klyro 1.0.0 → 1.0.2

package/dist/cli/hooks.js

@@ -0,0 +1,181 @@
+/**
+ * Hooks engine (10.2) — preToolUse / postToolUse shell hooks.
+ *
+ * Config files:
+ *   - project: `<cwd>/.klyro/hooks.json`
+ *   - global:  `~/.klyro/hooks.json` (merged; project wins on name clash)
+ *
+ * Schema: `{ hooks: Array<{ name, event, command, timeoutMs? }> }`.
+ *
+ * `loadHooks` never throws — a missing file is `[]`, an invalid file is
+ * `[]` plus a one-time stderr warning per path. `runHook` spawns the
+ * command with `shell: true` (commands are strings, must work on win +
+ * posix), a default 30s timeout, a filtered env, plus `KLYRO_TOOL_NAME`
+ * and `KLYRO_TOOL_INPUT_JSON` for the hook's inspection.
+ */
+import { spawn } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { z } from 'zod';
+export const HookSchema = z.object({
+    name: z.string().min(1),
+    event: z.enum(['preToolUse', 'postToolUse']),
+    command: z.string().min(1),
+    timeoutMs: z.number().int().positive().optional(),
+});
+const HooksFileSchema = z.object({
+    hooks: z.array(HookSchema),
+});
+export const DEFAULT_HOOK_TIMEOUT_MS = 30_000;
+const MAX_HOOK_OUTPUT_CHARS = 4000;
+/** Paths already warned about (invalid JSON/schema) — warn once per path. */
+const warnedPaths = new Set();
+function warnOnce(filePath, detail) {
+    if (warnedPaths.has(filePath))
+        return;
+    warnedPaths.add(filePath);
+    try {
+        process.stderr.write(`klyro: hooks: ignoring invalid file ${filePath}: ${detail}\n`);
+    }
+    catch { /* ignore */ }
+}
+/** Read + validate one hooks file. Missing → []. Invalid → [] + warn once. */
+function readHooksFile(filePath) {
+    let raw;
+    try {
+        raw = fs.readFileSync(filePath, 'utf-8');
+    }
+    catch {
+        return []; // missing/unreadable — silent, zero-cost fast path stays silent
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        warnOnce(filePath, err instanceof Error ? err.message : String(err));
+        return [];
+    }
+    const checked = HooksFileSchema.safeParse(parsed);
+    if (!checked.success) {
+        const first = checked.error.issues[0];
+        warnOnce(filePath, first ? `${first.path.join('.') || 'hooks'}: ${first.message}` : 'schema mismatch');
+        return [];
+    }
+    return checked.data.hooks;
+}
+function globalHooksPath() {
+    try {
+        return path.join(os.homedir() || process.cwd(), '.klyro', 'hooks.json');
+    }
+    catch {
+        return path.join(process.cwd(), '.klyro', 'hooks.json');
+    }
+}
+/**
+ * Load hooks for a run. Global first, then project — a project hook with
+ * the same `name` replaces the global one. Never throws.
+ */
+export function loadHooks(cwd) {
+    let out = [];
+    try {
+        const byName = new Map();
+        for (const h of readHooksFile(globalHooksPath()))
+            byName.set(h.name, h);
+        const projectFile = path.join(cwd, '.klyro', 'hooks.json');
+        for (const h of readHooksFile(projectFile))
+            byName.set(h.name, h);
+        out = [...byName.values()];
+    }
+    catch {
+        return [];
+    }
+    return out;
+}
+/**
+ * Minimal filtered env for hook children (mirrors the shell_exec policy:
+ * secrets stripped, only safe prefixes pass). Kept local so the hooks
+ * engine never depends on the tool layer at import time.
+ */
+function hookEnv() {
+    const out = {};
+    for (const [k, v] of Object.entries(process.env)) {
+        if (k.startsWith('KLYRO_') && k.includes('API_KEY'))
+            continue;
+        if (k.includes('SECRET') || k.includes('TOKEN') || k === 'ANTHROPIC_API_KEY' || k === 'OPENAI_API_KEY')
+            continue;
+        if (k.startsWith('PATH') || k.startsWith('HOME') || k.startsWith('USER') ||
+            k.startsWith('SHELL') || k.startsWith('TERM') || k.startsWith('LANG') ||
+            k.startsWith('NODE_') || k.startsWith('NPM_') || k.startsWith('PNPM_') ||
+            k.startsWith('YARN_') || k === 'PWD' || k === 'TMPDIR' || k === 'TEMP' ||
+            k === 'SystemRoot' || k === 'windir' || k === 'PATHEXT' || k === 'OS') {
+            out[k] = v;
+        }
+    }
+    out.PATH = process.env.PATH;
+    return out;
+}
+/**
+ * Run one hook. Resolves (never rejects) with the exit code + sliced
+ * output. `ok` is true only when the process exited 0.
+ */
+export function runHook(hook, ctx) {
+    const timeoutMs = hook.timeoutMs ?? DEFAULT_HOOK_TIMEOUT_MS;
+    return new Promise((resolve) => {
+        let env;
+        try {
+            // Filtered env (same policy as shell_exec): secrets stripped, only
+            // safe prefixes pass — plus the hook's own inspection vars below.
+            env = hookEnv();
+        }
+        catch {
+            env = { PATH: process.env.PATH };
+        }
+        env.KLYRO_TOOL_NAME = ctx.toolName;
+        try {
+            env.KLYRO_TOOL_INPUT_JSON = JSON.stringify(ctx.input ?? {}).slice(0, 16_000);
+        }
+        catch {
+            env.KLYRO_TOOL_INPUT_JSON = '{}';
+        }
+        let child;
+        try {
+            child = spawn(hook.command, {
+                cwd: process.cwd(),
+                shell: true,
+                windowsHide: true,
+                timeout: timeoutMs,
+                env,
+            });
+        }
+        catch (err) {
+            resolve({ ok: false, exitCode: -1, stdout: '', stderr: String(err instanceof Error ? err.message : err).slice(0, MAX_HOOK_OUTPUT_CHARS) });
+            return;
+        }
+        let stdout = '';
+        let stderr = '';
+        child.stdout?.on('data', (d) => {
+            stdout += d.toString();
+            if (stdout.length > MAX_HOOK_OUTPUT_CHARS * 2)
+                stdout = stdout.slice(0, MAX_HOOK_OUTPUT_CHARS * 2);
+        });
+        child.stderr?.on('data', (d) => {
+            stderr += d.toString();
+            if (stderr.length > MAX_HOOK_OUTPUT_CHARS * 2)
+                stderr = stderr.slice(0, MAX_HOOK_OUTPUT_CHARS * 2);
+        });
+        child.on('error', (err) => {
+            resolve({ ok: false, exitCode: -1, stdout: stdout.slice(0, MAX_HOOK_OUTPUT_CHARS), stderr: String(err.message ?? err).slice(0, MAX_HOOK_OUTPUT_CHARS) });
+        });
+        child.on('close', (code) => {
+            const exitCode = typeof code === 'number' ? code : -1;
+            resolve({
+                ok: exitCode === 0,
+                exitCode,
+                stdout: stdout.slice(0, MAX_HOOK_OUTPUT_CHARS),
+                stderr: stderr.slice(0, MAX_HOOK_OUTPUT_CHARS),
+            });
+        });
+    });
+}

package/dist/cli/repl.js

@@ -15,6 +15,7 @@ import { anthropicAdapter } from '../agent/anthropic-adapter.js';
 import { retryingAdapter } from '../agent/retry.js';
 import { globalBus } from '../events/bus.js';
 import { run } from '../agent/runtime.js';
+import { resolveSystemPrompt } from '../agent/runtime.js';
 import { builtinRegistry } from '../tools/registry.js';
 import { builtinRules, clonePolicyConfig, PolicyEngine } from '../policy/engine.js';
 import { buildLevel6Context } from '../context/level6.js';
@@ -28,7 +29,10 @@ import { MouseFilter, MOUSE_ENABLE, MOUSE_DISABLE, createReadWrapper } from '../
 import { inferProviderFromBaseURL } from '../agent/registry.js';
 import { getDefaultSessionStore } from '../persistence/session.js';
 import { buildSystemPrompt, parseImageInput } from '../context/system-prompt.js';
+import { memoryBlock } from '../context/memory.js';
 import { estimateCost } from '../providers/model-info.js';
+import { ContextTrust } from '../context/trust.js';
+import { redact } from '../policy/secret-redactor.js';
 export async function startRepl(opts = {}) {
     // P0.5 — load <cwd>/.env first so provider resolution below sees KLYRO_*
     // vars without `export`. Never throws; explicit env wins (no-clobber).
@@ -90,21 +94,66 @@ export async function startRepl(opts = {}) {
     catch {
         /* ignore — engine defaults stand */
     }
-    // Best-effort MCP tools: never fatal, never prompts. src/mcp/registry.ts
-    // lands from a sibling agent — the lazy import keeps runtime + builds green
-    // until then (import failure is caught below). Servers live for the process
-    // lifetime, so no close wiring here (unlike runOnce's finally).
-    try {
-        // @ts-ignore — sibling-owned module may not exist yet
-        const { loadAndRegisterMcp } = await import('../mcp/registry.js');
-        const mcp = await loadAndRegisterMcp({ cwd, registry, policy });
-        for (const e of mcp.errors)
-            process.stderr.write(`klyro: mcp ${e.server}: ${e.message}\n`);
-        if (mcp.registered.length > 0) {
-            process.stderr.write(`klyro: mcp tools: ${mcp.registered.join(', ')}\n`);
+    // Best-effort MCP tools: never fatal, never prompts. Servers live for the
+    // process lifetime, so no close wiring here (unlike runOnce's finally).
+    // NOTE: the actual loadAndRegisterMcp call lives below (after the approval
+    // object exists) so project-server approval can route through it.
+    // Local inline sanitizer for the approval prompt (duplicates the shared
+    // sanitizeForPrompt in sibling-owned policy/approval.ts — intentionally
+    // not imported; kept local to avoid coupling the REPL to that module).
+    function sanitizeForPrompt(s) {
+        return s.replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]|\x1b\[[0-9;]*[A-Za-z]/g, '').slice(0, 120);
+    }
+    async function loadMcpTools() {
+        try {
+            const { loadAndRegisterMcp } = await import('../mcp/registry.js');
+            const mcp = await loadAndRegisterMcp({
+                cwd,
+                registry,
+                policy,
+                // CONTRACT (sibling D): project-server approval hook. Registries that
+                // predate the contract ignore the unknown opt (checked via try/catch
+                // below with a skip-with-warning fallback).
+                approveProjectServer: async (info) => {
+                    // Show the disabled state alongside source before asking, so a
+                    // disabled server's approval can't be mistaken for activation.
+                    let disabledNote = '';
+                    try {
+                        const { loadMcpServers } = await import('../mcp/config.js');
+                        const cfg = loadMcpServers(cwd);
+                        const spec = cfg.servers[info.name];
+                        if (spec?.disabled)
+                            disabledNote = ' (disabled in config)';
+                    }
+                    catch { /* ignore — prompt without the note */ }
+                    const safeName = sanitizeForPrompt(info.name);
+                    const safeSource = sanitizeForPrompt(info.source);
+                    try {
+                        const choice = await approval.ask({
+                            toolName: 'mcp_project_server',
+                            reason: `MCP project server "${safeName}"${disabledNote} from ${safeSource} — approve to register its tools`,
+                            summary: safeName,
+                        });
+                        return choice === 'allow' || choice === 'always' || choice === 'always-persist';
+                    }
+                    catch {
+                        return false;
+                    }
+                },
+            });
+            for (const e of mcp.errors)
+                process.stderr.write(`klyro: mcp ${e.server}: ${e.message}\n`);
+            if (mcp.registered.length > 0) {
+                process.stderr.write(`klyro: mcp tools: ${mcp.registered.join(', ')}\n`);
+            }
+        }
+        catch {
+            try {
+                process.stderr.write('klyro: mcp project-server approval skipped (registry unavailable)\n');
+            }
+            catch { /* ignore */ }
         }
     }
-    catch { /* ignore — MCP is optional */ }
     const providerKind = inferProviderFromBaseURL(baseUrl);
     // Local Ollama exposes OpenAI-compat but hostname could contain "anthropic"
     // via proxy — don't try anthropic adapter with empty key (would 401).
@@ -136,16 +185,39 @@ export async function startRepl(opts = {}) {
         },
     });
     let adapter = buildAdapter(currentProvider, currentBaseUrl, currentApiKey);
+    // L15 failover — initial adapter only: extra `providers.failover` entries
+    // become fallback adapters for agent runs in this session. Live
+    // /provider switches rebuild a single adapter (buildAdapter) and bypass
+    // the chain — documented, not a bug.
+    let replFailoverAdapters = [];
+    try {
+        const { resolveProviderChain } = await import('./config.js');
+        const chain = await resolveProviderChain(cwd);
+        for (const entry of chain.slice(1)) {
+            if (!entry.apiKey)
+                continue;
+            try {
+                replFailoverAdapters.push(buildAdapter(entry.provider, entry.baseURL ?? currentBaseUrl, entry.apiKey));
+            }
+            catch { /* skip unbuildable entries */ }
+        }
+        if (replFailoverAdapters.length > 0) {
+            process.stderr.write(`klyro: failover chain: ${replFailoverAdapters.map((b) => b.id).join(' → ')}\n`);
+        }
+    }
+    catch { /* best-effort — single-provider session proceeds */ }
     const ctxBlock = await buildLevel6Context({ cwd });
     let ctxPrefix = ctxBlock.formatted ? `\n\n<context>\n${ctxBlock.formatted}\n</context>` : '';
-    // 4.4 KLYRO.md hierarchy (mutable — /reload refreshes)
-    const klyroMd = await import('../context/klyro-md.js').then((m) => m.loadKlyroMd(cwd)).catch(() => '');
-    let klyroBlock = klyroMd ? `\n\n<KLYRO.md>\n${klyroMd.slice(0, 4000)}\n</KLYRO.md>` : '';
-    // 2.3 layered system prompt
+    // 4.4 KLYRO.md hierarchy (mutable — /reload refreshes). Content is gated
+    // through the context trust store (see loadKlyroBlockTrust below) — the
+    // initial value stays empty until the gated load runs after approval setup.
+    let klyroBlock = '';
+    // 2.3 layered system prompt (split shape: stable base + volatile telemetry suffix)
     const systemPromptFn = (_ctx) => {
-        const base = buildSystemPrompt({ cwd, model, extraSystem: opts.systemPrompt, appendSystem: ctxPrefix + klyroBlock });
-        const t = _ctx.telemetry ? '\n\n' + _ctx.telemetry : '';
-        return base + t;
+        // 8.4 — inject session memory so memory_write actually takes effect.
+        const memBlock = memoryBlock(cwd);
+        const base = buildSystemPrompt({ cwd, model, extraSystem: opts.systemPrompt, appendSystem: ctxPrefix + klyroBlock + memBlock });
+        return _ctx.telemetry ? { system: base, suffix: _ctx.telemetry } : { system: base };
     };
     let ac = new AbortController();
     // When the TUI is mounted, use the inline Ink prompt. Otherwise
@@ -176,6 +248,45 @@ export async function startRepl(opts = {}) {
                 });
             },
         });
+    // Context-file trust gate (context/trust.js): KLYRO.md / AGENTS.md content
+    // only enters the prompt after the trust store approves it. Untrusted files
+    // prompt via the repl approval object (allow/always/always-persist → true,
+    // deny → false); every decision emits context.trust_prompt on globalBus.
+    const trustStore = new ContextTrust();
+    async function loadKlyroBlockTrust() {
+        try {
+            const { loadTrustedKlyroMd } = await import('../context/trust.js');
+            const text = await loadTrustedKlyroMd(cwd, {
+                trust: trustStore,
+                approve: async (file, reason) => {
+                    try {
+                        const choice = await approval.ask({
+                            toolName: 'context_trust',
+                            reason: `untrusted context file (${reason}): ${file.path}`,
+                            summary: file.path,
+                        });
+                        return choice === 'allow' || choice === 'always' || choice === 'always-persist';
+                    }
+                    catch {
+                        return false;
+                    }
+                },
+                sessionId: typeof tuiSessionId === 'string' ? tuiSessionId : 'ephemeral',
+                emit: (ev) => globalBus.emit(ev),
+            });
+            return text ? `\n\n<KLYRO.md>\n${text.slice(0, 4000)}\n</KLYRO.md>` : '';
+        }
+        catch {
+            return '';
+        }
+    }
+    // MCP servers need the approval object above — load them now.
+    await loadMcpTools();
+    // Non-TUI runs can prompt on stdin immediately; the TUI defers the gated
+    // load to onMounted (the modal can't render before mount — see below).
+    if (!useTui) {
+        klyroBlock = await loadKlyroBlockTrust().catch(() => '');
+    }
     let inflight = null;
     let lastStatus = null;
     const pendingQueue = [];
@@ -479,14 +590,41 @@ export async function startRepl(opts = {}) {
         return s.length > cap ? s.slice(0, cap) + `\n... [truncated ${s.length - cap} chars]` : s;
     }
     async function execShell(command, timeoutMs = 120_000) {
-        const r = await registry.execute('shell_exec', { command, timeoutMs }, { cwd, env: process.env, nonInteractive: true });
-        if (!r.ok)
-            throw new Error(r.error.message ?? 'shell failed');
-        return r.value;
+        // Internal shell executions bypass the agent runtime's event path, so
+        // audit them here: a redacted tool.call before, the matching tool.result
+        // after. One helper covers every slash handler (/commit, /push, …).
+        const callId = `internal-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+        const sessionId = typeof tuiSessionId === 'string' ? tuiSessionId : 'ephemeral';
+        const startedAt = Date.now();
+        globalBus.emit({
+            type: 'tool.call', ts: startedAt, sessionId, callId,
+            name: 'shell_exec', input: { internal: true, command: redact(command).slice(0, 2000) },
+        });
+        try {
+            const r = await registry.execute('shell_exec', { command, timeoutMs }, { cwd, env: process.env, nonInteractive: true });
+            if (!r.ok)
+                throw new Error(r.error.message ?? 'shell failed');
+            const v = r.value;
+            globalBus.emit({
+                type: 'tool.result', ts: Date.now(), sessionId, callId,
+                name: 'shell_exec', output: { internal: true, exitCode: v.exitCode },
+                isError: false, latencyMs: Date.now() - startedAt,
+            });
+            return v;
+        }
+        catch (err) {
+            globalBus.emit({
+                type: 'tool.result', ts: Date.now(), sessionId, callId,
+                name: 'shell_exec', output: { internal: true, error: err instanceof Error ? err.message : String(err) },
+                isError: true, latencyMs: Date.now() - startedAt,
+            });
+            throw err;
+        }
     }
     /** Read-only LLM answer (no tools) — powers /ask, /explain, /compact. */
     async function answerReadOnly(question, context) {
-        const sys = systemPromptFn({ cwd, telemetry: '' }) + '\n\nAnswer read-only: do not call tools, do not edit files.';
+        // Legacy chat path (no modes): resolve the split prompt back to one string.
+        const sys = resolveSystemPrompt(systemPromptFn, { cwd, telemetry: '' }).system + '\n\nAnswer read-only: do not call tools, do not edit files.';
         const attached = await buildAttachedBlock();
         const userText = (context ? `${question}\n\n<context>\n${context.slice(0, 6000)}\n</context>` : question) + attached;
         const req = {
@@ -529,6 +667,19 @@ export async function startRepl(opts = {}) {
         if (isMounted && directHooks)
             directHooks.clearTranscript();
     }
+    // Update nudge (best-effort, cached 24h, silent fail): a single stderr
+    // line when a newer version exists. No prompt, no blocking — the check
+    // itself is fire-and-forget.
+    void (async () => {
+        try {
+            const { checkForUpdate } = await import('./update.js');
+            const cur = readVersion();
+            const latest = await checkForUpdate(cur);
+            if (latest)
+                process.stderr.write(`Update available: ${cur} → ${latest} (klyro update)\n`);
+        }
+        catch { /* silent */ }
+    })();
     app = render(React.createElement(App, {
         initialModel: model,
         maxSteps: currentMaxSteps,
@@ -564,6 +715,14 @@ export async function startRepl(opts = {}) {
                     hooks.append(ev.item);
             }
             pendingQueue.length = 0;
+            // Deferred trust-gated KLYRO.md load: the approval modal can only
+            // render once the App is mounted. Prompts sent before this resolves
+            // run without the KLYRO.md block (noted in /reload output).
+            if (useTui && !klyroBlock) {
+                void loadKlyroBlockTrust()
+                    .then((b) => { klyroBlock = b; })
+                    .catch(() => undefined);
+            }
         },
     }), { patchConsole: false });
     // Install SIGINT handler only after app exists (avoids TDZ) and use once
@@ -618,7 +777,8 @@ export async function startRepl(opts = {}) {
             try {
                 const simpleReq = {
                     model,
-                    system: systemPromptFn({ cwd, telemetry: '' }),
+                    // Legacy chat path (no modes): plain string system, untouched by the split.
+                    system: resolveSystemPrompt(systemPromptFn, { cwd, telemetry: '' }).system,
                     messages: [{ role: 'user', content: [{ kind: 'text', text: taskText }] }],
                     tools: [],
                     signal: ac.signal,
@@ -771,8 +931,14 @@ export async function startRepl(opts = {}) {
                     else if (ev.kind === 'aborted') {
                         queuedStatus({ status: 'aborted' });
                     }
+                    else if (ev.kind === 'model_override') {
+                        queuedAppend({ id: `movr-${Date.now()}`, kind: 'text', text: `[model] override: requested ${ev.requested} → effective ${ev.effective}`, role: 'assistant' });
+                    }
                 },
-            }, { adapter, registry, policy, approval, systemPrompt: systemPromptFn });
+            }, {
+                adapter, registry, policy, approval, systemPrompt: systemPromptFn,
+                ...(replFailoverAdapters.length > 0 ? { failoverAdapters: replFailoverAdapters } : {}),
+            });
             if (result.finalText)
                 lastAssistantText = result.finalText;
             if (result.verification) {
@@ -2380,8 +2546,9 @@ export async function startRepl(opts = {}) {
                     }
                     const ctx = await buildLevel6Context({ cwd });
                     ctxPrefix = ctx.formatted ? `\n\n<context>\n${ctx.formatted}\n</context>` : '';
-                    const md = await import('../context/klyro-md.js').then((m) => m.loadKlyroMd(cwd)).catch(() => '');
-                    klyroBlock = md ? `\n\n<KLYRO.md>\n${md.slice(0, 4000)}\n</KLYRO.md>` : '';
+                    // Trust-gated like the initial load (the modal is mounted here,
+                    // so untrusted files prompt instead of being silently dropped).
+                    klyroBlock = await loadKlyroBlockTrust().catch(() => '');
                     queuedAppend({
                         id: `reload-${Date.now()}`,
                         kind: 'text',

package/dist/cli/run.d.ts

@@ -7,6 +7,8 @@
  * even on a long task. Tool calls and policy decisions go to stderr so
  * they don't pollute the captured `finalText` if the user pipes.
  */
+import type { VerifyMode } from '../agent/runtime.js';
+import type { SystemPromptFn } from '../agent/runtime.js';
 import type { Message } from '../agent/message.js';
 export interface RunCliOptions {
     task: string;
@@ -15,10 +17,7 @@ export interface RunCliOptions {
     maxSteps?: number;
     maxTokens?: number;
     temperature?: number;
-    systemPrompt?: (ctx: {
-        cwd: string;
-        telemetry?: string;
-    }) => string;
+    systemPrompt?: SystemPromptFn;
     baseUrl?: string;
     apiKey?: string;
     timeoutMs?: number;
@@ -60,6 +59,9 @@ export interface RunCliOptions {
     maxRepairAttempts?: number;
     verifyTimeoutMs?: number;
     requireVerify?: boolean;
+    /** Verification mode: strict (default) runs the full repair pipeline;
+     * advisory reports once without repairs; off skips verification. */
+    verifyMode?: VerifyMode;
     /** Level 9 — persistence */
     persist?: boolean;
     sessionId?: string;
@@ -68,13 +70,13 @@ export interface RunCliOptions {
     agent?: string;
     maxDepth?: number;
 }
+/**
+ * Double-Ctrl+C detector (pure, exported for tests): the second SIGINT
+ * within 1500ms of the first forces `process.exit(130)`. The live handler
+ * below owns the timestamp closure; tests exercise only this predicate.
+ */
+export declare function shouldForceExit(lastSigintAt: number | undefined, now: number): boolean;
 export declare function runOnce(opts: RunCliOptions): Promise<number>;
 /** Wrap a system-prompt fn to inject Level-6 context (project map etc.) + KLYRO.md (4.4). */
-export declare function makeRunSystemPrompt(cwd: string, base: (ctx: {
-    cwd: string;
-    telemetry?: string;
-}) => string): Promise<(ctx: {
-    cwd: string;
-    telemetry?: string;
-}) => string>;
+export declare function makeRunSystemPrompt(cwd: string, base: SystemPromptFn): Promise<SystemPromptFn>;
 export declare function loadTranscript(path: string): Message[];