klyro 0.1.4 → 0.1.6

package/dist/index.js

@@ -11,7 +11,7 @@
  * Provider: OpenAI-compatible /v1/chat/completions endpoint.
  * Configure via env: KLYRO_BASE_URL, KLYRO_API_KEY, KLYRO_MODEL.
  */
-import { Command } from 'commander';
+import { Command, InvalidArgumentError } from 'commander';
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, resolve } from 'node:path';
@@ -20,25 +20,64 @@ import { repl } from './repl.js';
 import { startRepl } from './cli/repl.js';
 import { runOnce } from './cli/run.js';
 import { runEval } from './cli/eval.js';
+import { runConfig } from './cli/config.js';
+import { runDoctor } from './cli/doctor.js';
+import { runCompletion } from './cli/completion.js';
+import { runUpdate } from './cli/update.js';
+import { runLogin, runLogout } from './cli/auth.js';
 // Read version from package.json so `klyro --version` always matches the
 // published version. Walks up from this file (src/index.ts) to find the
 // nearest package.json.
 function readVersion() {
+    const here = dirname(fileURLToPath(import.meta.url));
+    const candidates = [
+        resolve(here, '..', 'package.json'),
+        resolve(here, '../..', 'package.json'),
+        resolve(here, '../../package.json'),
+    ];
+    for (const pkgPath of candidates) {
+        try {
+            const raw = readFileSync(pkgPath, 'utf8');
+            const pkg = JSON.parse(raw);
+            if (typeof pkg.version === 'string' && pkg.version.length > 0)
+                return pkg.version;
+        }
+        catch (err) {
+            const e = err;
+            // Only ignore missing file; surface JSON parse errors
+            if (e.code === 'ENOENT')
+                continue;
+            // Malformed JSON — warn but don't crash version output
+            process.stderr.write(`klyro: warning: malformed ${pkgPath}: ${e.message}\n`);
+            continue;
+        }
+    }
+    // Fallback: try require-style resolution
     try {
-        const here = dirname(fileURLToPath(import.meta.url));
-        const pkgPath = resolve(here, '..', 'package.json');
-        const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
-        return pkg.version ?? '0.0.0';
+        const pkgPath = resolve(process.cwd(), 'package.json');
+        const raw = readFileSync(pkgPath, 'utf8');
+        const pkg = JSON.parse(raw);
+        if (pkg.name === 'klyro' && typeof pkg.version === 'string')
+            return pkg.version;
     }
     catch {
-        return '0.0.0';
+        // ignore
     }
+    return '0.0.0';
 }
 const VERSION = readVersion();
 function parsePositiveInt(name, v) {
     const n = Number(v);
-    if (!Number.isFinite(n) || n <= 0)
-        throw new Error(`invalid ${name}: ${v}`);
+    if (!Number.isFinite(n) || n <= 0) {
+        throw new InvalidArgumentError(`invalid ${name}: ${v}`);
+    }
+    return n;
+}
+function parseTemperature(v) {
+    const n = Number(v);
+    if (!Number.isFinite(n) || n < 0 || n > 2) {
+        throw new InvalidArgumentError(`invalid --temperature: ${v} (expected 0-2)`);
+    }
     return n;
 }
 async function main() {
@@ -48,7 +87,57 @@ async function main() {
         .description('Klyro — autonomous coding harness')
         .version(VERSION, '-V, --version', 'Print the version number')
         .helpOption('-h, --help', 'Print this help message')
-        .showHelpAfterError();
+        .showHelpAfterError()
+        .showSuggestionAfterError(true);
+    // Global flags — 1.2 + 2.5 headless
+    program
+        .option('--cwd <path>', 'Change working directory')
+        .option('--config <path>', 'Override config file path (sets KLYRO_CONFIG)')
+        .option('--debug', 'Enable debug logging')
+        .option('--verbose', 'Verbose output')
+        .option('--quiet', 'Suppress non-essential output')
+        .option('--json', 'Force JSON output where supported')
+        .option('--yes', 'Auto-approve prompts where possible')
+        .option('--no-color', 'Disable colored output')
+        .option('-p, --print <prompt>', 'Headless one-shot prompt (alias for run, --output json for machine)')
+        .option('--output-format <fmt>', 'Headless output format: text|json|stream-json (default text)')
+        .option('--no-stream', 'Disable streaming (buffer full response)')
+        .option('--show-thinking', 'Show thinking blocks');
+    // Handle global flags before any command runs
+    program.hook('preAction', (thisCommand) => {
+        const opts = thisCommand.optsWithGlobals();
+        if (opts.cwd) {
+            try {
+                process.chdir(opts.cwd);
+            }
+            catch (err) {
+                process.stderr.write(`klyro: --cwd: cannot chdir to ${opts.cwd}: ${err instanceof Error ? err.message : String(err)}\n`);
+                process.exit(2);
+            }
+        }
+        if (opts.config)
+            process.env.KLYRO_CONFIG = opts.config;
+        if (opts.debug)
+            process.env.KLYRO_LOG_LEVEL = 'debug';
+        if (opts.verbose)
+            process.env.KLYRO_LOG_LEVEL = 'debug';
+        if (opts.quiet)
+            process.env.KLYRO_QUIET = '1';
+        if (opts.json)
+            process.env.KLYRO_JSON = '1';
+        if (opts.yes)
+            process.env.KLYRO_YES = '1';
+        if (opts.color === false || process.env.NO_COLOR === '1') {
+            process.env.FORCE_COLOR = '0';
+            process.env.NO_COLOR = '1';
+        }
+        else if (process.env.FORCE_COLOR === undefined && process.env.NO_COLOR === undefined) {
+            // Respect NO_COLOR/FORCE_COLOR if already set, otherwise honor terminal
+            if (process.env.TERM === 'dumb' || process.env.CI === '1') {
+                // leave as is
+            }
+        }
+    });
     // Top-level TUI overrides — single definition; commander auto-creates --no-tui negation
     // Note: -m/--model and --max-steps are defined only on the `tui` subcommand to avoid
     // CommanderError "option already exists" (parent options are inherited by subcommands).
@@ -66,10 +155,107 @@ async function main() {
         process.exit(code);
     });
     program
+        .command('completion <shell>')
+        .description('Generate shell completion script (bash|zsh|fish|powershell)')
+        .action(async (shell) => {
+        const code = await runCompletion(shell);
+        process.exit(code);
+    });
+    program
+        .command('update')
+        .description('Check for klyro updates (cached 24h, KLYRO_NO_UPDATE_CHECK=1 to disable)')
         .action(async () => {
+        const code = await runUpdate();
+        process.exit(code);
+    });
+    program
+        .command('login')
+        .description('Login and store API key (masked, 0600) — provider auto-select')
+        .action(async () => {
+        const code = await runLogin();
+        process.exit(code);
+    });
+    program
+        .command('logout [provider]')
+        .description('Remove stored credentials')
+        .action(async (provider) => {
+        const code = await runLogout(provider);
+        process.exit(code);
+    });
+    // LEVEL 1 — config & doctor (graduation requires klyro config / klyro doctor)
+    program
+        .command('config [command] [key] [value]')
+        .description('Manage klyro config file (~/.klyro/config.json). Commands: list, get, set, unset, path')
+        .allowUnknownOption(false)
+        .action(async (command, key, value) => {
+        const args = [];
+        if (command)
+            args.push(command);
+        if (key)
+            args.push(key);
+        if (value !== undefined)
+            args.push(value);
+        // Also capture remaining raw args for `set a b c` style values
+        // commander splits `set x y z` as command=set key=x value=y, but z is lost —
+        // so re-parse from raw argv for set
+        const raw = process.argv.slice(2);
+        const idx = raw.indexOf('config');
+        if (idx !== -1 && command === 'set' && key) {
+            // everything after `config set <key>` is the value
+            const after = raw.slice(idx + 3);
+            const fullValue = after.join(' ');
+            const code = await runConfig(['set', key, fullValue]);
+            process.exit(code);
+        }
+        const code = await runConfig(args);
+        process.exit(code);
+    });
+    program
+        .command('doctor')
+        .description('Run diagnostics (node, config, provider, sessions, git, tools)')
+        .option('--json', 'Output JSON')
+        .action(async (opts) => {
+        const code = await runDoctor({ json: !!opts.json });
+        process.exit(code);
+    });
+    // Support `klyro "prompt"` positional headless (2.5)
+    program.argument('[prompt]', 'Headless one-shot prompt (same as -p)');
+    program
+        .action(async (promptArg) => {
         const opts = program.opts();
+        // Headless via -p / --print or positional prompt
+        const headlessPrompt = opts.print ?? promptArg;
+        if (headlessPrompt) {
+            // Handle stdin piping: if stdin has data, append
+            let stdinText = '';
+            if (!process.stdin.isTTY) {
+                try {
+                    const chunks = [];
+                    for await (const chunk of process.stdin)
+                        chunks.push(chunk);
+                    stdinText = Buffer.concat(chunks).toString('utf-8').trim();
+                }
+                catch { /* ignore */ }
+            }
+            const fullPrompt = stdinText ? `${headlessPrompt}\n\n${stdinText}` : headlessPrompt;
+            const outputFormat = opts.outputFormat ?? (opts.json ? 'json' : 'text');
+            const output = outputFormat === 'json' ? 'json' : outputFormat === 'stream-json' ? 'json' : 'human';
+            const code = await runOnce({
+                task: fullPrompt,
+                cwd: process.cwd(),
+                model: process.env.KLYRO_MODEL ?? 'gpt-4o-mini',
+                maxTokens: opts.maxTokens,
+                output: output,
+                provider: process.env.KLYRO_PROVIDER,
+            });
+            process.exit(code);
+        }
         const forceTui = opts.tui === true;
         const forceLegacy = opts.chat === true || opts.tui === false;
+        if (forceTui && forceLegacy) {
+            process.stderr.write('klyro: --tui and --no-tui/--chat are mutually exclusive\n');
+            process.exit(2);
+        }
         if (forceTui) {
             const code = await startRepl({ forceTty: true });
             process.exit(code);
@@ -82,7 +268,11 @@ async function main() {
             const code = await startRepl();
             process.exit(code);
         }
-        // Non-TTY without explicit flag: explain UI requires TTY
+        // Non-TTY without explicit flag: explain UI requires TTY, but avoid infinite loop on empty pipe
+        if (process.stdin.readableEnded || process.stdin.destroyed) {
+            process.stderr.write('klyro: no TTY and no input pipe — nothing to do. Try `klyro --help` or `klyro run \"<task>\"`\n');
+            process.exit(2);
+        }
         process.stderr.write('klyro: no TTY detected — starting legacy REPL (pipe mode)\n');
         process.stderr.write('  Tip: run `klyro tui` or `klyro --tui` to force the Ink UI, or `klyro --help` for options.\n');
         await repl('You are a helpful assistant.');
@@ -93,12 +283,7 @@ async function main() {
         .option('-m, --model <id>', 'Model id (default: env KLYRO_MODEL)')
         .option('--max-steps <n>', 'Max agent steps (default 30)', (v) => parsePositiveInt('--max-steps', v))
         .option('--max-tokens <n>', 'Max output tokens per step', (v) => parsePositiveInt('--max-tokens', v))
-        .option('--temperature <n>', 'Sampling temperature', (v) => {
-        const n = Number(v);
-        if (!Number.isFinite(n) || n < 0 || n > 2)
-            throw new Error(`invalid --temperature: ${v}`);
-        return n;
-    })
+        .option('--temperature <n>', 'Sampling temperature (0-2)', parseTemperature)
         .option('--timeout <ms>', 'Request timeout in ms (default: env KLYRO_TIMEOUT_MS or 60000)', (v) => parsePositiveInt('--timeout', v))
         .option('--base-url <url>', 'Override KLYRO_BASE_URL')
         .option('--api-key <key>', 'Override KLYRO_API_KEY')
@@ -106,6 +291,11 @@ async function main() {
         .option('--provider <name>', 'Provider: openai (default) or anthropic')
         .option('--dry-run', 'Print the prompt assembly (system, tools, task) and exit without calling the model')
         .option('--resume <file>', 'Resume from a saved transcript JSON file (must have a "transcript" field)')
+        .option('--resume-session <id>', 'Resume from a persisted session (Level 9) by id prefix')
+        .option('--verify', 'Enable verification after edits (Level 8, default: enabled)')
+        .option('--verify-command <cmd>', 'Custom verification command (default: auto-detected)')
+        .option('--max-repairs <n>', 'Max autonomous repair attempts (default 3)', (v) => parsePositiveInt('--max-repairs', v))
+        .option('--persist', 'Enable session persistence (Level 9, default: enabled)')
         .action(async (prompt, opts) => {
         const model = opts.model ?? process.env.KLYRO_MODEL;
         if (!model) {
@@ -117,11 +307,7 @@ async function main() {
             process.stderr.write(`klyro: invalid --output: ${output} (expected human|json|silent)\n`);
             process.exit(2);
         }
-        const provider = (opts.provider ?? 'openai');
-        if (provider !== 'openai' && provider !== 'anthropic') {
-            process.stderr.write(`klyro: invalid --provider: ${provider} (expected openai|anthropic)\n`);
-            process.exit(2);
-        }
+        // Provider validation is handled inside runOnce (single source of truth)
         try {
             const code = await runOnce({
                 task: prompt,
@@ -134,9 +320,14 @@ async function main() {
                 baseUrl: opts.baseUrl,
                 apiKey: opts.apiKey,
                 output,
-                provider,
+                provider: opts.provider,
                 dryRun: !!opts.dryRun,
                 resumePath: opts.resume,
+                sessionId: opts.resumeSession,
+                verify: opts.verify,
+                verifyCommand: opts.verifyCommand,
+                maxRepairAttempts: opts.maxRepairs,
+                persist: opts.persist,
             });
             process.exit(code);
         }
@@ -168,6 +359,128 @@ async function main() {
         const code = await runEval({ inputPath: input, output });
         process.exit(code);
     });
+    // Level 9 — Session management
+    const session = program.command('session').description('Session persistence (Level 9)');
+    session
+        .command('list')
+        .description('List persisted sessions')
+        .option('--status <s>', 'Filter by status: open|complete|verify_failed|aborted|max_steps')
+        .option('--json', 'Output JSON')
+        .action(async (opts) => {
+        const { getDefaultSessionStore, formatSession } = await import('./persistence/session.js');
+        const store = getDefaultSessionStore();
+        const all = await store.list(opts.status ? { status: opts.status } : undefined);
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(all, null, 2) + '\n');
+        }
+        else {
+            if (all.length === 0) {
+                process.stdout.write('No sessions\n');
+            }
+            else {
+                for (const r of all.sort((a, b) => b.updatedAt - a.updatedAt)) {
+                    process.stdout.write(formatSession(r) + '\n');
+                }
+            }
+        }
+    });
+    session
+        .command('show <id>')
+        .description('Show session transcript and observations')
+        .option('--json', 'Output JSON')
+        .action(async (id, opts) => {
+        const { getDefaultSessionStore, resolveSessionId } = await import('./persistence/session.js');
+        const store = getDefaultSessionStore();
+        const full = await resolveSessionId(store, id);
+        if (!full) {
+            process.stderr.write(`session not found: ${id}\n`);
+            process.exit(2);
+        }
+        const rec = await store.get(full);
+        const msgs = await store.loadMessages(full);
+        const obs = await store.loadObservations(full);
+        if (opts.json) {
+            process.stdout.write(JSON.stringify({ record: rec, messages: msgs, observations: obs }, null, 2) + '\n');
+        }
+        else {
+            process.stdout.write(`Session ${rec?.id}\n  task: ${rec?.task}\n  status: ${rec?.status}\n  cwd: ${rec?.cwd}\n  created: ${new Date(rec?.createdAt ?? 0).toISOString()}\n`);
+            process.stdout.write(`\nMessages (${msgs.length}):\n`);
+            for (const m of msgs)
+                process.stdout.write(`  [${m.role}] ${JSON.stringify(m.content).slice(0, 200)}\n`);
+            process.stdout.write(`\nObservations (${obs.length}):\n`);
+            for (const o of obs)
+                process.stdout.write(`  ${o.toolName} -> ${o.isError ? 'ERR' : 'ok'} ${JSON.stringify(o.output).slice(0, 120)}\n`);
+        }
+    });
+    session
+        .command('resume <id>')
+        .description('Resume a persisted session (requires KLYRO_MODEL etc.)')
+        .option('-m, --model <id>', 'Model (default: from session or env)')
+        .option('--max-steps <n>', 'Max steps (default 30)', (v) => parsePositiveInt('--max-steps', v))
+        .option('--verify-command <cmd>', 'Override verification command')
+        .option('--verify', 'Enable verification (default: enabled)')
+        .action(async (id, opts) => {
+        const { getDefaultSessionStore, resolveSessionId } = await import('./persistence/session.js');
+        const store = getDefaultSessionStore();
+        const full = await resolveSessionId(store, id);
+        if (!full) {
+            process.stderr.write(`session not found: ${id}\n`);
+            process.exit(2);
+        }
+        const rec = await store.get(full);
+        if (!rec) {
+            process.stderr.write(`session not found: ${id}\n`);
+            process.exit(2);
+        }
+        const model = opts.model ?? rec.config.model ?? process.env.KLYRO_MODEL;
+        if (!model) {
+            process.stderr.write('klyro: KLYRO_MODEL is not set (or pass --model)\n');
+            process.exit(2);
+        }
+        const code = await runOnce({
+            task: rec.task,
+            cwd: rec.cwd,
+            model,
+            maxSteps: opts.maxSteps ?? rec.config.maxSteps,
+            sessionId: full,
+            verify: opts.verify,
+            verifyCommand: opts.verifyCommand,
+        });
+        process.exit(code);
+    });
+    // Alias: klyro resume <id> → klyro session resume <id>
+    program
+        .command('resume <id>')
+        .description('Alias for `klyro session resume <id>`')
+        .option('-m, --model <id>', 'Model')
+        .option('--max-steps <n>', 'Max steps', (v) => parsePositiveInt('--max-steps', v))
+        .action(async (id, opts) => {
+        const { getDefaultSessionStore, resolveSessionId } = await import('./persistence/session.js');
+        const store = getDefaultSessionStore();
+        const full = await resolveSessionId(store, id);
+        if (!full) {
+            process.stderr.write(`session not found: ${id}\n`);
+            process.exit(2);
+        }
+        const rec = await store.get(full);
+        if (!rec) {
+            process.stderr.write(`session not found: ${id}\n`);
+            process.exit(2);
+        }
+        const model = opts.model ?? rec.config.model ?? process.env.KLYRO_MODEL;
+        if (!model) {
+            process.stderr.write('klyro: KLYRO_MODEL is not set (or pass --model)\n');
+            process.exit(2);
+        }
+        const code = await runOnce({
+            task: rec.task,
+            cwd: rec.cwd,
+            model,
+            maxSteps: opts.maxSteps ?? rec.config.maxSteps,
+            sessionId: full,
+        });
+        process.exit(code);
+    });
     await program.parseAsync(process.argv);
 }
 main().catch((err) => {

package/dist/persistence/session.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Level 9 — Session helpers (default store location, lifecycle).
+ */
+import { SessionStore, type SessionRecord } from './store.js';
+export declare function getDefaultSessionsDir(): string;
+export declare function getDefaultSessionStore(): SessionStore;
+/** Create a session store at a custom dir (for tests). */
+export declare function createSessionStore(dir: string): SessionStore;
+/** Format a session for human output. */
+export declare function formatSession(rec: SessionRecord): string;
+/** Resolve a short id prefix to full id (like git). */
+export declare function resolveSessionId(store: SessionStore, prefix: string): Promise<string | null>;

package/dist/persistence/session.js

@@ -0,0 +1,45 @@
+/**
+ * Level 9 — Session helpers (default store location, lifecycle).
+ */
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { SessionStore } from './store.js';
+let _cachedStore;
+export function getDefaultSessionsDir() {
+    if (process.env.KLYRO_SESSIONS_DIR)
+        return process.env.KLYRO_SESSIONS_DIR;
+    const home = os.homedir();
+    if (home)
+        return path.join(home, '.klyro', 'sessions');
+    return path.join(process.cwd(), '.klyro', 'sessions');
+}
+export function getDefaultSessionStore() {
+    if (_cachedStore)
+        return _cachedStore;
+    _cachedStore = new SessionStore(getDefaultSessionsDir());
+    return _cachedStore;
+}
+/** Create a session store at a custom dir (for tests). */
+export function createSessionStore(dir) {
+    return new SessionStore(dir);
+}
+/** Format a session for human output. */
+export function formatSession(rec) {
+    const d = new Date(rec.createdAt).toISOString().slice(0, 19).replace('T', ' ');
+    return `${rec.id.slice(0, 8)}  ${rec.status.padEnd(12)} ${d}  ${rec.cwd}  "${rec.task.slice(0, 60)}"`;
+}
+/** Resolve a short id prefix to full id (like git). */
+export async function resolveSessionId(store, prefix) {
+    if (prefix.length >= 32) {
+        const rec = await store.get(prefix);
+        return rec ? rec.id : null;
+    }
+    const all = await store.list();
+    const matches = all.filter((r) => r.id.startsWith(prefix));
+    if (matches.length === 1)
+        return matches[0].id;
+    if (matches.length === 0)
+        return null;
+    // ambiguous — return null and let caller report
+    return null;
+}

package/dist/policy/engine.d.ts

@@ -30,13 +30,22 @@ export interface PolicyContext {
     /** Per-tool config. */
     config: PolicyConfig;
 }
+export type PermissionMode = 'default' | 'accept-edits' | 'plan' | 'auto';
 export interface PolicyConfig {
+    /** Permission mode */
+    mode?: PermissionMode;
     /** Shell commands that are pre-approved (prefix match). */
     shellAllow: string[];
     /** Hard-deny shell commands (prefix or full match). */
     shellDeny: string[];
     /** File size limit in MiB for reads without confirmation. */
     readSizeAskMiB: number;
+    /** Glob rules: e.g. "write_file", "write_file(.env)", "shell_exec(npm *)" */
+    allow?: string[];
+    deny?: string[];
+    ask?: string[];
+    /** Additional allowed directories (sandbox) */
+    additionalDirs?: string[];
 }
 export interface PolicyRule {
     name: string;
@@ -57,6 +66,7 @@ export declare class PolicyEngine {
         transcript?: unknown;
         nonInteractive: boolean;
     }): Promise<Decision>;
+    private evaluateGlobRules;
 }
 /** Builtin set of rules. Order matters: first match wins. */
 export declare function builtinRules(): PolicyRule[];
@@ -64,7 +74,7 @@ export declare function builtinRules(): PolicyRule[];
 export declare const shellDenyRule: PolicyRule;
 /** Allowlist for shell — exact or prefix. Anything not in the list asks. */
 export declare const shellAllowRule: PolicyRule;
-/** Writes are auto-allowed if path resolves inside cwd (path-guard throws otherwise). */
+/** Writes are auto-allowed if path resolves inside cwd or --add-dir (path-guard throws otherwise). */
 export declare const writeFileCwdRule: PolicyRule;
 /** Reads > 5 MiB require confirmation (avoid filling the context window). */
 export declare const readFileSizeRule: PolicyRule;

package/dist/policy/engine.js

@@ -8,6 +8,7 @@
  */
 import { safe } from '../tools/normalize.js';
 export const DEFAULT_POLICY_CONFIG = {
+    mode: 'default',
     shellAllow: [
         'git',
         'ls',
@@ -36,6 +37,10 @@ export const DEFAULT_POLICY_CONFIG = {
         'bcdedit',
     ],
     readSizeAskMiB: 5,
+    allow: [],
+    deny: [],
+    ask: [],
+    additionalDirs: [],
 };
 /**
  * Compose multiple rules. The first rule to return a Decision wins.
@@ -55,6 +60,37 @@ export class PolicyEngine {
             nonInteractive: base.nonInteractive,
             config: this.config,
         };
+        // 3.4 — Permission modes
+        if (ctx.config.mode === 'auto') {
+            // auto / --yolo: allow everything (except hard deny already handled)
+        }
+        else if (ctx.config.mode === 'plan') {
+            // plan mode: block all writes (edit)
+            if (call.name === 'write_file' || call.name === 'edit_file') {
+                return { action: 'deny', reason: 'plan mode: writes blocked — use /permissions to allow or switch mode' };
+            }
+        }
+        else if (ctx.config.mode === 'accept-edits') {
+            // accept-edits: auto-allow edit tools
+            if (call.name === 'write_file' || call.name === 'edit_file') {
+                // fall through to allow, but still check .env below
+            }
+        }
+        // 3.4 — Glob rules allow/deny/ask with precedence deny → allow → ask
+        const globDecision = this.evaluateGlobRules(call);
+        if (globDecision)
+            return globDecision;
+        // 3.4 — .env guard: deny writes to .env files unless explicitly allowed
+        if ((call.name === 'write_file' || call.name === 'edit_file') && typeof call.input.path === 'string') {
+            const p = String(call.input.path);
+            if (/(^|\/)\.env(\.|$)/.test(p) || p.endsWith('.env')) {
+                // Check if explicitly allowed via allow list
+                const allowed = (ctx.config.allow ?? []).some((r) => r.includes('.env'));
+                if (!allowed) {
+                    return { action: 'deny', reason: 'write to .env denied by policy — add to allow list or use --yolo' };
+                }
+            }
+        }
         for (const rule of this.rules) {
             const d = rule.evaluate(call, ctx);
             if (d)
@@ -62,6 +98,24 @@ export class PolicyEngine {
         }
         return { action: 'allow' };
     }
+    evaluateGlobRules(call) {
+        const check = (list, action) => {
+            if (!list || list.length === 0)
+                return null;
+            for (const rule of list) {
+                if (matchesGlobRule(call, rule)) {
+                    if (action === 'allow')
+                        return { action: 'allow' };
+                    if (action === 'deny')
+                        return { action: 'deny', reason: `denied by rule: ${rule}` };
+                    return { action: 'ask', reason: `requires approval per rule: ${rule}` };
+                }
+            }
+            return null;
+        };
+        // Precedence: deny → allow → ask
+        return check(this.config.deny, 'deny') ?? check(this.config.allow, 'allow') ?? check(this.config.ask, 'ask') ?? null;
+    }
 }
 /** Builtin set of rules. Order matters: first match wins. */
 export function builtinRules() {
@@ -75,6 +129,26 @@ export function builtinRules() {
 function asString(v) {
     return typeof v === 'string' ? v : '';
 }
+function matchesGlobRule(call, rule) {
+    // Rule grammar: tool or tool(glob). e.g. "write_file", "write_file(.env)", "shell_exec(npm *)"
+    const m = /^([a-z_]+)(?:\((.*)\))?$/.exec(rule.trim());
+    if (!m)
+        return false;
+    const tool = m[1];
+    const glob = m[2];
+    if (tool !== call.name)
+        return false;
+    if (glob === undefined)
+        return true; // any input for that tool
+    // For shell, match command; for file tools, match path
+    const target = typeof call.input.command === 'string' ? String(call.input.command)
+        : typeof call.input.path === 'string' ? String(call.input.path)
+            : JSON.stringify(call.input);
+    // Simple glob: * matches any, ? matches single, otherwise substring
+    const regexStr = glob.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*').replace(/\?/g, '.');
+    const re = new RegExp(`^${regexStr}$`, 'i');
+    return re.test(target);
+}
 function startsWithAny(haystack, needles) {
     const h = haystack.trim().toLowerCase();
     return needles.some((n) => {
@@ -120,16 +194,25 @@ export const shellAllowRule = {
         return { action: 'ask', reason: `shell command not in allowlist: ${cmd.slice(0, 60)}` };
     },
 };
-/** Writes are auto-allowed if path resolves inside cwd (path-guard throws otherwise). */
+/** Writes are auto-allowed if path resolves inside cwd or --add-dir (path-guard throws otherwise). */
 export const writeFileCwdRule = {
     name: 'write-file-cwd',
-    evaluate(call) {
+    evaluate(call, ctx) {
         if (call.name !== 'write_file' && call.name !== 'edit_file')
             return null;
         const p = asString(call.input.path);
         if (!p)
             return null;
         if (p.includes('..') || path.isAbsolute(p)) {
+            // Check if absolute is inside additionalDirs
+            if (path.isAbsolute(p)) {
+                const allowed = (ctx.config.additionalDirs ?? []).some((dir) => {
+                    const rel = path.relative(path.resolve(dir), path.resolve(p));
+                    return !rel.startsWith('..') && !path.isAbsolute(rel);
+                });
+                if (allowed)
+                    return null;
+            }
             return { action: 'deny', reason: 'path traversal or absolute path not allowed' };
         }
         return null;