klyro 1.0.0 → 1.0.1

package/dist/trace/writer.js

@@ -1,10 +1,21 @@
 /**
  * 3.1 — TraceWriter (JSONL, fsync on tool results)
+ *
+ * Durability: appends serialize through a promise-chain queue (concurrent
+ * writes stay line-valid), each line carries a per-file `seq` number, and
+ * the serialized line is passed through redact() before it hits disk so
+ * secrets never land in the trace. readAll skips corrupt lines instead of
+ * discarding the whole trace.
  */
 import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
+import { redact } from '../policy/secret-redactor.js';
 export class TraceWriter {
     filePath;
+    /** Serializes appends; concurrent write() calls stay line-valid. */
+    queue = Promise.resolve();
+    nextSeq = 0;
+    seqPrimed = false;
     constructor(sessionId, dir) {
         const base = dir ?? path.join(process.cwd(), '.klyro', 'traces');
         this.filePath = path.join(base, `${sessionId}.jsonl`);
@@ -17,8 +28,36 @@ export class TraceWriter {
         }
         catch { /* ignore */ }
     }
+    /** Prime the seq counter from existing lines (so restarts don't reuse seqs). */
+    async primeSeq() {
+        if (this.seqPrimed)
+            return;
+        this.seqPrimed = true;
+        try {
+            const raw = await fs.readFile(this.filePath, 'utf-8');
+            for (const line of raw.split('\n')) {
+                if (!line.trim())
+                    continue;
+                try {
+                    const parsed = JSON.parse(line);
+                    if (typeof parsed.seq === 'number' && parsed.seq >= this.nextSeq) {
+                        this.nextSeq = parsed.seq + 1;
+                    }
+                }
+                catch { /* corrupt line — ignored, readAll skips it too */ }
+            }
+        }
+        catch { /* missing file — seq starts at 0 */ }
+    }
     async write(ev) {
-        const line = JSON.stringify(ev) + '\n';
+        const task = this.queue.then(() => this.appendOne(ev));
+        // Keep the queue alive across failures; the caller still sees its error.
+        this.queue = task.catch(() => undefined);
+        return task;
+    }
+    async appendOne(ev) {
+        await this.primeSeq();
+        const line = redact(JSON.stringify({ ...ev, seq: this.nextSeq++ })) + '\n';
         await fs.appendFile(this.filePath, line, 'utf-8');
         // fsync on tool results for crash safety
         if (ev.type === 'tool.result') {
@@ -35,16 +74,28 @@ export class TraceWriter {
         }
     }
     async close() {
-        // No persistent handle to close
+        // Drain the queue — no persistent handle to close.
+        await this.queue;
     }
     get path() {
         return this.filePath;
     }
-    // For tests: read back
+    // For tests: read back (skips unparseable lines, never discards the trace).
     async readAll() {
         try {
             const raw = await fs.readFile(this.filePath, 'utf-8');
-            return raw.split('\n').filter(Boolean).map((l) => JSON.parse(l));
+            const out = [];
+            for (const line of raw.split('\n')) {
+                if (!line.trim())
+                    continue;
+                try {
+                    out.push(JSON.parse(line));
+                }
+                catch {
+                    continue; // corrupt line skipped
+                }
+            }
+            return out;
         }
         catch {
             return [];

package/dist/tui/app.js

@@ -158,7 +158,7 @@ function useChatScroll(opts) {
     }), [dispatch]);
     const resolved = resolveTopRow(state, ctx);
     const maxTop = maxTopFor(ctx);
-    const pinned = state.anchor.mode === 'pinned' && !resolved.atBottom;
+    const pinned = state.anchor.mode === 'pinned' && (!resolved.atBottom || maxTop === 0);
     return {
         topRow: resolved.topRow,
         atBottom: resolved.atBottom,

package/dist/tui/approval.js

@@ -21,6 +21,7 @@ import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
  */
 import { useEffect, useState } from 'react';
 import { Box, Text, useInput } from 'ink';
+import { approvalChoiceForKey, sanitizeForPrompt } from '../policy/approval.js';
 class TuiApprovalBridge {
     pending = null;
     // Fan-out set: BOTH the App (awaitingApproval gate) and the ApprovalModal
@@ -72,41 +73,39 @@ export function ApprovalModal({ bridge }) {
         return bridge.subscribe((p) => setPending(p?.req ?? null));
     }, [bridge]);
     const [explain, setExplain] = useState(false);
+    const [full, setFull] = useState(false);
     useInput((inputStr, key) => {
         if (!pending)
             return;
-        const c = inputStr.toLowerCase();
-        if (c === 'y') {
-            bridge.resolve('allow');
-            return;
-        }
-        if (c === 'a') {
-            bridge.resolve('always');
-            return;
-        }
-        if (c === 'A') {
-            bridge.resolve('always-persist');
-            return;
-        }
-        if (c === 'd' || c === 'n') {
+        if (key.return) {
             bridge.resolve('deny');
             return;
         }
-        if (c === 'e') {
-            // Edit: for MVP, treat as deny with edit hint — model will be told to re-read and retry
-            bridge.resolve('deny');
+        // Case-sensitive mapping lives in approvalChoiceForKey: 'A' persists,
+        // 'a' is session-only (the old inline toLowerCase-first code collapsed
+        // them, silently downgrading persistence).
+        const action = approvalChoiceForKey(inputStr);
+        if (action === 'expand') {
+            setFull((v) => !v);
             return;
         }
-        if (c === '?') {
+        if (action === 'explain') {
             setExplain((v) => !v);
             return;
         }
-        if (key.return) {
-            bridge.resolve('deny');
+        if (action === 'allow' || action === 'always' || action === 'always-persist' || action === 'deny') {
+            bridge.resolve(action);
             return;
         }
     });
     if (!pending)
         return null;
-    return (_jsxs(Box, { flexDirection: "column", borderStyle: "double", borderColor: "yellow", paddingX: 1, marginY: 1, children: [_jsxs(Text, { color: "yellow", bold: true, children: ["\u26A0 approval needed \u2014 ", pending.toolName] }), _jsxs(Text, { color: "gray", children: ["  reason: ", pending.reason] }), pending.summary ? _jsxs(Text, { children: ["  ", pending.summary] }) : null, explain ? _jsxs(Text, { color: "cyan", children: ["  Explain: This tool will ", pending.toolName, " with the shown args. [y] once, [a] session, [A] always\u2192settings, [n] deny, [e] edit, [?] toggle help."] }) : null, _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: "green", children: "[y] once" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "green", children: "[a] session" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "green", children: "[A] always" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "red", children: "[n] deny" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "yellow", children: "[e] edit" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "cyan", children: "[?] explain" }), _jsx(Text, { color: "gray", children: "  (Enter = deny)" })] })] }));
+    // Sanitized display (ANSI/control-strip + 500-char cap inside
+    // sanitizeForPrompt), then the 300-char TUI truncation on top. [f] toggles
+    // the full sanitized text.
+    const trunc = (s, n = 300) => {
+        const clean = sanitizeForPrompt(s);
+        return !full && clean.length > n ? clean.slice(0, n) + '…' : clean;
+    };
+    return (_jsxs(Box, { flexDirection: "column", borderStyle: "double", borderColor: "yellow", paddingX: 1, marginY: 1, children: [_jsxs(Text, { color: "yellow", bold: true, children: ["\u26A0 approval needed \u2014 ", pending.toolName] }), _jsxs(Text, { color: "gray", children: ["  reason: \"", trunc(pending.reason), "\""] }), pending.summary ? _jsxs(Text, { children: ["  \"", trunc(pending.summary), "\""] }) : null, explain ? _jsxs(Text, { color: "cyan", children: ["  Explain: This tool will ", pending.toolName, " with the shown args. [y] once, [a] session, [A] always\u2192settings, [n] deny, [e] edit, [f] full text, [?] toggle help."] }) : null, _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: "green", children: "[y] once" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "green", children: "[a] session" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "green", children: "[A] always" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "red", children: "[n] deny" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "yellow", children: "[e] edit" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "cyan", children: "[f] full" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "cyan", children: "[?] explain" }), _jsx(Text, { color: "gray", children: "  (Enter = deny)" })] })] }));
 }

package/dist/util.d.ts

@@ -0,0 +1 @@
+export declare const x = 1;

package/dist/util.js

@@ -0,0 +1 @@
+export const x = 1;

package/dist/verification/baseline.js

@@ -7,10 +7,11 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
-import { primaryVerifyCommand } from './registry.js';
+import { primaryVerifyCommand, filteredVerifyEnv } from './registry.js';
 async function gitHead(cwd) {
     return new Promise((resolve) => {
-        const child = spawn('git', ['rev-parse', 'HEAD'], { cwd, shell: false });
+        // S2: verify commands run with filtered env; servers needing keys must use explicit config.
+        const child = spawn('git', ['rev-parse', 'HEAD'], { cwd, shell: false, env: filteredVerifyEnv() });
         let out = '';
         child.stdout.on('data', (b) => { out += b.toString(); });
         child.on('close', () => resolve(out.trim() || 'no-head'));
@@ -60,6 +61,18 @@ export async function runBaseline(cwd, command, timeoutMs = 90_000) {
         fs.mkdirSync(path.dirname(p), { recursive: true });
         const tmp = `${p}.tmp-${crypto.randomBytes(4).toString('hex')}`;
         fs.writeFileSync(tmp, JSON.stringify(baseline, null, 2));
+        // N5: fsync before rename — mirrors the persistence/store.ts writeIndex
+        // idiom (write → fsync → rename) so a crash can't lose the baseline.
+        try {
+            const fh = fs.openSync(tmp, 'r');
+            try {
+                fs.fsyncSync(fh);
+            }
+            finally {
+                fs.closeSync(fh);
+            }
+        }
+        catch { /* ignore on Windows */ }
         fs.renameSync(tmp, p);
     }
     catch { /* ignore */ }
@@ -68,7 +81,8 @@ export async function runBaseline(cwd, command, timeoutMs = 90_000) {
 const MAX_BASELINE_BYTES = 256 * 1024;
 function runCmd(cwd, command, timeoutMs) {
     return new Promise((resolve) => {
-        const child = spawn(command, { cwd, shell: true, env: process.env });
+        // S2: verify commands run with filtered env; servers needing keys must use explicit config.
+        const child = spawn(command, { cwd, shell: true, env: filteredVerifyEnv() });
         const outChunks = [];
         const errChunks = [];
         let done = false;

package/dist/verification/classify.js

@@ -4,6 +4,14 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { spawn } from 'node:child_process';
+import { detect } from './detect.js';
+function signatureOf(failure, fallbackExit) {
+    return {
+        type: failure?.type ?? 'unknown',
+        files: new Set((failure?.files ?? []).map((f) => f.path).filter(Boolean)),
+        exit: failure?.exitCode ?? fallbackExit,
+    };
+}
 export function classifyFailure(current, baseline, flakyRerunOk) {
     const combined = (current.stderr + '\n' + current.stdout).toLowerCase();
     // env: missing binary, network, permission, no such file, EACCES etc
@@ -18,20 +26,23 @@ export function classifyFailure(current, baseline, flakyRerunOk) {
     if (flakyRerunOk)
         return 'flaky';
     if (baseline && !baseline.ok) {
-        const baseRaw = (baseline.stderr + '\n' + baseline.stdout);
-        // if current failure files overlap baseline failure raw, treat as pre-existing
-        if (current.failure && baseline.stdout + baseline.stderr) {
-            const curPaths = new Set(current.failure.files.map((f) => f.path).filter(Boolean));
-            const baseContains = [...curPaths].some((p) => baseRaw.includes(p));
-            if (baseContains)
-                return 'pre_existing';
-            // also if same exit code and type, likely pre-existing
-            if (baseRaw.includes(current.failure.files[0]?.message ?? '') && baseRaw.length > 0)
+        // Structured signature compare (no substring matching): pre-existing
+        // iff same failure type AND file-set overlap is non-empty (or same
+        // exit + same type when both sides are fileless).
+        const curSig = signatureOf(current.failure, -1);
+        const baseFailure = detect(baseline.stdout, baseline.stderr, baseline.exitCode);
+        const baseSig = signatureOf(baseFailure, baseline.exitCode);
+        if (curSig.type !== 'unknown' && curSig.type === baseSig.type) {
+            if (curSig.files.size > 0 && baseSig.files.size > 0) {
+                for (const f of curSig.files) {
+                    if (baseSig.files.has(f))
+                        return 'pre_existing';
+                }
+            }
+            else if (curSig.files.size === 0 && baseSig.files.size === 0 && curSig.exit === baseSig.exit) {
                 return 'pre_existing';
+            }
         }
-        // if baseline failed and current also fails with similar raw length, assume pre-existing
-        if (current.failure && baseline.stderr.length > 0 && combined.includes(baseline.stderr.slice(0, 200).toLowerCase()))
-            return 'pre_existing';
     }
     return 'introduced';
 }

package/dist/verification/engine.js

@@ -9,6 +9,7 @@
  */
 import { spawn } from 'node:child_process';
 import { detect, summarize } from './detect.js';
+import { filteredVerifyEnv } from './registry.js';
 import { redact } from '../policy/secret-redactor.js';
 const MAX_VERIFY_BYTES = 256 * 1024;
 function appendCapped(current, chunk) {
@@ -61,7 +62,8 @@ export async function verify(opts) {
     }
     const timeout = opts.timeoutMs ?? 5 * 60 * 1000;
     return new Promise((resolve) => {
-        const child = spawn(opts.command, { cwd: opts.cwd, shell: true, env: process.env });
+        // S2: verify commands run with filtered env; servers needing keys must use explicit config.
+        const child = spawn(opts.command, { cwd: opts.cwd, shell: true, env: filteredVerifyEnv() });
         const outChunks = [];
         const errChunks = [];
         let done = false;

package/dist/verification/registry.d.ts

@@ -12,6 +12,8 @@ export interface Verifier {
 }
 export declare function detectVerifiers(cwd: string): Verifier[];
 export declare function primaryVerifyCommand(cwd: string): string | null;
+/** Filtered env for verify children: allowlist + secret strip + preload-vector delete. */
+export declare function filteredVerifyEnv(): NodeJS.ProcessEnv;
 export interface VerifySettings {
     commands?: string[];
     onEdit?: boolean;

package/dist/verification/registry.js

@@ -113,6 +113,39 @@ export function primaryVerifyCommand(cwd) {
     const v = detectVerifiers(cwd);
     return v[0]?.command ?? null;
 }
+// S2 — filtered env for ALL spawned verify commands.
+//
+// Sibling `tools/shell/shell-exec.ts` owns an equivalent `filteredEnv` but
+// does not export it, so this mirrors that filter (allowlisted prefixes +
+// exact keys, secret-ish names stripped, preload vectors deleted) instead of
+// importing sibling internals.
+const VERIFY_ENV_PREFIXES = ['PATH', 'HOME', 'USER', 'SHELL', 'TERM', 'LANG', 'NODE_', 'NPM_', 'PNPM_', 'YARN_'];
+// Exact keys: sibling's PWD/TMPDIR/TEMP plus the Windows OS vars a spawned
+// shell needs to start (COMSPEC/SystemRoot/PATHEXT/...) — none carry secrets.
+const VERIFY_ENV_EXACT = new Set([
+    'PWD', 'TMPDIR', 'TEMP', 'TMP',
+    'SystemRoot', 'windir', 'COMSPEC', 'PATHEXT', 'OS',
+    'USERPROFILE', 'APPDATA', 'LOCALAPPDATA', 'PROGRAMDATA',
+]);
+const VERIFY_ENV_SECRET_RE = /SECRET|TOKEN|KEY/i;
+/** Filtered env for verify children: allowlist + secret strip + preload-vector delete. */
+export function filteredVerifyEnv() {
+    const out = {};
+    for (const [k, v] of Object.entries(process.env)) {
+        if (v === undefined)
+            continue;
+        if (VERIFY_ENV_SECRET_RE.test(k))
+            continue;
+        if (VERIFY_ENV_PREFIXES.some((p) => k.startsWith(p)) || VERIFY_ENV_EXACT.has(k)) {
+            out[k] = v;
+        }
+    }
+    delete out.NODE_OPTIONS;
+    delete out.LD_PRELOAD;
+    delete out.LD_LIBRARY_PATH;
+    out.PATH = process.env.PATH;
+    return out;
+}
 export function resolveVerifySettings(raw) {
     if (!raw || typeof raw !== 'object')
         return {};

package/dist/verification/scoped.js

@@ -5,6 +5,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { spawn } from 'node:child_process';
+import { filteredVerifyEnv } from './registry.js';
 export function findRelatedTests(cwd, editedFiles) {
     if (editedFiles.length === 0)
         return [];
@@ -48,17 +49,34 @@ export function findRelatedTests(cwd, editedFiles) {
     }
     return [...related];
 }
+const UNSAFE_SCOPED_RE = /["$`;&|()]/;
+function isSafeScopedPath(cwd, f) {
+    if (UNSAFE_SCOPED_RE.test(f))
+        return false;
+    if (f.includes('\n') || f.includes('\r') || f.includes('\0'))
+        return false;
+    const rel = path.relative(path.resolve(cwd), path.resolve(cwd, f));
+    if (rel === '' || rel.startsWith('..') || path.isAbsolute(rel))
+        return false;
+    return true;
+}
 export function buildScopedCommand(cwd, baseCommand, relatedTests) {
     if (relatedTests.length === 0)
         return null;
     if (relatedTests.length > 10)
         return null; // too many → full suite
+    // Validate every test path: must stay within cwd and contain no shell
+    // metacharacters. Drop offenders; if none survive, return null (caller
+    // falls back to the full suite — never interpolate untrusted paths).
+    const safe = relatedTests.filter((f) => isSafeScopedPath(cwd, f));
+    if (safe.length === 0)
+        return null;
     // npm test heuristic: npm test -- <files> or vitest/jest file list
     if (baseCommand.includes('npm test') || baseCommand.includes('pnpm test') || baseCommand.includes('yarn test') || baseCommand.includes('bun test')) {
-        return `${baseCommand} -- ${relatedTests.map((f) => `"${f}"`).join(' ')}`;
+        return `${baseCommand} -- ${safe.map((f) => `"${f}"`).join(' ')}`;
     }
     if (baseCommand.includes('pytest')) {
-        return `pytest ${relatedTests.map((f) => `"${f}"`).join(' ')}`;
+        return `pytest ${safe.map((f) => `"${f}"`).join(' ')}`;
     }
     if (baseCommand.includes('go test')) {
         // go test ./... with file filter — fallback to full
@@ -73,7 +91,8 @@ export function buildScopedCommand(cwd, baseCommand, relatedTests) {
 const MAX_SCOPED_BYTES = 256 * 1024;
 export async function runScopedVerify(cwd, command, timeoutMs = 45_000) {
     return new Promise((resolve) => {
-        const child = spawn(command, { cwd, shell: true, env: process.env });
+        // S2: verify commands run with filtered env; servers needing keys must use explicit config.
+        const child = spawn(command, { cwd, shell: true, env: filteredVerifyEnv() });
         const outChunks = [];
         const errChunks = [];
         let done = false;
@@ -125,7 +144,8 @@ export async function syntaxCheck(cwd, file) {
             // For now, use tsc --noEmit --skipLibCheck on single file quickly
             if (ext === '.ts') {
                 const ok = await new Promise((resolve) => {
-                    const child = spawn('npx', ['tsc', '--noEmit', '--skipLibCheck', full], { cwd, shell: false, env: process.env });
+                    // S2: verify commands run with filtered env; servers needing keys must use explicit config.
+                    const child = spawn('npx', ['tsc', '--noEmit', '--skipLibCheck', full], { cwd, shell: false, env: filteredVerifyEnv() });
                     let done = false;
                     const t = setTimeout(() => { if (!done) {
                         done = true;
@@ -145,7 +165,8 @@ export async function syntaxCheck(cwd, file) {
                 return { ok: true };
             }
             const ok2 = await new Promise((resolve) => {
-                const child = spawn(process.execPath, ['--check', full], { cwd, shell: false, env: process.env });
+                // S2: verify commands run with filtered env; servers needing keys must use explicit config.
+                const child = spawn(process.execPath, ['--check', full], { cwd, shell: false, env: filteredVerifyEnv() });
                 let done = false;
                 const t = setTimeout(() => { if (!done) {
                     done = true;
@@ -170,7 +191,8 @@ export async function syntaxCheck(cwd, file) {
     }
     if (ext === '.py') {
         const ok = await new Promise((resolve) => {
-            const child = spawn('python', ['-m', 'py_compile', full], { cwd, shell: false, env: process.env });
+            // S2: verify commands run with filtered env; servers needing keys must use explicit config.
+            const child = spawn('python', ['-m', 'py_compile', full], { cwd, shell: false, env: filteredVerifyEnv() });
             let done = false;
             const t = setTimeout(() => { if (!done) {
                 done = true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "klyro",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Klyro — autonomous coding harness CLI that streams from any OpenAI-compatible or Anthropic LLM endpoint.",
   "type": "module",
   "main": "dist/index.js",