Safety

What ships in v0.9.1

Talos is a local coding agent for developers who review the actions it takes. The safety model is built on three explicit boundaries:

• Read-only workspace tools can run without approval.
• File writes, deletes, Git writes, and shell execution are routed through permissions. The permission pipeline is the only path these tools take to act on the workspace.
• Tool display focuses on key arguments instead of raw JSON where the tool definition provides summary fields. This makes approvals reviewable at a glance.

Local secrets should live in environment variables or private config files, never in source. Talos does not auto-commit changes — Git commits happen only through explicit tool or user action.

Secret masking boundary

Provider API keys can be stored inline in ~/.talos/config.toml as api_key, or referenced from the environment via api_key_env. Either way, every non-file-persistence output surface masks the key so it never appears in command output, logs, debug prints, exported transcripts, or repository files.

The masking surface is:

• talos --config-list — mask_secrets() replaces api_key with ***.
• talos --config-get providers.X.api_key — is_secret_key() prints *** before the value leaves the process.
• talos --config-set providers.X.api_key=... — echoes *** on the confirmation line.
• Custom Debug impls on ProviderConfig, Credentials, and CredentialResponseData render *** instead of the raw key.
• Provider HTTP debug snapshots use redact_secret() (first4 + **** + last4) so the key is recognizable in debug logs without being exposed.

${ENV_VAR} substitution remains supported for users who prefer env-var credentials without hardcoding.

Permission posture

Talos does not give a model unrestricted access to the local machine. The permission pipeline is the only path that reaches the workspace. A few rules of thumb:

• Read-only tools (read, ls, tree, glob, grep, diff, stat, the four *_symbol* / find_references tools, the read-only Git tools, http_request with read-only intent, and so on) do not require approval to run.
• Write-capable tools (write, edit, delete, write-side Git tools, bash, write-side MCP tools) require explicit approval through the permission pipeline.
• http_request is SSRF-protected and permission-gated; outbound network calls are not automatic.
• MCP tools that arrive without a read-only annotation go through the same approval path. If interactive approval is not available (e.g. talos -p in a CI shell), MCP tools are denied by default.
• Talos never auto-commits. Git writes only happen through an explicit tool invocation the operator approved.

Sandbox posture

Talos is a local process, not a remote service. In v0.9.1 the only startup web surface is the read-only, token-gated loopback dashboard; approvals, writes, logs, and session control do not move to a remote web plane. The runtime is designed to keep the default core local and auditable. Hardening details (the four production unsafe sites in talos-sandbox/hardening.rs, the libc FFI discipline, and the rusqlite/bundled exception for local storage) are tracked as Architecture Decision Records; see ADR-007, ADR-008, and the full ADR index.

Talos is also not a remote multi-user service, marketplace runtime, browser automation product, web approval surface, or autonomous background daemon in v0.9.1. See the Roadmap for the shipped / planned / research split.

Limits of the pre-1.0 line

• The talos-runtime embeddable facade is pre-1.0; the SDK surface can change before v1.0.0.
• Shared ~/.agents/skills/ discovery is shipped and enabled by default. Symbolic-link traversal remains disabled by default and requires an explicit discovery policy.
• Web control expansion beyond the read-only dashboard (WEB-001) is a separate product differentiation track. Remote access, browser automation, web approvals, and web write/action routes are not shipped and are not safety boundaries.
• Explicit local read-only WASM packages are shipped only when the operator selects a directory with --plugin. They have no host calls or write capability; remote distribution and automatic discovery are not shipped.