v0.11.0: Unified Approver — same security approvals everywhere

CLI (kode run/repl) and Web UI (kode serve) now share the exact same
interactive approval experience for dangerous operations.

- Approver interface (internal/danger/approver.go) with:
  - TTYApprover — /dev/tty prompt (CLI mode, backward compatible)
  - WSApprover  — WebSocket-based prompt with browser modal (serve mode)
- DangerousConfig.Approver field — tools auto-use it in CheckOperation
- shellTool.promptUser delegates to Approver (removed /dev/tty hardcode)
- removed dead promptForOperation() in classifier.go
- Web UI: approval_request/approval_response WebSocket protocol
- Frontend: modal dialog with Approve / Deny / Trust Session buttons
- Per-risk-class color coding (system_write=amber, destructive=red, etc.)
- 60s timeout prevents agent deadlock on unresponsive UI

13 packages, 859 tests, race detector clean.

Author: jkyberneees

README.md

@@ -39,7 +39,7 @@ kode is not a framework. It's a **runtime** — the smallest possible surface ar
 Parallel OS-process sub-agents via `delegate_tasks`. True isolation — each sub-agent is a fresh `kode subagent` process with its own config, tools, and termination timeout. Up to 8 concurrent workers. [docs/SUBAGENTS.md](docs/SUBAGENTS.md)
 
 ### 🧠 Skill System (on by default)
-Trigger-matched `SKILL.md` files load on-demand. Auto-learns from patterns every session — detects multi-step procedures, error recoveries, repeated actions, and user corrections. **LLM-enhanced**: detected patterns are enriched with better names, descriptions, and structured content. Use `--no-learn` to disable. Import skills from any URI with automatic LLM risk assessment. [docs/CLI.md#skills](docs/CLI.md#skills)
+|Trigger-matched `SKILL.md` files load on-demand. Auto-learns from patterns every session — detects multi-step procedures, error recoveries, repeated actions, and user corrections. **LLM-enhanced**: each detected pattern is enriched with an LLM-generated name, description, trigger keywords, and structured body with overview, steps, pitfalls, and verification sections. Use `--no-learn` to disable. Import skills from any URI with automatic LLM risk assessment. [docs/CLI.md#skills](docs/CLI.md#skills)
 
 ### 💾 Persistent Memory
 Three tiers: **facts** (agent-managed durable entries), **session buffer** (auto-appended turn summaries), **episodes** (LLM-extracted knowledge from past sessions). Merge-on-write via go-vector RandomProjections — cosine >0.7 auto-merges, <0.3 auto-adds. Saves ~80% LLM calls. [docs/MEMORY.md](docs/MEMORY.md)

cmd/kode/main.go

@@ -344,7 +344,6 @@ func printUsage() {
 
 Commands:
   run                 Execute a task with the agent loop
-  run --learn         Execute with skill learning (detects patterns, suggests skills)
   run --session       Execute and save conversation as a session
   continue            Continue the most recent session (or by --id)
   repl                Interactive REPL mode (multi-turn session)
@@ -378,7 +377,8 @@ Run flags:
   --no-color           Disable colored terminal output
   --no-agents          Skip loading AGENTS.md from working directory
   --session            Save conversation as a multi-turn session
-  --learn              Enable skill learning mode (detects patterns, saves skills)
+  --learn              Enable skill learning mode — on by default, no flag needed
+  --no-learn           Disable skill learning mode (overrides config/default)
   --system <prompt>    System prompt override
 
 Skill commands:
@@ -458,7 +458,9 @@ const defaultConfigTemplate = `{
   "skills": {
     "max_auto_load": 3,
     "max_lazy_slots": 5,
-    "learn": false,
+    "learn": true,
+    "llm_learn": true,
+    "llm_curate": true,
     "dirs": [],
     "import": {
       "max_size_bytes": 1048576,
@@ -705,7 +707,7 @@ func run(args []string) error {
 
 	// Sandbox setup
 	var sandboxCleanup func() error
-	tools := builtinTools(resolved.Dangerous, sm)
+	tools := builtinTools(resolved.Dangerous, sm, nil)
 
 	if resolved.Sandbox {
 		cleanup, err := setupSandbox(tools, sbCfg)
@@ -969,10 +971,11 @@ func buildSandboxArgs(cfg sandboxConfig, containerName, workdir, image string) [
 	return args
 }
 
-func builtinTools(dc danger.DangerousConfig, sm *skills.SkillManager) []kode.Tool {
+func builtinTools(dc danger.DangerousConfig, sm *skills.SkillManager, approver danger.Approver) []kode.Tool {
 	tools := []kode.Tool{
 		&shellTool{
 			dangerousConfig: dc,
+			approver:        approver,
 		},
 		&delegateTasksTool{
 			maxConcurrency: 3,
@@ -1327,7 +1330,7 @@ func continueCmd(args []string) error {
 			"./.kode/skills",
 		)
 	}
-	tools := builtinTools(resolved.Dangerous, sm)
+	tools := builtinTools(resolved.Dangerous, sm, nil)
 	var sandboxCleanup func() error
 
 	systemMessage := resolved.System

cmd/kode/main_test.go

@@ -196,7 +196,7 @@ func TestRun_NoAPIKey(t *testing.T) {
 }
 
 func TestBuiltinTools(t *testing.T) {
-	tools := builtinTools(danger.DangerousConfig{}, nil)
+	tools := builtinTools(danger.DangerousConfig{}, nil, nil)
 	if len(tools) == 0 {
 		t.Fatal("builtinTools() returned empty slice")
 	}

cmd/kode/repl.go

@@ -75,7 +75,7 @@ func replCmd(args []string) error {
 			"./.kode/skills",
 		)
 	}
-	tools := builtinTools(resolved.Dangerous, sm)
+	tools := builtinTools(resolved.Dangerous, sm, nil)
 	var sandboxCleanup func() error
 
 	if resolved.Sandbox {

cmd/kode/serve.go

@@ -98,7 +98,7 @@ Flags:
 
 // ── Agent Builder ──────────────────────────────────────────────────────
 
-func newServeAgent(resolved config.ResolvedConfig, system string) (*kode.Agent, func() error, error) {
+func newServeAgent(resolved config.ResolvedConfig, system string, sendFn func(v any) error) (*kode.Agent, func() error, *wsApprover, error) {
 	var sm *skills.SkillManager
 	if resolved.Skills.Learn {
 		sm = skills.NewSkillManager(
@@ -107,7 +107,11 @@ func newServeAgent(resolved config.ResolvedConfig, system string) (*kode.Agent,
 		)
 	}
 
-	tools := builtinTools(resolved.Dangerous, sm)
+	// Create WebSocket approver for dangerous operations approval
+	approver := newWSApprover(sendFn)
+	resolved.Dangerous.Approver = approver
+
+	tools := builtinTools(resolved.Dangerous, sm, approver)
 	var sandboxCleanup func() error
 
 	if resolved.Sandbox {
@@ -123,7 +127,7 @@ func newServeAgent(resolved config.ResolvedConfig, system string) (*kode.Agent,
 		}
 		cleanup, err := setupSandbox(tools, cfg)
 		if err != nil {
-			return nil, nil, fmt.Errorf("sandbox: %w", err)
+			return nil, nil, nil, fmt.Errorf("sandbox: %w", err)
 		}
 		sandboxCleanup = cleanup
 	}
@@ -144,10 +148,10 @@ func newServeAgent(resolved config.ResolvedConfig, system string) (*kode.Agent,
 		MemoryConfig:   resolved.Memory,
 	})
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
 
-	return agent, sandboxCleanup, nil
+	return agent, sandboxCleanup, approver, nil
 }
 
 // ── WebSocket Types ────────────────────────────────────────────────────
@@ -171,7 +175,10 @@ func handleWebSocket(store *session.Store, resources *resource.Registry, resolve
 
 		// Create ONE agent per WebSocket connection — provides buffer
 		// continuity across turns within the same session.
-		agent, sandboxCleanup, err := newServeAgent(resolved, system)
+		agent, sandboxCleanup, approver, err := newServeAgent(resolved, system, func(v any) error {
+			writeWSJSON(conn, v)
+			return nil
+		})
 		if err != nil {
 			writeWSError(conn, fmt.Sprintf("agent: %v", err))
 			return
@@ -196,13 +203,35 @@ func handleWebSocket(store *session.Store, resources *resource.Registry, resolve
 				continue
 			}
 
+			// Peek at the message type without full unmarshal
+			var msgType struct {
+				Type string `json:"type"`
+			}
+			if err := json.Unmarshal(data, &msgType); err != nil {
+				continue
+			}
+
+			// Handle approval responses separately (non-blocking, from the browser)
+			if msgType.Type == "approval_response" {
+				var resp approvalResponse
+				if err := json.Unmarshal(data, &resp); err == nil {
+					approver.HandleResponse(resp.ID, resp.Action)
+				}
+				continue
+			}
+
+			// Only process prompt messages
+			if msgType.Type != "prompt" {
+				continue
+			}
+
 			var msg wsClientMsg
 			if err := json.Unmarshal(data, &msg); err != nil {
 				writeWSError(conn, "invalid JSON")
 				continue
 			}
 
-			if msg.Type != "prompt" || msg.Content == "" {
+			if msg.Content == "" {
 				continue
 			}
 

cmd/kode/shell.go

@@ -1,11 +1,9 @@
 package main
 
 import (
-	"bufio"
 	"bytes"
 	"encoding/json"
 	"fmt"
-	"os"
 	"os/exec"
 	"strings"
 
@@ -38,7 +36,9 @@ import (
 //   - Error output is merged into stdout (stderr follows stdout in output).
 //   - Empty output returns "(no output)" so the LLM always gets a response.
 //   - Commands are classified by risk (see internal/danger). High-risk
-//     commands in non-sandboxed mode prompt the user for approval via /dev/tty.
+//     commands in non-sandboxed mode prompt the user for approval.
+//     The approval mechanism uses the configured Approver — TTY in CLI mode,
+//     WebSocket in serve mode — ensuring the same experience everywhere.
 type shellTool struct {
 	// containerName, when set, routes commands through "docker exec"
 	// into this container. Set by setupSandbox() when --sandbox is active.
@@ -48,12 +48,16 @@ type shellTool struct {
 	// dangerousConfig controls per-class actions and allow/denylists.
 	dangerousConfig danger.DangerousConfig
 
+	// approver handles interactive approval prompts. When nil, falls back
+	// to TTYApprover (CLI-compatible default).
+	approver danger.Approver
+
 	// trustedClasses caches user-approved risk classes for this process.
 	// Set when user presses T (trust this session) at the prompt.
 	trustedClasses map[danger.RiskClass]bool
 
 	// ttyPath is the path to the terminal device for approval prompts.
-	// Overridden in tests to mock user input.
+	// Overridden in tests to mock user input. Only used when approver is nil.
 	ttyPath string
 }
 
@@ -146,69 +150,32 @@ func (t *shellTool) checkApproval(cmd, description string) error {
 	}
 }
 
-// promptUser opens /dev/tty and asks the user to approve the command.
+// promptUser classifies the command and asks the user to approve it.
+// Delegates to the configured Approver, or falls back to TTYApprover.
 func (t *shellTool) promptUser(cmd, description string) error {
 	cls := danger.Classify(cmd)
 
-	// Check session trust cache
-	if t.trustedClasses != nil && t.trustedClasses[cls] {
-		return nil
-	}
-
-	// Open /dev/tty for interactive approval
-	ttyPath := t.ttyPath
-	if ttyPath == "" {
-		ttyPath = "/dev/tty"
-	}
-	tty, err := os.OpenFile(ttyPath, os.O_RDWR, 0)
-	if err != nil {
-		// Non-interactive: use configured fallback
-		action := t.dangerousConfig.NonInteractiveAction()
-		if action == danger.Deny {
-			return fmt.Errorf("operation denied (non-interactive mode): %s", cmd)
+	// Get or create the approver
+	approver := t.approver
+	if approver == nil {
+		ttyApprover := danger.NewTTYApprover(&t.dangerousConfig)
+		if t.trustedClasses != nil {
+			ttyApprover.TrustedClasses = t.trustedClasses
 		}
-		return nil
-	}
-	defer tty.Close()
-
-	// Build the prompt
-	fmt.Fprintf(os.Stderr, "\n⚠️  \033[1mRisk:\033[0m %s\n", cls)
-	fmt.Fprintf(os.Stderr, "   \033[1mRun:\033[0m  %s\n", cmd)
-	if description != "" {
-		fmt.Fprintf(os.Stderr, "   \033[1mWhy:\033[0m  %s\n", description)
-	}
-	fmt.Fprint(os.Stderr, "\n   [A]pprove  [D]eny  [?] Context  [T]rust session: ")
-
-	// Read a single line of input from the TTY
-	reader := bufio.NewReader(tty)
-	line, err := reader.ReadString('\n')
-	if err != nil {
-		return fmt.Errorf("approval prompt error: %w", err)
+		if t.ttyPath != "" {
+			ttyApprover.TTYPath = t.ttyPath
+		}
+		approver = ttyApprover
 	}
-	line = strings.TrimSpace(strings.ToLower(line))
 
-	switch line {
-	case "a", "approve":
-		return nil
-	case "t", "trust":
-		// Cache this risk class for the session
-		if t.trustedClasses == nil {
-			t.trustedClasses = make(map[danger.RiskClass]bool)
+	err := approver.PromptCommand(cls, cmd, description)
+	if err == nil {
+		// Sync trusted classes back if using TTYApprover
+		if tty, ok := approver.(*danger.TTYApprover); ok {
+			t.trustedClasses = tty.TrustedClasses
 		}
-		t.trustedClasses[cls] = true
-		return nil
-	case "?", "context":
-		fmt.Fprintf(tty, "\n  Command: %s\n", cmd)
-		fmt.Fprintf(tty, "  Risk class: %s\n", cls)
-		if description != "" {
-			fmt.Fprintf(tty, "  Description: %s\n", description)
-		}
-		fmt.Fprintf(tty, "  Trust this class: %v\n", t.trustedClasses[cls])
-		// Re-prompt
-		return t.promptUser(cmd, description)
-	default:
-		return fmt.Errorf("operation denied by user: %s", cmd)
 	}
+	return err
 }
 
 // buildCmd constructs the exec.Cmd for the given shell command.

cmd/kode/subagent.go

@@ -285,7 +285,7 @@ func subagentCmd(args []string) error {
 			"./.kode/skills",
 		)
 	}
-	tools := builtinTools(resolved.Dangerous, sm)
+	tools := builtinTools(resolved.Dangerous, sm, nil)
 	var sandboxCleanup func() error
 
 	if resolved.Sandbox {

cmd/kode/subagent_contract_test.go

@@ -304,7 +304,7 @@ func TestSubagent_ExitCodeThree(t *testing.T) {
 // ── 4. delegate_tasks Tool Schema ───────────────────────────────────
 
 func TestDelegateTasksTool_Exists(t *testing.T) {
-	tools := builtinTools(danger.DangerousConfig{}, nil)
+	tools := builtinTools(danger.DangerousConfig{}, nil, nil)
 
 	found := false
 	for _, tool := range tools {
@@ -319,7 +319,7 @@ func TestDelegateTasksTool_Exists(t *testing.T) {
 }
 
 func TestDelegateTasksTool_HasSchema(t *testing.T) {
-	tools := builtinTools(danger.DangerousConfig{}, nil)
+	tools := builtinTools(danger.DangerousConfig{}, nil, nil)
 
 	var tool kode.Tool
 	for _, t2 := range tools {
@@ -408,7 +408,7 @@ func TestDelegateTasksTool_HasSchema(t *testing.T) {
 }
 
 func TestDelegateTasksTool_Description(t *testing.T) {
-	tools := builtinTools(danger.DangerousConfig{}, nil)
+	tools := builtinTools(danger.DangerousConfig{}, nil, nil)
 
 	var tool kode.Tool
 	for _, t2 := range tools {