kritya 0.8.56-beta → 0.8.58-beta

package/README.md

@@ -13,6 +13,8 @@ are triaged.
 
 Open source, [MIT licensed](LICENSE).
 
+GitHub is the canonical repo; the [GitLab copy](https://gitlab.com/tech_venkat/kritya) is a read-only backup mirror.
+
 Superintelligence at your command line
 
 It works with any OpenAI-compatible endpoint: [build.nvidia.com](https://build.nvidia.com)
@@ -63,7 +65,7 @@ Requires Node.js >=22.19.0.
    model → "Get API Key").
 2. Set it (any one of these):
    - Put `NVIDIA_API_KEY=nvapi-...` in a `.env` file — checked in the workspace
-     you launch in, the directory you run from, and `~/.kritya/.env`
+     you launch in, and `~/.kritya/.env`
    - Linux/macOS: `export NVIDIA_API_KEY=nvapi-...`
    - Windows: `setx NVIDIA_API_KEY nvapi-...` (then open a new terminal)
 
@@ -97,6 +99,14 @@ cd ~/some-project
 kritya               # enter
 ```
 
+### Desktop app
+
+There is also an Electron desktop app wrapping the same agent (`electron/`,
+`npm run electron:dev` / `npm run electron:build`). Automatic desktop builds
+are currently paused; Windows installers are built manually via the
+"Build Desktop App" workflow. See
+[docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) for how the app is put together.
+
 ## Screenshots
 
 **One-time AI disclosure notice on first launch**
@@ -203,7 +213,9 @@ Custom `/commands` you define (see [docs/CONFIGURATION.md](docs/CONFIGURATION.md
 `Esc` cancels a running request. `↑/↓` recalls input history. `Ctrl+O` toggles
 full tool output. `Ctrl+E` opens the file the agent touched most recently in
 `$EDITOR`. `Ctrl+P` opens the command palette (fuzzy-find commands and
-checkpoints). `Ctrl+K` is the kill switch (see below). `Ctrl+C` exits.
+checkpoints). `Ctrl+B` copies the agent's most recent code block. `Ctrl+R`
+opens reverse history search. `Ctrl+K` is the kill switch (see below).
+`Ctrl+C` exits.
 
 ### More features
 
@@ -288,14 +300,20 @@ checkpoints). `Ctrl+K` is the kill switch (see below). `Ctrl+C` exits.
 
 - **Trust levels** — `Shift+Tab` cycles **normal** (every write/edit asks
   first) → **accept-edits** (file writes/edits auto-approve, no prompt) →
-  **plan** (read-only, nothing executes) → back to normal. The statusline
-  always shows which one you're in, with a running `(N auto-approved)` count
-  in accept-edits mode so you know how much slipped through before checking
-  `/diff`. Destructive shell commands (`rm -rf`, force-push, etc.) always
-  still prompt, in every mode — that guard never turns off. The first time you
-  switch into accept-edits mode each session, kritya asks you to confirm first
-  so it's a deliberate choice, not an accidental keypress. `/plan on` and
-  `/plan off` set the mode explicitly; a bare `/plan` toggles it. `/plan` never
+  **dry-run** (read-only: the agent explores and proposes a plan; edits and
+  shell are blocked) → **auto** (EVERY tool call auto-approves, including
+  destructive shell commands — nothing asks first) → back to normal. Auto
+  mode is only offered when the sandbox is active, and the sandbox — not a
+  human — is what contains any damage it causes; with the sandbox off,
+  dry-run goes straight back to normal. In accept-edits mode, destructive
+  shell commands (`rm -rf`, force-push, etc.) still prompt — that guard only
+  turns off in auto mode. The statusline always shows which mode you're in,
+  with a running `(N auto-approved)` count in the auto-approve modes so you
+  know how much slipped through before checking `/diff`. The first time you
+  switch into accept-edits or auto mode each session, kritya asks you to
+  confirm first so it's a deliberate choice, not an accidental keypress.
+  `/plan on` and `/plan off` set plan mode explicitly; a bare `/plan`
+  toggles it. Plan mode is separate from this cycle. `/plan` never
   touches the project workflow — that's `/flow-plan`.
 - **Kill switch** — `Ctrl+K` (or `/kill [reason]`) is a hard stop for the whole
   session. It aborts the in-flight model stream, any running tool, and every

package/dist/agent/toolExecutor.js

@@ -1,4 +1,5 @@
 import { classifyDanger } from "../permissions/danger.js";
+import { classifyLaterExec, classifyLaterExecInShell, recordLaterExec, workspaceRelative, } from "../permissions/later.js";
 import { acknowledgeUnsandboxedFallback, sandboxAvailable, sandboxFallbackWarning, } from "../shell/sandbox.js";
 import { isPlanningDocWrite, loadProjectState } from "./workflow.js";
 import { redactSecrets } from "../tools/secretScan.js";
@@ -48,6 +49,27 @@ export class ToolTimeoutError extends Error {
  * applies regardless of any mode.
  */
 const ACCEPT_EDITS_TOOL_NAMES = new Set(["write_file", "edit_file", "write_document"]);
+/**
+ * A write to a path that can run code later (a git hook, a lifecycle script,
+ * a direnv config — see `permissions/later.ts`), or null for an ordinary file.
+ *
+ * Only the text being *added* is inspected, never `old_string`: removing a
+ * `postinstall` script is not the risky direction, and matching the removed
+ * text would prompt on the cleanup.
+ */
+function laterExecForWrite(args, workspace) {
+    const target = args.path;
+    if (typeof target !== "string" || !target.trim())
+        return null;
+    const rel = workspaceRelative(workspace, target);
+    if (!rel)
+        return null;
+    const added = [args.content, args.new_string, args.text]
+        .filter((v) => typeof v === "string")
+        .join("\n");
+    const label = classifyLaterExec(rel, added || undefined);
+    return label ? { path: rel, label } : null;
+}
 /**
  * Wrap external (web/MCP) tool output in untrusted-content markers. Any copy
  * of the marker text inside the content itself is neutralized first, so the
@@ -231,7 +253,21 @@ export class ToolExecutor {
         const sandboxWarning = tool.name === "shell" && dangerLabel === null && host.interactive
             ? sandboxFallbackWarning(host.ctx.sandboxMode, shellCommand)
             : null;
-        const danger = dangerLabel ?? sandboxWarning;
+        // The workspace is writable by design, so the sandbox cannot stop a command
+        // from *leaving* something behind that runs later — a git hook, a
+        // postinstall script, a direnv config. That is a different risk from
+        // anything classifyDanger covers (it is about what runs now), so it gets its
+        // own label and its own prompt.
+        //
+        // Prompted only where a human can answer: a write subagent's
+        // requestPermission auto-refuses anything carrying a danger label, which
+        // would turn every package.json edit into a refusal. The end-of-session
+        // list is unconditional, so nothing is lost silently.
+        const laterMatch = tool.name === "shell"
+            ? classifyLaterExecInShell(shellCommand, host.ctx.workspace)
+            : laterExecForWrite(args, host.ctx.workspace);
+        const laterLabel = host.interactive ? (laterMatch?.label ?? null) : null;
+        const danger = dangerLabel ?? sandboxWarning ?? laterLabel;
         const autoApproveEdit = host.acceptEdits &&
             danger === null &&
             tool.requiresPermission &&
@@ -347,6 +383,10 @@ export class ToolExecutor {
             }
             output = truncateToolOutput(output);
             const failed = tool.failed?.(output) ?? false;
+            // Only a write that actually landed is worth putting on the sign-off
+            // list — a rejected or failed one left nothing behind.
+            if (!failed && laterMatch)
+                recordLaterExec(laterMatch);
             logToolOutcome(failed ? "error" : "ok");
             finishSpan(failed ? "ERROR" : "OK");
             handlers.onToolEnd(id, name, summary, output.slice(0, PREVIEW_CHARS), failed, failed ? undefined : (tool.resultSummary?.(output, args) ?? undefined));

package/dist/config/config.js

@@ -126,6 +126,9 @@ const KNOWN_CONFIG_KEYS = new Set([
     "subagentWriteMaxSteps",
     "mcpServers",
     "sandboxExec",
+    "sandboxReadDeny",
+    "sandboxReadAllow",
+    "sandboxNetwork",
     "retentionDays",
     "audit",
     "otel",

package/dist/index.js

@@ -13,6 +13,7 @@ import { createSwitchyardClient } from "./provider/switchyardClient.js";
 import { SWITCHYARD_ROUTE_ID, resolveEffectiveModel, staleSwitchyardModelWarning, } from "./provider/switchyardSidecar.js";
 import { SessionStore } from "./session/store.js";
 import { exitNotice } from "./session/exitNotice.js";
+import { laterExecFiles, laterExecNotice } from "./permissions/later.js";
 import { AuditLog } from "./audit/audit.js";
 import { runAuditCli } from "./audit/cli.js";
 import { runSkillsCli } from "./agent/skillsCli.js";
@@ -497,6 +498,12 @@ async function main() {
         });
         if (text)
             writeExitNotice(text);
+        // Printed even when the session notice is not (privacy mode, an empty
+        // session): this is a warning about files left on disk, not about the
+        // transcript, so it does not belong to that decision.
+        const later = laterExecNotice(laterExecFiles(), Boolean(process.stdout.isTTY));
+        if (later)
+            writeExitNotice(later);
     };
     // Filled in once the app is mounted, below; the crash handler needs a way to
     // tear the UI down and is installed before there is a UI to tear down.

package/dist/permissions/later.js

@@ -0,0 +1,136 @@
+import path from "node:path";
+/**
+ * Lifecycle scripts npm runs on its own: `npm install` fires preinstall,
+ * install, postinstall and prepare; `npm publish` fires prepublishOnly,
+ * prepack and postpack. Any of them is a shell command attached to an
+ * everyday action.
+ */
+const LIFECYCLE_RE = /"(pre|post)?(install|prepare|publish|pack)(Only)?"\s*:/i;
+const RULES = [
+    {
+        re: /^\.git\/hooks\/[^/]+$/,
+        label: "a git hook (runs on your next git command)",
+    },
+    { re: /^\.husky\/[^/]+$/, label: "a husky hook (runs on your next git command)" },
+    {
+        re: /^\.git\/config$/,
+        label: "git config (can redirect hooks or define shell aliases)",
+    },
+    { re: /^\.envrc$/, label: "direnv config (runs when you enter this directory)" },
+    {
+        re: /^\.vscode\/(tasks|launch)\.json$/,
+        label: "a VS Code task (runs when you launch it)",
+    },
+    {
+        re: /^\.pre-commit-config\.ya?ml$/,
+        label: "a pre-commit config (runs on your next commit)",
+    },
+    {
+        re: /^package\.json$/,
+        label: "package.json scripts (npm runs them on install and publish)",
+        contentSensitive: true,
+    },
+];
+/** `.\git\hooks\x` and `./.git/hooks/x` both become `.git/hooks/x`. */
+function normalizeRel(p) {
+    return p
+        .split(path.sep)
+        .join("/")
+        .replace(/\\/g, "/")
+        .replace(/^\.\//, "")
+        .replace(/\/+$/, "")
+        .toLowerCase();
+}
+/** A workspace-relative, `/`-separated form of `target`, or null if it is outside. */
+export function workspaceRelative(workspace, target) {
+    const abs = path.resolve(workspace, target);
+    const rel = path.relative(workspace, abs);
+    if (rel === "" || rel.startsWith("..") || path.isAbsolute(rel))
+        return null;
+    return rel.split(path.sep).join("/");
+}
+/**
+ * The label for a path that runs code later, or null when it is an ordinary
+ * file.
+ *
+ * `text` is the content being written, when the caller has it — only the
+ * `contentSensitive` rules look at it, and only to decide whether the edit
+ * actually introduces a script.
+ */
+export function classifyLaterExec(relPath, text) {
+    const rel = normalizeRel(relPath);
+    // Git ships .git/hooks/*.sample as documentation; writing one of those runs
+    // nothing.
+    if (rel.endsWith(".sample"))
+        return null;
+    for (const rule of RULES) {
+        if (!rule.re.test(rel))
+            continue;
+        if (rule.contentSensitive && !(text && LIFECYCLE_RE.test(text)))
+            continue;
+        return rule.label;
+    }
+    return null;
+}
+/**
+ * The same check for a shell command, by looking at what it redirects into.
+ *
+ * Only redirects are inspected — `> file` and `>> file` — because that is the
+ * one way a shell command writes a specific path without going through the
+ * file tools. Anything cleverer (a script that writes the hook itself) has no
+ * path to match, and is what the end-of-session list is for.
+ */
+export function classifyLaterExecInShell(command, workspace) {
+    const re = />>?\s*(?:"([^"]+)"|'([^']+)'|([^\s;|&()<>]+))/g;
+    for (let m = re.exec(command); m !== null; m = re.exec(command)) {
+        const target = m[1] ?? m[2] ?? m[3];
+        if (!target || target === "/dev/null" || target.startsWith("&"))
+            continue;
+        const rel = workspaceRelative(workspace, target);
+        if (!rel)
+            continue;
+        const label = classifyLaterExec(rel, command);
+        if (label)
+            return { path: rel, label };
+    }
+    return null;
+}
+// --- Session record ---------------------------------------------------------
+/**
+ * Paths touched this session, keyed by relative path. A Map rather than a Set
+ * so the same file touched twice is listed once, with its label.
+ */
+const touched = new Map();
+/** Remembers a file that can run code later. */
+export function recordLaterExec(match) {
+    touched.set(match.path, match.label);
+}
+/** Everything recorded so far this session, sorted for a stable list. */
+export function laterExecFiles() {
+    return [...touched.entries()]
+        .map(([p, label]) => ({ path: p, label }))
+        .sort((a, b) => a.path.localeCompare(b.path));
+}
+/** Test-only: forgets the session's record. */
+export function resetLaterExec() {
+    touched.clear();
+}
+/**
+ * The end-of-session list, or null when nothing was touched.
+ *
+ * Kept separate from the prompt on purpose: the prompt interrupts a write, and
+ * an interrupted write is easy to approve without reading. This is the last
+ * thing on screen, after the agent has stopped, which is when the question
+ * "what did I just let it leave here?" actually gets asked.
+ */
+export function laterExecNotice(files, isTTY = false) {
+    if (files.length === 0)
+        return null;
+    const dim = isTTY ? "\x1b[2m" : "";
+    const plain = isTTY ? "\x1b[22m" : "";
+    const n = files.length;
+    const lines = files.map((f) => `  ${f.path}  ${dim}${f.label}${plain}`);
+    return (`${dim}${n} file${n === 1 ? "" : "s"} here can run code later, outside the sandbox:${plain}\n` +
+        lines.join("\n") +
+        `\n${dim}  review before your next git or npm command${plain}`);
+}

package/dist/shell/sandbox.js

@@ -3,7 +3,7 @@ import fs from "node:fs";
 import { createRequire } from "node:module";
 import os from "node:os";
 import path from "node:path";
-import { CONFIG_DIR, loadDotEnv } from "../config/config.js";
+import { CONFIG_DIR, loadConfig, loadDotEnv } from "../config/config.js";
 import { classifyDanger } from "../permissions/danger.js";
 let cachedTool;
 let cachedMxcExec;
@@ -94,6 +94,7 @@ export function resetSandboxToolCache() {
     cachedTool = undefined;
     cachedMxcExec = undefined;
     dotEnvLoaded = false;
+    bwrapMaskSupported = undefined;
 }
 /** Which sandbox backend (if any) is usable on this platform, cached after the first check. */
 function sandboxTool() {
@@ -138,7 +139,7 @@ function windowsQuote(value) {
     return `"${value.replace(/"/g, '""')}"`;
 }
 /**
- * Turns the observed state of the canary's two marker files into probes.
+ * Turns the observed state of the canary's marker files into probes.
  *
  * Split out from `runSandboxCanary` so the decision — the part that can be
  * wrong — is testable without a backend to spawn. `escaped` is "the file
@@ -149,9 +150,15 @@ function windowsQuote(value) {
  * means the command never reached the shell at all, which must NOT be read as
  * containment — that is why the inside write is a probe rather than a
  * throwaway control.
+ *
+ * `credentialRead` is the result of trying to read one credential file from
+ * inside the sandbox, when there was one to try and this backend claims to
+ * deny it. Passing it makes the read probe a real claim; omitting it (or
+ * passing null) leaves the informational note that reads are open by design,
+ * which is the honest answer when there is nothing to probe.
  */
-export function canaryProbes(escaped, wroteInside) {
-    return [
+export function canaryProbes(escaped, wroteInside, credentialRead) {
+    const probes = [
         {
             what: "a write outside the workspace (system temp dir) did not reach the host",
             held: !escaped,
@@ -160,12 +167,37 @@ export function canaryProbes(escaped, wroteInside) {
             what: "a write inside the workspace succeeded (the sandbox is not simply refusing everything)",
             held: wroteInside,
         },
-        {
-            what: "reads outside the workspace (incl. ~/.kritya/.env) are open by design",
+    ];
+    probes.push(credentialRead
+        ? {
+            what: `a credential file (${credentialRead.path}) could not be read`,
+            held: !credentialRead.readable,
+        }
+        : {
+            what: "credential reads were not probed (reads are otherwise open by design)",
             held: false,
             informational: true,
-        },
-    ];
+        });
+    return probes;
+}
+/**
+ * A credential file that exists on this host and is non-empty, so the canary
+ * has something whose content it can look for. Empty files are skipped: reading
+ * one yields nothing whether or not the deny is working, so a probe against it
+ * would pass for the wrong reason.
+ */
+function canaryCredentialFile() {
+    for (const p of sandboxReadDenyPaths()) {
+        try {
+            const st = fs.statSync(p);
+            if (st.isFile() && st.size > 0)
+                return p;
+        }
+        catch {
+            // Not present on this host — try the next one.
+        }
+    }
+    return null;
 }
 /**
  * A live containment check: run a canary *inside* the sandbox that tries to
@@ -177,12 +209,14 @@ export function canaryProbes(escaped, wroteInside) {
  * `processcontainer`, a stale `wxc-exec.exe`, or a host missing the one-time
  * privilege prep all change the answer without changing a line of code here).
  * This closes that gap the only honest way — by trying to escape and looking
- * at the result. It writes at most one marker file, in the system temp dir,
- * and removes it either way.
+ * at the result. It writes at most three marker files — one in the system temp
+ * dir, two in the workspace — and removes all three either way.
  *
- * Only the *write* probe is a containment claim: reads outside the workspace
- * are open by design (see `buildSandboxedCommand`), so the read probe is
- * reported but never counted as a failure.
+ * The write probes are always containment claims. The credential probe is one
+ * only when there is a credential file to read and the backend claims to deny
+ * it (Linux and macOS); otherwise it degrades to the informational note that
+ * reads are open by design, so a host with no `~/.aws` or `~/.ssh` key is not
+ * reported as a sandbox failure.
  */
 export function runSandboxCanary(workspace) {
     const reason = sandboxUnavailableReason();
@@ -194,8 +228,11 @@ export function runSandboxCanary(workspace) {
     // blocked it. A path *inside* the workspace would prove nothing.
     const escapeTarget = path.join(os.tmpdir(), `kritya-canary-escape-${process.pid}.txt`);
     const insideTarget = path.join(workspace, `.kritya-canary-inside-${process.pid}.txt`);
+    // Where the credential probe's output lands. Its *size* is the answer: a
+    // masked file reads as zero bytes, an unmasked one gives up its content.
+    const credTarget = path.join(workspace, `.kritya-canary-cred-${process.pid}.txt`);
     const cleanup = () => {
-        for (const f of [escapeTarget, insideTarget]) {
+        for (const f of [escapeTarget, insideTarget, credTarget]) {
             try {
                 fs.rmSync(f, { force: true });
             }
@@ -206,17 +243,28 @@ export function runSandboxCanary(workspace) {
     };
     cleanup(); // in case a previous run left a marker behind
     const isWindows = os.platform() === "win32";
+    // MXC cannot deny a read (see mxcPolicyJson), so there is nothing to probe
+    // there — reporting the gap as a failure would blame the user for a schema
+    // limitation, and reporting it as a pass would be a lie.
+    const credential = isWindows ? null : canaryCredentialFile();
     const writeOutside = isWindows
         ? `echo canary> ${windowsQuote(escapeTarget)}`
         : `printf canary > ${JSON.stringify(escapeTarget)}`;
     const writeInside = isWindows
         ? `echo canary> ${windowsQuote(insideTarget)}`
         : `printf canary > ${JSON.stringify(insideTarget)}`;
+    // `head -c 64` rather than `cat`: enough to tell content from no content,
+    // and it keeps a large credential file from being copied into the workspace.
+    // The redirection creates the marker even when the read is refused, which is
+    // exactly the signal — empty marker means the deny held.
+    const readCredential = credential
+        ? `; head -c 64 ${JSON.stringify(credential)} > ${JSON.stringify(credTarget)} 2>/dev/null`
+        : "";
     // The canary exits 0 regardless: reaching the shell at all is the point, and
     // a nonzero exit from a *blocked* write is not something the caller needs.
     const script = isWindows
         ? `${writeOutside} & ${writeInside} & exit /b 0`
-        : `${writeOutside}; ${writeInside}; true`;
+        : `${writeOutside}; ${writeInside}${readCredential}; true`;
     const wrapped = buildSandboxedCommand(script, workspace);
     if (!wrapped) {
         return { ran: false, reason, probes: [] };
@@ -241,8 +289,20 @@ export function runSandboxCanary(workspace) {
     wrapped.cleanup?.();
     const escaped = fs.existsSync(escapeTarget);
     const wroteInside = fs.existsSync(insideTarget);
+    const credentialRead = credential
+        ? { path: credential, readable: markerSize(credTarget) > 0 }
+        : null;
     cleanup();
-    return { ran: true, probes: canaryProbes(escaped, wroteInside) };
+    return { ran: true, probes: canaryProbes(escaped, wroteInside, credentialRead) };
+}
+/** Byte size of a marker file, 0 when it is missing (the expected case). */
+function markerSize(p) {
+    try {
+        return fs.statSync(p).size;
+    }
+    catch {
+        return 0;
+    }
 }
 /** One-line reason sandboxing can't run here, for a fallback warning. */
 export function sandboxUnavailableReason() {
@@ -363,6 +423,106 @@ function extraWritablePaths() {
         // don't exist, and the macOS profile tolerates nonexistent subpaths.
         .concat([path.join(home, "Library", "Caches")]));
 }
+/**
+ * Entries inside `~/.ssh` that are *not* secret, and which SSH therefore has to
+ * read for anything to work: `config` supplies host aliases and identity files,
+ * `known_hosts` is what makes host-key verification possible, and `.pub` files
+ * are public by definition. Everything else in that directory is treated as a
+ * private key — including names this list has never heard of, which is the
+ * point: `id_rsa` and `id_ed25519` are the common spellings, not the only ones.
+ */
+const SSH_READABLE_NAMES = new Set([
+    "config",
+    "known_hosts",
+    "known_hosts.old",
+    "authorized_keys",
+    "environment",
+    "rc",
+]);
+/** `~/.ssh` entries that hold a private key, or a directory that holds them. */
+function sshPrivateKeyPaths(home) {
+    const dir = path.join(home, ".ssh");
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return []; // no ~/.ssh at all — nothing to hide
+    }
+    return entries
+        .filter((e) => !SSH_READABLE_NAMES.has(e.name) && !e.name.endsWith(".pub"))
+        .map((e) => path.join(dir, e.name));
+}
+/** `~/x` and `~` expanded against the real home; anything else resolved as given. */
+function expandHome(p) {
+    if (p === "~")
+        return os.homedir();
+    if (p.startsWith("~/") || p.startsWith("~\\"))
+        return path.join(os.homedir(), p.slice(2));
+    return path.resolve(p);
+}
+/** True when `parent` is `child` or contains it. */
+function pathContains(parent, child) {
+    const rel = path.relative(parent, child);
+    return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
+}
+/**
+ * `"none"` only when the user asked for it; anything else is `"open"`.
+ *
+ * Deliberately not a default: cutting the network off stops `npm install`,
+ * `git push` and `docker pull`, so it is the setting you switch on for a review
+ * pass or for code you don't trust, not one that should surprise someone
+ * mid-task. Exported for tests.
+ */
+export function sandboxNetworkMode(config = loadConfig()) {
+    return config.sandboxNetwork === "none" ? "none" : "open";
+}
+/**
+ * The credential paths a sandboxed command must not read, as absolute paths.
+ *
+ * The list is short on purpose, and it is a *deny* list rather than a narrowing
+ * of the read-everything default because reads have to stay open generally:
+ * dynamic linking, package manager caches and every toolchain's own config live
+ * outside the workspace, and closing those off breaks ordinary work rather than
+ * containing anything. What is left is the handful of files whose only value to
+ * a hostile command is the secret inside them, and which almost no build or
+ * test run touches:
+ *
+ *  - `~/.ssh` private keys (not `config`, `known_hosts`, or `.pub` files) —
+ *    SSH through an agent never reads the key file, so the everyday
+ *    `git push` keeps working while `cat ~/.ssh/id_rsa` stops working.
+ *  - `~/.aws`, `~/.config/gcloud`, `~/.kube` — cloud and cluster credentials.
+ *    A project's own build does not need *your* AWS keys.
+ *  - `~/.docker/config.json` — registry auth tokens. The rest of `~/.docker`
+ *    stays readable so contexts keep resolving.
+ *  - `~/.netrc` — plaintext credentials for whatever `machine` entries it has.
+ *
+ * Deliberately NOT denied, each because a first-class workflow reads it:
+ * `~/.npmrc` (`npm install` against a private registry, `npm publish`),
+ * `~/.config/gh/hosts.yml` (the `gh` calls behind pull requests), and
+ * `~/.git-credentials` (HTTPS `git push`). Blocking those would break the
+ * ordinary user's day far more often than it would stop an attacker, and the
+ * deny list is intentionally fixed so the only knob is the allow side.
+ *
+ * Exported for tests.
+ */
+export function sandboxReadDenyPaths(config = loadConfig()) {
+    if (config.sandboxReadDeny === false)
+        return [];
+    const home = os.homedir();
+    const deny = [
+        path.join(home, ".aws"),
+        path.join(home, ".config", "gcloud"),
+        path.join(home, ".kube"),
+        path.join(home, ".docker", "config.json"),
+        path.join(home, ".netrc"),
+        ...sshPrivateKeyPaths(home),
+    ];
+    const allow = (config.sandboxReadAllow ?? [])
+        .filter((p) => typeof p === "string" && p.length > 0)
+        .map(expandHome);
+    return [...new Set(deny.filter((p) => !allow.some((a) => pathContains(a, p))))];
+}
 /**
  * The one directory under the real system temp dir that sandboxed commands can
  * write to and see again on the next invocation. The rest of /tmp is a fresh
@@ -522,8 +682,33 @@ export function sandboxPathVariants(p) {
 function macTmpRoots() {
     return [...new Set(["/tmp", "/private/tmp", os.tmpdir()].flatMap(sandboxPathVariants))];
 }
-function macSandboxProfile(workspace, extraDirs, shared, runDir) {
-    const esc = (p) => p.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+/**
+ * Escapes a filesystem path for a string literal in a sandbox-exec profile.
+ * Backslashes first, so the quotes escaped second aren't double-escaped.
+ */
+function escapeProfilePath(p) {
+    return p.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+/**
+ * The `(deny file-read* …)` lines that make the credential list unreadable
+ * under sandbox-exec. Exported for tests — the profile itself is only ever
+ * built on macOS, so this is the only way CI can check what it would contain.
+ *
+ * Seatbelt resolves the last matching rule, which is what makes a deny here
+ * work at all: `(allow default)` comes first in the profile, so these later
+ * rules win over it. Both spellings of each path are emitted (see
+ * `sandboxPathVariants`) because the kernel matches against the canonical path,
+ * and on macOS `$HOME` can itself be a symlink (`/Users/x` → `/System/Volumes/
+ * Data/Users/x`) — a rule written only against the `/Users` spelling would
+ * match nothing.
+ */
+export function macReadDenyRules(paths) {
+    return [...new Set(paths.flatMap(sandboxPathVariants))]
+        .map((p) => `(deny file-read* (subpath "${escapeProfilePath(p)}"))`)
+        .join("\n");
+}
+function macSandboxProfile(workspace, extraDirs, shared, runDir, readDeny, network) {
+    const esc = escapeProfilePath;
     // Every allow rule is emitted for both the literal and the symlink-resolved
     // spelling of its path — see `sandboxPathVariants`. Without that, a workspace
     // under `os.tmpdir()` (i.e. `/var/folders/...`) is silently unwritable,
@@ -540,11 +725,11 @@ function macSandboxProfile(workspace, extraDirs, shared, runDir) {
         .map((p) => `(allow file-write* (subpath "${esc(p)}"))`)
         .join("\n");
     // Reads and process exec/fork stay open by default (matches the Linux
-    // ro-bind-everything posture below) EXCEPT under the real temp-dir roots,
-    // which are denied and then selectively re-opened below — see the tmp-root
-    // rules. Writes are denied everywhere except the workspace, the per-run
-    // scratch dir, and a short explicit allowlist, so a command can't damage
-    // anything outside the project.
+    // ro-bind-everything posture below) EXCEPT under the real temp-dir roots and
+    // the credential list, both of which are denied and then selectively
+    // re-opened — see the tmp-root rules and `credentialDeny`. Writes are denied
+    // everywhere except the workspace, the per-run scratch dir, and a short
+    // explicit allowlist, so a command can't damage anything outside the project.
     const readAllowDirs = variants([workspace, runDir, ...extraDirs, ...(shared ? [shared] : [])]);
     const readExtra = readAllowDirs.map((p) => `(allow file-read* (subpath "${esc(p)}"))`).join("\n");
     // The world-writable /tmp (and its real path /private/tmp), plus the
@@ -559,11 +744,25 @@ function macSandboxProfile(workspace, extraDirs, shared, runDir) {
     const tmpDeny = macTmpRoots()
         .map((p) => `(deny file-read* (subpath "${esc(p)}"))\n(deny file-write* (subpath "${esc(p)}"))`)
         .join("\n");
+    // The credential list, denied for reads only. It sits after `(allow default)`
+    // so it wins, and before `readExtra` — but nothing in `readExtra` is on this
+    // list, so the two cannot fight. Writes to these paths are already blocked by
+    // the whole-filesystem write deny above.
+    const credentialDeny = macReadDenyRules(readDeny);
+    // `network-outbound` and not `network*`: denying the whole operation family
+    // would also block binding a listening socket, so `npm run dev` could not
+    // serve anything at all. Denying only outbound connections stops a command
+    // from *sending* anything while leaving a dev server reachable from the
+    // browser — the same intent as bwrap's `--unshare-net`, minus the loopback
+    // loss that flag brings with it.
+    const networkDeny = network === "none" ? "(deny network-outbound)" : "";
     return `(version 1)
 (allow default)
 (deny file-write* (subpath "/"))
 (allow file-write* (subpath "/dev"))
 ${tmpDeny}
+${credentialDeny}
+${networkDeny}
 ${writeExtra}
 ${readExtra}
 `;
@@ -666,9 +865,17 @@ function windowsToolPaths(workspace) {
  *
  * Deliberate choices, all to keep Windows consistent with the other platforms
  * rather than stricter by accident:
- *  - The network is left open. Neither bwrap nor sandbox-exec restricts it, and
- *    a contained command that cannot reach the network cannot `npm install`,
- *    `git push`, or run a dev server. Tightening it is a cross-platform call.
+ *  - The network is left open unless `sandboxNetwork` is `"none"`, which turns
+ *    both directions into a deny-by-default policy here. It is not restricted by
+ *    default because a contained command that cannot reach the network cannot
+ *    `npm install`, `git push`, or run a dev server.
+ *  - Credential reads are NOT denied here, unlike the other two backends (see
+ *    `sandboxReadDenyPaths`). MXC's filesystem policy is a grant list, and the
+ *    drive root has to appear in `readwritePaths` for the container to start at
+ *    all (see below) — which grants every path beneath it, with no deny entry
+ *    to carve one back out. That is a limitation of the policy schema, not a
+ *    choice about how much to enforce, so it is stated plainly in SECURITY.md
+ *    rather than papered over.
  *  - The temp dir is not isolated. Windows has no tmpfs equivalent, so scratch
  *    state already persists across calls without a shared-dir bind. MXC hands
  *    the container its own writable temp dir regardless (it rewrites `TEMP` to
@@ -708,7 +915,7 @@ function windowsToolPaths(workspace) {
  *    sent as `[]` when there is nothing to add, so a policy built without it
  *    is byte-identical to what this function produced before.
  */
-export function mxcPolicyJson(command, workspace, writable, readable = []) {
+export function mxcPolicyJson(command, workspace, writable, readable = [], network = "open") {
     return JSON.stringify({
         version: "1.0.0",
         containment: "processcontainer",
@@ -724,28 +931,124 @@ export function mxcPolicyJson(command, workspace, writable, readable = []) {
             // are fatal under `readonlyPaths`.
             ...(readable.length > 0 ? { readonlyPaths: [...new Set(readable)] } : {}),
         },
-        network: { egress: { default: "allow" }, ingress: { default: "allow" } },
+        // MXC is the one backend that can express an allowlist here; `deny` with
+        // nothing listed is a plain "no network", which is what `sandboxNetwork:
+        // "none"` asks for.
+        network: network === "none"
+            ? { egress: { default: "deny" }, ingress: { default: "deny" } }
+            : { egress: { default: "allow" }, ingress: { default: "allow" } },
         ui: { disable: false },
         // MXC telemetry is off unless the run opts in, the user consents, and
         // administrative policy permits it. Kritya opts out on the user's behalf.
         telemetry: { enabled: false },
     });
 }
+/**
+ * The bwrap operations that make the credential list unreadable: an empty
+ * read-only tmpfs over a denied directory, and `/dev/null` bound over a denied
+ * file.
+ *
+ * Both hide the *contents* while leaving the path present, which matters: a
+ * path that vanished entirely would make ordinary code take its "not
+ * configured yet" branch, and some tools respond to that by creating the file —
+ * so a deny that reads as ENOENT is a worse lie than one that reads as an empty
+ * file. `~/.aws` as an empty directory and `~/.netrc` as a zero-byte file are
+ * both what "nothing set up here" looks like.
+ *
+ * `--dir` comes before `--tmpfs` because bwrap will not create a tmpfs mount
+ * point: mounting on a path that is absent from the new root fails the *whole*
+ * command with `Can't mount tmpfs on /newroot/…: No such file or directory`,
+ * which turns a read deny into "nothing works at all". `--dir` is a no-op when
+ * the path is already there and creates it when it isn't.
+ *
+ * Paths that don't exist are skipped, because a missing file is already
+ * unreadable and there is nothing to mask. `statSync` (not `lstatSync`) is used
+ * so a symlink to a directory takes the tmpfs branch — `mount(2)` resolves the
+ * link either way, and binding `/dev/null` over a directory fails the command.
+ *
+ * Exported for tests.
+ */
+export function bwrapReadDenyArgs(paths) {
+    const args = [];
+    // The *resolved* path, not the literal one: a credential directory that is a
+    // symlink (`~/.aws -> ~/dotfiles/aws`) has to be masked where it really
+    // lives, because `mount(2)` follows the link and a link whose target the
+    // kernel cannot resolve is one of the ways this mount fails.
+    for (const raw of new Set(paths)) {
+        const p = realpathBestEffort(raw);
+        let st;
+        try {
+            st = fs.statSync(p);
+        }
+        catch {
+            continue;
+        }
+        if (st.isDirectory())
+            args.push("--dir", p, "--tmpfs", p, "--remount-ro", p);
+        else
+            args.push("--ro-bind", "/dev/null", p);
+    }
+    return args;
+}
+/**
+ * Whether this host's bwrap actually accepts the mask operations, asked once
+ * per process by running them for real.
+ *
+ * This exists because of a failure mode that has no compile-time signal: a mask
+ * bwrap refuses (`Can't mount tmpfs on /newroot/…: No such file or directory`)
+ * does not just skip that one deny — it fails the *entire* command, so every
+ * shell call in the session dies and the sandbox looks broken rather than
+ * narrow. A security feature that can brick the tool is worse than one that is
+ * off, so the mask is used only if bwrap demonstrably accepts it here.
+ *
+ * The probe is the real argument list, not a synthetic one, so it exercises the
+ * exact paths the session will use. If it fails, the read deny is silently
+ * dropped and `kritya doctor`'s canary is what surfaces it: its credential
+ * probe reads a real file and reports the miss.
+ */
+let bwrapMaskSupported;
+function bwrapAcceptsMasks(maskArgs) {
+    if (maskArgs.length === 0)
+        return true;
+    if (bwrapMaskSupported !== undefined)
+        return bwrapMaskSupported;
+    try {
+        const probe = spawnSync("bwrap", ["--ro-bind", "/", "/", ...maskArgs, "true"], {
+            stdio: "ignore",
+            timeout: 15_000,
+            windowsHide: true,
+        });
+        bwrapMaskSupported = probe.status === 0;
+    }
+    catch {
+        bwrapMaskSupported = false;
+    }
+    return bwrapMaskSupported;
+}
 /**
  * Wraps `command` (run via `sh -c`) so it's confined to `workspace`: writes
- * are blocked everywhere else, network and (outside the real temp-dir roots)
- * reads are left open. This contains accidental or malicious damage outside
- * the project — it does not stop a command from reading files the real user
- * can read (e.g. `cat ~/.ssh/id_rsa`), since restricting reads generally
- * breaks most ordinary tooling (dynamic linking, package manager caches,
- * etc.); the temp-dir roots are the one exception, hidden to keep one
- * sandboxed command from reading another's scratch files. Returns null if no
- * sandbox binary is available on this platform.
+ * are blocked everywhere else, reads are left open outside the workspace
+ * *except* the credential list from `sandboxReadDenyPaths` (SSH private keys,
+ * cloud and cluster credentials) and the real temp-dir roots, which are hidden
+ * so one sandboxed command can't read another's scratch files, and the network
+ * stays open unless `sandboxNetwork` is `"none"`.
+ *
+ * Read confinement stops there deliberately. Closing reads generally breaks
+ * most ordinary tooling — dynamic linking, package manager caches, every
+ * toolchain's own config live outside the workspace — so the sandbox hides the
+ * few files whose only value to a hostile command is the secret inside them,
+ * and leaves `cat` on everything else working. Returns null if no sandbox
+ * binary is available on this platform.
  */
-export function buildSandboxedCommand(command, workspace) {
+export function buildSandboxedCommand(command, workspace, config = loadConfig()) {
     const tool = sandboxTool();
     if (!tool)
         return null;
+    // Read once: both settings are consulted by every branch below, and the
+    // third argument exists so tests can exercise a policy without writing to the
+    // user's real config.json.
+    const network = sandboxNetworkMode(config);
+    const readDeny = sandboxReadDenyPaths(config);
     // Linked worktrees / submodules keep their real git dir outside the workspace.
     const gitDir = externalGitCommonDir(workspace);
     if (tool === "mxc") {
@@ -771,7 +1074,7 @@ export function buildSandboxedCommand(command, workspace) {
             cmd: exe,
             args: [
                 "--config-base64",
-                Buffer.from(mxcPolicyJson(windowsShellCommand(command), workspace, writable, windowsToolPaths(workspace)), "utf8").toString("base64"),
+                Buffer.from(mxcPolicyJson(windowsShellCommand(command), workspace, writable, windowsToolPaths(workspace), network), "utf8").toString("base64"),
             ],
         };
     }
@@ -785,6 +1088,20 @@ export function buildSandboxedCommand(command, workspace) {
         // the host's real /tmp — which holds other agents' isolated worktrees and
         // is the easiest place to hardlink a host file and write through the link.
         const args = ["--ro-bind", "/", "/", "--dev", "/dev", "--proc", "/proc", "--tmpfs", "/tmp"];
+        // A fresh, empty network namespace: nothing routable, not even loopback.
+        // That is stricter than the macOS profile (which only denies outbound), and
+        // it is the honest limit of what bwrap can express — it has no per-host
+        // filter, so "no network" is the only useful setting it can enforce.
+        if (network === "none")
+            args.push("--unshare-net");
+        // Masked before the writable binds below rather than after, so a workspace
+        // that happens to contain one of these paths still wins — the same
+        // precedence the macOS profile gives the workspace. Used only when bwrap
+        // accepts the operations on this host; see `bwrapAcceptsMasks` for why a
+        // mask that bwrap refuses must not take the whole command with it.
+        const maskArgs = bwrapReadDenyArgs(readDeny);
+        if (bwrapAcceptsMasks(maskArgs))
+            args.push(...maskArgs);
         seedSshKnownHosts();
         for (const p of [
             ...extraWritablePaths(),
@@ -815,7 +1132,7 @@ export function buildSandboxedCommand(command, workspace) {
     // it's about to create.
     const runDir = path.join(os.tmpdir(), `kritya-sandbox-run-${runSuffix}`);
     fs.mkdirSync(runDir, { recursive: true, mode: 0o700 });
-    fs.writeFileSync(profilePath, macSandboxProfile(workspace, gitDir ? [gitDir] : [], shared, runDir), { mode: 0o600, flag: "wx" });
+    fs.writeFileSync(profilePath, macSandboxProfile(workspace, gitDir ? [gitDir] : [], shared, runDir, readDeny, network), { mode: 0o600, flag: "wx" });
     return {
         cmd: "sandbox-exec",
         args: ["-f", profilePath, "sh", "-c", command],

package/dist/ui/App.js

@@ -424,7 +424,7 @@ export function App({ agent, workspace, modelRef, providerRef, config, resumedCo
             void copyLastCodeBlock();
             return;
         }
-        // Shift+Tab cycles normal → accept-edits → plan → normal. Only from the
+        // Shift+Tab cycles normal → accept-edits → dry-run → auto → normal. Only from the
         // plain input state — not mid-permission-prompt, mid-resume-picker, etc.
         if (key.tab && key.shift && phase === "input") {
             cycleMode();
@@ -731,7 +731,7 @@ export function App({ agent, workspace, modelRef, providerRef, config, resumedCo
                                     }
                                     addItem({ kind: "user", text: `${text} (queued)` });
                                     void expandMentions(text).then((t) => agent.queueSteer(t));
-                                }, placeholder: "steer the agent\u2026 (Enter to queue)" })] })] })), phase === "permission" && permission && (_jsx(PermissionPrompt, { toolName: permission.toolName, summary: permission.summary, diff: permission.diff, warning: permission.warning, onDecision: onPermissionDecision })), phase === "elicitation" && elicitation && (_jsx(ElicitationPrompt, { message: elicitation.message, fields: elicitation.fields, onDecision: onElicitationDecision })), phase === "confirmMode" && (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: "green", paddingX: 1, children: [_jsx(Text, { bold: true, color: "green", children: "Switch to accept-edits mode?" }), _jsx(Text, { children: "File writes and edits will auto-approve without asking." }), _jsx(Text, { dimColor: true, children: "Destructive shell commands (rm -rf, force-push, etc.) always still ask, in every mode." }), _jsx(Text, { dimColor: true, children: "Shift+Tab again moves to dry-run mode; once more back to normal." }), _jsx(Box, { marginTop: 1, children: _jsxs(Text, { children: [_jsx(Text, { color: "green", children: "Yes (y)" }), " \u00B7 No (n/Esc)"] }) })] })), phase === "confirmBypassMode" && (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: "red", paddingX: 1, children: [_jsx(Text, { bold: true, color: "red", children: "Switch to auto mode? (sandbox-gated)" }), _jsx(Text, { children: "EVERY tool call will auto-approve, including destructive shell commands (rm -rf, force-push, etc.) \u2014 nothing will ask first." }), _jsx(Text, { dimColor: true, children: "The sandbox \u2014 not a human \u2014 is what contains any damage this mode causes." }), _jsx(Text, { dimColor: true, children: "Shift+Tab again goes back to normal." }), _jsx(Box, { marginTop: 1, children: _jsxs(Text, { children: [_jsx(Text, { color: "red", children: "Yes (y)" }), " \u00B7 No (n/Esc)"] }) })] })), phase === "model" && (_jsx(ModelPicker, { current: model, provider: provider, customModels: config.customModels ?? [], onSelect: (id) => {
+                                }, placeholder: "steer the agent\u2026 (Enter to queue)" })] })] })), phase === "permission" && permission && (_jsx(PermissionPrompt, { toolName: permission.toolName, summary: permission.summary, diff: permission.diff, warning: permission.warning, onDecision: onPermissionDecision })), phase === "elicitation" && elicitation && (_jsx(ElicitationPrompt, { message: elicitation.message, fields: elicitation.fields, onDecision: onElicitationDecision })), phase === "confirmMode" && (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: "green", paddingX: 1, children: [_jsx(Text, { bold: true, color: "green", children: "Switch to accept-edits mode?" }), _jsx(Text, { children: "File writes and edits will auto-approve without asking." }), _jsx(Text, { dimColor: true, children: "Destructive shell commands (rm -rf, force-push, etc.) always still ask in this mode." }), _jsx(Text, { dimColor: true, children: "Shift+Tab again moves to dry-run mode; once more to auto mode, then back to normal." }), _jsx(Box, { marginTop: 1, children: _jsxs(Text, { children: [_jsx(Text, { color: "green", children: "Yes (y)" }), " \u00B7 No (n/Esc)"] }) })] })), phase === "confirmBypassMode" && (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: "red", paddingX: 1, children: [_jsx(Text, { bold: true, color: "red", children: "Switch to auto mode? (sandbox-gated)" }), _jsx(Text, { children: "EVERY tool call will auto-approve, including destructive shell commands (rm -rf, force-push, etc.) \u2014 nothing will ask first." }), _jsx(Text, { dimColor: true, children: "The sandbox \u2014 not a human \u2014 is what contains any damage this mode causes." }), _jsx(Text, { dimColor: true, children: "Shift+Tab again goes back to normal." }), _jsx(Box, { marginTop: 1, children: _jsxs(Text, { children: [_jsx(Text, { color: "red", children: "Yes (y)" }), " \u00B7 No (n/Esc)"] }) })] })), phase === "model" && (_jsx(ModelPicker, { current: model, provider: provider, customModels: config.customModels ?? [], onSelect: (id) => {
                     setPhase("input");
                     setModelEverywhere(id);
                 }, onCancel: () => setPhase("input") })), phase === "resume" && (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: "magenta", paddingX: 1, children: [_jsxs(Text, { bold: true, color: "magenta", children: ["Resume a session", " ", _jsx(Text, { dimColor: true, children: "(type to search \u00B7 Esc for a fresh one \u00B7 -r <name> to skip this)" })] }), resumeFilter ? (_jsxs(Text, { children: [_jsx(Text, { dimColor: true, children: "filter: " }), resumeFilter] })) : null, _jsx(SelectList, { items: (resumeSessions ?? [])

package/dist/ui/useAgent.js

@@ -252,7 +252,7 @@ export function useAgent({ agent, workspace, modelRef, providerRef, config, uiBr
             kind: "info",
             text: "Accept-edits mode ON — file writes/edits auto-approve without asking. Destructive shell " +
                 "commands (rm -rf, force-push, etc.) still always ask. Shift+Tab again for dry-run mode, once " +
-                "more for normal.",
+                "more for auto mode, then back to normal.",
         });
     };
     const enterBypassMode = () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kritya",
-  "version": "0.8.56-beta",
+  "version": "0.8.58-beta",
   "description": "Kritya — Superintelligence at your command line",
   "type": "module",
   "publishConfig": {