v0.7.0: dangerous operations approval system

Add configurable risk-classification and user approval for high-risk
shell commands when running outside sandbox mode.

NEW: internal/danger/ package
  - RiskClass type with 8 levels: safe → blocked
  - Token-level classifier (quotes, pipes, &&, ||, ;, redirects)
  - DangerousConfig with per-class actions, allowlist, denylist
  - 52 tests covering every class, edge cases, and config paths

NEW: Shell tool approval prompt
  - Optional 'description' field in JSON schema for agent intent
  - /dev/tty prompt with Approve/Deny/Trust/Context responses
  - Session-level trust cache (in-memory, not persisted)
  - Non-interactive fallback when /dev/tty unavailable
  - 13 tests with mocked TTY

CHANGED:
  - config/loader.go: DangerousConfig in FileConfig + ResolvedConfig
  - main.go: builtinTools() accepts DangerousConfig, all callers updated
  - kode init: default template includes dangerous section
  - docs/CLI.md: dangerous operations reference table
  - docs/SECURITY.md: full approval system documentation

Author: jkyberneees

cmd/kode/main.go

@@ -15,6 +15,7 @@ import (
 
 	"github.com/BackendStack21/kode"
 	"github.com/BackendStack21/kode/internal/config"
+	"github.com/BackendStack21/kode/internal/danger"
 	"github.com/BackendStack21/kode/internal/llm"
 	"github.com/BackendStack21/kode/internal/render"
 	"github.com/BackendStack21/kode/internal/session"
@@ -303,7 +304,20 @@ const defaultConfigTemplate = `{
   "sandbox_cpus": "",
   "sandbox_user": "",
   "sandbox_env": {},
-  "sandbox_volumes": []
+  "sandbox_volumes": [],
+  "dangerous": {
+    "action": "prompt",
+    "non_interactive": "allow",
+    "classes": {
+      "destructive": "deny",
+      "network_egress": "prompt",
+      "code_execution": "prompt",
+      "install": "prompt",
+      "system_write": "prompt"
+    },
+    "allowlist": [],
+    "denylist": []
+  }
 }`
 
 // initConfig creates a new config file (local ./kode.json or global ~/kode/config.json).
@@ -524,7 +538,7 @@ func run(args []string) error {
 
 	// Sandbox setup
 	var sandboxCleanup func() error
-	tools := builtinTools()
+	tools := builtinTools(resolved.Dangerous)
 
 	if resolved.Sandbox {
 		cleanup, err := setupSandbox(tools, sbCfg)
@@ -706,9 +720,11 @@ func setupSandbox(tools []kode.Tool, cfg sandboxConfig) (func() error, error) {
 	return cleanup, nil
 }
 
-func builtinTools() []kode.Tool {
+func builtinTools(dc danger.DangerousConfig) []kode.Tool {
 	return []kode.Tool{
-		&shellTool{},
+		&shellTool{
+			dangerousConfig: dc,
+		},
 	}
 }
 
@@ -780,10 +796,6 @@ func continueCmd(args []string) error {
 	fmt.Fprintf(os.Stderr, "kode: continuing session %s (turn %d → %d)\n",
 		sess.ID, sess.Turns, sess.Turns+1)
 
-	// Build tools
-	tools := builtinTools()
-	var sandboxCleanup func() error
-
 	// Resolve config (no CLI flags for continue — uses session's model)
 	resolved := config.LoadConfig(config.CLIFlags{Model: sess.Model})
 
@@ -793,6 +805,10 @@ func continueCmd(args []string) error {
 		fmt.Fprintf(os.Stderr, "kode: session was sandboxed — enabling sandbox for this continuation\n")
 	}
 
+	// Build tools
+	tools := builtinTools(resolved.Dangerous)
+	var sandboxCleanup func() error
+
 	systemMessage := resolved.System
 	if systemMessage == "" {
 		systemMessage = defaultSystem

cmd/kode/main_test.go

@@ -11,6 +11,7 @@ import (
 	"testing"
 
 	"github.com/BackendStack21/kode/internal/config"
+	"github.com/BackendStack21/kode/internal/danger"
 )
 
 func TestGetVersion_LdFlagsOverride(t *testing.T) {
@@ -193,7 +194,7 @@ func TestRun_NoAPIKey(t *testing.T) {
 }
 
 func TestBuiltinTools(t *testing.T) {
-	tools := builtinTools()
+	tools := builtinTools(danger.DangerousConfig{})
 	if len(tools) == 0 {
 		t.Fatal("builtinTools() returned empty slice")
 	}

cmd/kode/repl.go

@@ -54,7 +54,7 @@ func replCmd(args []string) error {
 	}
 
 	// Build tools
-	tools := builtinTools()
+	tools := builtinTools(resolved.Dangerous)
 	var sandboxCleanup func() error
 
 	if resolved.Sandbox {

cmd/kode/shell.go

@@ -1,11 +1,15 @@
 package main
 
 import (
+	"bufio"
 	"bytes"
 	"encoding/json"
 	"fmt"
+	"os"
 	"os/exec"
 	"strings"
+
+	"github.com/BackendStack21/kode/internal/danger"
 )
 
 // shellTool is kode's built-in tool that lets the agent run shell commands.
@@ -33,11 +37,24 @@ import (
 //     command string as JSON; the shell tool executes it as-is.
 //   - Error output is merged into stdout (stderr follows stdout in output).
 //   - Empty output returns "(no output)" so the LLM always gets a response.
+//   - Commands are classified by risk (see internal/danger). High-risk
+//     commands in non-sandboxed mode prompt the user for approval via /dev/tty.
 type shellTool struct {
 	// containerName, when set, routes commands through "docker exec"
 	// into this container. Set by setupSandbox() when --sandbox is active.
 	// When empty, commands run directly on the host.
 	containerName string
+
+	// dangerousConfig controls per-class actions and allow/denylists.
+	dangerousConfig danger.DangerousConfig
+
+	// trustedClasses caches user-approved risk classes for this process.
+	// Set when user presses T (trust this session) at the prompt.
+	trustedClasses map[danger.RiskClass]bool
+
+	// ttyPath is the path to the terminal device for approval prompts.
+	// Overridden in tests to mock user input.
+	ttyPath string
 }
 
 func (t *shellTool) Name() string { return "shell" }
@@ -46,7 +63,10 @@ func (t *shellTool) Description() string {
 	return `Run a shell command and return its output.
 Use for: reading files, listing directories, running tests, building code, and git operations.
 In sandbox mode (--sandbox), commands run inside the Docker container with restricted permissions.
-In host mode (default), commands run with the same permissions as the kode process.`
+In host mode (default), commands run with the same permissions as the kode process.
+
+Risk classes: safe, local_write, system_write, destructive, network_egress, code_execution, install, blocked
+High-risk operations may prompt for approval (configurable via dangerous section in kode.json).`
 }
 
 func (t *shellTool) Schema() any {
@@ -57,6 +77,10 @@ func (t *shellTool) Schema() any {
 				"type":        "string",
 				"description": "The shell command to execute. Supports pipes, redirects, and multi-line scripts.",
 			},
+			"description": map[string]any{
+				"type":        "string",
+				"description": "Optional: explain what this command does and why. Shown in the approval prompt for high-risk operations.",
+			},
 		},
 		"required": []string{"command"},
 	}
@@ -67,7 +91,8 @@ func (t *shellTool) Schema() any {
 // Both stdout and stderr are captured and merged into the return string.
 func (t *shellTool) Call(args string) (string, error) {
 	var input struct {
-		Command string `json:"command"`
+		Command     string `json:"command"`
+		Description string `json:"description,omitempty"`
 	}
 	if err := json.Unmarshal([]byte(args), &input); err != nil {
 		return "", fmt.Errorf("shell: parse args: %w", err)
@@ -76,6 +101,11 @@ func (t *shellTool) Call(args string) (string, error) {
 		return "", fmt.Errorf("shell: empty command")
 	}
 
+	// Check approval before executing
+	if err := t.checkApproval(input.Command, input.Description); err != nil {
+		return "", err
+	}
+
 	cmd := t.buildCmd(input.Command)
 
 	var outBuf, errBuf bytes.Buffer
@@ -99,6 +129,88 @@ func (t *shellTool) Call(args string) (string, error) {
 	return output, nil
 }
 
+// checkApproval classifies the command and prompts the user if needed.
+func (t *shellTool) checkApproval(cmd, description string) error {
+	// Check allowlist/denylist + risk class via dangerous config
+	action := t.dangerousConfig.ActionForCommand(cmd)
+
+	switch action {
+	case danger.Allow:
+		return nil
+	case danger.Deny:
+		return fmt.Errorf("operation denied by configuration: %s", cmd)
+	case danger.Prompt:
+		return t.promptUser(cmd, description)
+	default:
+		return nil
+	}
+}
+
+// promptUser opens /dev/tty and asks the user to approve the command.
+func (t *shellTool) promptUser(cmd, description string) error {
+	cls := danger.Classify(cmd)
+
+	// Check session trust cache
+	if t.trustedClasses != nil && t.trustedClasses[cls] {
+		return nil
+	}
+
+	// Open /dev/tty for interactive approval
+	ttyPath := t.ttyPath
+	if ttyPath == "" {
+		ttyPath = "/dev/tty"
+	}
+	tty, err := os.OpenFile(ttyPath, os.O_RDWR, 0)
+	if err != nil {
+		// Non-interactive: use configured fallback
+		action := t.dangerousConfig.NonInteractiveAction()
+		if action == danger.Deny {
+			return fmt.Errorf("operation denied (non-interactive mode): %s", cmd)
+		}
+		return nil
+	}
+	defer tty.Close()
+
+	// Build the prompt
+	fmt.Fprintf(os.Stderr, "\n⚠️  \033[1mRisk:\033[0m %s\n", cls)
+	fmt.Fprintf(os.Stderr, "   \033[1mRun:\033[0m  %s\n", cmd)
+	if description != "" {
+		fmt.Fprintf(os.Stderr, "   \033[1mWhy:\033[0m  %s\n", description)
+	}
+	fmt.Fprint(os.Stderr, "\n   [A]pprove  [D]eny  [?] Context  [T]rust session: ")
+
+	// Read a single line of input from the TTY
+	reader := bufio.NewReader(tty)
+	line, err := reader.ReadString('\n')
+	if err != nil {
+		return fmt.Errorf("approval prompt error: %w", err)
+	}
+	line = strings.TrimSpace(strings.ToLower(line))
+
+	switch line {
+	case "a", "approve":
+		return nil
+	case "t", "trust":
+		// Cache this risk class for the session
+		if t.trustedClasses == nil {
+			t.trustedClasses = make(map[danger.RiskClass]bool)
+		}
+		t.trustedClasses[cls] = true
+		return nil
+	case "?", "context":
+		fmt.Fprintf(tty, "\n  Command: %s\n", cmd)
+		fmt.Fprintf(tty, "  Risk class: %s\n", cls)
+		if description != "" {
+			fmt.Fprintf(tty, "  Description: %s\n", description)
+		}
+		fmt.Fprintf(tty, "  Trust this class: %v\n", t.trustedClasses[cls])
+		// Re-prompt
+		return t.promptUser(cmd, description)
+	default:
+		return fmt.Errorf("operation denied by user: %s", cmd)
+	}
+}
+
 // buildCmd constructs the exec.Cmd for the given shell command.
 //
 // When sandbox mode is active (containerName is non-empty), the command