klyro 0.1.53 → 0.1.54

package/dist/agent/anthropic-adapter.js

@@ -115,6 +115,8 @@ async function* streamAnthropic(req, opts) {
     const toolBuffers = new Map();
     // Map content_block index → tool_use id (persists after tool completes to handle late deltas)
     const indexToToolId = new Map();
+    // message_stop already yields message_end — don't emit a second one at EOF.
+    let sawMessageEnd = false;
     try {
         while (true) {
             const { value, done } = await reader.read();
@@ -152,8 +154,11 @@ async function* streamAnthropic(req, opts) {
                     continue;
                 }
                 const out = translateSse(e.event, parsed, toolBuffers, indexToToolId);
-                for (const ev of out)
+                for (const ev of out) {
+                    if (ev.kind === 'message_end')
+                        sawMessageEnd = true;
                     yield ev;
+                }
             }
         }
     }
@@ -165,7 +170,8 @@ async function* streamAnthropic(req, opts) {
     finally {
         reader.releaseLock();
     }
-    yield { kind: 'message_end', finishReason: 'stop' };
+    if (!sawMessageEnd)
+        yield { kind: 'message_end', finishReason: 'stop' };
 }
 function translateSse(event, parsed, toolBuffers, indexToToolId) {
     const out = [];
@@ -277,6 +283,20 @@ function toAnthropicMessages(messages) {
                 }),
             };
         }
+        if (m.role === 'tool') {
+            // Anthropic has no tool role: tool_result blocks ride a user message,
+            // paired with the preceding assistant tool_use by tool_use_id.
+            const content = m.content.map((b) => {
+                if (b.kind === 'tool_result') {
+                    const out = typeof b.output === 'string' ? b.output : JSON.stringify(b.output ?? '');
+                    return { type: 'tool_result', tool_use_id: b.toolCallId, content: out, is_error: b.isError };
+                }
+                if (b.kind === 'text')
+                    return { type: 'text', text: b.text };
+                return { type: 'text', text: '' };
+            });
+            return { role: 'user', content };
+        }
         // 'system' is hoisted to the top-level `system` field; never appears
         // in the messages array passed to the adapter.
         return { role: 'user', content: [{ type: 'text', text: '' }] };

package/dist/agent/registry.js

@@ -19,6 +19,7 @@
 import * as fsSync from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
+import { assertSafeBaseURL } from '../chat.js';
 import { httpChatAdapter } from './provider-adapter.js';
 import { anthropicAdapter } from './anthropic-adapter.js';
 import { retryingAdapter } from './retry.js';
@@ -103,11 +104,12 @@ function persistedProviderSettings() {
         const baseURL = (cfg.baseUrl ?? cfg.baseURL);
         const provider = cfg.provider;
         const model = (cfg.model ?? cfg['model.default']);
+        const allowInsecure = cfg.allowInsecure === true;
         const apiKey = (cfg.apiKey ?? cfg.api_key) ??
             (provider ? keyOf(provider) : undefined) ??
             keyOf('openai') ??
             keyOf('anthropic');
-        return { baseURL, apiKey, provider, model };
+        return { baseURL, apiKey, provider, model, allowInsecure };
     }
     catch {
         return {};
@@ -118,6 +120,14 @@ export function buildProvider(opts = {}) {
     const baseURL = opts.baseURL ?? process.env.KLYRO_BASE_URL ?? saved.baseURL;
     const apiKey = opts.apiKey ?? process.env.KLYRO_API_KEY ?? saved.apiKey;
     const timeoutMs = opts.timeoutMs ?? 60_000;
+    // Same bearer-token guard as the TUI path: refuse plaintext HTTP to remote
+    // hosts unless explicitly opted in (persisted allowInsecure or env).
+    // (chat.ts has no imports — this static import cannot cycle.)
+    if (baseURL) {
+        assertSafeBaseURL(baseURL, {
+            allowInsecure: saved.allowInsecure === true || process.env.KLYRO_ALLOW_INSECURE === '1',
+        });
+    }
     // Resolve provider (with aliases like 9router -> openrouter -> openai)
     let provider;
     const normalizedOpt = normalizeProviderName(opts.provider);

package/dist/agent/retry.d.ts

@@ -30,5 +30,10 @@ export interface RetryOptions {
     onAttempt?: (attempt: number) => void;
 }
 export declare const DEFAULT_RETRY: Required<Omit<RetryOptions, 'signal' | 'onAttempt'>>;
+/**
+ * Sleep that resolves early when `signal` aborts (never rejects — callers
+ * check `signal.aborted` themselves after waking).
+ */
+export declare function sleepAbortable(ms: number, sleep: (ms: number) => Promise<void>, signal?: AbortSignal): Promise<void>;
 export declare function computeBackoff(attempt: number, baseMs: number, maxMs: number): number;
 export declare function retryingAdapter(inner: ProviderAdapter, opts?: Partial<RetryOptions>): ProviderAdapter;

package/dist/agent/retry.js

@@ -57,6 +57,31 @@ async function* streamWithAbort(source, signal) {
         }
     }
 }
+/**
+ * Sleep that resolves early when `signal` aborts (never rejects — callers
+ * check `signal.aborted` themselves after waking).
+ */
+export function sleepAbortable(ms, sleep, signal) {
+    if (ms <= 0)
+        return Promise.resolve();
+    // No signal: plain sleep (identical to the old behavior).
+    if (!signal)
+        return sleep(ms);
+    if (signal.aborted)
+        return Promise.resolve();
+    return new Promise((resolve) => {
+        let done = false;
+        const finish = () => {
+            if (done)
+                return;
+            done = true;
+            signal.removeEventListener('abort', finish);
+            resolve();
+        };
+        signal.addEventListener('abort', finish, { once: true });
+        void sleep(ms).then(finish);
+    });
+}
 export function computeBackoff(attempt, baseMs, maxMs) {
     const exp = Math.min(maxMs, baseMs * 2 ** attempt);
     // Jitter: ±25% to spread thundering herds.
@@ -128,8 +153,10 @@ export function retryingAdapter(inner, opts = {}) {
                     return;
                 }
                 const delay = computeBackoff(attempt, cfg.baseMs, cfg.maxMs);
+                // Abort-aware backoff: Ctrl+C during the sleep must stop promptly
+                // instead of stalling up to maxMs before noticing.
                 if (delay > 0)
-                    await sleep(delay);
+                    await sleepAbortable(delay, sleep, effectiveSignal);
             }
         },
     };

package/dist/agent/runtime.d.ts

@@ -173,6 +173,8 @@ export interface RunResult {
     toolCalls: number;
     finalText: string;
     transcript: Message[];
+    /** Whether any file-mutating tool ran (drives --require-verify semantics). */
+    hasEdits: boolean;
     usage: {
         input: number;
         output: number;

package/dist/agent/runtime.js

@@ -180,13 +180,13 @@ export async function run(opts, deps) {
             if (cost >= maxCost) {
                 setPhase('limit');
                 await closeTracer();
-                return { status: 'limit', steps, toolCalls: toolCallCount, finalText: `Stopped: max cost $${maxCost} reached (cost $${cost.toFixed(2)})`, transcript, usage, repairs, phase: 'limit' };
+                return { status: 'limit', steps, toolCalls: toolCallCount, finalText: `Stopped: max cost $${maxCost} reached (cost $${cost.toFixed(2)})`, transcript, hasEdits, usage, repairs, phase: 'limit' };
             }
         }
         if (maxTimeMs !== undefined && Date.now() - startTime >= maxTimeMs) {
             setPhase('limit');
             await closeTracer();
-            return { status: 'limit', steps, toolCalls: toolCallCount, finalText: `Stopped: max time ${maxTimeMs}ms reached`, transcript, usage, repairs, phase: 'limit' };
+            return { status: 'limit', steps, toolCalls: toolCallCount, finalText: `Stopped: max time ${maxTimeMs}ms reached`, transcript, hasEdits, usage, repairs, phase: 'limit' };
         }
         if (opts.signal?.aborted) {
             emit?.({ kind: 'aborted' });
@@ -197,7 +197,7 @@ export async function run(opts, deps) {
                 catch { /* ignore */ }
             }
             await closeTracer();
-            return { status: 'aborted', steps, toolCalls: toolCallCount, finalText, transcript, usage, repairs, verification: hasEdits ? { ok: false, attempts: verificationAttempts } : undefined, phase: 'blocked' };
+            return { status: 'aborted', steps, toolCalls: toolCallCount, finalText, transcript, hasEdits, usage, repairs, verification: hasEdits ? { ok: false, attempts: verificationAttempts } : undefined, phase: 'blocked' };
         }
         steps++;
         // 5.1 phase transitions (model-narrated)
@@ -282,6 +282,7 @@ export async function run(opts, deps) {
                     toolCalls: toolCallCount,
                     finalText: textBuf,
                     transcript,
+                    hasEdits,
                     usage,
                     repairs,
                     verification: hasEdits ? { ok: false, attempts: verificationAttempts } : undefined,
@@ -321,7 +322,7 @@ export async function run(opts, deps) {
                 catch { /* ignore */ }
             }
             await closeTracer();
-            return { status: 'aborted', steps, toolCalls: toolCallCount, finalText, transcript, usage, repairs, verification: hasEdits ? { ok: false, attempts: verificationAttempts } : undefined };
+            return { status: 'aborted', steps, toolCalls: toolCallCount, finalText, transcript, hasEdits, usage, repairs, verification: hasEdits ? { ok: false, attempts: verificationAttempts } : undefined };
         }
         if (finalizedCalls.length === 0) {
             finalText = textBuf;
@@ -340,35 +341,39 @@ export async function run(opts, deps) {
                 const isScoped = !!scopedCmd;
                 if (isScoped)
                     emit?.({ kind: 'verification_started', command: cmdToRun });
-                try {
-                    if (isScoped) {
-                        const sr = await runScopedVerify(opts.cwd, cmdToRun, opts.verify?.timeoutMs);
-                        const det = sr.ok ? undefined : (await import('../verification/detect.js')).detect(sr.stdout, sr.stderr, sr.exitCode);
-                        vResult = { ok: sr.ok, exitCode: sr.exitCode, stdout: sr.stdout, stderr: sr.stderr, ...(det ? { failure: det } : {}) };
+                // 6.3 — cheap sanity checks FIRST (fail fast before the suite runs).
+                // (Previously these ran after a green verify — pure waste.)
+                let sanityVResult;
+                for (const f of edited.slice(-3)) {
+                    const sc = await syntaxCheck(opts.cwd, f);
+                    if (!sc.ok) {
+                        sanityVResult = { ok: false, exitCode: 1, stdout: '', stderr: sc.error ?? `syntax error ${f}`, failure: { type: 'build', files: [{ path: f, message: sc.error ?? 'syntax error' }], raw: sc.error ?? '', exitCode: 1 } };
+                        break;
                     }
-                    else {
-                        vResult = await verify({ cwd: opts.cwd, command: cmdToRun, timeoutMs: opts.verify?.timeoutMs });
+                    const ic = checkImports(opts.cwd, f);
+                    if (!ic.ok) {
+                        sanityVResult = { ok: false, exitCode: 1, stdout: '', stderr: `missing imports in ${f}: ${ic.missing.join(', ')}`, failure: { type: 'build', files: ic.missing.map((m) => ({ path: f, message: `missing import ${m}` })), raw: `missing imports ${ic.missing.join(', ')}`, exitCode: 1 } };
+                        break;
                     }
                 }
-                catch (e) {
-                    const msg = e instanceof Error ? e.message : String(e);
-                    vResult = { ok: false, exitCode: -1, stdout: '', stderr: msg, failure: { type: 'unknown', files: [], raw: msg, exitCode: -1 } };
+                if (sanityVResult) {
+                    vResult = sanityVResult;
                 }
-                // 6.3 — sanity checks before full verify
-                if (vResult.ok) {
-                    // quick syntax/import guard for last edited files
-                    for (const f of edited.slice(-3)) {
-                        const sc = await syntaxCheck(opts.cwd, f);
-                        if (!sc.ok) {
-                            vResult = { ok: false, exitCode: 1, stdout: '', stderr: sc.error ?? `syntax error ${f}`, failure: { type: 'build', files: [{ path: f, message: sc.error ?? 'syntax error' }], raw: sc.error ?? '', exitCode: 1 } };
-                            break;
+                else {
+                    try {
+                        if (isScoped) {
+                            const sr = await runScopedVerify(opts.cwd, cmdToRun, opts.verify?.timeoutMs);
+                            const det = sr.ok ? undefined : (await import('../verification/detect.js')).detect(sr.stdout, sr.stderr, sr.exitCode);
+                            vResult = { ok: sr.ok, exitCode: sr.exitCode, stdout: sr.stdout, stderr: sr.stderr, ...(det ? { failure: det } : {}) };
                         }
-                        const ic = checkImports(opts.cwd, f);
-                        if (!ic.ok) {
-                            vResult = { ok: false, exitCode: 1, stdout: '', stderr: `missing imports in ${f}: ${ic.missing.join(', ')}`, failure: { type: 'build', files: ic.missing.map((m) => ({ path: f, message: `missing import ${m}` })), raw: `missing imports ${ic.missing.join(', ')}`, exitCode: 1 } };
-                            break;
+                        else {
+                            vResult = await verify({ cwd: opts.cwd, command: cmdToRun, timeoutMs: opts.verify?.timeoutMs });
                         }
                     }
+                    catch (e) {
+                        const msg = e instanceof Error ? e.message : String(e);
+                        vResult = { ok: false, exitCode: -1, stdout: '', stderr: msg, failure: { type: 'unknown', files: [], raw: msg, exitCode: -1 } };
+                    }
                 }
                 // If scoped passed but full may still fail, run full before declaring success
                 if (vResult.ok && isScoped) {
@@ -390,7 +395,7 @@ export async function run(opts, deps) {
                         catch { /* ignore */ }
                     }
                     await closeTracer();
-                    return { status: 'complete', steps, toolCalls: toolCallCount, finalText, transcript, usage, repairs, verification: { ok: true, command: verifyCmd, attempts: verificationAttempts } };
+                    return { status: 'complete', steps, toolCalls: toolCallCount, finalText, transcript, hasEdits, usage, repairs, verification: { ok: true, command: verifyCmd, attempts: verificationAttempts } };
                 }
                 // 6.4 — classify
                 const baseline = await getBaseline(opts.cwd, verifyCmd);
@@ -408,7 +413,7 @@ export async function run(opts, deps) {
                         catch { /* ignore */ }
                     }
                     await closeTracer();
-                    return { status: 'complete', steps, toolCalls: toolCallCount, finalText, transcript, usage, repairs, verification: { ok: true, command: verifyCmd, attempts: verificationAttempts } };
+                    return { status: 'complete', steps, toolCalls: toolCallCount, finalText, transcript, hasEdits, usage, repairs, verification: { ok: true, command: verifyCmd, attempts: verificationAttempts } };
                 }
                 if (cls === 'env') {
                     // don't try to repair env failures with code edits
@@ -419,7 +424,7 @@ export async function run(opts, deps) {
                     emit?.({ kind: 'verification_failed', step: String(steps), reason: `env: ${diagnosticForModel(vResult).slice(0, 600)}` });
                     if (verificationAttempts >= maxRepairs) {
                         await closeTracer();
-                        return { status: 'verify_failed', steps, toolCalls: toolCallCount, finalText, transcript, usage, repairs, verification: { ok: false, command: verifyCmd, attempts: verificationAttempts, failureType: 'env' } };
+                        return { status: 'verify_failed', steps, toolCalls: toolCallCount, finalText, transcript, hasEdits, usage, repairs, verification: { ok: false, command: verifyCmd, attempts: verificationAttempts, failureType: 'env' } };
                     }
                     emit?.({ kind: 'step_end', step: steps });
                     continue;
@@ -445,7 +450,7 @@ export async function run(opts, deps) {
                             catch { /* ignore */ }
                         }
                         await closeTracer();
-                        return { status: 'complete', steps, toolCalls: toolCallCount, finalText, transcript, usage, repairs, verification: { ok: true, command: verifyCmd, attempts: verificationAttempts } };
+                        return { status: 'complete', steps, toolCalls: toolCallCount, finalText, transcript, hasEdits, usage, repairs, verification: { ok: true, command: verifyCmd, attempts: verificationAttempts } };
                     }
                 }
                 // Failure → repair loop (introduced)
@@ -489,7 +494,7 @@ export async function run(opts, deps) {
                     emit?.({ kind: 'final_text', text: finalText });
                     emit?.({ kind: 'step_end', step: steps });
                     await closeTracer();
-                    return { status: 'verify_failed', steps, toolCalls: toolCallCount, finalText, transcript, usage, repairs, verification: { ok: false, command: verifyCmd, attempts: verificationAttempts, failureType } };
+                    return { status: 'verify_failed', steps, toolCalls: toolCallCount, finalText, transcript, hasEdits, usage, repairs, verification: { ok: false, command: verifyCmd, attempts: verificationAttempts, failureType } };
                 }
                 emit?.({ kind: 'step_end', step: steps });
                 continue; // -> next iteration lets model repair
@@ -503,7 +508,7 @@ export async function run(opts, deps) {
                 catch { /* ignore */ }
             }
             await closeTracer();
-            return { status: 'complete', steps, toolCalls: toolCallCount, finalText, transcript, usage, repairs, verification: hasEdits ? { ok: true, attempts: verificationAttempts } : undefined };
+            return { status: 'complete', steps, toolCalls: toolCallCount, finalText, transcript, hasEdits, usage, repairs, verification: hasEdits ? { ok: true, attempts: verificationAttempts } : undefined };
         }
         // 3.1 — emit turn events
         emitKlyro({ type: 'turn.start', ts: Date.now(), sessionId: sessionId ?? 'ephemeral', turn: steps, model: opts.model });
@@ -664,7 +669,7 @@ export async function run(opts, deps) {
             catch { /* ignore */ }
         }
         await closeTracer();
-        return { status: 'aborted', steps, toolCalls: toolCallCount, finalText, transcript, usage, repairs, verification: hasEdits ? { ok: false, attempts: verificationAttempts } : undefined };
+        return { status: 'aborted', steps, toolCalls: toolCallCount, finalText, transcript, hasEdits, usage, repairs, verification: hasEdits ? { ok: false, attempts: verificationAttempts } : undefined };
     }
     emit?.({ kind: 'final_text', text: finalText });
     if (store && sessionId) {
@@ -674,7 +679,7 @@ export async function run(opts, deps) {
         catch { /* ignore */ }
     }
     await closeTracer();
-    return { status: 'max_steps', steps, toolCalls: toolCallCount, finalText, transcript, usage, repairs, verification: hasEdits ? { ok: false, attempts: verificationAttempts } : undefined };
+    return { status: 'max_steps', steps, toolCalls: toolCallCount, finalText, transcript, hasEdits, usage, repairs, verification: hasEdits ? { ok: false, attempts: verificationAttempts } : undefined };
 }
 function redactOutput(v) {
     if (typeof v === 'string')
@@ -702,7 +707,7 @@ function inferFileChanged(toolName, input, output) {
     const inPath = typeof input.path === 'string' ? input.path : null;
     if (!inPath)
         return null;
-    if (toolName === 'write_file' || toolName === 'edit_file') {
+    if (toolName === 'write_file' || toolName === 'edit_file' || toolName === 'multi_edit') {
         // Distinguish create vs modify by the output shape: write_file returns
         // { path, bytesWritten }; edit_file returns { path, replacements, diff }.
         // Both are "modified" semantically; we don't have the pre-state easily
@@ -710,6 +715,14 @@ function inferFileChanged(toolName, input, output) {
         // file before/after the call. For now: treat both as 'modified'.
         return { path: inPath, op: 'modified' };
     }
+    if (toolName === 'apply_patch') {
+        // apply_patch has no path input — infer from its patchedFiles output.
+        const files = output?.patchedFiles;
+        if (Array.isArray(files) && typeof files[0] === 'string') {
+            return { path: files[0], op: 'modified' };
+        }
+        return null;
+    }
     return null;
 }
 export function defaultSystemPrompt(ctx) {

package/dist/chat.js

@@ -57,8 +57,8 @@ export function assertSafeBaseURL(url, opts) {
         if (/^172\.(1[6-9]|2\d|3[0-1])\.\d+\.\d+$/.test(host))
             return;
         throw new Error(`Refusing to send KLYRO_API_KEY over plaintext HTTP to ${host}. ` +
-            `Use https:// or a localhost/private URL, or set KLYRO_ALLOW_INSECURE=1 to allow insecure HTTP (not recommended). ` +
-            `Example: $Env:KLYRO_ALLOW_INSECURE=\"1\"; klyro`);
+            `Use https:// or a localhost/private URL, or allow once via \`klyro config set allowInsecure true\` (persisted, only for hosts you trust), ` +
+            `or set KLYRO_ALLOW_INSECURE=1 for this terminal only (not recommended).`);
     }
     throw new Error(`Unsupported KLYRO_BASE_URL protocol: ${parsed.protocol}`);
 }

package/dist/checkpoints/store.js

@@ -7,32 +7,97 @@ import * as crypto from 'node:crypto';
 function ckptDir(cwd) {
     return path.join(cwd, '.klyro', 'checkpoints');
 }
+/**
+ * Resolve a checkpoint file list entry inside cwd. Returns null for anything
+ * escaping the project (no arbitrary read/write outside cwd, via either the
+ * source read, the snapshot copy, or a tampered .meta.json on undo).
+ */
+function containedPath(cwd, base, rel) {
+    const out = path.resolve(base, rel);
+    const relOut = path.relative(cwd, out);
+    if (relOut.startsWith('..') || path.isAbsolute(relOut))
+        return null;
+    return out;
+}
 export async function snapshot(cwd, files) {
     const dir = ckptDir(cwd);
     await fs.mkdir(dir, { recursive: true });
     const id = `${Date.now()}-${crypto.randomBytes(4).toString('hex')}`;
     const dest = path.join(dir, id);
     await fs.mkdir(dest, { recursive: true });
+    const missing = [];
+    const kept = [];
     for (const f of files) {
         try {
-            const src = path.resolve(cwd, f);
+            const src = containedPath(cwd, cwd, f);
+            if (!src)
+                continue;
             const data = await fs.readFile(src);
             const rel = path.relative(cwd, src);
-            const out = path.join(dest, rel);
+            const out = containedPath(cwd, dest, rel);
+            if (!out)
+                continue;
             await fs.mkdir(path.dirname(out), { recursive: true });
             await fs.writeFile(out, data);
+            kept.push(rel);
+        }
+        catch (e) {
+            // Record deletions so undo() can restore the deleted state.
+            if (e?.code === 'ENOENT')
+                missing.push(f);
         }
-        catch { /* ignore missing */ }
     }
     // Save meta
-    await fs.writeFile(path.join(dest, '.meta.json'), JSON.stringify({ id, files, ts: Date.now() }, null, 2));
+    await fs.writeFile(path.join(dest, '.meta.json'), JSON.stringify({ id, files: kept, missing, ts: Date.now() }, null, 2));
+    // Best-effort last.diff for the repair guard (guardRepair reads it).
+    try {
+        const { spawn } = await import('node:child_process');
+        const args = ['diff', '--', ...kept.slice(0, 20)];
+        const diffText = await new Promise((resolve) => {
+            const child = spawn('git', args, { cwd, shell: false, windowsHide: true });
+            const chunks = [];
+            let done = false;
+            const t = setTimeout(() => {
+                if (!done) {
+                    done = true;
+                    try {
+                        child.kill();
+                    }
+                    catch { /* ignore */ }
+                    resolve('');
+                }
+            }, 10_000);
+            child.stdout.on('data', (b) => {
+                if (Buffer.concat(chunks).length < 20 * 1024)
+                    chunks.push(b);
+            });
+            child.on('close', () => {
+                if (done)
+                    return;
+                done = true;
+                clearTimeout(t);
+                resolve(Buffer.concat(chunks).toString('utf-8').slice(0, 20 * 1024));
+            });
+            child.on('error', () => {
+                if (done)
+                    return;
+                done = true;
+                clearTimeout(t);
+                resolve('');
+            });
+        });
+        if (diffText)
+            await fs.writeFile(path.join(dir, 'last.diff'), diffText, 'utf-8');
+    }
+    catch { /* best-effort only */ }
     return id;
 }
 export async function listCheckpoints(cwd) {
     const dir = ckptDir(cwd);
     try {
         const entries = await fs.readdir(dir);
-        return entries.filter((e) => !e.startsWith('.')).sort();
+        // last.diff is a guard artifact, not a checkpoint (must never be an undo target).
+        return entries.filter((e) => !e.startsWith('.') && e !== 'last.diff').sort();
     }
     catch {
         return [];
@@ -61,15 +126,29 @@ export async function undo(cwd, n = 1) {
     const srcDir = path.join(ckptDir(cwd), target);
     const metaRaw = await fs.readFile(path.join(srcDir, '.meta.json'), 'utf-8');
     const meta = JSON.parse(metaRaw);
+    // Restore modified/created files to their snapshotted content…
     for (const f of meta.files) {
-        const src = path.join(srcDir, f);
-        const dest = path.resolve(cwd, f);
+        const src = containedPath(cwd, srcDir, f);
+        const dest = src ? containedPath(cwd, cwd, f) : null;
+        if (!src || !dest)
+            continue;
         try {
             const data = await fs.readFile(src);
+            await fs.mkdir(path.dirname(dest), { recursive: true });
             await fs.writeFile(dest, data);
         }
         catch { /* ignore */ }
     }
+    // …and re-delete files that did not exist at snapshot time.
+    for (const f of meta.missing ?? []) {
+        const dest = containedPath(cwd, cwd, f);
+        if (!dest)
+            continue;
+        try {
+            await fs.unlink(dest);
+        }
+        catch { /* already gone */ }
+    }
 }
 export async function rewind(cwd) {
     return undo(cwd, 1);

package/dist/cli/config.js

@@ -159,8 +159,12 @@ function getByPath(obj, dotted) {
     }
     return cur;
 }
+const UNSAFE_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
 function setByPath(obj, dotted, value) {
     const parts = dotted.split('.');
+    if (parts.some((p) => UNSAFE_KEYS.has(p))) {
+        throw new Error(`refusing to set prototype-polluting key: ${dotted}`);
+    }
     let cur = obj;
     for (let i = 0; i < parts.length - 1; i++) {
         const p = parts[i];
@@ -173,6 +177,8 @@ function setByPath(obj, dotted, value) {
 }
 function deleteByPath(obj, dotted) {
     const parts = dotted.split('.');
+    if (parts.some((p) => UNSAFE_KEYS.has(p)))
+        return false;
     let cur = obj;
     for (let i = 0; i < parts.length - 1; i++) {
         const p = parts[i];
@@ -302,8 +308,14 @@ export async function loadMergedConfig(cwd = process.cwd(), flags = {}) {
     const merged = {};
     for (const layer of layers) {
         for (const [k, v] of Object.entries(layer)) {
-            if (v !== undefined)
+            if (v === undefined)
+                continue;
+            try {
                 setByPath(merged, k, v);
+            }
+            catch {
+                continue; // e.g. prototype-polluting keys in a config file — skip, never crash startup
+            }
         }
     }
     return merged;