klyro 0.1.53 → 0.1.55

package/dist/tui/transcript.js

@@ -1,74 +1,9 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { Text, Box } from 'ink';
-import Spinner from 'ink-spinner';
-import { DiffView } from './diff.js';
-export function Transcript({ items }) {
-    return (_jsx(Box, { flexDirection: "column", flexGrow: 1, paddingX: 1, children: items.length === 0 ? (_jsx(Text, { color: "gray", dimColor: true, children: "Type a prompt or /help for commands." })) : items.map((item) => (_jsx(TranscriptRow, { item: item }, item.id))) }));
-}
-/** Build a one-line summary of a tool call from its args JSON. */
-function summarizeTool(name, args) {
-    if (!args || args === '{}')
-        return '';
-    let parsed = null;
-    try {
-        parsed = JSON.parse(args);
-    }
-    catch {
-        return args.slice(0, 80);
-    }
-    switch (name) {
-        case 'read_file':
-        case 'write_file':
-        case 'edit_file':
-            return typeof parsed.path === 'string' ? parsed.path : '';
-        case 'shell_exec':
-            return typeof parsed.command === 'string' ? parsed.command : '';
-        case 'search_files':
-        case 'grep': {
-            const q = parsed.query ?? parsed.pattern;
-            return typeof q === 'string' ? `"${q}"` : '';
-        }
-        case 'list_directory':
-            return typeof parsed.path === 'string' ? parsed.path : '';
-        case 'git_status':
-        case 'git_diff':
-            return '';
-        default:
-            return '';
-    }
-}
-function TranscriptRow({ item }) {
-    if (item.kind === 'text') {
-        const color = item.role === 'user' ? 'blue' : undefined;
-        return (_jsx(Box, { marginY: 0, children: _jsxs(Text, { color: color, children: [item.role === 'user' ? '> ' : '', item.text] }) }));
-    }
-    if (item.kind === 'tool') {
-        return _jsx(ToolCard, { item: item });
-    }
-    if (item.kind === 'policy') {
-        const color = item.action === 'allow' ? 'green' : item.action === 'deny' ? 'red' : 'yellow';
-        return (_jsxs(Box, { paddingLeft: 2, children: [_jsx(Text, { color: "gray", children: "[policy] " }), _jsx(Text, { color: color, children: item.action }), _jsxs(Text, { color: "gray", children: [" ", item.name] }), item.reason ? _jsxs(Text, { color: "gray", children: [" \u2014 ", item.reason] }) : null] }));
-    }
-    if (item.kind === 'file_changed') {
-        const color = item.op === 'deleted' ? 'red' : item.op === 'created' ? 'green' : 'yellow';
-        const glyph = item.op === 'created' ? '+' : item.op === 'deleted' ? '-' : '~';
-        return (_jsx(Box, { paddingLeft: 2, children: _jsxs(Text, { color: color, children: ["[", glyph, " ", item.op, "] ", item.path] }) }));
-    }
-    if (item.kind === 'error') {
-        return (_jsx(Box, { paddingLeft: 2, children: _jsxs(Text, { color: "red", children: ["[error] ", item.message] }) }));
-    }
-    if (item.kind === 'diff') {
-        return _jsx(DiffView, { hunks: item.hunks, summary: item.summary });
-    }
-    return null;
-}
-function ToolCard({ item }) {
-    const summary = summarizeTool(item.name, item.args);
-    const borderColor = item.status === 'error' ? 'red' : item.status === 'running' ? 'cyan' : 'gray';
-    return (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: borderColor, marginY: 1, paddingX: 1, children: [_jsxs(Box, { children: [_jsx(Text, { color: "gray", children: "\u250C\u2500 " }), _jsx(Text, { bold: true, children: item.name }), item.status === 'running' ? (_jsxs(Text, { color: "cyan", children: ["  ", _jsx(Spinner, { type: "dots" }), " running"] })) : item.status === 'error' ? (_jsx(Text, { color: "red", children: "  \u2717 error" })) : (_jsxs(Text, { color: "green", children: ["  \u2713 ", item.latencyMs ?? 0, "ms"] })), _jsx(Text, { color: "gray", children: " \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500" })] }), summary ? (_jsx(Box, { paddingLeft: 2, children: _jsx(Text, { children: truncate(summary, 200) }) })) : null, item.status !== 'running' && item.result ? (_jsx(Box, { paddingLeft: 2, flexDirection: "column", children: _jsxs(Text, { color: item.isError ? 'red' : 'gray', children: [item.isError ? '✗ ' : '→ ', truncate(item.result, 400)] }) })) : null, _jsx(Box, { children: _jsx(Text, { color: "gray", children: "\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500" }) })] }));
-}
-function truncate(s, max) {
-    if (s.length <= max)
-        return s;
-    return s.slice(0, max) + '…';
-}
+/**
+ * Transcript item types — the scrollable entry list owned by App.
+ *
+ * NOTE: the old Transcript/TranscriptRow/ToolCard presentational components
+ * were removed: App renders entries inline (grouped tool activity), and the
+ * standalone components' tests gave false coverage for UI nobody sees.
+ * Only the item types remain.
+ */
+export {};

package/dist/verification/engine.js

@@ -18,7 +18,10 @@ function appendCapped(current, chunk) {
     return next.length > MAX_VERIFY_BYTES ? next.slice(0, MAX_VERIFY_BYTES) + '\n... [truncated]' : next;
 }
 // SEC-004: denylist for dangerous patterns in verify commands.
-// Reuses the same patterns as shell-exec.ts DANGEROUS_PATTERNS.
+// Destructive-only: the verify command comes from CLI flags, project config,
+// or auto-detected package scripts (never model-controlled), so shell
+// metacharacters ($(), backticks, pipes) that are legitimate in test scripts
+// are allowed here — unlike shell_exec's model-facing denylist.
 const DANGEROUS_VERIFY_PATTERNS = [
     { pattern: /rm\s+-rf?\s+\//, reason: 'recursive delete at filesystem root' },
     { pattern: /rm\s+-rf?\s+\/\/+/, reason: 'recursive delete at filesystem root (//)' },
@@ -39,9 +42,6 @@ const DANGEROUS_VERIFY_PATTERNS = [
     { pattern: /curl.*\|\s*(sh|bash|zsh|python|python3|perl|ruby|php)/i, reason: 'curl|sh to unknown host' },
     { pattern: /wget.*\|\s*(sh|bash|python|perl|ruby)/i, reason: 'wget|sh pipe' },
     { pattern: /rm\s+-rf\s+--no-preserve-root\s+\//, reason: 'recursive delete --no-preserve-root' },
-    { pattern: /\$\(/, reason: 'command substitution $()' },
-    { pattern: /`[^`]*`/, reason: 'command substitution via backticks' },
-    { pattern: /\|\s*bash\b|\|\s*sh\b/, reason: 'pipe to shell' },
     { pattern: /;\s*rm\s+-rf/, reason: 'chained rm -rf' },
     { pattern: /&&\s*rm\s+-rf/, reason: 'chained rm -rf' },
     { pattern: /\|\|\s*rm\s+-rf/, reason: 'chained rm -rf' },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "klyro",
-  "version": "0.1.53",
+  "version": "0.1.55",
   "description": "Klyro \u2014 autonomous coding harness CLI that streams from any OpenAI-compatible or Anthropic LLM endpoint.",
   "type": "module",
   "main": "dist/index.js",