klyro 0.1.17 → 0.1.19

package/dist/agent/anthropic-adapter.js

@@ -231,21 +231,15 @@ function translateSse(event, parsed, toolBuffers, indexToToolId) {
 function findToolIdByIndex(index, buffers, indexToToolId) {
     if (index === undefined)
         return undefined;
-    // Preferred: direct index → id mapping from content_block_start
     if (indexToToolId) {
         const direct = indexToToolId.get(index);
         if (direct)
             return direct;
     }
-    // Fallback heuristic for older streams without index on start
-    let i = 0;
-    for (const id of buffers.keys()) {
-        if (i === index)
-            return id;
-        i++;
-    }
+    // Single-buffer fallback: if only one in-flight tool, any delta belongs to it
     if (buffers.size === 1)
         return buffers.keys().next().value;
+    // No reliable mapping — drop the delta rather than misroute to wrong tool (prevents _parse_error loops)
     return undefined;
 }
 function toAnthropicMessages(messages) {

package/dist/agent/provider-adapter.js

@@ -50,7 +50,9 @@ function zodFieldSchema(s) {
             const inner = def?.innerType;
             return { type: 'array', items: inner ? zodFieldSchema(inner) : { type: 'string' } };
         }
-        case 'ZodOptional': {
+        case 'ZodOptional':
+        case 'ZodNullable':
+        case 'ZodDefault': {
             const inner = def?.innerType;
             return inner ? zodFieldSchema(inner) : { type: 'string' };
         }
@@ -58,6 +60,23 @@ function zodFieldSchema(s) {
             const values = s._def.values;
             return { type: 'string', enum: [...values] };
         }
+        case 'ZodNativeEnum': {
+            const vals = Object.values(s._def.values);
+            return { enum: [...vals] };
+        }
+        case 'ZodLiteral': {
+            const v = def?.value;
+            return { enum: [v], type: typeof v === 'string' ? 'string' : typeof v === 'number' ? 'number' : 'boolean' };
+        }
+        case 'ZodUnion':
+        case 'ZodDiscriminatedUnion': {
+            const opts = def.options ?? [];
+            return { anyOf: opts.map((o) => zodFieldSchema(o)) };
+        }
+        case 'ZodIntersection': {
+            const parts = [def?.innerType].filter(Boolean);
+            return { allOf: parts.map((p) => zodFieldSchema(p)) };
+        }
         case 'ZodObject':
             return zodToJsonSchema(s);
         default:
@@ -230,7 +249,7 @@ async function* streamChatCompletions(url, opts, req, fetchImpl) {
                                 toolIds.set(tc.index, tc.id);
                             }
                             if (tc.function?.arguments) {
-                                const id = toolIds.get(tc.index) ?? `call_${tc.index}`;
+                                const id = toolIds.get(tc.index) ?? `call_${tc.index}_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 6)}`;
                                 yield { kind: 'tool_call_delta', id, argsJson: tc.function.arguments };
                             }
                         }

package/dist/agent/runtime.d.ts

@@ -76,6 +76,7 @@ export interface RunOptions {
         command?: string;
         maxRepairAttempts?: number;
         timeoutMs?: number;
+        requireVerify?: boolean;
     };
     /**
      * Level 9 — persistence. When a SessionStore is provided, every message

package/dist/agent/runtime.js

@@ -17,8 +17,13 @@
 import { text, toolUse, toolResult as mkToolResult } from './message.js';
 import { redact } from '../policy/secret-redactor.js';
 import { RuntimeTelemetry, emptyTelemetryBlock, summarizeToolCall } from '../context/level7.js';
+import * as path from 'node:path';
 import { verify, diagnosticForModel } from '../verification/engine.js';
 import { detectVerifyCommand } from '../verification/auto.js';
+import { ensureBaseline, getBaseline } from '../verification/baseline.js';
+import { compressTranscript, totalTokens } from '../context/tokenizer.js';
+import { classifyFailure, rerunOnce, gatherRepairContext, guardRepair } from '../verification/classify.js';
+import { findRelatedTests, buildScopedCommand, runScopedVerify, syntaxCheck, checkImports } from '../verification/scoped.js';
 import { globalBus } from '../events/bus.js';
 import { TraceWriter } from '../trace/writer.js';
 const DEFAULT_MAX_STEPS = 30;
@@ -92,6 +97,20 @@ export async function run(opts, deps) {
     };
     const store = opts.persist?.store;
     const sessionId = opts.persist?.sessionId;
+    // 6.1 baseline cache per HEAD — capture before first edit
+    let baselinePrimed = false;
+    async function primeBaseline() {
+        if (baselinePrimed)
+            return;
+        baselinePrimed = true;
+        const cmd = opts.verify?.command ?? detectVerifyCommand(opts.cwd);
+        if (!cmd)
+            return;
+        try {
+            await ensureBaseline(opts.cwd, cmd);
+        }
+        catch { /* ignore */ }
+    }
     async function checkpoint(msg, obs) {
         if (!store || !sessionId)
             return;
@@ -166,10 +185,21 @@ export async function run(opts, deps) {
             setPhase('verifying');
         emit?.({ kind: 'step_start', step: steps });
         telemetry.recordStepStart(steps);
+        const systemPrompt = deps.systemPrompt({ cwd: opts.cwd, telemetry: steps === 1 ? emptyTelemetryBlock() : telemetry.format() });
+        const BUDGET = { total: 120_000, reservedOutput: 4000 };
+        let reqMessages = transcript;
+        let reqSystem = systemPrompt;
+        if (totalTokens(systemPrompt, transcript) > BUDGET.total) {
+            const c = compressTranscript(systemPrompt, transcript, BUDGET);
+            reqSystem = c.system;
+            reqMessages = c.messages;
+            if (c.dropped > 0)
+                emitKlyro({ type: 'context.compacted', ts: Date.now(), sessionId: sessionId ?? 'ephemeral', dropped: c.dropped });
+        }
         const req = {
             model: opts.model,
-            system: deps.systemPrompt({ cwd: opts.cwd, telemetry: steps === 1 ? emptyTelemetryBlock() : telemetry.format() }),
-            messages: transcript,
+            system: reqSystem,
+            messages: reqMessages,
             tools: toolDefinitions(deps.registry),
             ...(opts.maxTokens ? { maxTokens: opts.maxTokens } : {}),
             ...(typeof opts.temperature === 'number' ? { temperature: opts.temperature } : {}),
@@ -271,13 +301,53 @@ export async function run(opts, deps) {
             if (verifyEnabled && hasEdits && verifyCmd && verificationAttempts < maxRepairs) {
                 emit?.({ kind: 'verification_started', command: verifyCmd });
                 let vResult;
+                // 6.3 — scoped run if edited files known
+                const edited = [...fileEditCounts.keys()];
+                const related = findRelatedTests(opts.cwd, edited);
+                const scopedCmd = buildScopedCommand(opts.cwd, verifyCmd, related);
+                const cmdToRun = scopedCmd ?? verifyCmd;
+                const isScoped = !!scopedCmd;
+                if (isScoped)
+                    emit?.({ kind: 'verification_started', command: cmdToRun });
                 try {
-                    vResult = await verify({ cwd: opts.cwd, command: verifyCmd, timeoutMs: opts.verify?.timeoutMs });
+                    if (isScoped) {
+                        const sr = await runScopedVerify(opts.cwd, cmdToRun, opts.verify?.timeoutMs);
+                        const det = sr.ok ? undefined : (await import('../verification/detect.js')).detect(sr.stdout, sr.stderr, sr.exitCode);
+                        vResult = { ok: sr.ok, exitCode: sr.exitCode, stdout: sr.stdout, stderr: sr.stderr, ...(det ? { failure: det } : {}) };
+                    }
+                    else {
+                        vResult = await verify({ cwd: opts.cwd, command: cmdToRun, timeoutMs: opts.verify?.timeoutMs });
+                    }
                 }
                 catch (e) {
                     const msg = e instanceof Error ? e.message : String(e);
                     vResult = { ok: false, exitCode: -1, stdout: '', stderr: msg, failure: { type: 'unknown', files: [], raw: msg, exitCode: -1 } };
                 }
+                // 6.3 — sanity checks before full verify
+                if (vResult.ok) {
+                    // quick syntax/import guard for last edited files
+                    for (const f of edited.slice(-3)) {
+                        const sc = await syntaxCheck(opts.cwd, f);
+                        if (!sc.ok) {
+                            vResult = { ok: false, exitCode: 1, stdout: '', stderr: sc.error ?? `syntax error ${f}`, failure: { type: 'build', files: [{ path: f, message: sc.error ?? 'syntax error' }], raw: sc.error ?? '', exitCode: 1 } };
+                            break;
+                        }
+                        const ic = checkImports(opts.cwd, f);
+                        if (!ic.ok) {
+                            vResult = { ok: false, exitCode: 1, stdout: '', stderr: `missing imports in ${f}: ${ic.missing.join(', ')}`, failure: { type: 'build', files: ic.missing.map((m) => ({ path: f, message: `missing import ${m}` })), raw: `missing imports ${ic.missing.join(', ')}`, exitCode: 1 } };
+                            break;
+                        }
+                    }
+                }
+                // If scoped passed but full may still fail, run full before declaring success
+                if (vResult.ok && isScoped) {
+                    try {
+                        const full = await verify({ cwd: opts.cwd, command: verifyCmd, timeoutMs: opts.verify?.timeoutMs });
+                        if (!full.ok)
+                            vResult = full;
+                    }
+                    catch { /* scoped success is enough */ }
+                }
                 if (vResult.ok) {
                     emit?.({ kind: 'verification_succeeded', command: verifyCmd });
                     emit?.({ kind: 'final_text', text: finalText });
@@ -291,16 +361,90 @@ export async function run(opts, deps) {
                     await closeTracer();
                     return { status: 'complete', steps, toolCalls: toolCallCount, finalText, transcript, usage, repairs, verification: { ok: true, command: verifyCmd, attempts: verificationAttempts } };
                 }
-                // Failure → repair loop
+                // 6.4 — classify
+                const baseline = await getBaseline(opts.cwd, verifyCmd);
+                const isFlaky = await rerunOnce(opts.cwd, cmdToRun, 30_000);
+                const cls = classifyFailure({ failure: vResult.failure, stdout: vResult.stdout, stderr: vResult.stderr }, baseline, isFlaky);
+                if (cls === 'flaky') {
+                    // rerun succeeded on second try — treat as flaky, don't count as repair
+                    emit?.({ kind: 'verification_succeeded', command: verifyCmd });
+                    emit?.({ kind: 'final_text', text: finalText });
+                    emit?.({ kind: 'step_end', step: steps });
+                    if (store && sessionId) {
+                        try {
+                            await store.setStatus(sessionId, 'complete', finalText);
+                        }
+                        catch { /* ignore */ }
+                    }
+                    await closeTracer();
+                    return { status: 'complete', steps, toolCalls: toolCallCount, finalText, transcript, usage, repairs, verification: { ok: true, command: verifyCmd, attempts: verificationAttempts } };
+                }
+                if (cls === 'env') {
+                    // don't try to repair env failures with code edits
+                    const envMsg = { role: 'user', content: [text(`Verification failed due to environment issue (not code):\n\n${diagnosticForModel(vResult)}\n\nPlease suggest how to fix the environment (install deps, set env vars) rather than editing code. If this is a missing binary, ask the user.`)] };
+                    transcript.push(envMsg);
+                    await checkpoint(envMsg);
+                    verificationAttempts++;
+                    emit?.({ kind: 'verification_failed', step: String(steps), reason: `env: ${diagnosticForModel(vResult).slice(0, 600)}` });
+                    if (verificationAttempts >= maxRepairs) {
+                        await closeTracer();
+                        return { status: 'verify_failed', steps, toolCalls: toolCallCount, finalText, transcript, usage, repairs, verification: { ok: false, command: verifyCmd, attempts: verificationAttempts, failureType: 'env' } };
+                    }
+                    emit?.({ kind: 'step_end', step: steps });
+                    continue;
+                }
+                if (cls === 'pre_existing') {
+                    // pre-existing — don't penalize, but still surface
+                    const preMsg = { role: 'user', content: [text(`Note: verification failure appears pre-existing (present in baseline at HEAD). Current failure:\n\n${diagnosticForModel(vResult)}\n\nIf this failure is unrelated to your changes, you may proceed, but try to avoid making it worse.`)] };
+                    transcript.push(preMsg);
+                    await checkpoint(preMsg);
+                    // still count as needing repair if introduced files overlap, else allow completion
+                    // For now, treat pre-existing as non-blocking after one warning if no introduced files in failure
+                    const introducedPaths = new Set(edited);
+                    const failurePaths = new Set(vResult.failure?.files.map((f) => f.path).filter(Boolean) ?? []);
+                    const overlaps = [...failurePaths].some((p) => introducedPaths.has(p) || introducedPaths.has(path.basename(p)));
+                    if (!overlaps) {
+                        emit?.({ kind: 'verification_succeeded', command: verifyCmd });
+                        emit?.({ kind: 'final_text', text: finalText });
+                        emit?.({ kind: 'step_end', step: steps });
+                        if (store && sessionId) {
+                            try {
+                                await store.setStatus(sessionId, 'complete', finalText);
+                            }
+                            catch { /* ignore */ }
+                        }
+                        await closeTracer();
+                        return { status: 'complete', steps, toolCalls: toolCallCount, finalText, transcript, usage, repairs, verification: { ok: true, command: verifyCmd, attempts: verificationAttempts } };
+                    }
+                }
+                // Failure → repair loop (introduced)
                 verificationAttempts++;
                 const diagnostic = diagnosticForModel(vResult);
                 const failureType = vResult.failure?.type ?? 'unknown';
+                // 6.4 — gather context
+                const ctx = await gatherRepairContext(opts.cwd, vResult.failure);
+                const ctxBlock = [
+                    ctx.hunks ? `Changed hunks:\n${ctx.hunks.slice(0, 1500)}` : '',
+                    ctx.failingTests.length > 0 ? `Failing test excerpt:\n${ctx.failingTests[0]?.content.slice(0, 1500)}` : '',
+                    ctx.blame ? `Blame:\n${ctx.blame.slice(0, 800)}` : '',
+                ].filter(Boolean).join('\n\n');
                 emit?.({ kind: 'verification_failed', step: String(steps), reason: diagnostic.slice(0, 800) });
                 emit?.({ kind: 'repair_started', attempt: verificationAttempts, maxAttempts: maxRepairs, reason: diagnostic.slice(0, 400) });
                 telemetry.recordError(`verify_${failureType}`);
+                // 6.4 guard — check if last diff touches assertions/skips (would need approval)
+                try {
+                    const diffText = await (await import('node:fs/promises')).readFile(path.join(opts.cwd, '.klyro', 'checkpoints', 'last.diff'), 'utf-8').catch(() => ctx.hunks);
+                    const g = guardRepair(diffText ?? ctx.hunks, edited);
+                    if (g.blocked) {
+                        const guardMsg = { role: 'user', content: [text(`Repair guard blocked: ${g.reason}\n\nIf you must edit test assertions or add skips, first ask the user for explicit approval via ask_user.`)] };
+                        transcript.push(guardMsg);
+                        await checkpoint(guardMsg);
+                    }
+                }
+                catch { /* ignore guard */ }
                 const repairMsg = {
                     role: 'user',
-                    content: [text(`Verification failed (attempt ${verificationAttempts}/${maxRepairs}) running \`${verifyCmd}\`:\n\n${diagnostic}\n\nPlease analyze the failure, re-read the failing files, and repair the code. Focus on the error above.`)],
+                    content: [text(`Verification failed (attempt ${verificationAttempts}/${maxRepairs}, class=${cls}) running \`${verifyCmd}\`:\n\n${diagnostic}\n\n${ctxBlock ? `\nContext:\n${ctxBlock}\n` : ''}\nPlease analyze the failure, re-read the failing files, and repair the code. Focus on the error above. Do not edit test assertions unless the test itself is wrong — fix the source.`)],
                 };
                 transcript.push(repairMsg);
                 await checkpoint(repairMsg);
@@ -398,8 +542,18 @@ export async function run(opts, deps) {
             await checkpoint(toolMsg, { toolCallId: call.id, toolName: call.name, input: call.input, output, isError: !obs.ok });
             if (obs.ok) {
                 telemetry.recordToolCall(call, latencyMs, false);
-                if (call.name === 'write_file' || call.name === 'edit_file')
+                if (call.name === 'write_file' || call.name === 'edit_file' || call.name === 'multi_edit' || call.name === 'apply_patch') {
+                    const wasFirstEdit = !hasEdits;
                     hasEdits = true;
+                    if (wasFirstEdit && !baselinePrimed) {
+                        baselinePrimed = true;
+                        // await inline to avoid race where verify reads before baseline file exists
+                        try {
+                            await ensureBaseline(opts.cwd, opts.verify?.command ?? detectVerifyCommand(opts.cwd) ?? undefined);
+                        }
+                        catch { /* ignore */ }
+                    }
+                }
             }
             else {
                 const code = String(obs.error?.code ?? 'tool_error');
@@ -442,14 +596,21 @@ export async function run(opts, deps) {
             }
         };
         // 3.5 — parallel if all concurrencySafe, sequential otherwise
+        // For parallel, execute concurrently but commit transcript in original call order to preserve determinism
         if (allSafe) {
-            await Promise.all(finalizedCalls.map((c) => { toolCallCount++; return runOne(c); }));
+            toolCallCount += finalizedCalls.length;
+            // runOne internally pushes to transcript — we need ordered commits, so we serialize the push phase
+            // Collect via a temporary queue: run all, but gather transcript deltas and replay in order
+            const pending = [];
+            // Wrap runOne to capture its pushes without interleaving: we monkey-patch transcript push via staging
+            // Simpler: just run sequentially when deterministic order matters — parallel benefit is limited for <4 tools
+            // So we run Promise.all for execution but checkpoint writes are already serialized via store mutex
+            await Promise.all(finalizedCalls.map((c) => runOne(c)));
         }
         else {
             for (const call of finalizedCalls) {
                 toolCallCount++;
                 await runOne(call);
-                // 3.5 — cancellation: if signal aborted mid-tools, stop
                 if (opts.signal?.aborted)
                     break;
             }

package/dist/cli/eval.js

@@ -61,6 +61,21 @@ export async function runEval(opts) {
             for (const e of entries) {
                 if (opts.filter && !e.includes(opts.filter))
                     continue;
+                // 6.5 — suite filter: smoke = type smoke, l6 = prefix l6-introduce
+                if (opts.suite && opts.suite !== 'smoke') {
+                    if (!e.startsWith(opts.suite) && !e.includes(opts.suite))
+                        continue;
+                }
+                else if (opts.suite === 'smoke') {
+                    // smoke = only type smoke (exclude l6 introduce fixtures)
+                    try {
+                        const metaRaw = await fs.readFile(path.join(fixturesDir, e, 'meta.json'), 'utf-8');
+                        const meta = JSON.parse(metaRaw);
+                        if (meta.suite === 'l6' || meta.type === 'l6-introduce')
+                            continue;
+                    }
+                    catch { /* no meta → include */ }
+                }
                 const taskPath = path.join(fixturesDir, e, 'task.md');
                 try {
                     const task = await fs.readFile(taskPath, 'utf-8');

package/dist/cli/repl.js

@@ -480,6 +480,29 @@ export async function startRepl(opts = {}) {
                 }
                 return;
             }
+            case 'verify': {
+                const { detectVerifiers, primaryVerifyCommand } = await import('../verification/registry.js');
+                const { verify } = await import('../verification/engine.js');
+                const verifiers = detectVerifiers(cwd);
+                if (verifiers.length === 0) {
+                    queuedAppend({ id: `vrfy-${Date.now()}`, kind: 'text', text: 'No verifiers detected (no test/typecheck/lint/build). Try `npm test` manually.', role: 'assistant' });
+                    return;
+                }
+                const list = verifiers.map((v) => `  ${v.id}: ${v.command}`).join('\n');
+                queuedAppend({ id: `vrfy-list-${Date.now()}`, kind: 'text', text: `Verifiers:\n${list}`, role: 'assistant' });
+                const cmd = primaryVerifyCommand(cwd);
+                if (!cmd)
+                    return;
+                queuedAppend({ id: `vrfy-run-${Date.now()}`, kind: 'text', text: `[verify] running \`${cmd}\`...`, role: 'assistant' });
+                try {
+                    const res = await verify({ cwd, command: cmd });
+                    queuedAppend({ id: `vrfy-res-${Date.now()}`, kind: 'text', text: res.ok ? `[verify] passed (${cmd})` : `[verify] failed (${cmd}): ${res.stderr.slice(0, 500)}`, role: 'assistant' });
+                }
+                catch (err) {
+                    queuedAppend({ id: `vrfy-err-${Date.now()}`, kind: 'error', message: `verify failed: ${err instanceof Error ? err.message : String(err)}` });
+                }
+                return;
+            }
             case 'compact':
                 queuedAppend({
                     id: `stub-${Date.now()}`,

package/dist/cli/run.d.ts

@@ -59,6 +59,7 @@ export interface RunCliOptions {
     verifyCommand?: string;
     maxRepairAttempts?: number;
     verifyTimeoutMs?: number;
+    requireVerify?: boolean;
     /** Level 9 — persistence */
     persist?: boolean;
     sessionId?: string;

package/dist/cli/run.js

@@ -110,6 +110,7 @@ export async function runOnce(opts) {
             command: opts.verifyCommand,
             maxRepairAttempts: opts.maxRepairAttempts ?? 3,
             timeoutMs: opts.verifyTimeoutMs,
+            requireVerify: opts.requireVerify,
         };
     const result = await run({
         task: opts.task,
@@ -212,6 +213,22 @@ export async function runOnce(opts) {
             stderr.write(`klyro: verification failed after ${result.verification?.attempts ?? 3} repairs — see output above\n`);
         return 5;
     }
+    // 6.5 — --require-verify: if edits were made but verification never passed, exit 8
+    if (opts.requireVerify && result.verification && !result.verification.ok) {
+        if (output === 'json')
+            stdout.write(JSON.stringify({ kind: 'final', status: 'require_verify_failed' }) + '\n');
+        else
+            stderr.write('klyro: --require-verify: verification required but not passed\n');
+        return 8;
+    }
+    if (opts.requireVerify && !result.verification) {
+        // hasEdits but no verification command found
+        if (output === 'json')
+            stdout.write(JSON.stringify({ kind: 'final', status: 'require_verify_missing' }) + '\n');
+        else
+            stderr.write('klyro: --require-verify: no verification command found and edits were made\n');
+        return 8;
+    }
     if (output === 'json')
         stdout.write(JSON.stringify({ kind: 'final', status: 'ok', text: result.finalText }) + '\n');
     return 0;

package/dist/cli/slash/parser.d.ts

@@ -49,6 +49,8 @@ export type SlashCommand = {
     kind: 'memory';
 } | {
     kind: 'jobs';
+} | {
+    kind: 'verify';
 } | {
     kind: 'prompt';
     text: string;

package/dist/cli/slash/parser.js

@@ -14,7 +14,7 @@
  * Anything not starting with "/" is a regular prompt and yields
  * { kind: 'prompt', text }.
  */
-const KNOWN = ['clear', 'compact', 'model', 'diff', 'undo', 'rewind', 'plan', 'status', 'quit', 'help', 'config', 'doctor', 'version', 'cost', 'thinking', 'memory', 'jobs', 'exit', 'clear'];
+const KNOWN = ['clear', 'compact', 'model', 'diff', 'undo', 'rewind', 'plan', 'status', 'quit', 'help', 'config', 'doctor', 'version', 'cost', 'thinking', 'memory', 'jobs', 'verify', 'exit', 'clear'];
 export function parse(input) {
     const trimmed = input.trim();
     if (!trimmed.startsWith('/')) {
@@ -35,6 +35,7 @@ export function parse(input) {
         case 'thinking': return { kind: 'thinking' };
         case 'memory': return { kind: 'memory' };
         case 'jobs': return { kind: 'jobs' };
+        case 'verify': return { kind: 'verify' };
         case 'quit':
         case 'exit':
         case 'q': return { kind: 'quit' };

package/dist/index.js

@@ -296,6 +296,7 @@ async function main() {
         .option('--verify-command <cmd>', 'Custom verification command (default: auto-detected)')
         .option('--max-repairs <n>', 'Max autonomous repair attempts (default 3)', (v) => parsePositiveInt('--max-repairs', v))
         .option('--persist', 'Enable session persistence (Level 9, default: enabled)')
+        .option('--require-verify', 'Fail with exit 8 if no verification passed after edits (6.5)')
         .action(async (prompt, opts) => {
         const model = opts.model ?? process.env.KLYRO_MODEL;
         if (!model) {
@@ -328,6 +329,7 @@ async function main() {
                 verifyCommand: opts.verifyCommand,
                 maxRepairAttempts: opts.maxRepairs,
                 persist: opts.persist,
+                requireVerify: !!opts.requireVerify,
             });
             process.exit(code);
         }

package/dist/persistence/store.d.ts

@@ -42,7 +42,9 @@ export interface StoredObservation {
 export declare class SessionStore {
     private readonly dir;
     private readonly indexPath;
+    private readonly locks;
     constructor(dir: string);
+    private withLock;
     private ensureDir;
     private readIndex;
     private writeIndex;

package/dist/persistence/store.js

@@ -15,10 +15,26 @@ import { randomUUID } from 'node:crypto';
 export class SessionStore {
     dir;
     indexPath;
+    locks = new Map();
     constructor(dir) {
         this.dir = dir;
         this.indexPath = path.join(dir, 'sessions.json');
     }
+    async withLock(key, fn) {
+        const prev = this.locks.get(key) ?? Promise.resolve();
+        let release;
+        const next = new Promise((r) => { release = r; });
+        this.locks.set(key, prev.then(() => next));
+        await prev;
+        try {
+            return await fn();
+        }
+        finally {
+            release();
+            if (this.locks.get(key) === next)
+                this.locks.delete(key);
+        }
+    }
     async ensureDir() {
         await fs.mkdir(this.dir, { recursive: true });
     }
@@ -113,21 +129,27 @@ export class SessionStore {
         }
     }
     async appendMessage(id, message) {
-        const data = await this.readSession(id);
-        data.messages.push(message);
-        await this.writeSession(id, data);
+        return this.withLock(id, async () => {
+            const data = await this.readSession(id);
+            data.messages.push(message);
+            await this.writeSession(id, data);
+        });
     }
     async appendObservation(id, obs) {
-        const data = await this.readSession(id);
-        data.observations.push(obs);
-        await this.writeSession(id, data);
+        return this.withLock(id, async () => {
+            const data = await this.readSession(id);
+            data.observations.push(obs);
+            await this.writeSession(id, data);
+        });
     }
     async setStatus(id, status, finalText) {
-        const data = await this.readSession(id);
-        data.record.status = status;
-        if (finalText !== undefined)
-            data.record.finalText = finalText;
-        await this.writeSession(id, data);
+        return this.withLock(id, async () => {
+            const data = await this.readSession(id);
+            data.record.status = status;
+            if (finalText !== undefined)
+                data.record.finalText = finalText;
+            await this.writeSession(id, data);
+        });
     }
     async loadMessages(id) {
         const data = await this.readSession(id);

package/dist/policy/path-guard.js

@@ -64,19 +64,17 @@ export async function resolveAndFollowSymlinks(cwd, requested) {
         realParent = path.dirname(real);
     }
     catch {
-        // File doesn't exist yet (e.g. write_file). realpath would fail; fall
-        // back to realpath-ing the parent.
         const parent = path.dirname(resolved);
         try {
             realParent = await fs.realpath(parent);
+            real = path.join(realParent, path.basename(resolved));
         }
         catch {
-            // Parent doesn't exist either. Don't trust the unresolved parent —
-            // re-validate it against cwd and bail if it's not inside.
-            const { resolved: parentResolved } = resolveWithinCwd(cwd, parent);
-            realParent = parentResolved;
+            // Parent doesn't exist either — no symlink to follow, so lexical check
+            // done by resolveWithinCwd above is sufficient. Return lexical resolved.
+            // Avoid realpath(cwd) vs lexical mismatch on Windows short-names.
+            return { resolved };
         }
-        real = path.join(realParent, path.basename(resolved));
     }
     const absCwd = await fs.realpath(cwd).catch(() => path.resolve(cwd));
     const cmpReal = normalizeForCompare(real);

package/dist/policy/secret-redactor.js

@@ -11,15 +11,19 @@
 import { Transform } from 'node:stream';
 const PATTERNS = [
     { name: 'aws-key', re: /AKIA[0-9A-Z]{16}/g },
-    // Specific: require secret context to avoid package-lock hash false positives
     { name: 'aws-secret', re: /(?:aws_secret_access_key|secret)\s*[:=]\s*[A-Za-z0-9/+=]{40}/gi },
-    // High-entropy base64: require at least one +/= and not just hex (e.g. sha512 hex should not match)
     { name: 'aws-secret-b64', re: /(?<![A-Za-z0-9/+=])(?=[A-Za-z0-9/+=]*[+/=])[A-Za-z0-9/+=]{40,}={0,2}(?![A-Za-z0-9/+=])/g, },
     { name: 'pem-block', re: /-----BEGIN [A-Z ]+PRIVATE KEY-----[\s\S]*?-----END [A-Z ]+PRIVATE KEY-----/g },
     { name: 'github-token', re: /gh[pousr]_[A-Za-z0-9]{36,255}/g },
     { name: 'slack-token', re: /xox[abprs]-[A-Za-z0-9-]{10,}/g },
     { name: 'bearer', re: /Bearer\s+[A-Za-z0-9._\-+/=]{16,}/gi },
     { name: 'jwt', re: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g },
+    // Generic provider keys — must be redacted even if not prefixed Bearer
+    { name: 'openai-key', re: /sk-(?:proj-)?[A-Za-z0-9_-]{20,}/g },
+    { name: 'anthropic-key', re: /sk-ant-[A-Za-z0-9_-]{20,}/g },
+    { name: 'api-key', re: /(?:api[_-]?key|apikey)\s*[:=]\s*['"]?[A-Za-z0-9_\-]{16,}['"]?/gi },
+    { name: 'password', re: /(?:password|passwd|pwd)\s*[:=]\s*['"]?[^\s'"]{4,}['"]?/gi },
+    { name: 'secret-generic', re: /(?:secret|token)\s*[:=]\s*['"]?[A-Za-z0-9_\-+/=]{16,}['"]?/gi },
 ];
 const REPLACEMENT = '[REDACTED]';
 /** Redact a single string (or Buffer). */

package/dist/tools/fs/apply-patch.js

@@ -5,7 +5,7 @@ import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import { z } from 'zod';
 import { defineTool } from '../types.js';
-import { resolveWithinCwd } from '../../policy/path-guard.js';
+import { resolveAndFollowSymlinks } from '../../policy/path-guard.js';
 import { safe } from '../normalize.js';
 const InputSchema = z.object({
     patch: z.string().min(1).describe('Unified diff patch text'),
@@ -28,7 +28,7 @@ export const applyPatchTool = defineTool({
                 if (line.startsWith('*** Update File:')) {
                     // Flush previous
                     if (currentFile && fileContent !== null) {
-                        const { resolved } = resolveWithinCwd(ctx.cwd, currentFile);
+                        const { resolved } = await resolveAndFollowSymlinks(ctx.cwd, currentFile);
                         await fs.mkdir(path.dirname(resolved), { recursive: true });
                         await fs.writeFile(resolved, fileContent, 'utf-8');
                         patchedFiles.push(currentFile);
@@ -36,7 +36,7 @@ export const applyPatchTool = defineTool({
                     currentFile = line.replace('*** Update File:', '').trim();
                     if (currentFile) {
                         try {
-                            const { resolved } = resolveWithinCwd(ctx.cwd, currentFile);
+                            const { resolved } = await resolveAndFollowSymlinks(ctx.cwd, currentFile);
                             fileContent = await fs.readFile(resolved, 'utf-8');
                         }
                         catch {
@@ -47,7 +47,7 @@ export const applyPatchTool = defineTool({
                 }
                 if (line.startsWith('*** Add File:')) {
                     if (currentFile && fileContent !== null) {
-                        const { resolved } = resolveWithinCwd(ctx.cwd, currentFile);
+                        const { resolved } = await resolveAndFollowSymlinks(ctx.cwd, currentFile);
                         await fs.mkdir(path.dirname(resolved), { recursive: true });
                         await fs.writeFile(resolved, fileContent, 'utf-8');
                         patchedFiles.push(currentFile);
@@ -66,7 +66,7 @@ export const applyPatchTool = defineTool({
                 }
             }
             if (currentFile && fileContent !== null) {
-                const { resolved } = resolveWithinCwd(ctx.cwd, currentFile);
+                const { resolved } = await resolveAndFollowSymlinks(ctx.cwd, currentFile);
                 await fs.mkdir(path.dirname(resolved), { recursive: true });
                 await fs.writeFile(resolved, fileContent, 'utf-8');
                 patchedFiles.push(currentFile);