klyro 0.1.63 → 1.0.1

package/dist/persistence/store.js

@@ -10,8 +10,10 @@
  * SessionStore interface.
  */
 import * as fs from 'node:fs/promises';
+import * as fsSync from 'node:fs';
 import * as path from 'node:path';
 import { randomUUID } from 'node:crypto';
+import { redact } from '../policy/secret-redactor.js';
 export class SessionStore {
     dir;
     indexPath;
@@ -75,6 +77,28 @@ export class SessionStore {
         return Math.abs(h).toString(36);
     }
     perProjectIndexPath(cwd) { return path.join(this.dir, `index-${this.projectHash(cwd)}.json`); }
+    /** Atomic per-project index write (tmp + fsync + rename). */
+    async writePerProjectIndex(pp, pIdx) {
+        const tmp = `${pp}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+        await fs.writeFile(tmp, JSON.stringify(pIdx, null, 2), 'utf-8');
+        try {
+            const fh = await fs.open(tmp, 'r+');
+            try {
+                await fh.sync();
+            }
+            finally {
+                await fh.close();
+            }
+        }
+        catch { /* ignore on Windows */ }
+        try {
+            await fs.rename(tmp, pp);
+        }
+        catch {
+            await fs.unlink(tmp).catch(() => undefined);
+            throw new Error('Failed to write per-project sessions index');
+        }
+    }
     titleFor(task) {
         // heuristic title via first 6 words, or model.small would be used if available
         const w = task.trim().split(/\s+/).slice(0, 6).join(' ');
@@ -84,24 +108,39 @@ export class SessionStore {
         // Locked: the index read-modify-write below races under concurrent creates.
         return this.withLock('index', async () => {
             await this.ensureDir();
-            const id = randomUUID();
+            // Redact at the persist boundary — tasks routinely paste keys/tokens.
+            const task = redact(opts.task);
+            let id = randomUUID();
+            // Cross-process session lock: O_EXCL so a concurrent creator (another
+            // process resuming/creating the same id path) can detect contention.
+            // On collision fall back to a unique id suffix — never crash.
+            try {
+                await fs.writeFile(path.join(this.dir, `${id}.lock`), String(process.pid), { flag: 'wx' });
+            }
+            catch {
+                id = `${id}-${process.pid}-${Date.now().toString(36)}`;
+                try {
+                    await fs.writeFile(path.join(this.dir, `${id}.lock`), String(process.pid), { flag: 'wx' });
+                }
+                catch { /* best-effort only */ }
+            }
             const now = Date.now();
             const record = {
                 id,
                 cwd: opts.cwd,
-                task: opts.task,
+                task,
                 status: 'open',
                 createdAt: now,
                 updatedAt: now,
                 config: opts.config,
             };
-            record.title = this.titleFor(opts.task);
+            record.title = this.titleFor(task);
             await fs.writeFile(path.join(this.dir, `${id}.json`), JSON.stringify({ record, messages: [], observations: [] }, null, 2));
             await this.appendJsonl(id, { type: 'session.create', record, ts: now });
             const idx = await this.readIndex();
             idx[id] = record;
             await this.writeIndex(idx);
-            // per-project index
+            // per-project index (atomic)
             try {
                 const pp = this.perProjectIndexPath(opts.cwd);
                 let pIdx = {};
@@ -110,7 +149,7 @@ export class SessionStore {
                 }
                 catch { }
                 pIdx[id] = record;
-                await fs.writeFile(pp, JSON.stringify(pIdx, null, 2), 'utf-8');
+                await this.writePerProjectIndex(pp, pIdx);
             }
             catch { }
             return record;
@@ -136,13 +175,13 @@ export class SessionStore {
         await this.appendJsonl(forked.id, { type: 'session.fork', from: id, ts: Date.now() });
         return forked;
     }
-    /** Delete a session and all its artifacts (record, transcript, jsonl, indexes). */
+    /** Delete a session and all its artifacts (record, transcript, jsonl, lock, indexes). */
     async delete(id) {
         return this.withLock('index', async () => {
             const rec = await this.get(id);
             if (!rec)
                 return false;
-            for (const f of [`${id}.json`, `${id}.jsonl`]) {
+            for (const f of [`${id}.json`, `${id}.jsonl`, `${id}.lock`]) {
                 try {
                     await fs.unlink(path.join(this.dir, f));
                 }
@@ -156,7 +195,7 @@ export class SessionStore {
                 const raw = await fs.readFile(pp, 'utf-8');
                 const pIdx = JSON.parse(raw);
                 delete pIdx[id];
-                await fs.writeFile(pp, JSON.stringify(pIdx, null, 2), 'utf-8');
+                await this.writePerProjectIndex(pp, pIdx);
             }
             catch { /* ignore */ }
             return true;
@@ -241,14 +280,19 @@ export class SessionStore {
     async appendMessage(id, message) {
         return this.withLock(id, async () => {
             const data = await this.readSession(id);
-            data.messages.push(message);
+            data.messages.push({ ...message, content: redactStoredContent(message.content) });
             await this.writeSession(id, data);
         });
     }
     async appendObservation(id, obs) {
         return this.withLock(id, async () => {
             const data = await this.readSession(id);
-            data.observations.push(obs);
+            // S4-at-rest: redact observation input/output at the persist boundary.
+            data.observations.push({
+                ...obs,
+                input: redactStoredContent(obs.input),
+                output: redactStoredContent(obs.output),
+            });
             await this.writeSession(id, data);
         });
     }
@@ -256,9 +300,16 @@ export class SessionStore {
         return this.withLock(id, async () => {
             const data = await this.readSession(id);
             data.record.status = status;
+            // S4-at-rest: redact finalText before persisting.
             if (finalText !== undefined)
-                data.record.finalText = finalText;
+                data.record.finalText = redact(finalText);
             await this.writeSession(id, data);
+            // Terminal states release the cross-process lock (no destructor exists
+            // to do it — the session is done, so the lock is stale by definition).
+            if (status === 'complete' || status === 'aborted' || status === 'max_steps' ||
+                status === 'verify_failed' || status === 'stuck') {
+                await releaseSessionLock(this.dir, id);
+            }
         });
     }
     async loadMessages(id) {
@@ -278,9 +329,85 @@ export class SessionStore {
         const idx = await this.readIndex();
         return idx[id] ?? null;
     }
-    /** Atomic append — survives crashes; suitable for audit log. */
+    /** Atomic append + fsync — survives crashes; suitable for audit log. */
     static async appendJsonl(filePath, entry) {
         await fs.mkdir(path.dirname(filePath), { recursive: true });
-        await fs.appendFile(filePath, JSON.stringify(entry) + '\n', 'utf-8');
+        const fh = await fs.open(filePath, 'a');
+        try {
+            await fh.write(JSON.stringify(entry) + '\n');
+            await fh.sync();
+        }
+        finally {
+            await fh.close();
+        }
+    }
+}
+/**
+ * Redact text blocks of a stored message at the persist boundary.
+ * Handles string content, `{ text }` blocks, arrays of blocks, and plain
+ * objects (observation input/output) via a deep walk over string leaves.
+ * Only secret-shaped strings (key/token/password patterns, [:=-] shapes)
+ * are touched — normal prose passes through unchanged.
+ */
+export function redactStoredContent(content) {
+    if (typeof content === 'string')
+        return redact(content);
+    if (Array.isArray(content)) {
+        return content.map((b) => {
+            if (b && typeof b === 'object' && typeof b.text === 'string') {
+                return { ...b, text: redact(b.text) };
+            }
+            if (typeof b === 'string')
+                return redact(b);
+            if (b && typeof b === 'object')
+                return redactStoredContent(b);
+            return b;
+        });
+    }
+    if (content && typeof content === 'object') {
+        const rec = content;
+        if (typeof rec.text === 'string') {
+            return { ...rec, text: redact(rec.text) };
+        }
+        const out = {};
+        for (const [k, v] of Object.entries(rec)) {
+            out[k] = typeof v === 'string' ? redact(v) : (v && typeof v === 'object' ? redactStoredContent(v) : v);
+        }
+        return out;
+    }
+    return content;
+}
+/**
+ * Cross-process session lock probe. The lock file `<sessionsDir>/<id>.lock`
+ * contains the holder's PID. `alive` is resolved via `process.kill(pid, 0)`:
+ * EPERM means alive-but-unpermitted (→ true); ESRCH / other errors → false.
+ */
+export function readSessionLock(sessionsDir, id) {
+    let raw;
+    try {
+        raw = fsSync.readFileSync(path.join(sessionsDir, `${id}.lock`), 'utf-8');
+    }
+    catch {
+        return { held: false };
+    }
+    const pid = Number(raw.trim());
+    if (!Number.isInteger(pid) || pid <= 0)
+        return { held: true };
+    let alive;
+    try {
+        process.kill(pid, 0);
+        alive = true;
+    }
+    catch (err) {
+        const code = err?.code;
+        alive = code === 'EPERM';
+    }
+    return { held: true, pid, alive };
+}
+/** Best-effort release of the cross-process session lock. Never throws. */
+export async function releaseSessionLock(sessionsDir, id) {
+    try {
+        await fs.unlink(path.join(sessionsDir, `${id}.lock`));
     }
+    catch { /* ignore */ }
 }

package/dist/policy/approval.d.ts

@@ -25,6 +25,20 @@ export interface ApprovalRequest {
 export interface ApprovalPrompt {
     ask(req: ApprovalRequest): Promise<ApprovalChoice>;
 }
+/**
+ * Sanitize untrusted tool text before showing it in an approval prompt.
+ * Strips ANSI escapes (CSI `ESC[...letter` and OSC `ESC]...BEL`), control
+ * chars except `\n`/`\t`, and truncates to 500 chars with a hidden-count
+ * marker so prompt-injection / terminal-escape payloads can't ride along.
+ */
+export declare function sanitizeForPrompt(s: string): string;
+/**
+ * Single-key approval mapping shared by the TUI modal (and documented here
+ * so stdin stays consistent): lowercase `a` = session-only, UPPERCASE `A` =
+ * persist to settings. Case MUST be checked before lowercasing — the old TUI
+ * code lowercased first, so `A` silently became session-only `always`.
+ */
+export declare function approvalChoiceForKey(inputStr: string): ApprovalChoice | 'expand' | 'explain' | null;
 /** Default prompt backed by readline on stdin/stdout. */
 export declare class StdinApprovalPrompt implements ApprovalPrompt {
     ask(req: ApprovalRequest): Promise<ApprovalChoice>;

package/dist/policy/approval.js

@@ -8,6 +8,45 @@
 import * as readline from 'node:readline/promises';
 import { stdin as input, stdout as output } from 'node:process';
 import { patternForCall } from './patterns.js';
+/**
+ * Sanitize untrusted tool text before showing it in an approval prompt.
+ * Strips ANSI escapes (CSI `ESC[...letter` and OSC `ESC]...BEL`), control
+ * chars except `\n`/`\t`, and truncates to 500 chars with a hidden-count
+ * marker so prompt-injection / terminal-escape payloads can't ride along.
+ */
+export function sanitizeForPrompt(s) {
+    const noAnsi = s
+        .replace(/\x1b\[[0-9;]*[A-Za-z]/g, '')
+        .replace(/\x1b\][^\x07]*\x07/g, '');
+    const clean = noAnsi.replace(/[\x00-\x08\x0b-\x0d\x0e-\x1f\x7f]/g, '');
+    const LIMIT = 500;
+    if (clean.length > LIMIT) {
+        return clean.slice(0, LIMIT) + `…[+${clean.length - LIMIT} hidden]`;
+    }
+    return clean;
+}
+/**
+ * Single-key approval mapping shared by the TUI modal (and documented here
+ * so stdin stays consistent): lowercase `a` = session-only, UPPERCASE `A` =
+ * persist to settings. Case MUST be checked before lowercasing — the old TUI
+ * code lowercased first, so `A` silently became session-only `always`.
+ */
+export function approvalChoiceForKey(inputStr) {
+    if (inputStr === 'A')
+        return 'always-persist';
+    const c = inputStr.toLowerCase();
+    if (c === 'y')
+        return 'allow';
+    if (c === 'a')
+        return 'always';
+    if (c === 'd' || c === 'n' || c === 'e')
+        return 'deny';
+    if (c === 'f')
+        return 'expand';
+    if (c === '?')
+        return 'explain';
+    return null;
+}
 /** Default prompt backed by readline on stdin/stdout. */
 export class StdinApprovalPrompt {
     async ask(req) {
@@ -15,10 +54,13 @@ export class StdinApprovalPrompt {
             return 'deny';
         const rl = readline.createInterface({ input, output });
         try {
-            process.stdout.write(`\n[approval needed] ${req.toolName}: ${req.summary}\n  reason: ${req.reason}\n  allow? [y/n/a(llow)] `);
-            const ans = (await rl.question('')).trim().toLowerCase();
+            process.stdout.write(`\n[approval needed] ${req.toolName}: ${sanitizeForPrompt(req.summary)}\n  reason: ${sanitizeForPrompt(req.reason)}\n  allow? [y/n/a/A(llow always → settings)] (y=once, n=deny, a=session, A=persist) `);
+            const raw = (await rl.question('')).trim();
+            const ans = raw.toLowerCase();
             if (ans === 'y' || ans === 'yes')
                 return 'allow';
+            if (raw === 'A')
+                return 'always-persist';
             if (ans === 'a' || ans === 'allow')
                 return 'always';
             return 'deny';

package/dist/policy/engine.d.ts

@@ -83,6 +83,7 @@ export declare class PolicyEngine {
 }
 /** Builtin set of rules. Order matters: first match wins. */
 export declare function builtinRules(): PolicyRule[];
+export declare function matchesGlobRule(call: ToolCallLike, rule: string): boolean;
 /** Hard-deny for obviously destructive shell patterns. */
 export declare const shellDenyRule: PolicyRule;
 /** Allowlist for shell — exact or prefix. Anything not in the list asks. */

package/dist/policy/engine.js

@@ -80,17 +80,33 @@ export class PolicyEngine {
         const globDecision = this.evaluateGlobRules(call);
         if (globDecision)
             return globDecision;
-        // 3.4 — .env guard: deny writes to .env files unless explicitly allowed
-        if ((call.name === 'write_file' || call.name === 'edit_file') && typeof call.input.path === 'string') {
-            const p = String(call.input.path);
-            if (/(^|\/)\.env(\.|$)/.test(p) || p.endsWith('.env')) {
-                // Check if explicitly allowed via allow list
-                const allowed = (ctx.config.allow ?? []).some((r) => r.includes('.env'));
-                if (!allowed) {
+        // Centralized .env guard: any tool with a string `path` input pointing
+        // at an env file is denied unless an allow rule explicitly names that
+        // tool+path (exact/glob match — substring `.includes('.env')` is NOT enough).
+        const maybePath = typeof call.input.path === 'string' ? String(call.input.path) : null;
+        if (maybePath !== null && isEnvPath(maybePath)) {
+            const allowed = isExplicitlyAllowedForPath(call.name, maybePath, ctx.config.allow);
+            if (!allowed) {
+                return { action: 'deny', reason: 'write to .env denied by policy — add to allow list or use --yolo' };
+            }
+        }
+        // apply_patch carries paths inside the patch text, not `input.path`.
+        if (call.name === 'apply_patch' && typeof call.input.patch === 'string') {
+            const targets = extractPatchPaths(String(call.input.patch)).filter(isEnvPath);
+            if (targets.length > 0) {
+                const allAllowed = targets.every((t) => isExplicitlyAllowedForPath(call.name, t, ctx.config.allow));
+                if (!allAllowed) {
                     return { action: 'deny', reason: 'write to .env denied by policy — add to allow list or use --yolo' };
                 }
             }
         }
+        // Shell redirection into .env (e.g. `echo x > .env`, `cmd >> .env.local`).
+        if (call.name === 'shell_exec' && typeof call.input.command === 'string') {
+            const cmd = String(call.input.command);
+            if (/>+\s*['"]?[^'"\s]*\.env/i.test(cmd)) {
+                return { action: 'deny', reason: 'write to .env via shell redirection denied' };
+            }
+        }
         for (const rule of this.rules) {
             const d = rule.evaluate(call, ctx);
             if (d)
@@ -157,9 +173,35 @@ export function builtinRules() {
 function asString(v) {
     return typeof v === 'string' ? v : '';
 }
-function matchesGlobRule(call, rule) {
-    // Rule grammar: tool or tool(glob). e.g. "write_file", "write_file(.env)", "shell_exec(npm *)"
-    const m = /^([a-z_]+)(?:\((.*)\))?$/.exec(rule.trim());
+function isEnvPath(p) {
+    const lower = p.toLowerCase();
+    // Sample/template carve-out: `.env.example`-style files are documentation,
+    // not secrets — reads AND writes are allowed.
+    if (/[.](example|sample|template|dist)$/.test(lower))
+        return false;
+    return /(^|\/)\.env(\.|$)/.test(lower) || lower.endsWith('.env');
+}
+function extractPatchPaths(patch) {
+    const out = [];
+    for (const line of patch.split('\n')) {
+        if (line.startsWith('*** Update File:'))
+            out.push(line.replace('*** Update File:', '').trim());
+        else if (line.startsWith('*** Add File:'))
+            out.push(line.replace('*** Add File:', '').trim());
+    }
+    return out.filter(Boolean);
+}
+/** True when an allow rule explicitly names this tool+path (exact/glob match, not substring). */
+function isExplicitlyAllowedForPath(callName, envPath, allow) {
+    if (!allow || allow.length === 0)
+        return false;
+    const synthetic = { name: callName, input: { path: envPath } };
+    return allow.some((r) => matchesGlobRule(synthetic, r));
+}
+export function matchesGlobRule(call, rule) {
+    // Rule grammar: tool or tool(glob). e.g. "write_file", "write_file(.env)", "shell_exec(npm *)".
+    // Digits are allowed so generated names (e.g. mcp__server__tool2) can be targeted.
+    const m = /^([a-z0-9_]+)(?:\((.*)\))?$/.exec(rule.trim());
     if (!m)
         return false;
     const tool = m[1];
@@ -203,6 +245,45 @@ export const shellDenyRule = {
         if (/\b(curl|wget|fetch|iwr|Invoke-WebRequest)\b.*\|\s*(sh|bash|zsh|cmd|powershell|pwsh|node|node\s+-e)\b/i.test(cmd)) {
             return { action: 'deny', reason: 'pipe-to-shell: remote download piped into an interpreter' };
         }
+        // Exfiltration denylist (mirrors shell_exec DANGEROUS_PATTERNS).
+        if (/\bcurl\b.*(?:\s-d\b|\s--data(?:-binary|-urlencode)?\b|\s--upload-file\b)/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: curl with --data/-d/--upload-file denied' };
+        }
+        if (/\bwget\b.*--post-(data|file)\b/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: wget --post-data/--post-file denied' };
+        }
+        if (/\b(powershell|pwsh)\b.*-e(nc|ncodedcommand)\b/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: powershell -enc denied' };
+        }
+        if (/\bInvoke-Expression\b/i.test(cmd) || /\biex\s*\(/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: Invoke-Expression/iex denied' };
+        }
+        if (/\bcertutil\b.*-urlcache\b/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: certutil -urlcache denied' };
+        }
+        if (/\bbitsadmin\b.*\/transfer\b/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: bitsadmin /transfer denied' };
+        }
+        // .env writes via tee / PowerShell (mirrors shell_exec DANGEROUS_PATTERNS).
+        if (/\|\s*tee\b[^\n]*\.env/i.test(cmd)) {
+            return { action: 'deny', reason: 'write to .env via tee denied' };
+        }
+        if (/\b(Set-Content|Out-File)\b[^\n]*\.env/i.test(cmd)) {
+            return { action: 'deny', reason: 'write to .env via Set-Content/Out-File denied' };
+        }
+        // Upload-form exfiltration (mirrors shell_exec DANGEROUS_PATTERNS).
+        if (/\bcurl\b.*(?:\s-F\b|\s--form\b)/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: curl -F/--form denied' };
+        }
+        if (/\bwget\b.*(?:\s--method=POST\b|\s--body-data\b)/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: wget --method=POST/--body-data denied' };
+        }
+        if (/\bInvoke-RestMethod\b/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: Invoke-RestMethod denied' };
+        }
+        if (/\bStart-BitsTransfer\b/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: Start-BitsTransfer denied' };
+        }
         return null;
     },
 };

package/dist/policy/secret-redactor.js

@@ -24,6 +24,10 @@ const PATTERNS = [
     { name: 'api-key', re: /(?:api[_-]?key|apikey)\s*[:=]\s*['"]?[A-Za-z0-9_\-]{16,}['"]?/gi },
     { name: 'password', re: /(?:password|passwd|pwd)\s*[:=]\s*['"]?[^\s'"]{4,}['"]?/gi },
     { name: 'secret-generic', re: /(?:secret|token)\s*[:=]\s*['"]?[A-Za-z0-9_\-+/=]{16,}['"]?/gi },
+    { name: 'discord-token', re: /mfa\.[\w-]{84}|[MN][A-Za-z\d]{23}\.[\w-]{6}\.[\w-]{27}/g },
+    { name: 'npm-token', re: /\bnpm_[A-Za-z0-9]{24,}/g },
+    { name: 'sendgrid-key', re: /\bSG\.[\w-]{22}\.[\w-]{43}/g },
+    { name: 'pypi-token', re: /\bpypi-[A-Za-z0-9_-]{30,}/g },
 ];
 const REPLACEMENT = '[REDACTED]';
 /** Redact a single string (or Buffer). */

package/dist/providers/model-info.d.ts

@@ -15,4 +15,21 @@ export interface ModelInfo {
 }
 export declare const MODEL_REGISTRY: Record<string, ModelInfo>;
 export declare function getModelInfo(id: string): ModelInfo;
+/**
+ * Single-source per-1K-token rate table, derived from MODEL_REGISTRY so
+ * prices live in exactly one place. Local/self-hosted entries are $0.
+ */
+export declare const MODEL_RATES_PER_1K: Record<string, {
+    input: number;
+    output: number;
+}>;
+/**
+ * Resolve per-1K rates for any model id. Exact registry hits win, then the
+ * local-model check ($0), then hosted-family fallbacks. Unknown models are
+ * $0 — never invent nonzero prices for models we don't recognize.
+ */
+export declare function ratesFor(modelId: string): {
+    input: number;
+    output: number;
+};
 export declare function estimateCost(modelId: string, inputTokens: number, outputTokens: number): number;

package/dist/providers/model-info.js

@@ -12,7 +12,40 @@ export const MODEL_REGISTRY = {
 export function getModelInfo(id) {
     return MODEL_REGISTRY[id] ?? { id, contextWindow: 100000, maxOutput: 4096, inputPricePer1k: 0, outputPricePer1k: 0, capabilities: { tools: true } };
 }
+/**
+ * Single-source per-1K-token rate table, derived from MODEL_REGISTRY so
+ * prices live in exactly one place. Local/self-hosted entries are $0.
+ */
+export const MODEL_RATES_PER_1K = Object.fromEntries(Object.entries(MODEL_REGISTRY).map(([k, v]) => [k, { input: v.inputPricePer1k, output: v.outputPricePer1k }]));
+/** Hosted-family fallback rates for model ids not in the registry. */
+const FAMILY_RATES = [
+    { test: (m) => /o1/i.test(m), input: 0.015, output: 0.06 },
+    { test: (m) => /gpt-3\.5/i.test(m), input: 0.0005, output: 0.0015 },
+    { test: (m) => /gpt-4/i.test(m), input: 0.003, output: 0.015 },
+    { test: (m) => /claude|anthropic/i.test(m), input: 0.003, output: 0.015 },
+    { test: (m) => /gemini/i.test(m), input: 0.00075, output: 0.003 },
+];
+/** Local/self-hosted model ids are always priced at $0. */
+const LOCAL_MODEL_PATTERN = /local|ollama|llama|mistral|mixtral|qwen|gemma|phi-|vllm|llama\.cpp|^mock/i;
+/**
+ * Resolve per-1K rates for any model id. Exact registry hits win, then the
+ * local-model check ($0), then hosted-family fallbacks. Unknown models are
+ * $0 — never invent nonzero prices for models we don't recognize.
+ */
+export function ratesFor(modelId) {
+    const exact = MODEL_RATES_PER_1K[modelId];
+    if (exact)
+        return exact;
+    if (LOCAL_MODEL_PATTERN.test(modelId))
+        return { input: 0, output: 0 };
+    const fam = FAMILY_RATES.find((r) => r.test(modelId));
+    if (fam)
+        return { input: fam.input, output: fam.output };
+    return { input: 0, output: 0 };
+}
 export function estimateCost(modelId, inputTokens, outputTokens) {
-    const info = getModelInfo(modelId);
-    return (inputTokens / 1000) * info.inputPricePer1k + (outputTokens / 1000) * info.outputPricePer1k;
+    // Single source: delegate to ratesFor so registry, family fallbacks, and
+    // local-$0 rules live in exactly one place (no split-brain with getModelInfo).
+    const { input, output } = ratesFor(modelId);
+    return (inputTokens / 1000) * input + (outputTokens / 1000) * output;
 }

package/dist/repl.d.ts

@@ -6,4 +6,10 @@
  *
  * Type ':quit' (or Ctrl-C / Ctrl-D) to exit.
  */
+export interface Turn {
+    role: 'user' | 'assistant';
+    content: string;
+}
 export declare function repl(system: string): Promise<void>;
+/** Drop oldest turns to stay under the size cap. Keep user/assistant pairs together. */
+export declare function trimHistory(history: Turn[]): void;

package/dist/repl.js

@@ -10,6 +10,7 @@ import * as readline from 'node:readline/promises';
 import { stdin, exit } from 'node:process';
 import { streamToStdout, readBoundedText } from './chat.js';
 import { resolveProvider, providerHelp } from './providers.js';
+import { estimateTokens } from './context/tokenizer.js';
 /** Cap conversation history so we don't blow the model's context window. */
 const MAX_HISTORY_TURNS = 40;
 /** Approximate char budget for the user side of history. */
@@ -26,6 +27,8 @@ export async function repl(system) {
         exit(2);
     }
     const { baseURL, apiKey, model, source } = provider;
+    // Legacy REPL — prefer `klyro tui`; history truncation is approximate.
+    process.stderr.write('klyro: legacy REPL — prefer `klyro tui`; history truncation is approximate.\n');
     const history = [];
     // Adapt readline to the environment. On a TTY we let readline manage the
     // prompt and echo so the user sees their typing; on a pipe we suppress both
@@ -94,7 +97,7 @@ export async function repl(system) {
     }
 }
 /** Drop oldest turns to stay under the size cap. Keep user/assistant pairs together. */
-function trimHistory(history) {
+export function trimHistory(history) {
     // Keep even number of turns (pairs) when trimming for turn count
     while (history.length > MAX_HISTORY_TURNS) {
         // Drop oldest 2 (user+assistant) to preserve adjacency
@@ -106,21 +109,23 @@ function trimHistory(history) {
             history.shift();
         }
     }
-    let total = 0;
-    for (const t of history)
-        total += t.content.length;
-    while (total > MAX_HISTORY_CHARS && history.length > 2) {
+    // Token-budgeted trim (approximate): estimate over the joined history
+    // instead of raw chars so long-token text (CJK, code) trims correctly.
+    const budgetTokens = Math.ceil(MAX_HISTORY_CHARS / 4);
+    if (estimateTokens(history.map((t) => t.content).join('\n')) <= budgetTokens)
+        return;
+    while (history.length > 2) {
         // Drop oldest pair to avoid orphaning tool context
         const first = history[0];
         const second = history[1];
         if (!first)
             break;
-        total -= first.content.length;
         history.shift();
         if (second) {
-            total -= second.content.length;
             history.shift();
         }
+        if (estimateTokens(history.map((t) => t.content).join('\n')) <= budgetTokens)
+            break;
     }
 }
 /** Send the full history, stream the reply, return the assistant text. */

package/dist/tools/agent/spawn-agent.d.ts

@@ -0,0 +1,9 @@
+import type { ChildSummary } from '../../agent/orchestrator.js';
+export declare const spawnAgentTool: import("../types.js").Tool<{
+    agent: string;
+    task: string;
+    cwd?: string | undefined;
+    model?: string | undefined;
+    timeoutMs?: number | undefined;
+}, ChildSummary>;
+export type SpawnAgentOutput = ChildSummary;