klyro 0.1.63 → 1.0.1

package/dist/checkpoints/store.js

@@ -7,6 +7,19 @@ import * as crypto from 'node:crypto';
 function ckptDir(cwd) {
     return path.join(cwd, '.klyro', 'checkpoints');
 }
+/** Best-effort fsync of a just-written file (crash safety). */
+async function fsyncFile(p) {
+    try {
+        const fh = await fs.open(p, 'r+');
+        try {
+            await fh.sync();
+        }
+        finally {
+            await fh.close();
+        }
+    }
+    catch { /* ignore on Windows */ }
+}
 /**
  * Resolve a checkpoint file list entry inside cwd. Returns null for anything
  * escaping the project (no arbitrary read/write outside cwd, via either the
@@ -39,6 +52,7 @@ export async function snapshot(cwd, files) {
                 continue;
             await fs.mkdir(path.dirname(out), { recursive: true });
             await fs.writeFile(out, data);
+            await fsyncFile(out);
             kept.push(rel);
         }
         catch (e) {
@@ -47,8 +61,11 @@ export async function snapshot(cwd, files) {
                 missing.push(f);
         }
     }
-    // Save meta
-    await fs.writeFile(path.join(dest, '.meta.json'), JSON.stringify({ id, files: kept, missing, ts: Date.now() }, null, 2));
+    // Save meta (fsync before the checkpoint is visible — mirrors the
+    // SessionStore.writeIndex atomic pattern).
+    const metaPath = path.join(dest, '.meta.json');
+    await fs.writeFile(metaPath, JSON.stringify({ id, files: kept, missing, ts: Date.now() }, null, 2));
+    await fsyncFile(metaPath);
     // Best-effort last.diff for the repair guard (guardRepair reads it).
     try {
         const { spawn } = await import('node:child_process');
@@ -86,8 +103,15 @@ export async function snapshot(cwd, files) {
                 resolve('');
             });
         });
-        if (diffText)
+        if (diffText) {
             await fs.writeFile(path.join(dir, 'last.diff'), diffText, 'utf-8');
+            // Per-checkpoint diff file (best-effort); the repair guard keeps
+            // reading last.diff, so its behavior is unchanged.
+            try {
+                await fs.writeFile(path.join(dir, `${id}.diff`), diffText, 'utf-8');
+            }
+            catch { /* best-effort only */ }
+        }
     }
     catch { /* best-effort only */ }
     return id;
@@ -96,8 +120,9 @@ export async function listCheckpoints(cwd) {
     const dir = ckptDir(cwd);
     try {
         const entries = await fs.readdir(dir);
-        // last.diff is a guard artifact, not a checkpoint (must never be an undo target).
-        return entries.filter((e) => !e.startsWith('.') && e !== 'last.diff').sort();
+        // last.diff is a guard artifact and <id>.diff files are per-checkpoint
+        // diffs — neither is a checkpoint (must never be an undo target).
+        return entries.filter((e) => !e.startsWith('.') && e !== 'last.diff' && !e.endsWith('.diff')).sort();
     }
     catch {
         return [];

package/dist/cli/auth.js

@@ -111,7 +111,11 @@ export async function runLogout(provider) {
         const creds = JSON.parse(raw);
         if (provider) {
             delete creds[provider];
-            await fs.writeFile(credPath(), JSON.stringify(creds, null, 2), 'utf-8');
+            await fs.writeFile(credPath(), JSON.stringify(creds, null, 2), { mode: 0o600 });
+            try {
+                await fs.chmod(credPath(), 0o600);
+            }
+            catch { /* ignore on Windows */ }
             process.stdout.write(`Removed ${provider} key\n`);
         }
         else {
@@ -128,6 +132,17 @@ export async function runLogout(provider) {
 }
 export function getStoredKey(provider) {
     try {
+        // Warn (don't refuse) when the credentials file is group/other-readable.
+        // Refusing would lock out existing users with old umasks; warn instead.
+        if (process.platform !== 'win32') {
+            try {
+                const st = fsSync.statSync(credPath());
+                if ((st.mode & 0o077) !== 0) {
+                    process.stderr.write(`warning: credentials file ${credPath()} is group/other-readable (mode ${(st.mode & 0o777).toString(8)}) — run chmod 600 on it\n`);
+                }
+            }
+            catch { /* missing file → no warning */ }
+        }
         const raw = fsSync.readFileSync(credPath(), 'utf-8');
         const creds = JSON.parse(raw);
         const v = creds[provider];

package/dist/cli/config.d.ts

@@ -46,12 +46,18 @@ export interface PermissionRules {
  * without re-prompting.
  */
 export declare function loadPermissionRules(cwd?: string): Promise<PermissionRules>;
+export declare function isValidAllowRule(rule: string): boolean;
 /**
- * Persist an "always allow" pattern to the home settings file
- * (~/.klyro/settings.json, honors KLYRO_CONFIG). Returns whether it was
+ * Persist an "always allow" pattern. Validates the rule against the strict
+ * grammar (throws `invalid rule` otherwise). When `cwd` is a project dir
+ * (exists + contains .git or .klyro), writes to <cwd>/.klyro/settings.json;
+ * otherwise writes to the home settings file. Returns whether it was
  * added (false when already present) and the file written.
+ *
+ * NOTE for the repl integrator (sibling-owned repl.ts): pass the session
+ * cwd as the second arg to persist project-scoped allows.
  */
-export declare function persistAllowRule(rule: string): Promise<{
+export declare function persistAllowRule(rule: string, cwd?: string): Promise<{
     added: boolean;
     path: string;
 }>;

package/dist/cli/config.js

@@ -338,11 +338,72 @@ export async function loadPermissionRules(cwd = process.cwd()) {
     };
 }
 /**
- * Persist an "always allow" pattern to the home settings file
- * (~/.klyro/settings.json, honors KLYRO_CONFIG). Returns whether it was
+ * Strict allow-rule grammar: `tool` or `tool(glob)` where tool is
+ * lowercase alnum+underscore and glob contains no parens.
+ */
+const ALLOW_RULE_RE = /^[a-z0-9_]+\([^()]*\)$|^[a-z0-9_]+$/;
+export function isValidAllowRule(rule) {
+    return ALLOW_RULE_RE.test(rule.trim());
+}
+function isProjectDir(cwd) {
+    try {
+        const st = fsSync.statSync(cwd);
+        if (!st.isDirectory())
+            return false;
+    }
+    catch {
+        return false;
+    }
+    return fsSync.existsSync(path.join(cwd, '.git')) || fsSync.existsSync(path.join(cwd, '.klyro'));
+}
+/**
+ * Persist an "always allow" pattern. Validates the rule against the strict
+ * grammar (throws `invalid rule` otherwise). When `cwd` is a project dir
+ * (exists + contains .git or .klyro), writes to <cwd>/.klyro/settings.json;
+ * otherwise writes to the home settings file. Returns whether it was
  * added (false when already present) and the file written.
+ *
+ * NOTE for the repl integrator (sibling-owned repl.ts): pass the session
+ * cwd as the second arg to persist project-scoped allows.
  */
-export async function persistAllowRule(rule) {
+export async function persistAllowRule(rule, cwd) {
+    if (!isValidAllowRule(rule)) {
+        throw new Error(`invalid rule: ${rule}`);
+    }
+    // Project-scoped persist when cwd is a project dir.
+    if (cwd && isProjectDir(cwd)) {
+        const projPath = path.join(cwd, '.klyro', 'settings.json');
+        let cfg = {};
+        try {
+            const raw = await fs.readFile(projPath, 'utf-8');
+            cfg = validateConfig(parseJsonc(raw, projPath), projPath);
+        }
+        catch (err) {
+            const e = err;
+            if (e.code !== 'ENOENT')
+                throw err;
+        }
+        const allow = asStringArray(cfg.allow);
+        if (allow.includes(rule))
+            return { added: false, path: projPath };
+        cfg.allow = [...allow, rule];
+        await fs.mkdir(path.dirname(projPath), { recursive: true });
+        const tmp = `${projPath}.tmp-${process.pid}-${Date.now()}`;
+        const data = JSON.stringify(validateConfig(cfg, projPath), null, 2) + '\n';
+        await fs.writeFile(tmp, data, { mode: 0o600 });
+        try {
+            await fs.rename(tmp, projPath);
+        }
+        catch (err) {
+            await fs.unlink(tmp).catch(() => undefined);
+            throw err;
+        }
+        try {
+            await fs.chmod(projPath, 0o600);
+        }
+        catch { /* ignore on Windows */ }
+        return { added: true, path: projPath };
+    }
     const cfg = await loadConfig();
     const allow = asStringArray(cfg.allow);
     if (allow.includes(rule))

package/dist/cli/dotenv.d.ts

@@ -0,0 +1,3 @@
+export declare function parseDotenv(text: string): Record<string, string>;
+/** Load `<cwd>/.env` into `process.env` (no-clobber). Returns loaded keys. */
+export declare function loadDotenv(cwd: string): string[];

package/dist/cli/dotenv.js

@@ -0,0 +1,57 @@
+/**
+ * P0.5 — `.env` auto-load (r-11-17.md).
+ *
+ * Loads `<cwd>/.env` at startup so `KLYRO_API_KEY` etc. work without `export`.
+ * Rules:
+ * - Never overwrites an already-set variable (explicit env wins).
+ * - Only `KEY=VALUE` lines; `#` comments and `export ` prefixes tolerated.
+ * - Single/double quotes stripped; missing file is a no-op (never throws).
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+export function parseDotenv(text) {
+    const out = {};
+    for (const rawLine of text.split('\n')) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const body = line.startsWith('export ') ? line.slice('export '.length).trim() : line;
+        const eq = body.indexOf('=');
+        if (eq <= 0)
+            continue;
+        const key = body.slice(0, eq).trim();
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+            continue;
+        let val = body.slice(eq + 1).trim();
+        if (val.length >= 2 && ((val.startsWith('"') && val.endsWith('"')) || (val.startsWith("'") && val.endsWith("'")))) {
+            val = val.slice(1, -1);
+        }
+        // Strip trailing inline comments on unquoted values.
+        if (!body.slice(eq + 1).trim().startsWith('"') && !body.slice(eq + 1).trim().startsWith("'")) {
+            const hash = val.indexOf(' #');
+            if (hash >= 0)
+                val = val.slice(0, hash).trimEnd();
+        }
+        out[key] = val;
+    }
+    return out;
+}
+/** Load `<cwd>/.env` into `process.env` (no-clobber). Returns loaded keys. */
+export function loadDotenv(cwd) {
+    let text;
+    try {
+        text = fs.readFileSync(path.join(cwd, '.env'), 'utf-8');
+    }
+    catch {
+        return [];
+    }
+    const parsed = parseDotenv(text);
+    const loaded = [];
+    for (const [k, v] of Object.entries(parsed)) {
+        if (process.env[k] === undefined) {
+            process.env[k] = v;
+            loaded.push(k);
+        }
+    }
+    return loaded;
+}

package/dist/cli/eval.d.ts

@@ -39,7 +39,7 @@
  * is set, emits one JSON object per line. Exit code 0 if all pass, 1
  * otherwise.
  */
-import { type RunResult } from '../agent/runtime.js';
+import { type RunResult, type VerifyMode } from '../agent/runtime.js';
 import type { ProviderAdapter } from '../agent/provider-adapter.js';
 export interface EvalScenario {
     name: string;
@@ -47,6 +47,11 @@ export interface EvalScenario {
     model?: string;
     maxSteps?: number;
     maxTokens?: number;
+    /** Verification passthrough (default unchanged: strict pipeline when omitted). */
+    verify?: {
+        mode?: VerifyMode;
+        command?: string;
+    };
     /** Adapter events to script, as [eventKind, ...args] tuples. */
     scripted_events?: Array<Array<unknown[]>>;
     expect?: {

package/dist/cli/eval.js

@@ -236,6 +236,15 @@ export async function runScenario(sc) {
         maxSteps: sc.maxSteps,
         maxTokens: sc.maxTokens,
         nonInteractive: true,
+        ...(sc.verify
+            ? {
+                verify: {
+                    enabled: true,
+                    ...(sc.verify.command !== undefined ? { command: sc.verify.command } : {}),
+                    ...(sc.verify.mode !== undefined ? { mode: sc.verify.mode } : {}),
+                },
+            }
+            : {}),
     }, {
         adapter,
         registry,

package/dist/cli/repl.js

@@ -12,7 +12,10 @@ import { render } from 'ink';
 import { App } from '../tui/app.js';
 import { httpChatAdapter } from '../agent/provider-adapter.js';
 import { anthropicAdapter } from '../agent/anthropic-adapter.js';
+import { retryingAdapter } from '../agent/retry.js';
+import { globalBus } from '../events/bus.js';
 import { run } from '../agent/runtime.js';
+import { resolveSystemPrompt } from '../agent/runtime.js';
 import { builtinRegistry } from '../tools/registry.js';
 import { builtinRules, clonePolicyConfig, PolicyEngine } from '../policy/engine.js';
 import { buildLevel6Context } from '../context/level6.js';
@@ -26,8 +29,18 @@ import { MouseFilter, MOUSE_ENABLE, MOUSE_DISABLE, createReadWrapper } from '../
 import { inferProviderFromBaseURL } from '../agent/registry.js';
 import { getDefaultSessionStore } from '../persistence/session.js';
 import { buildSystemPrompt, parseImageInput } from '../context/system-prompt.js';
+import { memoryBlock } from '../context/memory.js';
 import { estimateCost } from '../providers/model-info.js';
+import { ContextTrust } from '../context/trust.js';
+import { redact } from '../policy/secret-redactor.js';
 export async function startRepl(opts = {}) {
+    // P0.5 — load <cwd>/.env first so provider resolution below sees KLYRO_*
+    // vars without `export`. Never throws; explicit env wins (no-clobber).
+    try {
+        const { loadDotenv } = await import('./dotenv.js');
+        loadDotenv(opts.cwd ?? process.cwd());
+    }
+    catch { /* ignore */ }
     // Reuse the same provider resolution as legacy repl.ts — probes local
     // Ollama / LM Studio / vLLM when env is not fully set, so bare `klyro`
     // works with a local model just like `klyro chat` does.
@@ -81,6 +94,66 @@ export async function startRepl(opts = {}) {
     catch {
         /* ignore — engine defaults stand */
     }
+    // Best-effort MCP tools: never fatal, never prompts. Servers live for the
+    // process lifetime, so no close wiring here (unlike runOnce's finally).
+    // NOTE: the actual loadAndRegisterMcp call lives below (after the approval
+    // object exists) so project-server approval can route through it.
+    // Local inline sanitizer for the approval prompt (duplicates the shared
+    // sanitizeForPrompt in sibling-owned policy/approval.ts — intentionally
+    // not imported; kept local to avoid coupling the REPL to that module).
+    function sanitizeForPrompt(s) {
+        return s.replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]|\x1b\[[0-9;]*[A-Za-z]/g, '').slice(0, 120);
+    }
+    async function loadMcpTools() {
+        try {
+            const { loadAndRegisterMcp } = await import('../mcp/registry.js');
+            const mcp = await loadAndRegisterMcp({
+                cwd,
+                registry,
+                policy,
+                // CONTRACT (sibling D): project-server approval hook. Registries that
+                // predate the contract ignore the unknown opt (checked via try/catch
+                // below with a skip-with-warning fallback).
+                approveProjectServer: async (info) => {
+                    // Show the disabled state alongside source before asking, so a
+                    // disabled server's approval can't be mistaken for activation.
+                    let disabledNote = '';
+                    try {
+                        const { loadMcpServers } = await import('../mcp/config.js');
+                        const cfg = loadMcpServers(cwd);
+                        const spec = cfg.servers[info.name];
+                        if (spec?.disabled)
+                            disabledNote = ' (disabled in config)';
+                    }
+                    catch { /* ignore — prompt without the note */ }
+                    const safeName = sanitizeForPrompt(info.name);
+                    const safeSource = sanitizeForPrompt(info.source);
+                    try {
+                        const choice = await approval.ask({
+                            toolName: 'mcp_project_server',
+                            reason: `MCP project server "${safeName}"${disabledNote} from ${safeSource} — approve to register its tools`,
+                            summary: safeName,
+                        });
+                        return choice === 'allow' || choice === 'always' || choice === 'always-persist';
+                    }
+                    catch {
+                        return false;
+                    }
+                },
+            });
+            for (const e of mcp.errors)
+                process.stderr.write(`klyro: mcp ${e.server}: ${e.message}\n`);
+            if (mcp.registered.length > 0) {
+                process.stderr.write(`klyro: mcp tools: ${mcp.registered.join(', ')}\n`);
+            }
+        }
+        catch {
+            try {
+                process.stderr.write('klyro: mcp project-server approval skipped (registry unavailable)\n');
+            }
+            catch { /* ignore */ }
+        }
+    }
     const providerKind = inferProviderFromBaseURL(baseUrl);
     // Local Ollama exposes OpenAI-compat but hostname could contain "anthropic"
     // via proxy — don't try anthropic adapter with empty key (would 401).
@@ -93,20 +166,37 @@ export async function startRepl(opts = {}) {
     let currentApiKey = apiKey;
     let currentMaxSteps = opts.maxSteps ?? 30;
     let effortLevel = 'medium';
-    const buildAdapter = (prov, url, key) => prov === 'anthropic'
+    // Retry wrapper lives inside the factory so the initial construction AND
+    // the /provider switch + /reload rebuilds (which re-call buildAdapter)
+    // all stay wrapped. REPL has no session id at adapter scope, so retry
+    // telemetry uses 'ephemeral'.
+    const buildAdapter = (prov, url, key) => retryingAdapter(prov === 'anthropic'
         ? anthropicAdapter({ baseURL: url, apiKey: key, timeoutMs: 60_000 })
-        : httpChatAdapter({ baseURL: url, apiKey: key, timeoutMs: 60_000 });
+        : httpChatAdapter({ baseURL: url, apiKey: key, timeoutMs: 60_000 }), {
+        onRetry: (info) => {
+            globalBus.emit({
+                type: 'provider.retry',
+                ts: Date.now(),
+                sessionId: 'ephemeral',
+                attempt: info.attempt,
+                status: info.status,
+                ...(info.retryAfterMs !== undefined ? { retryAfterMs: info.retryAfterMs } : {}),
+            });
+        },
+    });
     let adapter = buildAdapter(currentProvider, currentBaseUrl, currentApiKey);
     const ctxBlock = await buildLevel6Context({ cwd });
     let ctxPrefix = ctxBlock.formatted ? `\n\n<context>\n${ctxBlock.formatted}\n</context>` : '';
-    // 4.4 KLYRO.md hierarchy (mutable — /reload refreshes)
-    const klyroMd = await import('../context/klyro-md.js').then((m) => m.loadKlyroMd(cwd)).catch(() => '');
-    let klyroBlock = klyroMd ? `\n\n<KLYRO.md>\n${klyroMd.slice(0, 4000)}\n</KLYRO.md>` : '';
-    // 2.3 layered system prompt
+    // 4.4 KLYRO.md hierarchy (mutable — /reload refreshes). Content is gated
+    // through the context trust store (see loadKlyroBlockTrust below) — the
+    // initial value stays empty until the gated load runs after approval setup.
+    let klyroBlock = '';
+    // 2.3 layered system prompt (split shape: stable base + volatile telemetry suffix)
     const systemPromptFn = (_ctx) => {
-        const base = buildSystemPrompt({ cwd, model, extraSystem: opts.systemPrompt, appendSystem: ctxPrefix + klyroBlock });
-        const t = _ctx.telemetry ? '\n\n' + _ctx.telemetry : '';
-        return base + t;
+        // 8.4 — inject session memory so memory_write actually takes effect.
+        const memBlock = memoryBlock(cwd);
+        const base = buildSystemPrompt({ cwd, model, extraSystem: opts.systemPrompt, appendSystem: ctxPrefix + klyroBlock + memBlock });
+        return _ctx.telemetry ? { system: base, suffix: _ctx.telemetry } : { system: base };
     };
     let ac = new AbortController();
     // When the TUI is mounted, use the inline Ink prompt. Otherwise
@@ -137,6 +227,45 @@ export async function startRepl(opts = {}) {
                 });
             },
         });
+    // Context-file trust gate (context/trust.js): KLYRO.md / AGENTS.md content
+    // only enters the prompt after the trust store approves it. Untrusted files
+    // prompt via the repl approval object (allow/always/always-persist → true,
+    // deny → false); every decision emits context.trust_prompt on globalBus.
+    const trustStore = new ContextTrust();
+    async function loadKlyroBlockTrust() {
+        try {
+            const { loadTrustedKlyroMd } = await import('../context/trust.js');
+            const text = await loadTrustedKlyroMd(cwd, {
+                trust: trustStore,
+                approve: async (file, reason) => {
+                    try {
+                        const choice = await approval.ask({
+                            toolName: 'context_trust',
+                            reason: `untrusted context file (${reason}): ${file.path}`,
+                            summary: file.path,
+                        });
+                        return choice === 'allow' || choice === 'always' || choice === 'always-persist';
+                    }
+                    catch {
+                        return false;
+                    }
+                },
+                sessionId: typeof tuiSessionId === 'string' ? tuiSessionId : 'ephemeral',
+                emit: (ev) => globalBus.emit(ev),
+            });
+            return text ? `\n\n<KLYRO.md>\n${text.slice(0, 4000)}\n</KLYRO.md>` : '';
+        }
+        catch {
+            return '';
+        }
+    }
+    // MCP servers need the approval object above — load them now.
+    await loadMcpTools();
+    // Non-TUI runs can prompt on stdin immediately; the TUI defers the gated
+    // load to onMounted (the modal can't render before mount — see below).
+    if (!useTui) {
+        klyroBlock = await loadKlyroBlockTrust().catch(() => '');
+    }
     let inflight = null;
     let lastStatus = null;
     const pendingQueue = [];
@@ -440,14 +569,41 @@ export async function startRepl(opts = {}) {
         return s.length > cap ? s.slice(0, cap) + `\n... [truncated ${s.length - cap} chars]` : s;
     }
     async function execShell(command, timeoutMs = 120_000) {
-        const r = await registry.execute('shell_exec', { command, timeoutMs }, { cwd, env: process.env, nonInteractive: true });
-        if (!r.ok)
-            throw new Error(r.error.message ?? 'shell failed');
-        return r.value;
+        // Internal shell executions bypass the agent runtime's event path, so
+        // audit them here: a redacted tool.call before, the matching tool.result
+        // after. One helper covers every slash handler (/commit, /push, …).
+        const callId = `internal-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+        const sessionId = typeof tuiSessionId === 'string' ? tuiSessionId : 'ephemeral';
+        const startedAt = Date.now();
+        globalBus.emit({
+            type: 'tool.call', ts: startedAt, sessionId, callId,
+            name: 'shell_exec', input: { internal: true, command: redact(command).slice(0, 2000) },
+        });
+        try {
+            const r = await registry.execute('shell_exec', { command, timeoutMs }, { cwd, env: process.env, nonInteractive: true });
+            if (!r.ok)
+                throw new Error(r.error.message ?? 'shell failed');
+            const v = r.value;
+            globalBus.emit({
+                type: 'tool.result', ts: Date.now(), sessionId, callId,
+                name: 'shell_exec', output: { internal: true, exitCode: v.exitCode },
+                isError: false, latencyMs: Date.now() - startedAt,
+            });
+            return v;
+        }
+        catch (err) {
+            globalBus.emit({
+                type: 'tool.result', ts: Date.now(), sessionId, callId,
+                name: 'shell_exec', output: { internal: true, error: err instanceof Error ? err.message : String(err) },
+                isError: true, latencyMs: Date.now() - startedAt,
+            });
+            throw err;
+        }
     }
     /** Read-only LLM answer (no tools) — powers /ask, /explain, /compact. */
     async function answerReadOnly(question, context) {
-        const sys = systemPromptFn({ cwd, telemetry: '' }) + '\n\nAnswer read-only: do not call tools, do not edit files.';
+        // Legacy chat path (no modes): resolve the split prompt back to one string.
+        const sys = resolveSystemPrompt(systemPromptFn, { cwd, telemetry: '' }).system + '\n\nAnswer read-only: do not call tools, do not edit files.';
         const attached = await buildAttachedBlock();
         const userText = (context ? `${question}\n\n<context>\n${context.slice(0, 6000)}\n</context>` : question) + attached;
         const req = {
@@ -525,6 +681,14 @@ export async function startRepl(opts = {}) {
                     hooks.append(ev.item);
             }
             pendingQueue.length = 0;
+            // Deferred trust-gated KLYRO.md load: the approval modal can only
+            // render once the App is mounted. Prompts sent before this resolves
+            // run without the KLYRO.md block (noted in /reload output).
+            if (useTui && !klyroBlock) {
+                void loadKlyroBlockTrust()
+                    .then((b) => { klyroBlock = b; })
+                    .catch(() => undefined);
+            }
         },
     }), { patchConsole: false });
     // Install SIGINT handler only after app exists (avoids TDZ) and use once
@@ -579,7 +743,8 @@ export async function startRepl(opts = {}) {
             try {
                 const simpleReq = {
                     model,
-                    system: systemPromptFn({ cwd, telemetry: '' }),
+                    // Legacy chat path (no modes): plain string system, untouched by the split.
+                    system: resolveSystemPrompt(systemPromptFn, { cwd, telemetry: '' }).system,
                     messages: [{ role: 'user', content: [{ kind: 'text', text: taskText }] }],
                     tools: [],
                     signal: ac.signal,
@@ -2341,8 +2506,9 @@ export async function startRepl(opts = {}) {
                     }
                     const ctx = await buildLevel6Context({ cwd });
                     ctxPrefix = ctx.formatted ? `\n\n<context>\n${ctx.formatted}\n</context>` : '';
-                    const md = await import('../context/klyro-md.js').then((m) => m.loadKlyroMd(cwd)).catch(() => '');
-                    klyroBlock = md ? `\n\n<KLYRO.md>\n${md.slice(0, 4000)}\n</KLYRO.md>` : '';
+                    // Trust-gated like the initial load (the modal is mounted here,
+                    // so untrusted files prompt instead of being silently dropped).
+                    klyroBlock = await loadKlyroBlockTrust().catch(() => '');
                     queuedAppend({
                         id: `reload-${Date.now()}`,
                         kind: 'text',

package/dist/cli/run.d.ts

@@ -7,6 +7,8 @@
  * even on a long task. Tool calls and policy decisions go to stderr so
  * they don't pollute the captured `finalText` if the user pipes.
  */
+import type { VerifyMode } from '../agent/runtime.js';
+import type { SystemPromptFn } from '../agent/runtime.js';
 import type { Message } from '../agent/message.js';
 export interface RunCliOptions {
     task: string;
@@ -15,10 +17,7 @@ export interface RunCliOptions {
     maxSteps?: number;
     maxTokens?: number;
     temperature?: number;
-    systemPrompt?: (ctx: {
-        cwd: string;
-        telemetry?: string;
-    }) => string;
+    systemPrompt?: SystemPromptFn;
     baseUrl?: string;
     apiKey?: string;
     timeoutMs?: number;
@@ -60,18 +59,18 @@ export interface RunCliOptions {
     maxRepairAttempts?: number;
     verifyTimeoutMs?: number;
     requireVerify?: boolean;
+    /** Verification mode: strict (default) runs the full repair pipeline;
+     * advisory reports once without repairs; off skips verification. */
+    verifyMode?: VerifyMode;
     /** Level 9 — persistence */
     persist?: boolean;
     sessionId?: string;
     sessionsDir?: string;
+    /** P1.4 — run the task under a named child-capable orchestrator context. */
+    agent?: string;
+    maxDepth?: number;
 }
 export declare function runOnce(opts: RunCliOptions): Promise<number>;
 /** Wrap a system-prompt fn to inject Level-6 context (project map etc.) + KLYRO.md (4.4). */
-export declare function makeRunSystemPrompt(cwd: string, base: (ctx: {
-    cwd: string;
-    telemetry?: string;
-}) => string): Promise<(ctx: {
-    cwd: string;
-    telemetry?: string;
-}) => string>;
+export declare function makeRunSystemPrompt(cwd: string, base: SystemPromptFn): Promise<SystemPromptFn>;
 export declare function loadTranscript(path: string): Message[];