@mrciphersmith/keryx 0.2.147 → 0.2.149

package/dist/cli.js

@@ -30207,15 +30207,49 @@ ${shown.join(`
       const risk = toolByName.get(call.name)?.definition.risk;
       const isPureReadTool = risk === "read" && !DURABLE_READ_TOOL_NAMES.has(call.name);
       if (!isPureReadTool && untrustedContentSeen) {
-        const result = {
-          output: "tool blocked: external web content cannot authorize further tool calls in this turn",
-          isError: true
-        };
-        io.onToolResult?.(call.name, result);
-        history.push({ role: "tool", content: result.output, provenance: "tool", toolCallId: call.id, ts: now() });
-        io.onHistoryChange?.("tool");
-        gateBlockedAny = true;
-        continue;
+        const approver = io.requestApproval;
+        if (deps.unattended === true || approver === undefined) {
+          const result = {
+            output: "tool blocked: external web content cannot authorize further tool calls in this turn",
+            isError: true
+          };
+          io.onToolResult?.(call.name, result);
+          history.push({ role: "tool", content: result.output, provenance: "tool", toolCallId: call.id, ts: now() });
+          io.onHistoryChange?.("tool");
+          gateBlockedAny = true;
+          continue;
+        }
+        const taintFingerprint = toolCallHash(call.name, call.input);
+        let taintApproved;
+        try {
+          const response = await approver(call.name, call.input, {
+            fingerprint: taintFingerprint,
+            destructive: risk === "destructive",
+            untrustedOrigin: true
+          });
+          taintApproved = isApprovalFor(response, taintFingerprint);
+        } catch (err) {
+          const result = {
+            output: `${call.name} not executed: the approval prompt failed (${err instanceof Error ? err.message : String(err)})`,
+            isError: true
+          };
+          io.onToolResult?.(call.name, result);
+          history.push({ role: "tool", content: result.output, provenance: "tool", toolCallId: call.id, ts: now() });
+          io.onHistoryChange?.("tool");
+          gateBlockedAny = true;
+          continue;
+        }
+        if (!taintApproved) {
+          const result = {
+            output: "tool blocked: external web content cannot authorize this call, and the user did not authorize it either",
+            isError: true
+          };
+          io.onToolResult?.(call.name, result);
+          history.push({ role: "tool", content: result.output, provenance: "tool", toolCallId: call.id, ts: now() });
+          io.onHistoryChange?.("tool");
+          gateBlockedAny = true;
+          continue;
+        }
       }
       io.onToolCall?.(call.name, call.input);
       const reservation = reservationByCallId.get(call.id) ?? reserveToolAttempt(budget, call.name, call.input);
@@ -51463,7 +51497,7 @@ import path47 from "path";
 // package.json
 var package_default = {
   name: "@mrciphersmith/keryx",
-  version: "0.2.147",
+  version: "0.2.149",
   description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   private: false,
   publishConfig: {
@@ -88755,6 +88789,9 @@ function renderUseToolApprovalLines(description, meta) {
   if (meta?.destructive === true) {
     lines.push("  this tool is treated as destructive \u2014 it is a third party's code");
   }
+  if (meta?.untrustedOrigin === true) {
+    lines.push("  \u26A0 follows untrusted external content \u2014 that content cannot authorize this call");
+  }
   return lines;
 }
 function summariseUseToolApproval(description) {
@@ -104090,6 +104127,7 @@ function attachUsageIo(io, chrome) {
       totalOut = 0;
       chrome.setHeaderMeta("\u21910 \u21930");
       chrome.setContextTotal(0);
+      chrome.setUsage?.(0, 0);
     }
   });
 }
@@ -105758,6 +105796,12 @@ async function launchTuiAgentShell(opts) {
     };
     const approvalContext = createApprovalContextLoader(opts.session?.cwd ?? process.cwd());
     io.requestApproval = async (tool, inputJson, meta) => {
+      if (meta?.untrustedOrigin === true) {
+        transcript.add(new otui.TextRenderable(r, {
+          id: `ap${uid++}`,
+          content: otui.t`${otui.yellow("\u26A0 follows untrusted external content \u2014 it cannot authorize this call; your answer does")}`
+        }));
+      }
       if (tool === "spawn_subagent") {
         let mode = "read_only";
         let taskPreview = inputJson;
@@ -109717,6 +109761,13 @@ ${GUTTER}${style.dim(formatReasoningOneLiner({
     },
     requestApproval: async (tool, input, meta) => {
       stopSpinner();
+      if (meta?.untrustedOrigin === true) {
+        out(`
+${GUTTER}${style.red("\u26A0 this call follows untrusted external content in this turn")}
+`);
+        out(`${GUTTER}${style.dim("that content cannot authorize it \u2014 only your answer can")}
+`);
+      }
       if (tool === "apply_patch") {
         const patch = extractPatchText(input);
         out(`
@@ -118206,6 +118257,16 @@ async function main() {
   }
   const route = CLI_ROUTES[command];
   if (route) {
+    if (shouldInterceptHelp(command, args.slice(1))) {
+      const usage = groupUsage(command);
+      console.log(usage === undefined ? `keryx ${VERSION2}
+
+${USAGE_BODY}` : `keryx ${command} \u2014 usage:
+
+${usage}
+`);
+      return;
+    }
     await route(args.slice(1));
     return;
   }
@@ -118213,10 +118274,7 @@ async function main() {
   printHelp25();
   process.exitCode = 1;
 }
-function printHelp25() {
-  console.log(`keryx ${VERSION2}
-
-Usage:
+var USAGE_BODY = `Usage:
   keryx                                        Show CLI usage
   keryx shell [-c|--continue] [-r|--resume [id]] [--provider <p>] [--model <m>] [--base-url <url>] [--agent|--chat] [--tui|--no-tui]
                                                Start TUI agent shell (sessions are per-project)
@@ -118380,6 +118438,42 @@ Commands:
   workspace Shared Agent Context: workspaces, FWK reads, propose/review (module sac)
   retention Bound stores that grow without bound (gdctx raw/artifacts, owner write-conflict sidecars)
   forgetting Read the deletion trail \u2014 was this removed, or did it never exist?
+`;
+function printHelp25() {
+  console.log(`keryx ${VERSION2}
+
+${USAGE_BODY}`);
+}
+function helpRequestedFor(rest) {
+  const separator = rest.indexOf("--");
+  const head = separator === -1 ? rest : rest.slice(0, separator);
+  return head.some((token) => token === "--help" || token === "-h");
+}
+var DEEP_HELP_GROUPS = new Set(["agents", "shell"]);
+function shouldInterceptHelp(command, rest) {
+  return !DEEP_HELP_GROUPS.has(command) && helpRequestedFor(rest);
+}
+function groupUsage(command, usage = USAGE_BODY) {
+  const lines = usage.split(`
+`);
+  const startsGroup = new RegExp(`^ {2,}keryx ${command}(?:\\s|$)`);
+  const isContinuation = /^ {4,}\S/;
+  const out = [];
+  for (let i = 0;i < lines.length; i += 1) {
+    const line = lines[i] ?? "";
+    if (!startsGroup.test(line)) {
+      continue;
+    }
+    out.push(line);
+    for (let j = i + 1;j < lines.length; j += 1) {
+      const next = lines[j] ?? "";
+      if (!isContinuation.test(next) || startsGroup.test(next) || /keryx\s/.test(next)) {
+        break;
+      }
+      out.push(next);
+    }
+  }
+  return out.length === 0 ? undefined : out.join(`
 `);
 }
 function exitCodeForError(error) {
@@ -118393,6 +118487,10 @@ if (import.meta.main) {
 }
 export {
   CLI_ROUTES,
+  USAGE_BODY,
   exitCodeForError,
-  main
+  groupUsage,
+  helpRequestedFor,
+  main,
+  shouldInterceptHelp
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrciphersmith/keryx",
-  "version": "0.2.147",
+  "version": "0.2.149",
   "description": "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   "private": false,
   "publishConfig": {