klyro 1.0.0 → 1.0.1

package/dist/cli/repl.js

@@ -15,6 +15,7 @@ import { anthropicAdapter } from '../agent/anthropic-adapter.js';
 import { retryingAdapter } from '../agent/retry.js';
 import { globalBus } from '../events/bus.js';
 import { run } from '../agent/runtime.js';
+import { resolveSystemPrompt } from '../agent/runtime.js';
 import { builtinRegistry } from '../tools/registry.js';
 import { builtinRules, clonePolicyConfig, PolicyEngine } from '../policy/engine.js';
 import { buildLevel6Context } from '../context/level6.js';
@@ -28,7 +29,10 @@ import { MouseFilter, MOUSE_ENABLE, MOUSE_DISABLE, createReadWrapper } from '../
 import { inferProviderFromBaseURL } from '../agent/registry.js';
 import { getDefaultSessionStore } from '../persistence/session.js';
 import { buildSystemPrompt, parseImageInput } from '../context/system-prompt.js';
+import { memoryBlock } from '../context/memory.js';
 import { estimateCost } from '../providers/model-info.js';
+import { ContextTrust } from '../context/trust.js';
+import { redact } from '../policy/secret-redactor.js';
 export async function startRepl(opts = {}) {
     // P0.5 — load <cwd>/.env first so provider resolution below sees KLYRO_*
     // vars without `export`. Never throws; explicit env wins (no-clobber).
@@ -90,21 +94,66 @@ export async function startRepl(opts = {}) {
     catch {
         /* ignore — engine defaults stand */
     }
-    // Best-effort MCP tools: never fatal, never prompts. src/mcp/registry.ts
-    // lands from a sibling agent — the lazy import keeps runtime + builds green
-    // until then (import failure is caught below). Servers live for the process
-    // lifetime, so no close wiring here (unlike runOnce's finally).
-    try {
-        // @ts-ignore — sibling-owned module may not exist yet
-        const { loadAndRegisterMcp } = await import('../mcp/registry.js');
-        const mcp = await loadAndRegisterMcp({ cwd, registry, policy });
-        for (const e of mcp.errors)
-            process.stderr.write(`klyro: mcp ${e.server}: ${e.message}\n`);
-        if (mcp.registered.length > 0) {
-            process.stderr.write(`klyro: mcp tools: ${mcp.registered.join(', ')}\n`);
+    // Best-effort MCP tools: never fatal, never prompts. Servers live for the
+    // process lifetime, so no close wiring here (unlike runOnce's finally).
+    // NOTE: the actual loadAndRegisterMcp call lives below (after the approval
+    // object exists) so project-server approval can route through it.
+    // Local inline sanitizer for the approval prompt (duplicates the shared
+    // sanitizeForPrompt in sibling-owned policy/approval.ts — intentionally
+    // not imported; kept local to avoid coupling the REPL to that module).
+    function sanitizeForPrompt(s) {
+        return s.replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]|\x1b\[[0-9;]*[A-Za-z]/g, '').slice(0, 120);
+    }
+    async function loadMcpTools() {
+        try {
+            const { loadAndRegisterMcp } = await import('../mcp/registry.js');
+            const mcp = await loadAndRegisterMcp({
+                cwd,
+                registry,
+                policy,
+                // CONTRACT (sibling D): project-server approval hook. Registries that
+                // predate the contract ignore the unknown opt (checked via try/catch
+                // below with a skip-with-warning fallback).
+                approveProjectServer: async (info) => {
+                    // Show the disabled state alongside source before asking, so a
+                    // disabled server's approval can't be mistaken for activation.
+                    let disabledNote = '';
+                    try {
+                        const { loadMcpServers } = await import('../mcp/config.js');
+                        const cfg = loadMcpServers(cwd);
+                        const spec = cfg.servers[info.name];
+                        if (spec?.disabled)
+                            disabledNote = ' (disabled in config)';
+                    }
+                    catch { /* ignore — prompt without the note */ }
+                    const safeName = sanitizeForPrompt(info.name);
+                    const safeSource = sanitizeForPrompt(info.source);
+                    try {
+                        const choice = await approval.ask({
+                            toolName: 'mcp_project_server',
+                            reason: `MCP project server "${safeName}"${disabledNote} from ${safeSource} — approve to register its tools`,
+                            summary: safeName,
+                        });
+                        return choice === 'allow' || choice === 'always' || choice === 'always-persist';
+                    }
+                    catch {
+                        return false;
+                    }
+                },
+            });
+            for (const e of mcp.errors)
+                process.stderr.write(`klyro: mcp ${e.server}: ${e.message}\n`);
+            if (mcp.registered.length > 0) {
+                process.stderr.write(`klyro: mcp tools: ${mcp.registered.join(', ')}\n`);
+            }
+        }
+        catch {
+            try {
+                process.stderr.write('klyro: mcp project-server approval skipped (registry unavailable)\n');
+            }
+            catch { /* ignore */ }
         }
     }
-    catch { /* ignore — MCP is optional */ }
     const providerKind = inferProviderFromBaseURL(baseUrl);
     // Local Ollama exposes OpenAI-compat but hostname could contain "anthropic"
     // via proxy — don't try anthropic adapter with empty key (would 401).
@@ -138,14 +187,16 @@ export async function startRepl(opts = {}) {
     let adapter = buildAdapter(currentProvider, currentBaseUrl, currentApiKey);
     const ctxBlock = await buildLevel6Context({ cwd });
     let ctxPrefix = ctxBlock.formatted ? `\n\n<context>\n${ctxBlock.formatted}\n</context>` : '';
-    // 4.4 KLYRO.md hierarchy (mutable — /reload refreshes)
-    const klyroMd = await import('../context/klyro-md.js').then((m) => m.loadKlyroMd(cwd)).catch(() => '');
-    let klyroBlock = klyroMd ? `\n\n<KLYRO.md>\n${klyroMd.slice(0, 4000)}\n</KLYRO.md>` : '';
-    // 2.3 layered system prompt
+    // 4.4 KLYRO.md hierarchy (mutable — /reload refreshes). Content is gated
+    // through the context trust store (see loadKlyroBlockTrust below) — the
+    // initial value stays empty until the gated load runs after approval setup.
+    let klyroBlock = '';
+    // 2.3 layered system prompt (split shape: stable base + volatile telemetry suffix)
     const systemPromptFn = (_ctx) => {
-        const base = buildSystemPrompt({ cwd, model, extraSystem: opts.systemPrompt, appendSystem: ctxPrefix + klyroBlock });
-        const t = _ctx.telemetry ? '\n\n' + _ctx.telemetry : '';
-        return base + t;
+        // 8.4 — inject session memory so memory_write actually takes effect.
+        const memBlock = memoryBlock(cwd);
+        const base = buildSystemPrompt({ cwd, model, extraSystem: opts.systemPrompt, appendSystem: ctxPrefix + klyroBlock + memBlock });
+        return _ctx.telemetry ? { system: base, suffix: _ctx.telemetry } : { system: base };
     };
     let ac = new AbortController();
     // When the TUI is mounted, use the inline Ink prompt. Otherwise
@@ -176,6 +227,45 @@ export async function startRepl(opts = {}) {
                 });
             },
         });
+    // Context-file trust gate (context/trust.js): KLYRO.md / AGENTS.md content
+    // only enters the prompt after the trust store approves it. Untrusted files
+    // prompt via the repl approval object (allow/always/always-persist → true,
+    // deny → false); every decision emits context.trust_prompt on globalBus.
+    const trustStore = new ContextTrust();
+    async function loadKlyroBlockTrust() {
+        try {
+            const { loadTrustedKlyroMd } = await import('../context/trust.js');
+            const text = await loadTrustedKlyroMd(cwd, {
+                trust: trustStore,
+                approve: async (file, reason) => {
+                    try {
+                        const choice = await approval.ask({
+                            toolName: 'context_trust',
+                            reason: `untrusted context file (${reason}): ${file.path}`,
+                            summary: file.path,
+                        });
+                        return choice === 'allow' || choice === 'always' || choice === 'always-persist';
+                    }
+                    catch {
+                        return false;
+                    }
+                },
+                sessionId: typeof tuiSessionId === 'string' ? tuiSessionId : 'ephemeral',
+                emit: (ev) => globalBus.emit(ev),
+            });
+            return text ? `\n\n<KLYRO.md>\n${text.slice(0, 4000)}\n</KLYRO.md>` : '';
+        }
+        catch {
+            return '';
+        }
+    }
+    // MCP servers need the approval object above — load them now.
+    await loadMcpTools();
+    // Non-TUI runs can prompt on stdin immediately; the TUI defers the gated
+    // load to onMounted (the modal can't render before mount — see below).
+    if (!useTui) {
+        klyroBlock = await loadKlyroBlockTrust().catch(() => '');
+    }
     let inflight = null;
     let lastStatus = null;
     const pendingQueue = [];
@@ -479,14 +569,41 @@ export async function startRepl(opts = {}) {
         return s.length > cap ? s.slice(0, cap) + `\n... [truncated ${s.length - cap} chars]` : s;
     }
     async function execShell(command, timeoutMs = 120_000) {
-        const r = await registry.execute('shell_exec', { command, timeoutMs }, { cwd, env: process.env, nonInteractive: true });
-        if (!r.ok)
-            throw new Error(r.error.message ?? 'shell failed');
-        return r.value;
+        // Internal shell executions bypass the agent runtime's event path, so
+        // audit them here: a redacted tool.call before, the matching tool.result
+        // after. One helper covers every slash handler (/commit, /push, …).
+        const callId = `internal-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+        const sessionId = typeof tuiSessionId === 'string' ? tuiSessionId : 'ephemeral';
+        const startedAt = Date.now();
+        globalBus.emit({
+            type: 'tool.call', ts: startedAt, sessionId, callId,
+            name: 'shell_exec', input: { internal: true, command: redact(command).slice(0, 2000) },
+        });
+        try {
+            const r = await registry.execute('shell_exec', { command, timeoutMs }, { cwd, env: process.env, nonInteractive: true });
+            if (!r.ok)
+                throw new Error(r.error.message ?? 'shell failed');
+            const v = r.value;
+            globalBus.emit({
+                type: 'tool.result', ts: Date.now(), sessionId, callId,
+                name: 'shell_exec', output: { internal: true, exitCode: v.exitCode },
+                isError: false, latencyMs: Date.now() - startedAt,
+            });
+            return v;
+        }
+        catch (err) {
+            globalBus.emit({
+                type: 'tool.result', ts: Date.now(), sessionId, callId,
+                name: 'shell_exec', output: { internal: true, error: err instanceof Error ? err.message : String(err) },
+                isError: true, latencyMs: Date.now() - startedAt,
+            });
+            throw err;
+        }
     }
     /** Read-only LLM answer (no tools) — powers /ask, /explain, /compact. */
     async function answerReadOnly(question, context) {
-        const sys = systemPromptFn({ cwd, telemetry: '' }) + '\n\nAnswer read-only: do not call tools, do not edit files.';
+        // Legacy chat path (no modes): resolve the split prompt back to one string.
+        const sys = resolveSystemPrompt(systemPromptFn, { cwd, telemetry: '' }).system + '\n\nAnswer read-only: do not call tools, do not edit files.';
         const attached = await buildAttachedBlock();
         const userText = (context ? `${question}\n\n<context>\n${context.slice(0, 6000)}\n</context>` : question) + attached;
         const req = {
@@ -564,6 +681,14 @@ export async function startRepl(opts = {}) {
                     hooks.append(ev.item);
             }
             pendingQueue.length = 0;
+            // Deferred trust-gated KLYRO.md load: the approval modal can only
+            // render once the App is mounted. Prompts sent before this resolves
+            // run without the KLYRO.md block (noted in /reload output).
+            if (useTui && !klyroBlock) {
+                void loadKlyroBlockTrust()
+                    .then((b) => { klyroBlock = b; })
+                    .catch(() => undefined);
+            }
         },
     }), { patchConsole: false });
     // Install SIGINT handler only after app exists (avoids TDZ) and use once
@@ -618,7 +743,8 @@ export async function startRepl(opts = {}) {
             try {
                 const simpleReq = {
                     model,
-                    system: systemPromptFn({ cwd, telemetry: '' }),
+                    // Legacy chat path (no modes): plain string system, untouched by the split.
+                    system: resolveSystemPrompt(systemPromptFn, { cwd, telemetry: '' }).system,
                     messages: [{ role: 'user', content: [{ kind: 'text', text: taskText }] }],
                     tools: [],
                     signal: ac.signal,
@@ -2380,8 +2506,9 @@ export async function startRepl(opts = {}) {
                     }
                     const ctx = await buildLevel6Context({ cwd });
                     ctxPrefix = ctx.formatted ? `\n\n<context>\n${ctx.formatted}\n</context>` : '';
-                    const md = await import('../context/klyro-md.js').then((m) => m.loadKlyroMd(cwd)).catch(() => '');
-                    klyroBlock = md ? `\n\n<KLYRO.md>\n${md.slice(0, 4000)}\n</KLYRO.md>` : '';
+                    // Trust-gated like the initial load (the modal is mounted here,
+                    // so untrusted files prompt instead of being silently dropped).
+                    klyroBlock = await loadKlyroBlockTrust().catch(() => '');
                     queuedAppend({
                         id: `reload-${Date.now()}`,
                         kind: 'text',

package/dist/cli/run.d.ts

@@ -7,6 +7,8 @@
  * even on a long task. Tool calls and policy decisions go to stderr so
  * they don't pollute the captured `finalText` if the user pipes.
  */
+import type { VerifyMode } from '../agent/runtime.js';
+import type { SystemPromptFn } from '../agent/runtime.js';
 import type { Message } from '../agent/message.js';
 export interface RunCliOptions {
     task: string;
@@ -15,10 +17,7 @@ export interface RunCliOptions {
     maxSteps?: number;
     maxTokens?: number;
     temperature?: number;
-    systemPrompt?: (ctx: {
-        cwd: string;
-        telemetry?: string;
-    }) => string;
+    systemPrompt?: SystemPromptFn;
     baseUrl?: string;
     apiKey?: string;
     timeoutMs?: number;
@@ -60,6 +59,9 @@ export interface RunCliOptions {
     maxRepairAttempts?: number;
     verifyTimeoutMs?: number;
     requireVerify?: boolean;
+    /** Verification mode: strict (default) runs the full repair pipeline;
+     * advisory reports once without repairs; off skips verification. */
+    verifyMode?: VerifyMode;
     /** Level 9 — persistence */
     persist?: boolean;
     sessionId?: string;
@@ -70,11 +72,5 @@ export interface RunCliOptions {
 }
 export declare function runOnce(opts: RunCliOptions): Promise<number>;
 /** Wrap a system-prompt fn to inject Level-6 context (project map etc.) + KLYRO.md (4.4). */
-export declare function makeRunSystemPrompt(cwd: string, base: (ctx: {
-    cwd: string;
-    telemetry?: string;
-}) => string): Promise<(ctx: {
-    cwd: string;
-    telemetry?: string;
-}) => string>;
+export declare function makeRunSystemPrompt(cwd: string, base: SystemPromptFn): Promise<SystemPromptFn>;
 export declare function loadTranscript(path: string): Message[];

package/dist/cli/run.js

@@ -17,6 +17,7 @@ import { builtinRegistry } from '../tools/registry.js';
 import { builtinRules, clonePolicyConfig, PolicyEngine } from '../policy/engine.js';
 import { DenyAllApprovalPrompt } from '../policy/approval.js';
 import { buildLevel6Context } from '../context/level6.js';
+import { memoryBlock } from '../context/memory.js';
 import { resolveSessionId } from '../persistence/session.js';
 import * as fs from 'node:fs';
 function readEnv(name, fallback) {
@@ -97,15 +98,29 @@ export async function runOnce(opts) {
     catch {
         /* ignore — engine defaults stand */
     }
-    // Best-effort MCP tools: never fatal, never prompts. src/mcp/registry.ts
-    // lands from a sibling agent — the lazy import keeps runtime + builds green
-    // until then (import failure is caught below). @ts-ignore is used instead
-    // of @ts-expect-error so it stays inert after the sibling file lands.
+    // Best-effort MCP tools: never fatal, never prompts (headless cannot
+    // approve). Project-sourced servers auto-connect ONLY when their exact
+    // spec hash is already in the McpTrust store (e.g. approved in a prior
+    // REPL session); unknown specs are skipped with a warning.
     let closeMcp;
     try {
-        // @ts-ignore — sibling-owned module may not exist yet
         const { loadAndRegisterMcp } = await import('../mcp/registry.js');
-        const mcp = await loadAndRegisterMcp({ cwd: opts.cwd, registry, policy });
+        const { McpTrust, hashSpec } = await import('../mcp/trust.js');
+        const { loadMcpServers } = await import('../mcp/config.js');
+        const mcpTrust = new McpTrust();
+        const mcpSpecs = loadMcpServers(opts.cwd).servers;
+        const mcp = await loadAndRegisterMcp({
+            cwd: opts.cwd,
+            registry,
+            policy,
+            approveProjectServer: async ({ name }) => {
+                const spec = mcpSpecs[name];
+                if (spec && mcpTrust.isTrusted(name, hashSpec(spec)))
+                    return true;
+                stderr.write(`klyro: mcp project server "${name}" not in trust store (skipped — headless cannot prompt)\n`);
+                return false;
+            },
+        });
         for (const e of mcp.errors)
             stderr.write(`klyro: mcp ${e.server}: ${e.message}\n`);
         if (mcp.registered.length > 0 && output === 'human') {
@@ -179,6 +194,7 @@ export async function runOnce(opts) {
             maxRepairAttempts: opts.maxRepairAttempts ?? 3,
             timeoutMs: opts.verifyTimeoutMs,
             requireVerify: opts.requireVerify,
+            ...(opts.verifyMode ? { mode: opts.verifyMode } : {}),
         };
     let result;
     // P1.4 — if --agent is requested, stand up a parent orchestrator so the
@@ -297,6 +313,7 @@ export async function runOnce(opts) {
         const statusMap = {
             complete: 'complete',
             max_steps: 'max_steps',
+            limit: 'max_steps',
             aborted: 'aborted',
             no_final: 'aborted',
             verify_failed: 'verify_failed',
@@ -320,7 +337,21 @@ export async function runOnce(opts) {
             stdout.write(JSON.stringify({ kind: 'final', status: result.status, steps: result.steps }) + '\n');
         else
             stderr.write(`klyro: hit max steps (${result.steps}); consider raising --max-steps\n`);
-        return 3;
+        return 7;
+    }
+    if (result.status === 'limit') {
+        if (output === 'json')
+            stdout.write(JSON.stringify({ kind: 'final', status: result.status, steps: result.steps, text: result.finalText }) + '\n');
+        else
+            stderr.write(`klyro: stopped early: ${result.finalText || result.status} (after ${result.steps} steps)\n`);
+        return 7;
+    }
+    if (result.status === 'stuck') {
+        if (output === 'json')
+            stdout.write(JSON.stringify({ kind: 'final', status: result.status, steps: result.steps }) + '\n');
+        else
+            stderr.write(`klyro: stuck — repeated the same action with no progress; aborting after ${result.steps} steps\n`);
+        return 7;
     }
     if (result.status === 'aborted') {
         return 130;
@@ -328,14 +359,14 @@ export async function runOnce(opts) {
     if (result.status === 'no_final') {
         if (output !== 'json')
             stderr.write('klyro: provider error — no final answer\n');
-        return 4;
+        return 5;
     }
     if (result.status === 'verify_failed') {
         if (output === 'json')
             stdout.write(JSON.stringify({ kind: 'final', status: 'verify_failed', failureType: result.verification?.failureType }) + '\n');
         else
             stderr.write(`klyro: verification failed after ${result.verification?.attempts ?? 3} repairs — see output above\n`);
-        return 5;
+        return 8;
     }
     // 6.5 — --require-verify: if edits were made but verification never passed, exit 8
     if (opts.requireVerify && result.verification && !result.verification.ok) {
@@ -361,7 +392,9 @@ async function dryRunReport(opts) {
     // Assemble the REAL prompt (Level-6 context + KLYRO.md), not the bare base —
     // otherwise dry-run shows a different prompt than production runs use.
     const systemPromptFn = await makeRunSystemPrompt(opts.cwd, opts.systemPrompt ?? defaultRunSystemPrompt);
-    const systemPrompt = systemPromptFn({ cwd: opts.cwd });
+    const { resolveSystemPrompt } = await import('../agent/runtime.js');
+    const { system, suffix } = resolveSystemPrompt(systemPromptFn, { cwd: opts.cwd });
+    const systemPrompt = suffix ? `${system}\n\n${suffix}` : system;
     const registry = builtinRegistry();
     const rules = builtinRules();
     const report = {
@@ -386,35 +419,53 @@ function defaultRunSystemPrompt(_ctx) {
         'Solve it by calling tools as needed. When done, produce a short final text answer.',
         'Do not invent file paths. Do not call tools outside the working directory.',
     ].join(' ');
-    return _ctx.telemetry ? base + '\n\n' + _ctx.telemetry : base;
+    return _ctx.telemetry ? { system: base, suffix: _ctx.telemetry } : { system: base };
 }
 /** Wrap a system-prompt fn to inject Level-6 context (project map etc.) + KLYRO.md (4.4). */
 export async function makeRunSystemPrompt(cwd, base) {
     const ctxBlock = await buildLevel6Context({ cwd });
     const prefix = ctxBlock.formatted ? `\n\n<context>\n${ctxBlock.formatted}\n</context>` : '';
+    // Session memory: .klyro/memory/session-notes.md injected so memory_write
+    // actually takes effect (redacted at write time — see context/memory.ts).
+    const memBlock = memoryBlock(cwd);
     let klyroBlock = '';
     try {
-        // P0.3 trust gate: unapproved context files are excluded in headless
-        // mode (secure default-deny) and each exclusion is bus-visible.
+        // P0.3 trust gate with headless approve-if-store-known: approve(file) is
+        // trust.isTrusted(file), so REPL-persisted approvals are honored with no
+        // prompting; unknown/changed files stay excluded and each exclusion is
+        // bus-visible.
         const { loadKlyroMdFiles } = await import('../context/klyro-md.js');
         const { ContextTrust } = await import('../context/trust.js');
         const { globalBus } = await import('../events/bus.js');
+        const trust = new ContextTrust();
+        // Headless approve-if-store-known (no prompts): approve(file) is
+        // trust.isTrusted(file), so REPL-persisted approvals are honored;
+        // unknown/changed files stay excluded.
+        const approve = (file) => trust.isTrusted(file);
         const files = await loadKlyroMdFiles(cwd);
-        const { trusted, untrusted } = new ContextTrust().check(files);
+        const { trusted, untrusted } = trust.check(files);
         for (const { file, reason } of untrusted) {
             globalBus.emit({ type: 'context.trust_prompt', ts: Date.now(), sessionId: 'ephemeral', path: file.path, reason, trusted: false });
         }
         if (untrusted.length > 0) {
             stderr.write(`klyro: trust gate excluded ${untrusted.length} unapproved context file(s): ${untrusted.map((u) => u.file.path).join(', ')}\n`);
         }
-        const kept = trusted.map((f) => `# ${f.path}\n${f.content}`).join('\n\n---\n\n');
+        const keptFiles = trusted.filter(approve);
+        const kept = keptFiles.map((f) => `# ${f.path}\n${f.content}`).join('\n\n---\n\n');
         if (kept)
             klyroBlock = `\n\n<KLYRO.md>\n${kept.slice(0, 4000)}\n</KLYRO.md>`;
     }
     catch { /* ignore */ }
     return (ctx) => {
-        const t = ctx.telemetry ? '\n\n' + ctx.telemetry : '';
-        return base(ctx) + prefix + klyroBlock + t;
+        const r = base(ctx);
+        if (typeof r === 'string') {
+            // Legacy string fn: keep the exact legacy concatenation behavior.
+            const t = ctx.telemetry ? '\n\n' + ctx.telemetry : '';
+            return r + prefix + klyroBlock + memBlock + t;
+        }
+        // Split shape: Level-6/KLYRO.md join the stable prefix; telemetry stays
+        // the volatile suffix for cache-friendly adapters.
+        return { system: r.system + prefix + klyroBlock + memBlock, ...(r.suffix !== undefined ? { suffix: r.suffix } : {}) };
     };
 }
 export function loadTranscript(path) {

package/dist/cli/update.d.ts

@@ -1,6 +1,11 @@
 /**
  * klyro update — check registry for newer version, cached 24h.
  * Env KLYRO_NO_UPDATE_CHECK=1 disables.
+ *
+ * Integrity: before recommending `npm i`, we verify the tarball's SRI hash
+ * (sha512) against the registry's recorded `dist.integrity`. An install is
+ * only recommended when the download hash matches, so a tampered CDN or
+ * MITM registry response can't push a malicious binary to the operator.
  */
 export declare function checkForUpdate(current: string): Promise<string | null>;
 export declare function runUpdate(): Promise<number>;

package/dist/cli/update.js

@@ -1,15 +1,65 @@
 /**
  * klyro update — check registry for newer version, cached 24h.
  * Env KLYRO_NO_UPDATE_CHECK=1 disables.
+ *
+ * Integrity: before recommending `npm i`, we verify the tarball's SRI hash
+ * (sha512) against the registry's recorded `dist.integrity`. An install is
+ * only recommended when the download hash matches, so a tampered CDN or
+ * MITM registry response can't push a malicious binary to the operator.
  */
 import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import * as os from 'node:os';
+import { createHash } from 'node:crypto';
 const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+const REGISTRY_BASE = 'https://registry.npmjs.org/klyro';
+const FETCH_TIMEOUT_MS = 3000;
+const TARBALL_TIMEOUT_MS = 10000;
 function cachePath() {
+    // KLYRO_UPDATE_CACHE lets tests isolate the on-disk cache (and power users
+    // relocate it); default is the home cache like the rest of Klyro.
+    const override = process.env.KLYRO_UPDATE_CACHE;
+    if (override)
+        return override;
     const home = os.homedir() || process.cwd();
     return path.join(home, '.klyro', 'update-cache.json');
 }
+/** SRI string may carry multiple hashes parsable with `pick`; we accept sha512 or sha256. */
+function parseSRI(integrity) {
+    if (!integrity)
+        return null;
+    for (const part of integrity.split(/\s+/)) {
+        const m = /^(sha256|sha512)-([A-Za-z0-9+/=]+)$/.exec(part);
+        if (m)
+            return { algo: m[1], digest: m[2] };
+    }
+    return null;
+}
+/** Fetch with a timeout; rejects on non-2xx. */
+async function fetchWithTimeout(url, timeoutMs = FETCH_TIMEOUT_MS) {
+    const ctrl = new AbortController();
+    const t = setTimeout(() => ctrl.abort(), timeoutMs);
+    try {
+        const res = await fetch(url, { signal: ctrl.signal });
+        if (!res.ok)
+            throw new Error(`HTTP ${res.status}`);
+        return res;
+    }
+    finally {
+        clearTimeout(t);
+    }
+}
+/** Download the tarball and confirm its hash equals the registry's SRI digest. */
+async function verifyTarballIntegrity(dist) {
+    const sri = parseSRI(dist.integrity);
+    const tarball = dist.tarball;
+    if (!sri || !tarball)
+        return false;
+    const res = await fetchWithTimeout(tarball, TARBALL_TIMEOUT_MS);
+    const buf = Buffer.from(await res.arrayBuffer());
+    const actual = createHash(sri.algo).update(buf).digest('base64');
+    return actual === sri.digest;
+}
 export async function checkForUpdate(current) {
     if (process.env.KLYRO_NO_UPDATE_CHECK === '1')
         return null;
@@ -25,18 +75,20 @@ export async function checkForUpdate(current) {
         // ignore
     }
     try {
-        const ctrl = new AbortController();
-        const t = setTimeout(() => ctrl.abort(), 3000);
-        const res = await fetch('https://registry.npmjs.org/klyro/latest', { signal: ctrl.signal });
-        clearTimeout(t);
-        if (!res.ok)
-            return null;
+        const res = await fetchWithTimeout(`${REGISTRY_BASE}/latest`);
         const json = (await res.json());
         const latest = json.version ?? '';
-        await fs.mkdir(path.dirname(cache), { recursive: true });
-        await fs.writeFile(cache, JSON.stringify({ at: Date.now(), latest }), 'utf-8');
-        if (latest && latest !== current)
+        if (latest && latest !== current) {
+            // Verify the tarball's integrity before caching/recommending this version.
+            const verRes = await fetchWithTimeout(`${REGISTRY_BASE}/${encodeURIComponent(latest)}`);
+            const verJson = (await verRes.json());
+            const ok = await verifyTarballIntegrity(verJson.dist ?? {});
+            if (!ok)
+                return null; // integrity mismatch — treat as no update, never recommend it
+            await fs.mkdir(path.dirname(cache), { recursive: true });
+            await fs.writeFile(cache, JSON.stringify({ at: Date.now(), latest }), 'utf-8');
             return latest;
+        }
     }
     catch {
         // network failure — silent
@@ -55,7 +107,7 @@ export async function runUpdate() {
         const cur = pkg.version ?? '0.0.0';
         const latest = await checkForUpdate(cur);
         if (latest) {
-            process.stdout.write(`Update available: ${cur} → ${latest}\n  npm i -g klyro@latest\n`);
+            process.stdout.write(`Update available: ${cur} → ${latest} (integrity verified)\n  npm i -g klyro@latest\n`);
         }
         else {
             process.stdout.write(`klyro ${cur} is latest\n`);

package/dist/context/import-graph.d.ts

@@ -3,6 +3,8 @@ export interface ImportGraph {
     edges: Map<string, Set<string>>;
     mtime: number;
 }
+/** Invalidate the import-graph cache (tests + callers that mutate the tree). */
+export declare function clearImportGraphCache(): void;
 export declare function buildImportGraph(cwd: string): Promise<ImportGraph>;
 export declare function importsOf(cwd: string, file: string): Promise<string[]>;
 export declare function importersOf(cwd: string, file: string): Promise<string[]>;