klyro 0.1.53 → 0.1.55

package/dist/context/klyro-md.js

@@ -1,35 +1,53 @@
 /**
  * 4.4 — KLYRO.md loader: ~/.klyro/KLYRO.md → root → KLYRO.local.md → subdir files lazily
+ *
+ * Safety: @import targets are contained to the project cwd (escapes are
+ * skipped, not read — a malicious KLYRO.md must not pull /etc/passwd or
+ * secret files into context), each file is capped, and total output is
+ * capped so a giant monorepo doc can't blow the context budget.
  */
 import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import * as os from 'node:os';
-const CACHE = new Map();
+const MAX_FILE_CHARS = 4000;
+const MAX_TOTAL_CHARS = 8000;
+function cap(s, n) {
+    return s.length > n ? s.slice(0, n) + `\n... [truncated ${s.length - n} chars]` : s;
+}
 export async function loadKlyroMd(cwd) {
     const parts = [];
+    let total = 0;
+    const push = (s) => {
+        if (total >= MAX_TOTAL_CHARS)
+            return;
+        const room = MAX_TOTAL_CHARS - total;
+        const chunk = s.length > room ? s.slice(0, room) + '\n... [truncated]' : s;
+        parts.push(chunk);
+        total += chunk.length;
+    };
     // Global
     const home = os.homedir();
     if (home) {
         for (const p of [path.join(home, '.klyro', 'KLYRO.md'), path.join(home, '.klyro', 'KLYRO.local.md')]) {
             try {
                 const t = await fs.readFile(p, 'utf-8');
-                parts.push(`# ${p}\n${t}`);
+                push(`# ${p}\n${cap(t, MAX_FILE_CHARS)}`);
             }
             catch { /* ignore */ }
         }
     }
-    // Root
+    // Root (imports resolved relative to each file, contained to cwd)
     for (const name of ['KLYRO.md', 'KLYRO.local.md', 'AGENTS.md', 'CLAUDE.md', '.cursorrules']) {
         const p = path.join(cwd, name);
         try {
             const t = await fs.readFile(p, 'utf-8');
-            parts.push(`# ${p}\n${await resolveImports(t, path.dirname(p))}`);
+            push(`# ${p}\n${cap(await resolveImports(t, path.dirname(p), cwd), MAX_FILE_CHARS)}`);
         }
         catch { /* ignore */ }
     }
     return parts.join('\n\n---\n\n');
 }
-async function resolveImports(text, base, depth = 0) {
+async function resolveImports(text, base, root, depth = 0) {
     if (depth > 5)
         return text;
     const importRe = /^@import\s+(.+)$/gm;
@@ -38,9 +56,13 @@ async function resolveImports(text, base, depth = 0) {
     while ((m = importRe.exec(text))) {
         const rel = m[1].trim().replace(/^["']|["']$/g, '');
         const p = path.resolve(base, rel);
+        // Containment: never follow imports outside the project root.
+        const relToRoot = path.relative(root, p);
+        if (relToRoot.startsWith('..') || path.isAbsolute(relToRoot))
+            continue;
         try {
             const t = await fs.readFile(p, 'utf-8');
-            const resolved = await resolveImports(t, path.dirname(p), depth + 1);
+            const resolved = await resolveImports(cap(t, MAX_FILE_CHARS), path.dirname(p), root, depth + 1);
             out = out.replace(m[0], resolved);
         }
         catch { /* ignore missing */ }

package/dist/context/tokenizer.js

@@ -93,10 +93,17 @@ export function compressTranscript(system, messages, budget) {
         }
     }
     // Phase 3: hard cap — drop oldest messages until we fit, but always
-    // preserve the first message (the user's task).
+    // preserve the first message (the user's task). Drops keep tool_use /
+    // tool_result PAIRS intact: removing an assistant turn also removes the
+    // tool messages that answer it, and an orphaned tool message (its turn
+    // already gone) is dropped on its own. Split pairs make providers 400.
     while (totalTokens(system, result) > budget.total && result.length > 2) {
         result.splice(1, 1);
         dropped++;
+        while (result[1] && result[1].role === 'tool') {
+            result.splice(1, 1);
+            dropped++;
+        }
     }
     return { system, messages: result, dropped };
 }

package/dist/index.js

@@ -435,11 +435,17 @@ async function main() {
         .description('Show session transcript and observations')
         .option('--json', 'Output JSON')
         .action(async (id, opts) => {
-        const { getDefaultSessionStore, resolveSessionId } = await import('./persistence/session.js');
+        const { getDefaultSessionStore, resolveSessionId, matchSessionIds } = await import('./persistence/session.js');
         const store = getDefaultSessionStore();
         const full = await resolveSessionId(store, id);
         if (!full) {
-            process.stderr.write(`session not found: ${id}\n`);
+            const matches = await matchSessionIds(store, id);
+            if (matches.length > 1) {
+                process.stderr.write(`ambiguous id "${id}" matches:\n${matches.map((r) => `  ${r.id.slice(0, 8)}  ${r.task.slice(0, 50)}`).join('\n')}\n`);
+            }
+            else {
+                process.stderr.write(`session not found: ${id}\n`);
+            }
             process.exit(2);
         }
         const rec = await store.get(full);
@@ -466,11 +472,17 @@ async function main() {
         .option('--verify-command <cmd>', 'Override verification command')
         .option('--verify', 'Enable verification (default: enabled)')
         .action(async (id, opts) => {
-        const { getDefaultSessionStore, resolveSessionId } = await import('./persistence/session.js');
+        const { getDefaultSessionStore, resolveSessionId, matchSessionIds } = await import('./persistence/session.js');
         const store = getDefaultSessionStore();
         const full = await resolveSessionId(store, id);
         if (!full) {
-            process.stderr.write(`session not found: ${id}\n`);
+            const matches = await matchSessionIds(store, id);
+            if (matches.length > 1) {
+                process.stderr.write(`ambiguous id "${id}" matches:\n${matches.map((r) => `  ${r.id.slice(0, 8)}  ${r.task.slice(0, 50)}`).join('\n')}\n`);
+            }
+            else {
+                process.stderr.write(`session not found: ${id}\n`);
+            }
             process.exit(2);
         }
         const rec = await store.get(full);
@@ -501,11 +513,17 @@ async function main() {
         .option('-m, --model <id>', 'Model')
         .option('--max-steps <n>', 'Max steps', (v) => parsePositiveInt('--max-steps', v))
         .action(async (id, opts) => {
-        const { getDefaultSessionStore, resolveSessionId } = await import('./persistence/session.js');
+        const { getDefaultSessionStore, resolveSessionId, matchSessionIds } = await import('./persistence/session.js');
         const store = getDefaultSessionStore();
         const full = await resolveSessionId(store, id);
         if (!full) {
-            process.stderr.write(`session not found: ${id}\n`);
+            const matches = await matchSessionIds(store, id);
+            if (matches.length > 1) {
+                process.stderr.write(`ambiguous id "${id}" matches:\n${matches.map((r) => `  ${r.id.slice(0, 8)}  ${r.task.slice(0, 50)}`).join('\n')}\n`);
+            }
+            else {
+                process.stderr.write(`session not found: ${id}\n`);
+            }
             process.exit(2);
         }
         const rec = await store.get(full);
@@ -555,21 +573,38 @@ async function main() {
         const rec = await store.create({ cwd: data.record?.cwd ?? process.cwd(), task: data.record?.task ?? 'imported', config: data.record?.config ?? { model: 'imported', maxSteps: 30 } });
         process.stdout.write(`imported → ${rec.id}\n`);
     });
-    sessions.command('fork <id>').description('Fork session (9.4)').action(async (id) => {
-        const { getDefaultSessionStore, resolveSessionId } = await import('./persistence/session.js');
+    sessions.command('fork <id>').description('Fork session with full context (9.4)').action(async (id) => {
+        const { getDefaultSessionStore, matchSessionIds } = await import('./persistence/session.js');
         const store = getDefaultSessionStore();
-        const full = await resolveSessionId(store, id);
-        if (!full) {
+        const matches = await matchSessionIds(store, id);
+        if (matches.length === 0) {
             process.stderr.write(`session not found: ${id}\n`);
             process.exit(2);
         }
-        const rec = await store.get(full);
-        if (!rec) {
+        if (matches.length > 1) {
+            process.stderr.write(`ambiguous id "${id}" matches:\n${matches.map((r) => `  ${r.id.slice(0, 8)}  ${r.task.slice(0, 50)}`).join('\n')}\n`);
+            process.exit(2);
+        }
+        const full = matches[0].id;
+        const forked = await store.fork(full);
+        const msgs = await store.loadMessages(forked.id);
+        process.stdout.write(`forked ${full.slice(0, 8)} → ${forked.id.slice(0, 8)} (${msgs.length} messages carried over)\n`);
+    });
+    sessions.command('delete <id>').description('Delete a session and its artifacts').action(async (id) => {
+        const { getDefaultSessionStore, matchSessionIds } = await import('./persistence/session.js');
+        const store = getDefaultSessionStore();
+        const matches = await matchSessionIds(store, id);
+        if (matches.length === 0) {
             process.stderr.write(`session not found: ${id}\n`);
             process.exit(2);
         }
-        const forked = await store.create({ cwd: rec.cwd, task: rec.task + ' (fork)', config: rec.config });
-        process.stdout.write(`forked ${full.slice(0, 8)} → ${forked.id.slice(0, 8)}\n`);
+        if (matches.length > 1) {
+            process.stderr.write(`ambiguous id "${id}" matches:\n${matches.map((r) => `  ${r.id.slice(0, 8)}  ${r.task.slice(0, 50)}`).join('\n')}\n`);
+            process.exit(2);
+        }
+        const full = matches[0].id;
+        await store.delete(full);
+        process.stdout.write(`deleted ${full.slice(0, 8)}\n`);
     });
     // 10.1 — MCP
     const mcp = program.command('mcp').description('MCP client/server (10.1)');

package/dist/persistence/session.d.ts

@@ -10,3 +10,5 @@ export declare function createSessionStore(dir: string): SessionStore;
 export declare function formatSession(rec: SessionRecord): string;
 /** Resolve a short id prefix to full id (like git). */
 export declare function resolveSessionId(store: SessionStore, prefix: string): Promise<string | null>;
+/** All sessions matching an id prefix (lets callers distinguish missing vs ambiguous). */
+export declare function matchSessionIds(store: SessionStore, prefix: string): Promise<SessionRecord[]>;

package/dist/persistence/session.js

@@ -34,12 +34,18 @@ export async function resolveSessionId(store, prefix) {
         const rec = await store.get(prefix);
         return rec ? rec.id : null;
     }
-    const all = await store.list();
-    const matches = all.filter((r) => r.id.startsWith(prefix));
+    const matches = await matchSessionIds(store, prefix);
     if (matches.length === 1)
         return matches[0].id;
-    if (matches.length === 0)
-        return null;
-    // ambiguous — return null and let caller report
+    // zero or ambiguous — null; callers use matchSessionIds for a good message
     return null;
 }
+/** All sessions matching an id prefix (lets callers distinguish missing vs ambiguous). */
+export async function matchSessionIds(store, prefix) {
+    if (prefix.length >= 32) {
+        const rec = await store.get(prefix);
+        return rec ? [rec] : [];
+    }
+    const all = await store.list();
+    return all.filter((r) => r.id.startsWith(prefix));
+}

package/dist/persistence/store.d.ts

@@ -56,6 +56,13 @@ export declare class SessionStore {
         task: string;
         config: SessionConfig;
     }): Promise<SessionRecord>;
+    /**
+     * Fork a session: new id + copied messages/observations so the fork
+     * continues with full context instead of starting blank.
+     */
+    fork(id: string, taskSuffix?: string): Promise<SessionRecord>;
+    /** Delete a session and all its artifacts (record, transcript, jsonl, indexes). */
+    delete(id: string): Promise<boolean>;
     private jsonlPath;
     appendJsonl(id: string, entry: unknown): Promise<void>;
     readJsonl(id: string): Promise<unknown[]>;

package/dist/persistence/store.js

@@ -81,37 +81,86 @@ export class SessionStore {
         return w.length > 40 ? w.slice(0, 40) + '…' : w || 'untitled';
     }
     async create(opts) {
-        await this.ensureDir();
-        const id = randomUUID();
-        const now = Date.now();
-        const record = {
-            id,
-            cwd: opts.cwd,
-            task: opts.task,
-            status: 'open',
-            createdAt: now,
-            updatedAt: now,
-            config: opts.config,
-        };
-        record.title = this.titleFor(opts.task);
-        await fs.writeFile(path.join(this.dir, `${id}.json`), JSON.stringify({ record, messages: [], observations: [] }, null, 2));
-        await this.appendJsonl(id, { type: 'session.create', record, ts: now });
-        const idx = await this.readIndex();
-        idx[id] = record;
-        await this.writeIndex(idx);
-        // per-project index
-        try {
-            const pp = this.perProjectIndexPath(opts.cwd);
-            let pIdx = {};
+        // Locked: the index read-modify-write below races under concurrent creates.
+        return this.withLock('index', async () => {
+            await this.ensureDir();
+            const id = randomUUID();
+            const now = Date.now();
+            const record = {
+                id,
+                cwd: opts.cwd,
+                task: opts.task,
+                status: 'open',
+                createdAt: now,
+                updatedAt: now,
+                config: opts.config,
+            };
+            record.title = this.titleFor(opts.task);
+            await fs.writeFile(path.join(this.dir, `${id}.json`), JSON.stringify({ record, messages: [], observations: [] }, null, 2));
+            await this.appendJsonl(id, { type: 'session.create', record, ts: now });
+            const idx = await this.readIndex();
+            idx[id] = record;
+            await this.writeIndex(idx);
+            // per-project index
             try {
-                pIdx = JSON.parse(await fs.readFile(pp, 'utf-8'));
+                const pp = this.perProjectIndexPath(opts.cwd);
+                let pIdx = {};
+                try {
+                    pIdx = JSON.parse(await fs.readFile(pp, 'utf-8'));
+                }
+                catch { }
+                pIdx[id] = record;
+                await fs.writeFile(pp, JSON.stringify(pIdx, null, 2), 'utf-8');
             }
             catch { }
-            pIdx[id] = record;
-            await fs.writeFile(pp, JSON.stringify(pIdx, null, 2), 'utf-8');
-        }
-        catch { }
-        return record;
+            return record;
+        });
+    }
+    /**
+     * Fork a session: new id + copied messages/observations so the fork
+     * continues with full context instead of starting blank.
+     */
+    async fork(id, taskSuffix = ' (fork)') {
+        const data = await this.readSession(id);
+        const forked = await this.create({
+            cwd: data.record.cwd,
+            task: `${data.record.task}${taskSuffix}`,
+            config: data.record.config,
+        });
+        await this.withLock(forked.id, async () => {
+            const fresh = await this.readSession(forked.id);
+            fresh.messages = data.messages.map((m) => ({ ...m }));
+            fresh.observations = data.observations.map((o) => ({ ...o }));
+            await this.writeSession(forked.id, fresh);
+        });
+        await this.appendJsonl(forked.id, { type: 'session.fork', from: id, ts: Date.now() });
+        return forked;
+    }
+    /** Delete a session and all its artifacts (record, transcript, jsonl, indexes). */
+    async delete(id) {
+        return this.withLock('index', async () => {
+            const rec = await this.get(id);
+            if (!rec)
+                return false;
+            for (const f of [`${id}.json`, `${id}.jsonl`]) {
+                try {
+                    await fs.unlink(path.join(this.dir, f));
+                }
+                catch { /* ignore */ }
+            }
+            const idx = await this.readIndex();
+            delete idx[id];
+            await this.writeIndex(idx);
+            try {
+                const pp = this.perProjectIndexPath(rec.cwd);
+                const raw = await fs.readFile(pp, 'utf-8');
+                const pIdx = JSON.parse(raw);
+                delete pIdx[id];
+                await fs.writeFile(pp, JSON.stringify(pIdx, null, 2), 'utf-8');
+            }
+            catch { /* ignore */ }
+            return true;
+        });
     }
     jsonlPath(id) { return path.join(this.dir, `${id}.jsonl`); }
     async appendJsonl(id, entry) {

package/dist/policy/engine.d.ts

@@ -76,8 +76,17 @@ export declare const shellDenyRule: PolicyRule;
 export declare const shellAllowRule: PolicyRule;
 /** Writes are auto-allowed if path resolves inside cwd or --add-dir (path-guard throws otherwise). */
 export declare const writeFileCwdRule: PolicyRule;
-/** Reads > 5 MiB require confirmation (avoid filling the context window). */
+/**
+ * Reads > readSizeAskMiB require confirmation (avoid filling the context).
+ * Stats the file directly — the old sizeBytes input never existed in the
+ * read_file schema, so this rule never fired (dead code until now).
+ */
 export declare const readFileSizeRule: PolicyRule;
+/**
+ * Deep-clone a PolicyConfig so per-session tweaks (/mode, /sandbox) never
+ * leak across engines via the shared DEFAULT_POLICY_CONFIG reference.
+ */
+export declare function clonePolicyConfig(base?: PolicyConfig): PolicyConfig;
 /** Convenience: evaluate via safe() so a buggy rule doesn't crash the loop. */
 export declare function evaluatePolicy(engine: PolicyEngine, call: ToolCallLike, ctx: {
     cwd: string;

package/dist/policy/engine.js

@@ -218,13 +218,27 @@ export const writeFileCwdRule = {
         return null;
     },
 };
-/** Reads > 5 MiB require confirmation (avoid filling the context window). */
+/**
+ * Reads > readSizeAskMiB require confirmation (avoid filling the context).
+ * Stats the file directly — the old sizeBytes input never existed in the
+ * read_file schema, so this rule never fired (dead code until now).
+ */
 export const readFileSizeRule = {
     name: 'read-file-size',
     evaluate(call, ctx) {
         if (call.name !== 'read_file')
             return null;
-        const size = typeof call.input.sizeBytes === 'number' ? call.input.sizeBytes : 0;
+        const p = asString(call.input.path);
+        if (!p)
+            return null;
+        let size = 0;
+        try {
+            const { resolved } = resolveWithinCwd(ctx.cwd, p);
+            size = fsSync.statSync(resolved).size;
+        }
+        catch {
+            return null; // unreadable → other rules/tools report it
+        }
         if (size > ctx.config.readSizeAskMiB * 1024 * 1024) {
             if (ctx.nonInteractive)
                 return { action: 'deny', reason: `file > ${ctx.config.readSizeAskMiB} MiB` };
@@ -233,6 +247,21 @@ export const readFileSizeRule = {
         return null;
     },
 };
+/**
+ * Deep-clone a PolicyConfig so per-session tweaks (/mode, /sandbox) never
+ * leak across engines via the shared DEFAULT_POLICY_CONFIG reference.
+ */
+export function clonePolicyConfig(base = DEFAULT_POLICY_CONFIG) {
+    return {
+        ...base,
+        shellAllow: [...base.shellAllow],
+        shellDeny: [...base.shellDeny],
+        allow: [...(base.allow ?? [])],
+        deny: [...(base.deny ?? [])],
+        ask: [...(base.ask ?? [])],
+        additionalDirs: [...(base.additionalDirs ?? [])],
+    };
+}
 /** Convenience: evaluate via safe() so a buggy rule doesn't crash the loop. */
 export async function evaluatePolicy(engine, call, ctx) {
     const r = await safe(() => engine.evaluate(call, ctx));
@@ -244,3 +273,5 @@ export async function evaluatePolicy(engine, call, ctx) {
 // (path-guard is already in policy/, and tools/ depend on it. This keeps
 //  policy/ depending only on tools/normalize, no other tool code.)
 import * as path from 'node:path';
+import * as fsSync from 'node:fs';
+import { resolveWithinCwd } from './path-guard.js';

package/dist/tools/fs/apply-patch.d.ts

@@ -1,5 +1,20 @@
 /**
- * 4.2 — apply_patch: Codex-style unified patch, tolerant hunks
+ * 4.2 — apply_patch: Codex-style unified patch with REAL hunk application.
+ *
+ * Format:
+ *   *** Begin Patch
+ *   *** Update File: <path>     (must contain @@ hunks for existing files)
+ *   *** Add File: <path>        (created from + lines)
+ *   *** End Patch
+ *
+ * Hunks are standard unified diff: `@@ -a,b +c,d @@` headers, ' ' context,
+ * '-' removals, '+' additions. Context/removals must match the file (exact
+ * first, trailing-whitespace-insensitive fallback with ±3 line drift);
+ * otherwise INVALID_PATCH names the file+hunk instead of corrupting it.
+ *
+ * Legacy compat: a file section with NO @@ lines and only + lines is treated
+ * as file creation (the old tolerant behavior) — but never as an edit to an
+ * existing file, where hunk-less appends used to corrupt content.
  */
 export declare const applyPatchTool: import("../types.js").Tool<{
     patch: string;