klyro 0.1.3 → 0.1.5

package/dist/tools/fs/write-file.js

@@ -15,18 +15,36 @@ const InputSchema = z.object({
     path: z.string().min(1).describe('Path relative to cwd or absolute (must be inside cwd)'),
     content: z.string().describe('File content. Use empty string to truncate.'),
 });
+import { wasRead } from './read-history.js';
 export const writeFileTool = defineTool({
     name: 'write_file',
     description: 'Write content to a file. Atomic: writes to a temp file then renames. Creates parent directories as needed.',
     inputSchema: InputSchema,
+    permission: 'edit',
+    isConcurrencySafe: false,
+    renderCall: (input) => `write_file ${input.path} (${input.content.length} chars)`,
+    renderResult: (output) => `${output.path} written ${output.bytesWritten} bytes`,
     execute: async (input, ctx) => {
         return safe(async () => {
             const { resolved } = resolveWithinCwd(ctx.cwd, input.path);
             const parent = path.dirname(resolved);
             await fs.mkdir(parent, { recursive: true });
+            // 3.2: if file exists and was not read this session, warn but allow with diff
+            let existing = null;
+            let needsApproval = false;
+            try {
+                existing = await fs.readFile(resolved, 'utf-8');
+                if (!wasRead(input.path) && existing.length > 200) {
+                    needsApproval = true;
+                }
+            }
+            catch {
+                // not exists — fine
+            }
             const suffix = crypto.randomBytes(8).toString('hex');
             const tmp = path.join(parent, `.klyro-write-${process.pid}-${suffix}.tmp`);
             const data = Buffer.from(input.content, 'utf-8');
+            // Truncate to 8k tokens ~32k chars for result
             const fh = await fs.open(tmp, 'w');
             try {
                 await fh.writeFile(data);
@@ -42,7 +60,23 @@ export const writeFileTool = defineTool({
                 await fs.unlink(tmp).catch(() => undefined);
                 throw err;
             }
-            return { path: input.path, bytesWritten: data.byteLength };
+            // Compute diff for approval UI if needed
+            let diff = '';
+            if (existing !== null) {
+                const before = existing.split('\n').slice(0, 20).join('\n');
+                const after = input.content.split('\n').slice(0, 20).join('\n');
+                if (before !== after)
+                    diff = `--- before\n${before.slice(0, 500)}\n+++ after\n${after.slice(0, 500)}`;
+            }
+            const result = {
+                path: input.path,
+                bytesWritten: data.byteLength,
+            };
+            if (diff)
+                result.diff = diff;
+            if (needsApproval)
+                result.needsApproval = true;
+            return result;
         });
     },
 });

package/dist/tools/normalize.d.ts

@@ -28,4 +28,4 @@ export declare function toToolError(err: unknown, fallbackCode?: ToolErrorCode):
  *  If the function returns a ToolResult (already-shaped), it is passed through
  *  unwrapped. Otherwise the function's return value becomes `value` on success.
  */
-export declare function safe<T>(fn: () => Promise<T>): Promise<ToolResult<T>>;
+export declare function safe<T>(fn: () => Promise<T | ToolResult<T>>): Promise<ToolResult<T>>;

package/dist/tools/shell/shell-exec.d.ts

@@ -30,31 +30,6 @@ export declare const shellExecTool: import("../types.js").Tool<{
     cwd?: string | undefined;
     timeoutMs?: number | undefined;
     env?: Record<string, string> | undefined;
-}, {
-    readonly ok: false;
-    readonly error: {
-        readonly code: "COMMAND_DENIED";
-        readonly message: `Command blocked: ${string}`;
-    };
-    command?: undefined;
-    exitCode?: undefined;
-    signal?: undefined;
-    stdout?: undefined;
-    stderr?: undefined;
-    durationMs?: undefined;
-    timedOut?: undefined;
-    truncated?: undefined;
-} | {
-    command: string;
-    exitCode: number | null;
-    signal: NodeJS.Signals | null;
-    stdout: string;
-    stderr: string;
-    durationMs: number;
-    timedOut: boolean;
-    truncated: false;
-    readonly ok?: undefined;
-    readonly error?: undefined;
-}>;
+}, ShellOutput>;
 export type ShellInput = z.infer<typeof InputSchema>;
 export {};

package/dist/tools/shell/shell-exec.js

@@ -8,7 +8,9 @@
  *   - Non-zero exit is returned as a successful tool call (with exitCode in
  *     the output). The agent reads exitCode to decide what to do next.
  */
-import { spawn } from 'node:child_process';
+import { spawn, spawnSync } from 'node:child_process';
+import * as os from 'node:os';
+import * as path from 'node:path';
 import { z } from 'zod';
 import { defineTool } from '../types.js';
 import { resolveWithinCwd } from '../../policy/path-guard.js';
@@ -19,37 +21,99 @@ const InputSchema = z.object({
     timeoutMs: z.number().int().min(1).max(600_000).optional().describe('Timeout in milliseconds (default 30000, max 600000)'),
     env: z.record(z.string(), z.string()).optional().describe('Extra env vars merged onto process.env'),
 });
-const DEFAULT_TIMEOUT_MS = 30_000;
-const MAX_OUTPUT_BYTES = 128 * 1024;
-// Hard-coded dangerous patterns. These are non-overridable in MVP.
+const DEFAULT_TIMEOUT_MS = 120_000;
+const MAX_TIMEOUT_MS = 600_000;
+const MAX_OUTPUT_CHARS = 30_000; // head+tail cap per 3.3
+const FULL_OUTPUT_DIR = (() => {
+    try {
+        const home = os.homedir() || process.cwd();
+        return path.join(home, '.klyro', 'tool-output');
+    }
+    catch {
+        return path.join(process.cwd(), '.klyro', 'tool-output');
+    }
+})();
+// Persistent cwd across calls (3.3)
+let persistentCwd = null;
+// Filtered env — only safe vars, secrets stripped
+const ALLOWED_ENV_PREFIXES = ['PATH', 'HOME', 'USER', 'SHELL', 'TERM', 'LANG', 'NODE_', 'NPM_', 'PNPM_', 'YARN_'];
+function filteredEnv(extra) {
+    const out = {};
+    for (const [k, v] of Object.entries(process.env)) {
+        if (k.startsWith('KLYRO_') && k.includes('API_KEY'))
+            continue;
+        if (k.includes('SECRET') || k.includes('TOKEN') || k === 'ANTHROPIC_API_KEY' || k === 'OPENAI_API_KEY')
+            continue;
+        if (ALLOWED_ENV_PREFIXES.some((p) => k.startsWith(p)) || k === 'PWD' || k === 'TMPDIR' || k === 'TEMP') {
+            out[k] = v;
+        }
+    }
+    // Always allow basic
+    out.PATH = process.env.PATH;
+    if (extra)
+        Object.assign(out, extra);
+    return out;
+}
+// Interactive command detection (3.3)
+const INTERACTIVE_PATTERNS = [/^\s*vim\b/, /^\s*nano\b/, /^\s*htop\b/, /^\s*less\b/, /^\s*more\b/, /^\s*ssh\b/, /^\s*tmux\b/];
+// Hard-coded dangerous patterns. These are non-overridable, configurable via --yolo only.
 const DANGEROUS_PATTERNS = [
     { pattern: /rm\s+-rf?\s+\//, reason: 'recursive delete at filesystem root' },
+    { pattern: /rm\s+-rf?\s+\/\/+/, reason: 'recursive delete at filesystem root (//)' },
+    { pattern: /rm\s+-rf?\s+\/\*/, reason: 'recursive delete at filesystem root (/*)' },
+    { pattern: /rm\s+-rf?\s+\.\s*($|[;&|])/, reason: 'recursive delete current directory' },
+    { pattern: /rm\s+-rf?\s+\*\s*($|[;&|])/, reason: 'recursive delete all files via *' },
+    { pattern: /rm\s+-rf?\s+\.\/\*\s*($|[;&|])/, reason: 'recursive delete all files' },
     { pattern: /del\s+\/s\s+\/q\s+[a-z]:\\/i, reason: 'recursive delete on Windows drive root' },
     { pattern: /:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/, reason: 'fork bomb' },
+    { pattern: /bomb\(\)\s*\{\s*bomb\|bomb/, reason: 'fork bomb variant' },
     { pattern: />\s*\/dev\/sd[a-z]/, reason: 'overwrite raw block device' },
     { pattern: /mkfs(\.|\s)/, reason: 'format filesystem' },
     { pattern: /dd\s+.*of=\/dev\//, reason: 'dd write to device' },
+    { pattern: /chmod\s+-R\s+777\s+\//, reason: 'chmod 777 on root' },
+    { pattern: /curl.*\|\s*(sh|bash|python|perl|ruby)/i, reason: 'curl|sh to unknown host' },
+    { pattern: /rm\s+-rf\s+--no-preserve-root\s+\//, reason: 'recursive delete --no-preserve-root' },
 ];
 export const shellExecTool = defineTool({
     name: 'shell_exec',
-    description: 'Execute a shell command. Default timeout 30s. Output is truncated at 128 KiB. Returns exitCode (or null if killed by signal). Non-zero exit code is NOT a tool error — the tool succeeds and the agent sees the exit code in the output.',
+    description: 'Execute a shell command. Default timeout 120s (max 600s). Output head+tail 30k chars, full to ~/.klyro/tool-output/<id>.txt. Persistent cwd, filtered env, tree-kill on timeout.',
     inputSchema: InputSchema,
+    permission: 'execute',
+    isConcurrencySafe: false,
+    renderCall: (input) => `$ ${input.command.slice(0, 80)}`,
+    renderResult: (output) => `exit ${output.exitCode} (${output.durationMs}ms${output.timedOut ? ' timedOut' : ''})`,
     execute: async (input, ctx) => {
         return safe(async () => {
+            // Interactive detection
+            for (const pat of INTERACTIVE_PATTERNS) {
+                if (pat.test(input.command)) {
+                    throw Object.assign(new Error(`Interactive command blocked: ${input.command.split(' ')[0]} — hint: use non-interactive mode or run in background`), { code: TOOL_ERROR_CODES.COMMAND_DENIED });
+                }
+            }
             for (const { pattern, reason } of DANGEROUS_PATTERNS) {
                 if (pattern.test(input.command)) {
-                    return {
-                        ok: false,
-                        error: { code: TOOL_ERROR_CODES.COMMAND_DENIED, message: `Command blocked: ${reason}` },
-                    };
+                    throw Object.assign(new Error(`Command blocked: ${reason}`), { code: TOOL_ERROR_CODES.COMMAND_DENIED });
                 }
             }
-            let cwd = ctx.cwd;
+            // Persistent cwd
+            let cwd = persistentCwd ?? ctx.cwd;
             if (input.cwd) {
                 cwd = resolveWithinCwd(ctx.cwd, input.cwd).resolved;
+                persistentCwd = cwd;
+            }
+            else if (input.command.trim().startsWith('cd ')) {
+                const m = /^\s*cd\s+(.+?)\s*(?:&&|;|$)/.exec(input.command);
+                if (m?.[1]) {
+                    try {
+                        const target = m[1].replace(/^["']|["']$/g, '');
+                        const resolved = resolveWithinCwd(cwd, target).resolved;
+                        persistentCwd = resolved;
+                    }
+                    catch { /* ignore */ }
+                }
             }
-            const timeoutMs = input.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-            const env = { ...process.env, ...(input.env ?? {}) };
+            const timeoutMs = Math.min(input.timeoutMs ?? DEFAULT_TIMEOUT_MS, MAX_TIMEOUT_MS);
+            const env = filteredEnv(input.env);
             const start = Date.now();
             const child = spawn(input.command, {
                 cwd,
@@ -61,20 +125,29 @@ export const shellExecTool = defineTool({
             });
             const stdoutChunks = [];
             const stderrChunks = [];
+            const fullStdout = [];
+            const fullStderr = [];
             let totalOut = 0;
             let totalErr = 0;
             let truncated = false;
             child.stdout?.on('data', (chunk) => {
-                if (totalOut + chunk.length > MAX_OUTPUT_BYTES) {
+                fullStdout.push(chunk);
+                if (totalOut + chunk.length > MAX_OUTPUT_CHARS) {
                     truncated = true;
+                    // Keep head+tail: drop middle, keep first half and last half later
+                    if (stdoutChunks.length < 10)
+                        stdoutChunks.push(chunk);
                     return;
                 }
                 stdoutChunks.push(chunk);
                 totalOut += chunk.length;
             });
             child.stderr?.on('data', (chunk) => {
-                if (totalErr + chunk.length > MAX_OUTPUT_BYTES) {
+                fullStderr.push(chunk);
+                if (totalErr + chunk.length > MAX_OUTPUT_CHARS) {
                     truncated = true;
+                    if (stderrChunks.length < 10)
+                        stderrChunks.push(chunk);
                     return;
                 }
                 stderrChunks.push(chunk);
@@ -100,7 +173,7 @@ export const shellExecTool = defineTool({
                     // -SIGKILL signals the group so children go too.
                     if (process.platform === 'win32') {
                         try {
-                            require('node:child_process').spawnSync('taskkill', ['/F', '/T', '/PID', String(child.pid)], { windowsHide: true });
+                            spawnSync('taskkill', ['/F', '/T', '/PID', String(child.pid)], { windowsHide: true });
                         }
                         catch { /* already gone */ }
                     }
@@ -116,8 +189,39 @@ export const shellExecTool = defineTool({
                 child.on('error', () => finish({ code: null, signal: null, timedOut: false }));
             });
             const { code: exitCode, signal, timedOut } = outcome;
-            const stdout = Buffer.concat(stdoutChunks).toString('utf-8');
-            const stderr = Buffer.concat(stderrChunks).toString('utf-8');
+            const fullOutBuf = Buffer.concat(fullStdout);
+            const fullErrBuf = Buffer.concat(fullStderr);
+            // Write full output to ~/.klyro/tool-output/<id>.txt for 3.3
+            const outId = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+            try {
+                const fs = await import('node:fs/promises');
+                const path = await import('node:path');
+                await fs.mkdir(FULL_OUTPUT_DIR, { recursive: true });
+                const fullPath = path.join(FULL_OUTPUT_DIR, `${outId}.txt`);
+                const fullContent = `STDOUT:\n${fullOutBuf.toString('utf-8')}\n\nSTDERR:\n${fullErrBuf.toString('utf-8')}\n`;
+                await fs.writeFile(fullPath, fullContent, 'utf-8');
+            }
+            catch { /* ignore */ }
+            // Head+tail truncation: keep first 15k and last 15k chars
+            let stdout;
+            let stderr;
+            if (truncated) {
+                const fullOutStr = fullOutBuf.toString('utf-8');
+                const fullErrStr = fullErrBuf.toString('utf-8');
+                const headTail = (s) => {
+                    if (s.length <= MAX_OUTPUT_CHARS)
+                        return s;
+                    const head = s.slice(0, 15000);
+                    const tail = s.slice(-15000);
+                    return head + `\n... [truncated ${s.length - 30000} chars, full at ~/.klyro/tool-output/${outId}.txt]\n` + tail;
+                };
+                stdout = headTail(fullOutStr);
+                stderr = headTail(fullErrStr);
+            }
+            else {
+                stdout = Buffer.concat(stdoutChunks).toString('utf-8');
+                stderr = Buffer.concat(stderrChunks).toString('utf-8');
+            }
             return {
                 command: input.command,
                 exitCode,

package/dist/tools/types.d.ts

@@ -33,6 +33,21 @@ export interface ToolContext {
     signal?: AbortSignal;
     /** True when running headless (CI, pipe). Tools should avoid prompts. */
     nonInteractive?: boolean;
+    /** Current session id (for tracing). */
+    sessionId?: string;
+    /** Permissions snapshot for this turn. */
+    permissions?: {
+        mode?: string;
+        allow?: string[];
+        deny?: string[];
+    };
+    /** Logger (pino-like) */
+    logger?: {
+        debug: (msg: string, data?: unknown) => void;
+        info: (msg: string, data?: unknown) => void;
+    };
+    /** Emit KlyroEvent */
+    emit?: (ev: import('../events/catalog.js').KlyroEvent) => void;
 }
 /**
  * A typed tool definition. TInput is the validated input shape; TOutput is
@@ -45,6 +60,16 @@ export interface Tool<TInput, TOutput> {
     description: string;
     /** Zod schema for runtime validation. */
     inputSchema: z.ZodType<TInput>;
+    /** Permission class: read | edit | execute | admin */
+    permission?: 'read' | 'edit' | 'execute' | 'admin';
+    /** True if tool is safe to run in parallel with others */
+    isConcurrencySafe?: boolean;
+    /** Render call for approval UI */
+    renderCall?: (input: TInput) => string;
+    /** Render result for UI */
+    renderResult?: (output: TOutput) => string;
+    /** Truncate large results to maxResultTokens (default 8k) */
+    truncate?: (output: TOutput, maxTokens: number) => TOutput | string;
     /** Execute the tool. Must never throw — return a ToolResult instead. */
     execute(input: TInput, ctx: ToolContext): Promise<ToolResult<TOutput>>;
 }

package/dist/trace/writer.d.ts

@@ -0,0 +1,13 @@
+/**
+ * 3.1 — TraceWriter (JSONL, fsync on tool results)
+ */
+import type { KlyroEvent } from '../events/catalog.js';
+export declare class TraceWriter {
+    private filePath;
+    constructor(sessionId: string, dir?: string);
+    init(): Promise<void>;
+    write(ev: KlyroEvent): Promise<void>;
+    close(): Promise<void>;
+    get path(): string;
+    readAll(): Promise<KlyroEvent[]>;
+}

package/dist/trace/writer.js

@@ -0,0 +1,53 @@
+/**
+ * 3.1 — TraceWriter (JSONL, fsync on tool results)
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+export class TraceWriter {
+    filePath;
+    constructor(sessionId, dir) {
+        const base = dir ?? path.join(process.cwd(), '.klyro', 'traces');
+        this.filePath = path.join(base, `${sessionId}.jsonl`);
+    }
+    async init() {
+        await fs.mkdir(path.dirname(this.filePath), { recursive: true });
+        // Ensure file exists
+        try {
+            await fs.appendFile(this.filePath, '', 'utf-8');
+        }
+        catch { /* ignore */ }
+    }
+    async write(ev) {
+        const line = JSON.stringify(ev) + '\n';
+        await fs.appendFile(this.filePath, line, 'utf-8');
+        // fsync on tool results for crash safety
+        if (ev.type === 'tool.result') {
+            try {
+                const handle = await fs.open(this.filePath, 'r+');
+                try {
+                    await handle.sync();
+                }
+                finally {
+                    await handle.close();
+                }
+            }
+            catch { /* ignore */ }
+        }
+    }
+    async close() {
+        // No persistent handle to close
+    }
+    get path() {
+        return this.filePath;
+    }
+    // For tests: read back
+    async readAll() {
+        try {
+            const raw = await fs.readFile(this.filePath, 'utf-8');
+            return raw.split('\n').filter(Boolean).map((l) => JSON.parse(l));
+        }
+        catch {
+            return [];
+        }
+    }
+}

package/dist/tui/app.d.ts

@@ -1,32 +1,25 @@
 /**
  * Ink app root — status line + scrollable transcript + input box.
- *
- * Owns the session state machine:
- *   - transcript: array of TranscriptItem (rendered by <Transcript/>)
- *   - status: snapshot for the <StatusLine/>
- *   - input: the current input-box buffer
- *
- * The actual agent loop runs externally; the app just listens for
- * RuntimeEvents via the onEvent callback wired by cli/repl.ts and
- * translates them into transcript/status updates.
+ * 1.4: history per project, multiline, Ctrl+C double, slash registry, Windows handling
  */
 import React from 'react';
 import { type StatusSnapshot } from './status.js';
 import { type TranscriptItem } from './transcript.js';
 import { TuiApprovalBridge } from './approval.js';
+import type { PlanStep } from '../agent/runtime.js';
 export interface AppProps {
     initialModel: string;
     maxSteps: number;
-    /** Working directory to display in the header. */
     cwd: string;
-    /** Called when the user submits a non-slash prompt. */
     onPrompt: (text: string) => void | Promise<void>;
-    /** Called when the user types a slash command. */
     onSlash: (cmd: import('../cli/slash/parser.js').SlashCommand) => void | Promise<void>;
-    /** Initial state (e.g. when resuming a session). */
     initialTranscript?: TranscriptItem[];
     initialStatus?: Partial<StatusSnapshot>;
-    /** Optional approval bridge — when set, the modal prompts inline. */
     approvalBridge?: TuiApprovalBridge;
+    onMounted?: (hooks: {
+        append: (i: TranscriptItem) => void;
+        updateStatus: (s: Partial<StatusSnapshot>) => void;
+        updatePlan: (p: PlanStep[]) => void;
+    }) => void;
 }
 export declare function App(props: AppProps): React.JSX.Element;