klyro 1.0.0 → 1.0.1

package/dist/agent/worktree-manager.js

@@ -0,0 +1,189 @@
+/**
+ * Git worktree isolation for parallel write-capable child agents.
+ *
+ * Each write-capable child gets its own worktree on a branch
+ * `klyro/<taskId>` so concurrent children never clobber each other's files.
+ * `task_apply` merges the branch back into the parent tree; failures,
+ * cancellations, and timeouts remove the worktree best-effort.
+ *
+ * Semantics worth knowing:
+ *   - Dirty parent: the merge runs in the parent checkout, so uncommitted
+ *     parent edits can conflict. On conflict the merge is ABORTED (no
+ *     commit), the branch is kept, and the caller gets MERGE_CONFLICT with
+ *     the file list — resolve and re-apply.
+ *   - Stale branch: a leftover `klyro/<taskId>` branch (e.g. from a crashed
+ *     session) makes `createWorktree` fail. Delete the stale branch
+ *     (`deleteBranch`) or sweep orphaned worktrees (`pruneStaleWorktrees`)
+ *     before retrying.
+ *   - No-apply: tasks that never reach `succeeded` are NEVER merged — their
+ *     worktrees are removed best-effort and `task_apply` reports NOT_READY.
+ *
+ * All git invocations go through `execFile` argv (no shell) with a ~30s
+ * timeout, so this is safe on Windows.
+ */
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import * as path from 'node:path';
+import { filteredEnv } from '../tools/shell/shell-exec.js';
+const execFileAsync = promisify(execFile);
+/** Per-command timeout for every git invocation. */
+export const GIT_TIMEOUT_MS = 30_000;
+async function git(repoCwd, args) {
+    // Filtered env (same call shape as shell-exec) so secrets never reach
+    // child processes. Then strip repo-pinning vars so discovery is always
+    // relative to `repoCwd` (a sandbox may export GIT_DIR for its own
+    // harness — that must not make every directory look like a repo).
+    const env = { ...filteredEnv() };
+    delete env.GIT_DIR;
+    delete env.GIT_WORK_TREE;
+    delete env.GIT_NAMESPACE;
+    const r = await execFileAsync('git', [...args], {
+        cwd: repoCwd,
+        timeout: GIT_TIMEOUT_MS,
+        windowsHide: true,
+        maxBuffer: 4 * 1024 * 1024,
+        env,
+    });
+    return { stdout: r.stdout, stderr: r.stderr };
+}
+/** True when `cwd` is inside a git working tree. Never throws — false on any failure. */
+export async function ensureGitRepo(cwd) {
+    try {
+        const r = await git(cwd, ['rev-parse', '--is-inside-work-tree']);
+        return r.stdout.trim() === 'true';
+    }
+    catch {
+        return false;
+    }
+}
+/** Resolve the repo top-level for any path inside it. Throws when not in a repo. */
+export async function repoTopLevel(cwd) {
+    const r = await git(cwd, ['rev-parse', '--show-toplevel']);
+    return r.stdout.trim();
+}
+function branchForTask(taskId) {
+    return `klyro/${taskId}`;
+}
+/**
+ * Create an isolated worktree for a task on branch `klyro/<taskId>`,
+ * rooted at `<repo>/.klyro/worktrees/<taskId>` from HEAD.
+ */
+export async function createWorktree(opts) {
+    const branch = branchForTask(opts.taskId);
+    const top = await repoTopLevel(opts.repoCwd);
+    const worktreePath = path.join(top, '.klyro', 'worktrees', opts.taskId);
+    await git(opts.repoCwd, ['worktree', 'add', '-b', branch, worktreePath, 'HEAD']);
+    return { worktreePath, branch };
+}
+/**
+ * Merge a task branch into the current checkout (`repoCwd`) with
+ * `git merge --no-ff --no-edit`. On conflict, parses `git status
+ * --porcelain` for unmerged paths (UU/AA/DD), aborts the merge WITHOUT
+ * committing, and returns `{ merged: false, conflictFiles }`.
+ */
+export async function mergeWorktree(opts) {
+    try {
+        await git(opts.repoCwd, ['merge', '--no-ff', '--no-edit', opts.branch]);
+        return { merged: true, conflictFiles: [] };
+    }
+    catch {
+        const conflictFiles = await unmergedFiles(opts.repoCwd);
+        try {
+            await git(opts.repoCwd, ['merge', '--abort']);
+        }
+        catch {
+            /* best-effort: leave the repo as-is if abort itself fails */
+        }
+        return { merged: false, conflictFiles };
+    }
+}
+async function unmergedFiles(repoCwd) {
+    try {
+        const r = await git(repoCwd, ['status', '--porcelain']);
+        const out = [];
+        for (const line of r.stdout.split('\n')) {
+            if (line.length < 4)
+                continue;
+            const x = line[0];
+            const y = line[1];
+            const unmerged = (x === 'U' || y === 'U' || x === 'A' || y === 'A') && (x === 'U' || y === 'U' || (x === 'A' && y === 'A'));
+            // Unmerged statuses: UU, AA, DD, AU, UA, UD, DU.
+            const code = `${x}${y}`;
+            if (['UU', 'AA', 'DD', 'AU', 'UA', 'UD', 'DU'].includes(code) || unmerged) {
+                out.push(line.slice(3).trim());
+            }
+        }
+        return out;
+    }
+    catch {
+        return [];
+    }
+}
+/** Remove a worktree and prune its metadata. Throws with context on failure. */
+export async function removeWorktree(opts) {
+    const args = ['worktree', 'remove', ...(opts.force ? ['--force'] : []), opts.worktreePath];
+    try {
+        await git(opts.repoCwd, args);
+    }
+    catch (err) {
+        throw new Error(`git worktree remove failed for ${opts.worktreePath}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    finally {
+        try {
+            await git(opts.repoCwd, ['worktree', 'prune']);
+        }
+        catch {
+            /* best-effort */
+        }
+    }
+}
+/** Delete a task branch (best-effort cleanup after a successful merge). Never throws. */
+export async function deleteBranch(opts) {
+    try {
+        await git(opts.repoCwd, ['branch', '-D', opts.branch]);
+    }
+    catch {
+        /* best-effort */
+    }
+}
+/**
+ * Remove worktrees under `.klyro/worktrees` whose task id is NOT in
+ * `activeTaskIds` (orphans from crashed/timed-out sessions). Lists
+ * `git worktree list --porcelain`, force-removes each stale entry, and
+ * returns the removed paths. Never throws — per-worktree failures are
+ * skipped and a failing `git` itself yields `[]`.
+ */
+export async function pruneStaleWorktrees(repoCwd, activeTaskIds) {
+    const removed = [];
+    try {
+        const r = await git(repoCwd, ['worktree', 'list', '--porcelain']);
+        const active = new Set(activeTaskIds);
+        for (const line of r.stdout.split('\n')) {
+            const raw = /^worktree (.+)$/.exec(line.trim())?.[1];
+            if (!raw)
+                continue;
+            // git prints forward slashes even on win32 — normalize so returned
+            // paths textually match the path.join-built worktreePath.
+            const wp = path.normalize(raw);
+            // Only manage our own namespace: <repo>/.klyro/worktrees/<taskId>.
+            const parts = wp.split(/[\\/]/);
+            const idx = parts.lastIndexOf('worktrees');
+            if (idx < 1 || parts[idx - 1] !== '.klyro' || idx + 1 >= parts.length)
+                continue;
+            const taskId = parts[idx + 1];
+            if (!taskId || active.has(taskId))
+                continue;
+            try {
+                await removeWorktree({ repoCwd, worktreePath: wp, force: true });
+                removed.push(wp);
+            }
+            catch {
+                /* skip — never throws */
+            }
+        }
+    }
+    catch {
+        /* git itself failed (not a repo, binary missing) — return what we have */
+    }
+    return removed;
+}

package/dist/checkpoints/store.js

@@ -7,6 +7,19 @@ import * as crypto from 'node:crypto';
 function ckptDir(cwd) {
     return path.join(cwd, '.klyro', 'checkpoints');
 }
+/** Best-effort fsync of a just-written file (crash safety). */
+async function fsyncFile(p) {
+    try {
+        const fh = await fs.open(p, 'r+');
+        try {
+            await fh.sync();
+        }
+        finally {
+            await fh.close();
+        }
+    }
+    catch { /* ignore on Windows */ }
+}
 /**
  * Resolve a checkpoint file list entry inside cwd. Returns null for anything
  * escaping the project (no arbitrary read/write outside cwd, via either the
@@ -39,6 +52,7 @@ export async function snapshot(cwd, files) {
                 continue;
             await fs.mkdir(path.dirname(out), { recursive: true });
             await fs.writeFile(out, data);
+            await fsyncFile(out);
             kept.push(rel);
         }
         catch (e) {
@@ -47,8 +61,11 @@ export async function snapshot(cwd, files) {
                 missing.push(f);
         }
     }
-    // Save meta
-    await fs.writeFile(path.join(dest, '.meta.json'), JSON.stringify({ id, files: kept, missing, ts: Date.now() }, null, 2));
+    // Save meta (fsync before the checkpoint is visible — mirrors the
+    // SessionStore.writeIndex atomic pattern).
+    const metaPath = path.join(dest, '.meta.json');
+    await fs.writeFile(metaPath, JSON.stringify({ id, files: kept, missing, ts: Date.now() }, null, 2));
+    await fsyncFile(metaPath);
     // Best-effort last.diff for the repair guard (guardRepair reads it).
     try {
         const { spawn } = await import('node:child_process');
@@ -86,8 +103,15 @@ export async function snapshot(cwd, files) {
                 resolve('');
             });
         });
-        if (diffText)
+        if (diffText) {
             await fs.writeFile(path.join(dir, 'last.diff'), diffText, 'utf-8');
+            // Per-checkpoint diff file (best-effort); the repair guard keeps
+            // reading last.diff, so its behavior is unchanged.
+            try {
+                await fs.writeFile(path.join(dir, `${id}.diff`), diffText, 'utf-8');
+            }
+            catch { /* best-effort only */ }
+        }
     }
     catch { /* best-effort only */ }
     return id;
@@ -96,8 +120,9 @@ export async function listCheckpoints(cwd) {
     const dir = ckptDir(cwd);
     try {
         const entries = await fs.readdir(dir);
-        // last.diff is a guard artifact, not a checkpoint (must never be an undo target).
-        return entries.filter((e) => !e.startsWith('.') && e !== 'last.diff').sort();
+        // last.diff is a guard artifact and <id>.diff files are per-checkpoint
+        // diffs — neither is a checkpoint (must never be an undo target).
+        return entries.filter((e) => !e.startsWith('.') && e !== 'last.diff' && !e.endsWith('.diff')).sort();
     }
     catch {
         return [];

package/dist/cli/auth.js

@@ -111,7 +111,11 @@ export async function runLogout(provider) {
         const creds = JSON.parse(raw);
         if (provider) {
             delete creds[provider];
-            await fs.writeFile(credPath(), JSON.stringify(creds, null, 2), 'utf-8');
+            await fs.writeFile(credPath(), JSON.stringify(creds, null, 2), { mode: 0o600 });
+            try {
+                await fs.chmod(credPath(), 0o600);
+            }
+            catch { /* ignore on Windows */ }
             process.stdout.write(`Removed ${provider} key\n`);
         }
         else {
@@ -128,6 +132,17 @@ export async function runLogout(provider) {
 }
 export function getStoredKey(provider) {
     try {
+        // Warn (don't refuse) when the credentials file is group/other-readable.
+        // Refusing would lock out existing users with old umasks; warn instead.
+        if (process.platform !== 'win32') {
+            try {
+                const st = fsSync.statSync(credPath());
+                if ((st.mode & 0o077) !== 0) {
+                    process.stderr.write(`warning: credentials file ${credPath()} is group/other-readable (mode ${(st.mode & 0o777).toString(8)}) — run chmod 600 on it\n`);
+                }
+            }
+            catch { /* missing file → no warning */ }
+        }
         const raw = fsSync.readFileSync(credPath(), 'utf-8');
         const creds = JSON.parse(raw);
         const v = creds[provider];

package/dist/cli/config.d.ts

@@ -46,12 +46,18 @@ export interface PermissionRules {
  * without re-prompting.
  */
 export declare function loadPermissionRules(cwd?: string): Promise<PermissionRules>;
+export declare function isValidAllowRule(rule: string): boolean;
 /**
- * Persist an "always allow" pattern to the home settings file
- * (~/.klyro/settings.json, honors KLYRO_CONFIG). Returns whether it was
+ * Persist an "always allow" pattern. Validates the rule against the strict
+ * grammar (throws `invalid rule` otherwise). When `cwd` is a project dir
+ * (exists + contains .git or .klyro), writes to <cwd>/.klyro/settings.json;
+ * otherwise writes to the home settings file. Returns whether it was
  * added (false when already present) and the file written.
+ *
+ * NOTE for the repl integrator (sibling-owned repl.ts): pass the session
+ * cwd as the second arg to persist project-scoped allows.
  */
-export declare function persistAllowRule(rule: string): Promise<{
+export declare function persistAllowRule(rule: string, cwd?: string): Promise<{
     added: boolean;
     path: string;
 }>;

package/dist/cli/config.js

@@ -338,11 +338,72 @@ export async function loadPermissionRules(cwd = process.cwd()) {
     };
 }
 /**
- * Persist an "always allow" pattern to the home settings file
- * (~/.klyro/settings.json, honors KLYRO_CONFIG). Returns whether it was
+ * Strict allow-rule grammar: `tool` or `tool(glob)` where tool is
+ * lowercase alnum+underscore and glob contains no parens.
+ */
+const ALLOW_RULE_RE = /^[a-z0-9_]+\([^()]*\)$|^[a-z0-9_]+$/;
+export function isValidAllowRule(rule) {
+    return ALLOW_RULE_RE.test(rule.trim());
+}
+function isProjectDir(cwd) {
+    try {
+        const st = fsSync.statSync(cwd);
+        if (!st.isDirectory())
+            return false;
+    }
+    catch {
+        return false;
+    }
+    return fsSync.existsSync(path.join(cwd, '.git')) || fsSync.existsSync(path.join(cwd, '.klyro'));
+}
+/**
+ * Persist an "always allow" pattern. Validates the rule against the strict
+ * grammar (throws `invalid rule` otherwise). When `cwd` is a project dir
+ * (exists + contains .git or .klyro), writes to <cwd>/.klyro/settings.json;
+ * otherwise writes to the home settings file. Returns whether it was
  * added (false when already present) and the file written.
+ *
+ * NOTE for the repl integrator (sibling-owned repl.ts): pass the session
+ * cwd as the second arg to persist project-scoped allows.
  */
-export async function persistAllowRule(rule) {
+export async function persistAllowRule(rule, cwd) {
+    if (!isValidAllowRule(rule)) {
+        throw new Error(`invalid rule: ${rule}`);
+    }
+    // Project-scoped persist when cwd is a project dir.
+    if (cwd && isProjectDir(cwd)) {
+        const projPath = path.join(cwd, '.klyro', 'settings.json');
+        let cfg = {};
+        try {
+            const raw = await fs.readFile(projPath, 'utf-8');
+            cfg = validateConfig(parseJsonc(raw, projPath), projPath);
+        }
+        catch (err) {
+            const e = err;
+            if (e.code !== 'ENOENT')
+                throw err;
+        }
+        const allow = asStringArray(cfg.allow);
+        if (allow.includes(rule))
+            return { added: false, path: projPath };
+        cfg.allow = [...allow, rule];
+        await fs.mkdir(path.dirname(projPath), { recursive: true });
+        const tmp = `${projPath}.tmp-${process.pid}-${Date.now()}`;
+        const data = JSON.stringify(validateConfig(cfg, projPath), null, 2) + '\n';
+        await fs.writeFile(tmp, data, { mode: 0o600 });
+        try {
+            await fs.rename(tmp, projPath);
+        }
+        catch (err) {
+            await fs.unlink(tmp).catch(() => undefined);
+            throw err;
+        }
+        try {
+            await fs.chmod(projPath, 0o600);
+        }
+        catch { /* ignore on Windows */ }
+        return { added: true, path: projPath };
+    }
     const cfg = await loadConfig();
     const allow = asStringArray(cfg.allow);
     if (allow.includes(rule))

package/dist/cli/eval.d.ts

@@ -39,7 +39,7 @@
  * is set, emits one JSON object per line. Exit code 0 if all pass, 1
  * otherwise.
  */
-import { type RunResult } from '../agent/runtime.js';
+import { type RunResult, type VerifyMode } from '../agent/runtime.js';
 import type { ProviderAdapter } from '../agent/provider-adapter.js';
 export interface EvalScenario {
     name: string;
@@ -47,6 +47,11 @@ export interface EvalScenario {
     model?: string;
     maxSteps?: number;
     maxTokens?: number;
+    /** Verification passthrough (default unchanged: strict pipeline when omitted). */
+    verify?: {
+        mode?: VerifyMode;
+        command?: string;
+    };
     /** Adapter events to script, as [eventKind, ...args] tuples. */
     scripted_events?: Array<Array<unknown[]>>;
     expect?: {

package/dist/cli/eval.js

@@ -236,6 +236,15 @@ export async function runScenario(sc) {
         maxSteps: sc.maxSteps,
         maxTokens: sc.maxTokens,
         nonInteractive: true,
+        ...(sc.verify
+            ? {
+                verify: {
+                    enabled: true,
+                    ...(sc.verify.command !== undefined ? { command: sc.verify.command } : {}),
+                    ...(sc.verify.mode !== undefined ? { mode: sc.verify.mode } : {}),
+                },
+            }
+            : {}),
     }, {
         adapter,
         registry,