klyro 0.1.63 → 1.0.1

package/dist/tools/agent/spawn-agent.js

@@ -0,0 +1,50 @@
+/**
+ * P1.1 — spawn_agent tool (6-10fix.md §5).
+ *
+ * Async: starts the child worker and returns IMMEDIATELY with
+ * `{ taskId, status: 'running', ... }` — never the child transcript.
+ * Await completion with `task_wait`, poll with `task_get` / `task_list`,
+ * merge the child's worktree with `task_apply`, or abort with `task_stop`.
+ */
+import { z } from 'zod';
+import { defineTool } from '../types.js';
+import { toToolError } from '../normalize.js';
+const InputSchema = z.object({
+    agent: z.string().min(1).describe('Agent id (e.g. explorer, implementer, tester, reviewer)'),
+    task: z.string().min(1).describe('Task brief for the child agent'),
+    cwd: z.string().optional().describe('Working directory override (defaults to parent cwd)'),
+    model: z.string().optional().describe('Model override for the child (must be honoured or error)'),
+    timeoutMs: z.number().int().positive().optional().describe('Child runtime timeout in ms'),
+});
+export const spawnAgentTool = defineTool({
+    name: 'spawn_agent',
+    description: 'Spawn a child agent asynchronously; returns immediately with { taskId, status: "running", ... }. Child transcript stays separate — await it with task_wait, poll with task_get, merge with task_apply, abort with task_stop.',
+    inputSchema: InputSchema,
+    permission: 'admin',
+    isConcurrencySafe: false,
+    renderCall: (input) => `spawn_agent(${input.agent}): ${input.task.slice(0, 80)}`,
+    execute: async (input, ctx) => {
+        try {
+            const bridge = ctx.agentBridge;
+            if (!bridge) {
+                return {
+                    ok: false,
+                    error: {
+                        code: 'NO_ORCHESTRATOR',
+                        message: 'spawn_agent requires an active orchestrator (run with --agent or via a parent agent)',
+                    },
+                };
+            }
+            return await bridge.spawnAgent({
+                agent: input.agent,
+                task: input.task,
+                ...(input.cwd ? { cwd: input.cwd } : {}),
+                ...(input.model ? { model: input.model } : {}),
+                ...(input.timeoutMs ? { timeoutMs: input.timeoutMs } : {}),
+            });
+        }
+        catch (err) {
+            return { ok: false, error: toToolError(err) };
+        }
+    },
+});

package/dist/tools/agent/task-apply.d.ts

@@ -0,0 +1,4 @@
+import type { ChildSummary } from '../../agent/orchestrator.js';
+export declare const taskApplyTool: import("../types.js").Tool<{
+    taskId: string;
+}, ChildSummary>;

package/dist/tools/agent/task-apply.js

@@ -0,0 +1,44 @@
+/**
+ * task_apply tool — merge a succeeded child's work into the parent tree.
+ *
+ * For worktree-isolated children this merges the `klyro/<taskId>` branch and
+ * emits `subtask.merged`; for shared-cwd children (whose edits already
+ * landed in the parent tree) it is the explicit acknowledgement step that
+ * emits `subtask.merged` and returns the summary. Non-succeeded tasks error
+ * with NOT_READY; conflicts error with MERGE_CONFLICT.
+ */
+import { z } from 'zod';
+import { defineTool } from '../types.js';
+import { toToolError } from '../normalize.js';
+const InputSchema = z.object({
+    taskId: z.string().min(1).describe('Succeeded task id to apply (e.g. task_1)'),
+});
+export const taskApplyTool = defineTool({
+    name: 'task_apply',
+    description: 'Merge a succeeded child task into the parent tree (emits subtask.merged). Errors with NOT_READY unless the task succeeded.',
+    inputSchema: InputSchema,
+    permission: 'admin',
+    isConcurrencySafe: false,
+    renderCall: (input) => `task_apply(${input.taskId})`,
+    execute: async (input, ctx) => {
+        try {
+            const bridge = ctx.agentBridge;
+            if (!bridge) {
+                return {
+                    ok: false,
+                    error: { code: 'NO_ORCHESTRATOR', message: 'task_apply requires an active orchestrator' },
+                };
+            }
+            if (!bridge.applyTask) {
+                return {
+                    ok: false,
+                    error: { code: 'UNSUPPORTED', message: 'task_apply is not supported by this orchestrator bridge' },
+                };
+            }
+            return await bridge.applyTask(input.taskId);
+        }
+        catch (err) {
+            return { ok: false, error: toToolError(err) };
+        }
+    },
+});

package/dist/tools/agent/task-get.d.ts

@@ -0,0 +1,8 @@
+export declare const taskGetTool: import("../types.js").Tool<{
+    taskId: string;
+}, import("../../agent/task-manager.js").TaskSummary & {
+    error?: {
+        code: string;
+        message: string;
+    };
+}>;

package/dist/tools/agent/task-get.js

@@ -0,0 +1,40 @@
+/**
+ * P1.3 — task_get tool (6-10fix.md §5). Read-only + concurrency-safe.
+ * Returns one task's status and summary by id.
+ */
+import { z } from 'zod';
+import { defineTool } from '../types.js';
+import { toToolError } from '../normalize.js';
+const InputSchema = z.object({
+    taskId: z.string().min(1).describe('Task id (e.g. task_1)'),
+});
+export const taskGetTool = defineTool({
+    name: 'task_get',
+    description: "Return one child-agent task's status and summary by id.",
+    inputSchema: InputSchema,
+    permission: 'read',
+    isConcurrencySafe: true,
+    renderCall: (input) => `task_get(${input.taskId})`,
+    execute: async (input, ctx) => {
+        try {
+            const bridge = ctx.agentBridge;
+            if (!bridge) {
+                return {
+                    ok: false,
+                    error: { code: 'NO_ORCHESTRATOR', message: 'task_get requires an active orchestrator' },
+                };
+            }
+            const rec = bridge.getTask(input.taskId);
+            if (!rec) {
+                return {
+                    ok: false,
+                    error: { code: 'NOT_FOUND', message: `Unknown task: ${input.taskId}` },
+                };
+            }
+            return { ok: true, value: rec };
+        }
+        catch (err) {
+            return { ok: false, error: toToolError(err) };
+        }
+    },
+});

package/dist/tools/agent/task-list.d.ts

@@ -0,0 +1,4 @@
+export declare const taskListTool: import("../types.js").Tool<{
+    parentTaskId?: string | undefined;
+    status?: "running" | "succeeded" | "failed" | "cancelled" | "timed_out" | "blocked" | "queued" | undefined;
+}, import("../../agent/task-manager.js").TaskSummary[]>;

package/dist/tools/agent/task-list.js

@@ -0,0 +1,41 @@
+/**
+ * P1.2 — task_list tool (6-10fix.md §5). Read-only + concurrency-safe.
+ * Returns TaskSummary[] snapshots from the orchestrator's TaskManager.
+ */
+import { z } from 'zod';
+import { defineTool } from '../types.js';
+import { toToolError } from '../normalize.js';
+const InputSchema = z.object({
+    parentTaskId: z.string().optional().describe('Filter by parent task id'),
+    status: z
+        .enum(['queued', 'running', 'succeeded', 'failed', 'cancelled', 'timed_out', 'blocked'])
+        .optional()
+        .describe('Filter by status'),
+});
+export const taskListTool = defineTool({
+    name: 'task_list',
+    description: 'List child-agent tasks (running and completed) with status summaries.',
+    inputSchema: InputSchema,
+    permission: 'read',
+    isConcurrencySafe: true,
+    renderCall: () => 'task_list',
+    execute: async (input, ctx) => {
+        try {
+            const bridge = ctx.agentBridge;
+            if (!bridge) {
+                return {
+                    ok: false,
+                    error: { code: 'NO_ORCHESTRATOR', message: 'task_list requires an active orchestrator' },
+                };
+            }
+            const tasks = bridge.listTasks({
+                ...(input.parentTaskId ? { parentTaskId: input.parentTaskId } : {}),
+                ...(input.status ? { status: input.status } : {}),
+            });
+            return { ok: true, value: tasks };
+        }
+        catch (err) {
+            return { ok: false, error: toToolError(err) };
+        }
+    },
+});

package/dist/tools/agent/task-stop.d.ts

@@ -0,0 +1,6 @@
+export declare const taskStopTool: import("../types.js").Tool<{
+    taskId: string;
+}, {
+    taskId: string;
+    status: import("../../agent/task-manager.js").TaskStatus;
+}>;

package/dist/tools/agent/task-stop.js

@@ -0,0 +1,39 @@
+/**
+ * task_stop tool — cancel a running child task via `taskManager.cancel`.
+ * Idempotent on terminal tasks (returns the current status).
+ */
+import { z } from 'zod';
+import { defineTool } from '../types.js';
+import { toToolError } from '../normalize.js';
+const InputSchema = z.object({
+    taskId: z.string().min(1).describe('Task id to stop (e.g. task_1)'),
+});
+export const taskStopTool = defineTool({
+    name: 'task_stop',
+    description: 'Cancel a running child-agent task. Returns { taskId, status }. Idempotent on terminal tasks.',
+    inputSchema: InputSchema,
+    permission: 'admin',
+    isConcurrencySafe: false,
+    renderCall: (input) => `task_stop(${input.taskId})`,
+    execute: async (input, ctx) => {
+        try {
+            const bridge = ctx.agentBridge;
+            if (!bridge) {
+                return {
+                    ok: false,
+                    error: { code: 'NO_ORCHESTRATOR', message: 'task_stop requires an active orchestrator' },
+                };
+            }
+            if (!bridge.cancelTask) {
+                return {
+                    ok: false,
+                    error: { code: 'UNSUPPORTED', message: 'task_stop is not supported by this orchestrator bridge' },
+                };
+            }
+            return bridge.cancelTask(input.taskId);
+        }
+        catch (err) {
+            return { ok: false, error: toToolError(err) };
+        }
+    },
+});

package/dist/tools/agent/task-wait.d.ts

@@ -0,0 +1,17 @@
+import type { ChildSummary } from '../../agent/orchestrator.js';
+import type { TaskStatus } from '../../agent/task-manager.js';
+export interface WaitTaskEntry {
+    taskId: string;
+    status: TaskStatus;
+    summary?: ChildSummary;
+    error?: {
+        code: string;
+        message: string;
+    };
+}
+export declare const taskWaitTool: import("../types.js").Tool<{
+    taskIds: string[];
+    timeoutMs?: number | undefined;
+}, {
+    tasks: import("../../agent/orchestrator.js").WaitedTask[];
+}>;

package/dist/tools/agent/task-wait.js

@@ -0,0 +1,79 @@
+/**
+ * task_wait tool — await one or more child tasks without cancelling them.
+ *
+ * Delegates to `AgentSpawnBridge.waitForTasks` when available, otherwise
+ * polls `getTask` until every id is terminal or `timeoutMs` elapses.
+ * Entries that do not settle in time come back with status `'running'` —
+ * the underlying task keeps running. Documented contract: waiting never
+ * cancels.
+ */
+import { z } from 'zod';
+import { defineTool } from '../types.js';
+import { toToolError } from '../normalize.js';
+const TERMINAL = new Set([
+    'succeeded',
+    'failed',
+    'cancelled',
+    'timed_out',
+    'blocked',
+]);
+const InputSchema = z.object({
+    taskIds: z.array(z.string().min(1)).min(1).describe('Task ids to await (e.g. ["task_1"])'),
+    timeoutMs: z.number().int().positive().optional().describe('Per-task wait timeout in ms (unset = wait indefinitely)'),
+});
+export const taskWaitTool = defineTool({
+    name: 'task_wait',
+    description: 'Await child-agent tasks until they settle. Entries that time out return status "running" — the task is NOT cancelled. Never cancels.',
+    inputSchema: InputSchema,
+    permission: 'read',
+    isConcurrencySafe: true,
+    renderCall: (input) => `task_wait(${input.taskIds.join(', ')})`,
+    execute: async (input, ctx) => {
+        try {
+            const bridge = ctx.agentBridge;
+            if (!bridge) {
+                return {
+                    ok: false,
+                    error: { code: 'NO_ORCHESTRATOR', message: 'task_wait requires an active orchestrator' },
+                };
+            }
+            if (bridge.waitForTasks) {
+                const r = await bridge.waitForTasks(input.taskIds, input.timeoutMs);
+                return { ok: true, value: r };
+            }
+            // Fallback for bridges without waitForTasks: poll getTask snapshots.
+            const deadline = input.timeoutMs !== undefined ? Date.now() + input.timeoutMs : undefined;
+            const tasks = [];
+            for (const taskId of input.taskIds) {
+                let snap = bridge.getTask(taskId);
+                if (!snap) {
+                    tasks.push({ taskId, status: 'failed', error: { code: 'NOT_FOUND', message: `Unknown task: ${taskId}` } });
+                    continue;
+                }
+                while (!TERMINAL.has(snap.status) && (deadline === undefined || Date.now() < deadline)) {
+                    await new Promise((r) => setTimeout(r, 10));
+                    const next = bridge.getTask(taskId);
+                    if (next)
+                        snap = next;
+                }
+                tasks.push({
+                    taskId,
+                    status: snap.status,
+                    summary: {
+                        taskId: snap.id,
+                        agentName: snap.agentName,
+                        status: snap.status,
+                        durationMs: snap.durationMs ?? 0,
+                        changedFiles: [],
+                        ...(snap.error ? { error: { code: snap.error.code, message: snap.error.message } } : {}),
+                    },
+                    ...(snap.error ? { error: { code: snap.error.code, message: snap.error.message } } : {}),
+                });
+            }
+            return { ok: true, value: { tasks } };
+        }
+        catch (err) {
+            return { ok: false, error: toToolError(err) };
+        }
+    },
+});

package/dist/tools/fs/apply-patch.js

@@ -23,6 +23,40 @@ import { defineTool } from '../types.js';
 import { resolveAndFollowSymlinks } from '../../policy/path-guard.js';
 import { safe } from '../normalize.js';
 import { wasRead } from './read-history.js';
+// Extension-anchored: matches test.ts, foo.test.ts, foo-test.ts, foo.spec.js,
+// __tests__ segments — but NOT latest.ts / attest.ts / contest-data.
+const TEST_BASENAME_RE = /(^|[._-])(test|spec)\.[^.]+$|\.test\.[^.]+$|\.spec\.[^.]+$|__(tests|snapshots)__/i;
+function repairGuardHit(targetPath, _content) {
+    const base = targetPath.split(/[\\/]/).pop() ?? targetPath;
+    // Basename alone decides. Patch CONTENT is never consulted for non-test
+    // paths (the old assert-skip regex over-blocked ordinary sources
+    // containing e.g. `it(` or `test(`), and stays unconsulted for test-like
+    // paths too since the basename already denies.
+    return TEST_BASENAME_RE.test(base);
+}
+async function allowedHit(cwd, resolved, allowed) {
+    if (!allowed)
+        return false;
+    // Canonicalize both sides (realpath) so lexical-vs-canonical spellings
+    // of the same directory (e.g. Windows 8.3 short names) compare equal.
+    const canon = async (p) => {
+        try {
+            return await fs.realpath(p);
+        }
+        catch {
+            return path.resolve(p);
+        }
+    };
+    const canonTarget = await canon(resolved);
+    for (const base of allowed) {
+        const absBase = path.isAbsolute(base) ? path.resolve(base) : path.resolve(cwd, base);
+        const canonBase = await canon(absBase);
+        const rel = path.relative(canonBase, canonTarget);
+        if (rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel)))
+            return false;
+    }
+    return true;
+}
 const InputSchema = z.object({
     patch: z.string().min(1).describe('Unified diff patch text'),
 });
@@ -116,6 +150,28 @@ async function guardWrite(cwd, relPath, resolved) {
         // missing file → creation path, no guard needed
     }
 }
+// TOCTOU shrink (mirrors write_file): re-resolve symlinks immediately
+// before the write and refuse if the target moved. Compares canonicalized
+// forms (not raw strings) to avoid false positives from
+// lexical-vs-canonical spellings (e.g. `sub/../a.txt`, short names).
+async function assertSameTarget(cwd, relPath, resolved) {
+    const { resolved: reResolved } = await resolveAndFollowSymlinks(cwd, relPath);
+    const canon = async (p) => {
+        try {
+            return await fs.realpath(p);
+        }
+        catch { /* missing file → try parent */ }
+        try {
+            return path.join(await fs.realpath(path.dirname(p)), path.basename(p));
+        }
+        catch {
+            return p;
+        }
+    };
+    if ((await canon(reResolved)) !== (await canon(resolved))) {
+        throw Object.assign(new Error(`Path target changed between check and write: ${relPath} (POLICY_DENIED)`), { code: 'POLICY_DENIED' });
+    }
+}
 export const applyPatchTool = defineTool({
     name: 'apply_patch',
     description: 'Apply a unified diff patch (Codex-style). Real hunk application with context matching; mismatches fail loudly.',
@@ -130,6 +186,13 @@ export const applyPatchTool = defineTool({
             for (const line of lines) {
                 if (line.startsWith('*** Begin Patch') || line.startsWith('*** End Patch'))
                     continue;
+                // Delete sections are NOT supported — reject loudly rather than
+                // mis-parsing the section as a write.
+                if (line.startsWith('*** Delete File:')) {
+                    throw Object.assign(new Error(`Delete sections not supported: ${line.trim()} (INVALID_PATCH)`), {
+                        code: 'INVALID_PATCH',
+                    });
+                }
                 if (line.startsWith('*** Update File:')) {
                     cur = { op: 'update', path: line.replace('*** Update File:', '').trim(), body: [] };
                     sections.push(cur);
@@ -150,7 +213,13 @@ export const applyPatchTool = defineTool({
             for (const sec of sections) {
                 if (!sec.path)
                     throw Object.assign(new Error('Patch section missing file path'), { code: 'INVALID_PATCH' });
+                if (ctx.repairGuard?.denyTestEdits && repairGuardHit(sec.path, sec.body.join('\n'))) {
+                    throw Object.assign(new Error('repair-guard: test edits denied (denyTestEdits)'), { code: 'POLICY_DENIED' });
+                }
                 const { resolved } = await resolveAndFollowSymlinks(ctx.cwd, sec.path);
+                if (await allowedHit(ctx.cwd, resolved, ctx.agentAllowedPaths)) {
+                    throw Object.assign(new Error(`agent path not allowed: ${resolved} (POLICY_DENIED)`), { code: 'POLICY_DENIED' });
+                }
                 const hunks = parseHunks(sec.body);
                 if (sec.op === 'add' || hunks.length === 0) {
                     // Creation path: content from + lines (legacy tolerant format).
@@ -171,6 +240,7 @@ export const applyPatchTool = defineTool({
                         .map((l) => l.slice(1))
                         .join('\n');
                     await guardWrite(ctx.cwd, sec.path, resolved);
+                    await assertSameTarget(ctx.cwd, sec.path, resolved);
                     await fs.mkdir(path.dirname(resolved), { recursive: true });
                     await fs.writeFile(resolved, content ? content + '\n' : '', 'utf-8');
                     patchedFiles.push(sec.path);
@@ -192,6 +262,7 @@ export const applyPatchTool = defineTool({
                 if (hasTrailingNewline && fileLines[fileLines.length - 1] === '')
                     fileLines.pop();
                 const next = applyHunks(sec.path, fileLines, hunks);
+                await assertSameTarget(ctx.cwd, sec.path, resolved);
                 await fs.mkdir(path.dirname(resolved), { recursive: true });
                 await fs.writeFile(resolved, next.join('\n') + (hasTrailingNewline ? '\n' : ''), 'utf-8');
                 patchedFiles.push(sec.path);

package/dist/tools/fs/edit-file.js

@@ -3,12 +3,51 @@
  * Strict: ambiguous matches fail unless replaceAll=true. Missing match fails.
  */
 import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
 import * as crypto from 'node:crypto';
 import { z } from 'zod';
 import { defineTool } from '../types.js';
 import { resolveAndFollowSymlinks } from '../../policy/path-guard.js';
 import { safe } from '../normalize.js';
 import { wasRead } from './read-history.js';
+// Extension-anchored: matches test.ts, foo.test.ts, foo-test.ts, foo.spec.js,
+// __tests__ segments — but NOT latest.ts / attest.ts / contest-data.
+const TEST_BASENAME_RE = /(^|[._-])(test|spec)\.[^.]+$|\.test\.[^.]+$|\.spec\.[^.]+$|__(tests|snapshots)__/i;
+function checkRepairGuard(targetPath, _content, deny) {
+    if (!deny)
+        return null;
+    const base = targetPath.split(/[\\/]/).pop() ?? targetPath;
+    // Basename alone decides. File CONTENT is never consulted for non-test
+    // paths (the old assert-skip regex over-blocked ordinary sources
+    // containing e.g. `it(` or `test(`), and stays unconsulted for test-like
+    // paths too since the basename already denies.
+    if (!TEST_BASENAME_RE.test(base))
+        return null;
+    return { ok: false, error: { code: 'POLICY_DENIED', message: 'repair-guard: test edits denied (denyTestEdits)' } };
+}
+async function checkAllowedPaths(cwd, resolved, allowed) {
+    if (!allowed)
+        return null;
+    // Canonicalize both sides (realpath) so lexical-vs-canonical spellings
+    // of the same directory (e.g. Windows 8.3 short names) compare equal.
+    const canon = async (p) => {
+        try {
+            return await fs.realpath(p);
+        }
+        catch {
+            return path.resolve(p);
+        }
+    };
+    const canonTarget = await canon(resolved);
+    for (const base of allowed) {
+        const absBase = path.isAbsolute(base) ? path.resolve(base) : path.resolve(cwd, base);
+        const canonBase = await canon(absBase);
+        const rel = path.relative(canonBase, canonTarget);
+        if (rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel)))
+            return null;
+    }
+    return { ok: false, error: { code: 'POLICY_DENIED', message: `agent path not allowed: ${resolved}` } };
+}
 const InputSchema = z.object({
     path: z.string().min(1),
     find: z.string().min(1).describe('Exact substring to match. Not a regex.'),
@@ -36,7 +75,13 @@ export const editFileTool = defineTool({
     renderResult: (output) => `${output.path} ${output.replacements} replacement(s)`,
     execute: async (input, ctx) => {
         return safe(async () => {
+            const guard = checkRepairGuard(input.path, `${input.find}\n${input.replace}`, ctx.repairGuard?.denyTestEdits);
+            if (guard)
+                return guard;
             const { resolved } = await resolveAndFollowSymlinks(ctx.cwd, input.path);
+            const allowed = await checkAllowedPaths(ctx.cwd, resolved, ctx.agentAllowedPaths);
+            if (allowed)
+                return allowed;
             // 4.1: staleness check via mtime+hash
             const stat = await fs.stat(resolved);
             const raw = await fs.readFile(resolved, 'utf-8');
@@ -112,6 +157,26 @@ export const editFileTool = defineTool({
             // Preserve BOM
             if (hasBOM)
                 next = '\uFEFF' + next;
+            // TOCTOU shrink (mirrors write_file): re-resolve symlinks immediately
+            // before the write and refuse if the target moved. Compares
+            // canonicalized forms (not raw strings) to avoid false positives from
+            // lexical-vs-canonical spellings (e.g. `sub/../a.txt`, short names).
+            const { resolved: reResolved } = await resolveAndFollowSymlinks(ctx.cwd, input.path);
+            const canon = async (p) => {
+                try {
+                    return await fs.realpath(p);
+                }
+                catch { /* missing file → try parent */ }
+                try {
+                    return path.join(await fs.realpath(path.dirname(p)), path.basename(p));
+                }
+                catch {
+                    return p;
+                }
+            };
+            if ((await canon(reResolved)) !== (await canon(resolved))) {
+                throw Object.assign(new Error(`Path target changed between check and write: ${input.path} (POLICY_DENIED)`), { code: 'POLICY_DENIED' });
+            }
             const tmp = `${resolved}.klyro-edit-${process.pid}-${Date.now()}-${crypto.randomBytes(4).toString('hex')}.tmp`;
             await fs.writeFile(tmp, next, 'utf-8');
             // Ensure fsync before rename (like write_file)

package/dist/tools/fs/multi-edit.d.ts

@@ -9,6 +9,10 @@ export declare const multiEditTool: import("../types.js").Tool<{
         replaceAll?: boolean | undefined;
     }[];
 }, {
+    path: string;
+    edits: number;
+    diff: string;
+} | {
     readonly path: string;
     readonly edits: number;
     readonly diff: `multi_edit ${number} edits`;

package/dist/tools/fs/multi-edit.js

@@ -9,6 +9,45 @@ import { resolveAndFollowSymlinks } from '../../policy/path-guard.js';
 import { safe } from '../normalize.js';
 import { wasRead } from './read-history.js';
 import { checkStaleness, recordEditStaleness } from './edit-file.js';
+import * as path from 'node:path';
+// Extension-anchored: matches test.ts, foo.test.ts, foo-test.ts, foo.spec.js,
+// __tests__ segments — but NOT latest.ts / attest.ts / contest-data.
+const TEST_BASENAME_RE = /(^|[._-])(test|spec)\.[^.]+$|\.test\.[^.]+$|\.spec\.[^.]+$|__(tests|snapshots)__/i;
+function checkRepairGuard(targetPath, _content, deny) {
+    if (!deny)
+        return null;
+    const base = targetPath.split(/[\\/]/).pop() ?? targetPath;
+    // Basename alone decides. File CONTENT is never consulted for non-test
+    // paths (the old assert-skip regex over-blocked ordinary sources
+    // containing e.g. `it(` or `test(`), and stays unconsulted for test-like
+    // paths too since the basename already denies.
+    if (!TEST_BASENAME_RE.test(base))
+        return null;
+    return { ok: false, error: { code: 'POLICY_DENIED', message: 'repair-guard: test edits denied (denyTestEdits)' } };
+}
+async function checkAllowedPaths(cwd, resolved, allowed) {
+    if (!allowed)
+        return null;
+    // Canonicalize both sides (realpath) so lexical-vs-canonical spellings
+    // of the same directory (e.g. Windows 8.3 short names) compare equal.
+    const canon = async (p) => {
+        try {
+            return await fs.realpath(p);
+        }
+        catch {
+            return path.resolve(p);
+        }
+    };
+    const canonTarget = await canon(resolved);
+    for (const base of allowed) {
+        const absBase = path.isAbsolute(base) ? path.resolve(base) : path.resolve(cwd, base);
+        const canonBase = await canon(absBase);
+        const rel = path.relative(canonBase, canonTarget);
+        if (rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel)))
+            return null;
+    }
+    return { ok: false, error: { code: 'POLICY_DENIED', message: `agent path not allowed: ${resolved}` } };
+}
 const EditSchema = z.object({
     find: z.string().min(1),
     replace: z.string(),
@@ -26,7 +65,14 @@ export const multiEditTool = defineTool({
     isConcurrencySafe: false,
     execute: async (input, ctx) => {
         return safe(async () => {
+            const combined = input.edits.map((e) => `${e.find}\n${e.replace}`).join('\n');
+            const guard = checkRepairGuard(input.path, combined, ctx.repairGuard?.denyTestEdits);
+            if (guard)
+                return guard;
             const { resolved } = await resolveAndFollowSymlinks(ctx.cwd, input.path);
+            const allowed = await checkAllowedPaths(ctx.cwd, resolved, ctx.agentAllowedPaths);
+            if (allowed)
+                return allowed;
             const stat = await fs.stat(resolved);
             let content = await fs.readFile(resolved, 'utf-8');
             if (checkStaleness(resolved, stat.mtimeMs, crypto.createHash('sha256').update(content, 'utf-8').digest('hex'))) {
@@ -44,6 +90,26 @@ export const multiEditTool = defineTool({
                     throw Object.assign(new Error(`edit ${i}: ambiguous (${count} matches)`), { code: 'MATCH_AMBIGUOUS' });
                 content = e.replaceAll ? content.split(e.find).join(e.replace) : content.replace(e.find, e.replace);
             }
+            // TOCTOU shrink (mirrors write_file): re-resolve symlinks immediately
+            // before the write and refuse if the target moved. Compares
+            // canonicalized forms (not raw strings) to avoid false positives from
+            // lexical-vs-canonical spellings (e.g. `sub/../a.txt`, short names).
+            const { resolved: reResolved } = await resolveAndFollowSymlinks(ctx.cwd, input.path);
+            const canon = async (p) => {
+                try {
+                    return await fs.realpath(p);
+                }
+                catch { /* missing file → try parent */ }
+                try {
+                    return path.join(await fs.realpath(path.dirname(p)), path.basename(p));
+                }
+                catch {
+                    return p;
+                }
+            };
+            if ((await canon(reResolved)) !== (await canon(resolved))) {
+                throw Object.assign(new Error(`Path target changed between check and write: ${input.path} (POLICY_DENIED)`), { code: 'POLICY_DENIED' });
+            }
             const tmp = `${resolved}.klyro-multi-${Date.now()}.tmp`;
             await fs.writeFile(tmp, content, 'utf-8');
             try {