Skip to content

Safety

An agent that runs bash needs brakes. hummin ships several layers, all visible and all toggleable - not vibes, actual mechanisms.

Bash sandboxing

Workspace-mode sandboxing with real OS primitives: macOS seatbelt on Apple, bubblewrap on Linux.

  • Writes restricted to the working directory and temp; secrets unreadable; configurable network policy.
  • A real capability probe at startup - not assumed support.
  • Blocked commands surface as in-band [Sandbox] blocks so you can see what happened and why.
  • Child processes inherit the sandbox.

Toggle and inspect with /sandbox.

Bashguard

An advisory matrix over destructive commands: flags rm -rf-class operations, sed -i rewrites, and writes outside the working directory as in-band notices before they run.

  • Opt-in block mode and read-only deny mode when you want teeth, not just warnings.
  • Exempt regexes for commands you trust.

Status and config: /bashguard.

Guardrails

  • Loop detector: catches the same tool called with the same args over and over.
  • Per-tool circuit breaker: stops a misbehaving tool instead of the whole session.
  • Optional cumulative tool budget (disabled by default) for hard cost control.
  • Post-mortems after a guardrail trips, so the failure is legible.

System-1 gate

One decision engine (default a local Clef endpoint, configurable via decision.url) backs four automatic hooks: a bash gate (deterministic classifiers for clear cases, a scored gray zone for everything else), destructive-intent steer per turn, test-failure triage, and memory intake scoring.

  • Blocked commands name the reason and carry an escape hatch: rerun the same command with # sys1-gate: confirmed appended once you've verified the target.
  • Every read fails open - an unreachable engine never blocks a session.
  • Calibrate with decision.* thresholds; inspect what hummin picked up via /doctor.

Hooks

hooks.json runs shell hooks on four lifecycle events. tool_call hooks can block a tool with a reason before it executes. Fail-open by design, with a loaded-hooks table and reload at /hooks.

Checkpoints

  • Every edit/write is snapshotted, content-addressed.
  • /rewind restores files and/or the conversation to an earlier prompt, with conflict detection.
  • 30-day blob retention.

Trust and network

  • Project trust gating for project-local resources, MCP servers, hooks and agent registration, with a defaultProjectTrust fallback. First touch of a new project asks.
  • Web fetch SSRF guard: internal addresses and metadata endpoints are not fetchable.
  • Remote control runs on loopback with a token and CSP - the terminal stays the answerer for approvals.