Assistant

It shows you the command before it runs it.

An assistant that can drive kosa8 for you — and tells you exactly what it is about to touch, how bad it would be, and why. Some actions it will never take unprompted, no matter how you configure it.

Download for Mac Read the guide

Approval-firstNo silent destructionSession grants expire

approvals


rm sealed
  touches   the kosa8 daemon on this host
  touches   target sealed
  risk      destructive
  why       "rm" removes state permanently; there is no
            snapshot to rewind to afterwards
kosa8 will ask again every time, even if you approve now
 

kosa8: "sandbox_rm" is destructive, and destructive actions
  are always confirmed

The gate

Four risk classes, and only two of them can be waved through.

01 Before

Ask what an action would actually do.

Every action kosa8 can take has a class and a reason. You can interrogate any of them without running anything, which is also how the assistant decides whether to ask.

Risk classes →

check


run alpine sh -c 'apk add curl'
  touches   the kosa8 daemon on this host
  touches   target alpine
  risk      contained
  why       changes state inside an existing sandbox —
            recoverable with a checkpoint, but not automatic
approve once, or allow this kind for the rest of the session
to stop being asked: `kosa8 approve allow run`

02 During

Grant the boring ones. Keep being asked about the rest.

Read-only and contained actions can be waved through once you trust them. The grant is listed, reversible, and never covers anything destructive.

grants


nothing is auto-approved — kosa8 asks before every mutating action
 

run now runs without asking
  undo with `kosa8 approve revoke run`
 

RULE           ACTION   EFFECT
auto-approve   run      runs without asking
session grants are not listed here: they live in the
assistant process and are gone when the session closes

03 Never

The ones it will not do, however you ask.

Removing a sandbox destroys state that no checkpoint can bring back. kosa8 refuses to pre-approve that class at all — the request to stop being asked is itself denied.

0 flagscan turn this off

refusal


kosa8: "sandbox_rm" is destructive, and destructive actions
  are always confirmed: "sandbox_rm" removes state
  permanently; there is no snapshot to rewind to afterwards
  approve it each time it comes up, or run it yourself

The rule that has no switch

Destructive actions are always confirmed.