klyro 1.0.0 → 1.0.2

package/dist/verification/classify.js

@@ -4,6 +4,15 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { spawn } from 'node:child_process';
+import { filteredVerifyEnv } from './registry.js';
+import { detect } from './detect.js';
+function signatureOf(failure, fallbackExit) {
+    return {
+        type: failure?.type ?? 'unknown',
+        files: new Set((failure?.files ?? []).map((f) => f.path).filter(Boolean)),
+        exit: failure?.exitCode ?? fallbackExit,
+    };
+}
 export function classifyFailure(current, baseline, flakyRerunOk) {
     const combined = (current.stderr + '\n' + current.stdout).toLowerCase();
     // env: missing binary, network, permission, no such file, EACCES etc
@@ -18,26 +27,29 @@ export function classifyFailure(current, baseline, flakyRerunOk) {
     if (flakyRerunOk)
         return 'flaky';
     if (baseline && !baseline.ok) {
-        const baseRaw = (baseline.stderr + '\n' + baseline.stdout);
-        // if current failure files overlap baseline failure raw, treat as pre-existing
-        if (current.failure && baseline.stdout + baseline.stderr) {
-            const curPaths = new Set(current.failure.files.map((f) => f.path).filter(Boolean));
-            const baseContains = [...curPaths].some((p) => baseRaw.includes(p));
-            if (baseContains)
-                return 'pre_existing';
-            // also if same exit code and type, likely pre-existing
-            if (baseRaw.includes(current.failure.files[0]?.message ?? '') && baseRaw.length > 0)
+        // Structured signature compare (no substring matching): pre-existing
+        // iff same failure type AND file-set overlap is non-empty (or same
+        // exit + same type when both sides are fileless).
+        const curSig = signatureOf(current.failure, -1);
+        const baseFailure = detect(baseline.stdout, baseline.stderr, baseline.exitCode);
+        const baseSig = signatureOf(baseFailure, baseline.exitCode);
+        if (curSig.type !== 'unknown' && curSig.type === baseSig.type) {
+            if (curSig.files.size > 0 && baseSig.files.size > 0) {
+                for (const f of curSig.files) {
+                    if (baseSig.files.has(f))
+                        return 'pre_existing';
+                }
+            }
+            else if (curSig.files.size === 0 && baseSig.files.size === 0 && curSig.exit === baseSig.exit) {
                 return 'pre_existing';
+            }
         }
-        // if baseline failed and current also fails with similar raw length, assume pre-existing
-        if (current.failure && baseline.stderr.length > 0 && combined.includes(baseline.stderr.slice(0, 200).toLowerCase()))
-            return 'pre_existing';
     }
     return 'introduced';
 }
 export async function rerunOnce(cwd, command, timeoutMs = 45_000) {
     return new Promise((resolve) => {
-        const child = spawn(command, { cwd, shell: true, env: process.env });
+        const child = spawn(command, { cwd, shell: true, env: filteredVerifyEnv() });
         let done = false;
         const t = setTimeout(() => { if (!done) {
             done = true;
@@ -81,7 +93,7 @@ export async function gatherRepairContext(cwd, failure) {
 }
 function execCapturePipe(cwd, cmd) {
     return new Promise((resolve) => {
-        const child = spawn(cmd, { cwd, shell: true, env: process.env });
+        const child = spawn(cmd, { cwd, shell: true, env: filteredVerifyEnv() });
         const chunks = [];
         child.stdout.on('data', (b) => { chunks.push(b); });
         child.stderr.on('data', (b) => { chunks.push(b); });
@@ -91,7 +103,7 @@ function execCapturePipe(cwd, cmd) {
 }
 function execCaptureArgv(cwd, file, args) {
     return new Promise((resolve) => {
-        const child = spawn('git', [...args, file], { cwd, shell: false, env: process.env });
+        const child = spawn('git', [...args, file], { cwd, shell: false, env: filteredVerifyEnv() });
         const chunks = [];
         child.stdout.on('data', (b) => { chunks.push(b); });
         child.stderr.on('data', (b) => { chunks.push(b); });

package/dist/verification/engine.d.ts

@@ -8,10 +8,18 @@
  * structured Failure (and the model has had up to N attempts to fix).
  */
 import { type Failure } from './detect.js';
+/** Verification mode. Canonical definition — agent/runtime.ts converges to
+ * this type automatically once this export exists (see its conditional
+ * VerifyMode). Backward-compatible: pure type, no runtime change. */
+export type VerifyMode = 'strict' | 'advisory' | 'off';
 export interface VerifyOptions {
     cwd: string;
     command: string;
     timeoutMs?: number;
+    /** Owning session for `verification.*` bus events. Optional for backward
+     * compatibility — siblings pass `sessionId` at verify call sites; when
+     * absent the emitted events fall back to 'ephemeral'. */
+    sessionId?: string;
 }
 export interface VerifyResult {
     ok: boolean;

package/dist/verification/engine.js

@@ -9,7 +9,9 @@
  */
 import { spawn } from 'node:child_process';
 import { detect, summarize } from './detect.js';
+import { filteredVerifyEnv } from './registry.js';
 import { redact } from '../policy/secret-redactor.js';
+import { globalBus } from '../events/bus.js';
 const MAX_VERIFY_BYTES = 256 * 1024;
 function appendCapped(current, chunk) {
     if (current.length >= MAX_VERIFY_BYTES)
@@ -47,9 +49,30 @@ const DANGEROUS_VERIFY_PATTERNS = [
     { pattern: /\|\|\s*rm\s+-rf/, reason: 'chained rm -rf' },
 ];
 export async function verify(opts) {
+    const sid = opts.sessionId ?? 'ephemeral';
+    const emitStarted = () => {
+        try {
+            globalBus.emit({ type: 'verification.started', ts: Date.now(), sessionId: sid, command: opts.command });
+        }
+        catch { /* bus never throws */ }
+    };
+    const emitSucceeded = () => {
+        try {
+            globalBus.emit({ type: 'verification.succeeded', ts: Date.now(), sessionId: sid, command: opts.command });
+        }
+        catch { /* bus never throws */ }
+    };
+    const emitFailed = (reason) => {
+        try {
+            globalBus.emit({ type: 'verification.failed', ts: Date.now(), sessionId: sid, command: opts.command, reason });
+        }
+        catch { /* bus never throws */ }
+    };
+    emitStarted();
     // SEC-004: reject dangerous patterns before spawning
     for (const { pattern, reason } of DANGEROUS_VERIFY_PATTERNS) {
         if (pattern.test(opts.command)) {
+            emitFailed(`Command blocked: ${reason}`);
             return {
                 ok: false,
                 exitCode: -1,
@@ -61,7 +84,8 @@ export async function verify(opts) {
     }
     const timeout = opts.timeoutMs ?? 5 * 60 * 1000;
     return new Promise((resolve) => {
-        const child = spawn(opts.command, { cwd: opts.cwd, shell: true, env: process.env });
+        // S2: verify commands run with filtered env; servers needing keys must use explicit config.
+        const child = spawn(opts.command, { cwd: opts.cwd, shell: true, env: filteredVerifyEnv() });
         const outChunks = [];
         const errChunks = [];
         let done = false;
@@ -73,6 +97,7 @@ export async function verify(opts) {
             const so = Buffer.concat(outChunks).toString('utf-8').slice(0, MAX_VERIFY_BYTES);
             const se = Buffer.concat(errChunks).toString('utf-8').slice(0, MAX_VERIFY_BYTES);
             const raw = se + '\n' + so;
+            emitFailed('[verify timeout]');
             resolve({
                 ok: false,
                 exitCode: -1,
@@ -94,10 +119,12 @@ export async function verify(opts) {
             const se = Buffer.concat(errChunks).toString('utf-8').slice(0, MAX_VERIFY_BYTES);
             const exit = typeof code === 'number' ? code : -1;
             if (exit === 0) {
+                emitSucceeded();
                 resolve({ ok: true, exitCode: 0, stdout: so, stderr: se });
                 return;
             }
             const failure = detect(so, se, exit);
+            emitFailed(failure.type);
             resolve({ ok: false, exitCode: exit, stdout: so, stderr: se, failure });
         });
     });

package/dist/verification/registry.d.ts

@@ -12,6 +12,8 @@ export interface Verifier {
 }
 export declare function detectVerifiers(cwd: string): Verifier[];
 export declare function primaryVerifyCommand(cwd: string): string | null;
+/** Filtered env for verify children: allowlist + secret strip + preload-vector delete. */
+export declare function filteredVerifyEnv(): NodeJS.ProcessEnv;
 export interface VerifySettings {
     commands?: string[];
     onEdit?: boolean;

package/dist/verification/registry.js

@@ -5,6 +5,7 @@
  */
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { filteredEnv as siblingFilteredEnv } from '../tools/shell/shell-exec.js';
 function exists(p) {
     try {
         return fs.existsSync(p);
@@ -113,6 +114,49 @@ export function primaryVerifyCommand(cwd) {
     const v = detectVerifiers(cwd);
     return v[0]?.command ?? null;
 }
+// S2 — filtered env for ALL spawned verify commands.
+//
+// Delegates to the sibling-owned `filteredEnv` from
+// `tools/shell/shell-exec.ts` (EXACT export name — verified via grep) for
+// the allowlist base, then applies this module's stricter secret strip
+// (sibling only strips SECRET/TOKEN + named keys; verify children also
+// strip KEY-shaped names like NODE_API_KEY) plus the Windows shell vars a
+// spawned shell needs (SystemRoot/COMSPEC/...) and preload-vector deletes.
+// `filteredVerifyEnv` already exists — reuse it, don't duplicate it.
+const VERIFY_ENV_PREFIXES = ['PATH', 'HOME', 'USER', 'SHELL', 'TERM', 'LANG', 'NODE_', 'NPM_', 'PNPM_', 'YARN_'];
+// Exact keys: sibling's PWD/TMPDIR/TEMP plus the Windows OS vars a spawned
+// shell needs to start (COMSPEC/SystemRoot/PATHEXT/...) — none carry secrets.
+const VERIFY_ENV_EXACT = new Set([
+    'PWD', 'TMPDIR', 'TEMP', 'TMP',
+    'SystemRoot', 'windir', 'COMSPEC', 'PATHEXT', 'OS',
+    'USERPROFILE', 'APPDATA', 'LOCALAPPDATA', 'PROGRAMDATA',
+]);
+const VERIFY_ENV_SECRET_RE = /SECRET|TOKEN|KEY/i;
+/** Filtered env for verify children: allowlist + secret strip + preload-vector delete. */
+export function filteredVerifyEnv() {
+    // Sibling-owned base (allowlisted prefixes + secret strip).
+    const out = { ...siblingFilteredEnv() };
+    // Harden beyond the sibling: strip KEY-shaped names the sibling passes
+    // through (e.g. NODE_API_KEY) before overlaying our own allowlist.
+    for (const k of Object.keys(out)) {
+        if (VERIFY_ENV_SECRET_RE.test(k))
+            delete out[k];
+    }
+    for (const [k, v] of Object.entries(process.env)) {
+        if (v === undefined)
+            continue;
+        if (VERIFY_ENV_SECRET_RE.test(k))
+            continue;
+        if (VERIFY_ENV_PREFIXES.some((p) => k.startsWith(p)) || VERIFY_ENV_EXACT.has(k)) {
+            out[k] = v;
+        }
+    }
+    delete out.NODE_OPTIONS;
+    delete out.LD_PRELOAD;
+    delete out.LD_LIBRARY_PATH;
+    out.PATH = process.env.PATH;
+    return out;
+}
 export function resolveVerifySettings(raw) {
     if (!raw || typeof raw !== 'object')
         return {};

package/dist/verification/scoped.js

@@ -5,6 +5,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { spawn } from 'node:child_process';
+import { filteredVerifyEnv } from './registry.js';
 export function findRelatedTests(cwd, editedFiles) {
     if (editedFiles.length === 0)
         return [];
@@ -48,32 +49,81 @@ export function findRelatedTests(cwd, editedFiles) {
     }
     return [...related];
 }
+const UNSAFE_SCOPED_RE = /["$`;&|()]/;
+function isSafeScopedPath(cwd, f) {
+    if (UNSAFE_SCOPED_RE.test(f))
+        return false;
+    if (f.includes('\n') || f.includes('\r') || f.includes('\0'))
+        return false;
+    const rel = path.relative(path.resolve(cwd), path.resolve(cwd, f));
+    if (rel === '' || rel.startsWith('..') || path.isAbsolute(rel))
+        return false;
+    return true;
+}
 export function buildScopedCommand(cwd, baseCommand, relatedTests) {
     if (relatedTests.length === 0)
         return null;
     if (relatedTests.length > 10)
         return null; // too many → full suite
+    // Validate every test path: must stay within cwd and contain no shell
+    // metacharacters. Drop offenders; if none survive, return null (caller
+    // falls back to the full suite — never interpolate untrusted paths).
+    const safe = relatedTests.filter((f) => isSafeScopedPath(cwd, f));
+    if (safe.length === 0)
+        return null;
     // npm test heuristic: npm test -- <files> or vitest/jest file list
     if (baseCommand.includes('npm test') || baseCommand.includes('pnpm test') || baseCommand.includes('yarn test') || baseCommand.includes('bun test')) {
-        return `${baseCommand} -- ${relatedTests.map((f) => `"${f}"`).join(' ')}`;
+        return `${baseCommand} -- ${safe.map((f) => `"${f}"`).join(' ')}`;
     }
     if (baseCommand.includes('pytest')) {
-        return `pytest ${relatedTests.map((f) => `"${f}"`).join(' ')}`;
-    }
-    if (baseCommand.includes('go test')) {
-        // go test ./... with file filter — fallback to full
-        return null;
+        return `pytest ${safe.map((f) => `"${f}"`).join(' ')}`;
     }
     if (baseCommand.includes('cargo test')) {
-        // cargo test --test <name>
+        // Cargo keeps the full suite: `cargo test` selects by test-target name
+        // (`--test <name>`), lib/bin unit-test filters, or `-- <filter>` args —
+        // none of which map 1:1 onto file paths. Interpolating a file path as a
+        // filter would silently run the WRONG subset (substring match against
+        // test names), so fall back to the full suite rather than lie about
+        // coverage. (Checked before the `go test` branch: "cargo test" contains
+        // the substring "go test".)
         return null;
     }
+    // NOTE: `baseCommand.includes('go test')` must stay AFTER the cargo branch
+    // above — "cargo test" contains "go test" as a substring.
+    if (baseCommand.includes('go test')) {
+        // Go has no file-scoped test selection: `go test` takes package
+        // patterns, not file paths (passing `foo_test.go` directly errors with
+        // "no Go files in ..."). Derive `go test ./<pkgdirs...>` from the
+        // directories of the related test files instead: dedupe, cap 10, and
+        // reuse the same containment-validated `safe` list as every other
+        // branch (untrusted paths never reach the shell).
+        const dirs = [];
+        const seen = new Set();
+        for (const f of safe) {
+            const d = path.dirname(f);
+            const pkg = d === '.' ? '.' : `./${d.split(path.sep).join('/')}`;
+            if (!seen.has(pkg)) {
+                seen.add(pkg);
+                dirs.push(pkg);
+            }
+            if (dirs.length >= 10)
+                break;
+        }
+        if (dirs.length === 0)
+            return null;
+        // Preserve a './...'-style base by replacing it; otherwise append.
+        if (baseCommand.includes('./...')) {
+            return baseCommand.replace('./...', dirs.join(' '));
+        }
+        return `${baseCommand} ${dirs.join(' ')}`;
+    }
     return null;
 }
 const MAX_SCOPED_BYTES = 256 * 1024;
 export async function runScopedVerify(cwd, command, timeoutMs = 45_000) {
     return new Promise((resolve) => {
-        const child = spawn(command, { cwd, shell: true, env: process.env });
+        // S2: verify commands run with filtered env; servers needing keys must use explicit config.
+        const child = spawn(command, { cwd, shell: true, env: filteredVerifyEnv() });
         const outChunks = [];
         const errChunks = [];
         let done = false;
@@ -125,7 +175,8 @@ export async function syntaxCheck(cwd, file) {
             // For now, use tsc --noEmit --skipLibCheck on single file quickly
             if (ext === '.ts') {
                 const ok = await new Promise((resolve) => {
-                    const child = spawn('npx', ['tsc', '--noEmit', '--skipLibCheck', full], { cwd, shell: false, env: process.env });
+                    // S2: verify commands run with filtered env; servers needing keys must use explicit config.
+                    const child = spawn('npx', ['tsc', '--noEmit', '--skipLibCheck', full], { cwd, shell: false, env: filteredVerifyEnv() });
                     let done = false;
                     const t = setTimeout(() => { if (!done) {
                         done = true;
@@ -145,7 +196,8 @@ export async function syntaxCheck(cwd, file) {
                 return { ok: true };
             }
             const ok2 = await new Promise((resolve) => {
-                const child = spawn(process.execPath, ['--check', full], { cwd, shell: false, env: process.env });
+                // S2: verify commands run with filtered env; servers needing keys must use explicit config.
+                const child = spawn(process.execPath, ['--check', full], { cwd, shell: false, env: filteredVerifyEnv() });
                 let done = false;
                 const t = setTimeout(() => { if (!done) {
                     done = true;
@@ -170,7 +222,8 @@ export async function syntaxCheck(cwd, file) {
     }
     if (ext === '.py') {
         const ok = await new Promise((resolve) => {
-            const child = spawn('python', ['-m', 'py_compile', full], { cwd, shell: false, env: process.env });
+            // S2: verify commands run with filtered env; servers needing keys must use explicit config.
+            const child = spawn('python', ['-m', 'py_compile', full], { cwd, shell: false, env: filteredVerifyEnv() });
             let done = false;
             const t = setTimeout(() => { if (!done) {
                 done = true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "klyro",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Klyro — autonomous coding harness CLI that streams from any OpenAI-compatible or Anthropic LLM endpoint.",
   "type": "module",
   "main": "dist/index.js",