kronk-cli 0.1.1 → 0.1.3

package/README.md

@@ -50,6 +50,16 @@ workflow run that produced it:
 gh attestation verify kronk-cli-*.tgz --repo BardiaN/kronk-cli
 ```
 
+The same attestation is attached to every release as a file, so it can be checked without
+GitHub's attestations API in the loop — `<tarball>.sigstore.json` for `gh attestation verify`
+and cosign, `<tarball>.intoto.jsonl` for SLSA tooling:
+
+```bash
+gh release download v0.1.3 --repo BardiaN/kronk-cli
+gh attestation verify kronk-cli-0.1.3.tgz --repo BardiaN/kronk-cli \
+  --bundle kronk-cli-0.1.3.tgz.sigstore.json
+```
+
 npm packages carry the same provenance, shown as a **Provenance** panel on the
 [package page](https://www.npmjs.com/package/kronk-cli), and verifiable locally:
 
@@ -153,8 +163,102 @@ ln -s "$PWD/src/index.js" ~/.local/bin/kronk-cli
 
 ### Scope
 
-The agent roots itself at **the directory you launch it from**. That becomes its sandbox — file
-tools cannot read or write outside it, and `bash` cannot `cd` out of it. `cd` into a project first.
+The agent roots itself at **the directory you launch it from**. `cd` into a project first.
+
+Two separate things keep it there, and they are worth telling apart:
+
+| | Enforced by | Covers |
+|---|---|---|
+| **Path containment** | `kronk-cli` | `read_file`, `write_file`, `list_dir`, `search` — resolved through symlinks, so a link inside the project cannot point out of it |
+| **Shell confinement** | the kernel — `sandbox-exec` on macOS, [`bwrap`](https://github.com/containers/bubblewrap) on Linux | `bash`: writes outside the project are denied, and key material (`~/.ssh`, `~/.gnupg`, `~/.password-store`, the macOS keychain, `~/.netrc`, `~/.npmrc`) is unreadable |
+
+The startup banner says which is in force:
+
+```
+  sandbox  paths + seatbelt
+```
+
+If no backend is available, it says so rather than implying one:
+
+```
+  sandbox  paths only — bwrap not installed, shell commands are unconfined
+```
+
+**What shell confinement does not do.** Reads stay open outside the deny-list, because denying them
+wholesale breaks every compiler and runtime the agent needs. The network is not blocked — the agent
+has to be able to run `npm install`. So it stops a command from *writing* outside your project or
+reading your keys; it does not make a hostile command harmless.
+
+The write half is categorical: both backends start from "nothing is writable" and hand back the
+project, the temp directories and the build caches. The read half is a deny-list, and a deny-list is
+only as good as its entries — which is exactly why it is kept narrow rather than broad. See
+[Authenticated CLIs](#authenticated-clis) for the trade that produced it.
+
+Two more limits worth stating:
+
+- **Symlinks out of the project are refused, even benign ones.** An `npm link`ed package under
+  `node_modules` resolves outside the root, so `read_file` and `write_file` will decline it. Use the
+  real path, which is inside a project the agent was launched in.
+- **Only filesystem operations are constrained.** The macOS profile allows everything else by
+  design, so a command that persuades an *already-running* unsandboxed process to act on its behalf
+  is not covered by it. Confinement limits what a command reaches directly; it is not a substitute
+  for reading the command before approving it.
+
+`KRONK_SANDBOX=strict` refuses to run `bash` at all when no backend is available, which is the
+setting to use if you need the guarantee rather than the best effort. `KRONK_SANDBOX=off` disables
+confinement.
+
+On Linux, install bubblewrap to get it: `apt install bubblewrap` / `dnf install bubblewrap`.
+
+### Authenticated CLIs
+
+**Tools you are already logged in to keep working.** `kubectl`, `argocd`, `aws`, `docker` and the
+like read their session tokens from `~/.kube`, `~/.config/argocd`, `~/.aws` and so on, and those
+stay readable:
+
+```console
+› run lint on all apps, then show me the current kube context
+  1 ⚙ bash: npx nx run-many -t lint
+  ✓ 174 lines
+  2 ⚙ bash: kubectl config current-context
+  ✓ prod
+```
+
+An earlier version of this denied those directories too. It broke `kubectl` and `gh` outright while
+still missing `argocd`, whose token lives in `~/.config/argocd` and which nobody had thought to add
+— a deny-list that blocks the tools you use and misses the ones you forgot costs real work and buys
+little, since an attacker just takes whichever store was not on the list. So the default covers
+material that is pivot-grade and never legitimately read by a build.
+
+**The one exception is the macOS keychain**, which is denied by default. `gh` stores its token
+there, so it will report `Failed to log in` under the sandbox. If you want it:
+
+```bash
+KRONK_SANDBOX_ALLOW=~/Library/Keychains kronk-cli
+```
+
+**Logging in from inside the agent will not work**, by design — `argocd login`, `gh auth login` and
+`kubectl config set-context` all write outside the project. Log in yourself, in your own shell,
+before starting a session. If a tool genuinely must write to its config directory, allow just that:
+
+```bash
+KRONK_SANDBOX_ALLOW=~/.config/argocd kronk-cli
+```
+
+`KRONK_SANDBOX_ALLOW` makes a path fully available — writable, and readable even if it is denied by
+default. `KRONK_SANDBOX_DENY` goes the other way and hides more, if you would rather the agent could
+not read your cluster credentials at all:
+
+```bash
+KRONK_SANDBOX_DENY=~/.kube,~/.aws kronk-cli     # kubectl and aws will now fail
+```
+
+Both take a comma- or colon-separated list, and `~` expands.
+
+> ⚠️ `bwrap` needs unprivileged user namespaces, which several hardened distros and most CI
+> runners disable — GitHub's included. Where they are off, `bwrap` is installed but cannot start,
+> and the banner will say the shell is unconfined. That is why the backend is probed rather than
+> assumed, and why the check is worth reading rather than trusting the presence of the binary.
 
 ---
 
@@ -221,6 +325,45 @@ kronk-cli --auto "make the tests pass"      # unattended, runs the whole task
 
 ---
 
+## Startup: the model is loaded before you type
+
+Kronk has no load command. It lists a model in `GET /v1/models` as soon as the
+server starts, but the weights only reach VRAM on the first inference request —
+so on a fresh server the first prompt you type pays a 10–30 s cold load, and
+looks like a hang.
+
+`kronk-cli` pays it at boot instead. It asks Kronk what is resident, and if the
+selected model is not, sends the cheapest completion there is — one token, no
+reasoning — to trigger admission:
+
+```console
+$ kronk-cli
+  loaded   unsloth/Qwen3.6-35B-A3B-UD-Q4_K_M/AGENT · 11.4s
+
+  ██ kronk-cli  · local agent, no network
+```
+
+A model already in the pool is left alone; nothing is sent. If the selected one
+cannot be admitted — it will not fit next to what is already resident — the
+fallback runs the same order the CLI uses when you name nothing: the configured
+default, then the best id Kronk is serving. Each is tried once, and a failure
+says why:
+
+```console
+$ kronk-cli -m Qwen3.6-27B
+  unsloth/Qwen3.6-27B-Q4_K_M failed to load — 507 /chat/completions — insufficient VRAM
+  loaded   unsloth/Qwen3.6-35B-A3B-UD-Q4_K_M/AGENT · 2.0s · fallback
+```
+
+If nothing loads, the original pick stands and the first turn reports the real
+error. A warm-up is a convenience, not a gate — it never decides whether the CLI
+starts.
+
+Skip it with `--no-warm` or `KRONK_WARM=false` and the first prompt pays the load,
+as before.
+
+---
+
 ## Command-line options
 
 | Flag | Default | |
@@ -229,6 +372,7 @@ kronk-cli --auto "make the tests pass"      # unattended, runs the whole task
 | `-l`, `--models`, `--list` | — | List the models Kronk is serving, then exit |
 | `--no-context` | off | Skip the startup scan of the working directory |
 | `--no-compact` | off | Never auto-compact; fail when the window fills instead |
+| `--no-warm` | off | Don't preload the model at startup; let the first prompt trigger the load |
 | `--mcp [names]` | off | Attach MCP servers — bare for all, or a comma list |
 | `--mcp-list` | — | Show configured MCP servers and their tools, then exit |
 | `-a`, `--auto` | off | Autonomous: auto-approve tools **and** run until the task is done. Implies `--yes` |
@@ -292,8 +436,12 @@ The per-turn usage line still prints after each response; this one is the runnin
 | `KRONK_THINKING` | `true` | `false` hides reasoning but still generates it |
 | `KRONK_NO_THINK` | — | `1` disables reasoning server-side |
 | `KRONK_TOOL_TIMEOUT` | `900` | Seconds before a shell command is killed |
+| `KRONK_SANDBOX` | `auto` | `auto` confines `bash` when the OS can, `strict` refuses to run it when it cannot, `off` disables it |
+| `KRONK_SANDBOX_ALLOW` | — | Paths to make fully available inside the sandbox, comma or colon separated |
+| `KRONK_SANDBOX_DENY` | — | Extra paths to hide from `bash`, comma or colon separated |
 | `KRONK_DISTILL` | `true` | `false` disables tool-output distillation |
 | `KRONK_DISTILL_AT` | `8000` | Characters of output that trigger distillation |
+| `KRONK_WARM` | `true` | `false` skips the boot-time model preload |
 | `KRONK_AUTO_COMPACT` | `true` | `false` disables automatic compaction |
 | `KRONK_COMPACT_AT` | `0.85` | Fraction of the window that triggers compaction |
 | `NO_COLOR` | — | Any value disables colour |
@@ -489,7 +637,8 @@ Disable with `--no-compact` or `KRONK_AUTO_COMPACT=false` if you would rather se
 | `bash` | ✋ | Run a command; shows it first |
 
 `--yes` and `--auto` skip the prompts. Paths resolve against the session directory and cannot
-escape the launch root. `bash` keeps its working directory **between calls**, so a bare `cd`
+escape the launch root — including through a symlink. `bash` additionally runs under an OS
+sandbox where one is available; see [Scope](#scope) for exactly what that covers. `bash` keeps its working directory **between calls**, so a bare `cd`
 sticks the way it would in a real shell.
 
 ---
@@ -749,7 +898,7 @@ previous prompt prefix — watch `cached` climb in the usage line.
 |---|---|
 | `Cannot reach Kronk` | `kronk server start --detach` |
 | `Kronk is running but has no models` | `kronk model pull <id>` |
-| First response takes ~25 s | Cold model load. Keep it warm with `--pool-ttl 1h` on the server |
+| First response takes ~25 s | Cold model load, and you started with `--no-warm`. Drop the flag, or keep the model warm with `--pool-ttl 1h` on the server |
 | Long silence before text | The model is reasoning. `--no-think`, or `/thinking` to watch it |
 | `(model produced no answer)` | Reasoning consumed the whole budget. Raise `KRONK_MAX_TOKENS` or use `--no-think` |
 | `kronk-cli: command not found` after an nvm switch | Re-run `npm link`, or see [Using nvm?](#using-nvm) |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kronk-cli",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "A Claude-Code-style terminal agent for local models served by Kronk.",
   "license": "Apache-2.0",
   "type": "module",

package/src/boot.js

@@ -0,0 +1,59 @@
+import { config, DEFAULT_MODEL } from './config.js';
+import { listLoaded, warm } from './client.js';
+import { c, spinner } from './ui.js';
+
+/** Last resort when neither the flag nor DEFAULT_MODEL is being served. */
+export function pickDefault(ids) {
+  const chat = ids.filter((id) => !/embedding|rerank/i.test(id));
+  const agent = chat.filter((id) => id.endsWith('/AGENT'));
+  const pool = agent.length ? agent : chat;
+  return pool.sort((a, b) => b.length - a.length)[0] ?? null;
+}
+
+/**
+ * Get the chosen model resident before the first prompt.
+ *
+ * A freshly started Kronk serves model *ids* but holds nothing in VRAM — it
+ * admits a model on its first inference request, and there is no endpoint that
+ * does it sooner. Left alone, that 10–25 s cold load lands on the first thing
+ * you type, looking like a hang. Do it here, where a spinner explains the wait
+ * and where a model that will not fit can still fall back to one that will.
+ *
+ * Never fatal: if nothing warms, the original pick stands and the first turn
+ * reports the real error. A warm-up is a convenience, not a gate.
+ *
+ * Returns the id left in `config.model`.
+ */
+export async function ensureLoaded(ids, log = console.error) {
+  const loaded = await listLoaded();
+  const resident = new Set((Array.isArray(loaded) ? loaded : []).map((l) => l.id));
+  if (resident.has(config.model)) return config.model;
+
+  const chosen = config.model;
+  // chosen → configured default → best guess; each distinct id tried once.
+  const chain = [...new Set([
+    chosen,
+    ids.includes(DEFAULT_MODEL) ? DEFAULT_MODEL : null,
+    pickDefault(ids),
+  ])].filter(Boolean);
+
+  for (const id of chain) {
+    if (resident.has(id)) { config.model = id; return id; }
+    const t0 = Date.now();
+    const spin = spinner(`loading ${id.split('/').pop()} — first run takes 10-30s`);
+    try {
+      await warm(id);
+      spin.stop();
+      const how = `${((Date.now() - t0) / 1000).toFixed(1)}s${id === chosen ? '' : ' · fallback'}`;
+      log(c.grey(`  loaded   ${id} · ${how}`));
+      config.model = id;
+      return id;
+    } catch (e) {
+      spin.stop();
+      log(c.yellow(`  ${id} failed to load — ${e.message.split('\n')[0].slice(0, 160)}`));
+    }
+  }
+  // Nothing would load. Keep the original pick and let the first turn say why.
+  config.model = chosen;
+  return chosen;
+}

package/src/client.js

@@ -113,3 +113,25 @@ export async function* streamChat({ model, messages, tools, signal, maxTokens, n
 
   yield { type: 'done', calls: [...calls.values()], finish };
 }
+
+/**
+ * Load a model into the pool.
+ *
+ * Kronk has no explicit "load" endpoint — admission happens on the first
+ * inference request, so the cheapest possible completion *is* the load
+ * command. A 23 GB MoE takes ~10–25 s off disk. The reply is discarded;
+ * only whether it succeeded matters.
+ */
+export async function warm(id, signal) {
+  const res = await req('/chat/completions', {
+    method: 'POST',
+    signal,
+    body: JSON.stringify({
+      model: id,
+      messages: [{ role: 'user', content: 'hi' }],
+      max_completion_tokens: 1,
+      enable_thinking: false,
+    }),
+  });
+  await res.text();
+}

package/src/config.js

@@ -23,6 +23,9 @@ export const config = {
   maxSteps: Number(process.env.KRONK_MAX_STEPS ?? file.maxSteps ?? Infinity),
   showThinking: (process.env.KRONK_THINKING ?? String(file.showThinking ?? 'true')) !== 'false',
   noThink: (process.env.KRONK_NO_THINK ?? String(file.noThink ?? '')) === '1',
+  // Kronk admits a model on its first inference request, not at server start.
+  // Pay that cold load at boot rather than on the first typed prompt.
+  warm: (process.env.KRONK_WARM ?? String(file.warm ?? 'true')) !== 'false',
   autoCompact: (process.env.KRONK_AUTO_COMPACT ?? String(file.autoCompact ?? 'true')) !== 'false',
   compactAt: Number(process.env.KRONK_COMPACT_AT ?? file.compactAt ?? 0.85),
   // Large tool output is summarized in a throwaway context so the raw text

package/src/index.js

@@ -4,11 +4,13 @@ import { stdin, stdout } from 'node:process';
 import { readFile } from 'node:fs/promises';
 import { config, DEFAULT_MODEL, warnIfInsecure } from './config.js';
 import { listModels, listModelDetails, listLoaded, modelLimits, tokenize } from './client.js';
+import { pickDefault, ensureLoaded } from './boot.js';
 import { runTurn, SYSTEM, SYSTEM_AUTO } from './agent.js';
 import { c, banner, fmtContext, statusLine } from './ui.js';
 import { projectContext } from './context.js';
 import { compact, report } from './compact.js';
 import { loadServers, McpHub, reportFailures } from './mcp.js';
+import { resolveSandbox, sandbox } from './tools.js';
 
 // ---- argv -------------------------------------------------------------
 const argv = process.argv.slice(2);
@@ -28,6 +30,7 @@ const SHOW_MODELS = flag('--models', '-l', '--list');
 const SHOW_MCP = flag('--mcp-list');
 const NO_CONTEXT = flag('--no-context');
 if (flag('--no-compact')) config.autoCompact = false;
+if (flag('--no-warm')) config.warm = false;
 
 if (flag('-h', '--help')) {
   console.log(`
@@ -42,6 +45,7 @@ if (flag('-h', '--help')) {
     -l, --models        list the models Kronk is serving, then exit
         --no-context    skip the startup scan of the working directory
         --no-compact    never auto-compact; fail instead when the window fills
+        --no-warm       don't preload the model; let the first prompt trigger it
         --mcp [names]   attach MCP servers; bare for all, or a comma list
         --mcp-list      show configured MCP servers and their tools, then exit
     -m, --model <id>    model to use; substring is enough, /AGENT profiles win
@@ -59,6 +63,7 @@ if (flag('-h', '--help')) {
     KRONK_MAX_TOKENS    output cap per response (default 8192)
     KRONK_MAX_STEPS     cap on tool calls per task (default unlimited)
     KRONK_NO_THINK      set to 1 to disable reasoning
+    KRONK_WARM          false to skip the boot-time model preload
     KRONK_AUTO_COMPACT  false to disable automatic compaction
     KRONK_COMPACT_AT    fraction of the window that triggers it (default 0.85)
 
@@ -95,14 +100,6 @@ let MCP_WANTED = null;
 const stepsArg = opt('--steps');
 if (stepsArg) config.maxSteps = /^(0|off|none|inf|unlimited)$/i.test(stepsArg) ? Infinity : Number(stepsArg);
 
-/** Last resort when neither the flag nor DEFAULT_MODEL is being served. */
-function pickDefault(ids) {
-  const chat = ids.filter((id) => !/embedding|rerank/i.test(id));
-  const agent = chat.filter((id) => id.endsWith('/AGENT'));
-  const pool = agent.length ? agent : chat;
-  return pool.sort((a, b) => b.length - a.length)[0] ?? null;
-}
-
 async function boot() {
   let ids;
   try {
@@ -138,6 +135,8 @@ async function boot() {
   }
   if (!config.model) config.model = pickDefault(ids);
 
+  if (config.warm) await ensureLoaded(ids);
+
   const { configured, native } = await modelLimits(config.model);
   config.contextWindow = configured;
   config.nativeContext = native;
@@ -307,6 +306,14 @@ async function oneShot(prompt) {
   ];
   const ac = new AbortController();
   process.on('SIGINT', () => ac.abort());
+
+  // One shot prints no banner, so the mode that auto-approves every command was
+  // also the one that said nothing about what was confining them. On stderr, so
+  // piping the answer somewhere still gets just the answer.
+  if (resolveSandbox() === 'none' && AUTO_YES) {
+    console.error(c.yellow(`  warning: shell commands run unconfined — ${sandbox.reason}`));
+  }
+
   const approve = async (name) => {
     if (AUTO_YES) return true;
     console.log(c.yellow(`  ✗ ${name} needs approval; re-run with --yes to allow it`));
@@ -334,7 +341,16 @@ async function main() {
   // Without one, stdin IS the prompt, so wait longer before giving up.
   const piped = await readStdin(inline ? 200 : 10_000);
   const oneShotPrompt = inline && piped ? `${inline}\n\n${piped}` : (inline || piped);
-  if (oneShotPrompt) { await oneShot(oneShotPrompt); return; }
+  if (oneShotPrompt) {
+    // stdin has given us everything it is going to. When it is a pipe the
+    // caller never closes — a script, an editor task, a CI step — the read
+    // above stays pending and its handle would keep the process alive long
+    // after the answer was printed. Let go of it before answering.
+    stdin.pause();
+    stdin.unref?.();
+    await oneShot(oneShotPrompt);
+    return;
+  }
 
   const rl = readline.createInterface({ input: stdin, output: stdout, historySize: 500 });
   await boot();
@@ -347,9 +363,17 @@ async function main() {
     if (ctx.isGit) bits.push('git');
     if (ctx.agentFile) bits.push(c.green(ctx.agentFile));
     if (config.contextWindow) bits.push(c.grey(`${(config.contextWindow / 1000).toFixed(0)}k ctx`));
-    console.log(c.grey(`  context`) + `  ${bits.join(c.grey(' · '))}\n`);
+    console.log(c.grey(`  context`) + `  ${bits.join(c.grey(' · '))}`);
   }
 
+  // Say which of the two confinements is actually in force. Printing nothing
+  // would let the README's word "sandbox" stand in for a guarantee the kernel
+  // is not making on this machine.
+  const backend = resolveSandbox();
+  console.log(`${c.grey('  sandbox')}  ${backend === 'none'
+    ? c.yellow(`paths only — ${sandbox.reason}, shell commands are unconfined`)
+    : c.grey(`paths + ${backend}`)}\n`);
+
   const messages = [{ role: 'system', content }];
 
   // Ctrl-C aborts the in-flight request instead of killing the process.

package/src/sandbox.js

@@ -0,0 +1,168 @@
+import { existsSync, statSync } from 'node:fs';
+import { join, delimiter } from 'node:path';
+
+/**
+ * OS-level confinement for `bash`.
+ *
+ * The file tools resolve paths and refuse to leave the launch root, but `bash`
+ * had no such guard: `cat ~/.ssh/id_rsa` ran fine, and the README called the
+ * launch root a sandbox anyway. A path check in JavaScript cannot constrain a
+ * process it has already handed the whole machine to, so the confinement has to
+ * come from the kernel.
+ *
+ * This module is pure — it builds an argv and nothing else. Spawning stays in
+ * the tool layer, which is the only place allowed to start processes.
+ */
+
+/** Directories a build legitimately writes to outside the project. */
+const CACHE_DIRS = ['.npm', '.cache', '.yarn', '.pnpm-store', 'Library/Caches'];
+
+/**
+ * Absolute cache paths. Exported because with the filesystem read-only these
+ * have to exist *before* the sandbox starts — bwrap cannot create a mountpoint
+ * under a read-only parent, so a machine with no ~/.npm yet could not run
+ * `npm install` at all. The tool layer creates them; this module stays pure.
+ */
+export const cacheDirs = (home) => CACHE_DIRS.map((d) => join(home, d));
+
+/**
+ * Key material the agent has no reason to read, and that no build step needs.
+ *
+ * This list was once wider — it covered `~/.kube`, `~/.aws`, `~/.config/gh` and
+ * friends. That broke `kubectl`, `gh` and anything else the user had already
+ * logged in to, while still missing tools nobody thought of (`argocd` keeps its
+ * token in `~/.config/argocd`, and sailed straight through). A deny-list that
+ * blocks the tools you use and misses the ones you forgot is worse than an
+ * honest boundary: it costs real work and buys little, because an attacker
+ * exfiltrates whichever credential store was not on it.
+ *
+ * So the default is narrow and covers material that is pivot-grade and never
+ * legitimately read by a build. Session tokens for CLIs you are already logged
+ * in to stay readable — add them with KRONK_SANDBOX_DENY if your threat model
+ * wants them gone, at the cost of those commands failing.
+ *
+ * The write confinement is the half that holds categorically. This half is
+ * best-effort, and the README says so.
+ */
+const SECRET_DIRS = ['.ssh', '.gnupg', '.password-store', 'Library/Keychains'];
+
+const SECRET_FILES = ['.npmrc', '.netrc', '.pypirc', '.git-credentials'];
+
+/** `A:B` or `A,B`, absolute or `~`-relative. Empty entries are dropped. */
+export function extraPaths(value, home) {
+  return (value ?? '')
+    .split(/[:,]/)
+    .map((p) => p.trim())
+    .filter(Boolean)
+    .map((p) => (p.startsWith('~/') ? join(home, p.slice(2)) : p));
+}
+
+/** Seatbelt string literals are double-quoted; only `\` and `"` need escaping. */
+const sb = (p) => `"${p.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+
+/**
+ * Allow everything, then take away writes outside the project and reads of
+ * credential stores. Starting from `(deny default)` would mean enumerating every
+ * dylib, locale file and device node a toolchain touches, and getting that wrong
+ * fails closed in ways that look like a broken CLI rather than a blocked write.
+ */
+export function seatbeltProfile({ root, home, tmp, allow = [], deny = [] }) {
+  const writable = [root, '/dev', '/private/tmp', '/private/var/tmp', '/private/var/folders', '/tmp']
+    .concat(tmp ? [tmp] : [])
+    .concat(cacheDirs(home))
+    .concat(allow);
+
+  // ALLOW means "this path is fully available", so it also lifts a default
+  // denial. Without that there is no way to run a keychain-backed CLI like `gh`
+  // short of turning the sandbox off entirely, which is a worse trade.
+  const unreadable = SECRET_DIRS.map((d) => join(home, d)).concat(deny)
+    .filter((d) => !allow.some((a) => d === a || d.startsWith(`${a}/`)));
+
+  return [
+    '(version 1)',
+    '(allow default)',
+    '(deny file-write*)',
+    `(allow file-write* ${writable.map((p) => `(subpath ${sb(p)})`).join(' ')})`,
+    `(deny file-read* ${unreadable.map((d) => `(subpath ${sb(d)})`).join(' ')} `
+      + `${SECRET_FILES.map((f) => `(literal ${sb(join(home, f))})`).join(' ')})`,
+  ].join('\n');
+}
+
+/**
+ * bubblewrap equivalent: the filesystem read-only, then hand back what has to
+ * be writable.
+ *
+ * This started as `--dev-bind / /` (everything read-write) with `$HOME` made
+ * read-only afterwards, which protected `$HOME` and nothing else — `/etc`,
+ * `/opt`, `/usr/local` and `/var/tmp` all stayed writable. That is the escape
+ * this module exists to prevent, merely relocated. Deny-by-default is the only
+ * shape that matches what the README promises, and it is what seatbelt does on
+ * the other side.
+ */
+export function bwrapArgs({ root, home, cwd, tmp, allow = [], deny = [] }) {
+  // /dev and /proc must be fresh mounts: a read-only bind of the host's would
+  // leave a shell unable to write to its own stdout or read /proc/self.
+  const args = ['--die-with-parent', '--ro-bind', '/', '/', '--dev', '/dev', '--proc', '/proc'];
+
+  // The project is bound unconditionally: it is the working directory, it has to
+  // exist, and guarding it on existsSync meant a root that could not be stat-ed
+  // silently produced a read-only project instead of an error.
+  args.push('--bind', root, root);
+
+  const optional = ['/tmp', '/var/tmp']
+    .concat(tmp ? [tmp] : [])
+    .concat(cacheDirs(home))
+    .concat(allow);
+
+  for (const p of optional) {
+    if (existsSync(p)) args.push('--bind', p, p);
+  }
+
+  // A tmpfs makes a credential directory exist but be empty; /dev/null over a
+  // file makes it readable and empty. Both beat a missing path, which tools
+  // report as a confusing ENOENT rather than an obvious denial.
+  const hidden = SECRET_DIRS.map((x) => join(home, x)).concat(deny)
+    .filter((d) => !allow.some((a) => d === a || d.startsWith(`${a}/`)));
+  for (const d of hidden) {
+    if (existsSync(d) && statSync(d).isDirectory()) args.push('--tmpfs', d);
+  }
+  for (const f of SECRET_FILES.map((x) => join(home, x))) {
+    if (existsSync(f)) args.push('--ro-bind', '/dev/null', f);
+  }
+
+  return args.concat('--chdir', cwd, 'bash');
+}
+
+/** First match in PATH, without shelling out to `which`. */
+export function onPath(bin, { env = process.env } = {}) {
+  return (env.PATH ?? '').split(delimiter).some((d) => d && existsSync(join(d, bin)));
+}
+
+/**
+ * Which backend this machine can offer, before we know whether it works.
+ * `KRONK_SANDBOX=off` skips confinement; `strict` refuses to run unconfined.
+ */
+export function detectBackend({ platform = process.platform, env = process.env } = {}) {
+  if ((env.KRONK_SANDBOX ?? 'auto') === 'off') return 'none';
+  if (platform === 'darwin' && onPath('sandbox-exec', { env })) return 'seatbelt';
+  if (platform === 'linux' && onPath('bwrap', { env })) return 'bwrap';
+  return 'none';
+}
+
+/**
+ * Build the argv that runs `script` under `backend`.
+ * Returns `['bash', ['-c', script]]` shaped output for spawn().
+ */
+export function sandboxArgv(script, { backend, root, home, cwd, tmp, env = process.env }) {
+  const allow = extraPaths(env.KRONK_SANDBOX_ALLOW, home);
+  const deny = extraPaths(env.KRONK_SANDBOX_DENY, home);
+
+  if (backend === 'seatbelt') {
+    return ['sandbox-exec',
+      ['-p', seatbeltProfile({ root, home, tmp, allow, deny }), 'bash', '-c', script]];
+  }
+  if (backend === 'bwrap') {
+    return ['bwrap', [...bwrapArgs({ root, home, cwd, tmp, allow, deny }), '-c', script]];
+  }
+  return ['bash', ['-c', script]];
+}

package/src/tools.js

@@ -1,8 +1,10 @@
 import { readFile, writeFile, readdir, stat } from 'node:fs/promises';
-import { execFile, spawn } from 'node:child_process';
+import { execFile, spawn, spawnSync } from 'node:child_process';
 import { promisify } from 'node:util';
-import { resolve, relative } from 'node:path';
-import { realpathSync } from 'node:fs';
+import { resolve, relative, dirname, basename, isAbsolute } from 'node:path';
+import { realpathSync, mkdirSync } from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
+import { detectBackend, sandboxArgv, cacheDirs } from './sandbox.js';
 import { c } from './ui.js';
 
 const exec = promisify(execFile);
@@ -31,6 +33,30 @@ function real(p) {
   try { return realpathSync(p); } catch { return p; }
 }
 
+/**
+ * Resolve symlinks all the way down, including for a path that does not exist
+ * yet.
+ *
+ * Comparing the textual path against the root let a symlink inside the project
+ * point anywhere: `ln -s /etc/passwd notes` and then `read_file notes` passed
+ * the containment check and read the target. Writes were worse — a symlinked
+ * directory meant `write_file` landed outside the root entirely. So we resolve
+ * the deepest ancestor that exists and re-attach the rest, which is the path the
+ * filesystem will actually use.
+ */
+function realDeep(abs) {
+  const tail = [];
+  let cur = abs;
+  for (;;) {
+    try { return tail.length ? resolve(realpathSync(cur), ...tail) : realpathSync(cur); }
+    catch { /* does not exist yet — walk up */ }
+    const parent = dirname(cur);
+    if (parent === cur) return abs;
+    tail.unshift(basename(cur));
+    cur = parent;
+  }
+}
+
 /**
  * Trim from the MIDDLE, never the end.
  *
@@ -47,9 +73,11 @@ export const clip = (s) => {
 
 /** Resolve against the session cwd, and keep the agent inside the launch root. */
 export function safe(p) {
-  const abs = resolve(real(session.cwd), p);
+  const abs = realDeep(resolve(real(session.cwd), p));
   const rel = relative(real(session.root), abs);
-  if (rel.startsWith('..')) throw new Error(`refusing to touch path outside ${session.root}: ${p}`);
+  if (rel.startsWith('..') || isAbsolute(rel)) {
+    throw new Error(`refusing to touch path outside ${session.root}: ${p}`);
+  }
   return abs;
 }
 
@@ -123,6 +151,55 @@ function applyCwd(out, mark) {
 
 const MARK = '__KRONK_CWD__';
 
+/**
+ * What is actually confining `bash`, resolved once and reported in the banner.
+ * `pending` until the first command runs, because the preflight costs a process.
+ */
+export const sandbox = { backend: 'pending', reason: null };
+
+/**
+ * Ask the kernel, do not assume.
+ *
+ * `sandbox-exec` exists on every Mac and `bwrap` may be installed but unusable
+ * — unprivileged user namespaces are off on some distros, and a container often
+ * has neither. A backend that fails to launch would turn every command into a
+ * confusing startup error, so it is tried against `true` once and dropped if it
+ * does not work.
+ */
+export function resolveSandbox({ platform = process.platform, env = process.env } = {}) {
+  if (sandbox.backend !== 'pending') return sandbox.backend;
+
+  const mode = env.KRONK_SANDBOX ?? 'auto';
+  const wanted = detectBackend({ platform, env });
+
+  if (wanted === 'none') {
+    sandbox.backend = 'none';
+    sandbox.reason = mode === 'off'
+      ? 'disabled by KRONK_SANDBOX=off'
+      : platform === 'linux' ? 'bwrap not installed' : 'no sandbox backend on this platform';
+    return sandbox.backend;
+  }
+
+  // With the filesystem read-only inside the sandbox these cannot be created
+  // from within it, and a missing ~/.npm would break `npm install` outright.
+  for (const d of cacheDirs(homedir())) {
+    try { mkdirSync(d, { recursive: true }); } catch { /* not fatal — it just stays unwritable */ }
+  }
+
+  const [bin, argv] = sandboxArgv('exit 0', {
+    backend: wanted, root: session.root, home: homedir(), cwd: session.cwd, tmp: real(tmpdir()),
+  });
+  const probe = spawnSync(bin, argv, { stdio: 'ignore', timeout: 10_000 });
+
+  if (probe.error || probe.status !== 0) {
+    sandbox.backend = 'none';
+    sandbox.reason = `${wanted} failed to start`;
+  } else {
+    sandbox.backend = wanted;
+  }
+  return sandbox.backend;
+}
+
 /**
  * Run a shell command, streaming progress to `onProgress` as it goes.
  *
@@ -141,7 +218,16 @@ export function runBash(cmd, { onProgress, timeoutMs = TOOL_TIMEOUT } = {}) {
     // Appending `printf` naively made every command look successful, so
     // failures never reached the agent at all.
     const script = `${cmd}\n__kronk_st=$?\nprintf '\\n${MARK}%s' "$(pwd)"\nexit $__kronk_st`;
-    const child = spawn('bash', ['-c', script], {
+
+    const backend = resolveSandbox();
+    if (backend === 'none' && (process.env.KRONK_SANDBOX ?? 'auto') === 'strict') {
+      return resolve(`error: refusing to run unconfined — KRONK_SANDBOX=strict and ${sandbox.reason}.`);
+    }
+
+    const [bin, argv] = sandboxArgv(script, {
+      backend, root: session.root, home: homedir(), cwd: session.cwd, tmp: real(tmpdir()),
+    });
+    const child = spawn(bin, argv, {
       cwd: session.cwd,
       env: { ...process.env, TERM: 'dumb', CI: process.env.CI ?? '1' },
       detached: true,
@@ -246,7 +332,9 @@ export async function runTool(name, args, opts = {}) {
       }
 
       case 'search': {
-        const where = args.path ?? '.';
+        // Went straight to ripgrep unchecked, so `search` with an absolute path
+        // read anything on the machine while read_file was busy refusing to.
+        const where = safe(args.path ?? '.');
         try {
           const { stdout } = await exec('rg', ['-n', '--no-heading', '-m', '200', args.pattern, where]);
           return clip(stdout) || '(no matches)';