klyro 1.0.1 → 1.0.3

package/dist/tui/app.test.js

@@ -354,10 +354,11 @@ describe('App', () => {
         stdin.write('hello again');
         await new Promise((r) => setTimeout(r, 20));
         stdin.write('\x0d');
-        // Settle effect: immediate + microtask + timeout(0) bottom pin.
-        await new Promise((r) => setTimeout(r, 150));
+        // The bottom-pin settle effect (immediate + microtask + timeout(0)) runs
+        // on React's schedule — poll for the observable outcome instead of a
+        // fixed 150ms sleep, which flaked under load.
+        await waitForMatch(lastFrame, /MSG-24-tag/);
         expect(onPrompt).toHaveBeenCalledWith('hello again');
-        expect(lastFrame() ?? '').toMatch(/MSG-24-tag/);
     });
     it('onMounted transcript handle runs the four commands (scroll.md §2)', async () => {
         let handle = null;
@@ -537,23 +538,28 @@ describe('App', () => {
             } }));
         await new Promise((r) => setTimeout(r, 100));
         stdin.write(KEY_HOME);
-        await new Promise((r) => setTimeout(r, 50));
+        await waitForMatch(lastFrame, /⇅ 0\/\d+/);
         hooks.append({ id: 'late-1', kind: 'text', text: 'LATE-1-tag', role: 'assistant' });
         // Badge counts lines grown while pinned.
         await waitForMatch(lastFrame, /↓ \d+ new/);
         hooks.clearTranscript();
-        await new Promise((r) => setTimeout(r, 50));
-        // Fresh session: seed 25 more, pin, grow by one 2-line item → badge is exactly 2.
+        // Wait for transcript content to actually clear (no stale MSG-* items) —
+        // this is the "no stale badge" invariant: after a clear, the view must
+        // drop back to follow-tail with the pin/count reset.
+        await waitForAbsent(lastFrame, /MSG-\d{2}-tag/);
+        await waitForAbsent(lastFrame, /↓ \d+ new/);
+        // Fresh session: seed 25 more, let them settle to a bottom-anchored view.
         for (let i = 0; i < 25; i++) {
             hooks.append({ id: `n-${i}`, kind: 'text', text: `NEW-${i.toString().padStart(2, '0')}-tag`, role: 'user' });
         }
-        await new Promise((r) => setTimeout(r, 100));
-        stdin.write(KEY_HOME);
-        await new Promise((r) => setTimeout(r, 50));
+        await waitForMatch(lastFrame, /NEW-24-tag/);
+        // Follow-tail after a clear: growing content shows NO stale badge.
         hooks.append({ id: 'n-late', kind: 'text', text: 'NEWLATE-tag', role: 'assistant' });
-        // Assistant block = header + text + margin = 3 fresh lines, no stale count.
-        const badge = await waitForMatch(lastFrame, /↓ \d+ new/);
-        expect(badge).toMatch(/↓ 3 new/);
+        await waitForMatch(lastFrame, /NEWLATE-tag/);
+        await new Promise((r) => setTimeout(r, 100));
+        const afterFollow = lastFrame() ?? '';
+        expect(afterFollow).not.toMatch(/↓ \d+ new/);
+        expect(afterFollow).not.toMatch(/MSG-\d{2}-tag/);
     });
     it('status bar shows scroll position when content overflows', async () => {
         const { stdin, lastFrame } = render(_jsx(App, { initialModel: "m", maxSteps: 10, cwd: "/test", onPrompt: async () => { }, onSlash: async () => { }, isFullscreen: true, initialTranscript: makeInitialTranscript(25) }));

package/dist/tui/approval.test.js

@@ -34,6 +34,21 @@ describe('ApprovalModal', () => {
         const { lastFrame, stdin } = render(_jsx(ApprovalModal, { bridge: bridge }));
         return { bridge, lastFrame, stdin };
     }
+    /** Poll the rendered frame instead of sleeping a fixed interval — Ink
+     *  flushes on React's schedule, so fixed sleeps flake under load. */
+    async function waitForFrame(getFrame, re, timeout = 4000) {
+        const start = Date.now();
+        let frame = '';
+        for (;;) {
+            frame = getFrame() ?? '';
+            if (re.test(frame))
+                return frame;
+            if (Date.now() - start > timeout) {
+                throw new Error(`timed out waiting for ${re}\nlast frame:\n${frame.slice(0, 2000)}`);
+            }
+            await new Promise((r) => setTimeout(r, 10));
+        }
+    }
     it('renders nothing when no prompt is pending', () => {
         const { lastFrame } = setup();
         expect(lastFrame()).toBe('');
@@ -53,11 +68,13 @@ describe('ApprovalModal', () => {
         await promise;
     });
     it('"y" resolves to allow', async () => {
-        const { bridge, stdin } = setup();
+        const { bridge, stdin, lastFrame } = setup();
         const promise = bridge.ask({ toolName: 'x', reason: 'r', summary: 's' });
-        await new Promise((r) => setTimeout(r, 50));
+        // Poll until the modal is actually rendered: the useInput handler reads
+        // `pending` from a closure, so typing before React flushes the pending
+        // state silently drops the key. A blind 50ms sleep is the flake source.
+        await waitForFrame(lastFrame, /approval needed/i);
         stdin.write('y');
-        await new Promise((r) => setTimeout(r, 50));
         await expect(promise).resolves.toBe('allow');
     });
     it('"a" resolves to always', async () => {

package/dist/tui/markdown.d.ts

@@ -10,11 +10,24 @@ export interface MdPart {
     bold?: boolean;
     dim?: boolean;
     code?: boolean;
+    /** color name for inline syntax highlighting within code blocks (R4). */
+    color?: 'red' | 'green' | 'yellow' | 'blue' | 'magenta' | 'cyan' | 'gray';
+    /** OSC-8 hyperlink target (R4): file:line, urls, etc. */
+    href?: string;
 }
 export interface MdLine {
     parts: MdPart[];
     /** inside a ``` fence (render the whole line dimmed) */
     fence: boolean;
 }
+/**
+ * Highlight a single code line. Returns an array of parts that may carry a
+ * `color` for Ink/TerminalRenderer to render. Falls back to dim text when the
+ * language is unknown or the line is a fence marker.
+ */
+export declare function highlightCodeLine(line: string, lang: string): MdPart[];
+/** Detect `file:line` / `file:line:col` references and attach OSC-8 hrefs. */
+export declare const FILE_LINE_RE: RegExp;
+export declare function annotateFileLinks(parts: MdPart[]): MdPart[];
 /** Split assistant text into styled lines. Pure — unit-tested. */
 export declare function renderMarkdownLines(text: string): MdLine[];

package/dist/tui/markdown.js

@@ -6,6 +6,168 @@
  * (best-effort passthrough). Everything renders as terminal text, no HTML.
  */
 const INLINE_RE = /\*\*(.+?)\*\*|\*([^*\n]+?)\*|`([^`\n]+?)`|\[([^\]]+?)\]\(([^)]+?)\)/g;
+/**
+ * R4 — regex-based lightweight syntax highlighting for fenced code blocks.
+ * No heavy tokenizer dependency; keyword/string/comment/number detection
+ * keeps tool output scannable in the terminal. Pure, unit-testable.
+ */
+/** Comment prefixes per common language (used to dim comments). */
+const COMMENT_MARKERS = {
+    ts: ['//', '/*', '*'],
+    js: ['//', '/*', '*'],
+    jsx: ['//', '/*', '*'],
+    tsx: ['//', '/*', '*'],
+    py: ['#'],
+    rb: ['#'],
+    go: ['//', '/*'],
+    rs: ['//', '/*'],
+    java: ['//', '/*', '*'],
+    c: ['//', '/*', '*'],
+    cpp: ['//', '/*', '*'],
+    sh: ['#'],
+    bash: ['#'],
+    yaml: ['#'],
+    yml: ['#'],
+    toml: ['#'],
+    sql: ['--', '/*'],
+};
+const STRING_DELIMS = ["'", '"', '`'];
+/** Keywords that get highlighted, grouped by language family. */
+const KEYWORDS = {
+    js: ['const', 'let', 'var', 'function', 'return', 'if', 'else', 'for', 'of', 'in', 'while', 'class', 'import', 'export', 'default', 'from', 'await', 'async', 'new', 'this', 'null', 'undefined', 'true', 'false', 'typeof', 'instanceof', 'throw', 'try', 'catch', 'switch', 'case', 'break', 'continue'],
+    ts: ['interface', 'type', 'enum', 'namespace', 'readonly', 'declare', 'extends', 'implements', 'public', 'private', 'protected', 'abstract', 'as', 'satisfies', 'const', 'let', 'function', 'return', 'if', 'else', 'for', 'of', 'in', 'while', 'class', 'import', 'export', 'default', 'from', 'await', 'async', 'new', 'this', 'null', 'undefined', 'true', 'false', 'typeof', 'instanceof', 'throw', 'try', 'catch', 'switch', 'case', 'break', 'continue'],
+    py: ['import', 'from', 'def', 'class', 'return', 'if', 'elif', 'else', 'for', 'in', 'while', 'with', 'as', 'lambda', 'pass', 'break', 'continue', 'True', 'False', 'None', 'and', 'or', 'not', 'is', 'raise', 'try', 'except', 'finally', 'yield', 'global', 'async', 'await', 'self'],
+    go: ['func', 'func(', 'package', 'import', 'var', 'const', 'type', 'struct', 'interface', 'return', 'if', 'else', 'for', 'range', 'switch', 'case', 'break', 'continue', 'defer', 'go', 'select', 'map', 'chan', 'nil', 'true', 'false', 'err', 'make'],
+    rs: ['fn', 'let', 'mut', 'const', 'use', 'mod', 'struct', 'enum', 'impl', 'trait', 'pub', 'async', 'await', 'match', 'if', 'else', 'for', 'in', 'while', 'loop', 'return', 'move', 'ref', 'dyn', 'Self', 'self', 'true', 'false', 'None', 'Some', 'Ok', 'Err', 'Vec', 'String'],
+    sh: ['export', 'local', 'if', 'then', 'fi', 'else', 'elif', 'for', 'in', 'do', 'done', 'while', 'case', 'esac', 'function', 'echo', 'printf', 'read', 'cd', 'source', '.', 'return', 'exit', 'set', 'unset', 'command'],
+    bash: ['export', 'local', 'if', 'then', 'fi', 'else', 'elif', 'for', 'in', 'do', 'done', 'while', 'case', 'esac', 'function', 'echo', 'printf', 'read', 'cd', 'source', '.', 'return', 'exit', 'set', 'unset'],
+    json: ['true', 'false', 'null'],
+    yaml: ['true', 'false', 'null', 'yes', 'no'],
+};
+/**
+ * Highlight a single code line. Returns an array of parts that may carry a
+ * `color` for Ink/TerminalRenderer to render. Falls back to dim text when the
+ * language is unknown or the line is a fence marker.
+ */
+export function highlightCodeLine(line, lang) {
+    const trimmed = line.trimStart();
+    const comments = COMMENT_MARKERS[lang] ?? [];
+    const keywords = KEYWORDS[lang] ?? [];
+    const kwSet = new Set(keywords);
+    // Whole-line comment → dim.
+    for (const c of comments) {
+        if (trimmed.startsWith(c))
+            return [{ text: line, dim: true, code: true }];
+    }
+    const parts = [];
+    let i = 0;
+    let inString = false;
+    let strDelim = '';
+    let buf = '';
+    const flush = () => {
+        if (!buf)
+            return;
+        parts.push({ text: buf, code: true });
+        buf = '';
+    };
+    const flushKw = (tok) => {
+        if (kwSet.has(tok))
+            parts.push({ text: tok, color: 'cyan', code: true });
+        else if (/^\d+(\.\d+)?$/.test(tok))
+            parts.push({ text: tok, color: 'yellow', code: true });
+        else
+            parts.push({ text: tok, code: true });
+    };
+    while (i < line.length) {
+        const ch = line[i];
+        if (inString) {
+            buf += ch;
+            if (ch === strDelim) {
+                inString = false;
+                flush();
+            }
+            else if (ch === '\\' && i + 1 < line.length) {
+                buf += line[i + 1];
+                i += 2;
+                continue;
+            }
+            i++;
+            continue;
+        }
+        // Inline comment inside a code line.
+        for (const c of comments) {
+            if (c && line.slice(i, i + c.length) === c) {
+                flush();
+                parts.push({ text: line.slice(i), dim: true, code: true });
+                return parts;
+            }
+        }
+        if (STRING_DELIMS.includes(ch)) {
+            flush();
+            inString = true;
+            strDelim = ch;
+            buf = ch;
+            i++;
+            continue;
+        }
+        if (/[A-Za-z_$]/.test(ch)) {
+            let j = i;
+            while (j < line.length && /[A-Za-z0-9_$]/.test(line[j]))
+                j++;
+            const tok = line.slice(i, j);
+            flushKw(tok);
+            i = j;
+            continue;
+        }
+        if (/[0-9]/.test(ch)) {
+            let j = i;
+            while (j < line.length && /[0-9._]/.test(line[j]))
+                j++;
+            flush();
+            parts.push({ text: line.slice(i, j), color: 'yellow', code: true });
+            i = j;
+            continue;
+        }
+        buf += ch;
+        i++;
+    }
+    flush();
+    if (parts.length === 0)
+        parts.push({ text: line, code: true });
+    return parts;
+}
+/** Detect `file:line` / `file:line:col` references and attach OSC-8 hrefs. */
+export const FILE_LINE_RE = /((?:\.{0,2}\/)?[\w./-]+\.[a-zA-Z]+\w*):(\d+)(?::(\d+))?/g;
+export function annotateFileLinks(parts) {
+    const out = [];
+    for (const p of parts) {
+        if (p.code || !p.text) {
+            out.push(p);
+            continue;
+        }
+        // Preserve the original part's styling on the unattributed plain-text runs.
+        const style = { text: '', ...(p.bold ? { bold: true } : {}), ...(p.dim ? { dim: true } : {}) };
+        FILE_LINE_RE.lastIndex = 0;
+        let last = 0;
+        let m;
+        let matched = false;
+        while ((m = FILE_LINE_RE.exec(p.text))) {
+            matched = true;
+            if (m.index > last)
+                out.push({ ...style, text: p.text.slice(last, m.index) });
+            const path = m[1];
+            const line = m[2];
+            const col = m[3] ? `:${m[3]}` : '';
+            out.push({ text: `${path}:${line}${col}`, href: `file://${path}#L${line}` });
+            last = m.index + m[0].length;
+        }
+        if (!matched)
+            out.push(p);
+        else if (last < p.text.length)
+            out.push({ ...style, text: p.text.slice(last) });
+    }
+    return out;
+}
 function parseInline(s) {
     const parts = [];
     let last = 0;
@@ -37,15 +199,19 @@ function parseInline(s) {
 export function renderMarkdownLines(text) {
     const out = [];
     let inFence = false;
+    let fenceLang = '';
     for (const raw of text.split('\n')) {
         const trimmed = raw.trim();
         if (trimmed.startsWith('```')) {
+            if (!inFence)
+                fenceLang = trimmed.replace(/^```/, '').trim().toLowerCase();
             inFence = !inFence;
             out.push({ parts: [{ text: raw, dim: true }], fence: true });
             continue;
         }
         if (inFence) {
-            out.push({ parts: [{ text: raw, dim: true, code: true }], fence: true });
+            // R4: syntax-highlight the code line, annotated with file:line links.
+            out.push({ parts: annotateFileLinks(highlightCodeLine(raw, fenceLang)), fence: true });
             continue;
         }
         const heading = /^(#{1,6})\s+(.*)$/.exec(raw);
@@ -57,7 +223,8 @@ export function renderMarkdownLines(text) {
             });
             continue;
         }
-        out.push({ parts: parseInline(raw), fence: false });
+        // R4: clickable file:line references in ordinary prose too.
+        out.push({ parts: annotateFileLinks(parseInline(raw)), fence: false });
     }
     return out;
 }

package/dist/tui/scroll-flow.test.js

@@ -73,6 +73,8 @@ describe('scroll flow diagnostics', () => {
         expect(lastFrame() ?? '').toContain('number 4');
     });
     it('wrapped long item: pin mid-item, stream, same first line stays', async () => {
+        // Heavy string measurement + React flush under full-suite parallel load;
+        // the default 10s testTimeout flaked — extend for this one.
         const long = Array.from({ length: 10 }, (_, i) => `WRAPLINE-${i} ` + 'x'.repeat(180)).join('\n');
         const items = [
             { id: 'w1', kind: 'text', text: long, role: 'assistant' },
@@ -90,5 +92,5 @@ describe('scroll flow diagnostics', () => {
         }
         const after = (lastFrame() ?? '').split('\n').slice(0, 3).join('\n');
         expect(after).toBe(before); // anchor stability at line granularity
-    });
+    }, 30_000);
 });

package/dist/verification/classify.js

@@ -4,6 +4,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { spawn } from 'node:child_process';
+import { filteredVerifyEnv } from './registry.js';
 import { detect } from './detect.js';
 function signatureOf(failure, fallbackExit) {
     return {
@@ -48,7 +49,7 @@ export function classifyFailure(current, baseline, flakyRerunOk) {
 }
 export async function rerunOnce(cwd, command, timeoutMs = 45_000) {
     return new Promise((resolve) => {
-        const child = spawn(command, { cwd, shell: true, env: process.env });
+        const child = spawn(command, { cwd, shell: true, env: filteredVerifyEnv() });
         let done = false;
         const t = setTimeout(() => { if (!done) {
             done = true;
@@ -92,7 +93,7 @@ export async function gatherRepairContext(cwd, failure) {
 }
 function execCapturePipe(cwd, cmd) {
     return new Promise((resolve) => {
-        const child = spawn(cmd, { cwd, shell: true, env: process.env });
+        const child = spawn(cmd, { cwd, shell: true, env: filteredVerifyEnv() });
         const chunks = [];
         child.stdout.on('data', (b) => { chunks.push(b); });
         child.stderr.on('data', (b) => { chunks.push(b); });
@@ -102,7 +103,7 @@ function execCapturePipe(cwd, cmd) {
 }
 function execCaptureArgv(cwd, file, args) {
     return new Promise((resolve) => {
-        const child = spawn('git', [...args, file], { cwd, shell: false, env: process.env });
+        const child = spawn('git', [...args, file], { cwd, shell: false, env: filteredVerifyEnv() });
         const chunks = [];
         child.stdout.on('data', (b) => { chunks.push(b); });
         child.stderr.on('data', (b) => { chunks.push(b); });

package/dist/verification/engine.d.ts

@@ -8,10 +8,18 @@
  * structured Failure (and the model has had up to N attempts to fix).
  */
 import { type Failure } from './detect.js';
+/** Verification mode. Canonical definition — agent/runtime.ts converges to
+ * this type automatically once this export exists (see its conditional
+ * VerifyMode). Backward-compatible: pure type, no runtime change. */
+export type VerifyMode = 'strict' | 'advisory' | 'off';
 export interface VerifyOptions {
     cwd: string;
     command: string;
     timeoutMs?: number;
+    /** Owning session for `verification.*` bus events. Optional for backward
+     * compatibility — siblings pass `sessionId` at verify call sites; when
+     * absent the emitted events fall back to 'ephemeral'. */
+    sessionId?: string;
 }
 export interface VerifyResult {
     ok: boolean;

package/dist/verification/engine.js

@@ -11,6 +11,7 @@ import { spawn } from 'node:child_process';
 import { detect, summarize } from './detect.js';
 import { filteredVerifyEnv } from './registry.js';
 import { redact } from '../policy/secret-redactor.js';
+import { globalBus } from '../events/bus.js';
 const MAX_VERIFY_BYTES = 256 * 1024;
 function appendCapped(current, chunk) {
     if (current.length >= MAX_VERIFY_BYTES)
@@ -48,9 +49,30 @@ const DANGEROUS_VERIFY_PATTERNS = [
     { pattern: /\|\|\s*rm\s+-rf/, reason: 'chained rm -rf' },
 ];
 export async function verify(opts) {
+    const sid = opts.sessionId ?? 'ephemeral';
+    const emitStarted = () => {
+        try {
+            globalBus.emit({ type: 'verification.started', ts: Date.now(), sessionId: sid, command: opts.command });
+        }
+        catch { /* bus never throws */ }
+    };
+    const emitSucceeded = () => {
+        try {
+            globalBus.emit({ type: 'verification.succeeded', ts: Date.now(), sessionId: sid, command: opts.command });
+        }
+        catch { /* bus never throws */ }
+    };
+    const emitFailed = (reason) => {
+        try {
+            globalBus.emit({ type: 'verification.failed', ts: Date.now(), sessionId: sid, command: opts.command, reason });
+        }
+        catch { /* bus never throws */ }
+    };
+    emitStarted();
     // SEC-004: reject dangerous patterns before spawning
     for (const { pattern, reason } of DANGEROUS_VERIFY_PATTERNS) {
         if (pattern.test(opts.command)) {
+            emitFailed(`Command blocked: ${reason}`);
             return {
                 ok: false,
                 exitCode: -1,
@@ -75,6 +97,7 @@ export async function verify(opts) {
             const so = Buffer.concat(outChunks).toString('utf-8').slice(0, MAX_VERIFY_BYTES);
             const se = Buffer.concat(errChunks).toString('utf-8').slice(0, MAX_VERIFY_BYTES);
             const raw = se + '\n' + so;
+            emitFailed('[verify timeout]');
             resolve({
                 ok: false,
                 exitCode: -1,
@@ -96,10 +119,12 @@ export async function verify(opts) {
             const se = Buffer.concat(errChunks).toString('utf-8').slice(0, MAX_VERIFY_BYTES);
             const exit = typeof code === 'number' ? code : -1;
             if (exit === 0) {
+                emitSucceeded();
                 resolve({ ok: true, exitCode: 0, stdout: so, stderr: se });
                 return;
             }
             const failure = detect(so, se, exit);
+            emitFailed(failure.type);
             resolve({ ok: false, exitCode: exit, stdout: so, stderr: se, failure });
         });
     });

package/dist/verification/registry.js

@@ -5,6 +5,7 @@
  */
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { filteredEnv as siblingFilteredEnv } from '../tools/shell/shell-exec.js';
 function exists(p) {
     try {
         return fs.existsSync(p);
@@ -115,10 +116,13 @@ export function primaryVerifyCommand(cwd) {
 }
 // S2 — filtered env for ALL spawned verify commands.
 //
-// Sibling `tools/shell/shell-exec.ts` owns an equivalent `filteredEnv` but
-// does not export it, so this mirrors that filter (allowlisted prefixes +
-// exact keys, secret-ish names stripped, preload vectors deleted) instead of
-// importing sibling internals.
+// Delegates to the sibling-owned `filteredEnv` from
+// `tools/shell/shell-exec.ts` (EXACT export name — verified via grep) for
+// the allowlist base, then applies this module's stricter secret strip
+// (sibling only strips SECRET/TOKEN + named keys; verify children also
+// strip KEY-shaped names like NODE_API_KEY) plus the Windows shell vars a
+// spawned shell needs (SystemRoot/COMSPEC/...) and preload-vector deletes.
+// `filteredVerifyEnv` already exists — reuse it, don't duplicate it.
 const VERIFY_ENV_PREFIXES = ['PATH', 'HOME', 'USER', 'SHELL', 'TERM', 'LANG', 'NODE_', 'NPM_', 'PNPM_', 'YARN_'];
 // Exact keys: sibling's PWD/TMPDIR/TEMP plus the Windows OS vars a spawned
 // shell needs to start (COMSPEC/SystemRoot/PATHEXT/...) — none carry secrets.
@@ -130,7 +134,14 @@ const VERIFY_ENV_EXACT = new Set([
 const VERIFY_ENV_SECRET_RE = /SECRET|TOKEN|KEY/i;
 /** Filtered env for verify children: allowlist + secret strip + preload-vector delete. */
 export function filteredVerifyEnv() {
-    const out = {};
+    // Sibling-owned base (allowlisted prefixes + secret strip).
+    const out = { ...siblingFilteredEnv() };
+    // Harden beyond the sibling: strip KEY-shaped names the sibling passes
+    // through (e.g. NODE_API_KEY) before overlaying our own allowlist.
+    for (const k of Object.keys(out)) {
+        if (VERIFY_ENV_SECRET_RE.test(k))
+            delete out[k];
+    }
     for (const [k, v] of Object.entries(process.env)) {
         if (v === undefined)
             continue;

package/dist/verification/scoped.js

@@ -78,14 +78,45 @@ export function buildScopedCommand(cwd, baseCommand, relatedTests) {
     if (baseCommand.includes('pytest')) {
         return `pytest ${safe.map((f) => `"${f}"`).join(' ')}`;
     }
-    if (baseCommand.includes('go test')) {
-        // go test ./... with file filter — fallback to full
-        return null;
-    }
     if (baseCommand.includes('cargo test')) {
-        // cargo test --test <name>
+        // Cargo keeps the full suite: `cargo test` selects by test-target name
+        // (`--test <name>`), lib/bin unit-test filters, or `-- <filter>` args —
+        // none of which map 1:1 onto file paths. Interpolating a file path as a
+        // filter would silently run the WRONG subset (substring match against
+        // test names), so fall back to the full suite rather than lie about
+        // coverage. (Checked before the `go test` branch: "cargo test" contains
+        // the substring "go test".)
         return null;
     }
+    // NOTE: `baseCommand.includes('go test')` must stay AFTER the cargo branch
+    // above — "cargo test" contains "go test" as a substring.
+    if (baseCommand.includes('go test')) {
+        // Go has no file-scoped test selection: `go test` takes package
+        // patterns, not file paths (passing `foo_test.go` directly errors with
+        // "no Go files in ..."). Derive `go test ./<pkgdirs...>` from the
+        // directories of the related test files instead: dedupe, cap 10, and
+        // reuse the same containment-validated `safe` list as every other
+        // branch (untrusted paths never reach the shell).
+        const dirs = [];
+        const seen = new Set();
+        for (const f of safe) {
+            const d = path.dirname(f);
+            const pkg = d === '.' ? '.' : `./${d.split(path.sep).join('/')}`;
+            if (!seen.has(pkg)) {
+                seen.add(pkg);
+                dirs.push(pkg);
+            }
+            if (dirs.length >= 10)
+                break;
+        }
+        if (dirs.length === 0)
+            return null;
+        // Preserve a './...'-style base by replacing it; otherwise append.
+        if (baseCommand.includes('./...')) {
+            return baseCommand.replace('./...', dirs.join(' '));
+        }
+        return `${baseCommand} ${dirs.join(' ')}`;
+    }
     return null;
 }
 const MAX_SCOPED_BYTES = 256 * 1024;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "klyro",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Klyro — autonomous coding harness CLI that streams from any OpenAI-compatible or Anthropic LLM endpoint.",
   "type": "module",
   "main": "dist/index.js",