kritya 0.8.4-beta → 0.8.6-beta

package/dist/agent/loop.js

@@ -45,6 +45,13 @@ export class Agent {
     dryRunMode = false;
     /** When true, file-edit tools auto-approve without prompting (see ACCEPT_EDITS_TOOL_NAMES). */
     acceptEdits = false;
+    /**
+     * Whether a human can see and respond to a permission prompt right now.
+     * True by default (the CLI and its subagents render one); headless runs
+     * set this false because there is no one to answer it, so a forced
+     * warning prompt there must resolve on its own rather than block forever.
+     */
+    interactive = true;
     /** Fires each time a tool call is auto-approved because of acceptEdits, for a UI counter. */
     onAutoApprove;
     /**

package/dist/agent/toolExecutor.js

@@ -1,4 +1,5 @@
 import { classifyDanger } from "../permissions/danger.js";
+import { acknowledgeUnsandboxedFallback, sandboxFallbackWarning } from "../shell/sandbox.js";
 import { isPlanningDocWrite, loadProjectState } from "./workflow.js";
 /** How much tool output to hand the UI (it shows a preview and expands on toggle). */
 const PREVIEW_CHARS = 4000;
@@ -190,7 +191,16 @@ export class ToolExecutor {
             return "This action is blocked by a deny rule in the user's settings. Do not retry it; take a different approach.";
         }
         // Destructive shell commands always prompt with a warning, even if allowlisted.
-        const danger = tool.name === "shell" ? classifyDanger(String(args.command ?? "")) : null;
+        const shellCommand = tool.name === "shell" ? String(args.command ?? "") : "";
+        const dangerLabel = tool.name === "shell" ? classifyDanger(shellCommand) : null;
+        // Separate from dangerLabel: this one only fires when no sandbox binary
+        // is installed, so a flagged command is about to run fully unconfined.
+        // Only surfaced when a human can actually see and answer the prompt —
+        // see `Agent.interactive`.
+        const sandboxWarning = tool.name === "shell" && dangerLabel === null && host.interactive
+            ? sandboxFallbackWarning(host.ctx.sandboxMode, shellCommand)
+            : null;
+        const danger = dangerLabel ?? sandboxWarning;
         const autoApproveEdit = host.acceptEdits &&
             danger === null &&
             tool.requiresPermission &&
@@ -214,6 +224,12 @@ export class ToolExecutor {
             // A forced (danger) prompt does not grant a lasting allowance.
             if (danger === null)
                 host.permissions.record(tool.name, decision, args);
+            // Unlike a dangerLabel prompt (which re-warns every time on purpose),
+            // approving the unsandboxed-fallback warning once is enough — "auto"
+            // sandboxes nearly every command, so re-asking on each one would be
+            // an unusable wall of prompts for a fact that won't change mid-session.
+            if (decision === "yes" && sandboxWarning !== null)
+                acknowledgeUnsandboxedFallback();
             if (decision === "no") {
                 host.audit?.logPermission({
                     tool: name,

package/dist/config/models.js

@@ -23,6 +23,11 @@ export const CURATED_MODELS = [
         label: "Nemotron 3 Ultra 550B",
         contextWindow: 128_000,
     },
+    {
+        id: "nvidia/nemotron-3-nano-omni-30b-a3b-reasoning",
+        label: "Nemotron 3 Nano Omni 30B Reasoning",
+        contextWindow: 128_000,
+    },
     {
         id: "meta/muse-glimmer-30b",
         label: "Muse Glimmer 30B",

package/dist/headless.js

@@ -164,6 +164,10 @@ export async function runHeadless(args) {
     // declined" for a question no one was actually asked.
     { workspace, sandboxMode: config.sandboxExec ?? defaultSandboxMode(), trustWorkspace }, permissions, session, initialHistory);
     agent.contextWindow = contextWindowFor(model, config);
+    // No one is present to answer a permission prompt, so a forced
+    // unsandboxed-fallback warning must resolve on its own (see
+    // requestPermission below) rather than be raised at all.
+    agent.interactive = false;
     if (config.maxSteps && config.maxSteps > 0)
         agent.maxSteps = config.maxSteps;
     if (config.toolTimeoutSeconds !== undefined) {

package/dist/index.js

@@ -526,6 +526,10 @@ async function main() {
             // network access).
             const sub = new Agent(client, () => modelRef.current, writeSubTools, { workspace: wt.dir, sandboxMode, trustWorkspace }, new PermissionManager({ allow: ["write_file", "edit_file", "shell(*)"], deny: [] }, wt.dir), new SessionStore(wt.dir, true), []);
             sub.maxSteps = 30;
+            // No human is watching this run (see the auto-allow comment above) —
+            // the forced unsandboxed-fallback warning must resolve on its own via
+            // the handler below rather than be raised at all.
+            sub.interactive = false;
             sub.audit = sessionAudit;
             sub.tracer = sessionTracer;
             sub.meter = sessionMeter;

package/dist/shell/sandbox.js

@@ -81,6 +81,45 @@ export function shouldSandbox(mode, command) {
 export function requiresSandbox(mode) {
     return mode === "strict";
 }
+/**
+ * True once the user has explicitly approved running unsandboxed for the rest
+ * of this process — see `sandboxFallbackWarning`. Resets on restart; there is
+ * no persistent "don't ask again" for this, since a different host without
+ * the sandbox binary could be running next time.
+ */
+let unsandboxedFallbackAcknowledged = false;
+/** Records that the user approved the one-time unsandboxed-fallback warning. */
+export function acknowledgeUnsandboxedFallback() {
+    unsandboxedFallbackAcknowledged = true;
+}
+/** Test-only: undoes `acknowledgeUnsandboxedFallback` between test cases. */
+export function resetUnsandboxedFallbackAcknowledgement() {
+    unsandboxedFallbackAcknowledged = false;
+}
+/**
+ * A one-time, forced permission-prompt warning for the fail-open gap in
+ * "auto"/"always": sandboxing was requested for `command` but no sandbox
+ * binary is installed, so it's about to run completely unconfined — able to
+ * read, write, or delete anywhere the real user can, not just inside the
+ * workspace. Returns null (nothing to warn about) once
+ * `acknowledgeUnsandboxedFallback` has been called this run, when sandboxing
+ * wasn't requested for this command, when a sandbox binary IS available, or
+ * under "strict" (which refuses instead of falling back, so it has no silent
+ * gap to warn about).
+ */
+export function sandboxFallbackWarning(mode, command) {
+    if (unsandboxedFallbackAcknowledged)
+        return null;
+    if (!shouldSandbox(mode, command))
+        return null;
+    if (requiresSandbox(mode))
+        return null;
+    if (sandboxAvailable())
+        return null;
+    return (`a command running with NO sandbox isolation (${sandboxUnavailableReason()}) — ` +
+        `it can read, write, or delete anywhere you can, not just inside the workspace. ` +
+        `Approving runs this command now and skips this warning for the rest of the session`);
+}
 /**
  * Common tool-cache / global-install directories outside the workspace that
  * legitimate commands need to write to (package manager caches, toolchain

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kritya",
-  "version": "0.8.4-beta",
+  "version": "0.8.6-beta",
   "description": "Kritya — a lean, provider-agnostic terminal coding agent (NVIDIA, OpenAI, OpenRouter, Groq, Ollama, and more)",
   "type": "module",
   "bin": {