klyro 1.0.0 → 1.0.2

package/dist/tools/shell/shell-exec.js

@@ -8,12 +8,14 @@
  *   - Non-zero exit is returned as a successful tool call (with exitCode in
  *     the output). The agent reads exitCode to decide what to do next.
  */
-import { spawn, spawnSync } from 'node:child_process';
+import { spawn, spawnSync, execFileSync } from 'node:child_process';
 import * as os from 'node:os';
 import * as path from 'node:path';
+import * as fsp from 'node:fs/promises';
 import { z } from 'zod';
 import { defineTool } from '../types.js';
 import { resolveWithinCwd } from '../../policy/path-guard.js';
+import { sandboxCommand, detectSandbox } from './sandbox.js';
 import { safe, TOOL_ERROR_CODES } from '../normalize.js';
 const InputSchema = z.object({
     command: z.string().min(1).describe('Shell command to execute (interpreted by /bin/sh -c on Unix, cmd.exe /c on Windows)'),
@@ -41,7 +43,7 @@ export function resetPersistentCwd() {
 }
 // Filtered env — only safe vars, secrets stripped
 const ALLOWED_ENV_PREFIXES = ['PATH', 'HOME', 'USER', 'SHELL', 'TERM', 'LANG', 'NODE_', 'NPM_', 'PNPM_', 'YARN_'];
-function filteredEnv(extra) {
+export function filteredEnv(extra) {
     const out = {};
     for (const [k, v] of Object.entries(process.env)) {
         if (k.startsWith('KLYRO_') && k.includes('API_KEY'))
@@ -71,6 +73,15 @@ function filteredEnv(extra) {
 }
 // Interactive command detection (3.3)
 const INTERACTIVE_PATTERNS = [/^\s*vim\b/, /^\s*nano\b/, /^\s*htop\b/, /^\s*less\b/, /^\s*more\b/, /^\s*ssh\b/, /^\s*tmux\b/];
+/**
+ * Protected-branch push helpers (mirror policy engine shellDenyRule).
+ * `git push` targeting main/master/production is denied outright; a bare
+ * `git push` (no ref args) is denied when the checkout sits on a protected
+ * branch. Escape hatch: KLYRO_ALLOW_MAIN_PUSH=1.
+ */
+export const PROTECTED_BRANCHES = ['main', 'master', 'production'];
+export const PROTECTED_PUSH_RE = /\bpush\b[^\n]*\b(main|master|production)\b/;
+const GIT_PUSH_RE = /\bgit\b[^\n]*\bpush\b/;
 // Hard-coded dangerous patterns. These are non-overridable, configurable via --yolo only.
 const DANGEROUS_PATTERNS = [
     { pattern: /rm\s+-rf?\s+\//, reason: 'recursive delete at filesystem root' },
@@ -99,7 +110,97 @@ const DANGEROUS_PATTERNS = [
     { pattern: /;\s*rm\s+-rf/, reason: 'chained rm -rf' },
     { pattern: /&&\s*rm\s+-rf/, reason: 'chained rm -rf' },
     { pattern: /\|\|\s*rm\s+-rf/, reason: 'chained rm -rf' },
+    // Exfiltration denylist (mirrors policy engine shellDenyRule).
+    { pattern: /\bcurl\b.*(?:\s-d\b|\s--data(?:-binary|-urlencode)?\b|\s--upload-file\b)/i, reason: 'exfiltration: curl with --data/-d/--upload-file denied' },
+    { pattern: /\bwget\b.*--post-(data|file)\b/i, reason: 'exfiltration: wget --post-data/--post-file denied' },
+    { pattern: /\b(powershell|pwsh)\b.*-e(nc|ncodedcommand)\b/i, reason: 'exfiltration: powershell -enc denied' },
+    { pattern: /\bInvoke-Expression\b/i, reason: 'exfiltration: Invoke-Expression denied' },
+    { pattern: /\biex\s*\(/i, reason: 'exfiltration: iex( denied' },
+    { pattern: /\bcertutil\b.*-urlcache\b/i, reason: 'exfiltration: certutil -urlcache denied' },
+    { pattern: /\bbitsadmin\b.*\/transfer\b/i, reason: 'exfiltration: bitsadmin /transfer denied' },
+    // .env writes via tee / PowerShell (mirrors policy engine .env guard).
+    { pattern: /\|\s*tee\b[^\n]*\.env/i, reason: 'write to .env via tee denied' },
+    { pattern: /\b(Set-Content|Out-File)\b[^\n]*\.env/i, reason: 'write to .env via Set-Content/Out-File denied' },
+    // Shell-redirection containment (mirrors policy engine shellDenyRule):
+    // deny `>` / `>>` into dotfiles under home/abs paths or bare project
+    // dotfiles. `(?<![0-9])` excludes the `2>` stderr-redirect prefix.
+    { pattern: /(?<![0-9])>+\s*["']?(~|\/)[^"'\s]*\/\.[^"'\s]+/, reason: 'redirect into dotfile under home/abs path denied' },
+    { pattern: /(?<![0-9])>+\s*["']?\.[^"'\s\/][^"'\s]*/, reason: 'redirect into project dotfile denied' },
+    // Upload-form exfiltration (mirrors policy engine shellDenyRule).
+    { pattern: /\bcurl\b.*(?:\s-F\b|\s--form\b)/i, reason: 'exfiltration: curl -F/--form denied' },
+    { pattern: /\bwget\b.*(?:\s--method=POST\b|\s--body-data\b)/i, reason: 'exfiltration: wget --method=POST/--body-data denied' },
+    { pattern: /\bInvoke-RestMethod\b/i, reason: 'exfiltration: Invoke-RestMethod denied' },
+    { pattern: /\bStart-BitsTransfer\b/i, reason: 'exfiltration: Start-BitsTransfer denied' },
+    // Protected-branch push deny (mirrors policy engine shellDenyRule).
+    // Explicit `git push ... main|master|production`. Honored only when
+    // KLYRO_ALLOW_MAIN_PUSH=1 is NOT set (see findBlockedReason). Bare
+    // `git push` on a protected checkout is handled in execute() with cwd.
+    { pattern: PROTECTED_PUSH_RE, reason: 'protected-branch push denied (main/master/production) — set KLYRO_ALLOW_MAIN_PUSH=1 to override' },
 ];
+/**
+ * True when KLYRO_ALLOW_MAIN_PUSH=1 opts out of the protected-push deny. */
+export function isMainPushEscape() {
+    return process.env.KLYRO_ALLOW_MAIN_PUSH === '1';
+}
+/**
+ * True when the command is a `git push` with NO ref/positional args
+ * (e.g. `git push`, `git push -f`) — i.e. it pushes whatever is checked
+ * out. `git push origin feature` is explicit, not bare.
+ */
+export function isBareGitPush(cmd) {
+    if (!GIT_PUSH_RE.test(cmd))
+        return false;
+    const idx = cmd.search(/\bpush\b/);
+    const rest = idx >= 0 ? cmd.slice(idx + 4) : '';
+    const segment = (rest.split(/[;&|]/)[0] ?? '').split(/\n/)[0] ?? '';
+    const tokens = segment.match(/"[^"]*"|'[^']*'|\S+/g) ?? [];
+    const positionals = tokens.filter((t) => {
+        const unquoted = t.replace(/^["']|["']$/g, '');
+        return unquoted.length > 0 && !unquoted.startsWith('-');
+    });
+    return positionals.length === 0;
+}
+/**
+ * Resolve the currently checked-out branch via `git branch --show-current`.
+ * Returns null on any failure (not a repo, git missing) — callers treat
+ * null as "unknown" and allow the normal flow to continue.
+ */
+export function currentGitBranch(cwd) {
+    try {
+        const out = execFileSync('git', ['-C', cwd, 'branch', '--show-current'], {
+            timeout: 3000,
+            stdio: ['ignore', 'pipe', 'ignore'],
+            encoding: 'utf-8',
+        });
+        const branch = String(out).trim();
+        return branch.length > 0 ? branch : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Bare-push check with cwd: deny `git push` with no ref args when the
+ * checkout is on a protected branch. Returns the block reason or null.
+ */
+export function findBareProtectedPushReason(command, cwd) {
+    if (isMainPushEscape())
+        return null;
+    if (!isBareGitPush(command))
+        return null;
+    const branch = currentGitBranch(cwd);
+    if (branch !== null && PROTECTED_BRANCHES.includes(branch)) {
+        return `bare git push on protected branch '${branch}' — set KLYRO_ALLOW_MAIN_PUSH=1 to override`;
+    }
+    return null;
+}
+/**
+ * Repair-guard mirror: heredoc/redirect writes to test paths, or test-path
+ * rewrites via sed/python/perl/ruby/node/git (e.g. `> x.test.ts`,
+ * `<<EOF > x.test.ts`, `sed -i`, `git apply`). Only enforced when
+ * `ctx.repairGuard?.denyTestEdits` is set.
+ */
+const REPAIR_GUARD_SHELL_RE = />+\s*['"]?[^'"\s]*test[^'"\s]*|\b(sed|python|perl|ruby|node|git)\b[^\n]*test[^'"\s]*/i;
 /**
  * Shared dangerous-command check (also used by background shells).
  * Returns the block reason, or null when the command is not hard-blocked.
@@ -108,11 +209,23 @@ const DANGEROUS_PATTERNS = [
  */
 export function findBlockedReason(command) {
     for (const { pattern, reason } of DANGEROUS_PATTERNS) {
+        // Protected-push entry honors the KLYRO_ALLOW_MAIN_PUSH=1 escape hatch.
+        if (pattern === PROTECTED_PUSH_RE && isMainPushEscape())
+            continue;
         if (pattern.test(command))
             return reason;
     }
     return null;
 }
+/** Resolve symlinks on both base and target, then enforce containment. */
+async function realContainedCwd(ctxCwd, resolved) {
+    const realBase = await fsp.realpath(ctxCwd).catch(() => path.resolve(ctxCwd));
+    const realTarget = await fsp.realpath(resolved).catch(() => resolved);
+    const rel = path.relative(realBase, realTarget);
+    if (rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel)))
+        return realTarget;
+    throw Object.assign(new Error(`Path escapes cwd via symlink: ${resolved}`), { code: TOOL_ERROR_CODES.PATH_ESCAPE });
+}
 export const shellExecTool = defineTool({
     name: 'shell_exec',
     description: 'Execute a shell command. Default timeout 120s (max 600s). Output head+tail 30k chars, full to ~/.klyro/tool-output/<id>.txt. Persistent cwd, filtered env, tree-kill on timeout.',
@@ -123,6 +236,10 @@ export const shellExecTool = defineTool({
     renderResult: (output) => `exit ${output.exitCode} (${output.durationMs}ms${output.timedOut ? ' timedOut' : ''})`,
     execute: async (input, ctx) => {
         return safe(async () => {
+            // Repair-guard mirror (denyTestEdits): refuse shell writes to test paths.
+            if (ctx.repairGuard?.denyTestEdits && REPAIR_GUARD_SHELL_RE.test(input.command)) {
+                throw Object.assign(new Error('repair-guard: test edits via shell denied (denyTestEdits)'), { code: 'POLICY_DENIED' });
+            }
             // Interactive detection
             for (const pat of INTERACTIVE_PATTERNS) {
                 if (pat.test(input.command)) {
@@ -137,6 +254,9 @@ export const shellExecTool = defineTool({
             let cwd = persistentCwd ?? ctx.cwd;
             if (input.cwd) {
                 cwd = resolveWithinCwd(ctx.cwd, input.cwd).resolved;
+                // Resolve symlinks for the effective cwd before the containment
+                // check, so a symlinked subdir can't escape the workspace.
+                cwd = await realContainedCwd(ctx.cwd, cwd);
                 persistentCwd = cwd;
             }
             else if (input.command.trim().startsWith('cd ')) {
@@ -145,25 +265,63 @@ export const shellExecTool = defineTool({
                     try {
                         const target = m[1].replace(/^["']|["']$/g, '');
                         const resolved = resolveWithinCwd(cwd, target).resolved;
-                        persistentCwd = resolved;
+                        persistentCwd = await realContainedCwd(ctx.cwd, resolved);
                     }
                     catch { /* ignore */ }
                 }
             }
+            else {
+                // Even without an explicit cwd, normalize symlinks on the
+                // effective cwd so containment holds when ctx.cwd is symlinked.
+                try {
+                    cwd = await realContainedCwd(ctx.cwd, cwd);
+                }
+                catch {
+                    throw Object.assign(new Error(`Working directory escapes workspace (POLICY_DENIED)`), { code: TOOL_ERROR_CODES.PATH_ESCAPE });
+                }
+            }
             const timeoutMs = Math.min(input.timeoutMs ?? DEFAULT_TIMEOUT_MS, MAX_TIMEOUT_MS);
             const env = filteredEnv(input.env);
             const start = Date.now();
+            // Protected-branch bare push: `git push` with no ref args while the
+            // effective checkout sits on main/master/production. Explicit
+            // `push ... main` was already denied by findBlockedReason above.
+            const barePushReason = findBareProtectedPushReason(input.command, cwd);
+            if (barePushReason) {
+                throw Object.assign(new Error(`Command blocked: ${barePushReason}`), { code: TOOL_ERROR_CODES.COMMAND_DENIED });
+            }
             // Detached on POSIX so timeout kills the whole process GROUP
             // (child.kill alone orphans grandchildren holding the pipes).
-            const child = spawn(input.command, {
-                cwd,
-                env: env,
-                shell: true,
-                stdio: ['ignore', 'pipe', 'pipe'],
-                windowsHide: true,
-                signal: ctx.signal,
-                detached: process.platform !== 'win32',
-            });
+            // G1-2 — sandbox is ON BY DEFAULT whenever a backend is available
+            // (bwrap, Linux). Explicit opt-out with KLYRO_SANDBOX=0. Sandboxed calls
+            // are OFFLINE by default; KLYRO_SANDBOX_NET=1 re-enables the network.
+            const sandboxBackend = detectSandbox();
+            const useSandbox = sandboxBackend.active && process.env.KLYRO_SANDBOX !== '0';
+            const sandboxWrap = useSandbox
+                ? sandboxCommand('/bin/sh', ['-c', input.command], {
+                    cwd,
+                    allowNetwork: process.env.KLYRO_SANDBOX_NET === '1',
+                })
+                : undefined;
+            const child = sandboxWrap
+                ? spawn(sandboxWrap.cmd, sandboxWrap.args, {
+                    cwd,
+                    env: env,
+                    stdio: ['ignore', 'pipe', 'pipe'],
+                    windowsHide: true,
+                    signal: ctx.signal,
+                    detached: process.platform !== 'win32',
+                    shell: false,
+                })
+                : spawn(input.command, {
+                    cwd,
+                    env: env,
+                    shell: true,
+                    stdio: ['ignore', 'pipe', 'pipe'],
+                    windowsHide: true,
+                    signal: ctx.signal,
+                    detached: process.platform !== 'win32',
+                });
             const stdoutChunks = [];
             const stderrChunks = [];
             const fullStdout = [];

package/dist/tools/shell/worker-entry.d.ts

@@ -0,0 +1,12 @@
+/**
+ * G2 — Worker entry point for subprocess isolation.
+ *
+ * When the OS sandbox (bwrap) is unavailable (Windows, no-bwrap Linux),
+ * shell_exec routes its command through this worker so a crash/OOM in the
+ * child cannot take down the parent harness.
+ *
+ * Protocol: single JSON arg on argv[2] -> single JSON line on stdout.
+ * Input:  { cmd: string; args: string[]; cwd: string; env?: Record<string,string> }
+ * Output: { status: number|null; signal: string|null; stdout: string; stderr: string }
+ */
+export {};

package/dist/tools/shell/worker-entry.js

@@ -0,0 +1,43 @@
+/**
+ * G2 — Worker entry point for subprocess isolation.
+ *
+ * When the OS sandbox (bwrap) is unavailable (Windows, no-bwrap Linux),
+ * shell_exec routes its command through this worker so a crash/OOM in the
+ * child cannot take down the parent harness.
+ *
+ * Protocol: single JSON arg on argv[2] -> single JSON line on stdout.
+ * Input:  { cmd: string; args: string[]; cwd: string; env?: Record<string,string> }
+ * Output: { status: number|null; signal: string|null; stdout: string; stderr: string }
+ */
+import { spawnSync } from 'node:child_process';
+import { filteredEnv } from './shell-exec.js';
+function main() {
+    const raw = process.argv[2];
+    if (!raw) {
+        process.stderr.write('worker-entry: missing payload\n');
+        process.exit(2);
+    }
+    let payload;
+    try {
+        payload = JSON.parse(raw);
+    }
+    catch (e) {
+        process.stderr.write(`worker-entry: bad JSON: ${e}\n`);
+        process.exit(2);
+    }
+    const { cmd, args, cwd, env } = payload;
+    const child = spawnSync(cmd, args, {
+        cwd,
+        env: filteredEnv(env),
+        shell: false,
+        windowsHide: true,
+    });
+    const out = {
+        status: child.status,
+        signal: child.signal,
+        stdout: child.stdout ? Buffer.from(child.stdout).toString('base64') : '',
+        stderr: child.stderr ? Buffer.from(child.stderr).toString('base64') : '',
+    };
+    process.stdout.write(JSON.stringify(out));
+}
+main();

package/dist/tools/types.d.ts

@@ -60,6 +60,12 @@ export interface ToolContext {
     agentAllowedTools?: ReadonlySet<string> | null;
     /** Model override active for the current agent. */
     agentModel?: string;
+    /** Repair-guard: when denyTestEdits is true, tools must refuse test-file edits. */
+    repairGuard?: {
+        denyTestEdits: boolean;
+    };
+    /** Allowed target paths for this agent. When present, file tools deny targets outside it. */
+    agentAllowedPaths?: readonly string[];
 }
 /**
  * A typed tool definition. TInput is the validated input shape; TOutput is

package/dist/tools/verify/run-verify.js

@@ -10,6 +10,7 @@ import { spawn, spawnSync } from 'node:child_process';
 import { z } from 'zod';
 import { defineTool } from '../types.js';
 import { safe, TOOL_ERROR_CODES } from '../normalize.js';
+import { filteredVerifyEnv } from '../../verification/registry.js';
 const InputSchema = z.object({
     command: z.string().min(1).describe('Verification command, e.g. "npm test" or "tsc --noEmit"'),
     cwd: z.string().optional(),
@@ -25,7 +26,8 @@ export const runVerifyTool = defineTool({
         return safe(async () => {
             const cwd = input.cwd ?? ctx.cwd;
             const timeoutMs = input.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-            const env = process.env;
+            // S2: verify commands run with filtered env; servers needing keys must use explicit config.
+            const env = filteredVerifyEnv();
             const start = Date.now();
             const child = spawn(input.command, {
                 cwd,

package/dist/trace/writer.d.ts

@@ -1,12 +1,32 @@
 /**
  * 3.1 — TraceWriter (JSONL, fsync on tool results)
+ *
+ * Durability: appends serialize through a promise-chain queue (concurrent
+ * writes stay line-valid), each line carries a per-file `seq` number, and
+ * the serialized line is passed through redact() before it hits disk so
+ * secrets never land in the trace. readAll skips corrupt lines instead of
+ * discarding the whole trace.
+ *
+ * Trace-dir rationale (PRD divergence): the PRD places traces at
+ * `~/.klyro/projects/<hash>/traces/<session>.jsonl` (global store), but this
+ * writer defaults to `<cwd>/.klyro/traces/<session>.jsonl` (project-local)
+ * so traces travel with the working tree — inspectable offline, backed up
+ * with the repo, and resolvable without a global-project-hash lookup. The
+ * `dir` ctor param preserves the PRD path for callers that want it.
  */
 import type { KlyroEvent } from '../events/catalog.js';
 export declare class TraceWriter {
     private filePath;
+    /** Serializes appends; concurrent write() calls stay line-valid. */
+    private queue;
+    private nextSeq;
+    private seqPrimed;
     constructor(sessionId: string, dir?: string);
     init(): Promise<void>;
+    /** Prime the seq counter from existing lines (so restarts don't reuse seqs). */
+    private primeSeq;
     write(ev: KlyroEvent): Promise<void>;
+    private appendOne;
     close(): Promise<void>;
     get path(): string;
     readAll(): Promise<KlyroEvent[]>;

package/dist/trace/writer.js

@@ -1,10 +1,28 @@
 /**
  * 3.1 — TraceWriter (JSONL, fsync on tool results)
+ *
+ * Durability: appends serialize through a promise-chain queue (concurrent
+ * writes stay line-valid), each line carries a per-file `seq` number, and
+ * the serialized line is passed through redact() before it hits disk so
+ * secrets never land in the trace. readAll skips corrupt lines instead of
+ * discarding the whole trace.
+ *
+ * Trace-dir rationale (PRD divergence): the PRD places traces at
+ * `~/.klyro/projects/<hash>/traces/<session>.jsonl` (global store), but this
+ * writer defaults to `<cwd>/.klyro/traces/<session>.jsonl` (project-local)
+ * so traces travel with the working tree — inspectable offline, backed up
+ * with the repo, and resolvable without a global-project-hash lookup. The
+ * `dir` ctor param preserves the PRD path for callers that want it.
  */
 import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
+import { redact } from '../policy/secret-redactor.js';
 export class TraceWriter {
     filePath;
+    /** Serializes appends; concurrent write() calls stay line-valid. */
+    queue = Promise.resolve();
+    nextSeq = 0;
+    seqPrimed = false;
     constructor(sessionId, dir) {
         const base = dir ?? path.join(process.cwd(), '.klyro', 'traces');
         this.filePath = path.join(base, `${sessionId}.jsonl`);
@@ -17,8 +35,36 @@ export class TraceWriter {
         }
         catch { /* ignore */ }
     }
+    /** Prime the seq counter from existing lines (so restarts don't reuse seqs). */
+    async primeSeq() {
+        if (this.seqPrimed)
+            return;
+        this.seqPrimed = true;
+        try {
+            const raw = await fs.readFile(this.filePath, 'utf-8');
+            for (const line of raw.split('\n')) {
+                if (!line.trim())
+                    continue;
+                try {
+                    const parsed = JSON.parse(line);
+                    if (typeof parsed.seq === 'number' && parsed.seq >= this.nextSeq) {
+                        this.nextSeq = parsed.seq + 1;
+                    }
+                }
+                catch { /* corrupt line — ignored, readAll skips it too */ }
+            }
+        }
+        catch { /* missing file — seq starts at 0 */ }
+    }
     async write(ev) {
-        const line = JSON.stringify(ev) + '\n';
+        const task = this.queue.then(() => this.appendOne(ev));
+        // Keep the queue alive across failures; the caller still sees its error.
+        this.queue = task.catch(() => undefined);
+        return task;
+    }
+    async appendOne(ev) {
+        await this.primeSeq();
+        const line = redact(JSON.stringify({ ...ev, seq: this.nextSeq++ })) + '\n';
         await fs.appendFile(this.filePath, line, 'utf-8');
         // fsync on tool results for crash safety
         if (ev.type === 'tool.result') {
@@ -35,16 +81,28 @@ export class TraceWriter {
         }
     }
     async close() {
-        // No persistent handle to close
+        // Drain the queue — no persistent handle to close.
+        await this.queue;
     }
     get path() {
         return this.filePath;
     }
-    // For tests: read back
+    // For tests: read back (skips unparseable lines, never discards the trace).
     async readAll() {
         try {
             const raw = await fs.readFile(this.filePath, 'utf-8');
-            return raw.split('\n').filter(Boolean).map((l) => JSON.parse(l));
+            const out = [];
+            for (const line of raw.split('\n')) {
+                if (!line.trim())
+                    continue;
+                try {
+                    out.push(JSON.parse(line));
+                }
+                catch {
+                    continue; // corrupt line skipped
+                }
+            }
+            return out;
         }
         catch {
             return [];

package/dist/tui/app.js

@@ -158,7 +158,7 @@ function useChatScroll(opts) {
     }), [dispatch]);
     const resolved = resolveTopRow(state, ctx);
     const maxTop = maxTopFor(ctx);
-    const pinned = state.anchor.mode === 'pinned' && !resolved.atBottom;
+    const pinned = state.anchor.mode === 'pinned' && (!resolved.atBottom || maxTop === 0);
     return {
         topRow: resolved.topRow,
         atBottom: resolved.atBottom,

package/dist/tui/approval.js

@@ -21,6 +21,7 @@ import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
  */
 import { useEffect, useState } from 'react';
 import { Box, Text, useInput } from 'ink';
+import { approvalChoiceForKey, sanitizeForPrompt } from '../policy/approval.js';
 class TuiApprovalBridge {
     pending = null;
     // Fan-out set: BOTH the App (awaitingApproval gate) and the ApprovalModal
@@ -72,41 +73,39 @@ export function ApprovalModal({ bridge }) {
         return bridge.subscribe((p) => setPending(p?.req ?? null));
     }, [bridge]);
     const [explain, setExplain] = useState(false);
+    const [full, setFull] = useState(false);
     useInput((inputStr, key) => {
         if (!pending)
             return;
-        const c = inputStr.toLowerCase();
-        if (c === 'y') {
-            bridge.resolve('allow');
-            return;
-        }
-        if (c === 'a') {
-            bridge.resolve('always');
-            return;
-        }
-        if (c === 'A') {
-            bridge.resolve('always-persist');
-            return;
-        }
-        if (c === 'd' || c === 'n') {
+        if (key.return) {
             bridge.resolve('deny');
             return;
         }
-        if (c === 'e') {
-            // Edit: for MVP, treat as deny with edit hint — model will be told to re-read and retry
-            bridge.resolve('deny');
+        // Case-sensitive mapping lives in approvalChoiceForKey: 'A' persists,
+        // 'a' is session-only (the old inline toLowerCase-first code collapsed
+        // them, silently downgrading persistence).
+        const action = approvalChoiceForKey(inputStr);
+        if (action === 'expand') {
+            setFull((v) => !v);
             return;
         }
-        if (c === '?') {
+        if (action === 'explain') {
             setExplain((v) => !v);
             return;
         }
-        if (key.return) {
-            bridge.resolve('deny');
+        if (action === 'allow' || action === 'always' || action === 'always-persist' || action === 'deny') {
+            bridge.resolve(action);
             return;
         }
     });
     if (!pending)
         return null;
-    return (_jsxs(Box, { flexDirection: "column", borderStyle: "double", borderColor: "yellow", paddingX: 1, marginY: 1, children: [_jsxs(Text, { color: "yellow", bold: true, children: ["\u26A0 approval needed \u2014 ", pending.toolName] }), _jsxs(Text, { color: "gray", children: ["  reason: ", pending.reason] }), pending.summary ? _jsxs(Text, { children: ["  ", pending.summary] }) : null, explain ? _jsxs(Text, { color: "cyan", children: ["  Explain: This tool will ", pending.toolName, " with the shown args. [y] once, [a] session, [A] always\u2192settings, [n] deny, [e] edit, [?] toggle help."] }) : null, _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: "green", children: "[y] once" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "green", children: "[a] session" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "green", children: "[A] always" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "red", children: "[n] deny" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "yellow", children: "[e] edit" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "cyan", children: "[?] explain" }), _jsx(Text, { color: "gray", children: "  (Enter = deny)" })] })] }));
+    // Sanitized display (ANSI/control-strip + 500-char cap inside
+    // sanitizeForPrompt), then the 300-char TUI truncation on top. [f] toggles
+    // the full sanitized text.
+    const trunc = (s, n = 300) => {
+        const clean = sanitizeForPrompt(s);
+        return !full && clean.length > n ? clean.slice(0, n) + '…' : clean;
+    };
+    return (_jsxs(Box, { flexDirection: "column", borderStyle: "double", borderColor: "yellow", paddingX: 1, marginY: 1, children: [_jsxs(Text, { color: "yellow", bold: true, children: ["\u26A0 approval needed \u2014 ", pending.toolName] }), _jsxs(Text, { color: "gray", children: ["  reason: \"", trunc(pending.reason), "\""] }), pending.summary ? _jsxs(Text, { children: ["  \"", trunc(pending.summary), "\""] }) : null, explain ? _jsxs(Text, { color: "cyan", children: ["  Explain: This tool will ", pending.toolName, " with the shown args. [y] once, [a] session, [A] always\u2192settings, [n] deny, [e] edit, [f] full text, [?] toggle help."] }) : null, _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: "green", children: "[y] once" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "green", children: "[a] session" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "green", children: "[A] always" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "red", children: "[n] deny" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "yellow", children: "[e] edit" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "cyan", children: "[f] full" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "cyan", children: "[?] explain" }), _jsx(Text, { color: "gray", children: "  (Enter = deny)" })] })] }));
 }

package/dist/util.d.ts

@@ -0,0 +1 @@
+export declare const x = 1;

package/dist/util.js

@@ -0,0 +1 @@
+export const x = 1;

package/dist/verification/baseline.js

@@ -7,10 +7,11 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
-import { primaryVerifyCommand } from './registry.js';
+import { primaryVerifyCommand, filteredVerifyEnv } from './registry.js';
 async function gitHead(cwd) {
     return new Promise((resolve) => {
-        const child = spawn('git', ['rev-parse', 'HEAD'], { cwd, shell: false });
+        // S2: verify commands run with filtered env; servers needing keys must use explicit config.
+        const child = spawn('git', ['rev-parse', 'HEAD'], { cwd, shell: false, env: filteredVerifyEnv() });
         let out = '';
         child.stdout.on('data', (b) => { out += b.toString(); });
         child.on('close', () => resolve(out.trim() || 'no-head'));
@@ -60,6 +61,18 @@ export async function runBaseline(cwd, command, timeoutMs = 90_000) {
         fs.mkdirSync(path.dirname(p), { recursive: true });
         const tmp = `${p}.tmp-${crypto.randomBytes(4).toString('hex')}`;
         fs.writeFileSync(tmp, JSON.stringify(baseline, null, 2));
+        // N5: fsync before rename — mirrors the persistence/store.ts writeIndex
+        // idiom (write → fsync → rename) so a crash can't lose the baseline.
+        try {
+            const fh = fs.openSync(tmp, 'r');
+            try {
+                fs.fsyncSync(fh);
+            }
+            finally {
+                fs.closeSync(fh);
+            }
+        }
+        catch { /* ignore on Windows */ }
         fs.renameSync(tmp, p);
     }
     catch { /* ignore */ }
@@ -68,7 +81,8 @@ export async function runBaseline(cwd, command, timeoutMs = 90_000) {
 const MAX_BASELINE_BYTES = 256 * 1024;
 function runCmd(cwd, command, timeoutMs) {
     return new Promise((resolve) => {
-        const child = spawn(command, { cwd, shell: true, env: process.env });
+        // S2: verify commands run with filtered env; servers needing keys must use explicit config.
+        const child = spawn(command, { cwd, shell: true, env: filteredVerifyEnv() });
         const outChunks = [];
         const errChunks = [];
         let done = false;