klyro 0.1.53 → 0.1.55

package/dist/cli/repl.js

@@ -14,7 +14,7 @@ import { httpChatAdapter } from '../agent/provider-adapter.js';
 import { anthropicAdapter } from '../agent/anthropic-adapter.js';
 import { run } from '../agent/runtime.js';
 import { builtinRegistry } from '../tools/registry.js';
-import { builtinRules, DEFAULT_POLICY_CONFIG, PolicyEngine } from '../policy/engine.js';
+import { builtinRules, clonePolicyConfig, PolicyEngine } from '../policy/engine.js';
 import { buildLevel6Context } from '../context/level6.js';
 import { DenyAllApprovalPrompt, StdinApprovalPrompt } from '../policy/approval.js';
 import { TuiApprovalBridge } from '../tui/approval.js';
@@ -68,7 +68,9 @@ export async function startRepl(opts = {}) {
     let model = opts.model ?? resolved.model;
     let cwd = opts.cwd ?? process.cwd();
     const registry = builtinRegistry();
-    const policy = new PolicyEngine(builtinRules(), DEFAULT_POLICY_CONFIG);
+    // Clone: /mode and /sandbox mutate this config — it must never leak into
+    // the shared DEFAULT_POLICY_CONFIG across sessions.
+    const policy = new PolicyEngine(builtinRules(), clonePolicyConfig());
     const providerKind = inferProviderFromBaseURL(baseUrl);
     // Local Ollama exposes OpenAI-compat but hostname could contain "anthropic"
     // via proxy — don't try anthropic adapter with empty key (would 401).
@@ -252,7 +254,15 @@ export async function startRepl(opts = {}) {
                 const home = process.env.HOME ?? process.env.USERPROFILE ?? cwd;
                 const dir = nodePath.join(home, '.klyro');
                 fsSync.mkdirSync(dir, { recursive: true });
-                fsSync.appendFileSync(nodePath.join(dir, 'debug.log'), line + '\n');
+                const logFile = nodePath.join(dir, 'debug.log');
+                // Rotation: never let the debug log grow without bound (2 MiB cap).
+                try {
+                    if (fsSync.statSync(logFile).size > 2 * 1024 * 1024) {
+                        fsSync.renameSync(logFile, `${logFile}.1`);
+                    }
+                }
+                catch { /* missing — fine */ }
+                fsSync.appendFileSync(logFile, line + '\n');
             }
             catch { /* ignore */ }
         };
@@ -327,6 +337,42 @@ export async function startRepl(opts = {}) {
         }
         catch { /* best-effort */ }
     }
+    /** Extract display text from a read_file result ({lines[]} shape). */
+    function readFileBody(value) {
+        const v = value;
+        if (typeof v?.content === 'string')
+            return v.content;
+        if (Array.isArray(v?.lines))
+            return v.lines.join('\n');
+        if (typeof v?.text === 'string')
+            return v.text;
+        return JSON.stringify(v ?? '');
+    }
+    /**
+     * Build the attached-files context block (/attach, @path, /mention feed
+     * this — previously they were display-only and never reached the agent).
+     * Re-read fresh at prompt time (5 files, 2k chars each, 8k total cap).
+     */
+    async function buildAttachedBlock() {
+        if (attachedFiles.size === 0)
+            return '';
+        const parts = [];
+        let total = 0;
+        for (const file of [...attachedFiles.keys()].slice(0, 5)) {
+            try {
+                const r = await registry.execute('read_file', { path: file }, { cwd, env: process.env, nonInteractive: true });
+                if (!r.ok)
+                    continue;
+                const body = readFileBody(r.value).slice(0, 2000);
+                if (total + body.length > 8000)
+                    break;
+                total += body.length;
+                parts.push(`<attached file="${file}">\n${body}\n</attached>`);
+            }
+            catch { /* ignore */ }
+        }
+        return parts.length > 0 ? `\n\n${parts.join('\n\n')}` : '';
+    }
     /** Truncation budget honoring /verbose and /raw. */
     function outCap(s) {
         const cap = rawMode ? 12000 : verboseMode ? 8000 : 4000;
@@ -338,10 +384,11 @@ export async function startRepl(opts = {}) {
             throw new Error(r.error.message ?? 'shell failed');
         return r.value;
     }
-    /** Read-only LLM answer (no tools) — powers /ask and /explain. */
+    /** Read-only LLM answer (no tools) — powers /ask, /explain, /compact. */
     async function answerReadOnly(question, context) {
         const sys = systemPromptFn({ cwd, telemetry: '' }) + '\n\nAnswer read-only: do not call tools, do not edit files.';
-        const userText = context ? `${question}\n\n<context>\n${context.slice(0, 6000)}\n</context>` : question;
+        const attached = await buildAttachedBlock();
+        const userText = (context ? `${question}\n\n<context>\n${context.slice(0, 6000)}\n</context>` : question) + attached;
         const req = {
             model,
             system: sys,
@@ -362,11 +409,13 @@ export async function startRepl(opts = {}) {
             }
             lastAssistantText = text;
             queuedStatus({ status: 'done' });
+            return text;
         }
         catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
             queuedAppend({ id: `ro-err-${Date.now()}`, kind: 'error', message: msg });
             queuedStatus({ status: 'error', errorMessage: msg });
+            return '';
         }
     }
     function queuedClear() {
@@ -430,9 +479,16 @@ export async function startRepl(opts = {}) {
             queuedStatus({ status: 'error', errorMessage: 'no model configured' });
             return;
         }
+        // Fresh read-guard scope per task: reads from a previous task must not
+        // satisfy write guards in this one (same process, shared module state).
+        try {
+            const { clearReadHistory } = await import('../tools/fs/read-history.js');
+            clearReadHistory();
+        }
+        catch { /* ignore */ }
         // 2.3 image handling: extract @img refs
         const { text: cleanText, images } = parseImageInput(text);
-        const taskText = images.length > 0 ? `${cleanText}\n\n[images: ${images.join(', ')}]` : cleanText;
+        let taskText = images.length > 0 ? `${cleanText}\n\n[images: ${images.join(', ')}]` : cleanText;
         // Only create session for non-trivial tasks (with tools/verify) — plain chat like "hello" is not a persisted session
         const isSimpleChat = taskText.trim().split(/\s+/).length <= 5 && !taskText.toLowerCase().includes('fix') && !taskText.toLowerCase().includes('add') && !taskText.toLowerCase().includes('create');
         let sessionId;
@@ -449,6 +505,8 @@ export async function startRepl(opts = {}) {
             }
         }
         queuedStatus({ status: 'running', step: 0, model });
+        // Attached files ride along (fresh re-read, capped) on both paths.
+        taskText += await buildAttachedBlock();
         // Simple chat like "hello" must NOT trigger tool calls — direct LLM chat, no tools, no files
         if (isSimpleChat) {
             try {
@@ -844,15 +902,57 @@ export async function startRepl(opts = {}) {
                 return;
             }
             case 'compact': {
+                // Real compaction (not a destructive clear): summarize the persisted
+                // session via a read-only pass, then clear the view and retain the
+                // summary as the new context anchor.
                 const focus = cmd.focus?.trim();
-                queuedClear();
-                queuedAppend({
-                    id: `compact-${Date.now()}`,
-                    kind: 'text',
-                    text: focus ? `Context compacted — transcript cleared (focus: ${focus}). Continuing fresh.` : 'Context compacted — transcript cleared. Continuing fresh.',
-                    role: 'assistant',
-                });
-                queuedStatus({ status: 'done' });
+                const compactFallback = () => {
+                    queuedClear();
+                    queuedAppend({
+                        id: `compact-${Date.now()}`,
+                        kind: 'text',
+                        text: focus ? `Context compacted — transcript cleared (focus: ${focus}). Continuing fresh.` : 'Context compacted — transcript cleared. Continuing fresh.',
+                        role: 'assistant',
+                    });
+                    queuedStatus({ status: 'done' });
+                };
+                if (!tuiSessionId) {
+                    compactFallback();
+                    return;
+                }
+                try {
+                    const msgs = await tuiStore.loadMessages(tuiSessionId);
+                    if (msgs.length === 0) {
+                        compactFallback();
+                        return;
+                    }
+                    const excerpt = msgs
+                        .slice(-60)
+                        .map((m) => {
+                        const c = m.content;
+                        const s = typeof c === 'string' ? c : JSON.stringify(c);
+                        return `[${m.role}] ${s.slice(0, 500)}`;
+                    })
+                        .join('\n')
+                        .slice(0, 12000);
+                    queuedAppend({ id: `compact-run-${Date.now()}`, kind: 'text', text: 'Compacting context (summarizing session)…', role: 'assistant' });
+                    const summary = await answerReadOnly(`Summarize this coding session in 10-15 lines for context retention: goal, key decisions, files changed, current state, next steps.${focus ? ` Focus on: ${focus}` : ''}\n\nSession:\n${excerpt}`);
+                    if (!summary.trim()) {
+                        compactFallback();
+                        return;
+                    }
+                    queuedClear();
+                    queuedAppend({
+                        id: `compact-done-${Date.now()}`,
+                        kind: 'text',
+                        text: `Context compacted — retained summary:\n\n${summary.slice(0, 4000)}`,
+                        role: 'assistant',
+                    });
+                    queuedStatus({ status: 'done' });
+                }
+                catch {
+                    compactFallback();
+                }
                 return;
             }
             case 'model': {
@@ -1069,7 +1169,11 @@ export async function startRepl(opts = {}) {
                 const cfg = policy.config;
                 const p = cmd.policy?.trim();
                 if (!p) {
-                    queuedAppend({ id: `sb-${Date.now()}`, kind: 'text', text: `sandbox dirs: ${JSON.stringify(cfg.additionalDirs ?? [])}\nusage: /sandbox <dir> (adds an allowed directory)`, role: 'assistant' });
+                    queuedAppend({ id: `sb-${Date.now()}`, kind: 'text', text: `sandbox dirs: ${JSON.stringify(cfg.additionalDirs ?? [])}\nusage: /sandbox <dir> (add) | /sandbox reset (clear)`, role: 'assistant' });
+                }
+                else if (p === 'reset') {
+                    cfg.additionalDirs = [];
+                    queuedAppend({ id: `sb3-${Date.now()}`, kind: 'text', text: 'sandbox: cleared allowed dirs', role: 'assistant' });
                 }
                 else {
                     cfg.additionalDirs = [...(cfg.additionalDirs ?? []), p];
@@ -1089,11 +1193,23 @@ export async function startRepl(opts = {}) {
             }
             case 'resume': {
                 try {
-                    const { resolveSessionId } = await import('../persistence/session.js');
+                    const { resolveSessionId, matchSessionIds } = await import('../persistence/session.js');
                     const all = (await tuiStore.list()).filter((r) => r.cwd === cwd).sort((a, b) => b.updatedAt - a.updatedAt);
                     const full = cmd.id ? await resolveSessionId(tuiStore, cmd.id) : all[0]?.id;
                     if (!full) {
-                        queuedAppend({ id: `resume-err-${Date.now()}`, kind: 'error', message: cmd.id ? `session not found: ${cmd.id}` : 'no previous session in this cwd' });
+                        if (cmd.id) {
+                            const matches = await matchSessionIds(tuiStore, cmd.id);
+                            queuedAppend({
+                                id: `resume-err-${Date.now()}`,
+                                kind: 'error',
+                                message: matches.length > 1
+                                    ? `ambiguous id "${cmd.id}" matches:\n${matches.map((r) => `  ${r.id.slice(0, 8)}  ${r.task.slice(0, 50)}`).join('\n')}`
+                                    : `session not found: ${cmd.id}`,
+                            });
+                        }
+                        else {
+                            queuedAppend({ id: `resume-err-${Date.now()}`, kind: 'error', message: 'no previous session in this cwd' });
+                        }
                         return;
                     }
                     const rec = await tuiStore.get(full);
@@ -1137,10 +1253,19 @@ export async function startRepl(opts = {}) {
             }
             case 'fork': {
                 try {
-                    const base = sessionLabel || 'session';
-                    const rec = await tuiStore.create({ cwd, task: `${base} (fork)${cmd.prompt ? `: ${cmd.prompt}` : ''}`, config: { model, maxSteps: currentMaxSteps } });
-                    tuiSessionId = rec.id;
-                    queuedAppend({ id: `fork-${Date.now()}`, kind: 'text', text: `forked → session ${rec.id.slice(0, 8)}`, role: 'assistant' });
+                    if (tuiSessionId) {
+                        const forked = await tuiStore.fork(tuiSessionId);
+                        const msgs = await tuiStore.loadMessages(forked.id);
+                        tuiSessionId = forked.id;
+                        sessionLabel = forked.task.slice(0, 40);
+                        queuedAppend({ id: `fork-${Date.now()}`, kind: 'text', text: `forked → session ${forked.id.slice(0, 8)} (${msgs.length} messages carried over)`, role: 'assistant' });
+                    }
+                    else {
+                        const base = sessionLabel || 'session';
+                        const rec = await tuiStore.create({ cwd, task: `${base} (fork)${cmd.prompt ? `: ${cmd.prompt}` : ''}`, config: { model, maxSteps: currentMaxSteps } });
+                        tuiSessionId = rec.id;
+                        queuedAppend({ id: `fork-${Date.now()}`, kind: 'text', text: `forked → session ${rec.id.slice(0, 8)}`, role: 'assistant' });
+                    }
                 }
                 catch (err) {
                     queuedAppend({ id: `fork-err-${Date.now()}`, kind: 'error', message: `fork failed: ${err instanceof Error ? err.message : String(err)}` });
@@ -1254,7 +1379,7 @@ export async function startRepl(opts = {}) {
                     }
                     else {
                         const v = r.value;
-                        const body = String(v.content ?? v.text ?? JSON.stringify(v)).slice(0, 6000);
+                        const body = readFileBody(v).slice(0, 6000);
                         queuedAppend({ id: `men2-${Date.now()}`, kind: 'text', text: `attached ${cmd.path} (${body.length} chars):\n${body}`, role: 'assistant' });
                     }
                 }
@@ -1287,7 +1412,7 @@ export async function startRepl(opts = {}) {
                             try {
                                 const fr = await registry.execute('read_file', { path: cmd.target }, { cwd, env: process.env, nonInteractive: true });
                                 if (fr.ok)
-                                    extra = `\n\n--- ${cmd.target} ---\n${String(fr.value.content ?? '').slice(0, 2000)}`;
+                                    extra = `\n\n--- ${cmd.target} ---\n${readFileBody(fr.value).slice(0, 2000)}`;
                             }
                             catch { /* ignore */ }
                         }
@@ -1445,7 +1570,7 @@ export async function startRepl(opts = {}) {
                     try {
                         const fr = await registry.execute('read_file', { path: cmd.target }, { cwd, env: process.env, nonInteractive: true });
                         if (fr.ok)
-                            ctx = `File ${cmd.target}:\n${String(fr.value.content ?? '').slice(0, 6000)}`;
+                            ctx = `File ${cmd.target}:\n${readFileBody(fr.value).slice(0, 6000)}`;
                     }
                     catch { /* symbol — answer without file context */ }
                     await answerReadOnly(`Explain ${cmd.target}: what it does, key logic, and gotchas.`, ctx || undefined);
@@ -1465,7 +1590,10 @@ export async function startRepl(opts = {}) {
                             queuedAppend({ id: `fmt2-${Date.now()}`, kind: 'text', text: 'prettier not installed — run `npm i -D prettier` first.', role: 'assistant' });
                         }
                         else {
-                            const fv = await execShell(`npx prettier --write ${files.map((f) => `"${f}"`).join(' ')}`);
+                            // Strip double quotes from paths (" is illegal in Windows
+                            // filenames and a shell escape vector everywhere else).
+                            const safeFiles = files.map((f) => f.replace(/"/g, ''));
+                            const fv = await execShell(`npx prettier --write ${safeFiles.map((f) => `"${f}"`).join(' ')}`);
                             queuedAppend({ id: `fmt3-${Date.now()}`, kind: 'text', text: fv.exitCode === 0 ? `[format] formatted ${files.length} file(s)` : `[format] failed:\n${outCap(fv.stderr || fv.stdout)}`, role: 'assistant' });
                         }
                     }
@@ -1727,7 +1855,11 @@ export async function startRepl(opts = {}) {
                     }
                     else {
                         cwd = abs;
-                        queuedAppend({ id: `cd2-${Date.now()}`, kind: 'text', text: `cwd → ${abs} (header refreshes on restart)`, role: 'assistant' });
+                        const { resetPersistentCwd } = await import('../tools/shell/shell-exec.js');
+                        resetPersistentCwd();
+                        const { clearReadHistory } = await import('../tools/fs/read-history.js');
+                        clearReadHistory();
+                        queuedAppend({ id: `cd2-${Date.now()}`, kind: 'text', text: `cwd → ${abs} (shell cwd + read guards reset; header refreshes on restart)`, role: 'assistant' });
                     }
                 }
                 return;
@@ -1743,7 +1875,7 @@ export async function startRepl(opts = {}) {
                             queuedAppend({ id: `att-err-${Date.now()}`, kind: 'error', message: `attach failed: ${r.error.message ?? 'read error'}` });
                         }
                         else {
-                            const body = String(r.value.content ?? '');
+                            const body = readFileBody(r.value);
                             attachedFiles.set(cmd.file, body.length);
                             queuedAppend({ id: `att2-${Date.now()}`, kind: 'text', text: `attached ${cmd.file} (${body.length} chars) — in context for future prompts`, role: 'assistant' });
                         }
@@ -1886,8 +2018,21 @@ export async function startRepl(opts = {}) {
                         const t = setTimeout(() => ctrl.abort(), 15_000);
                         const res = await fetch(cmd.url, { signal: ctrl.signal });
                         clearTimeout(t);
-                        const text = (await res.text()).replace(/<[^>]+>/g, ' ').replace(/\s+/g, ' ').trim().slice(0, 6000);
-                        queuedAppend({ id: `web2-${Date.now()}`, kind: 'text', text: `${cmd.url} [${res.status}]:\n${text || '(no text content)'}`, role: 'assistant' });
+                        // SSRF/OOM guard: refuse huge bodies before buffering.
+                        const declared = Number(res.headers.get('content-length') ?? 0);
+                        if (declared > 2 * 1024 * 1024) {
+                            queuedAppend({ id: `web-err-${Date.now()}`, kind: 'error', message: `refusing to fetch ${declared} byte body (2 MiB cap)` });
+                            return;
+                        }
+                        const raw = await res.text();
+                        const capped = raw.length > 256 * 1024;
+                        const text = raw
+                            .slice(0, 256 * 1024)
+                            .replace(/<[^>]+>/g, ' ')
+                            .replace(/\s+/g, ' ')
+                            .trim()
+                            .slice(0, 6000);
+                        queuedAppend({ id: `web2-${Date.now()}`, kind: 'text', text: `${cmd.url} [${res.status}]${capped ? ' [body capped at 256 KiB]' : ''}:\n${text || '(no text content)'}`, role: 'assistant' });
                     }
                     catch (err) {
                         queuedAppend({ id: `web-err-${Date.now()}`, kind: 'error', message: `fetch failed: ${err instanceof Error ? err.message : String(err)}` });
@@ -1906,7 +2051,7 @@ export async function startRepl(opts = {}) {
                             queuedAppend({ id: `read-err-${Date.now()}`, kind: 'error', message: `read failed: ${r.error.message ?? 'error'}` });
                         }
                         else {
-                            queuedAppend({ id: `read2-${Date.now()}`, kind: 'text', text: `${cmd.path}:\n${outCap(String(r.value.content ?? ''))}`, role: 'assistant' });
+                            queuedAppend({ id: `read2-${Date.now()}`, kind: 'text', text: `${cmd.path}:\n${outCap(readFileBody(r.value))}`, role: 'assistant' });
                         }
                     }
                     catch (err) {
@@ -1952,9 +2097,19 @@ export async function startRepl(opts = {}) {
                             queuedAppend({ id: `commit2-${Date.now()}`, kind: 'text', text: 'Nothing staged — stage changes with `git add` first.', role: 'assistant' });
                         }
                         else {
-                            const safeMsg = cmd.message.replace(/"/g, "'");
-                            const v = await execShell(`git commit -m "${safeMsg}"`);
-                            queuedAppend({ id: `commit3-${Date.now()}`, kind: 'text', text: v.exitCode === 0 ? `committed ${staged.length} file(s):\n${outCap(v.stdout)}` : `commit failed:\n${outCap(v.stderr || v.stdout)}`, role: 'assistant' });
+                            // Message via temp file (git commit -F): zero shell interpolation.
+                            const { writeFile, unlink } = await import('node:fs/promises');
+                            const { join } = await import('node:path');
+                            const { tmpdir } = await import('node:os');
+                            const msgFile = join(tmpdir(), `klyro-commit-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.txt`);
+                            await writeFile(msgFile, cmd.message, 'utf-8');
+                            try {
+                                const v = await execShell(`git commit -F "${msgFile}"`);
+                                queuedAppend({ id: `commit3-${Date.now()}`, kind: 'text', text: v.exitCode === 0 ? `committed ${staged.length} file(s):\n${outCap(v.stdout)}` : `commit failed:\n${outCap(v.stderr || v.stdout)}`, role: 'assistant' });
+                            }
+                            finally {
+                                await unlink(msgFile).catch(() => undefined);
+                            }
                         }
                     }
                     catch (err) {
@@ -2024,11 +2179,16 @@ export async function startRepl(opts = {}) {
                 }
                 else {
                     try {
-                        const { startBackground } = await import('../tools/shell/background.js');
+                        const { startBackgroundArgv } = await import('../tools/shell/background.js');
                         const { resolve } = await import('node:path');
                         const abs = resolve(cwd, file);
-                        const opener = process.platform === 'win32' ? `start "" "${abs}"` : process.platform === 'darwin' ? `open "${abs}"` : `xdg-open "${abs}"`;
-                        startBackground(opener, cwd);
+                        // argv form (shell:false) — the user-supplied path is never interpolated.
+                        const argv = process.platform === 'win32'
+                            ? ['cmd', '/c', 'start', '', abs]
+                            : process.platform === 'darwin'
+                                ? ['open', abs]
+                                : ['xdg-open', abs];
+                        startBackgroundArgv(argv, cwd);
                         queuedAppend({ id: `ed2-${Date.now()}`, kind: 'text', text: `opened ${abs} in background`, role: 'assistant' });
                     }
                     catch (err) {
@@ -2227,6 +2387,10 @@ export async function startRepl(opts = {}) {
                     if (!m) {
                         queuedAppend({ id: `env-err-${Date.now()}`, kind: 'error', message: 'usage: /env KEY=value' });
                     }
+                    else if (['NODE_OPTIONS', 'LD_PRELOAD', 'LD_LIBRARY_PATH'].includes(m[1])) {
+                        // Same injection-vector blocklist as shell_exec's filteredEnv.
+                        queuedAppend({ id: `env-err2-${Date.now()}`, kind: 'error', message: `refusing to set ${m[1]} (process injection vector)` });
+                    }
                     else {
                         process.env[m[1]] = m[2];
                         queuedAppend({ id: `env2-${Date.now()}`, kind: 'text', text: `set ${m[1]} (session-only)`, role: 'assistant' });

package/dist/cli/run.js

@@ -12,7 +12,7 @@ import { httpChatAdapter } from '../agent/provider-adapter.js';
 import { anthropicAdapter } from '../agent/anthropic-adapter.js';
 import { run } from '../agent/runtime.js';
 import { builtinRegistry } from '../tools/registry.js';
-import { builtinRules, DEFAULT_POLICY_CONFIG, PolicyEngine } from '../policy/engine.js';
+import { builtinRules, clonePolicyConfig, PolicyEngine } from '../policy/engine.js';
 import { DenyAllApprovalPrompt } from '../policy/approval.js';
 import { buildLevel6Context } from '../context/level6.js';
 import { resolveSessionId } from '../persistence/session.js';
@@ -24,8 +24,14 @@ function readEnv(name, fallback) {
 export async function runOnce(opts) {
     const output = opts.output ?? 'human';
     if (opts.dryRun) {
-        return dryRunReport(opts);
+        return await dryRunReport(opts);
     }
+    // Fresh read-guard scope per run (shared module state otherwise leaks across runs).
+    try {
+        const { clearReadHistory } = await import('../tools/fs/read-history.js');
+        clearReadHistory();
+    }
+    catch { /* ignore */ }
     let adapter = opts.adapter;
     if (!adapter) {
         const provider = opts.provider ?? 'openai';
@@ -52,7 +58,7 @@ export async function runOnce(opts) {
         }
     }
     const registry = builtinRegistry();
-    const policy = new PolicyEngine(builtinRules(), DEFAULT_POLICY_CONFIG);
+    const policy = new PolicyEngine(builtinRules(), clonePolicyConfig());
     const systemPrompt = await makeRunSystemPrompt(opts.cwd, opts.systemPrompt ?? defaultRunSystemPrompt);
     // Level 9 — session setup (create or resume)
     const persistEnabled = opts.persist !== false;
@@ -97,12 +103,16 @@ export async function runOnce(opts) {
         initialTranscript = loadTranscript(opts.resumePath);
     }
     const ac = new AbortController();
+    const onSigint = () => {
+        stderr.write('\nklyro: SIGINT — aborting\n');
+        ac.abort();
+    };
     if (opts.abortOnSigint !== false) {
-        process.on('SIGINT', () => {
-            stderr.write('\nklyro: SIGINT — aborting\n');
-            ac.abort();
-        });
+        process.once('SIGINT', onSigint);
     }
+    const doneSigint = () => {
+        process.removeListener('SIGINT', onSigint);
+    };
     const verifyOpts = opts.verify === false
         ? { enabled: false }
         : {
@@ -112,63 +122,69 @@ export async function runOnce(opts) {
             timeoutMs: opts.verifyTimeoutMs,
             requireVerify: opts.requireVerify,
         };
-    const result = await run({
-        task: opts.task,
-        cwd: opts.cwd,
-        model: opts.model,
-        maxSteps: opts.maxSteps,
-        maxTokens: opts.maxTokens,
-        temperature: opts.temperature,
-        signal: ac.signal,
-        nonInteractive: true,
-        initialTranscript,
-        verify: verifyOpts,
-        persist: store && sessionId ? { store, sessionId } : undefined,
-        onEvent: (ev) => {
-            if (output === 'json') {
-                stdout.write(JSON.stringify(ev) + '\n');
-                return;
-            }
-            if (output === 'silent') {
-                return;
-            }
-            // human mode
-            if (ev.kind === 'text_delta')
-                stdout.write(ev.text);
-            else if (ev.kind === 'tool_call_start') {
-                stderr.write(`\n[tool] ${ev.name} {\n`);
-            }
-            else if (ev.kind === 'tool_call_end') {
-                stderr.write(`\n}\n`);
-            }
-            else if (ev.kind === 'tool_result') {
-                const summary = typeof ev.output === 'string' ? ev.output.slice(0, 200) : JSON.stringify(ev.output).slice(0, 200);
-                stderr.write(`  -> ${ev.isError ? 'ERR ' : 'ok  '}(${ev.latencyMs}ms) ${summary}\n`);
-            }
-            else if (ev.kind === 'policy_decision' && ev.action !== 'allow') {
-                stderr.write(`  policy: ${ev.action}${ev.reason ? ` — ${ev.reason}` : ''}\n`);
-            }
-            else if (ev.kind === 'step_start') {
-                stderr.write(`\n[step ${ev.step}]\n`);
-            }
-            else if (ev.kind === 'verification_started') {
-                stderr.write(`\n[verify] running \`${ev.command}\`\n`);
-            }
-            else if (ev.kind === 'verification_succeeded') {
-                stderr.write(`[verify] passed\n`);
-            }
-            else if (ev.kind === 'verification_failed') {
-                stderr.write(`[verify] failed — ${ev.reason.slice(0, 200)}\n`);
-            }
-            else if (ev.kind === 'repair_started') {
-                stderr.write(`[repair] attempt ${ev.attempt}/${ev.maxAttempts}\n`);
-            }
-            else if (ev.kind === 'checkpoint_saved') {
-                if (output === 'human')
-                    stderr.write(`[session ${ev.sessionId.slice(0, 8)} checkpoint]\n`);
-            }
-        },
-    }, { adapter, registry, policy, approval: new DenyAllApprovalPrompt(), systemPrompt });
+    let result;
+    try {
+        result = await run({
+            task: opts.task,
+            cwd: opts.cwd,
+            model: opts.model,
+            maxSteps: opts.maxSteps,
+            maxTokens: opts.maxTokens,
+            temperature: opts.temperature,
+            signal: ac.signal,
+            nonInteractive: true,
+            initialTranscript,
+            verify: verifyOpts,
+            persist: store && sessionId ? { store, sessionId } : undefined,
+            onEvent: (ev) => {
+                if (output === 'json') {
+                    stdout.write(JSON.stringify(ev) + '\n');
+                    return;
+                }
+                if (output === 'silent') {
+                    return;
+                }
+                // human mode
+                if (ev.kind === 'text_delta')
+                    stdout.write(ev.text);
+                else if (ev.kind === 'tool_call_start') {
+                    stderr.write(`\n[tool] ${ev.name} {\n`);
+                }
+                else if (ev.kind === 'tool_call_end') {
+                    stderr.write(`\n}\n`);
+                }
+                else if (ev.kind === 'tool_result') {
+                    const summary = typeof ev.output === 'string' ? ev.output.slice(0, 200) : JSON.stringify(ev.output).slice(0, 200);
+                    stderr.write(`  -> ${ev.isError ? 'ERR ' : 'ok  '}(${ev.latencyMs}ms) ${summary}\n`);
+                }
+                else if (ev.kind === 'policy_decision' && ev.action !== 'allow') {
+                    stderr.write(`  policy: ${ev.action}${ev.reason ? ` — ${ev.reason}` : ''}\n`);
+                }
+                else if (ev.kind === 'step_start') {
+                    stderr.write(`\n[step ${ev.step}]\n`);
+                }
+                else if (ev.kind === 'verification_started') {
+                    stderr.write(`\n[verify] running \`${ev.command}\`\n`);
+                }
+                else if (ev.kind === 'verification_succeeded') {
+                    stderr.write(`[verify] passed\n`);
+                }
+                else if (ev.kind === 'verification_failed') {
+                    stderr.write(`[verify] failed — ${ev.reason.slice(0, 200)}\n`);
+                }
+                else if (ev.kind === 'repair_started') {
+                    stderr.write(`[repair] attempt ${ev.attempt}/${ev.maxAttempts}\n`);
+                }
+                else if (ev.kind === 'checkpoint_saved') {
+                    if (output === 'human')
+                        stderr.write(`[session ${ev.sessionId.slice(0, 8)} checkpoint]\n`);
+                }
+            },
+        }, { adapter, registry, policy, approval: new DenyAllApprovalPrompt(), systemPrompt });
+    }
+    finally {
+        doneSigint();
+    }
     if (store && sessionId) {
         // Finalize session status
         const statusMap = {
@@ -189,7 +205,7 @@ export async function runOnce(opts) {
             stderr.write('\n');
         }
     }
-    if (output !== 'json')
+    if (output === 'human')
         stdout.write('\n');
     if (result.status === 'max_steps') {
         if (output === 'json')
@@ -221,8 +237,8 @@ export async function runOnce(opts) {
             stderr.write('klyro: --require-verify: verification required but not passed\n');
         return 8;
     }
-    if (opts.requireVerify && !result.verification) {
-        // hasEdits but no verification command found
+    if (opts.requireVerify && !result.verification && result.hasEdits) {
+        // Edits were made but no verification command found
         if (output === 'json')
             stdout.write(JSON.stringify({ kind: 'final', status: 'require_verify_missing' }) + '\n');
         else
@@ -233,8 +249,11 @@ export async function runOnce(opts) {
         stdout.write(JSON.stringify({ kind: 'final', status: 'ok', text: result.finalText }) + '\n');
     return 0;
 }
-function dryRunReport(opts) {
-    const systemPrompt = (opts.systemPrompt ?? defaultRunSystemPrompt)({ cwd: opts.cwd });
+async function dryRunReport(opts) {
+    // Assemble the REAL prompt (Level-6 context + KLYRO.md), not the bare base —
+    // otherwise dry-run shows a different prompt than production runs use.
+    const systemPromptFn = await makeRunSystemPrompt(opts.cwd, opts.systemPrompt ?? defaultRunSystemPrompt);
+    const systemPrompt = systemPromptFn({ cwd: opts.cwd });
     const registry = builtinRegistry();
     const rules = builtinRules();
     const report = {

package/dist/context/klyro-md.d.ts

@@ -1,5 +1,10 @@
 /**
  * 4.4 — KLYRO.md loader: ~/.klyro/KLYRO.md → root → KLYRO.local.md → subdir files lazily
+ *
+ * Safety: @import targets are contained to the project cwd (escapes are
+ * skipped, not read — a malicious KLYRO.md must not pull /etc/passwd or
+ * secret files into context), each file is capped, and total output is
+ * capped so a giant monorepo doc can't blow the context budget.
  */
 export declare function loadKlyroMd(cwd: string): Promise<string>;
 export declare function handleInit(cwd: string): Promise<string>;