Hermetic by default.

Agents execute inside rootless containers with dropped capabilities, a read-only root filesystem, and blocked network egress. Your working tree is never touched mid-run. Fail-closed posture when you can't be there to answer.

Security docs

sandboxing · three backends

the pipeline never mutates your working tree mid-run

backend

Podman (default)

Rootless, no daemon. Recommended — the least-privilege default path.

backend

Docker

Same hardening when Podman isn't available. Identical image, identical policy.

backend

Git worktree

No container runtime at all — an isolated git worktree plus local process. Prints a host-privilege warning so you know what you opted into.

sandbox hardening — niki.toml

[sandbox]
backend   = "podman"          # or "docker", "worktree"
image     = "niki-sandbox:24.04"
cap_drop  = "ALL"             # drop every Linux capability
rootfs    = "read-only"       # read-only root filesystem

[general]
network_disabled = true       # egress blocked unless allowlisted

Layered controls

CapDrop ALL — every Linux capability dropped
Read-only root filesystem; workspace is the only writable bind mount
Command deny-lists — rm -rf /, curl | sh blocked by policy
Hermeticity violations abort the run (HermeticityViolation)
Secrets redacted from logs and reports — including ?key= query params

permissions · fail-closed

the ask tool never invents answers; approvals deny by default

manual

Ask before anything consequential. The interactive default posture.

auto

Run the pipeline with in-policy actions allowed, per your config.

dontask

Headless: no prompts, deny on ambiguity, record everything.

bypass

Explicit, loud, for trusted sandboxes you control. Never silent.

--permission-mode flag and [permissions] mode config
disable_worktree kill-switch for the no-container backend
fail_closed_headless — unanswerable approvals fail the run, not silently pass
Lifecycle hooks ([hooks.commands]) can block runs fail-closed at each stage boundary

A spend cap that actually stops.

Niki meters every agent call — tokens split into cached-input, reasoning and output — and enforces spend_cap_usd hard: the run aborts before a branch is created if the estimate exceeds your ceiling. Unpriced models warn loudly instead of silently costing $0.00.

What a task costs

cost report

$ niki report 6d281d6d…tokens		in 2,912 · cached 1,204 · out 251cost		est. $0.0112 (claude-sonnet-4 meter rates)cap			$5.00 · not exceededtrace		trace.jsonl · OTLP export available

auditability · on disk

inspect, diff, replay and hand to an auditor

report.md

Human-readable run report — verdict, scores, revisions, costs.

changes.patch

The unified diff — reviewable with anything that reads patches.

artifacts/*.json

Per-agent JSON artifacts, schema-validated — what each agent decided and why.

safety_proof.json

Sandbox and policy proofs for the run.

trace.jsonl

Per-span event trace — an honestly derived timeline of the pipeline.

niki audit

Consolidated JSON compliance bundle for one task: record, proofs, costs, trace.

No telemetry. Ever.

The only outbound traffic Niki makes is your LLM provider API calls — or none at all with a local Ollama. No analytics, no phone-home, no hosted service. Keys are redacted from logs and reports by design.

Full security docs Enterprise readiness