yes (y)" }), " \u00B7 No (n/Esc)"] }) })] })), phase === "model" && (_jsx(ModelPicker, { current: model, customModels: config.customModels ?? [], onSelect: (id) => {
+                                }, placeholder: "steer the agent\u2026 (Enter to queue)" })] })] })), phase === "permission" && permission && (_jsx(PermissionPrompt, { toolName: permission.toolName, summary: permission.summary, diff: permission.diff, warning: permission.warning, onDecision: onPermissionDecision })), phase === "elicitation" && elicitation && (_jsx(ElicitationPrompt, { message: elicitation.message, fields: elicitation.fields, onDecision: onElicitationDecision })), phase === "confirmMode" && (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: "green", paddingX: 1, children: [_jsx(Text, { bold: true, color: "green", children: "Switch to accept-edits mode?" }), _jsx(Text, { children: "File writes and edits will auto-approve without asking." }), _jsx(Text, { dimColor: true, children: "Destructive shell commands (rm -rf, force-push, etc.) always still ask, in every mode." }), _jsx(Text, { dimColor: true, children: "Shift+Tab again moves to dry-run mode; once more back to normal." }), _jsx(Box, { marginTop: 1, children: _jsxs(Text, { children: [_jsx(Text, { color: "green", children: "Yes (y)" }), " \u00B7 No (n/Esc)"] }) })] })), phase === "confirmBypassMode" && (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: "red", paddingX: 1, children: [_jsx(Text, { bold: true, color: "red", children: "Switch to auto mode? (sandbox-gated)" }), _jsx(Text, { children: "EVERY tool call will auto-approve, including destructive shell commands (rm -rf, force-push, etc.) \u2014 nothing will ask first." }), _jsx(Text, { dimColor: true, children: "The sandbox \u2014 not a human \u2014 is what contains any damage this mode causes." }), _jsx(Text, { dimColor: true, children: "Shift+Tab again goes back to normal." }), _jsx(Box, { marginTop: 1, children: _jsxs(Text, { children: [_jsx(Text, { color: "red", children: "Yes (y)" }), " \u00B7 No (n/Esc)"] }) })] })), phase === "model" && (_jsx(ModelPicker, { current: model, customModels: config.customModels ?? [], onSelect: (id) => {
                     setPhase("input");
                     setModelEverywhere(id);
                 }, onCancel: () => setPhase("input") })), phase === "resume" && (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: "magenta", paddingX: 1, children: [_jsxs(Text, { bold: true, color: "magenta", children: ["Resume a session ", _jsx(Text, { dimColor: true, children: "(type to search \u00B7 Esc for a fresh one)" })] }), resumeFilter ? (_jsxs(Text, { children: [_jsx(Text, { dimColor: true, children: "filter: " }), resumeFilter] })) : null, _jsx(SelectList, { items: (resumeSessions ?? [])
@@ -496,7 +507,7 @@ export function App({ agent, workspace, modelRef, providerRef, config, resumedCo
                                     lastCategory = c.category;
                                     return (_jsxs(Fragment, { children: [showHeader && _jsx(Text, { dimColor: true, children: c.category ?? "Other" }), _jsxs(Text, { color: i === selectedCmd ? "cyan" : undefined, children: [i === selectedCmd ? "❯ " : "  ", _jsx(Text, { bold: i === selectedCmd, children: c.name }), _jsxs(Text, { dimColor: true, children: [" \u2014 ", c.description] })] })] }, c.name));
                                 });
-                            })(), _jsx(Text, { dimColor: true, children: "\u2191\u2193 select \u00B7 Tab/Enter select \u00B7 Enter again to run" })] })), fileSuggestions.length > 0 && (_jsxs(Box, { flexDirection: "column", paddingLeft: 2, children: [fileSuggestions.map((f, i) => (_jsxs(Text, { color: i === selectedFile ? "cyan" : undefined, children: [i === selectedFile ? "❯ " : "  ", f] }, f))), _jsx(Text, { dimColor: true, children: "\u2191\u2193 select \u00B7 Tab/Enter attach file" })] }))] })), _jsx(Box, { children: _jsx(StatusLine, { killed: killed, killReason: killReason, dryRunMode: dryRunMode, planMode: planMode, acceptEdits: acceptEdits, autoApprovedCount: autoApprovedCount, provider: provider, model: servedModel && servedModel !== model
+                            })(), _jsx(Text, { dimColor: true, children: "\u2191\u2193 select \u00B7 Tab/Enter select \u00B7 Enter again to run" })] })), fileSuggestions.length > 0 && (_jsxs(Box, { flexDirection: "column", paddingLeft: 2, children: [fileSuggestions.map((f, i) => (_jsxs(Text, { color: i === selectedFile ? "cyan" : undefined, children: [i === selectedFile ? "❯ " : "  ", f] }, f))), _jsx(Text, { dimColor: true, children: "\u2191\u2193 select \u00B7 Tab/Enter attach file" })] }))] })), _jsx(Box, { children: _jsx(StatusLine, { killed: killed, killReason: killReason, dryRunMode: dryRunMode, planMode: planMode, acceptEdits: acceptEdits, bypassMode: bypassMode, autoApprovedCount: autoApprovedCount, provider: provider, model: servedModel && servedModel !== model
                         ? `${model}-${modelDisplaySlug(servedModel)}`
                         : model, workflow: workflow, branch: branch, budgetPct: budgetPct, budgetStopped: budgetStopped, totalCost: totalCost, sandboxActive: (config.sandboxExec ?? defaultSandboxMode()) !== "off" && sandboxAvailable(), persistenceWarningCount: persistenceWarningCount, privacyMode: privacyMode }) })] }));
 }

package/dist/ui/StatusLine.js

@@ -8,12 +8,14 @@ import { displayModelId } from "../config/models.js";
  * moved to the on-demand `/status` command — see CommandContext.statusReport
  * in src/commands/registry.ts.
  */
-export function StatusLine({ killed, killReason, dryRunMode, planMode, acceptEdits, autoApprovedCount, provider, model, workflow, branch, budgetPct, budgetStopped, totalCost, sandboxActive, persistenceWarningCount, privacyMode, }) {
-    return (_jsxs(Text, { dimColor: true, children: [killed ? (_jsxs(Text, { bold: true, color: "red", children: ["\u26D4 KILLED", killReason ? ` (${killReason})` : "", " \u00B7", " "] })) : (""), _jsxs(Text, { color: dryRunMode || planMode ? "cyan" : acceptEdits ? "green" : undefined, children: ["mode:", " ", dryRunMode
-                        ? "dry-run"
-                        : planMode
-                            ? "plan"
-                            : acceptEdits
-                                ? `accept-edits (${autoApprovedCount} auto)`
-                                : "default", " · "] }), displayModelId(provider, model), _jsxs(Text, { color: sandboxActive ? "green" : "red", children: [" ", "\u00B7 ", sandboxActive ? "🔒 sandbox:active" : "🔓 sandbox:inactive"] }), workflow ? (_jsxs(Text, { color: "magenta", children: [" ", "\u00B7 \u2691 ", workflow.name, ":", workflow.phase] })) : (""), branch ? ` · ⎇ ${branch}` : "", budgetStopped || budgetPct >= 80 ? (_jsxs(Text, { color: budgetStopped ? "red" : "yellow", children: [" \u00B7 budget ", budgetPct, "%"] })) : (""), totalCost > 0 ? ` · $${totalCost.toFixed(4)}` : "", persistenceWarningCount > 0 ? (_jsxs(Text, { color: "yellow", children: [" \u00B7 \u26A0 persistence warnings: ", persistenceWarningCount] })) : (""), privacyMode ? _jsx(Text, { color: "cyan", children: " \u00B7 privacy:on" }) : "", " · /status for details"] }));
+export function StatusLine({ killed, killReason, dryRunMode, planMode, acceptEdits, bypassMode, autoApprovedCount, provider, model, workflow, branch, budgetPct, budgetStopped, totalCost, sandboxActive, persistenceWarningCount, privacyMode, }) {
+    return (_jsxs(Text, { dimColor: true, children: [killed ? (_jsxs(Text, { bold: true, color: "red", children: ["\u26D4 KILLED", killReason ? ` (${killReason})` : "", " \u00B7", " "] })) : (""), _jsxs(Text, { color: bypassMode ? "red" : dryRunMode || planMode ? "cyan" : acceptEdits ? "green" : undefined, children: ["mode:", " ", bypassMode
+                        ? `auto (${autoApprovedCount} auto)`
+                        : dryRunMode
+                            ? "dry-run"
+                            : planMode
+                                ? "plan"
+                                : acceptEdits
+                                    ? `accept-edits (${autoApprovedCount} auto)`
+                                    : "default", " · "] }), displayModelId(provider, model), _jsxs(Text, { color: sandboxActive ? "green" : "red", children: [" ", "\u00B7 ", sandboxActive ? "🔒 sandbox:active" : "🔓 sandbox:inactive"] }), workflow ? (_jsxs(Text, { color: "magenta", children: [" ", "\u00B7 \u2691 ", workflow.name, ":", workflow.phase] })) : (""), branch ? ` · ⎇ ${branch}` : "", budgetStopped || budgetPct >= 80 ? (_jsxs(Text, { color: budgetStopped ? "red" : "yellow", children: [" \u00B7 budget ", budgetPct, "%"] })) : (""), totalCost > 0 ? ` · $${totalCost.toFixed(4)}` : "", persistenceWarningCount > 0 ? (_jsxs(Text, { color: "yellow", children: [" \u00B7 \u26A0 persistence warnings: ", persistenceWarningCount] })) : (""), privacyMode ? _jsx(Text, { color: "cyan", children: " \u00B7 privacy:on" }) : "", " · /diff review · /undo revert · Ctrl+K stop · /status for details"] }));
 }

package/dist/ui/TranscriptItem.js

@@ -9,5 +9,5 @@ export function TranscriptItem({ item, verbose, stdout }) {
     return (_jsxs(Box, { marginBottom: item.kind === "tool" ? 0 : 1, flexDirection: "column", children: [item.kind === "user" && (_jsxs(Text, { children: [_jsxs(Text, { bold: true, color: "green", children: ["\u276F", " "] }), item.text] })), item.kind === "assistant" && _jsx(Markdown, { text: item.text }), item.kind === "tool" && (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Text, { dimColor: true, children: [item.error ? _jsx(Text, { color: "red", children: "\u2717" }) : _jsx(Text, { color: "green", children: "\u2713" }), " ", item.summary, item.resultSummary && !verbose ? ` — ${item.resultSummary}` : ""] }), item.output && item.output.trim() && (item.resultSummary === undefined || verbose) && (_jsx(Text, { dimColor: true, children: toolOutputPreview(item.output, verbose, Math.max(20, terminalColumns(stdout) - 6), item.error)
                             .split("\n")
                             .map((l) => `    ${l}`)
-                            .join("\n") }))] })), item.kind === "info" && _jsx(Text, { dimColor: true, children: item.text }), item.kind === "banner" && _jsx(Banner, { subtitle: item.subtitle, compact: item.compact })] }));
+                            .join("\n") }))] })), item.kind === "info" && _jsx(Text, { dimColor: true, children: item.text }), item.kind === "banner" && _jsx(Banner, { subtitle: item.subtitle, compact: item.compact }), item.kind === "summary" && (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: "green", paddingX: 1, children: [_jsx(Text, { bold: true, color: "green", children: "\u2713 Completed" }), item.files.length > 0 ? (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { dimColor: true, children: "Changed:" }), item.files.map((f) => (_jsxs(Text, { children: [" ", f] }, f)))] })) : (_jsx(Text, { dimColor: true, children: "No files changed." })), _jsxs(Text, { dimColor: true, children: ["Next: ", item.nextStep] })] }))] }));
 }

package/dist/ui/useAgent.js

@@ -7,12 +7,27 @@ import { ProviderClient, RetryExhaustedError, friendlyProviderErrorHint, } from
 import { createSwitchyardClient } from "../provider/switchyardClient.js";
 import { SWITCHYARD_ROUTE_ID, resolveEffectiveModel } from "../provider/switchyardSidecar.js";
 import { KillSwitchError } from "../agent/killSwitch.js";
+import { defaultSandboxMode, sandboxAvailable } from "../shell/sandbox.js";
 import { loadProjectState, nextPhase, PHASE_COMMAND, } from "../agent/workflow.js";
 import { tavilySearch } from "../tools/webSearch.js";
 import { killActiveNotice, useKillSwitch } from "./useKillSwitch.js";
 import { useUsageBudget } from "./useUsageBudget.js";
 import { useSessionResume } from "./useSessionResume.js";
 import { activePersistenceWarnings, onPersistenceWarning } from "../config/debug.js";
+/** Tool names whose successful calls mutate a file the user would want to review. */
+const FILE_MUTATING_TOOLS = new Set([
+    "edit_file",
+    "write_file",
+    "edit_notebook",
+    "edit_spreadsheet",
+    "edit_pdf",
+    "write_document",
+]);
+/** Pulls the path out of a tool summary like "Edit src/foo.ts" or "Write src/foo.ts (12 bytes)". */
+function pathFromToolSummary(summary) {
+    const match = summary.match(/^\S+\s+(\S+)/);
+    return match?.[1];
+}
 function initialToolStatus(name) {
     if (name.startsWith("mcp_"))
         return "contacting MCP server…";
@@ -102,8 +117,13 @@ export function useAgent({ agent, workspace, modelRef, providerRef, config, uiBr
      *  workflow's own `planMode`. */
     const [dryRunMode, setDryRunMode] = useState(false);
     const [acceptEdits, setAcceptEdits] = useState(false);
+    const [bypassMode, setBypassMode] = useState(false);
     const [autoApprovedCount, setAutoApprovedCount] = useState(0);
     const hasConfirmedAcceptEdits = useRef(false);
+    const hasConfirmedBypassMode = useRef(false);
+    /** Whether auto/bypass mode is even reachable — requires a real sandbox
+     *  backend on this platform (Windows never has one; see sandboxAvailable). */
+    const sandboxActive = (config.sandboxExec ?? defaultSandboxMode()) !== "off" && sandboxAvailable();
     const abortRef = useRef(null);
     /** Tool calls currently running, keyed by call id — more than one when a
      *  turn's read-only calls are dispatched in parallel. Rendered as live rows. */
@@ -192,12 +212,44 @@ export function useAgent({ agent, workspace, modelRef, providerRef, config, uiBr
                 "more for normal.",
         });
     };
-    /** Cycles normal → accept-edits → dry-run → normal. First entry into accept-edits this session pauses on a confirmation instead of switching immediately. */
+    const enterBypassMode = () => {
+        hasConfirmedBypassMode.current = true;
+        agent.bypassMode = true;
+        setBypassMode(true);
+        setAutoApprovedCount(0);
+        addItem({
+            kind: "info",
+            text: "Auto mode ON — EVERY tool call auto-approves, including destructive shell commands " +
+                "(rm -rf, force-push, etc.). Relies on the sandbox, not a human, to contain damage. " +
+                "Shift+Tab again for normal.",
+        });
+    };
+    /**
+     * Cycles normal → accept-edits → dry-run → auto (only when the sandbox is
+     * active) → normal. First entry into accept-edits or auto mode this session
+     * pauses on a confirmation instead of switching immediately. When the
+     * sandbox isn't active, auto mode is skipped and dry-run goes straight back
+     * to normal, same as before this mode existed.
+     */
     const cycleMode = () => {
+        if (bypassMode) {
+            agent.bypassMode = false;
+            setBypassMode(false);
+            addItem({ kind: "info", text: "Auto mode OFF — back to normal, prompts resume." });
+            return;
+        }
         if (dryRunMode) {
             agent.dryRunMode = false;
             setDryRunMode(false);
-            addItem({ kind: "info", text: "Dry-run mode OFF — the agent can make changes again." });
+            if (!sandboxActive) {
+                addItem({ kind: "info", text: "Dry-run mode OFF — the agent can make changes again." });
+                return;
+            }
+            if (!hasConfirmedBypassMode.current) {
+                setPhase("confirmBypassMode");
+                return;
+            }
+            enterBypassMode();
             return;
         }
         if (acceptEdits) {
@@ -222,6 +274,13 @@ export function useAgent({ agent, workspace, modelRef, providerRef, config, uiBr
         if (confirmed)
             enterAcceptEdits();
     };
+    const onBypassModeConfirm = (confirmed) => {
+        setPhase("input");
+        if (confirmed)
+            enterBypassMode();
+        else
+            addItem({ kind: "info", text: "Auto mode declined — back to normal." });
+    };
     const setModelEverywhere = (id) => {
         modelRef.current = id;
         setModel(id);
@@ -387,6 +446,8 @@ export function useAgent({ agent, workspace, modelRef, providerRef, config, uiBr
         const ac = new AbortController();
         abortRef.current = ac;
         setInFlight([]);
+        const changedFiles = new Set();
+        let turnSucceeded = false;
         try {
             await agent.runTurn(text, {
                 onTextDelta: (delta) => {
@@ -408,6 +469,11 @@ export function useAgent({ agent, workspace, modelRef, providerRef, config, uiBr
                 },
                 onToolEnd: (id, name, summary, preview, isError, resultSummary) => {
                     setInFlight((prev) => prev.filter((t) => t.id !== id));
+                    if (!isError && FILE_MUTATING_TOOLS.has(name)) {
+                        const p = pathFromToolSummary(summary);
+                        if (p)
+                            changedFiles.add(p);
+                    }
                     if (name !== "update_tasks")
                         addItem({
                             kind: "tool",
@@ -439,6 +505,7 @@ export function useAgent({ agent, workspace, modelRef, providerRef, config, uiBr
                     recordUsage(usage);
                 },
             }, ac.signal, images);
+            turnSucceeded = true;
         }
         catch (err) {
             const isAbort = (err instanceof Error && err.name === "AbortError") ||
@@ -476,6 +543,13 @@ export function useAgent({ agent, workspace, modelRef, providerRef, config, uiBr
             addItem({ kind: "info", text });
         }
         finally {
+            if (turnSucceeded && changedFiles.size > 0) {
+                addItem({
+                    kind: "summary",
+                    files: [...changedFiles],
+                    nextStep: "review with /diff · revert with /undo",
+                });
+            }
             abortRef.current = null;
             setInFlight([]);
             setStream("");
@@ -554,9 +628,13 @@ export function useAgent({ agent, workspace, modelRef, providerRef, config, uiBr
         releaseKill,
         acceptEdits,
         setAcceptEdits,
+        bypassMode,
+        setBypassMode,
+        sandboxActive,
         autoApprovedCount,
         cycleMode,
         onAcceptEditsConfirm,
+        onBypassModeConfirm,
         abortRef,
         setModelEverywhere,
         setProviderEverywhere,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kritya",
-  "version": "0.8.25-beta",
+  "version": "0.8.26-beta",
   "description": "Kritya — a lean, provider-agnostic terminal coding agent (NVIDIA, OpenAI, OpenRouter, Groq, Ollama, and more)",
   "type": "module",
   "publishConfig": {