klyro 1.0.0 → 1.0.1

package/dist/tools/fs/write-file.js

@@ -11,6 +11,44 @@ import { z } from 'zod';
 import { defineTool } from '../types.js';
 import { resolveAndFollowSymlinks } from '../../policy/path-guard.js';
 import { safe } from '../normalize.js';
+// Extension-anchored: matches test.ts, foo.test.ts, foo-test.ts, foo.spec.js,
+// __tests__ segments — but NOT latest.ts / attest.ts / contest-data.
+const TEST_BASENAME_RE = /(^|[._-])(test|spec)\.[^.]+$|\.test\.[^.]+$|\.spec\.[^.]+$|__(tests|snapshots)__/i;
+function checkRepairGuard(targetPath, _content, deny) {
+    if (!deny)
+        return null;
+    const base = targetPath.split(/[\\/]/).pop() ?? targetPath;
+    // Basename alone decides. File CONTENT is never consulted for non-test
+    // paths (the old assert-skip regex over-blocked ordinary sources
+    // containing e.g. `it(` or `test(`), and stays unconsulted for test-like
+    // paths too since the basename already denies.
+    if (!TEST_BASENAME_RE.test(base))
+        return null;
+    return { ok: false, error: { code: 'POLICY_DENIED', message: 'repair-guard: test edits denied (denyTestEdits)' } };
+}
+async function checkAllowedPaths(cwd, resolved, allowed) {
+    if (!allowed)
+        return null;
+    // Canonicalize both sides (realpath) so lexical-vs-canonical spellings
+    // of the same directory (e.g. Windows 8.3 short names) compare equal.
+    const canon = async (p) => {
+        try {
+            return await fs.realpath(p);
+        }
+        catch {
+            return path.resolve(p);
+        }
+    };
+    const canonTarget = await canon(resolved);
+    for (const base of allowed) {
+        const absBase = path.isAbsolute(base) ? path.resolve(base) : path.resolve(cwd, base);
+        const canonBase = await canon(absBase);
+        const rel = path.relative(canonBase, canonTarget);
+        if (rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel)))
+            return null;
+    }
+    return { ok: false, error: { code: 'POLICY_DENIED', message: `agent path not allowed: ${resolved}` } };
+}
 const InputSchema = z.object({
     path: z.string().min(1).describe('Path relative to cwd or absolute (must be inside cwd)'),
     content: z.string().describe('File content. Use empty string to truncate.'),
@@ -26,7 +64,13 @@ export const writeFileTool = defineTool({
     renderResult: (output) => `${output.path} written ${output.bytesWritten} bytes`,
     execute: async (input, ctx) => {
         return safe(async () => {
+            const guard = checkRepairGuard(input.path, input.content, ctx.repairGuard?.denyTestEdits);
+            if (guard)
+                return guard;
             const { resolved } = await resolveAndFollowSymlinks(ctx.cwd, input.path);
+            const allowed = await checkAllowedPaths(ctx.cwd, resolved, ctx.agentAllowedPaths);
+            if (allowed)
+                return allowed;
             const parent = path.dirname(resolved);
             await fs.mkdir(parent, { recursive: true });
             // 3.2: if file exists and was not read this session, warn but allow with diff
@@ -44,6 +88,29 @@ export const writeFileTool = defineTool({
             const suffix = crypto.randomBytes(8).toString('hex');
             const tmp = path.join(parent, `.klyro-write-${process.pid}-${suffix}.tmp`);
             const data = Buffer.from(input.content, 'utf-8');
+            // TOCTOU shrink (not elimination): re-resolve symlinks immediately
+            // before the write and refuse if the target moved. A racing swap
+            // between this check and rename can still occur.
+            // NOTE: the pre-check resolution may be lexical (parent missing) while
+            // the re-resolution is canonical (parent now exists), so compare
+            // canonicalized forms — not raw strings — to avoid false positives
+            // (e.g. Windows 8.3 short-name expansion after mkdir).
+            const { resolved: reResolved } = await resolveAndFollowSymlinks(ctx.cwd, input.path);
+            const canon = async (p) => {
+                try {
+                    return await fs.realpath(p);
+                }
+                catch { /* missing file → try parent */ }
+                try {
+                    return path.join(await fs.realpath(path.dirname(p)), path.basename(p));
+                }
+                catch {
+                    return p;
+                }
+            };
+            if ((await canon(reResolved)) !== (await canon(resolved))) {
+                throw Object.assign(new Error(`Path target changed between check and write: ${input.path} (POLICY_DENIED)`), { code: 'POLICY_DENIED' });
+            }
             // Truncate to 8k tokens ~32k chars for result
             const fh = await fs.open(tmp, 'w');
             try {

package/dist/tools/registry.js

@@ -28,6 +28,9 @@ import { memoryWriteTool } from './memory-write.js';
 import { spawnAgentTool } from './agent/spawn-agent.js';
 import { taskListTool } from './agent/task-list.js';
 import { taskGetTool } from './agent/task-get.js';
+import { taskWaitTool } from './agent/task-wait.js';
+import { taskStopTool } from './agent/task-stop.js';
+import { taskApplyTool } from './agent/task-apply.js';
 import { zodToJsonSchema } from './schema.js';
 export class ToolRegistry {
     tools = new Map();
@@ -113,5 +116,8 @@ export const builtinRegistry = () => {
     r.register(spawnAgentTool);
     r.register(taskListTool);
     r.register(taskGetTool);
+    r.register(taskWaitTool);
+    r.register(taskStopTool);
+    r.register(taskApplyTool);
     return r;
 };

package/dist/tools/shell/background.js

@@ -2,7 +2,7 @@
  * 4.3 — Background shell: shell(run_in_background), bash_output, kill_shell, /jobs
  */
 import { spawn } from 'node:child_process';
-import { findBlockedReason } from './shell-exec.js';
+import { findBlockedReason, filteredEnv } from './shell-exec.js';
 const jobs = new Map();
 let counter = 0;
 const MAX_JOBS = 5;
@@ -32,7 +32,9 @@ export function startBackground(command, cwd) {
     if (blocked)
         throw new Error(`Command blocked: ${blocked}`);
     const id = `job-${++counter}-${Date.now().toString(36)}`;
-    const proc = spawn(command, { cwd, shell: true, windowsHide: true });
+    // Filtered env, same call shape as shell_exec — background children must
+    // not inherit secrets from the parent process.
+    const proc = spawn(command, { cwd, shell: true, windowsHide: true, env: filteredEnv() });
     const job = { id, command, cwd, proc, output: '', start: Date.now() };
     jobs.set(id, job);
     proc.stdout?.on('data', (b) => { job.output += b.toString(); if (job.output.length > 1_000_000)
@@ -56,7 +58,8 @@ export function startBackgroundArgv(argv, cwd) {
     if (argv.length === 0)
         throw new Error('startBackgroundArgv requires argv');
     const id = `job-${++counter}-${Date.now().toString(36)}`;
-    const proc = spawn(argv[0], argv.slice(1), { cwd, shell: false, windowsHide: true });
+    // Filtered env, same call shape as shell_exec (see startBackground).
+    const proc = spawn(argv[0], argv.slice(1), { cwd, shell: false, windowsHide: true, env: filteredEnv() });
     const job = { id, command: argv.join(' '), cwd, proc, output: '', start: Date.now() };
     jobs.set(id, job);
     proc.stdout?.on('data', (b) => { job.output += b.toString(); if (job.output.length > 1_000_000)

package/dist/tools/shell/sandbox.d.ts

@@ -0,0 +1,51 @@
+/**
+ * G1-1 — OS-level sandbox shim for shell/subprocess tools.
+ *
+ * Bounds even a *compromised* tool call by the kernel, not by policy. Path
+ * guards + the destructive-pattern denylist stop a cooperative model; this
+ * is the layer that stops an exploited one.
+ *
+ * Backend strategy (defense-in-depth, cheapest-first):
+ *   - `bwrap` (bubblewrap) — rootless, cross-distro, the same primitive Claude
+ *     Code's sandbox docs reference. Primary backend when present.
+ *   - landlock — kernel LSM, no helper binary needed, but requires a native
+ *     syscall helper Node can't invoke directly. Tracked for the next step.
+ *
+ * Detection is done once at startup and cached. When no backend is present we
+ * *degrade cleanly* to `undefined` — an empty sandbox command and a clearly
+ * reported status, never a pretend "sandboxed" that isn't.
+ */
+export type SandboxBackend = 'bwrap' | 'none';
+export interface SandboxStatus {
+    backend: SandboxBackend;
+    /** True when a real kernel/namespace boundary will be applied. */
+    active: boolean;
+    /** Human-readable why — for /sandbox and the trust gate. */
+    reason: string;
+}
+/**
+ * One-time detection. Cached for the process lifetime so we don't fork a
+ * probe on every tool call. bwrap only — landlock is a follow-on.
+ */
+export declare function detectSandbox(): SandboxStatus;
+/**
+ * Build a bwrap argv-wrapper for a command, bounding:
+ *   - filesystem: read-only root, bind cwd read-write (only the permitted dir)
+ *   - network: disabled (--unshare-net) for tool calls by default
+ *   - process: new PID/user namespace (--unshare-pid --unshare-user)
+ *   - devices/sockets: stripped of host access
+ *
+ * Returns `undefined` when no backend is active — the caller then runs the
+ * command normally. Sandbox is opt-out of the *command namespace*, never a
+ * silent no-op that claims to be sandboxed.
+ */
+export declare function sandboxCommand(cmd: string, args: string[], opts: {
+    cwd: string;
+    readWriteDirs?: string[];
+    allowNetwork?: boolean;
+}): {
+    cmd: string;
+    args: string[];
+} | undefined;
+/** Reset detection (tests). */
+export declare function resetSandbox(): void;

package/dist/tools/shell/sandbox.js

@@ -0,0 +1,143 @@
+/**
+ * G1-1 — OS-level sandbox shim for shell/subprocess tools.
+ *
+ * Bounds even a *compromised* tool call by the kernel, not by policy. Path
+ * guards + the destructive-pattern denylist stop a cooperative model; this
+ * is the layer that stops an exploited one.
+ *
+ * Backend strategy (defense-in-depth, cheapest-first):
+ *   - `bwrap` (bubblewrap) — rootless, cross-distro, the same primitive Claude
+ *     Code's sandbox docs reference. Primary backend when present.
+ *   - landlock — kernel LSM, no helper binary needed, but requires a native
+ *     syscall helper Node can't invoke directly. Tracked for the next step.
+ *
+ * Detection is done once at startup and cached. When no backend is present we
+ * *degrade cleanly* to `undefined` — an empty sandbox command and a clearly
+ * reported status, never a pretend "sandboxed" that isn't.
+ */
+import { spawnSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+let cachedStatus = null;
+/** Walk $PATH for an executable without shells. Returns null when absent. */
+function findOnPath(bin) {
+    const paths = (process.env.PATH ?? '').split(path.delimiter).filter(Boolean);
+    for (const dir of paths) {
+        const p = path.join(dir, bin);
+        try {
+            if (fs.statSync(p).isFile() && p.endsWith(bin))
+                return p;
+        }
+        catch {
+            /* ignore */
+        }
+    }
+    return null;
+}
+/** True when `bwrap --version` runs and reports a sane bubblewrap build. */
+function bwrapUsable(binPath) {
+    try {
+        const r = spawnSync(binPath, ['--version'], { encoding: 'utf-8', timeout: 2000, windowsHide: true });
+        return r.status === 0 && r.stdout.trim().length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * One-time detection. Cached for the process lifetime so we don't fork a
+ * probe on every tool call. bwrap only — landlock is a follow-on.
+ */
+export function detectSandbox() {
+    if (cachedStatus)
+        return cachedStatus;
+    // bubblewrap is POSIX-only; Windows guards are policy+path only (documented
+    // honestly — Windows receives a native sandbox in G1-3 via a microVM).
+    if (process.platform === 'win32') {
+        cachedStatus = {
+            backend: 'none',
+            active: false,
+            reason: 'native sandbox not yet available on win32 (G1-3 microVM planned); policy+path guards active',
+        };
+        return cachedStatus;
+    }
+    const bwrap = findOnPath('bwrap');
+    if (bwrap && bwrapUsable(bwrap)) {
+        cachedStatus = { backend: 'bwrap', active: true, reason: `bubblewrap at ${bwrap}` };
+        return cachedStatus;
+    }
+    cachedStatus = {
+        backend: 'none',
+        active: false,
+        reason: 'bwrap not found on $PATH — install bubblewrap (e.g. `apt install bubblewrap`) or run unsandboxed; policy+path guards remain active',
+    };
+    return cachedStatus;
+}
+/**
+ * Build a bwrap argv-wrapper for a command, bounding:
+ *   - filesystem: read-only root, bind cwd read-write (only the permitted dir)
+ *   - network: disabled (--unshare-net) for tool calls by default
+ *   - process: new PID/user namespace (--unshare-pid --unshare-user)
+ *   - devices/sockets: stripped of host access
+ *
+ * Returns `undefined` when no backend is active — the caller then runs the
+ * command normally. Sandbox is opt-out of the *command namespace*, never a
+ * silent no-op that claims to be sandboxed.
+ */
+export function sandboxCommand(cmd, args, opts) {
+    const status = detectSandbox();
+    if (!status.active)
+        return undefined;
+    const roDirs = ['/usr', '/bin', '/etc', '/lib', '/lib64', '/opt'];
+    const bwrapArgs = [
+        '--unshare-all',
+        '--ro-bind',
+        '/usr',
+        '/usr',
+        '--ro-bind',
+        '/bin',
+        '/bin',
+        '--ro-bind',
+        '/etc',
+        '/etc',
+        '--ro-bind',
+        '/lib',
+        '/lib',
+        '--ro-bind',
+        '/lib64',
+        '/lib64',
+        '--ro-bind',
+        '/opt',
+        '/opt',
+        '--dev',
+        '/dev',
+        '--proc',
+        '/proc',
+        '--tmpfs',
+        '/tmp',
+    ];
+    // Read-write: the permitted cwd (and any explicitly allowed dirs) only.
+    const rw = [opts.cwd, ...(opts.readWriteDirs ?? [])];
+    for (const d of roDirs)
+        void d; // (kept for parity with the read-only surface)
+    for (const d of rw) {
+        bwrapArgs.push('--bind', d, d);
+    }
+    // A clean, empty HOME so the child can't read the operator's dotfiles.
+    bwrapArgs.push('--tmpfs', '/root');
+    bwrapArgs.push('--clearenv');
+    bwrapArgs.push('--setenv', 'PATH', '/usr/bin:/bin:/usr/local/bin');
+    bwrapArgs.push('--setenv', 'HOME', '/root');
+    bwrapArgs.push('--chdir', opts.cwd);
+    if (!opts.allowNetwork) {
+        // Default: sandboxed tool calls are offline. Exfiltration via curl/wget is
+        // already denylisted at the policy layer; this is the belt-and-suspenders.
+        bwrapArgs.push('--unshare-net');
+    }
+    bwrapArgs.push('--', cmd, ...args);
+    return { cmd: 'bwrap', args: bwrapArgs };
+}
+/** Reset detection (tests). */
+export function resetSandbox() {
+    cachedStatus = null;
+}

package/dist/tools/shell/shell-exec.d.ts

@@ -17,6 +17,7 @@ declare const InputSchema: z.ZodObject<{
 }, z.core.$strip>;
 /** Reset the sticky cwd (e.g. after /cd changes the session directory). */
 export declare function resetPersistentCwd(): void;
+export declare function filteredEnv(extra?: Record<string, string>): NodeJS.ProcessEnv;
 /**
  * Shared dangerous-command check (also used by background shells).
  * Returns the block reason, or null when the command is not hard-blocked.

package/dist/tools/shell/shell-exec.js

@@ -11,9 +11,11 @@
 import { spawn, spawnSync } from 'node:child_process';
 import * as os from 'node:os';
 import * as path from 'node:path';
+import * as fsp from 'node:fs/promises';
 import { z } from 'zod';
 import { defineTool } from '../types.js';
 import { resolveWithinCwd } from '../../policy/path-guard.js';
+import { sandboxCommand, detectSandbox } from './sandbox.js';
 import { safe, TOOL_ERROR_CODES } from '../normalize.js';
 const InputSchema = z.object({
     command: z.string().min(1).describe('Shell command to execute (interpreted by /bin/sh -c on Unix, cmd.exe /c on Windows)'),
@@ -41,7 +43,7 @@ export function resetPersistentCwd() {
 }
 // Filtered env — only safe vars, secrets stripped
 const ALLOWED_ENV_PREFIXES = ['PATH', 'HOME', 'USER', 'SHELL', 'TERM', 'LANG', 'NODE_', 'NPM_', 'PNPM_', 'YARN_'];
-function filteredEnv(extra) {
+export function filteredEnv(extra) {
     const out = {};
     for (const [k, v] of Object.entries(process.env)) {
         if (k.startsWith('KLYRO_') && k.includes('API_KEY'))
@@ -99,7 +101,30 @@ const DANGEROUS_PATTERNS = [
     { pattern: /;\s*rm\s+-rf/, reason: 'chained rm -rf' },
     { pattern: /&&\s*rm\s+-rf/, reason: 'chained rm -rf' },
     { pattern: /\|\|\s*rm\s+-rf/, reason: 'chained rm -rf' },
+    // Exfiltration denylist (mirrors policy engine shellDenyRule).
+    { pattern: /\bcurl\b.*(?:\s-d\b|\s--data(?:-binary|-urlencode)?\b|\s--upload-file\b)/i, reason: 'exfiltration: curl with --data/-d/--upload-file denied' },
+    { pattern: /\bwget\b.*--post-(data|file)\b/i, reason: 'exfiltration: wget --post-data/--post-file denied' },
+    { pattern: /\b(powershell|pwsh)\b.*-e(nc|ncodedcommand)\b/i, reason: 'exfiltration: powershell -enc denied' },
+    { pattern: /\bInvoke-Expression\b/i, reason: 'exfiltration: Invoke-Expression denied' },
+    { pattern: /\biex\s*\(/i, reason: 'exfiltration: iex( denied' },
+    { pattern: /\bcertutil\b.*-urlcache\b/i, reason: 'exfiltration: certutil -urlcache denied' },
+    { pattern: /\bbitsadmin\b.*\/transfer\b/i, reason: 'exfiltration: bitsadmin /transfer denied' },
+    // .env writes via tee / PowerShell (mirrors policy engine .env guard).
+    { pattern: /\|\s*tee\b[^\n]*\.env/i, reason: 'write to .env via tee denied' },
+    { pattern: /\b(Set-Content|Out-File)\b[^\n]*\.env/i, reason: 'write to .env via Set-Content/Out-File denied' },
+    // Upload-form exfiltration (mirrors policy engine shellDenyRule).
+    { pattern: /\bcurl\b.*(?:\s-F\b|\s--form\b)/i, reason: 'exfiltration: curl -F/--form denied' },
+    { pattern: /\bwget\b.*(?:\s--method=POST\b|\s--body-data\b)/i, reason: 'exfiltration: wget --method=POST/--body-data denied' },
+    { pattern: /\bInvoke-RestMethod\b/i, reason: 'exfiltration: Invoke-RestMethod denied' },
+    { pattern: /\bStart-BitsTransfer\b/i, reason: 'exfiltration: Start-BitsTransfer denied' },
 ];
+/**
+ * Repair-guard mirror: heredoc/redirect writes to test paths, or test-path
+ * rewrites via sed/python/perl/ruby/node/git (e.g. `> x.test.ts`,
+ * `<<EOF > x.test.ts`, `sed -i`, `git apply`). Only enforced when
+ * `ctx.repairGuard?.denyTestEdits` is set.
+ */
+const REPAIR_GUARD_SHELL_RE = />+\s*['"]?[^'"\s]*test[^'"\s]*|\b(sed|python|perl|ruby|node|git)\b[^\n]*test[^'"\s]*/i;
 /**
  * Shared dangerous-command check (also used by background shells).
  * Returns the block reason, or null when the command is not hard-blocked.
@@ -113,6 +138,15 @@ export function findBlockedReason(command) {
     }
     return null;
 }
+/** Resolve symlinks on both base and target, then enforce containment. */
+async function realContainedCwd(ctxCwd, resolved) {
+    const realBase = await fsp.realpath(ctxCwd).catch(() => path.resolve(ctxCwd));
+    const realTarget = await fsp.realpath(resolved).catch(() => resolved);
+    const rel = path.relative(realBase, realTarget);
+    if (rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel)))
+        return realTarget;
+    throw Object.assign(new Error(`Path escapes cwd via symlink: ${resolved}`), { code: TOOL_ERROR_CODES.PATH_ESCAPE });
+}
 export const shellExecTool = defineTool({
     name: 'shell_exec',
     description: 'Execute a shell command. Default timeout 120s (max 600s). Output head+tail 30k chars, full to ~/.klyro/tool-output/<id>.txt. Persistent cwd, filtered env, tree-kill on timeout.',
@@ -123,6 +157,10 @@ export const shellExecTool = defineTool({
     renderResult: (output) => `exit ${output.exitCode} (${output.durationMs}ms${output.timedOut ? ' timedOut' : ''})`,
     execute: async (input, ctx) => {
         return safe(async () => {
+            // Repair-guard mirror (denyTestEdits): refuse shell writes to test paths.
+            if (ctx.repairGuard?.denyTestEdits && REPAIR_GUARD_SHELL_RE.test(input.command)) {
+                throw Object.assign(new Error('repair-guard: test edits via shell denied (denyTestEdits)'), { code: 'POLICY_DENIED' });
+            }
             // Interactive detection
             for (const pat of INTERACTIVE_PATTERNS) {
                 if (pat.test(input.command)) {
@@ -137,6 +175,9 @@ export const shellExecTool = defineTool({
             let cwd = persistentCwd ?? ctx.cwd;
             if (input.cwd) {
                 cwd = resolveWithinCwd(ctx.cwd, input.cwd).resolved;
+                // Resolve symlinks for the effective cwd before the containment
+                // check, so a symlinked subdir can't escape the workspace.
+                cwd = await realContainedCwd(ctx.cwd, cwd);
                 persistentCwd = cwd;
             }
             else if (input.command.trim().startsWith('cd ')) {
@@ -145,25 +186,56 @@ export const shellExecTool = defineTool({
                     try {
                         const target = m[1].replace(/^["']|["']$/g, '');
                         const resolved = resolveWithinCwd(cwd, target).resolved;
-                        persistentCwd = resolved;
+                        persistentCwd = await realContainedCwd(ctx.cwd, resolved);
                     }
                     catch { /* ignore */ }
                 }
             }
+            else {
+                // Even without an explicit cwd, normalize symlinks on the
+                // effective cwd so containment holds when ctx.cwd is symlinked.
+                try {
+                    cwd = await realContainedCwd(ctx.cwd, cwd);
+                }
+                catch {
+                    throw Object.assign(new Error(`Working directory escapes workspace (POLICY_DENIED)`), { code: TOOL_ERROR_CODES.PATH_ESCAPE });
+                }
+            }
             const timeoutMs = Math.min(input.timeoutMs ?? DEFAULT_TIMEOUT_MS, MAX_TIMEOUT_MS);
             const env = filteredEnv(input.env);
             const start = Date.now();
             // Detached on POSIX so timeout kills the whole process GROUP
             // (child.kill alone orphans grandchildren holding the pipes).
-            const child = spawn(input.command, {
-                cwd,
-                env: env,
-                shell: true,
-                stdio: ['ignore', 'pipe', 'pipe'],
-                windowsHide: true,
-                signal: ctx.signal,
-                detached: process.platform !== 'win32',
-            });
+            // G1-2 — sandbox is ON BY DEFAULT whenever a backend is available
+            // (bwrap, Linux). Explicit opt-out with KLYRO_SANDBOX=0. Sandboxed calls
+            // are OFFLINE by default; KLYRO_SANDBOX_NET=1 re-enables the network.
+            const sandboxBackend = detectSandbox();
+            const useSandbox = sandboxBackend.active && process.env.KLYRO_SANDBOX !== '0';
+            const sandboxWrap = useSandbox
+                ? sandboxCommand('/bin/sh', ['-c', input.command], {
+                    cwd,
+                    allowNetwork: process.env.KLYRO_SANDBOX_NET === '1',
+                })
+                : undefined;
+            const child = sandboxWrap
+                ? spawn(sandboxWrap.cmd, sandboxWrap.args, {
+                    cwd,
+                    env: env,
+                    stdio: ['ignore', 'pipe', 'pipe'],
+                    windowsHide: true,
+                    signal: ctx.signal,
+                    detached: process.platform !== 'win32',
+                    shell: false,
+                })
+                : spawn(input.command, {
+                    cwd,
+                    env: env,
+                    shell: true,
+                    stdio: ['ignore', 'pipe', 'pipe'],
+                    windowsHide: true,
+                    signal: ctx.signal,
+                    detached: process.platform !== 'win32',
+                });
             const stdoutChunks = [];
             const stderrChunks = [];
             const fullStdout = [];

package/dist/tools/shell/worker-entry.d.ts

@@ -0,0 +1,12 @@
+/**
+ * G2 — Worker entry point for subprocess isolation.
+ *
+ * When the OS sandbox (bwrap) is unavailable (Windows, no-bwrap Linux),
+ * shell_exec routes its command through this worker so a crash/OOM in the
+ * child cannot take down the parent harness.
+ *
+ * Protocol: single JSON arg on argv[2] -> single JSON line on stdout.
+ * Input:  { cmd: string; args: string[]; cwd: string; env?: Record<string,string> }
+ * Output: { status: number|null; signal: string|null; stdout: string; stderr: string }
+ */
+export {};

package/dist/tools/shell/worker-entry.js

@@ -0,0 +1,43 @@
+/**
+ * G2 — Worker entry point for subprocess isolation.
+ *
+ * When the OS sandbox (bwrap) is unavailable (Windows, no-bwrap Linux),
+ * shell_exec routes its command through this worker so a crash/OOM in the
+ * child cannot take down the parent harness.
+ *
+ * Protocol: single JSON arg on argv[2] -> single JSON line on stdout.
+ * Input:  { cmd: string; args: string[]; cwd: string; env?: Record<string,string> }
+ * Output: { status: number|null; signal: string|null; stdout: string; stderr: string }
+ */
+import { spawnSync } from 'node:child_process';
+import { filteredEnv } from './shell-exec.js';
+function main() {
+    const raw = process.argv[2];
+    if (!raw) {
+        process.stderr.write('worker-entry: missing payload\n');
+        process.exit(2);
+    }
+    let payload;
+    try {
+        payload = JSON.parse(raw);
+    }
+    catch (e) {
+        process.stderr.write(`worker-entry: bad JSON: ${e}\n`);
+        process.exit(2);
+    }
+    const { cmd, args, cwd, env } = payload;
+    const child = spawnSync(cmd, args, {
+        cwd,
+        env: filteredEnv(env),
+        shell: false,
+        windowsHide: true,
+    });
+    const out = {
+        status: child.status,
+        signal: child.signal,
+        stdout: child.stdout ? Buffer.from(child.stdout).toString('base64') : '',
+        stderr: child.stderr ? Buffer.from(child.stderr).toString('base64') : '',
+    };
+    process.stdout.write(JSON.stringify(out));
+}
+main();

package/dist/tools/types.d.ts

@@ -60,6 +60,12 @@ export interface ToolContext {
     agentAllowedTools?: ReadonlySet<string> | null;
     /** Model override active for the current agent. */
     agentModel?: string;
+    /** Repair-guard: when denyTestEdits is true, tools must refuse test-file edits. */
+    repairGuard?: {
+        denyTestEdits: boolean;
+    };
+    /** Allowed target paths for this agent. When present, file tools deny targets outside it. */
+    agentAllowedPaths?: readonly string[];
 }
 /**
  * A typed tool definition. TInput is the validated input shape; TOutput is

package/dist/tools/verify/run-verify.js

@@ -10,6 +10,7 @@ import { spawn, spawnSync } from 'node:child_process';
 import { z } from 'zod';
 import { defineTool } from '../types.js';
 import { safe, TOOL_ERROR_CODES } from '../normalize.js';
+import { filteredVerifyEnv } from '../../verification/registry.js';
 const InputSchema = z.object({
     command: z.string().min(1).describe('Verification command, e.g. "npm test" or "tsc --noEmit"'),
     cwd: z.string().optional(),
@@ -25,7 +26,8 @@ export const runVerifyTool = defineTool({
         return safe(async () => {
             const cwd = input.cwd ?? ctx.cwd;
             const timeoutMs = input.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-            const env = process.env;
+            // S2: verify commands run with filtered env; servers needing keys must use explicit config.
+            const env = filteredVerifyEnv();
             const start = Date.now();
             const child = spawn(input.command, {
                 cwd,

package/dist/trace/writer.d.ts

@@ -1,12 +1,25 @@
 /**
  * 3.1 — TraceWriter (JSONL, fsync on tool results)
+ *
+ * Durability: appends serialize through a promise-chain queue (concurrent
+ * writes stay line-valid), each line carries a per-file `seq` number, and
+ * the serialized line is passed through redact() before it hits disk so
+ * secrets never land in the trace. readAll skips corrupt lines instead of
+ * discarding the whole trace.
  */
 import type { KlyroEvent } from '../events/catalog.js';
 export declare class TraceWriter {
     private filePath;
+    /** Serializes appends; concurrent write() calls stay line-valid. */
+    private queue;
+    private nextSeq;
+    private seqPrimed;
     constructor(sessionId: string, dir?: string);
     init(): Promise<void>;
+    /** Prime the seq counter from existing lines (so restarts don't reuse seqs). */
+    private primeSeq;
     write(ev: KlyroEvent): Promise<void>;
+    private appendOne;
     close(): Promise<void>;
     get path(): string;
     readAll(): Promise<KlyroEvent[]>;