klyro 0.1.61 → 0.1.63

package/dist/agent/runtime.js

@@ -16,6 +16,7 @@
  */
 import { text, toolUse, toolResult as mkToolResult } from './message.js';
 import { redact } from '../policy/secret-redactor.js';
+import { patternForCall } from '../policy/patterns.js';
 import { RuntimeTelemetry, emptyTelemetryBlock, summarizeToolCall } from '../context/level7.js';
 import * as path from 'node:path';
 import { verify, diagnosticForModel } from '../verification/engine.js';
@@ -173,6 +174,8 @@ export async function run(opts, deps) {
     // 5.2 — stuck detection state
     const callHistory = [];
     const fileEditCounts = new Map();
+    let stuckTriggers = 0;
+    let stuckAbort = false;
     outer: while (steps < maxSteps) {
         // 5.1 limits: max-cost, max-time
         if (maxCost !== undefined) {
@@ -273,6 +276,17 @@ export async function run(opts, deps) {
                     telemetry.recordUsage(ev.usage.input, ev.usage.output);
                     emit?.({ kind: 'usage', input: usage.input, output: usage.output });
                 }
+                else {
+                    // Providers that omit usage (Ollama, vLLM, proxies): estimate from
+                    // the actual request + generated output so cost accounting never
+                    // silently records zero. Marked estimated for the UI/debugging.
+                    const est = estimateTurnUsage(reqSystem, reqMessages, textBuf, pendingToolCalls);
+                    usage.input += est.input;
+                    usage.output += est.output;
+                    usage.estimated = true;
+                    telemetry.recordUsage(est.input, est.output);
+                    emit?.({ kind: 'usage', input: usage.input, output: usage.output, estimated: true });
+                }
             }
             else if (ev.kind === 'error') {
                 telemetry.recordError(`stream_error: ${ev.code}`);
@@ -296,22 +310,47 @@ export async function run(opts, deps) {
                 };
             }
         }
-        // Build the assistant message.
+        // Build the assistant message. Tool calls are finalized here: JSON is
+        // parsed and schema-validated BEFORE policy/execution. Malformed calls
+        // become structured MALFORMED_TOOL_CALL results — garbage arguments must
+        // never reach a real tool.
         const assistantContent = [];
         if (textBuf)
             assistantContent.push(text(textBuf));
         const finalizedCalls = [];
+        let hadInvalidTool = false;
         for (const tc of pendingToolCalls.values()) {
-            let input = {};
-            try {
-                input = JSON.parse(tc.argsJson || '{}');
-            }
-            catch {
-                input = { _parse_error: true, raw: tc.argsJson };
+            const validated = validateFinalizedCall(deps.registry, tc.id, tc.name, tc.argsJson);
+            if (!validated.ok) {
+                hadInvalidTool = true;
+                // Record the model's tool_use (empty input — safe to replay to any
+                // provider) and answer it immediately with a structured error.
+                assistantContent.push(toolUse(tc.id, tc.name, {}));
+                emit?.({ kind: 'tool_call_end', id: tc.id, name: tc.name, input: {} });
+                const errMsg = {
+                    role: 'tool',
+                    content: [mkToolResult(tc.id, tc.name, validated.output, true)],
+                };
+                transcript.push(errMsg);
+                await checkpoint(errMsg, {
+                    toolCallId: tc.id, toolName: tc.name,
+                    input: { raw: redact(tc.argsJson).slice(0, 500) }, output: validated.output, isError: true,
+                });
+                let attempted = {};
+                try {
+                    attempted = JSON.parse(tc.argsJson);
+                }
+                catch {
+                    attempted = {};
+                }
+                telemetry.recordToolError(toolUse(tc.id, tc.name, attempted), validated.code);
+                emitKlyro({ type: 'tool.result', ts: Date.now(), sessionId: sessionId ?? 'ephemeral', callId: tc.id, name: tc.name, output: validated.output, isError: true, latencyMs: 0 });
+                emit?.({ kind: 'tool_result', id: tc.id, name: tc.name, output: validated.output, isError: true, latencyMs: 0 });
+                continue;
             }
-            finalizedCalls.push(toolUse(tc.id, tc.name, input));
-            assistantContent.push(toolUse(tc.id, tc.name, input));
-            emit?.({ kind: 'tool_call_end', id: tc.id, name: tc.name, input });
+            finalizedCalls.push(toolUse(tc.id, tc.name, validated.input));
+            assistantContent.push(toolUse(tc.id, tc.name, validated.input));
+            emit?.({ kind: 'tool_call_end', id: tc.id, name: tc.name, input: validated.input });
         }
         const assistantMsg = { role: 'assistant', content: assistantContent };
         transcript.push(assistantMsg);
@@ -332,6 +371,14 @@ export async function run(opts, deps) {
             return { status: 'aborted', steps, toolCalls: toolCallCount, finalText, transcript, hasEdits, usage, repairs, verification: hasEdits ? { ok: false, attempts: verificationAttempts } : undefined };
         }
         if (finalizedCalls.length === 0) {
+            if (hadInvalidTool) {
+                // The model attempted a tool call that failed validation; the error is
+                // already a tool_result in the transcript — loop so the model can
+                // repair next turn instead of treating an answerable error as a
+                // completion. Bounded by maxSteps and stuck detection (P0-3).
+                emit?.({ kind: 'step_end', step: steps });
+                continue;
+            }
             finalText = textBuf;
             // Level 8 — Verification + Autonomous Repair (gated on hasEdits below — pure analysis skips verify)
             const verifyEnabled = opts.verify?.enabled !== false;
@@ -528,8 +575,11 @@ export async function run(opts, deps) {
             sessionId,
         };
         const allSafe = finalizedCalls.length > 1 && finalizedCalls.every((c) => deps.registry.get(c.name)?.isConcurrencySafe !== false);
-        const runOne = async (call) => {
-            // Use per-call handling without continue (runOne is not a loop)
+        // Gate phase: policy decision + approval prompt for one call. Runs
+        // sequentially (approval UI is one-modal-at-a-time). Commits deny/user-deny
+        // results immediately — gate runs in call order so these stay ordered.
+        // Returns true when the call is approved for execution.
+        const gateCall = async (call) => {
             const decision = await deps.policy.evaluate({ name: call.name, input: call.input }, { cwd: opts.cwd, nonInteractive: opts.nonInteractive });
             emit?.({ kind: 'policy_decision', id: call.id, name: call.name, action: decision.action, ...(decision.action !== 'allow' ? { reason: decision.reason } : {}) });
             // Mirror to KlyroEvent bus
@@ -546,7 +596,7 @@ export async function run(opts, deps) {
                 emitKlyro({ type: 'tool.result', ts: Date.now(), sessionId: sessionId ?? 'ephemeral', callId: call.id, name: call.name, output: { error: 'POLICY_DENIED' }, isError: true, latencyMs: 0 });
                 telemetry.recordToolError(call, 'policy_denied');
                 emit?.({ kind: 'tool_result', id: call.id, name: call.name, output: { error: 'POLICY_DENIED', reason: decision.reason }, isError: true, latencyMs: 0 });
-                return;
+                return false;
             }
             if (decision.action === 'ask') {
                 emitKlyro({ type: 'permission.ask', ts: Date.now(), sessionId: sessionId ?? 'ephemeral', callId: call.id, name: call.name, reason: decision.reason });
@@ -554,6 +604,8 @@ export async function run(opts, deps) {
                     toolName: call.name,
                     reason: decision.reason,
                     summary: summarizeToolCall(call),
+                    input: call.input,
+                    pattern: patternForCall(call.name, call.input),
                 });
                 // Approval UI in TUI handles y/a/A/n/e/? — e edits input, ? explains
                 if (choice === 'deny') {
@@ -567,15 +619,49 @@ export async function run(opts, deps) {
                     await checkpoint(denyMsg2, { toolCallId: call.id, toolName: call.name, input: call.input, output: { error: 'POLICY_DENIED', reason: 'user denied' }, isError: true });
                     telemetry.recordToolError(call, 'user_denied');
                     emit?.({ kind: 'tool_result', id: call.id, name: call.name, output: { error: 'POLICY_DENIED', reason: 'user denied' }, isError: true, latencyMs: 0 });
-                    return;
+                    return false;
                 }
                 // Handle 'edit' choice: for now treat as allow with edited input (future: re-prompt)
                 repairs++;
             }
+            return true;
+        };
+        // Execute phase: run the tool with no transcript writes, so concurrent
+        // executions can't interleave. A throw here becomes a tool error (an
+        // executor crash must never kill the step).
+        const execTool = async (call) => {
             const t0 = Date.now();
             emitKlyro({ type: 'tool.call', ts: Date.now(), sessionId: sessionId ?? 'ephemeral', callId: call.id, name: call.name, input: call.input });
-            const obs = await deps.registry.execute(call.name, call.input, toolCtx);
+            let obs;
+            try {
+                obs = await deps.registry.execute(call.name, call.input, toolCtx);
+            }
+            catch (err) {
+                obs = { ok: false, error: { code: 'EXEC_CRASH', message: err instanceof Error ? err.message : String(err) } };
+            }
             const latencyMs = Date.now() - t0;
+            return { obs, latencyMs };
+        };
+        // 5.2 stuck termination (P0-3): the FIRST detection injects one
+        // "change approach" synthetic message for the next model turn; the SECOND
+        // detection aborts the automated loop with a `stuck` status so a repeated
+        // tool loop never burns unbounded tokens. Covers both signals: identical
+        // call ×3 and same-file edited >8×.
+        const markStuck = async (msg) => {
+            stuckTriggers++;
+            emitKlyro({ type: 'error', ts: Date.now(), sessionId: sessionId ?? 'ephemeral', code: 'stuck', message: msg });
+            if (stuckTriggers === 1) {
+                const note = { role: 'user', content: [text(`[system note] Stuck detected: ${msg}. Stop repeating the same action; change approach.`)] };
+                transcript.push(note);
+                await checkpoint(note);
+            }
+            else {
+                stuckAbort = true;
+            }
+        };
+        // Commit phase: fold one execution result into the transcript, in original
+        // call order. The only writer — call sequentially, never concurrently.
+        const commitResult = async (call, obs, latencyMs) => {
             const output = obs.ok ? redactOutput(obs.value) : redactOutput({ error: obs.error });
             const toolMsg = {
                 role: 'tool',
@@ -620,7 +706,7 @@ export async function run(opts, deps) {
                     const cnt = (fileEditCounts.get(fileChanged.path) ?? 0) + 1;
                     fileEditCounts.set(fileChanged.path, cnt);
                     if (cnt > 8) {
-                        emitKlyro({ type: 'error', ts: Date.now(), sessionId: sessionId ?? 'ephemeral', code: 'stuck', message: `same file edited >8×: ${fileChanged.path}` });
+                        await markStuck(`same file edited >8×: ${fileChanged.path}`);
                     }
                 }
             }
@@ -631,23 +717,42 @@ export async function run(opts, deps) {
                 callHistory.shift();
             const last3 = callHistory.slice(-3);
             if (last3.length === 3 && last3[0] === last3[1] && last3[1] === last3[2]) {
-                emitKlyro({ type: 'error', ts: Date.now(), sessionId: sessionId ?? 'ephemeral', code: 'stuck', message: `identical call ×3: ${sig}` });
-                // Inject system note for next turn
-                const note = { role: 'user', content: [text(`[system note] Stuck detected: identical call ×3: ${sig}. Try a different approach.`)] };
-                transcript.push(note);
-                await checkpoint(note);
+                await markStuck(`identical call ×3: ${sig}`);
             }
         };
-        // 3.5 — parallel if all concurrencySafe, sequential otherwise
-        // BUG-002: preserve call order — run sequentially even when allSafe to avoid out-of-order transcript
-        // Parallel execution previously pushed tool_results out of order via Promise.all
+        // Sequential path: gate → execute → commit per call, in order.
+        const runOne = async (call) => {
+            if (!(await gateCall(call)))
+                return;
+            const { obs, latencyMs } = await execTool(call);
+            await commitResult(call, obs, latencyMs);
+        };
+        // 3.5 — parallel when every call is concurrencySafe, sequential otherwise.
+        // Gate runs sequentially in both paths (approval UI is one-at-a-time).
+        // Parallel path executes concurrently but commits in original call order,
+        // so the transcript reads exactly as if the calls ran in order (this is
+        // what the old BUG-002 sequential fallback was protecting).
         if (allSafe) {
+            const approved = [];
             for (const call of finalizedCalls) {
                 toolCallCount++;
-                await runOne(call);
+                if (await gateCall(call))
+                    approved.push(call);
                 if (opts.signal?.aborted)
                     break;
             }
+            if (approved.length > 0 && !opts.signal?.aborted) {
+                const settled = await Promise.allSettled(approved.map((c) => execTool(c)));
+                for (let i = 0; i < approved.length; i++) {
+                    const s = settled[i];
+                    if (s.status === 'fulfilled') {
+                        await commitResult(approved[i], s.value.obs, s.value.latencyMs);
+                    }
+                    else {
+                        await commitResult(approved[i], { ok: false, error: { code: 'EXEC_CRASH', message: String(s.reason) } }, 0);
+                    }
+                }
+            }
         }
         else {
             for (const call of finalizedCalls) {
@@ -666,6 +771,9 @@ export async function run(opts, deps) {
             }
             catch { /* ignore */ }
         }
+        // 5.2 — terminate the automated loop once stuck recurs after the note
+        if (stuckAbort)
+            break;
     }
     if (opts.signal?.aborted) {
         emit?.({ kind: 'aborted' });
@@ -678,6 +786,18 @@ export async function run(opts, deps) {
         await closeTracer();
         return { status: 'aborted', steps, toolCalls: toolCallCount, finalText, transcript, hasEdits, usage, repairs, verification: hasEdits ? { ok: false, attempts: verificationAttempts } : undefined };
     }
+    // 5.2 — stuck termination (P0-3): bounded stop instead of unbounded token burn.
+    if (stuckAbort) {
+        emit?.({ kind: 'final_text', text: finalText });
+        if (store && sessionId) {
+            try {
+                await store.setStatus(sessionId, 'stuck', finalText);
+            }
+            catch { /* ignore */ }
+        }
+        await closeTracer();
+        return { status: 'stuck', steps, toolCalls: toolCallCount, finalText, transcript, hasEdits, usage, repairs, verification: hasEdits ? { ok: false, attempts: verificationAttempts } : undefined };
+    }
     emit?.({ kind: 'final_text', text: finalText });
     if (store && sessionId) {
         try {
@@ -688,6 +808,88 @@ export async function run(opts, deps) {
     await closeTracer();
     return { status: 'max_steps', steps, toolCalls: toolCallCount, finalText, transcript, hasEdits, usage, repairs, verification: hasEdits ? { ok: false, attempts: verificationAttempts } : undefined };
 }
+/**
+ * Estimate usage for a turn whose provider omitted it (Ollama, vLLM,
+ * proxies). Input is measured from the actual request via the tokenizer;
+ * output is a chars/4 heuristic over generated text + tool arguments.
+ */
+function estimateTurnUsage(system, messages, textOut, toolCalls) {
+    let argsChars = 0;
+    for (const tc of toolCalls.values())
+        argsChars += tc.argsJson.length;
+    return {
+        input: totalTokens(system, messages),
+        output: Math.max(1, Math.ceil((textOut.length + argsChars) / 4)),
+    };
+}
+/**
+ * Validate one assembled tool call before it reaches policy or execution.
+ * Returns the parsed+schema-validated input, or a structured error output
+ * (MALFORMED_TOOL_CALL / UNKNOWN_TOOL) that the runtime records as a tool
+ * result without executing anything.
+ */
+function validateFinalizedCall(registry, id, name, argsJson) {
+    void id;
+    let parsed = {};
+    if (argsJson.trim()) {
+        try {
+            parsed = JSON.parse(argsJson);
+        }
+        catch {
+            return {
+                ok: false,
+                code: 'MALFORMED_TOOL_CALL',
+                output: {
+                    code: 'MALFORMED_TOOL_CALL',
+                    tool: name,
+                    message: 'Tool arguments were incomplete or invalid JSON. Re-issue the call with complete arguments.',
+                    retryable: true,
+                },
+            };
+        }
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        return {
+            ok: false,
+            code: 'MALFORMED_TOOL_CALL',
+            output: {
+                code: 'MALFORMED_TOOL_CALL',
+                tool: name,
+                message: 'Tool arguments must be a JSON object. Re-issue the call with complete arguments.',
+                retryable: true,
+            },
+        };
+    }
+    const tool = registry.get(name);
+    if (!tool) {
+        return {
+            ok: false,
+            code: 'UNKNOWN_TOOL',
+            output: {
+                code: 'MALFORMED_TOOL_CALL',
+                tool: name,
+                message: `Unknown tool "${name}". Use one of the available tools.`,
+                retryable: true,
+            },
+        };
+    }
+    const checked = tool.inputSchema.safeParse(parsed);
+    if (!checked.success) {
+        const first = checked.error.issues[0];
+        const detail = first ? ` (${first.path.join('.') || 'input'}: ${first.message})` : '';
+        return {
+            ok: false,
+            code: 'MALFORMED_TOOL_CALL',
+            output: {
+                code: 'MALFORMED_TOOL_CALL',
+                tool: name,
+                message: `Tool arguments failed validation${detail}. Re-issue the call with correct arguments.`,
+                retryable: true,
+            },
+        };
+    }
+    return { ok: true, input: parsed };
+}
 function redactOutput(v) {
     if (typeof v === 'string')
         return redact(v);

package/dist/cli/config.d.ts

@@ -34,6 +34,27 @@ declare function parseValue(raw: string): unknown;
 export declare function loadConfig(): Promise<Record<string, unknown>>;
 export declare function loadConfigSync(): Record<string, unknown>;
 export declare function loadMergedConfig(cwd?: string, flags?: Record<string, unknown>): Promise<Record<string, unknown>>;
+export interface PermissionRules {
+    allow: string[];
+    deny: string[];
+    ask: string[];
+}
+/**
+ * Permission glob rules (`tool(glob)` grammar) from the merged config
+ * layers — home settings, project settings, project local. Fed into the
+ * policy engine at startup so persisted "always allow" patterns apply
+ * without re-prompting.
+ */
+export declare function loadPermissionRules(cwd?: string): Promise<PermissionRules>;
+/**
+ * Persist an "always allow" pattern to the home settings file
+ * (~/.klyro/settings.json, honors KLYRO_CONFIG). Returns whether it was
+ * added (false when already present) and the file written.
+ */
+export declare function persistAllowRule(rule: string): Promise<{
+    added: boolean;
+    path: string;
+}>;
 export declare function saveConfig(obj: Record<string, unknown>): Promise<void>;
 export declare function runConfig(args: string[]): Promise<number>;
 export declare const _helpers: {

package/dist/cli/config.js

@@ -320,6 +320,37 @@ export async function loadMergedConfig(cwd = process.cwd(), flags = {}) {
     }
     return merged;
 }
+function asStringArray(v) {
+    return Array.isArray(v) ? v.filter((e) => typeof e === 'string') : [];
+}
+/**
+ * Permission glob rules (`tool(glob)` grammar) from the merged config
+ * layers — home settings, project settings, project local. Fed into the
+ * policy engine at startup so persisted "always allow" patterns apply
+ * without re-prompting.
+ */
+export async function loadPermissionRules(cwd = process.cwd()) {
+    const merged = await loadMergedConfig(cwd, {});
+    return {
+        allow: asStringArray(merged.allow),
+        deny: asStringArray(merged.deny),
+        ask: asStringArray(merged.ask),
+    };
+}
+/**
+ * Persist an "always allow" pattern to the home settings file
+ * (~/.klyro/settings.json, honors KLYRO_CONFIG). Returns whether it was
+ * added (false when already present) and the file written.
+ */
+export async function persistAllowRule(rule) {
+    const cfg = await loadConfig();
+    const allow = asStringArray(cfg.allow);
+    if (allow.includes(rule))
+        return { added: false, path: getConfigPath() };
+    cfg.allow = [...allow, rule];
+    await saveConfig(cfg);
+    return { added: true, path: getConfigPath() };
+}
 export async function saveConfig(obj) {
     const p = getConfigPath();
     await fs.mkdir(path.dirname(p), { recursive: true });

package/dist/cli/repl.js

@@ -16,11 +16,12 @@ import { run } from '../agent/runtime.js';
 import { builtinRegistry } from '../tools/registry.js';
 import { builtinRules, clonePolicyConfig, PolicyEngine } from '../policy/engine.js';
 import { buildLevel6Context } from '../context/level6.js';
-import { DenyAllApprovalPrompt, StdinApprovalPrompt } from '../policy/approval.js';
+import { DenyAllApprovalPrompt, PatternApprovalCache, StdinApprovalPrompt } from '../policy/approval.js';
 import { TuiApprovalBridge } from '../tui/approval.js';
 import { parseUnifiedDiff } from '../tui/diff-parser.js';
 import { parse } from './slash/parser.js';
 import { resolveProvider, providerHelp, lastProviderError } from '../providers.js';
+import { readVersion } from '../version.js';
 import { MouseFilter, MOUSE_ENABLE, MOUSE_DISABLE, createReadWrapper } from '../tui/mouse.js';
 import { inferProviderFromBaseURL } from '../agent/registry.js';
 import { getDefaultSessionStore } from '../persistence/session.js';
@@ -71,6 +72,15 @@ export async function startRepl(opts = {}) {
     // Clone: /mode and /sandbox mutate this config — it must never leak into
     // the shared DEFAULT_POLICY_CONFIG across sessions.
     const policy = new PolicyEngine(builtinRules(), clonePolicyConfig());
+    // Persisted permission rules (home + project settings layers) — "always"
+    // choices from previous sessions apply without re-prompting.
+    try {
+        const { loadPermissionRules } = await import('./config.js');
+        policy.applyRules(await loadPermissionRules(cwd));
+    }
+    catch {
+        /* ignore — engine defaults stand */
+    }
     const providerKind = inferProviderFromBaseURL(baseUrl);
     // Local Ollama exposes OpenAI-compat but hostname could contain "anthropic"
     // via proxy — don't try anthropic adapter with empty key (would 401).
@@ -104,9 +114,29 @@ export async function startRepl(opts = {}) {
     // App and the runtime so the modal can resolve the runtime's ask().
     const tuiBridge = new TuiApprovalBridge();
     const useTui = opts.forceTty || process.stdin.isTTY;
-    const approval = opts.nonInteractive
+    // Ask-once-per-pattern: session cache + optional persist. `a` records for
+    // the session, `A` additionally appends the pattern to settings and the
+    // live engine (matches the modal's [a] session / [A] always→settings).
+    const approvalBase = opts.nonInteractive
         ? new DenyAllApprovalPrompt()
         : (useTui ? tuiBridge : new StdinApprovalPrompt());
+    const approval = opts.nonInteractive
+        ? approvalBase
+        : new PatternApprovalCache(approvalBase, {
+            onPersist: async (pattern) => {
+                const { persistAllowRule } = await import('./config.js');
+                const res = await persistAllowRule(pattern);
+                policy.addAllow(pattern);
+                queuedAppend({
+                    id: `allow-${Date.now()}`,
+                    kind: 'text',
+                    text: res.added
+                        ? `allowed always: ${pattern} (saved to ${res.path} — revoke by deleting the line)`
+                        : `allowed always: ${pattern} (already in ${res.path})`,
+                    role: 'assistant',
+                });
+            },
+        });
     let inflight = null;
     let lastStatus = null;
     const pendingQueue = [];
@@ -464,6 +494,7 @@ export async function startRepl(opts = {}) {
         initialModel: model,
         maxSteps: currentMaxSteps,
         cwd,
+        version: readVersion(),
         initialStatus: { status: 'idle' },
         approvalBridge: tuiBridge,
         isFullscreen: isAltScreen,
@@ -793,17 +824,7 @@ export async function startRepl(opts = {}) {
                 return;
             }
             case 'version': {
-                const { readFileSync } = await import('node:fs');
-                const { resolve, dirname } = await import('node:path');
-                const { fileURLToPath } = await import('node:url');
-                try {
-                    const here = dirname(fileURLToPath(import.meta.url));
-                    const pkg = JSON.parse(readFileSync(resolve(here, '../../package.json'), 'utf-8'));
-                    queuedAppend({ id: `ver-${Date.now()}`, kind: 'text', text: `klyro ${pkg.version ?? '0.0.0'}`, role: 'assistant' });
-                }
-                catch {
-                    queuedAppend({ id: `ver-${Date.now()}`, kind: 'text', text: 'klyro (version unknown)', role: 'assistant' });
-                }
+                queuedAppend({ id: `ver-${Date.now()}`, kind: 'text', text: `klyro ${readVersion()}`, role: 'assistant' });
                 return;
             }
             case 'cost': {

package/dist/cli/run.js

@@ -59,6 +59,14 @@ export async function runOnce(opts) {
     }
     const registry = builtinRegistry();
     const policy = new PolicyEngine(builtinRules(), clonePolicyConfig());
+    // Persisted "always allow" patterns apply to one-shot runs too.
+    try {
+        const { loadPermissionRules } = await import('./config.js');
+        policy.applyRules(await loadPermissionRules(opts.cwd));
+    }
+    catch {
+        /* ignore — engine defaults stand */
+    }
     const systemPrompt = await makeRunSystemPrompt(opts.cwd, opts.systemPrompt ?? defaultRunSystemPrompt);
     // Level 9 — session setup (create or resume)
     const persistEnabled = opts.persist !== false;
@@ -193,6 +201,7 @@ export async function runOnce(opts) {
             aborted: 'aborted',
             no_final: 'aborted',
             verify_failed: 'verify_failed',
+            stuck: 'stuck',
         };
         try {
             await store.setStatus(sessionId, statusMap[result.status] ?? 'complete', result.finalText);

package/dist/index.js

@@ -12,9 +12,6 @@
  * Configure via env: KLYRO_BASE_URL, KLYRO_API_KEY, KLYRO_MODEL.
  */
 import { Command, InvalidArgumentError } from 'commander';
-import { readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import { dirname, resolve } from 'node:path';
 import { chat } from './chat.js';
 import { repl } from './repl.js';
 import { startRepl } from './cli/repl.js';
@@ -25,46 +22,7 @@ import { runDoctor } from './cli/doctor.js';
 import { runCompletion } from './cli/completion.js';
 import { runUpdate } from './cli/update.js';
 import { runLogin, runLogout } from './cli/auth.js';
-// Read version from package.json so `klyro --version` always matches the
-// published version. Walks up from this file (src/index.ts) to find the
-// nearest package.json.
-function readVersion() {
-    const here = dirname(fileURLToPath(import.meta.url));
-    const candidates = [
-        resolve(here, '..', 'package.json'),
-        resolve(here, '../..', 'package.json'),
-        resolve(here, '../../package.json'),
-    ];
-    for (const pkgPath of candidates) {
-        try {
-            const raw = readFileSync(pkgPath, 'utf8');
-            const pkg = JSON.parse(raw);
-            if (typeof pkg.version === 'string' && pkg.version.length > 0)
-                return pkg.version;
-        }
-        catch (err) {
-            const e = err;
-            // Only ignore missing file; surface JSON parse errors
-            if (e.code === 'ENOENT')
-                continue;
-            // Malformed JSON — warn but don't crash version output
-            process.stderr.write(`klyro: warning: malformed ${pkgPath}: ${e.message}\n`);
-            continue;
-        }
-    }
-    // Fallback: try require-style resolution
-    try {
-        const pkgPath = resolve(process.cwd(), 'package.json');
-        const raw = readFileSync(pkgPath, 'utf8');
-        const pkg = JSON.parse(raw);
-        if (pkg.name === 'klyro' && typeof pkg.version === 'string')
-            return pkg.version;
-    }
-    catch {
-        // ignore
-    }
-    return '0.0.0';
-}
+import { readVersion } from './version.js';
 const VERSION = readVersion();
 function parsePositiveInt(name, v) {
     const n = Number(v);

package/dist/persistence/store.d.ts

@@ -9,7 +9,7 @@
  * ~50-task eval suite. v1.0 can swap in SQLite behind the same
  * SessionStore interface.
  */
-export type SessionStatus = 'open' | 'complete' | 'verify_failed' | 'aborted' | 'max_steps';
+export type SessionStatus = 'open' | 'complete' | 'verify_failed' | 'aborted' | 'max_steps' | 'stuck';
 export interface SessionConfig {
     model: string;
     maxSteps: number;

package/dist/policy/approval.d.ts

@@ -5,12 +5,22 @@
  * Non-TTY: returns deny. Callers should treat non-TTY as the default
  * (the user opted out of prompts with `--yes` or pipe input).
  */
-export type ApprovalChoice = 'allow' | 'deny' | 'always';
+export type ApprovalChoice = 
+/** Yes, just this once. */
+'allow' | 'deny'
+/** Yes, and auto-allow this pattern for the rest of the session. */
+ | 'always'
+/** Yes, session-allow AND persist the pattern to settings (survives restarts). */
+ | 'always-persist';
 export interface ApprovalRequest {
     toolName: string;
     reason: string;
     /** Best-effort summary of the call (command or path). */
     summary: string;
+    /** Raw tool input — used to derive the approval pattern when `pattern` is absent. */
+    input?: Record<string, unknown>;
+    /** Pre-derived approval pattern (`tool(glob)` grammar). */
+    pattern?: string;
 }
 export interface ApprovalPrompt {
     ask(req: ApprovalRequest): Promise<ApprovalChoice>;
@@ -24,12 +34,23 @@ export declare class DenyAllApprovalPrompt implements ApprovalPrompt {
     ask(_req: ApprovalRequest): Promise<ApprovalChoice>;
 }
 /**
- * In-memory allowlist: tracks "always" choices by command prefix so a
- * single prompt per command covers repeat invocations in the same session.
+ * Pattern approval cache — ask-once-per-pattern (Claude-Code-like).
+ *
+ * Wraps any inner prompt (TUI modal, stdin). The first `ask` for a pattern
+ * delegates to the user; `always` records the pattern for the session,
+ * `always-persist` additionally calls `onPersist` (the CLI wires this to
+ * append the pattern to ~/.klyro/settings.json and the live engine).
+ * Re-prompts never happen for a recorded pattern within the session.
+ *
+ * The pattern comes from `req.pattern` (pre-derived by the runtime via
+ * `patternForCall`) or is derived from `req.input` here as a fallback.
  */
-export declare class InMemoryAllowlist implements ApprovalPrompt {
+export declare class PatternApprovalCache implements ApprovalPrompt {
     private readonly inner;
-    private readonly allow;
-    constructor(inner?: ApprovalPrompt);
+    private readonly opts;
+    private readonly session;
+    constructor(inner?: ApprovalPrompt, opts?: {
+        onPersist?: (pattern: string) => void | Promise<void>;
+    });
     ask(req: ApprovalRequest): Promise<ApprovalChoice>;
 }