klyro 1.0.0 → 1.0.2

package/dist/persistence/store.d.ts

@@ -50,6 +50,8 @@ export declare class SessionStore {
     private writeIndex;
     private projectHash;
     private perProjectIndexPath;
+    /** Atomic per-project index write (tmp + fsync + rename). */
+    private writePerProjectIndex;
     private titleFor;
     create(opts: {
         cwd: string;
@@ -61,7 +63,7 @@ export declare class SessionStore {
      * continues with full context instead of starting blank.
      */
     fork(id: string, taskSuffix?: string): Promise<SessionRecord>;
-    /** Delete a session and all its artifacts (record, transcript, jsonl, indexes). */
+    /** Delete a session and all its artifacts (record, transcript, jsonl, lock, indexes). */
     delete(id: string): Promise<boolean>;
     private jsonlPath;
     appendJsonl(id: string, entry: unknown): Promise<void>;
@@ -77,6 +79,28 @@ export declare class SessionStore {
         status?: SessionStatus;
     }): Promise<SessionRecord[]>;
     get(id: string): Promise<SessionRecord | null>;
-    /** Atomic append — survives crashes; suitable for audit log. */
+    /** Atomic append + fsync — survives crashes; suitable for audit log. */
     static appendJsonl(filePath: string, entry: unknown): Promise<void>;
 }
+/**
+ * Redact text blocks of a stored message at the persist boundary.
+ * Handles string content, `{ text }` blocks, arrays of blocks, and plain
+ * objects (observation input/output) via a deep walk over string leaves.
+ * Only secret-shaped strings (key/token/password patterns, [:=-] shapes)
+ * are touched — normal prose passes through unchanged.
+ */
+export declare function redactStoredContent(content: unknown): unknown;
+export interface SessionLockInfo {
+    held: boolean;
+    pid?: number;
+    /** True when the lock holder process is (probably) still running. */
+    alive?: boolean;
+}
+/**
+ * Cross-process session lock probe. The lock file `<sessionsDir>/<id>.lock`
+ * contains the holder's PID. `alive` is resolved via `process.kill(pid, 0)`:
+ * EPERM means alive-but-unpermitted (→ true); ESRCH / other errors → false.
+ */
+export declare function readSessionLock(sessionsDir: string, id: string): SessionLockInfo;
+/** Best-effort release of the cross-process session lock. Never throws. */
+export declare function releaseSessionLock(sessionsDir: string, id: string): Promise<void>;

package/dist/persistence/store.js

@@ -10,8 +10,10 @@
  * SessionStore interface.
  */
 import * as fs from 'node:fs/promises';
+import * as fsSync from 'node:fs';
 import * as path from 'node:path';
 import { randomUUID } from 'node:crypto';
+import { redact } from '../policy/secret-redactor.js';
 export class SessionStore {
     dir;
     indexPath;
@@ -75,6 +77,28 @@ export class SessionStore {
         return Math.abs(h).toString(36);
     }
     perProjectIndexPath(cwd) { return path.join(this.dir, `index-${this.projectHash(cwd)}.json`); }
+    /** Atomic per-project index write (tmp + fsync + rename). */
+    async writePerProjectIndex(pp, pIdx) {
+        const tmp = `${pp}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+        await fs.writeFile(tmp, JSON.stringify(pIdx, null, 2), 'utf-8');
+        try {
+            const fh = await fs.open(tmp, 'r+');
+            try {
+                await fh.sync();
+            }
+            finally {
+                await fh.close();
+            }
+        }
+        catch { /* ignore on Windows */ }
+        try {
+            await fs.rename(tmp, pp);
+        }
+        catch {
+            await fs.unlink(tmp).catch(() => undefined);
+            throw new Error('Failed to write per-project sessions index');
+        }
+    }
     titleFor(task) {
         // heuristic title via first 6 words, or model.small would be used if available
         const w = task.trim().split(/\s+/).slice(0, 6).join(' ');
@@ -84,24 +108,39 @@ export class SessionStore {
         // Locked: the index read-modify-write below races under concurrent creates.
         return this.withLock('index', async () => {
             await this.ensureDir();
-            const id = randomUUID();
+            // Redact at the persist boundary — tasks routinely paste keys/tokens.
+            const task = redact(opts.task);
+            let id = randomUUID();
+            // Cross-process session lock: O_EXCL so a concurrent creator (another
+            // process resuming/creating the same id path) can detect contention.
+            // On collision fall back to a unique id suffix — never crash.
+            try {
+                await fs.writeFile(path.join(this.dir, `${id}.lock`), String(process.pid), { flag: 'wx' });
+            }
+            catch {
+                id = `${id}-${process.pid}-${Date.now().toString(36)}`;
+                try {
+                    await fs.writeFile(path.join(this.dir, `${id}.lock`), String(process.pid), { flag: 'wx' });
+                }
+                catch { /* best-effort only */ }
+            }
             const now = Date.now();
             const record = {
                 id,
                 cwd: opts.cwd,
-                task: opts.task,
+                task,
                 status: 'open',
                 createdAt: now,
                 updatedAt: now,
                 config: opts.config,
             };
-            record.title = this.titleFor(opts.task);
+            record.title = this.titleFor(task);
             await fs.writeFile(path.join(this.dir, `${id}.json`), JSON.stringify({ record, messages: [], observations: [] }, null, 2));
             await this.appendJsonl(id, { type: 'session.create', record, ts: now });
             const idx = await this.readIndex();
             idx[id] = record;
             await this.writeIndex(idx);
-            // per-project index
+            // per-project index (atomic)
             try {
                 const pp = this.perProjectIndexPath(opts.cwd);
                 let pIdx = {};
@@ -110,7 +149,7 @@ export class SessionStore {
                 }
                 catch { }
                 pIdx[id] = record;
-                await fs.writeFile(pp, JSON.stringify(pIdx, null, 2), 'utf-8');
+                await this.writePerProjectIndex(pp, pIdx);
             }
             catch { }
             return record;
@@ -136,13 +175,13 @@ export class SessionStore {
         await this.appendJsonl(forked.id, { type: 'session.fork', from: id, ts: Date.now() });
         return forked;
     }
-    /** Delete a session and all its artifacts (record, transcript, jsonl, indexes). */
+    /** Delete a session and all its artifacts (record, transcript, jsonl, lock, indexes). */
     async delete(id) {
         return this.withLock('index', async () => {
             const rec = await this.get(id);
             if (!rec)
                 return false;
-            for (const f of [`${id}.json`, `${id}.jsonl`]) {
+            for (const f of [`${id}.json`, `${id}.jsonl`, `${id}.lock`]) {
                 try {
                     await fs.unlink(path.join(this.dir, f));
                 }
@@ -156,7 +195,7 @@ export class SessionStore {
                 const raw = await fs.readFile(pp, 'utf-8');
                 const pIdx = JSON.parse(raw);
                 delete pIdx[id];
-                await fs.writeFile(pp, JSON.stringify(pIdx, null, 2), 'utf-8');
+                await this.writePerProjectIndex(pp, pIdx);
             }
             catch { /* ignore */ }
             return true;
@@ -241,14 +280,19 @@ export class SessionStore {
     async appendMessage(id, message) {
         return this.withLock(id, async () => {
             const data = await this.readSession(id);
-            data.messages.push(message);
+            data.messages.push({ ...message, content: redactStoredContent(message.content) });
             await this.writeSession(id, data);
         });
     }
     async appendObservation(id, obs) {
         return this.withLock(id, async () => {
             const data = await this.readSession(id);
-            data.observations.push(obs);
+            // S4-at-rest: redact observation input/output at the persist boundary.
+            data.observations.push({
+                ...obs,
+                input: redactStoredContent(obs.input),
+                output: redactStoredContent(obs.output),
+            });
             await this.writeSession(id, data);
         });
     }
@@ -256,9 +300,16 @@ export class SessionStore {
         return this.withLock(id, async () => {
             const data = await this.readSession(id);
             data.record.status = status;
+            // S4-at-rest: redact finalText before persisting.
             if (finalText !== undefined)
-                data.record.finalText = finalText;
+                data.record.finalText = redact(finalText);
             await this.writeSession(id, data);
+            // Terminal states release the cross-process lock (no destructor exists
+            // to do it — the session is done, so the lock is stale by definition).
+            if (status === 'complete' || status === 'aborted' || status === 'max_steps' ||
+                status === 'verify_failed' || status === 'stuck') {
+                await releaseSessionLock(this.dir, id);
+            }
         });
     }
     async loadMessages(id) {
@@ -278,9 +329,85 @@ export class SessionStore {
         const idx = await this.readIndex();
         return idx[id] ?? null;
     }
-    /** Atomic append — survives crashes; suitable for audit log. */
+    /** Atomic append + fsync — survives crashes; suitable for audit log. */
     static async appendJsonl(filePath, entry) {
         await fs.mkdir(path.dirname(filePath), { recursive: true });
-        await fs.appendFile(filePath, JSON.stringify(entry) + '\n', 'utf-8');
+        const fh = await fs.open(filePath, 'a');
+        try {
+            await fh.write(JSON.stringify(entry) + '\n');
+            await fh.sync();
+        }
+        finally {
+            await fh.close();
+        }
+    }
+}
+/**
+ * Redact text blocks of a stored message at the persist boundary.
+ * Handles string content, `{ text }` blocks, arrays of blocks, and plain
+ * objects (observation input/output) via a deep walk over string leaves.
+ * Only secret-shaped strings (key/token/password patterns, [:=-] shapes)
+ * are touched — normal prose passes through unchanged.
+ */
+export function redactStoredContent(content) {
+    if (typeof content === 'string')
+        return redact(content);
+    if (Array.isArray(content)) {
+        return content.map((b) => {
+            if (b && typeof b === 'object' && typeof b.text === 'string') {
+                return { ...b, text: redact(b.text) };
+            }
+            if (typeof b === 'string')
+                return redact(b);
+            if (b && typeof b === 'object')
+                return redactStoredContent(b);
+            return b;
+        });
+    }
+    if (content && typeof content === 'object') {
+        const rec = content;
+        if (typeof rec.text === 'string') {
+            return { ...rec, text: redact(rec.text) };
+        }
+        const out = {};
+        for (const [k, v] of Object.entries(rec)) {
+            out[k] = typeof v === 'string' ? redact(v) : (v && typeof v === 'object' ? redactStoredContent(v) : v);
+        }
+        return out;
+    }
+    return content;
+}
+/**
+ * Cross-process session lock probe. The lock file `<sessionsDir>/<id>.lock`
+ * contains the holder's PID. `alive` is resolved via `process.kill(pid, 0)`:
+ * EPERM means alive-but-unpermitted (→ true); ESRCH / other errors → false.
+ */
+export function readSessionLock(sessionsDir, id) {
+    let raw;
+    try {
+        raw = fsSync.readFileSync(path.join(sessionsDir, `${id}.lock`), 'utf-8');
+    }
+    catch {
+        return { held: false };
+    }
+    const pid = Number(raw.trim());
+    if (!Number.isInteger(pid) || pid <= 0)
+        return { held: true };
+    let alive;
+    try {
+        process.kill(pid, 0);
+        alive = true;
+    }
+    catch (err) {
+        const code = err?.code;
+        alive = code === 'EPERM';
+    }
+    return { held: true, pid, alive };
+}
+/** Best-effort release of the cross-process session lock. Never throws. */
+export async function releaseSessionLock(sessionsDir, id) {
+    try {
+        await fs.unlink(path.join(sessionsDir, `${id}.lock`));
     }
+    catch { /* ignore */ }
 }

package/dist/policy/approval.d.ts

@@ -25,6 +25,20 @@ export interface ApprovalRequest {
 export interface ApprovalPrompt {
     ask(req: ApprovalRequest): Promise<ApprovalChoice>;
 }
+/**
+ * Sanitize untrusted tool text before showing it in an approval prompt.
+ * Strips ANSI escapes (CSI `ESC[...letter` and OSC `ESC]...BEL`), control
+ * chars except `\n`/`\t`, and truncates to 500 chars with a hidden-count
+ * marker so prompt-injection / terminal-escape payloads can't ride along.
+ */
+export declare function sanitizeForPrompt(s: string): string;
+/**
+ * Single-key approval mapping shared by the TUI modal (and documented here
+ * so stdin stays consistent): lowercase `a` = session-only, UPPERCASE `A` =
+ * persist to settings. Case MUST be checked before lowercasing — the old TUI
+ * code lowercased first, so `A` silently became session-only `always`.
+ */
+export declare function approvalChoiceForKey(inputStr: string): ApprovalChoice | 'expand' | 'explain' | null;
 /** Default prompt backed by readline on stdin/stdout. */
 export declare class StdinApprovalPrompt implements ApprovalPrompt {
     ask(req: ApprovalRequest): Promise<ApprovalChoice>;

package/dist/policy/approval.js

@@ -8,6 +8,45 @@
 import * as readline from 'node:readline/promises';
 import { stdin as input, stdout as output } from 'node:process';
 import { patternForCall } from './patterns.js';
+/**
+ * Sanitize untrusted tool text before showing it in an approval prompt.
+ * Strips ANSI escapes (CSI `ESC[...letter` and OSC `ESC]...BEL`), control
+ * chars except `\n`/`\t`, and truncates to 500 chars with a hidden-count
+ * marker so prompt-injection / terminal-escape payloads can't ride along.
+ */
+export function sanitizeForPrompt(s) {
+    const noAnsi = s
+        .replace(/\x1b\[[0-9;]*[A-Za-z]/g, '')
+        .replace(/\x1b\][^\x07]*\x07/g, '');
+    const clean = noAnsi.replace(/[\x00-\x08\x0b-\x0d\x0e-\x1f\x7f]/g, '');
+    const LIMIT = 500;
+    if (clean.length > LIMIT) {
+        return clean.slice(0, LIMIT) + `…[+${clean.length - LIMIT} hidden]`;
+    }
+    return clean;
+}
+/**
+ * Single-key approval mapping shared by the TUI modal (and documented here
+ * so stdin stays consistent): lowercase `a` = session-only, UPPERCASE `A` =
+ * persist to settings. Case MUST be checked before lowercasing — the old TUI
+ * code lowercased first, so `A` silently became session-only `always`.
+ */
+export function approvalChoiceForKey(inputStr) {
+    if (inputStr === 'A')
+        return 'always-persist';
+    const c = inputStr.toLowerCase();
+    if (c === 'y')
+        return 'allow';
+    if (c === 'a')
+        return 'always';
+    if (c === 'd' || c === 'n' || c === 'e')
+        return 'deny';
+    if (c === 'f')
+        return 'expand';
+    if (c === '?')
+        return 'explain';
+    return null;
+}
 /** Default prompt backed by readline on stdin/stdout. */
 export class StdinApprovalPrompt {
     async ask(req) {
@@ -15,10 +54,13 @@ export class StdinApprovalPrompt {
             return 'deny';
         const rl = readline.createInterface({ input, output });
         try {
-            process.stdout.write(`\n[approval needed] ${req.toolName}: ${req.summary}\n  reason: ${req.reason}\n  allow? [y/n/a(llow)] `);
-            const ans = (await rl.question('')).trim().toLowerCase();
+            process.stdout.write(`\n[approval needed] ${req.toolName}: ${sanitizeForPrompt(req.summary)}\n  reason: ${sanitizeForPrompt(req.reason)}\n  allow? [y/n/a/A(llow always → settings)] (y=once, n=deny, a=session, A=persist) `);
+            const raw = (await rl.question('')).trim();
+            const ans = raw.toLowerCase();
             if (ans === 'y' || ans === 'yes')
                 return 'allow';
+            if (raw === 'A')
+                return 'always-persist';
             if (ans === 'a' || ans === 'allow')
                 return 'always';
             return 'deny';

package/dist/policy/engine.d.ts

@@ -83,6 +83,23 @@ export declare class PolicyEngine {
 }
 /** Builtin set of rules. Order matters: first match wins. */
 export declare function builtinRules(): PolicyRule[];
+export declare function matchesGlobRule(call: ToolCallLike, rule: string): boolean;
+/** Branches that `git push` must never target without an explicit opt-out. */
+export declare const PROTECTED_BRANCHES: string[];
+/** Matches `push` with a protected branch name later on the same line. */
+export declare const PROTECTED_PUSH_RE: RegExp;
+/**
+ * True when the command is a `git push` with NO ref/positional args
+ * (e.g. `git push`, `git push -f`) — i.e. it pushes whatever is checked
+ * out. `git push origin feature` is explicit, not bare.
+ */
+export declare function isBareGitPush(cmd: string): boolean;
+/**
+ * Resolve the currently checked-out branch via `git branch --show-current`.
+ * Returns null on any failure (not a repo, git missing) — callers treat
+ * null as "unknown" and allow the normal policy flow to continue.
+ */
+export declare function currentGitBranch(cwd: string): string | null;
 /** Hard-deny for obviously destructive shell patterns. */
 export declare const shellDenyRule: PolicyRule;
 /** Allowlist for shell — exact or prefix. Anything not in the list asks. */

package/dist/policy/engine.js

@@ -66,7 +66,11 @@ export class PolicyEngine {
         }
         else if (ctx.config.mode === 'plan') {
             // plan mode: block all writes (edit)
-            if (call.name === 'write_file' || call.name === 'edit_file') {
+            if (call.name === 'write_file' ||
+                call.name === 'edit_file' ||
+                call.name === 'multi_edit' ||
+                call.name === 'apply_patch' ||
+                call.name === 'memory_write') {
                 return { action: 'deny', reason: 'plan mode: writes blocked — use /permissions to allow or switch mode' };
             }
         }
@@ -80,17 +84,33 @@ export class PolicyEngine {
         const globDecision = this.evaluateGlobRules(call);
         if (globDecision)
             return globDecision;
-        // 3.4 — .env guard: deny writes to .env files unless explicitly allowed
-        if ((call.name === 'write_file' || call.name === 'edit_file') && typeof call.input.path === 'string') {
-            const p = String(call.input.path);
-            if (/(^|\/)\.env(\.|$)/.test(p) || p.endsWith('.env')) {
-                // Check if explicitly allowed via allow list
-                const allowed = (ctx.config.allow ?? []).some((r) => r.includes('.env'));
-                if (!allowed) {
+        // Centralized .env guard: any tool with a string `path` input pointing
+        // at an env file is denied unless an allow rule explicitly names that
+        // tool+path (exact/glob match — substring `.includes('.env')` is NOT enough).
+        const maybePath = typeof call.input.path === 'string' ? String(call.input.path) : null;
+        if (maybePath !== null && isEnvPath(maybePath)) {
+            const allowed = isExplicitlyAllowedForPath(call.name, maybePath, ctx.config.allow);
+            if (!allowed) {
+                return { action: 'deny', reason: 'write to .env denied by policy — add to allow list or use --yolo' };
+            }
+        }
+        // apply_patch carries paths inside the patch text, not `input.path`.
+        if (call.name === 'apply_patch' && typeof call.input.patch === 'string') {
+            const targets = extractPatchPaths(String(call.input.patch)).filter(isEnvPath);
+            if (targets.length > 0) {
+                const allAllowed = targets.every((t) => isExplicitlyAllowedForPath(call.name, t, ctx.config.allow));
+                if (!allAllowed) {
                     return { action: 'deny', reason: 'write to .env denied by policy — add to allow list or use --yolo' };
                 }
             }
         }
+        // Shell redirection into .env (e.g. `echo x > .env`, `cmd >> .env.local`).
+        if (call.name === 'shell_exec' && typeof call.input.command === 'string') {
+            const cmd = String(call.input.command);
+            if (/>+\s*['"]?[^'"\s]*\.env/i.test(cmd)) {
+                return { action: 'deny', reason: 'write to .env via shell redirection denied' };
+            }
+        }
         for (const rule of this.rules) {
             const d = rule.evaluate(call, ctx);
             if (d)
@@ -157,7 +177,32 @@ export function builtinRules() {
 function asString(v) {
     return typeof v === 'string' ? v : '';
 }
-function matchesGlobRule(call, rule) {
+function isEnvPath(p) {
+    const lower = p.toLowerCase();
+    // Sample/template carve-out: `.env.example`-style files are documentation,
+    // not secrets — reads AND writes are allowed.
+    if (/[.](example|sample|template|dist)$/.test(lower))
+        return false;
+    return /(^|\/)\.env(\.|$)/.test(lower) || lower.endsWith('.env');
+}
+function extractPatchPaths(patch) {
+    const out = [];
+    for (const line of patch.split('\n')) {
+        if (line.startsWith('*** Update File:'))
+            out.push(line.replace('*** Update File:', '').trim());
+        else if (line.startsWith('*** Add File:'))
+            out.push(line.replace('*** Add File:', '').trim());
+    }
+    return out.filter(Boolean);
+}
+/** True when an allow rule explicitly names this tool+path (exact/glob match, not substring). */
+function isExplicitlyAllowedForPath(callName, envPath, allow) {
+    if (!allow || allow.length === 0)
+        return false;
+    const synthetic = { name: callName, input: { path: envPath } };
+    return allow.some((r) => matchesGlobRule(synthetic, r));
+}
+export function matchesGlobRule(call, rule) {
     // Rule grammar: tool or tool(glob). e.g. "write_file", "write_file(.env)", "shell_exec(npm *)".
     // Digits are allowed so generated names (e.g. mcp__server__tool2) can be targeted.
     const m = /^([a-z0-9_]+)(?:\((.*)\))?$/.exec(rule.trim());
@@ -185,6 +230,48 @@ function startsWithAny(haystack, needles) {
         return h === nl || h.startsWith(nl + ' ') || h.startsWith(nl + '\t');
     });
 }
+/** Branches that `git push` must never target without an explicit opt-out. */
+export const PROTECTED_BRANCHES = ['main', 'master', 'production'];
+/** Matches `push` with a protected branch name later on the same line. */
+export const PROTECTED_PUSH_RE = /\bpush\b[^\n]*\b(main|master|production)\b/;
+const GIT_PUSH_RE = /\bgit\b[^\n]*\bpush\b/;
+/**
+ * True when the command is a `git push` with NO ref/positional args
+ * (e.g. `git push`, `git push -f`) — i.e. it pushes whatever is checked
+ * out. `git push origin feature` is explicit, not bare.
+ */
+export function isBareGitPush(cmd) {
+    if (!GIT_PUSH_RE.test(cmd))
+        return false;
+    const idx = cmd.search(/\bpush\b/);
+    const rest = idx >= 0 ? cmd.slice(idx + 4) : '';
+    const segment = (rest.split(/[;&|]/)[0] ?? '').split(/\n/)[0] ?? '';
+    const tokens = segment.match(/"[^"]*"|'[^']*'|\S+/g) ?? [];
+    const positionals = tokens.filter((t) => {
+        const unquoted = t.replace(/^["']|["']$/g, '');
+        return unquoted.length > 0 && !unquoted.startsWith('-');
+    });
+    return positionals.length === 0;
+}
+/**
+ * Resolve the currently checked-out branch via `git branch --show-current`.
+ * Returns null on any failure (not a repo, git missing) — callers treat
+ * null as "unknown" and allow the normal policy flow to continue.
+ */
+export function currentGitBranch(cwd) {
+    try {
+        const out = execFileSync('git', ['-C', cwd, 'branch', '--show-current'], {
+            timeout: 3000,
+            stdio: ['ignore', 'pipe', 'ignore'],
+            encoding: 'utf-8',
+        });
+        const branch = String(out).trim();
+        return branch.length > 0 ? branch : null;
+    }
+    catch {
+        return null;
+    }
+}
 /** Hard-deny for obviously destructive shell patterns. */
 export const shellDenyRule = {
     name: 'shell-deny',
@@ -204,6 +291,71 @@ export const shellDenyRule = {
         if (/\b(curl|wget|fetch|iwr|Invoke-WebRequest)\b.*\|\s*(sh|bash|zsh|cmd|powershell|pwsh|node|node\s+-e)\b/i.test(cmd)) {
             return { action: 'deny', reason: 'pipe-to-shell: remote download piped into an interpreter' };
         }
+        // Exfiltration denylist (mirrors shell_exec DANGEROUS_PATTERNS).
+        if (/\bcurl\b.*(?:\s-d\b|\s--data(?:-binary|-urlencode)?\b|\s--upload-file\b)/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: curl with --data/-d/--upload-file denied' };
+        }
+        if (/\bwget\b.*--post-(data|file)\b/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: wget --post-data/--post-file denied' };
+        }
+        if (/\b(powershell|pwsh)\b.*-e(nc|ncodedcommand)\b/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: powershell -enc denied' };
+        }
+        if (/\bInvoke-Expression\b/i.test(cmd) || /\biex\s*\(/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: Invoke-Expression/iex denied' };
+        }
+        if (/\bcertutil\b.*-urlcache\b/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: certutil -urlcache denied' };
+        }
+        if (/\bbitsadmin\b.*\/transfer\b/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: bitsadmin /transfer denied' };
+        }
+        // .env writes via tee / PowerShell (mirrors shell_exec DANGEROUS_PATTERNS).
+        if (/\|\s*tee\b[^\n]*\.env/i.test(cmd)) {
+            return { action: 'deny', reason: 'write to .env via tee denied' };
+        }
+        if (/\b(Set-Content|Out-File)\b[^\n]*\.env/i.test(cmd)) {
+            return { action: 'deny', reason: 'write to .env via Set-Content/Out-File denied' };
+        }
+        // Shell-redirection containment: deny `>` / `>>` into dotfiles.
+        // Home/abs dotfile target (e.g. `> ~/.klyro/mcp.json`, `> /home/u/.config/x`).
+        // The `(?<![0-9])` guard excludes the `2>` stderr-redirect prefix.
+        if (/(?<![0-9])>+\s*["']?(~|\/)[^"'\s]*\/\.[^"'\s]+/.test(cmd)) {
+            return { action: 'deny', reason: 'redirect into dotfile under home/abs path denied' };
+        }
+        // Bare project dotfile target (e.g. `> .mcp.json`, `>> .env.local`).
+        if (/(?<![0-9])>+\s*["']?\.[^"'\s\/][^"'\s]*/.test(cmd)) {
+            return { action: 'deny', reason: 'redirect into project dotfile denied' };
+        }
+        // Upload-form exfiltration (mirrors shell_exec DANGEROUS_PATTERNS).
+        if (/\bcurl\b.*(?:\s-F\b|\s--form\b)/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: curl -F/--form denied' };
+        }
+        if (/\bwget\b.*(?:\s--method=POST\b|\s--body-data\b)/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: wget --method=POST/--body-data denied' };
+        }
+        if (/\bInvoke-RestMethod\b/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: Invoke-RestMethod denied' };
+        }
+        if (/\bStart-BitsTransfer\b/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: Start-BitsTransfer denied' };
+        }
+        // Protected-branch push deny (mirrors shell_exec DANGEROUS_PATTERNS).
+        // Explicit `git push ... main|master|production` is denied outright;
+        // a bare `git push` (no ref args) is denied when the checkout is on a
+        // protected branch. Escape hatch: KLYRO_ALLOW_MAIN_PUSH=1.
+        if (process.env.KLYRO_ALLOW_MAIN_PUSH !== '1') {
+            if (PROTECTED_PUSH_RE.test(cmd)) {
+                return { action: 'deny', reason: 'protected-branch push denied (main/master/production) — set KLYRO_ALLOW_MAIN_PUSH=1 to override' };
+            }
+            if (isBareGitPush(cmd)) {
+                const branch = currentGitBranch(ctx.cwd);
+                if (branch !== null && PROTECTED_BRANCHES.includes(branch)) {
+                    return { action: 'deny', reason: `bare git push on protected branch '${branch}' denied — set KLYRO_ALLOW_MAIN_PUSH=1 to override` };
+                }
+                // currentGitBranch null (not a repo / git missing) → allow normal flow.
+            }
+        }
         return null;
     },
 };
@@ -303,4 +455,5 @@ export async function evaluatePolicy(engine, call, ctx) {
 //  policy/ depending only on tools/normalize, no other tool code.)
 import * as path from 'node:path';
 import * as fsSync from 'node:fs';
+import { execFileSync } from 'node:child_process';
 import { resolveWithinCwd } from './path-guard.js';

package/dist/policy/path-guard.d.ts

@@ -28,3 +28,27 @@ export declare function resolveWithinCwd(cwd: string, requested: string): PathGu
  * Use this for read_file / write_file to defeat symlink-based escapes.
  */
 export declare function resolveAndFollowSymlinks(cwd: string, requested: string): Promise<PathGuardResult>;
+/**
+ * Symlink-swap guard: refuse when the FINAL path itself is a symlink.
+ *
+ * File tools resolve symlinks up front, but a racing swap between that
+ * check and the final write/rename could redirect an open-with-O_TRUNC /
+ * O_CREAT (or rename) through a freshly-planted symlink. Calling this
+ * immediately before the final write/rename shrinks that window to ~0:
+ * `lstat` never follows the final component, so a swapped-in link is
+ * caught. (POSIX `rename(2)` onto a symlink replaces the LINK itself, so
+ * the vulnerable op is opening/truncating through the link — which this
+ * denies first.) Supported on POSIX and Windows (both implement lstat).
+ * Missing paths (ENOENT) are fine — a nonexistent path is not a symlink.
+ */
+export declare function assertNotSymlink(p: string): Promise<void>;
+/**
+ * Open a file for writing without following a trailing symlink (POSIX).
+ *
+ * Uses O_WRONLY | O_CREAT | O_NOFOLLOW so the open itself fails (ELOOP)
+ * when the final component is a symlink, instead of truncating through
+ * it. On Windows there is no O_NOFOLLOW, so this falls back to a plain
+ * `'w'` open — symlink-swap protection there comes from
+ * `assertNotSymlink` (lstat) immediately before the write/rename instead.
+ */
+export declare function openNoFollowForWrite(dir: string, file: string): number;