klyro 1.0.0 → 1.0.1

package/dist/persistence/audit.js

@@ -2,14 +2,114 @@
  * Audit log — append-only JSONL of runtime events. Same shape as the
  * future durable-task scheduler will read, so the data layout is
  * forward-compatible.
+ *
+ * Durability: every record is hash-chained. Each line carries `prevHash`
+ * (hex sha256 of the previous line's canonical JSON, 'GENESIS' for the
+ * first line) and `hash` (sha256 of the record-with-prevHash canonical
+ * JSON). `verifyAuditChain` recomputes the chain for `klyro audit`.
  */
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
 import { SessionStore } from './store.js';
+export const AUDIT_GENESIS = 'GENESIS';
+/** Canonical JSON: object keys sorted recursively, so hashes are stable. */
+export function canonicalJson(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value) ?? 'null';
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(',')}]`;
+    const rec = value;
+    const keys = Object.keys(rec).sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(rec[k])}`).join(',')}}`;
+}
+export function sha256Hex(s) {
+    return crypto.createHash('sha256').update(s, 'utf-8').digest('hex');
+}
+/** Hash of a chained record excluding its own `hash` field. */
+export function hashAuditRecord(record) {
+    const { hash: _omit, ...body } = record;
+    void _omit;
+    return sha256Hex(canonicalJson(body));
+}
+async function readLastLine(filePath) {
+    try {
+        const raw = await fs.readFile(filePath, 'utf-8');
+        const lines = raw.split('\n').filter((l) => l.trim());
+        return lines.length > 0 ? lines[lines.length - 1] : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** prevHash for the next record: hash of the previous line, or GENESIS. */
+async function prevHashFor(filePath) {
+    const last = await readLastLine(filePath);
+    if (!last)
+        return AUDIT_GENESIS;
+    try {
+        const parsed = JSON.parse(last);
+        if (typeof parsed.hash === 'string' && parsed.hash)
+            return parsed.hash;
+        return sha256Hex(canonicalJson(parsed));
+    }
+    catch {
+        return sha256Hex(last);
+    }
+}
 export class AuditLog {
     filePath;
+    /** Serializes chained appends so concurrent writes can't fork the chain. */
+    chain = Promise.resolve();
     constructor(filePath) {
         this.filePath = filePath;
     }
     async write(event) {
-        await SessionStore.appendJsonl(this.filePath, event);
+        const task = this.chain.then(() => this.appendChained(event));
+        // Keep the chain alive across failures; the caller still sees its error.
+        this.chain = task.catch(() => undefined);
+        return task;
+    }
+    async appendChained(event) {
+        const prevHash = await prevHashFor(this.filePath);
+        const body = { ...event, prevHash };
+        const record = { ...body, prevHash, hash: sha256Hex(canonicalJson(body)) };
+        await SessionStore.appendJsonl(this.filePath, record);
+    }
+}
+/**
+ * Recompute the hash chain of a session JSONL file.
+ * Sessions live at `<sessionsDir>/<sessionId>.jsonl` (see SessionStore).
+ */
+export async function verifyAuditChain(sessionsDir, sessionId) {
+    const filePath = path.join(sessionsDir, `${sessionId}.jsonl`);
+    let raw;
+    try {
+        raw = await fs.readFile(filePath, 'utf-8');
+    }
+    catch {
+        return { ok: false, events: 0, error: `audit log not found: ${filePath}` };
+    }
+    const lines = raw.split('\n').filter((l) => l.trim());
+    let expectedPrev = AUDIT_GENESIS;
+    let events = 0;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        let parsed;
+        try {
+            parsed = JSON.parse(line);
+        }
+        catch {
+            return { ok: false, events, error: `line ${i + 1}: unparseable JSON` };
+        }
+        if (parsed.prevHash !== expectedPrev) {
+            return { ok: false, events, error: `line ${i + 1}: prevHash mismatch (chain fork or truncation)` };
+        }
+        if (typeof parsed.hash !== 'string' || parsed.hash !== hashAuditRecord(parsed)) {
+            return { ok: false, events, error: `line ${i + 1}: hash mismatch (tampered record)` };
+        }
+        expectedPrev = parsed.hash;
+        events++;
     }
+    return { ok: true, events };
 }

package/dist/persistence/store.d.ts

@@ -50,6 +50,8 @@ export declare class SessionStore {
     private writeIndex;
     private projectHash;
     private perProjectIndexPath;
+    /** Atomic per-project index write (tmp + fsync + rename). */
+    private writePerProjectIndex;
     private titleFor;
     create(opts: {
         cwd: string;
@@ -61,7 +63,7 @@ export declare class SessionStore {
      * continues with full context instead of starting blank.
      */
     fork(id: string, taskSuffix?: string): Promise<SessionRecord>;
-    /** Delete a session and all its artifacts (record, transcript, jsonl, indexes). */
+    /** Delete a session and all its artifacts (record, transcript, jsonl, lock, indexes). */
     delete(id: string): Promise<boolean>;
     private jsonlPath;
     appendJsonl(id: string, entry: unknown): Promise<void>;
@@ -77,6 +79,28 @@ export declare class SessionStore {
         status?: SessionStatus;
     }): Promise<SessionRecord[]>;
     get(id: string): Promise<SessionRecord | null>;
-    /** Atomic append — survives crashes; suitable for audit log. */
+    /** Atomic append + fsync — survives crashes; suitable for audit log. */
     static appendJsonl(filePath: string, entry: unknown): Promise<void>;
 }
+/**
+ * Redact text blocks of a stored message at the persist boundary.
+ * Handles string content, `{ text }` blocks, arrays of blocks, and plain
+ * objects (observation input/output) via a deep walk over string leaves.
+ * Only secret-shaped strings (key/token/password patterns, [:=-] shapes)
+ * are touched — normal prose passes through unchanged.
+ */
+export declare function redactStoredContent(content: unknown): unknown;
+export interface SessionLockInfo {
+    held: boolean;
+    pid?: number;
+    /** True when the lock holder process is (probably) still running. */
+    alive?: boolean;
+}
+/**
+ * Cross-process session lock probe. The lock file `<sessionsDir>/<id>.lock`
+ * contains the holder's PID. `alive` is resolved via `process.kill(pid, 0)`:
+ * EPERM means alive-but-unpermitted (→ true); ESRCH / other errors → false.
+ */
+export declare function readSessionLock(sessionsDir: string, id: string): SessionLockInfo;
+/** Best-effort release of the cross-process session lock. Never throws. */
+export declare function releaseSessionLock(sessionsDir: string, id: string): Promise<void>;

package/dist/persistence/store.js

@@ -10,8 +10,10 @@
  * SessionStore interface.
  */
 import * as fs from 'node:fs/promises';
+import * as fsSync from 'node:fs';
 import * as path from 'node:path';
 import { randomUUID } from 'node:crypto';
+import { redact } from '../policy/secret-redactor.js';
 export class SessionStore {
     dir;
     indexPath;
@@ -75,6 +77,28 @@ export class SessionStore {
         return Math.abs(h).toString(36);
     }
     perProjectIndexPath(cwd) { return path.join(this.dir, `index-${this.projectHash(cwd)}.json`); }
+    /** Atomic per-project index write (tmp + fsync + rename). */
+    async writePerProjectIndex(pp, pIdx) {
+        const tmp = `${pp}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+        await fs.writeFile(tmp, JSON.stringify(pIdx, null, 2), 'utf-8');
+        try {
+            const fh = await fs.open(tmp, 'r+');
+            try {
+                await fh.sync();
+            }
+            finally {
+                await fh.close();
+            }
+        }
+        catch { /* ignore on Windows */ }
+        try {
+            await fs.rename(tmp, pp);
+        }
+        catch {
+            await fs.unlink(tmp).catch(() => undefined);
+            throw new Error('Failed to write per-project sessions index');
+        }
+    }
     titleFor(task) {
         // heuristic title via first 6 words, or model.small would be used if available
         const w = task.trim().split(/\s+/).slice(0, 6).join(' ');
@@ -84,24 +108,39 @@ export class SessionStore {
         // Locked: the index read-modify-write below races under concurrent creates.
         return this.withLock('index', async () => {
             await this.ensureDir();
-            const id = randomUUID();
+            // Redact at the persist boundary — tasks routinely paste keys/tokens.
+            const task = redact(opts.task);
+            let id = randomUUID();
+            // Cross-process session lock: O_EXCL so a concurrent creator (another
+            // process resuming/creating the same id path) can detect contention.
+            // On collision fall back to a unique id suffix — never crash.
+            try {
+                await fs.writeFile(path.join(this.dir, `${id}.lock`), String(process.pid), { flag: 'wx' });
+            }
+            catch {
+                id = `${id}-${process.pid}-${Date.now().toString(36)}`;
+                try {
+                    await fs.writeFile(path.join(this.dir, `${id}.lock`), String(process.pid), { flag: 'wx' });
+                }
+                catch { /* best-effort only */ }
+            }
             const now = Date.now();
             const record = {
                 id,
                 cwd: opts.cwd,
-                task: opts.task,
+                task,
                 status: 'open',
                 createdAt: now,
                 updatedAt: now,
                 config: opts.config,
             };
-            record.title = this.titleFor(opts.task);
+            record.title = this.titleFor(task);
             await fs.writeFile(path.join(this.dir, `${id}.json`), JSON.stringify({ record, messages: [], observations: [] }, null, 2));
             await this.appendJsonl(id, { type: 'session.create', record, ts: now });
             const idx = await this.readIndex();
             idx[id] = record;
             await this.writeIndex(idx);
-            // per-project index
+            // per-project index (atomic)
             try {
                 const pp = this.perProjectIndexPath(opts.cwd);
                 let pIdx = {};
@@ -110,7 +149,7 @@ export class SessionStore {
                 }
                 catch { }
                 pIdx[id] = record;
-                await fs.writeFile(pp, JSON.stringify(pIdx, null, 2), 'utf-8');
+                await this.writePerProjectIndex(pp, pIdx);
             }
             catch { }
             return record;
@@ -136,13 +175,13 @@ export class SessionStore {
         await this.appendJsonl(forked.id, { type: 'session.fork', from: id, ts: Date.now() });
         return forked;
     }
-    /** Delete a session and all its artifacts (record, transcript, jsonl, indexes). */
+    /** Delete a session and all its artifacts (record, transcript, jsonl, lock, indexes). */
     async delete(id) {
         return this.withLock('index', async () => {
             const rec = await this.get(id);
             if (!rec)
                 return false;
-            for (const f of [`${id}.json`, `${id}.jsonl`]) {
+            for (const f of [`${id}.json`, `${id}.jsonl`, `${id}.lock`]) {
                 try {
                     await fs.unlink(path.join(this.dir, f));
                 }
@@ -156,7 +195,7 @@ export class SessionStore {
                 const raw = await fs.readFile(pp, 'utf-8');
                 const pIdx = JSON.parse(raw);
                 delete pIdx[id];
-                await fs.writeFile(pp, JSON.stringify(pIdx, null, 2), 'utf-8');
+                await this.writePerProjectIndex(pp, pIdx);
             }
             catch { /* ignore */ }
             return true;
@@ -241,14 +280,19 @@ export class SessionStore {
     async appendMessage(id, message) {
         return this.withLock(id, async () => {
             const data = await this.readSession(id);
-            data.messages.push(message);
+            data.messages.push({ ...message, content: redactStoredContent(message.content) });
             await this.writeSession(id, data);
         });
     }
     async appendObservation(id, obs) {
         return this.withLock(id, async () => {
             const data = await this.readSession(id);
-            data.observations.push(obs);
+            // S4-at-rest: redact observation input/output at the persist boundary.
+            data.observations.push({
+                ...obs,
+                input: redactStoredContent(obs.input),
+                output: redactStoredContent(obs.output),
+            });
             await this.writeSession(id, data);
         });
     }
@@ -256,9 +300,16 @@ export class SessionStore {
         return this.withLock(id, async () => {
             const data = await this.readSession(id);
             data.record.status = status;
+            // S4-at-rest: redact finalText before persisting.
             if (finalText !== undefined)
-                data.record.finalText = finalText;
+                data.record.finalText = redact(finalText);
             await this.writeSession(id, data);
+            // Terminal states release the cross-process lock (no destructor exists
+            // to do it — the session is done, so the lock is stale by definition).
+            if (status === 'complete' || status === 'aborted' || status === 'max_steps' ||
+                status === 'verify_failed' || status === 'stuck') {
+                await releaseSessionLock(this.dir, id);
+            }
         });
     }
     async loadMessages(id) {
@@ -278,9 +329,85 @@ export class SessionStore {
         const idx = await this.readIndex();
         return idx[id] ?? null;
     }
-    /** Atomic append — survives crashes; suitable for audit log. */
+    /** Atomic append + fsync — survives crashes; suitable for audit log. */
     static async appendJsonl(filePath, entry) {
         await fs.mkdir(path.dirname(filePath), { recursive: true });
-        await fs.appendFile(filePath, JSON.stringify(entry) + '\n', 'utf-8');
+        const fh = await fs.open(filePath, 'a');
+        try {
+            await fh.write(JSON.stringify(entry) + '\n');
+            await fh.sync();
+        }
+        finally {
+            await fh.close();
+        }
+    }
+}
+/**
+ * Redact text blocks of a stored message at the persist boundary.
+ * Handles string content, `{ text }` blocks, arrays of blocks, and plain
+ * objects (observation input/output) via a deep walk over string leaves.
+ * Only secret-shaped strings (key/token/password patterns, [:=-] shapes)
+ * are touched — normal prose passes through unchanged.
+ */
+export function redactStoredContent(content) {
+    if (typeof content === 'string')
+        return redact(content);
+    if (Array.isArray(content)) {
+        return content.map((b) => {
+            if (b && typeof b === 'object' && typeof b.text === 'string') {
+                return { ...b, text: redact(b.text) };
+            }
+            if (typeof b === 'string')
+                return redact(b);
+            if (b && typeof b === 'object')
+                return redactStoredContent(b);
+            return b;
+        });
+    }
+    if (content && typeof content === 'object') {
+        const rec = content;
+        if (typeof rec.text === 'string') {
+            return { ...rec, text: redact(rec.text) };
+        }
+        const out = {};
+        for (const [k, v] of Object.entries(rec)) {
+            out[k] = typeof v === 'string' ? redact(v) : (v && typeof v === 'object' ? redactStoredContent(v) : v);
+        }
+        return out;
+    }
+    return content;
+}
+/**
+ * Cross-process session lock probe. The lock file `<sessionsDir>/<id>.lock`
+ * contains the holder's PID. `alive` is resolved via `process.kill(pid, 0)`:
+ * EPERM means alive-but-unpermitted (→ true); ESRCH / other errors → false.
+ */
+export function readSessionLock(sessionsDir, id) {
+    let raw;
+    try {
+        raw = fsSync.readFileSync(path.join(sessionsDir, `${id}.lock`), 'utf-8');
+    }
+    catch {
+        return { held: false };
+    }
+    const pid = Number(raw.trim());
+    if (!Number.isInteger(pid) || pid <= 0)
+        return { held: true };
+    let alive;
+    try {
+        process.kill(pid, 0);
+        alive = true;
+    }
+    catch (err) {
+        const code = err?.code;
+        alive = code === 'EPERM';
+    }
+    return { held: true, pid, alive };
+}
+/** Best-effort release of the cross-process session lock. Never throws. */
+export async function releaseSessionLock(sessionsDir, id) {
+    try {
+        await fs.unlink(path.join(sessionsDir, `${id}.lock`));
     }
+    catch { /* ignore */ }
 }

package/dist/policy/approval.d.ts

@@ -25,6 +25,20 @@ export interface ApprovalRequest {
 export interface ApprovalPrompt {
     ask(req: ApprovalRequest): Promise<ApprovalChoice>;
 }
+/**
+ * Sanitize untrusted tool text before showing it in an approval prompt.
+ * Strips ANSI escapes (CSI `ESC[...letter` and OSC `ESC]...BEL`), control
+ * chars except `\n`/`\t`, and truncates to 500 chars with a hidden-count
+ * marker so prompt-injection / terminal-escape payloads can't ride along.
+ */
+export declare function sanitizeForPrompt(s: string): string;
+/**
+ * Single-key approval mapping shared by the TUI modal (and documented here
+ * so stdin stays consistent): lowercase `a` = session-only, UPPERCASE `A` =
+ * persist to settings. Case MUST be checked before lowercasing — the old TUI
+ * code lowercased first, so `A` silently became session-only `always`.
+ */
+export declare function approvalChoiceForKey(inputStr: string): ApprovalChoice | 'expand' | 'explain' | null;
 /** Default prompt backed by readline on stdin/stdout. */
 export declare class StdinApprovalPrompt implements ApprovalPrompt {
     ask(req: ApprovalRequest): Promise<ApprovalChoice>;

package/dist/policy/approval.js

@@ -8,6 +8,45 @@
 import * as readline from 'node:readline/promises';
 import { stdin as input, stdout as output } from 'node:process';
 import { patternForCall } from './patterns.js';
+/**
+ * Sanitize untrusted tool text before showing it in an approval prompt.
+ * Strips ANSI escapes (CSI `ESC[...letter` and OSC `ESC]...BEL`), control
+ * chars except `\n`/`\t`, and truncates to 500 chars with a hidden-count
+ * marker so prompt-injection / terminal-escape payloads can't ride along.
+ */
+export function sanitizeForPrompt(s) {
+    const noAnsi = s
+        .replace(/\x1b\[[0-9;]*[A-Za-z]/g, '')
+        .replace(/\x1b\][^\x07]*\x07/g, '');
+    const clean = noAnsi.replace(/[\x00-\x08\x0b-\x0d\x0e-\x1f\x7f]/g, '');
+    const LIMIT = 500;
+    if (clean.length > LIMIT) {
+        return clean.slice(0, LIMIT) + `…[+${clean.length - LIMIT} hidden]`;
+    }
+    return clean;
+}
+/**
+ * Single-key approval mapping shared by the TUI modal (and documented here
+ * so stdin stays consistent): lowercase `a` = session-only, UPPERCASE `A` =
+ * persist to settings. Case MUST be checked before lowercasing — the old TUI
+ * code lowercased first, so `A` silently became session-only `always`.
+ */
+export function approvalChoiceForKey(inputStr) {
+    if (inputStr === 'A')
+        return 'always-persist';
+    const c = inputStr.toLowerCase();
+    if (c === 'y')
+        return 'allow';
+    if (c === 'a')
+        return 'always';
+    if (c === 'd' || c === 'n' || c === 'e')
+        return 'deny';
+    if (c === 'f')
+        return 'expand';
+    if (c === '?')
+        return 'explain';
+    return null;
+}
 /** Default prompt backed by readline on stdin/stdout. */
 export class StdinApprovalPrompt {
     async ask(req) {
@@ -15,10 +54,13 @@ export class StdinApprovalPrompt {
             return 'deny';
         const rl = readline.createInterface({ input, output });
         try {
-            process.stdout.write(`\n[approval needed] ${req.toolName}: ${req.summary}\n  reason: ${req.reason}\n  allow? [y/n/a(llow)] `);
-            const ans = (await rl.question('')).trim().toLowerCase();
+            process.stdout.write(`\n[approval needed] ${req.toolName}: ${sanitizeForPrompt(req.summary)}\n  reason: ${sanitizeForPrompt(req.reason)}\n  allow? [y/n/a/A(llow always → settings)] (y=once, n=deny, a=session, A=persist) `);
+            const raw = (await rl.question('')).trim();
+            const ans = raw.toLowerCase();
             if (ans === 'y' || ans === 'yes')
                 return 'allow';
+            if (raw === 'A')
+                return 'always-persist';
             if (ans === 'a' || ans === 'allow')
                 return 'always';
             return 'deny';

package/dist/policy/engine.d.ts

@@ -83,6 +83,7 @@ export declare class PolicyEngine {
 }
 /** Builtin set of rules. Order matters: first match wins. */
 export declare function builtinRules(): PolicyRule[];
+export declare function matchesGlobRule(call: ToolCallLike, rule: string): boolean;
 /** Hard-deny for obviously destructive shell patterns. */
 export declare const shellDenyRule: PolicyRule;
 /** Allowlist for shell — exact or prefix. Anything not in the list asks. */

package/dist/policy/engine.js

@@ -80,17 +80,33 @@ export class PolicyEngine {
         const globDecision = this.evaluateGlobRules(call);
         if (globDecision)
             return globDecision;
-        // 3.4 — .env guard: deny writes to .env files unless explicitly allowed
-        if ((call.name === 'write_file' || call.name === 'edit_file') && typeof call.input.path === 'string') {
-            const p = String(call.input.path);
-            if (/(^|\/)\.env(\.|$)/.test(p) || p.endsWith('.env')) {
-                // Check if explicitly allowed via allow list
-                const allowed = (ctx.config.allow ?? []).some((r) => r.includes('.env'));
-                if (!allowed) {
+        // Centralized .env guard: any tool with a string `path` input pointing
+        // at an env file is denied unless an allow rule explicitly names that
+        // tool+path (exact/glob match — substring `.includes('.env')` is NOT enough).
+        const maybePath = typeof call.input.path === 'string' ? String(call.input.path) : null;
+        if (maybePath !== null && isEnvPath(maybePath)) {
+            const allowed = isExplicitlyAllowedForPath(call.name, maybePath, ctx.config.allow);
+            if (!allowed) {
+                return { action: 'deny', reason: 'write to .env denied by policy — add to allow list or use --yolo' };
+            }
+        }
+        // apply_patch carries paths inside the patch text, not `input.path`.
+        if (call.name === 'apply_patch' && typeof call.input.patch === 'string') {
+            const targets = extractPatchPaths(String(call.input.patch)).filter(isEnvPath);
+            if (targets.length > 0) {
+                const allAllowed = targets.every((t) => isExplicitlyAllowedForPath(call.name, t, ctx.config.allow));
+                if (!allAllowed) {
                     return { action: 'deny', reason: 'write to .env denied by policy — add to allow list or use --yolo' };
                 }
             }
         }
+        // Shell redirection into .env (e.g. `echo x > .env`, `cmd >> .env.local`).
+        if (call.name === 'shell_exec' && typeof call.input.command === 'string') {
+            const cmd = String(call.input.command);
+            if (/>+\s*['"]?[^'"\s]*\.env/i.test(cmd)) {
+                return { action: 'deny', reason: 'write to .env via shell redirection denied' };
+            }
+        }
         for (const rule of this.rules) {
             const d = rule.evaluate(call, ctx);
             if (d)
@@ -157,7 +173,32 @@ export function builtinRules() {
 function asString(v) {
     return typeof v === 'string' ? v : '';
 }
-function matchesGlobRule(call, rule) {
+function isEnvPath(p) {
+    const lower = p.toLowerCase();
+    // Sample/template carve-out: `.env.example`-style files are documentation,
+    // not secrets — reads AND writes are allowed.
+    if (/[.](example|sample|template|dist)$/.test(lower))
+        return false;
+    return /(^|\/)\.env(\.|$)/.test(lower) || lower.endsWith('.env');
+}
+function extractPatchPaths(patch) {
+    const out = [];
+    for (const line of patch.split('\n')) {
+        if (line.startsWith('*** Update File:'))
+            out.push(line.replace('*** Update File:', '').trim());
+        else if (line.startsWith('*** Add File:'))
+            out.push(line.replace('*** Add File:', '').trim());
+    }
+    return out.filter(Boolean);
+}
+/** True when an allow rule explicitly names this tool+path (exact/glob match, not substring). */
+function isExplicitlyAllowedForPath(callName, envPath, allow) {
+    if (!allow || allow.length === 0)
+        return false;
+    const synthetic = { name: callName, input: { path: envPath } };
+    return allow.some((r) => matchesGlobRule(synthetic, r));
+}
+export function matchesGlobRule(call, rule) {
     // Rule grammar: tool or tool(glob). e.g. "write_file", "write_file(.env)", "shell_exec(npm *)".
     // Digits are allowed so generated names (e.g. mcp__server__tool2) can be targeted.
     const m = /^([a-z0-9_]+)(?:\((.*)\))?$/.exec(rule.trim());
@@ -204,6 +245,45 @@ export const shellDenyRule = {
         if (/\b(curl|wget|fetch|iwr|Invoke-WebRequest)\b.*\|\s*(sh|bash|zsh|cmd|powershell|pwsh|node|node\s+-e)\b/i.test(cmd)) {
             return { action: 'deny', reason: 'pipe-to-shell: remote download piped into an interpreter' };
         }
+        // Exfiltration denylist (mirrors shell_exec DANGEROUS_PATTERNS).
+        if (/\bcurl\b.*(?:\s-d\b|\s--data(?:-binary|-urlencode)?\b|\s--upload-file\b)/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: curl with --data/-d/--upload-file denied' };
+        }
+        if (/\bwget\b.*--post-(data|file)\b/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: wget --post-data/--post-file denied' };
+        }
+        if (/\b(powershell|pwsh)\b.*-e(nc|ncodedcommand)\b/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: powershell -enc denied' };
+        }
+        if (/\bInvoke-Expression\b/i.test(cmd) || /\biex\s*\(/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: Invoke-Expression/iex denied' };
+        }
+        if (/\bcertutil\b.*-urlcache\b/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: certutil -urlcache denied' };
+        }
+        if (/\bbitsadmin\b.*\/transfer\b/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: bitsadmin /transfer denied' };
+        }
+        // .env writes via tee / PowerShell (mirrors shell_exec DANGEROUS_PATTERNS).
+        if (/\|\s*tee\b[^\n]*\.env/i.test(cmd)) {
+            return { action: 'deny', reason: 'write to .env via tee denied' };
+        }
+        if (/\b(Set-Content|Out-File)\b[^\n]*\.env/i.test(cmd)) {
+            return { action: 'deny', reason: 'write to .env via Set-Content/Out-File denied' };
+        }
+        // Upload-form exfiltration (mirrors shell_exec DANGEROUS_PATTERNS).
+        if (/\bcurl\b.*(?:\s-F\b|\s--form\b)/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: curl -F/--form denied' };
+        }
+        if (/\bwget\b.*(?:\s--method=POST\b|\s--body-data\b)/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: wget --method=POST/--body-data denied' };
+        }
+        if (/\bInvoke-RestMethod\b/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: Invoke-RestMethod denied' };
+        }
+        if (/\bStart-BitsTransfer\b/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: Start-BitsTransfer denied' };
+        }
         return null;
     },
 };

package/dist/policy/secret-redactor.js

@@ -24,6 +24,10 @@ const PATTERNS = [
     { name: 'api-key', re: /(?:api[_-]?key|apikey)\s*[:=]\s*['"]?[A-Za-z0-9_\-]{16,}['"]?/gi },
     { name: 'password', re: /(?:password|passwd|pwd)\s*[:=]\s*['"]?[^\s'"]{4,}['"]?/gi },
     { name: 'secret-generic', re: /(?:secret|token)\s*[:=]\s*['"]?[A-Za-z0-9_\-+/=]{16,}['"]?/gi },
+    { name: 'discord-token', re: /mfa\.[\w-]{84}|[MN][A-Za-z\d]{23}\.[\w-]{6}\.[\w-]{27}/g },
+    { name: 'npm-token', re: /\bnpm_[A-Za-z0-9]{24,}/g },
+    { name: 'sendgrid-key', re: /\bSG\.[\w-]{22}\.[\w-]{43}/g },
+    { name: 'pypi-token', re: /\bpypi-[A-Za-z0-9_-]{30,}/g },
 ];
 const REPLACEMENT = '[REDACTED]';
 /** Redact a single string (or Buffer). */

package/dist/providers/model-info.d.ts

@@ -15,4 +15,21 @@ export interface ModelInfo {
 }
 export declare const MODEL_REGISTRY: Record<string, ModelInfo>;
 export declare function getModelInfo(id: string): ModelInfo;
+/**
+ * Single-source per-1K-token rate table, derived from MODEL_REGISTRY so
+ * prices live in exactly one place. Local/self-hosted entries are $0.
+ */
+export declare const MODEL_RATES_PER_1K: Record<string, {
+    input: number;
+    output: number;
+}>;
+/**
+ * Resolve per-1K rates for any model id. Exact registry hits win, then the
+ * local-model check ($0), then hosted-family fallbacks. Unknown models are
+ * $0 — never invent nonzero prices for models we don't recognize.
+ */
+export declare function ratesFor(modelId: string): {
+    input: number;
+    output: number;
+};
 export declare function estimateCost(modelId: string, inputTokens: number, outputTokens: number): number;