klyro 1.0.13 → 1.0.16

package/dist/cli/update.js

@@ -112,9 +112,11 @@ export async function checkForUpdate(current) {
         const latest = json.version ?? '';
         // Downgrade protection: only ever recommend a strictly newer version.
         // A registry answering with an older-or-equal `latest` (stale mirror,
-        // cache poisoning, downgrade attack) is treated as "no update".
+        // cache poisoning, downgrade attack) — or a non-semver tag like
+        // "latest"/"next" (which would otherwise flow into `npm i -g klyro@…`)
+        // — is treated as "no update".
         const cmp = compareSemver(latest, current);
-        const isNewer = cmp === null ? latest !== current : cmp > 0;
+        const isNewer = cmp !== null && cmp > 0;
         if (latest && isNewer) {
             // Verify the tarball's integrity before caching/recommending this version.
             const verRes = await fetchWithTimeout(`${REGISTRY_BASE}/${encodeURIComponent(latest)}`);
@@ -126,9 +128,9 @@ export async function checkForUpdate(current) {
             await fs.writeFile(cache, JSON.stringify({ at: Date.now(), latest }), 'utf-8');
             return latest;
         }
-        if (latest && cmp !== null && cmp <= 0) {
-            // Refresh the negative cache so a poisoned answer isn't re-fetched
-            // every invocation for the next 24h.
+        if (latest && (cmp === null || cmp <= 0)) {
+            // Refresh the negative cache so a poisoned or non-semver answer isn't
+            // re-fetched every invocation for the next 24h.
             await fs.mkdir(path.dirname(cache), { recursive: true }).catch(() => undefined);
             await fs.writeFile(cache, JSON.stringify({ at: Date.now(), latest: current }), 'utf-8').catch(() => undefined);
         }
@@ -139,7 +141,6 @@ export async function checkForUpdate(current) {
     return null;
 }
 export async function runUpdate(opts = {}) {
-    const here = await import('../index.js').then(() => '');
     // Get version from package.json via dynamic import
     const { readFileSync } = await import('node:fs');
     const { resolve, dirname } = await import('node:path');
@@ -152,6 +153,15 @@ export async function runUpdate(opts = {}) {
         if (latest) {
             process.stdout.write(`Update available: ${cur} → ${latest} (integrity verified)\n  npm i -g klyro@latest\n`);
             if (opts.apply) {
+                // Defense in depth: the version string flows into a child process
+                // (with shell:true on Windows), so re-validate strict semver here
+                // even though checkForUpdate already gates on it. A non-semver
+                // string (registry compromise, cache tampering) must never reach
+                // the shell.
+                if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(latest)) {
+                    process.stderr.write(`klyro update: refusing to install non-semver version: ${latest}\n`);
+                    return 1;
+                }
                 // Opt-in self-apply: the tarball was already hash-verified by
                 // checkForUpdate, so npm installs exactly the verified version.
                 process.stdout.write(`Applying update to klyro@${latest}...\n`);

package/dist/eval/harness.d.ts

@@ -4,8 +4,9 @@
  * expected tool-call sequence, (b) the verification engine detects the
  * right failure type, and (c) the compressor preserves the goal.
  *
- * This is the MVP gate per Devolopment-plan.md / docs/plan.md §10: a
- * reproducible suite of programmatic tasks. Real repo tasks come in v1.0.
+ * This is the MVP gate per `plan.md` (§10, root of the repo — there is no
+ * `docs/plan.md`): a reproducible suite of programmatic tasks that later
+ * graduated into the fixture-backed file harness below.
  */
 import type { ProviderAdapter, StreamEvent } from '../agent/provider-adapter.js';
 export interface ScriptedTask {

package/dist/eval/harness.js

@@ -4,10 +4,14 @@
  * expected tool-call sequence, (b) the verification engine detects the
  * right failure type, and (c) the compressor preserves the goal.
  *
- * This is the MVP gate per Devolopment-plan.md / docs/plan.md §10: a
- * reproducible suite of programmatic tasks. Real repo tasks come in v1.0.
+ * This is the MVP gate per `plan.md` (§10, root of the repo — there is no
+ * `docs/plan.md`): a reproducible suite of programmatic tasks that later
+ * graduated into the fixture-backed file harness below.
  */
 import { run } from '../agent/runtime.js';
+import { cappedOutput } from '../shared/output-cap.js';
+/** Bounded capture for `check.sh` output — fixtures are project-authored. */
+const MAX_CHECK_BYTES = 64 * 1024;
 import { ToolRegistry } from '../tools/registry.js';
 import { readFileTool } from '../tools/fs/read-file.js';
 import { writeFileTool } from '../tools/fs/write-file.js';
@@ -189,15 +193,15 @@ export async function runFileFixture(fixture, opts = {}) {
     const { spawn } = await import('node:child_process');
     const result = await new Promise((resolve) => {
         const child = spawn('bash', ['-c', fixture.checkSh], { cwd: tmp, shell: false });
-        let out = '';
-        child.stdout?.on('data', (b) => { out += b.toString(); });
-        child.stderr?.on('data', (b) => { out += b.toString(); });
+        const sink = cappedOutput(MAX_CHECK_BYTES);
+        child.stdout?.on('data', (b) => sink.push(b));
+        child.stderr?.on('data', (b) => sink.push(b));
         child.on('close', (code) => {
             const pass = code === 0;
             resolve({
                 id: path.basename(fixture.dir),
                 status: pass ? 'pass' : 'fail',
-                details: out.slice(0, 500),
+                details: sink.text().slice(0, 500),
                 observedStatus: pass ? 'complete' : 'verify_failed',
                 durationMs: Date.now() - start,
             });
@@ -247,10 +251,10 @@ export async function runAgentFixture(fixture, opts = {}) {
         const { spawn } = await import('node:child_process');
         const out = await new Promise((resolve) => {
             const child = spawn('bash', ['-c', fixture.checkSh], { cwd: tmp, shell: false });
-            let buf = '';
-            child.stdout?.on('data', (b) => { buf += b.toString(); });
-            child.stderr?.on('data', (b) => { buf += b.toString(); });
-            child.on('close', (code) => resolve(`exit=${code ?? -1} ${buf.slice(0, 500)}`));
+            const sink = cappedOutput(MAX_CHECK_BYTES);
+            child.stdout?.on('data', (b) => sink.push(b));
+            child.stderr?.on('data', (b) => sink.push(b));
+            child.on('close', (code) => resolve(`exit=${code ?? -1} ${sink.text().slice(0, 500)}`));
             child.on('error', (err) => resolve(`spawn-error: ${String(err)}`));
         });
         if (!out.startsWith('exit=0')) {

package/dist/index.js

@@ -562,13 +562,33 @@ async function main() {
         const code = await serveStdio(process.cwd());
         process.exit(code);
     });
-    // 10.2 — Hooks: list configured preToolUse/postToolUse hooks.
-    program.command('hooks [cmd]').description('Hooks (10.2): `klyro hooks` or `klyro hooks list` prints configured hooks').action(async (cmd) => {
+    // 10.2 — Hooks: list, or trust/untrust the project hooks file.
+    program.command('hooks [cmd]').description('Hooks (10.2): `klyro hooks` lists them; `klyro hooks trust` pins the project hooks file so it runs').action(async (cmd) => {
+        const { loadHooks, trustProjectHooks, untrustProjectHooks, projectHooksStatus } = await import('./cli/hooks.js');
+        if (cmd === 'trust') {
+            try {
+                const { path: p, hash } = trustProjectHooks(process.cwd());
+                process.stdout.write(`trusted project hooks: ${p} (sha256 ${hash.slice(0, 12)}…, re-locks if edited)\n`);
+            }
+            catch (err) {
+                process.stderr.write(`klyro: ${err instanceof Error ? err.message : String(err)}\n`);
+                process.exit(2);
+            }
+            return;
+        }
+        if (cmd === 'untrust') {
+            const ok = untrustProjectHooks(process.cwd());
+            process.stdout.write(ok ? 'project hooks are no longer trusted\n' : 'project hooks were not trusted\n');
+            return;
+        }
         if (cmd && cmd !== 'list') {
-            process.stderr.write(`klyro: unknown hooks command: ${cmd} (usage: klyro hooks [list])\n`);
+            process.stderr.write(`klyro: unknown hooks command: ${cmd} (usage: klyro hooks [list|trust|untrust])\n`);
             process.exit(2);
         }
-        const { loadHooks } = await import('./cli/hooks.js');
+        const st = projectHooksStatus(process.cwd());
+        if (st.exists) {
+            process.stdout.write(`project hooks: ${st.path} [${st.trusted ? 'trusted' : 'NOT TRUSTED — review, then run `klyro hooks trust`'}]\n`);
+        }
         const hooks = loadHooks(process.cwd());
         if (hooks.length === 0) {
             process.stdout.write('hooks: none configured (.klyro/hooks.json, ~/.klyro/hooks.json)\n');

package/dist/mcp/client.js

@@ -26,6 +26,13 @@ const MAX_STDERR_BYTES = 8192;
 const CONNECT_TIMEOUT_MS = 15_000;
 /** Grace period between SIGTERM and SIGKILL in close(). */
 const CLOSE_SIGKILL_AFTER_MS = 2000;
+/**
+ * A single JSON-RPC frame (one newline-terminated line) is small. A server
+ * that streams megabytes with no frame boundary is broken or hostile; drop
+ * the partial line instead of buffering it without bound. The affected call
+ * then fails with its normal TIMEOUT instead of taking the harness down.
+ */
+const MAX_STDOUT_FRAME_BYTES = 8 * 1024 * 1024;
 export class McpClient {
     name;
     spec;
@@ -233,6 +240,11 @@ export class McpClient {
     }
     onStdout(chunk) {
         this.stdoutBuf += chunk;
+        if (this.stdoutBuf.length > MAX_STDOUT_FRAME_BYTES && this.stdoutBuf.indexOf('\n') === -1) {
+            // No frame boundary in megabytes: discard rather than grow the heap.
+            this.stdoutBuf = '';
+            return;
+        }
         let idx;
         while ((idx = this.stdoutBuf.indexOf('\n')) >= 0) {
             const line = this.stdoutBuf.slice(0, idx).trim();

package/dist/mcp/config.js

@@ -12,6 +12,7 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import { z } from 'zod';
+import { stripBom } from '../shared/json.js';
 /** MCP remote URL guard — https:// (or loopback http://) only. */
 export function assertSafeMcpUrl(url) {
     let parsed;
@@ -125,7 +126,7 @@ function normalizeRaw(raw) {
 }
 function readJsonFile(p) {
     try {
-        return JSON.parse(fs.readFileSync(p, 'utf-8'));
+        return JSON.parse(stripBom(fs.readFileSync(p, 'utf-8')));
     }
     catch {
         return undefined;

package/dist/mcp/serve.d.ts

@@ -1,6 +1,30 @@
+/**
+ * `klyro mcp serve` — expose the builtin tool registry as a minimal MCP
+ * server over stdio (newline-delimited JSON-RPC 2.0).
+ *
+ * Supported methods: `initialize`, `ping`, `tools/list`, `tools/call`.
+ * Every call is gated by the PolicyEngine (default config + builtin rules)
+ * in headless mode: `allow` runs, `deny`/`ask` are refused as tool errors
+ * (serve cannot prompt, so nothing privileged runs without an explicit
+ * allow rule) — serving never bypasses policy.
+ */
 import { type ToolRegistry } from '../tools/registry.js';
 import type { ToolContext } from '../tools/types.js';
 import { PolicyEngine } from '../policy/engine.js';
+/**
+ * Max bytes of one JSON-RPC line (defense in depth: readline-style
+ * unbounded buffering lets one giant message OOM the server).
+ */
+export declare const MAX_MCP_LINE_BYTES: number;
+/**
+ * Bounded newline-delimited reader. Lines longer than maxBytes are dropped
+ * (reported once as `{ tooLong: true }`) and the reader resyncs at the next
+ * newline; callers answer oversized messages with a JSON-RPC error instead
+ * of parsing unbounded input.
+ */
+export declare function readBoundedLines(input: NodeJS.ReadableStream, maxBytes?: number): AsyncGenerator<string | {
+    tooLong: true;
+}, void, void>;
 interface JsonRpcRequest {
     jsonrpc?: string;
     id?: string | number | null;

package/dist/mcp/serve.js

@@ -8,10 +8,44 @@
  * (serve cannot prompt, so nothing privileged runs without an explicit
  * allow rule) — serving never bypasses policy.
  */
-import * as readline from 'node:readline';
 import { builtinRegistry } from '../tools/registry.js';
 import { PolicyEngine, builtinRules, DEFAULT_POLICY_CONFIG } from '../policy/engine.js';
 import { readVersion } from '../version.js';
+/**
+ * Max bytes of one JSON-RPC line (defense in depth: readline-style
+ * unbounded buffering lets one giant message OOM the server).
+ */
+export const MAX_MCP_LINE_BYTES = 8 * 1024 * 1024;
+/**
+ * Bounded newline-delimited reader. Lines longer than maxBytes are dropped
+ * (reported once as `{ tooLong: true }`) and the reader resyncs at the next
+ * newline; callers answer oversized messages with a JSON-RPC error instead
+ * of parsing unbounded input.
+ */
+export async function* readBoundedLines(input, maxBytes = MAX_MCP_LINE_BYTES) {
+    let buf = Buffer.alloc(0);
+    let overlong = false;
+    for await (const chunk of input) {
+        buf = Buffer.concat([buf, typeof chunk === 'string' ? Buffer.from(chunk, 'utf-8') : chunk]);
+        let nl;
+        while ((nl = buf.indexOf(0x0a)) !== -1) {
+            const line = buf.subarray(0, nl);
+            buf = buf.subarray(nl + 1);
+            if (overlong) {
+                overlong = false; // drop the remainder of the oversized message
+                continue;
+            }
+            yield line.toString('utf-8');
+        }
+        if (buf.length > maxBytes) {
+            buf = Buffer.alloc(0);
+            overlong = true;
+            yield { tooLong: true };
+        }
+    }
+    if (buf.length > 0 && !overlong)
+        yield buf.toString('utf-8');
+}
 export function makeServeDeps(cwd, overrides = {}) {
     return {
         registry: overrides.registry ?? builtinRegistry(),
@@ -82,9 +116,12 @@ export async function handleMcpRequest(deps, msg) {
 /** Stdio loop: one JSON-RPC message per line on stdin, responses on stdout. */
 export async function serveStdio(cwd) {
     const deps = makeServeDeps(cwd);
-    const rl = readline.createInterface({ input: process.stdin, crlfDelay: Infinity });
-    for await (const line of rl) {
-        const trimmed = line.trim();
+    for await (const item of readBoundedLines(process.stdin)) {
+        if (typeof item !== 'string') {
+            process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id: null, error: { code: -32600, message: `Request too large (limit ${MAX_MCP_LINE_BYTES} bytes)` } }) + '\n');
+            continue;
+        }
+        const trimmed = item.trim();
         if (!trimmed)
             continue;
         let msg;

package/dist/persistence/audit.js

@@ -11,7 +11,7 @@
 import * as crypto from 'node:crypto';
 import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
-import { SessionStore } from './store.js';
+import { SessionStore, hasDangerousKeys } from './store.js';
 export const AUDIT_GENESIS = 'GENESIS';
 /** Canonical JSON: object keys sorted recursively, so hashes are stable. */
 export function canonicalJson(value) {
@@ -150,6 +150,13 @@ async function verifySegment(filePath, segmentLabel) {
         catch {
             return { events, error: `${segmentLabel}:${i + 1}: unparseable JSON` };
         }
+        // Fail closed on tampered shapes before any field is trusted: a line
+        // carrying prototype-pollution keys can never be a genuine record
+        // (the writer only emits AuditEvent shapes), so reject it outright
+        // rather than letting it reach the hash comparison.
+        if (hasDangerousKeys(parsed)) {
+            return { events, error: `${segmentLabel}:${i + 1}: dangerous keys (possible tampering)` };
+        }
         if (parsed.prevHash !== expectedPrev) {
             return { events, error: `${segmentLabel}:${i + 1}: prevHash mismatch (chain fork or truncation)` };
         }

package/dist/persistence/store.d.ts

@@ -99,6 +99,8 @@ export declare class SessionStore {
     /** Atomic append + fsync — survives crashes; suitable for audit log. */
     static appendJsonl(filePath: string, entry: unknown): Promise<void>;
 }
+/** True when any own key (at any depth) is a prototype-pollution key. */
+export declare function hasDangerousKeys(value: unknown): boolean;
 /**
  * Redact text blocks of a stored message at the persist boundary.
  * Handles string content, `{ text }` blocks, arrays of blocks, and plain

package/dist/persistence/store.js

@@ -395,6 +395,30 @@ export class SessionStore {
         }
     }
 }
+/**
+ * Keys that must never be copied by assignment: `out['__proto__'] = …`
+ * invokes the Object.prototype setter (pollution), and `constructor` /
+ * `prototype` walks can reach live prototypes. Tampered session content
+ * carrying them is dropped at the persist boundary.
+ */
+function isDangerousKey(k) {
+    return k === '__proto__' || k === 'constructor' || k === 'prototype';
+}
+/** True when any own key (at any depth) is a prototype-pollution key. */
+export function hasDangerousKeys(value) {
+    if (Array.isArray(value))
+        return value.some(hasDangerousKeys);
+    if (value && typeof value === 'object') {
+        const rec = value;
+        for (const k of Object.keys(rec)) {
+            if (isDangerousKey(k))
+                return true;
+            if (hasDangerousKeys(rec[k]))
+                return true;
+        }
+    }
+    return false;
+}
 /**
  * Redact text blocks of a stored message at the persist boundary.
  * Handles string content, `{ text }` blocks, arrays of blocks, and plain
@@ -424,6 +448,8 @@ export function redactStoredContent(content) {
         }
         const out = {};
         for (const [k, v] of Object.entries(rec)) {
+            if (isDangerousKey(k))
+                continue; // tampered key — drop, never assign
             out[k] = typeof v === 'string' ? redact(v) : (v && typeof v === 'object' ? redactStoredContent(v) : v);
         }
         return out;

package/dist/policy/secret-redactor.js

@@ -24,9 +24,9 @@ const PATTERNS = [
     // Generic provider keys — must be redacted even if not prefixed Bearer
     { name: 'openai-key', re: /sk-(?:proj-)?[A-Za-z0-9_-]{20,}/g },
     { name: 'anthropic-key', re: /sk-ant-[A-Za-z0-9_-]{20,}/g },
-    { name: 'api-key', re: /(?:api[_-]?key|apikey)\s*[:=]\s*['"]?[A-Za-z0-9_\-]{16,}['"]?/gi },
+    { name: 'api-key', re: /(?:api[_-]?key|apikey)\s*[:=]\s*['"]?[A-Za-z0-9_\-]{8,}['"]?/gi },
     { name: 'password', re: /(?:password|passwd|pwd)\s*[:=]\s*['"]?[^\s'"]{4,}['"]?/gi },
-    { name: 'secret-generic', re: /(?:secret|token)\s*[:=]\s*['"]?[A-Za-z0-9_\-+/=]{16,}['"]?/gi },
+    { name: 'secret-generic', re: /(?:secret|token)\s*[:=]\s*['"]?[A-Za-z0-9_\-+/=]{8,}['"]?/gi },
     { name: 'discord-token', re: /mfa\.[\w-]{84}|[MN][A-Za-z\d]{23}\.[\w-]{6}\.[\w-]{27}/g },
     { name: 'npm-token', re: /\bnpm_[A-Za-z0-9]{24,}/g },
     { name: 'sendgrid-key', re: /\bSG\.[\w-]{22}\.[\w-]{43}/g },

package/dist/shared/index.d.ts

@@ -1,3 +1,4 @@
 export * from './errors.js';
 export * from './types.js';
 export * from './sanitize.js';
+export * from './json.js';

package/dist/shared/index.js

@@ -1,3 +1,4 @@
 export * from './errors.js';
 export * from './types.js';
 export * from './sanitize.js';
+export * from './json.js';

package/dist/shared/json.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Strip a leading U+FEFF byte-order mark. Windows editors (e.g. Notepad)
+ * save JSON with a BOM by default; `JSON.parse` rejects it, so user-authored
+ * config files must be BOM-tolerant. Use this on every raw string read for
+ * config/threat-surface parsing.
+ */
+export declare function stripBom(text: string): string;

package/dist/shared/json.js

@@ -0,0 +1,9 @@
+/**
+ * Strip a leading U+FEFF byte-order mark. Windows editors (e.g. Notepad)
+ * save JSON with a BOM by default; `JSON.parse` rejects it, so user-authored
+ * config files must be BOM-tolerant. Use this on every raw string read for
+ * config/threat-surface parsing.
+ */
+export function stripBom(text) {
+    return text.charCodeAt(0) === 0xfeff ? text.slice(1) : text;
+}

package/dist/shared/output-cap.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Bounded output collector for child-process stdout/stderr.
+ *
+ * Mirrors the counter pattern already used by `tools/verify/run-verify.ts:66`.
+ * The naive alternative —
+ *
+ *   child.stdout.on('data', (b) => { if (Buffer.concat(chunks).length < CAP) chunks.push(b); });
+ *
+ * — re-concatenates everything on *every* chunk, so a chatty verifier (a test
+ * suite printing megabytes) burns O(n²) CPU and keeps paying that cost for the
+ * rest of the run even after the cap is reached; with no guard at all the heap
+ * grows without bound. `push` here is O(1) and stops storing after `capBytes`.
+ *
+ * Streams are deliberately NOT paused when full: pausing a piped stdout sends
+ * backpressure to the child, which can then block on write and never exit —
+ * the caller would hang until its own timeout. Draining and discarding is the
+ * safe trade: bounded memory, no hang.
+ */
+export interface CappedOutput {
+    /** Store `chunk` (partially, when it overflows the cap). O(1). */
+    push(chunk: Buffer): void;
+    /** True once a byte was dropped, or a chunk arrived after the cap was hit. */
+    readonly truncated: boolean;
+    /**
+     * Collected bytes decoded as UTF-8. Call once per run: the byte cap also
+     * bounds the character count, so no character slicing is needed.
+     */
+    text(): string;
+}
+export declare function cappedOutput(capBytes: number): CappedOutput;

package/dist/shared/output-cap.js

@@ -0,0 +1,28 @@
+export function cappedOutput(capBytes) {
+    const chunks = [];
+    let bytes = 0;
+    let truncated = false;
+    return {
+        push(chunk) {
+            if (bytes >= capBytes) {
+                truncated = true; // more output exists but is intentionally dropped
+                return;
+            }
+            const room = capBytes - bytes;
+            if (chunk.length > room) {
+                chunks.push(chunk.subarray(0, room));
+                bytes = capBytes;
+                truncated = true;
+                return;
+            }
+            chunks.push(chunk);
+            bytes += chunk.length;
+        },
+        get truncated() {
+            return truncated;
+        },
+        text() {
+            return Buffer.concat(chunks).toString('utf-8');
+        },
+    };
+}

package/dist/tools/web/web-fetch.d.ts

@@ -34,6 +34,15 @@ export interface WebFetchOutput {
 }
 /** Hard ceiling on downloaded bytes regardless of `maxChars`. */
 export declare const MAX_DOWNLOAD_BYTES: number;
+/**
+ * Expand an IPv4-mapped IPv6 host to its dotted quad, else null.
+ *
+ * `::ffff:169.254.169.254` and `::ffff:a9fe:a9fe` are the SAME address, but
+ * WHATWG URL stringifies the second form in hex — so a dotted-quad regex
+ * alone is bypassable by writing the mapped form. Returns the dotted quad for
+ * both spellings so every address check below sees one canonical shape.
+ */
+export declare function mappedIPv4(host: string): string | null;
 /**
  * Allow-list check for fetch targets. `https:` is always structurally OK;
  * `http:` is restricted to loopback/private hosts unless the user opts in

package/dist/tools/web/web-fetch.js

@@ -39,6 +39,25 @@ const InputSchema = z.object({
 export const MAX_DOWNLOAD_BYTES = 2 * 1024 * 1024;
 const DEFAULT_MAX_CHARS = 20_000;
 const DEFAULT_TIMEOUT_MS = 30_000;
+/**
+ * Expand an IPv4-mapped IPv6 host to its dotted quad, else null.
+ *
+ * `::ffff:169.254.169.254` and `::ffff:a9fe:a9fe` are the SAME address, but
+ * WHATWG URL stringifies the second form in hex — so a dotted-quad regex
+ * alone is bypassable by writing the mapped form. Returns the dotted quad for
+ * both spellings so every address check below sees one canonical shape.
+ */
+export function mappedIPv4(host) {
+    const dotted = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/.exec(host);
+    if (dotted)
+        return dotted[1];
+    const hex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(host);
+    if (!hex)
+        return null;
+    const hi = parseInt(hex[1], 16);
+    const lo = parseInt(hex[2], 16);
+    return `${hi >> 8}.${hi & 0xff}.${lo >> 8}.${lo & 0xff}`;
+}
 /**
  * Allow-list check for fetch targets. `https:` is always structurally OK;
  * `http:` is restricted to loopback/private hosts unless the user opts in
@@ -55,13 +74,30 @@ export function fetchUrlDenialReason(raw, env) {
     if (u.protocol !== 'https:' && u.protocol !== 'http:') {
         return `refusing non-http(s) URL scheme: ${u.protocol}`;
     }
-    const host = u.hostname.toLowerCase();
+    // WHATWG URL keeps IPv6 brackets in `hostname` (`[::1]`), so strip them
+    // once and compare bare hosts everywhere below.
+    const host = u.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    // Address view: unmap IPv4-mapped IPv6 so `[::ffff:0.0.0.0]` and
+    // `[::ffff:169.254.169.254]` cannot slip past the checks as hex strings.
+    const addr = mappedIPv4(host) ?? host;
+    // Unspecified addresses are never valid fetch targets (SSRF evasion
+    // vector — "this host" without naming it).
+    if (addr === '0.0.0.0' || addr === '::' || addr === '0:0:0:0:0:0:0:0') {
+        return `refusing unspecified destination address: ${u.hostname}`;
+    }
+    // Cloud metadata endpoints (169.254.0.0/16, any scheme): link-local
+    // IMDS services expose IAM credentials to any local requester. An agent
+    // tricked into fetching these exfiltrates cloud identity — deny always,
+    // even over https.
+    if (/^169\.254\.\d+\.\d+$/.test(addr)) {
+        return `refusing cloud metadata address: ${u.hostname}`;
+    }
     const loopback = host === 'localhost' ||
-        host === '127.0.0.1' ||
-        host === '::1' ||
-        /^10\./.test(host) ||
-        /^192\.168\./.test(host) ||
-        /^172\.(1[6-9]|2\d|3[01])\./.test(host);
+        addr === '127.0.0.1' ||
+        addr === '::1' ||
+        /^10\./.test(addr) ||
+        /^192\.168\./.test(addr) ||
+        /^172\.(1[6-9]|2\d|3[01])\./.test(addr);
     if (u.protocol === 'http:' && !loopback && env.KLYRO_ALLOW_INSECURE !== '1') {
         return 'refusing plaintext http for non-local host (use https or set KLYRO_ALLOW_INSECURE=1)';
     }

package/dist/tui/app.js

@@ -1052,30 +1052,23 @@ export function App(props) {
             void props.onSlash({ kind: 'quit' });
             return;
         }
-        // Contextual ↑/↓ (§8.3): both behaviors, split by where you are.
-        // Scrolled up reading the transcript (not at the live tail, not already
-        // browsing) → plain ↑ keeps scrolling so chat scroll is never lost.
-        // At the live tail (or no scroll surface) → ↑ browses input history
-        // newest-first, so send + ↑ restores the last prompt. ↓ is unchanged:
-        // browse newer while browsing, else scroll toward the tail.
-        if (key.upArrow && !key.shift && !key.ctrl) {
-            if (isFullscreen && maxTop > 0 && !atBottom && histIdx === null && input.trim() === '') {
-                commands.lineUp();
-                return;
-            }
+        // ↑/↓ are history keys, always (§8.3): ↑ browses older prompts
+        // newest-first (empty history → no-op), ↓ browses back newer. Neither
+        // ever scrolls the transcript — scrolling is PgUp/PgDn, Ctrl+U/D/B/F,
+        // Shift+↑/↓, Home/End, Space, or the wheel (KLYRO_MOUSE=1). Ctrl+P /
+        // Ctrl+N are escape-free aliases for the same history moves.
+        const wantHistPrev = (key.upArrow && !key.shift && !key.ctrl) || (key.ctrl && inputStr === 'p');
+        const wantHistNext = (key.downArrow && !key.shift && !key.ctrl) || (key.ctrl && inputStr === 'n');
+        if (wantHistPrev) {
             if (history.length > 0) {
                 const next = histIdx === null ? history.length - 1 : Math.max(0, histIdx - 1);
                 setHistIdx(next);
                 setInput(history[next] ?? '');
                 setVimCursor(null);
-                return;
-            }
-            if (isFullscreen && maxTop > 0) {
-                commands.lineUp();
-                return;
             }
+            return;
         }
-        if (key.downArrow && !key.shift && !key.ctrl) {
+        if (wantHistNext) {
             if (histIdx !== null) {
                 const next = histIdx + 1;
                 if (next >= history.length) {
@@ -1087,14 +1080,8 @@ export function App(props) {
                     setInput(history[next] ?? '');
                 }
                 setVimCursor(null);
-                return;
-            }
-            if (input.trim() !== '')
-                return; // single line with text, nothing newer
-            if (isFullscreen && maxTop > 0) {
-                commands.lineDown();
-                return;
             }
+            return;
         }
         // Enter on empty input dismisses the badge (jump to bottom, §7.2)
         if (key.return) {