klyro 0.1.62 → 1.0.0

package/dist/policy/approval.d.ts

@@ -5,12 +5,22 @@
  * Non-TTY: returns deny. Callers should treat non-TTY as the default
  * (the user opted out of prompts with `--yes` or pipe input).
  */
-export type ApprovalChoice = 'allow' | 'deny' | 'always';
+export type ApprovalChoice = 
+/** Yes, just this once. */
+'allow' | 'deny'
+/** Yes, and auto-allow this pattern for the rest of the session. */
+ | 'always'
+/** Yes, session-allow AND persist the pattern to settings (survives restarts). */
+ | 'always-persist';
 export interface ApprovalRequest {
     toolName: string;
     reason: string;
     /** Best-effort summary of the call (command or path). */
     summary: string;
+    /** Raw tool input — used to derive the approval pattern when `pattern` is absent. */
+    input?: Record<string, unknown>;
+    /** Pre-derived approval pattern (`tool(glob)` grammar). */
+    pattern?: string;
 }
 export interface ApprovalPrompt {
     ask(req: ApprovalRequest): Promise<ApprovalChoice>;
@@ -24,12 +34,23 @@ export declare class DenyAllApprovalPrompt implements ApprovalPrompt {
     ask(_req: ApprovalRequest): Promise<ApprovalChoice>;
 }
 /**
- * In-memory allowlist: tracks "always" choices by command prefix so a
- * single prompt per command covers repeat invocations in the same session.
+ * Pattern approval cache — ask-once-per-pattern (Claude-Code-like).
+ *
+ * Wraps any inner prompt (TUI modal, stdin). The first `ask` for a pattern
+ * delegates to the user; `always` records the pattern for the session,
+ * `always-persist` additionally calls `onPersist` (the CLI wires this to
+ * append the pattern to ~/.klyro/settings.json and the live engine).
+ * Re-prompts never happen for a recorded pattern within the session.
+ *
+ * The pattern comes from `req.pattern` (pre-derived by the runtime via
+ * `patternForCall`) or is derived from `req.input` here as a fallback.
  */
-export declare class InMemoryAllowlist implements ApprovalPrompt {
+export declare class PatternApprovalCache implements ApprovalPrompt {
     private readonly inner;
-    private readonly allow;
-    constructor(inner?: ApprovalPrompt);
+    private readonly opts;
+    private readonly session;
+    constructor(inner?: ApprovalPrompt, opts?: {
+        onPersist?: (pattern: string) => void | Promise<void>;
+    });
     ask(req: ApprovalRequest): Promise<ApprovalChoice>;
 }

package/dist/policy/approval.js

@@ -7,6 +7,7 @@
  */
 import * as readline from 'node:readline/promises';
 import { stdin as input, stdout as output } from 'node:process';
+import { patternForCall } from './patterns.js';
 /** Default prompt backed by readline on stdin/stdout. */
 export class StdinApprovalPrompt {
     async ask(req) {
@@ -34,21 +35,48 @@ export class DenyAllApprovalPrompt {
     }
 }
 /**
- * In-memory allowlist: tracks "always" choices by command prefix so a
- * single prompt per command covers repeat invocations in the same session.
+ * Pattern approval cache — ask-once-per-pattern (Claude-Code-like).
+ *
+ * Wraps any inner prompt (TUI modal, stdin). The first `ask` for a pattern
+ * delegates to the user; `always` records the pattern for the session,
+ * `always-persist` additionally calls `onPersist` (the CLI wires this to
+ * append the pattern to ~/.klyro/settings.json and the live engine).
+ * Re-prompts never happen for a recorded pattern within the session.
+ *
+ * The pattern comes from `req.pattern` (pre-derived by the runtime via
+ * `patternForCall`) or is derived from `req.input` here as a fallback.
  */
-export class InMemoryAllowlist {
+export class PatternApprovalCache {
     inner;
-    allow = new Set();
-    constructor(inner = new DenyAllApprovalPrompt()) {
+    opts;
+    session = new Set();
+    constructor(inner = new DenyAllApprovalPrompt(), opts = {}) {
         this.inner = inner;
+        this.opts = opts;
     }
     async ask(req) {
-        if (this.allow.has(req.summary))
+        const key = req.pattern ?? patternFromRequest(req);
+        if (key && this.session.has(key))
             return 'allow';
         const choice = await this.inner.ask(req);
-        if (choice === 'always')
-            this.allow.add(req.summary);
+        if ((choice === 'always' || choice === 'always-persist') && key) {
+            this.session.add(key);
+        }
+        if (choice === 'always-persist' && key) {
+            // Best-effort: the current call is already approved via the session
+            // set above — a persist failure must not retro-deny it.
+            try {
+                await this.opts.onPersist?.(key);
+            }
+            catch {
+                /* ignore */
+            }
+        }
         return choice;
     }
 }
+function patternFromRequest(req) {
+    if (!req.input)
+        return undefined;
+    return patternForCall(req.toolName, req.input);
+}

package/dist/policy/engine.d.ts

@@ -67,6 +67,19 @@ export declare class PolicyEngine {
         nonInteractive: boolean;
     }): Promise<Decision>;
     private evaluateGlobRules;
+    /**
+     * Session rule management — appends a glob rule (`tool(glob)` grammar)
+     * if not already present. Used for persisted "always allow" patterns
+     * (loaded at startup) and live additions (approval `always→settings`).
+     */
+    addAllow(rule: string): void;
+    addDeny(rule: string): void;
+    addAsk(rule: string): void;
+    applyRules(rules: {
+        allow?: string[];
+        deny?: string[];
+        ask?: string[];
+    }): void;
 }
 /** Builtin set of rules. Order matters: first match wins. */
 export declare function builtinRules(): PolicyRule[];

package/dist/policy/engine.js

@@ -116,6 +116,34 @@ export class PolicyEngine {
         // Precedence: deny → allow → ask
         return check(this.config.deny, 'deny') ?? check(this.config.allow, 'allow') ?? check(this.config.ask, 'ask') ?? null;
     }
+    /**
+     * Session rule management — appends a glob rule (`tool(glob)` grammar)
+     * if not already present. Used for persisted "always allow" patterns
+     * (loaded at startup) and live additions (approval `always→settings`).
+     */
+    addAllow(rule) {
+        const list = (this.config.allow ??= []);
+        if (!list.includes(rule))
+            list.push(rule);
+    }
+    addDeny(rule) {
+        const list = (this.config.deny ??= []);
+        if (!list.includes(rule))
+            list.push(rule);
+    }
+    addAsk(rule) {
+        const list = (this.config.ask ??= []);
+        if (!list.includes(rule))
+            list.push(rule);
+    }
+    applyRules(rules) {
+        for (const r of rules.allow ?? [])
+            this.addAllow(r);
+        for (const r of rules.deny ?? [])
+            this.addDeny(r);
+        for (const r of rules.ask ?? [])
+            this.addAsk(r);
+    }
 }
 /** Builtin set of rules. Order matters: first match wins. */
 export function builtinRules() {
@@ -130,8 +158,9 @@ function asString(v) {
     return typeof v === 'string' ? v : '';
 }
 function matchesGlobRule(call, rule) {
-    // Rule grammar: tool or tool(glob). e.g. "write_file", "write_file(.env)", "shell_exec(npm *)"
-    const m = /^([a-z_]+)(?:\((.*)\))?$/.exec(rule.trim());
+    // Rule grammar: tool or tool(glob). e.g. "write_file", "write_file(.env)", "shell_exec(npm *)".
+    // Digits are allowed so generated names (e.g. mcp__server__tool2) can be targeted.
+    const m = /^([a-z0-9_]+)(?:\((.*)\))?$/.exec(rule.trim());
     if (!m)
         return false;
     const tool = m[1];

package/dist/policy/patterns.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Approval patterns — the unit of "always allow this pattern".
+ *
+ * A pattern uses the same `tool(glob)` grammar the policy engine matches
+ * (`matchesGlobRule` in engine.ts), e.g. `shell_exec(npm *)`,
+ * `write_file(src/index.ts)`. Derivation is deterministic: the same call
+ * shape always yields the same pattern, so session caching can key on exact
+ * pattern equality and persisted patterns re-match across sessions.
+ *
+ * Scoping (Claude-Code-like):
+ *   - shell_exec / run_verify → first command word + ` *`
+ *     (`npm test` and `npm run build` share `shell_exec(npm *)`)
+ *   - file tools with a path → the exact path (safest: no wildcards)
+ *   - everything else → the bare tool name (whole-tool session allow)
+ */
+export declare function patternForCall(name: string, input: Record<string, unknown>): string;

package/dist/policy/patterns.js

@@ -0,0 +1,26 @@
+/**
+ * Approval patterns — the unit of "always allow this pattern".
+ *
+ * A pattern uses the same `tool(glob)` grammar the policy engine matches
+ * (`matchesGlobRule` in engine.ts), e.g. `shell_exec(npm *)`,
+ * `write_file(src/index.ts)`. Derivation is deterministic: the same call
+ * shape always yields the same pattern, so session caching can key on exact
+ * pattern equality and persisted patterns re-match across sessions.
+ *
+ * Scoping (Claude-Code-like):
+ *   - shell_exec / run_verify → first command word + ` *`
+ *     (`npm test` and `npm run build` share `shell_exec(npm *)`)
+ *   - file tools with a path → the exact path (safest: no wildcards)
+ *   - everything else → the bare tool name (whole-tool session allow)
+ */
+export function patternForCall(name, input) {
+    if ((name === 'shell_exec' || name === 'run_verify') && typeof input.command === 'string') {
+        const first = input.command.trim().split(/\s+/, 1)[0] ?? '';
+        if (first)
+            return `${name}(${first} *)`;
+    }
+    if (typeof input.path === 'string' && input.path.length > 0) {
+        return `${name}(${input.path})`;
+    }
+    return name;
+}

package/dist/tools/agent/spawn-agent.d.ts

@@ -0,0 +1,9 @@
+import type { ChildSummary } from '../../agent/orchestrator.js';
+export declare const spawnAgentTool: import("../types.js").Tool<{
+    agent: string;
+    task: string;
+    cwd?: string | undefined;
+    model?: string | undefined;
+    timeoutMs?: number | undefined;
+}, ChildSummary>;
+export type SpawnAgentOutput = ChildSummary;

package/dist/tools/agent/spawn-agent.js

@@ -0,0 +1,50 @@
+/**
+ * P1.1 — spawn_agent tool (6-10fix.md §5).
+ *
+ * Delegates to `AgentSpawnBridge.spawnAgent`, which runs the child to
+ * completion (P0/P1 scope: blocking) and returns a compact ChildSummary —
+ * never the child transcript. True background `task_wait` / `task_stop`
+ * arrives in P2.
+ */
+import { z } from 'zod';
+import { defineTool } from '../types.js';
+import { toToolError } from '../normalize.js';
+const InputSchema = z.object({
+    agent: z.string().min(1).describe('Agent id (e.g. explorer, implementer, tester, reviewer)'),
+    task: z.string().min(1).describe('Task brief for the child agent'),
+    cwd: z.string().optional().describe('Working directory override (defaults to parent cwd)'),
+    model: z.string().optional().describe('Model override for the child (must be honoured or error)'),
+    timeoutMs: z.number().int().positive().optional().describe('Child runtime timeout in ms'),
+});
+export const spawnAgentTool = defineTool({
+    name: 'spawn_agent',
+    description: 'Spawn a child agent and return its compact summary { taskId, status, ... }. Child transcript stays separate; use task_get for status.',
+    inputSchema: InputSchema,
+    permission: 'admin',
+    isConcurrencySafe: false,
+    renderCall: (input) => `spawn_agent(${input.agent}): ${input.task.slice(0, 80)}`,
+    execute: async (input, ctx) => {
+        try {
+            const bridge = ctx.agentBridge;
+            if (!bridge) {
+                return {
+                    ok: false,
+                    error: {
+                        code: 'NO_ORCHESTRATOR',
+                        message: 'spawn_agent requires an active orchestrator (run with --agent or via a parent agent)',
+                    },
+                };
+            }
+            return await bridge.spawnAgent({
+                agent: input.agent,
+                task: input.task,
+                ...(input.cwd ? { cwd: input.cwd } : {}),
+                ...(input.model ? { model: input.model } : {}),
+                ...(input.timeoutMs ? { timeoutMs: input.timeoutMs } : {}),
+            });
+        }
+        catch (err) {
+            return { ok: false, error: toToolError(err) };
+        }
+    },
+});

package/dist/tools/agent/task-get.d.ts

@@ -0,0 +1,8 @@
+export declare const taskGetTool: import("../types.js").Tool<{
+    taskId: string;
+}, import("../../agent/task-manager.js").TaskSummary & {
+    error?: {
+        code: string;
+        message: string;
+    };
+}>;

package/dist/tools/agent/task-get.js

@@ -0,0 +1,40 @@
+/**
+ * P1.3 — task_get tool (6-10fix.md §5). Read-only + concurrency-safe.
+ * Returns one task's status and summary by id.
+ */
+import { z } from 'zod';
+import { defineTool } from '../types.js';
+import { toToolError } from '../normalize.js';
+const InputSchema = z.object({
+    taskId: z.string().min(1).describe('Task id (e.g. task_1)'),
+});
+export const taskGetTool = defineTool({
+    name: 'task_get',
+    description: "Return one child-agent task's status and summary by id.",
+    inputSchema: InputSchema,
+    permission: 'read',
+    isConcurrencySafe: true,
+    renderCall: (input) => `task_get(${input.taskId})`,
+    execute: async (input, ctx) => {
+        try {
+            const bridge = ctx.agentBridge;
+            if (!bridge) {
+                return {
+                    ok: false,
+                    error: { code: 'NO_ORCHESTRATOR', message: 'task_get requires an active orchestrator' },
+                };
+            }
+            const rec = bridge.getTask(input.taskId);
+            if (!rec) {
+                return {
+                    ok: false,
+                    error: { code: 'NOT_FOUND', message: `Unknown task: ${input.taskId}` },
+                };
+            }
+            return { ok: true, value: rec };
+        }
+        catch (err) {
+            return { ok: false, error: toToolError(err) };
+        }
+    },
+});

package/dist/tools/agent/task-list.d.ts

@@ -0,0 +1,4 @@
+export declare const taskListTool: import("../types.js").Tool<{
+    parentTaskId?: string | undefined;
+    status?: "running" | "succeeded" | "failed" | "cancelled" | "timed_out" | "blocked" | "queued" | undefined;
+}, import("../../agent/task-manager.js").TaskSummary[]>;

package/dist/tools/agent/task-list.js

@@ -0,0 +1,41 @@
+/**
+ * P1.2 — task_list tool (6-10fix.md §5). Read-only + concurrency-safe.
+ * Returns TaskSummary[] snapshots from the orchestrator's TaskManager.
+ */
+import { z } from 'zod';
+import { defineTool } from '../types.js';
+import { toToolError } from '../normalize.js';
+const InputSchema = z.object({
+    parentTaskId: z.string().optional().describe('Filter by parent task id'),
+    status: z
+        .enum(['queued', 'running', 'succeeded', 'failed', 'cancelled', 'timed_out', 'blocked'])
+        .optional()
+        .describe('Filter by status'),
+});
+export const taskListTool = defineTool({
+    name: 'task_list',
+    description: 'List child-agent tasks (running and completed) with status summaries.',
+    inputSchema: InputSchema,
+    permission: 'read',
+    isConcurrencySafe: true,
+    renderCall: () => 'task_list',
+    execute: async (input, ctx) => {
+        try {
+            const bridge = ctx.agentBridge;
+            if (!bridge) {
+                return {
+                    ok: false,
+                    error: { code: 'NO_ORCHESTRATOR', message: 'task_list requires an active orchestrator' },
+                };
+            }
+            const tasks = bridge.listTasks({
+                ...(input.parentTaskId ? { parentTaskId: input.parentTaskId } : {}),
+                ...(input.status ? { status: input.status } : {}),
+            });
+            return { ok: true, value: tasks };
+        }
+        catch (err) {
+            return { ok: false, error: toToolError(err) };
+        }
+    },
+});

package/dist/tools/plan/todo-write.d.ts

@@ -2,7 +2,7 @@ export declare const todoWriteTool: import("../types.js").Tool<{
     todos: {
         id: string;
         title: string;
-        status: "done" | "pending" | "in_progress" | "failed" | "skipped";
+        status: "done" | "pending" | "failed" | "in_progress" | "skipped";
         files?: string[] | undefined;
     }[];
 }, {

package/dist/tools/registry.js

@@ -25,6 +25,9 @@ import { findSymbolTool } from './symbols/find-symbol.js';
 import { lspDiagnosticsTool, lspGotoDefinitionTool } from './lsp/diagnostics.js';
 import { expandResultTool } from './expand-result.js';
 import { memoryWriteTool } from './memory-write.js';
+import { spawnAgentTool } from './agent/spawn-agent.js';
+import { taskListTool } from './agent/task-list.js';
+import { taskGetTool } from './agent/task-get.js';
 import { zodToJsonSchema } from './schema.js';
 export class ToolRegistry {
     tools = new Map();
@@ -107,5 +110,8 @@ export const builtinRegistry = () => {
     r.register(lspGotoDefinitionTool);
     r.register(expandResultTool);
     r.register(memoryWriteTool);
+    r.register(spawnAgentTool);
+    r.register(taskListTool);
+    r.register(taskGetTool);
     return r;
 };

package/dist/tools/types.d.ts

@@ -48,6 +48,18 @@ export interface ToolContext {
     };
     /** Emit KlyroEvent */
     emit?: (ev: import('../events/catalog.js').KlyroEvent) => void;
+    /** Delegation bridge (set when an orchestrator is active). Powers spawn_agent/task_* tools. */
+    agentBridge?: import('../agent/orchestrator.js').AgentSpawnBridge;
+    /** The task id this agent belongs to, when running under an orchestrator. */
+    parentTaskId?: string;
+    /** Depth of the current agent in the spawn tree (0 = root). Used to build ParentContextRef for spawn_agent. */
+    agentDepth?: number;
+    /** Max allowed spawn depth for this branch. */
+    agentMaxDepth?: number;
+    /** Effective tool allow-set of the current agent (null = all). Child can never exceed this. */
+    agentAllowedTools?: ReadonlySet<string> | null;
+    /** Model override active for the current agent. */
+    agentModel?: string;
 }
 /**
  * A typed tool definition. TInput is the validated input shape; TOutput is

package/dist/tui/approval.d.ts

@@ -13,7 +13,7 @@
  *      a Promise.
  *   3. The App polls getPending() on every render to show a modal.
  *   4. The App's useInput handler sees a pending prompt and routes
- *      y/n/a to the resolver.
+ *      y/a/A/n to the resolver (A = always-persist to settings).
  *
  * Non-TTY mode (no Ink mounted) keeps using StdinApprovalPrompt; this
  * module is only used when the TUI is active.

package/dist/tui/approval.js

@@ -14,7 +14,7 @@ import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
  *      a Promise.
  *   3. The App polls getPending() on every render to show a modal.
  *   4. The App's useInput handler sees a pending prompt and routes
- *      y/n/a to the resolver.
+ *      y/a/A/n to the resolver (A = always-persist to settings).
  *
  * Non-TTY mode (no Ink mounted) keeps using StdinApprovalPrompt; this
  * module is only used when the TUI is active.
@@ -85,7 +85,7 @@ export function ApprovalModal({ bridge }) {
             return;
         }
         if (c === 'A') {
-            bridge.resolve('always');
+            bridge.resolve('always-persist');
             return;
         }
         if (c === 'd' || c === 'n') {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "klyro",
-  "version": "0.1.62",
-  "description": "Klyro \u2014 autonomous coding harness CLI that streams from any OpenAI-compatible or Anthropic LLM endpoint.",
+  "version": "1.0.0",
+  "description": "Klyro — autonomous coding harness CLI that streams from any OpenAI-compatible or Anthropic LLM endpoint.",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",