klyro 1.0.14 → 1.0.17

package/README.md

@@ -51,6 +51,7 @@ node dist/index.js chat
 | `KLYRO_YES` / `--yes` | **Commit only** — auto-approves `klyro commit` prompts; nothing else reads it |
 | `KLYRO_NO_UPDATE_CHECK=1` | Disables the 24h update check |
 | `KLYRO_ALLOW_MAIN_PUSH=1` | Per-risk escape for protected-branch push |
+| `KLYRO_TRUST_PROJECT_HOOKS=1` | Per-shell opt-in to run repo-authored `.klyro/hooks.json` commands without pinning them via `klyro hooks trust` |
 | `KLYRO_CREDENTIALS_INSECURE_OK=1` | Warn (don't refuse) on group-readable credentials |
 | `KLYRO_LSP=0` | Force language tools off |
 | `KLYRO_SYMBOLS=0` | Force `find_symbol` off |
@@ -60,6 +61,7 @@ node dist/index.js chat
 ## New in recent releases
 
 - `klyro run --bare` — deterministic runs: skips MCP, hooks, memory/KLYRO.md/context, persistence
+- `klyro hooks trust` — project `.klyro/hooks.json` commands run only after explicit review: the file is hash-pinned in `~/.klyro/trusted-hooks.json` and any edit re-locks it (a cloned repo can no longer execute code just because you ran `klyro` in it)
 - `klyro mcp trust <name>` / `mcp prompts [server]` / `mcp add <name> <https-url>` — remote MCP + prompt trust
 - `klyro agents lint` — validate `.klyro/agents/*.md` (ids, tool names)
 - `klyro init` — scan-seeded `KLYRO.md` + `.mcp.json` (never overwrites)
@@ -72,13 +74,20 @@ node dist/index.js chat
 
 ## Documentation
 
+Progress: Klyro is **complete through Level 10** ("Klyro 1.0" milestone) of the
+20-level plan; see [`docs/STATUS.md`](docs/STATUS.md) for the audited
+level-by-level grading.
+
 | Doc | Purpose |
 |---|---|
-| [`docs/done.md`](docs/done.md) | **Status** — what's built, what's verified, what isn't |
-| [`docs/plan.md`](docs/plan.md) | **Roadmap** — 20-level plan from bare CLI to super-harness |
-| [`docs/PRD.md`](docs/PRD.md) | (authoritative) product vision |
-| [`docs/HarnessFlow.md`](docs/HarnessFlow.md) | (authoritative) system flow |
-| [`docs/MVP.md`](docs/MVP.md) | (authoritative) MVP scope |
+| [`docs/STATUS.md`](docs/STATUS.md) | **Status (authoritative)** — release state + plan level progress |
+| [`plan.md`](plan.md) | **Roadmap** — 20-level / 100-sub-level plan from bare CLI to super-harness |
+| [`PRD.md`](PRD.md) | Product vision and requirements |
+| [`READ.md`](READ.md) | Full build documentation / architecture walkthrough |
+| [`review.md`](review.md) | Point-in-time repository review (1.0.9) |
+| [`comparison.md`](comparison.md) | Architectural audit vs Claude Code (36 rounds) |
+| [`commands.md`](commands.md) | CLI + slash-command reference |
+| [`TUI_DESIGN.md`](TUI_DESIGN.md) | TUI design notes (layout, scroll model) |
 
 ## Code structure
 

package/dist/agent/anthropic-adapter.js

@@ -17,6 +17,8 @@
  */
 import { assertSafeBaseURL } from '../chat.js';
 import { parseRetryAfterMs } from './provider-adapter.js';
+import { estimateTokens } from '../context/tokenizer.js';
+import { proxiedFetch } from '../shared/proxy.js';
 const DEFAULT_VERSION = '2023-06-01';
 const DEFAULT_TIMEOUT_MS = 120_000;
 export const PROMPT_CACHING_BETA = 'prompt-caching-2024-07-31';
@@ -40,7 +42,7 @@ export function anthropicAdapter(opts) {
     const betas = [...(opts.betas ?? [])];
     if (promptCache && !betas.includes(PROMPT_CACHING_BETA))
         betas.push(PROMPT_CACHING_BETA);
-    const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+    const fetchImpl = opts.fetchImpl ?? proxiedFetch;
     if (!fetchImpl) {
         throw new Error('anthropicAdapter: no fetch available — pass opts.fetchImpl or run on Node 18+');
     }
@@ -52,6 +54,29 @@ export function anthropicAdapter(opts) {
                 fetchImpl, version, authHeader, betas, promptCache,
             });
         },
+        // 2.1 — capability discovery via the Anthropic Models API.
+        // Returns [] when unavailable (callers fall back to configured ids).
+        async listModels() {
+            try {
+                const headers = { 'anthropic-version': version };
+                if (authHeader === 'x-api-key')
+                    headers['x-api-key'] = opts.apiKey;
+                else
+                    headers['Authorization'] = `Bearer ${opts.apiKey}`;
+                const res = await fetchImpl(`${baseURL}/v1/models`, { headers });
+                if (!res.ok)
+                    return [];
+                const json = (await res.json());
+                const ids = Array.isArray(json.data) ? json.data.map((m) => m.id).filter((id) => typeof id === 'string' && id.length > 0) : [];
+                return [...new Set(ids)];
+            }
+            catch {
+                return [];
+            }
+        },
+        countTokens(text) {
+            return estimateTokens(text);
+        },
     };
 }
 /**

package/dist/agent/child-worker.js

@@ -33,6 +33,11 @@ import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { existsSync } from 'node:fs';
 import { run } from './runtime.js';
+import { cappedOutput } from '../shared/output-cap.js';
+/** Child results are ONE JSON line, but a misbehaving child can print forever. */
+const MAX_CHILD_STDOUT_BYTES = 8 * 1024 * 1024;
+/** stderr keeps its TAIL — callers slice(-500/-1000) for the failure reason. */
+const MAX_CHILD_STDERR_CHARS = 16_000;
 /**
  * Differently-phrased crash, distinct from an in-process throw the parent
  * would catch. The child either exited non-zero without a parseable result
@@ -81,12 +86,18 @@ export async function forkChild(entry, payload, opts = {}) {
         windowsHide: true,
         shell: false,
     });
-    let stdout = '';
+    const stdoutCap = cappedOutput(MAX_CHILD_STDOUT_BYTES);
     let stderr = '';
     child.stdout.setEncoding('utf8');
     child.stderr.setEncoding('utf8');
-    child.stdout.on('data', (c) => { stdout += c; });
-    child.stderr.on('data', (c) => { opts.onStderr?.(c); stderr += c; });
+    // Keep the HEAD of stdout (the ChildResult line) and the TAIL of stderr
+    // (where the reason lives), so neither can grow the parent's heap without
+    // bound over the child's 10-minute budget.
+    child.stdout.on('data', (c) => { stdoutCap.push(Buffer.from(c, 'utf8')); });
+    child.stderr.on('data', (c) => {
+        opts.onStderr?.(c);
+        stderr = (stderr + c).slice(-MAX_CHILD_STDERR_CHARS);
+    });
     // Write the payload to stdin, then signal EOF so the child knows it has
     // the whole payload before it starts running.
     child.stdin.on('error', () => { });
@@ -119,7 +130,7 @@ export async function forkChild(entry, payload, opts = {}) {
         });
         child.on('close', (code, signal) => {
             cleanup();
-            const first = stdout.split('\n').find((l) => l.trim().length > 0);
+            const first = stdoutCap.text().split('\n').find((l) => l.trim().length > 0);
             if (code === 0 && first) {
                 try {
                     resolve(JSON.parse(first));

package/dist/agent/provider-adapter.d.ts

@@ -68,11 +68,17 @@ export interface CallRequest {
     tools: ToolDefinition[];
     maxTokens?: number;
     temperature?: number;
+    /** Reasoning effort for reasoning models ( OpenAI `reasoning_effort` ); adapters that lack the concept ignore it. */
+    reasoningEffort?: 'low' | 'medium' | 'high';
     signal?: AbortSignal;
 }
 export interface ProviderAdapter {
     readonly id: string;
     stream(req: CallRequest): AsyncIterable<StreamEvent>;
+    /** Optional capability discovery: model ids (2.1). Absent = unknown, use configured ids. */
+    listModels?(): Promise<string[]>;
+    /** Optional local token estimate (2.1). Absent = caller estimates. */
+    countTokens?(text: string): number | Promise<number>;
 }
 export interface HttpAdapterOptions {
     baseURL: string;
@@ -110,6 +116,7 @@ interface ChatCompletionsRequest {
     }>;
     max_tokens?: number;
     temperature?: number;
+    reasoning_effort?: 'low' | 'medium' | 'high';
     stream: true;
 }
 /**

package/dist/agent/provider-adapter.js

@@ -11,6 +11,8 @@
  * runtime loop sees one shape regardless of provider quirks.
  */
 import { redact } from '../policy/secret-redactor.js';
+import { estimateTokens } from '../context/tokenizer.js';
+import { proxiedFetch } from '../shared/proxy.js';
 const DEFAULT_TIMEOUT_MS = 120_000;
 /**
  * Parse a `Retry-After` response header value into milliseconds.
@@ -157,6 +159,8 @@ export function buildChatCompletionsBody(req) {
         body.max_tokens = req.maxTokens;
     if (typeof req.temperature === 'number')
         body.temperature = req.temperature;
+    if (req.reasoningEffort)
+        body.reasoning_effort = req.reasoningEffort;
     if (req.tools.length) {
         body.tools = req.tools.map((t) => ({
             type: 'function',
@@ -166,13 +170,34 @@ export function buildChatCompletionsBody(req) {
     return body;
 }
 export function httpChatAdapter(opts) {
-    const fetchImpl = opts.fetchImpl ?? fetch;
+    const fetchImpl = opts.fetchImpl ?? proxiedFetch;
     const url = `${opts.baseURL.replace(/\/+$/, '')}/chat/completions`;
     return {
         id: 'http-chat',
         stream(req) {
             return streamChatCompletions(url, opts, req, fetchImpl);
         },
+        // 2.1 — capability discovery: list model ids via OpenAI /models.
+        // Returns [] when the endpoint doesn't serve a model list (not an
+        // error: callers fall back to configured ids).
+        async listModels() {
+            try {
+                const res = await fetchImpl(`${opts.baseURL.replace(/\/+$/, '')}/models`, {
+                    headers: opts.apiKey ? { Authorization: `Bearer ${opts.apiKey}` } : {},
+                });
+                if (!res.ok)
+                    return [];
+                const json = (await res.json());
+                const ids = Array.isArray(json.data) ? json.data.map((m) => m.id).filter((id) => typeof id === 'string' && id.length > 0) : [];
+                return [...new Set(ids)];
+            }
+            catch {
+                return [];
+            }
+        },
+        countTokens(text) {
+            return estimateTokens(text);
+        },
     };
 }
 async function* streamChatCompletions(url, opts, req, fetchImpl) {

package/dist/agent/runtime.d.ts

@@ -83,6 +83,7 @@ export interface RunOptions {
     maxTimeMs?: number;
     maxTokens?: number;
     temperature?: number;
+    reasoningEffort?: 'low' | 'medium' | 'high';
     signal?: AbortSignal;
     nonInteractive: boolean;
     /**
@@ -157,6 +158,12 @@ export interface RunOptions {
         allowedPaths?: readonly string[];
         model?: string;
     };
+    /**
+     * Root sandbox extensions (--add-dir): extra resolvable roots for file
+     * tools, merged with cwd. Child scopes (parentContext.allowedPaths) still
+     * narrow further when present.
+     */
+    allowedPaths?: readonly string[];
     /**
      * Delegation bridge (P0). Present on the root run so the model can call
      * spawn_agent / task_list / task_get. The tool layer reads it from the

package/dist/agent/runtime.js

@@ -223,18 +223,6 @@ export async function run(opts, deps) {
     const sessionId = opts.persist?.sessionId;
     // 6.1 baseline cache per HEAD — capture before first edit
     let baselinePrimed = false;
-    async function primeBaseline() {
-        if (baselinePrimed)
-            return;
-        baselinePrimed = true;
-        const cmd = opts.verify?.command ?? detectVerifyCommand(opts.cwd);
-        if (!cmd)
-            return;
-        try {
-            await ensureBaseline(opts.cwd, cmd);
-        }
-        catch { /* ignore */ }
-    }
     async function checkpoint(msg, obs) {
         if (!store || !sessionId)
             return;
@@ -319,6 +307,11 @@ export async function run(opts, deps) {
             // Abort cascade (fix: background shells must not outlive the run).
             const killed = killAllJobs();
             emitKlyro({ type: 'abort', ts: Date.now(), sessionId: sessionId ?? 'ephemeral', reason: killed.length > 0 ? `aborted by operator (${killed.length} background job(s) killed)` : 'aborted by operator' });
+            // 2.4 — explicit interrupted marker: partial output stays labeled in
+            // the transcript so resume/replay never mistakes it for final text.
+            const interruptedNote = { role: 'user', content: [text('[system note] Interrupted by user — output above is partial and preserved.')] };
+            transcript.push(interruptedNote);
+            await checkpoint(interruptedNote);
             if (store && sessionId) {
                 try {
                     await store.setStatus(sessionId, 'aborted', finalText);
@@ -399,23 +392,22 @@ export async function run(opts, deps) {
             tools: toolDefinitions(deps.registry),
             ...(opts.maxTokens ? { maxTokens: opts.maxTokens } : {}),
             ...(typeof opts.temperature === 'number' ? { temperature: opts.temperature } : {}),
+            ...(opts.reasoningEffort ? { reasoningEffort: opts.reasoningEffort } : {}),
             ...(opts.signal ? { signal: opts.signal } : {}),
         };
         const events = activeAdapter.stream(req);
         let textBuf = '';
         // Thinking is ephemeral: streamed to the UI live, never stored in the
         // transcript, and cleared when the turn's answer completes.
-        let thinkingBuf = '';
         const pendingToolCalls = new Map();
-        let lastFinishReason;
         // Set when this step's request must be re-issued after overflow recovery.
         let overflowRetryPending = false;
         // Set when a terminal provider error consumed a failover adapter — the
         // step is re-issued against the next adapter without consuming budget.
         let failoverPending = false;
-        let failoverFrom = '';
-        let failoverTo = '';
-        let failoverReason = '';
+        let failoverFrom;
+        let failoverTo;
+        let failoverReason;
         for await (const ev of events) {
             if (opts.signal?.aborted)
                 break outer;
@@ -424,7 +416,6 @@ export async function run(opts, deps) {
                 emit?.({ kind: 'text_delta', text: ev.text });
             }
             else if (ev.kind === 'thinking_delta') {
-                thinkingBuf += ev.text;
                 emit?.({ kind: 'thinking_delta', text: ev.text });
             }
             else if (ev.kind === 'tool_call_start') {
@@ -441,7 +432,6 @@ export async function run(opts, deps) {
                 // tool_calls are accumulated; finalization happens after stream.
             }
             else if (ev.kind === 'message_end') {
-                lastFinishReason = ev.finishReason;
                 if (ev.usage) {
                     usage.input += ev.usage.input;
                     usage.output += ev.usage.output;
@@ -553,9 +543,7 @@ export async function run(opts, deps) {
         if (failoverPending) {
             failoverPending = false;
             textBuf = '';
-            thinkingBuf = '';
             pendingToolCalls.clear();
-            lastFinishReason = undefined;
             steps--;
             emit?.({ kind: 'step_end', step: steps + 1 });
             continue outer;
@@ -613,6 +601,10 @@ export async function run(opts, deps) {
             emit?.({ kind: 'aborted' });
             const killed = killAllJobs();
             emitKlyro({ type: 'abort', ts: Date.now(), sessionId: sessionId ?? 'ephemeral', reason: killed.length > 0 ? `aborted by operator (${killed.length} background job(s) killed)` : 'aborted by operator' });
+            // 2.4 — explicit interrupted marker (see loop-top abort).
+            const interruptedNote = { role: 'user', content: [text('[system note] Interrupted by user — output above is partial and preserved.')] };
+            transcript.push(interruptedNote);
+            await checkpoint(interruptedNote);
             if (store && sessionId) {
                 try {
                     await store.setStatus(sessionId, 'aborted', finalText);
@@ -907,6 +899,7 @@ export async function run(opts, deps) {
                 : {}),
             agentDepth: opts.parentContext?.depth ?? 0,
             agentMaxDepth: opts.parentContext?.maxDepth ?? 1,
+            ...(opts.allowedPaths ? { agentAllowedPaths: opts.allowedPaths } : {}),
             ...(opts.parentContext?.allowedTools ? { agentAllowedTools: opts.parentContext.allowedTools } : {}),
             ...(opts.parentContext?.allowedPaths ? { agentAllowedPaths: opts.parentContext.allowedPaths } : {}),
             ...(opts.parentContext?.model ?? opts.model ? { agentModel: opts.parentContext?.model ?? opts.model } : {}),
@@ -1308,6 +1301,10 @@ export async function run(opts, deps) {
     }
     if (opts.signal?.aborted) {
         emit?.({ kind: 'aborted' });
+        // 2.4 — explicit interrupted marker (see loop-top abort).
+        const interruptedNote = { role: 'user', content: [text('[system note] Interrupted by user — output above is partial and preserved.')] };
+        transcript.push(interruptedNote);
+        await checkpoint(interruptedNote);
         if (store && sessionId) {
             try {
                 await store.setStatus(sessionId, 'aborted', finalText);

package/dist/chat.js

@@ -20,6 +20,16 @@
  */
 /** Default request timeout: 60s. */
 const DEFAULT_TIMEOUT_MS = 60_000;
+/**
+ * Legacy output flows through the shared terminal renderer (3.1): all
+ * human output leaves via the renderer module, which also sanitizes
+ * control sequences out of model text.
+ */
+import { TerminalRenderer, writeStdoutDrained } from './renderers/terminal.js';
+const renderer = new TerminalRenderer();
+function frame(text) {
+    renderer.handle({ type: 'stream.delta', ts: Date.now(), sessionId: 'legacy-chat', text });
+}
 /** Max bytes of an error response body we will print. */
 const MAX_ERROR_BODY_BYTES = 4_000;
 /** Strip a trailing slash so we can append /chat/completions cleanly. */
@@ -187,7 +197,7 @@ export async function streamToStdout(body, signal) {
     const reader = body.getReader();
     const decoder = new TextDecoder('utf-8');
     let buf = '';
-    process.stdout.write('\n');
+    frame('\n');
     try {
         while (true) {
             if (signal.aborted)
@@ -209,7 +219,7 @@ export async function streamToStdout(body, signal) {
                         continue;
                     const data = line.slice(5).trim();
                     if (data === '[DONE]') {
-                        process.stdout.write('\n');
+                        frame('\n');
                         return;
                     }
                     // Handle case where data was split across chunks and reassembled as event
@@ -224,7 +234,7 @@ export async function streamToStdout(body, signal) {
                     }
                     const text = parsed.choices?.[0]?.delta?.content;
                     if (text) {
-                        if (!await writeWithBackpressure(text, signal)) {
+                        if (!await writeStdoutDrained(text, signal)) {
                             try {
                                 await reader.cancel();
                             }
@@ -246,7 +256,7 @@ export async function streamToStdout(body, signal) {
                         continue;
                     const data = line.slice(5).trim();
                     if (data === '[DONE]') {
-                        process.stdout.write('\n');
+                        frame('\n');
                         return;
                     }
                     if (data === '')
@@ -255,7 +265,7 @@ export async function streamToStdout(body, signal) {
                         const parsed = JSON.parse(data);
                         const text = parsed.choices?.[0]?.delta?.content;
                         if (text) {
-                            if (!await writeWithBackpressure(text, signal)) {
+                            if (!await writeStdoutDrained(text, signal)) {
                                 try {
                                     await reader.cancel();
                                 }
@@ -270,7 +280,7 @@ export async function streamToStdout(body, signal) {
                 }
             }
         }
-        process.stdout.write('\n');
+        frame('\n');
     }
     finally {
         try {
@@ -281,56 +291,6 @@ export async function streamToStdout(body, signal) {
         }
     }
 }
-/**
- * Write to stdout and wait for the drain event if the buffer is full.
- * Returns false if stdout has been closed (e.g. piped to `head`).
- * Respects abort signal — resolves false if aborted while waiting.
- */
-function writeWithBackpressure(chunk, signal) {
-    return new Promise((resolve) => {
-        if (signal?.aborted) {
-            resolve(false);
-            return;
-        }
-        if (!process.stdout.write(chunk)) {
-            let settled = false;
-            const cleanup = () => {
-                process.stdout.off('drain', onDrain);
-                process.stdout.off('error', onError);
-                if (signal)
-                    signal.removeEventListener('abort', onAbort);
-            };
-            const onDrain = () => {
-                if (settled)
-                    return;
-                settled = true;
-                cleanup();
-                resolve(true);
-            };
-            const onError = () => {
-                if (settled)
-                    return;
-                settled = true;
-                cleanup();
-                resolve(false);
-            };
-            const onAbort = () => {
-                if (settled)
-                    return;
-                settled = true;
-                cleanup();
-                resolve(false);
-            };
-            process.stdout.once('drain', onDrain);
-            process.stdout.once('error', onError);
-            if (signal)
-                signal.addEventListener('abort', onAbort, { once: true });
-        }
-        else {
-            resolve(true);
-        }
-    });
-}
 /**
  * Read up to `max` bytes from a response body. Used for error responses where
  * we want to surface the cause without risking OOM on a misbehaving server.

package/dist/checkpoints/store.js

@@ -14,6 +14,7 @@ import * as fs from 'node:fs/promises';
 import * as fsSync from 'node:fs';
 import * as path from 'node:path';
 import * as crypto from 'node:crypto';
+import { cappedOutput } from '../shared/output-cap.js';
 function ckptDir(cwd) {
     return path.join(cwd, '.klyro', 'checkpoints');
 }
@@ -107,7 +108,7 @@ export async function snapshot(cwd, files) {
         const args = ['diff', '--', ...kept.slice(0, 20)];
         const diffText = await new Promise((resolve) => {
             const child = spawn('git', args, { cwd, shell: false, windowsHide: true });
-            const chunks = [];
+            const sink = cappedOutput(20 * 1024);
             let done = false;
             const t = setTimeout(() => {
                 if (!done) {
@@ -119,16 +120,13 @@ export async function snapshot(cwd, files) {
                     resolve('');
                 }
             }, 10_000);
-            child.stdout.on('data', (b) => {
-                if (Buffer.concat(chunks).length < 20 * 1024)
-                    chunks.push(b);
-            });
+            child.stdout.on('data', (b) => sink.push(b));
             child.on('close', () => {
                 if (done)
                     return;
                 done = true;
                 clearTimeout(t);
-                resolve(Buffer.concat(chunks).toString('utf-8').slice(0, 20 * 1024));
+                resolve(sink.text());
             });
             child.on('error', () => {
                 if (done)
@@ -214,9 +212,9 @@ export async function diff(cwd, id) {
     const { spawn } = await import('node:child_process');
     return new Promise((resolve) => {
         const child = spawn('git', ['diff', '--stat'], { cwd, shell: false, windowsHide: true });
-        let out = '';
-        child.stdout.on('data', (b) => { out += b.toString(); });
-        child.on('close', () => resolve(out || 'No diff'));
+        const sink = cappedOutput(64 * 1024);
+        child.stdout.on('data', (b) => sink.push(b));
+        child.on('close', () => resolve(sink.text() || 'No diff'));
         child.on('error', () => resolve('No git diff available'));
     });
 }

package/dist/cli/completion.js

@@ -19,9 +19,6 @@ const COMMAND_FLAGS = {
     completion: ['bash', 'zsh', 'fish', 'powershell'],
     resume: ['-m', '--model', '--max-steps'],
 };
-function flagsFor(cmd) {
-    return [...GLOBAL_FLAGS, ...(COMMAND_FLAGS[cmd] ?? [])];
-}
 function bashScript() {
     const cmdCases = Object.entries(COMMAND_FLAGS)
         .map(([c, fs]) => `      ${c}) opts="${fs.join(' ')}" ;;`)

package/dist/cli/config.js

@@ -328,6 +328,91 @@ export function loadConfigSync() {
     }
     return {};
 }
+/**
+ * Project-layer trust boundary (P1): `.klyro/settings*.json` ship with the
+ * repo, so a hostile checkout can plant them. API keys are NEVER accepted
+ * from project layers — keys load only from ~/.klyro, env, or flags. A
+ * project baseUrl pointing at a public host (which would receive the user's
+ * key + prompts) warns loudly; loopback/RFC1918 stay silent for shared
+ * local setups (Ollama etc.).
+ */
+function isPublicHostUrl(raw) {
+    let host = '';
+    try {
+        host = new URL(raw).hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    }
+    catch {
+        return true; // unparseable endpoint — treat as hostile, warn
+    }
+    if (host === 'localhost' || host === '127.0.0.1' || host === '::1')
+        return false;
+    if (host.endsWith('.localhost') || host.endsWith('.local'))
+        return false;
+    if (host.startsWith('127.'))
+        return false;
+    if (/^10\.\d+\.\d+\.\d+$/.test(host))
+        return false;
+    if (/^192\.168\.\d+\.\d+$/.test(host))
+        return false;
+    if (/^172\.(1[6-9]|2\d|3[0-1])\.\d+\.\d+$/.test(host))
+        return false;
+    return true;
+}
+function scrubProjectLayer(obj, file) {
+    const warn = (msg) => {
+        try {
+            process.stderr.write(msg);
+        }
+        catch { /* ignore */ }
+    };
+    for (const k of ['apiKey', 'api_key']) {
+        if (obj[k] !== undefined) {
+            delete obj[k];
+            warn(`klyro: ignoring apiKey in project config ${file} — keys load only from ~/.klyro/settings.json, env (KLYRO_API_KEY), or --api-key\n`);
+        }
+    }
+    for (const k of ['baseUrl', 'baseURL']) {
+        const v = obj[k];
+        if (typeof v === 'string' && v.length > 0 && isPublicHostUrl(v)) {
+            warn(`klyro: warning: project config ${file} points the provider at ${v} — API requests (including your key) will go there\n`);
+        }
+    }
+    scrubProjectFailover(obj['providers'], file, warn);
+    return obj;
+}
+/**
+ * Failover entries from a project layer get the same trust treatment as the
+ * primary endpoint. Two reasons `apiKeyEnv` is dropped rather than warned
+ * about: (a) a fallback fires *without a prompt*, so a repo-chosen env var
+ * name would silently ship the user's credential to a repo-chosen host, and
+ * (b) the name can also cross providers (`provider:'openai'` + an Anthropic
+ * env var). A literal `apiKey` in project config is left alone — that is the
+ * repo's own key, not the user's secret — matching the accepted
+ * `providers.failover[].apiKey` behaviour. Keys for a project-authored
+ * fallback belong in ~/.klyro/settings.json.
+ */
+function scrubProjectFailover(providers, file, warn) {
+    if (providers === null || typeof providers !== 'object')
+        return;
+    const failover = providers.failover;
+    if (!Array.isArray(failover))
+        return;
+    for (const entry of failover) {
+        if (entry === null || typeof entry !== 'object')
+            continue;
+        const e = entry;
+        if (e['apiKeyEnv'] !== undefined) {
+            delete e['apiKeyEnv'];
+            warn(`klyro: ignoring apiKeyEnv in project config ${file} — a repo must not choose which env var holds your key; configure that fallback in ~/.klyro/settings.json\n`);
+        }
+        for (const k of ['baseURL', 'baseUrl']) {
+            const v = e[k];
+            if (typeof v === 'string' && v.length > 0 && isPublicHostUrl(v)) {
+                warn(`klyro: warning: project config ${file} routes a failover provider to ${v} — API requests (including your key) will go there\n`);
+            }
+        }
+    }
+}
 // --- Merged load with 5-layer precedence ---
 export async function loadMergedConfig(cwd = process.cwd(), flags = {}) {
     const layers = [];
@@ -351,7 +436,7 @@ export async function loadMergedConfig(cwd = process.cwd(), flags = {}) {
     try {
         const raw = await fs.readFile(path.join(cwd, '.klyro', 'settings.json'), 'utf-8');
         const obj = parseJsonc(raw, path.join(cwd, '.klyro/settings.json'));
-        layers.push(validateConfig(obj, path.join(cwd, '.klyro/settings.json')));
+        layers.push(scrubProjectLayer(validateConfig(obj, path.join(cwd, '.klyro/settings.json')), path.join(cwd, '.klyro/settings.json')));
     }
     catch (err) {
         const e = err;
@@ -362,7 +447,7 @@ export async function loadMergedConfig(cwd = process.cwd(), flags = {}) {
     try {
         const raw = await fs.readFile(path.join(cwd, '.klyro', 'settings.local.json'), 'utf-8');
         const obj = parseJsonc(raw, path.join(cwd, '.klyro/settings.local.json'));
-        layers.push(validateConfig(obj, path.join(cwd, '.klyro/settings.local.json')));
+        layers.push(scrubProjectLayer(validateConfig(obj, path.join(cwd, '.klyro/settings.local.json')), path.join(cwd, '.klyro/settings.local.json')));
     }
     catch (err) {
         const e = err;

package/dist/cli/doctor.d.ts

@@ -3,6 +3,19 @@
  * Runs quick diagnostics: node version, config, provider reachability,
  * persistence dir, git, tools.
  */
+/**
+ * Pure byte interpreter for `doctor --keys` (unit-tested): names what a
+ * terminal delivered so broken arrow/paste/scroll input becomes provable
+ * fact instead of guesswork. Covers arrows, paging/home/end, Ctrl codes,
+ * bracketed-paste markers, and SGR/X10 mouse sequences.
+ */
+export declare function describeKeyBytes(chunk: Buffer): string;
+/**
+ * Interactive key probe: raw-mode stdin echo of every chunk with its
+ * meaning. Proves what THIS terminal delivers for arrows, Ctrl+P/N,
+ * paste, and wheel — run it when TUI input misbehaves.
+ */
+export declare function runKeysProbe(): Promise<number>;
 export declare function runDoctor(opts?: {
     json?: boolean;
     cwd?: string;