kritya 0.8.58-beta → 0.8.60-beta

package/dist/commands/registry.js

@@ -7,9 +7,10 @@ import { mcpPrompts } from "../mcp/client.js";
 import { scanSkillsDetailed, skillsDir, userSkillsDir } from "../agent/skills.js";
 import { pluginsDir, pluginSkillsRoots, scanPlugins, scanPluginsDetailed, userPluginsDir, } from "../plugins/discover.js";
 import { scanPluginMcpServers } from "../plugins/mcp.js";
-import { listProviders } from "../config/config.js";
+import { listProviders, loadConfig } from "../config/config.js";
 import { expandCommand } from "./custom.js";
 import { recordCommandUse } from "../ui/recentCommands.js";
+import { headlessSandboxRestrictions, sandboxNetworkEscalated, sandboxNetworkMode, setSandboxNetworkEscalated, } from "../shell/sandbox.js";
 import { allTemplates, applyTemplate, isValidName, lastUserText, loadTemplates, saveTemplates, } from "./templates.js";
 import { gitBranch, gitCommitsAhead, gitDefaultBranch, gitHasUpstream, gitPush, gitRefExists, gitRemoteUrl, gitUnpushedCount, } from "../git/git.js";
 import { createPullRequest, findOpenPullRequest, parseGitHubRemote, parsePrFlags, prBodyFor, prTitleFor, resolveGitHubToken, } from "../git/pr.js";
@@ -157,6 +158,11 @@ export const BUILTIN_COMMANDS = [
         description: "show this session's permission decisions and verify the audit log's chain",
         category: SAFETY,
     },
+    {
+        name: "/network",
+        description: "sandbox network access: /network on|off for this session, or no argument to see it",
+        category: SAFETY,
+    },
     {
         name: "/budget",
         description: "show session token budget, /budget reset, or /budget <number> to set it",
@@ -739,6 +745,45 @@ const handlers = {
     "/status": (ctx) => {
         ctx.addItem({ kind: "info", text: ctx.statusReport() });
     },
+    "/network": (ctx) => {
+        const arg = ctx.arg.trim().toLowerCase();
+        const config = loadConfig();
+        if (arg === "on" || arg === "off") {
+            if (headlessSandboxRestrictions()) {
+                ctx.addItem({
+                    kind: "info",
+                    text: "This run is headless, so the sandbox keeps the network off regardless. " +
+                        "A CI job has nobody to answer for the session, which is the whole point of the posture.",
+                });
+                return;
+            }
+            setSandboxNetworkEscalated(arg === "on");
+            ctx.addItem({
+                kind: "info",
+                text: arg === "on"
+                    ? "Sandbox network: OPEN for the rest of this session. It is not per-host — every " +
+                        "destination is reachable — and it resets when kritya restarts."
+                    : "Sandbox network: CLOSED for the rest of this session. Commands can no longer reach the network.",
+            });
+            return;
+        }
+        const mode = sandboxNetworkMode(config);
+        const source = headlessSandboxRestrictions()
+            ? "forced by this headless run"
+            : sandboxNetworkEscalated()
+                ? "opened by /network on this session"
+                : config.sandboxNetwork === "open"
+                    ? 'set by "sandboxNetwork": "open" in config'
+                    : "the default";
+        ctx.addItem({
+            kind: "info",
+            text: `Sandbox network: ${mode.toUpperCase()} (${source}).\n` +
+                (mode === "none"
+                    ? "Commands run without the network, so npm install, git push and docker pull fail. " +
+                        "/network on opens it for this session."
+                    : "Commands can reach the network. /network off closes it for this session."),
+        });
+    },
     "/audit": (ctx) => {
         const audit = ctx.agent.audit;
         if (!audit) {

package/dist/config/config.js

@@ -128,6 +128,7 @@ const KNOWN_CONFIG_KEYS = new Set([
     "sandboxExec",
     "sandboxReadDeny",
     "sandboxReadAllow",
+    "sandboxReadDenyStrict",
     "sandboxNetwork",
     "retentionDays",
     "audit",

package/dist/headless.js

@@ -24,7 +24,7 @@ import { loadHooks, HookRunner } from "./hooks/hooks.js";
 import { gatedContentHash, isTrusted } from "./trust/trust.js";
 import { partitionByTrust, serverFingerprint, trustServer } from "./trust/mcpTrust.js";
 import { installCrashHandlers } from "./crash.js";
-import { defaultSandboxMode } from "./shell/sandbox.js";
+import { defaultSandboxMode, setHeadlessSandboxRestrictions } from "./shell/sandbox.js";
 /**
  * Whether a `--prompt` value looks like a slash command.
  *
@@ -112,6 +112,12 @@ export async function runHeadless(args) {
     if (trustWorkspace)
         loadDotEnv([path.join(workspace, ".env")]);
     const config = loadConfig();
+    // Nobody is at the terminal to answer "this looks untrusted" or "allow the
+    // network for this one", so a headless run takes the maximum-restriction
+    // posture instead of the interactive defaults: no egress, and the strict
+    // credential list. Set before any agent is built so every shell call in the
+    // run, including subagents, sees it.
+    setHeadlessSandboxRestrictions(true);
     const privacyMode = args.privacy === true || privacyModeFor(config);
     const provider = resolveProvider(config, args.provider || undefined);
     if (!provider.apiKey) {

package/dist/shell/sandbox.js

@@ -8,6 +8,68 @@ import { classifyDanger } from "../permissions/danger.js";
 let cachedTool;
 let cachedMxcExec;
 let dotEnvLoaded = false;
+/**
+ * True once a headless run has claimed maximum restriction.
+ *
+ * Module state rather than a config field, because the readers below are called
+ * from paths that pass no config and fall back to `loadConfig()` — a frontend
+ * that mutated its own copy of the config would not be seen by
+ * `buildSandboxedCommand`'s default argument. A process-wide flag is what makes
+ * the claim hold no matter which caller arrives first, and a headless run is
+ * one process, so there is nothing to scope it to.
+ *
+ * What it forces, and why each one:
+ *  - network `"none"` — a CI job has nobody watching it, so the setting that
+ *    depends on a human deciding "this looks untrusted" never gets chosen.
+ *  - the strict credential list — `gh`, `npm publish` and HTTPS push are not
+ *    things a headless run does on the user's behalf, so masking their tokens
+ *    costs nothing there.
+ *  - read denial even when `sandboxReadDeny` is false — the config was written
+ *    for an interactive session; a headless run cannot show the prompt that
+ *    would make an open read policy defensible.
+ *
+ * Deliberately not part of it: `sandboxExec`. A headless run with no backend
+ * already fails closed under "strict", and forcing the mode would silently
+ * override a host where the user deliberately chose "auto".
+ */
+let headlessRestrictions = false;
+/**
+ * Turns maximum restriction on or off for this process. Called by the headless
+ * entry point; exported so tests can drive both states without a CI runner.
+ */
+export function setHeadlessSandboxRestrictions(on) {
+    headlessRestrictions = on;
+}
+/** Whether the headless maximum-restriction posture is in force. */
+export function headlessSandboxRestrictions() {
+    return headlessRestrictions;
+}
+/**
+ * True once this session has been granted network access by hand.
+ *
+ * The counterpart to `headlessRestrictions`, and the reason the default can be
+ * `"none"` without making the tool unusable: a command that needs the network
+ * fails, says so, and the user opens it with `/network on` for the rest of the
+ * session. Resets on restart, deliberately — "I trusted this session" is not a
+ * fact about the next one, and the same posture as the unsandboxed-fallback
+ * acknowledgement above.
+ *
+ * Session-scoped rather than per-command because the sandbox backends cannot
+ * express "this host, not that one": bwrap's `--unshare-net` is a namespace,
+ * and sandbox-exec's rule is an operation family. A per-host allowlist would
+ * need a proxy in front of the sandbox, which is a different piece of work —
+ * so this grants the whole session and says so, rather than implying a
+ * precision that does not exist.
+ */
+let networkEscalated = false;
+/** Grants or revokes network access for the rest of this session. */
+export function setSandboxNetworkEscalated(on) {
+    networkEscalated = on;
+}
+/** Whether this session has been granted network access by hand. */
+export function sandboxNetworkEscalated() {
+    return networkEscalated;
+}
 /**
  * Load `~/.kritya/.env` before the backend is resolved, once per process.
  *
@@ -467,15 +529,67 @@ function pathContains(parent, child) {
     return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
 }
 /**
- * `"none"` only when the user asked for it; anything else is `"open"`.
+ * `"none"` unless the user asked for `"open"`, this session was granted the
+ * network by hand, or a headless run is in force.
+ *
+ * Off by default because egress is the one thing that turns a command that read
+ * something it shouldn't into a command that sent it somewhere. The cost is
+ * that `npm install`, `git push` and `docker pull` fail until the network is
+ * opened, which is why a failure says how (see `networkBlockedHint`) and
+ * `/network on` grants it for the session.
  *
- * Deliberately not a default: cutting the network off stops `npm install`,
- * `git push` and `docker pull`, so it is the setting you switch on for a review
- * pass or for code you don't trust, not one that should surprise someone
- * mid-task. Exported for tests.
+ * Exported for tests.
  */
 export function sandboxNetworkMode(config = loadConfig()) {
-    return config.sandboxNetwork === "none" ? "none" : "open";
+    if (headlessRestrictions)
+        return "none";
+    if (networkEscalated)
+        return "open";
+    return config.sandboxNetwork === "open" ? "open" : "none";
+}
+/**
+ * Whether a failed command's output looks like it died because the network was
+ * unreachable, rather than because the command itself was wrong.
+ *
+ * Deliberately loose: a false positive costs one extra line under an error that
+ * already happened, and a false negative leaves someone staring at
+ * `getaddrinfo ENOTFOUND` with no idea the sandbox caused it. Exported for
+ * tests.
+ */
+export function looksLikeNetworkFailure(output) {
+    return /\b(ENOTFOUND|EAI_AGAIN|ECONNREFUSED|ECONNRESET|ETIMEDOUT|EHOSTUNREACH|ENETUNREACH)\b|could not resolve host|network is unreachable|temporary failure in name resolution|getaddrinfo/i.test(output);
+}
+/**
+ * The line appended to a failed sandboxed command when the network was what
+ * stood in its way. Null when the network was open, or the failure looks
+ * unrelated, so nothing is said when nothing is wrong.
+ */
+export function networkBlockedHint(network, output) {
+    if (network !== "none")
+        return null;
+    if (!looksLikeNetworkFailure(output))
+        return null;
+    return (`[network is off inside the sandbox, so this command could not reach the network. ` +
+        `Run /network on to allow it for the rest of the session, or set "sandboxNetwork": "open" ` +
+        `in ~/.kritya/config.json to make that the default.]`);
+}
+/**
+ * The credential files that are readable by default because a first-class
+ * workflow reads each one, and which `sandboxReadDenyStrict` (or a headless
+ * run) masks anyway.
+ *
+ * Kept separate from the base list so the two postures stay legible: the base
+ * list is "nobody needs this to build", and this one is "somebody needs this
+ * to work". Every entry here is a live token in a plain file, which is exactly
+ * why it is the interesting half of the deny list and why it cannot be the
+ * default half.
+ */
+function strictReadDenyPaths(home) {
+    return [
+        path.join(home, ".npmrc"),
+        path.join(home, ".config", "gh", "hosts.yml"),
+        path.join(home, ".git-credentials"),
+    ];
 }
 /**
  * The credential paths a sandboxed command must not read, as absolute paths.
@@ -497,19 +611,26 @@ export function sandboxNetworkMode(config = loadConfig()) {
  *    stays readable so contexts keep resolving.
  *  - `~/.netrc` — plaintext credentials for whatever `machine` entries it has.
  *
- * Deliberately NOT denied, each because a first-class workflow reads it:
- * `~/.npmrc` (`npm install` against a private registry, `npm publish`),
- * `~/.config/gh/hosts.yml` (the `gh` calls behind pull requests), and
- * `~/.git-credentials` (HTTPS `git push`). Blocking those would break the
- * ordinary user's day far more often than it would stop an attacker, and the
- * deny list is intentionally fixed so the only knob is the allow side.
+ * Deliberately NOT denied by default, each because a first-class workflow
+ * reads it: `~/.npmrc` (`npm install` against a private registry,
+ * `npm publish`), `~/.config/gh/hosts.yml` (the `gh` calls behind pull
+ * requests), and `~/.git-credentials` (HTTPS `git push`). Blocking those would
+ * break the ordinary user's day far more often than it would stop an attacker,
+ * so they are the opt-in half of the list rather than an omission — see
+ * `sandboxReadDenyStrict` and `strictReadDenyPaths`.
+ *
+ * The deny list is fixed apart from that one switch, so the only per-path knob
+ * is the allow side.
  *
  * Exported for tests.
  */
 export function sandboxReadDenyPaths(config = loadConfig()) {
-    if (config.sandboxReadDeny === false)
+    // A headless run does not get to honour `sandboxReadDeny: false`: there is
+    // nobody to ask whether an open read policy is acceptable here.
+    if (config.sandboxReadDeny === false && !headlessRestrictions)
         return [];
     const home = os.homedir();
+    const strict = config.sandboxReadDenyStrict === true || headlessRestrictions;
     const deny = [
         path.join(home, ".aws"),
         path.join(home, ".config", "gcloud"),
@@ -517,6 +638,7 @@ export function sandboxReadDenyPaths(config = loadConfig()) {
         path.join(home, ".docker", "config.json"),
         path.join(home, ".netrc"),
         ...sshPrivateKeyPaths(home),
+        ...(strict ? strictReadDenyPaths(home) : []),
     ];
     const allow = (config.sandboxReadAllow ?? [])
         .filter((p) => typeof p === "string" && p.length > 0)
@@ -1076,6 +1198,7 @@ export function buildSandboxedCommand(command, workspace, config = loadConfig())
                 "--config-base64",
                 Buffer.from(mxcPolicyJson(windowsShellCommand(command), workspace, writable, windowsToolPaths(workspace), network), "utf8").toString("base64"),
             ],
+            network,
         };
     }
     // null if the path exists but isn't a real, self-owned directory (e.g.
@@ -1112,7 +1235,7 @@ export function buildSandboxedCommand(command, workspace, config = loadConfig())
                 args.push("--bind", p, p);
         }
         args.push("--bind", workspace, workspace, "--chdir", workspace, "--unshare-pid", "--die-with-parent", "sh", "-c", command);
-        return { cmd: "bwrap", args };
+        return { cmd: "bwrap", args, network };
     }
     // sandbox-exec (macOS) takes its policy as a profile file, not inline args.
     // Named with the same pid+timestamp+random suffix as runDir below, so a
@@ -1136,6 +1259,7 @@ export function buildSandboxedCommand(command, workspace, config = loadConfig())
     return {
         cmd: "sandbox-exec",
         args: ["-f", profilePath, "sh", "-c", command],
+        network,
         env: { TMPDIR: runDir, TMP: runDir, TEMP: runDir },
         cleanup: () => {
             fs.rm(profilePath, { force: true }, () => { });

package/dist/tools/shell.js

@@ -2,7 +2,7 @@ import { exec, execFile } from "node:child_process";
 import { scrubbedShellEnv } from "../config/config.js";
 import { gitDiffStat } from "../git/git.js";
 import { backgroundManager } from "../shell/background.js";
-import { buildSandboxedCommand, requiresSandbox, sandboxUnavailableReason, shouldSandbox, } from "../shell/sandbox.js";
+import { buildSandboxedCommand, networkBlockedHint, requiresSandbox, sandboxUnavailableReason, shouldSandbox, } from "../shell/sandbox.js";
 import { commandTouchesSensitivePath, truncateTail } from "./common.js";
 import { redactSecrets } from "./secretScan.js";
 const DEFAULT_TIMEOUT_S = 120;
@@ -114,7 +114,13 @@ export const shellTool = {
                         : runOpts;
                     execFile(wrapped.cmd, wrapped.args, opts, (error, stdout, stderr) => {
                         wrapped.cleanup?.();
-                        finish(resolve, error, stdout, stderr);
+                        // Only on failure, and only when the sandbox was the reason: a
+                        // command that fails with a name-resolution error inside a
+                        // no-network sandbox otherwise looks like a broken project rather
+                        // than a setting the user can change.
+                        finish(resolve, error, stdout, stderr, error
+                            ? (networkBlockedHint(wrapped.network, `${stdout}\n${stderr}`) ?? undefined)
+                            : undefined);
                     });
                     return;
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kritya",
-  "version": "0.8.58-beta",
+  "version": "0.8.60-beta",
   "description": "Kritya — Superintelligence at your command line",
   "type": "module",
   "publishConfig": {