AGPL-3.0-or-later · forever.

operations · authority

Keep the application seam narrow.

Combine argv-safe process spawning, default-deny permits, explicit secrets, cost ceilings and caller-owned cancellation.

The SDK does not replace the engine boundary. It preserves it: no shell around workflow paths, no secret values in reports, no run past a caller ceiling and no ambient remote endpoint.

Keep paths out of a shell.

LocalNika calls spawn with an argv array. A workflow path remains one argument even when it contains spaces or attacker-adjacent text.

unsafe: shell("nika run " + path)
safe:   spawn("nika", ["run", path, "--json"])
                         └── one argv value

Read permits before execution.

The check report and plan carry declared and needed authority. Application policy can refuse a net host, filesystem root, program or tool before run starts.

  • an absent permits block grants zero additional authority
  • requirements expose secret names and model needs, never secret values
  • nativeStrict can promote portability and native-first hints

Pass a run ceiling after checking the shape.

Reject an unbounded static shape when policy requires one, then pass maxCostUsd so the engine owns the final start refusal.

const report = await nika.check(file)
if (!report.clean || report.cost?.has_unbounded) {
  throw new Error('workflow is not admitted')
}

await nika.runToEnd(file, { maxCostUsd: 0.25 })

Keep tokens out of source and logs.

The preview remote client accepts a bearer token. Load it from governed environment or identity plumbing, and use the logger interface without recording authorization headers.