klyro 1.0.16 → 1.0.17

package/dist/cli/repl.js

@@ -103,6 +103,7 @@ export async function startRepl(opts = {}) {
     // sanitizeForPrompt in sibling-owned policy/approval.ts — intentionally
     // not imported; kept local to avoid coupling the REPL to that module).
     function sanitizeForPrompt(s) {
+        // eslint-disable-next-line no-control-regex -- intentional: stripping C0 controls + CSI sequences
         return s.replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]|\x1b\[[0-9;]*[A-Za-z]/g, '').slice(0, 120);
     }
     async function loadMcpTools() {
@@ -190,7 +191,7 @@ export async function startRepl(opts = {}) {
     // become fallback adapters for agent runs in this session. Live
     // /provider switches rebuild a single adapter (buildAdapter) and bypass
     // the chain — documented, not a bug.
-    let replFailoverAdapters = [];
+    const replFailoverAdapters = [];
     try {
         const { resolveProviderChain } = await import('./config.js');
         const chain = await resolveProviderChain(cwd);
@@ -372,11 +373,12 @@ export async function startRepl(opts = {}) {
     // ── Full-screen takeover like OpenCode — always when klyro in TTY (user explicitly wants it)
     // Scroll now works correctly via internal viewport, not native terminal scroll
     const isAltScreen = useTui && !!process.stdout.isTTY && process.env.KLYRO_NO_ALT !== '1';
-    // Mouse reporting is opt-in (KLYRO_MOUSE=1): when on, the terminal sends
-    // clicks/wheel to the app (wheel scrolls ±3 lines) but native text
-    // selection and right-click paste stop working. Default off so select to
-    // copy and right-click paste work out of the box; bracketed paste
-    // (keyboard paste) is unaffected and always enabled below.
+    // Mouse reporting is ON by default (opencode parity): the wheel scrolls
+    // the chat, clicks are swallowed by the app. That means plain mouse
+    // selection/right-click go to the app, not the terminal — use Shift+drag
+    // to select and Shift+right-click to paste, or set KLYRO_MOUSE=0 for fully
+    // native selection (then scroll with PgUp/PgDn, Ctrl+U/D, Shift+↑/↓,
+    // Home/End, Space). Bracketed (keyboard) paste is unaffected and always on.
     const mouseReporting = isAltScreen && isMouseReportingEnabled();
     const enterAlt = () => {
         if (!isAltScreen)
@@ -501,8 +503,9 @@ export async function startRepl(opts = {}) {
             if (consoleRing.length > 200)
                 consoleRing.splice(0, consoleRing.length - 200);
             try {
+                // KLYRO_LOG_DIR relocates the debug log (1.5); default is ~/.klyro.
                 const home = process.env.HOME ?? process.env.USERPROFILE ?? cwd;
-                const dir = nodePath.join(home, '.klyro');
+                const dir = process.env.KLYRO_LOG_DIR ?? nodePath.join(home, '.klyro');
                 fsSync.mkdirSync(dir, { recursive: true });
                 const logFile = nodePath.join(dir, 'debug.log');
                 // Rotation: never let the debug log grow without bound (2 MiB cap).
@@ -724,6 +727,7 @@ export async function startRepl(opts = {}) {
         }
         catch { /* silent */ }
     })();
+    // eslint-disable-next-line prefer-const -- single assignment, but `let` is required: declaration precedes this for TDZ-safe handler wiring.
     app = render(React.createElement(App, {
         initialModel: model,
         maxSteps: currentMaxSteps,
@@ -778,6 +782,7 @@ export async function startRepl(opts = {}) {
     }), { patchConsole: false });
     // Install SIGINT handler only after app exists (avoids TDZ) and use once
     // On Ctrl+C in alt-screen, leave alt before exit so shell is restored
+    // eslint-disable-next-line prefer-const -- see above: declaration order is load-bearing.
     sigintHandler = () => {
         ac.abort();
         queuedStatus({ status: 'aborted' });
@@ -861,9 +866,6 @@ export async function startRepl(opts = {}) {
                 return;
             }
         }
-        let activeCallId = null;
-        let activeCallName = null;
-        let activeCallArgs = '';
         let runEndStatus = 'error';
         try {
             const result = await run({
@@ -902,14 +904,6 @@ export async function startRepl(opts = {}) {
                     else if (ev.kind === 'checkpoint_saved') {
                         queuedStatus({ status: 'running' });
                     }
-                    else if (ev.kind === 'tool_call_start') {
-                        activeCallId = ev.id;
-                        activeCallName = ev.name;
-                        activeCallArgs = '';
-                    }
-                    else if (ev.kind === 'tool_call_delta') {
-                        activeCallArgs += ev.argsJson;
-                    }
                     else if (ev.kind === 'tool_call_end') {
                         pendingToolIds.add(ev.id);
                         queuedAppend({
@@ -920,9 +914,6 @@ export async function startRepl(opts = {}) {
                             args: JSON.stringify(ev.input, null, 2),
                             status: 'running',
                         });
-                        activeCallId = null;
-                        activeCallName = null;
-                        activeCallArgs = '';
                     }
                     else if (ev.kind === 'policy_decision') {
                         queuedAppend({
@@ -1354,8 +1345,6 @@ export async function startRepl(opts = {}) {
             }
             case 'context': {
                 const { renderContextBreakdown } = await import('./context.js');
-                // use last transcript via closure? approximate with empty
-                const { accounting } = await import('../context/accounting.js');
                 const sys = ''; // system prompt approx
                 const breakdown = renderContextBreakdown(sys, []);
                 queuedAppend({ id: `ctx-${Date.now()}`, kind: 'text', text: breakdown, role: 'assistant' });
@@ -2689,7 +2678,7 @@ export async function startRepl(opts = {}) {
                         '  Enter send · Shift+Enter newline · Tab complete slash · Esc drop queued / Esc×2 cancel run',
                         '  Ctrl+C cancel (1st) / quit (2nd) · Ctrl+O expand last tool group · Ctrl+G jump bottom',
                         '  PgUp/PgDn or Ctrl+U/Ctrl+D half-page · Ctrl+Home/End top/bottom · Home/End jump · Space jump to unread',
-                        '  Ctrl+B/F page · Shift/Ctrl+↑/↓ line · ↑/↓ and Ctrl+P/N browse input history only · PgUp/Dn or Ctrl+U/D scroll · wheel scrolls with KLYRO_MOUSE=1',
+                        '  Ctrl+B/F page · Shift/Ctrl+↑/↓ line · ↑/↓ and Ctrl+P/N browse input history only · wheel scrolls · PgUp/Dn or Ctrl+U/D scroll · KLYRO_MOUSE=0 for native selection',
                         '  Text selection/copy and right-click paste work natively · Shift+Enter newline · /vim toggles vim input mode · /keymap <note> saves a display note',
                     ].join('\n'),
                 });

package/dist/cli/run.d.ts

@@ -15,9 +15,25 @@ export interface RunCliOptions {
     cwd: string;
     model: string;
     maxSteps?: number;
+    /** Alias for maxSteps (3.5) — when both are set, the smaller wins. */
+    maxTurns?: number;
     maxTokens?: number;
     temperature?: number;
+    /** Reasoning effort for reasoning models (OpenAI `reasoning_effort`). */
+    reasoningEffort?: 'low' | 'medium' | 'high';
     systemPrompt?: SystemPromptFn;
+    /** Replace the assembled system prompt wholesale (2.3). */
+    systemPromptText?: string;
+    /** Extra instructions appended after the assembled system prompt (2.3). */
+    appendSystemPrompt?: string;
+    /** Permission mode override (3.4): default|accept-edits|plan|auto. */
+    permissionMode?: import('../policy/engine.js').PermissionMode;
+    /** Tool names pre-approved for this run (added to allow rules). */
+    allowedTools?: string[] | string;
+    /** Tool names denied for this run (deny always wins). */
+    disallowedTools?: string[] | string;
+    /** Extra sandbox directories, as with /add-dir. */
+    addDir?: string[] | string;
     baseUrl?: string;
     apiKey?: string;
     timeoutMs?: number;
@@ -76,6 +92,22 @@ export interface RunCliOptions {
     agent?: string;
     maxDepth?: number;
 }
+/**
+ * Split a comma-separated tool/dir list (string or string[]) into names.
+ * Exported for tests.
+ */
+export declare function splitToolList(v: string[] | string | undefined): string[];
+/** Smaller of two optional caps (--max-turns aliases --max-steps). Exported for tests. */
+export declare function minDefined(a: number | undefined, b: number | undefined): number | undefined;
+/**
+ * Layer --system-prompt/--append-system-prompt over the assembled prompt
+ * (2.3): replace wins wholesale, append rides after the assembled system
+ * (preserving any suffix the base carries). Exported for tests.
+ */
+export declare function withSystemPromptOverrides(base: SystemPromptFn, opts: {
+    replace?: string;
+    append?: string;
+}): SystemPromptFn;
 /**
  * Double-Ctrl+C detector (pure, exported for tests): the second SIGINT
  * within 1500ms of the first forces `process.exit(130)`. The live handler

package/dist/cli/run.js

@@ -7,6 +7,7 @@
  * even on a long task. Tool calls and policy decisions go to stderr so
  * they don't pollute the captured `finalText` if the user pipes.
  */
+import * as path from 'node:path';
 import { stdout, stderr } from 'node:process';
 import { httpChatAdapter } from '../agent/provider-adapter.js';
 import { anthropicAdapter } from '../agent/anthropic-adapter.js';
@@ -20,8 +21,47 @@ import { redact } from '../policy/secret-redactor.js';
 import { buildLevel6Context } from '../context/level6.js';
 import { memoryBlock } from '../context/memory.js';
 import { estimateCost } from '../providers/model-info.js';
+import { resolveModelAlias } from '../providers/model-info.js';
+import { logDebug, logInfo } from '../util/log.js';
 import { resolveSessionId } from '../persistence/session.js';
 import * as fs from 'node:fs';
+/**
+ * Split a comma-separated tool/dir list (string or string[]) into names.
+ * Exported for tests.
+ */
+export function splitToolList(v) {
+    const arr = v === undefined ? [] : Array.isArray(v) ? v : [v];
+    return arr.flatMap((s) => String(s).split(',')).map((s) => s.trim()).filter((s) => s.length > 0);
+}
+/** Smaller of two optional caps (--max-turns aliases --max-steps). Exported for tests. */
+export function minDefined(a, b) {
+    if (a === undefined)
+        return b;
+    if (b === undefined)
+        return a;
+    return Math.min(a, b);
+}
+/**
+ * Layer --system-prompt/--append-system-prompt over the assembled prompt
+ * (2.3): replace wins wholesale, append rides after the assembled system
+ * (preserving any suffix the base carries). Exported for tests.
+ */
+export function withSystemPromptOverrides(base, opts) {
+    if (opts.replace === undefined && opts.append === undefined)
+        return base;
+    return (ctx) => {
+        if (opts.replace !== undefined) {
+            return opts.append ? `${opts.replace}\n\n${opts.append}` : opts.replace;
+        }
+        const r = base(ctx);
+        const system = typeof r === 'string' ? r : r.system;
+        const suffix = typeof r === 'string' ? undefined : r.suffix;
+        const out = { system: `${system}\n\n${opts.append}` };
+        if (suffix !== undefined)
+            out.suffix = suffix;
+        return out;
+    };
+}
 /**
  * Double-Ctrl+C detector (pure, exported for tests): the second SIGINT
  * within 1500ms of the first forces `process.exit(130)`. The live handler
@@ -38,6 +78,9 @@ export async function runOnce(opts) {
         loadDotenv(opts.cwd);
     }
     catch { /* ignore */ }
+    // Model aliases (2.2: sonnet/opus/haiku/gpt/local) resolve once here so
+    // the session store, cost math, and every adapter agree on the id.
+    opts = { ...opts, model: resolveModelAlias(opts.model) };
     const output = opts.output ?? 'human';
     if (opts.dryRun) {
         return await dryRunReport(opts);
@@ -138,7 +181,18 @@ export async function runOnce(opts) {
         catch { /* best-effort — single-provider run proceeds */ }
     }
     const registry = builtinRegistry();
-    const policy = new PolicyEngine(builtinRules(), clonePolicyConfig());
+    const policyConfig = clonePolicyConfig();
+    // Explicit CLI overrides (3.4). Persisted rules load next via applyRules;
+    // the engine's deny-first precedence keeps any denial terminal.
+    if (opts.permissionMode !== undefined)
+        policyConfig.mode = opts.permissionMode;
+    for (const t of splitToolList(opts.allowedTools))
+        policyConfig.allow.push(t);
+    for (const t of splitToolList(opts.disallowedTools))
+        policyConfig.deny.push(t);
+    for (const d of splitToolList(opts.addDir))
+        policyConfig.additionalDirs.push(path.resolve(opts.cwd, d));
+    const policy = new PolicyEngine(builtinRules(), policyConfig);
     // Persisted "always allow" patterns apply to one-shot runs too.
     try {
         const { loadPermissionRules } = await import('./config.js');
@@ -181,7 +235,7 @@ export async function runOnce(opts) {
         }
         catch { /* ignore — MCP is optional */ }
     }
-    const systemPrompt = await makeRunSystemPrompt(opts.cwd, opts.systemPrompt ?? defaultRunSystemPrompt, opts.bare);
+    const systemPrompt = withSystemPromptOverrides(await makeRunSystemPrompt(opts.cwd, opts.systemPrompt ?? defaultRunSystemPrompt, opts.bare), { replace: opts.systemPromptText, append: opts.appendSystemPrompt });
     // Level 9 — session setup (create or resume). --bare skips persistence.
     const persistEnabled = opts.persist !== false && !opts.bare;
     let store;
@@ -219,9 +273,6 @@ export async function runOnce(opts) {
                 stderr.write(`klyro: resuming session ${sessionId.slice(0, 8)} — task: "${rec.task}"\n`);
             }
         }
-        else if (opts.resumePath) {
-            // already handled
-        }
         else {
             // Create new session
             const rec = await store.create({ cwd: opts.cwd, task: opts.task, config: { model: opts.model, maxSteps: opts.maxSteps ?? 30 } });
@@ -313,23 +364,34 @@ export async function runOnce(opts) {
             model: opts.model,
         });
     }
+    // 2.5 latency tracking: TTFT = first model event after run start.
+    const runStartMs = Date.now();
+    let ttftMs;
+    logDebug('run start', { model: opts.model, maxSteps: opts.maxSteps, bare: !!opts.bare });
     try {
         result = await run({
             task: opts.task,
             cwd: opts.cwd,
             model: opts.model,
             ...(opts.bare ? { bare: true } : {}),
-            maxSteps: opts.maxSteps,
+            maxSteps: minDefined(opts.maxSteps, opts.maxTurns),
             maxTokens: opts.maxTokens,
             temperature: opts.temperature,
+            reasoningEffort: opts.reasoningEffort,
             signal: ac.signal,
             nonInteractive: true,
             initialTranscript,
+            // Sandbox roots for file tools: cwd plus --add-dir extras (resolved
+            // absolute). checkAllowedPaths narrows to exactly this set.
+            allowedPaths: [path.resolve(opts.cwd), ...(policyConfig.additionalDirs ?? [])],
             verify: verifyOpts,
             persist: store && sessionId ? { store, sessionId } : undefined,
             ...(agentBridge ? { agentBridge } : {}),
             ...(parentContext ? { parentContext } : {}),
             onEvent: (ev) => {
+                if (ttftMs === undefined && (ev.kind === 'text_delta' || ev.kind === 'tool_call_start')) {
+                    ttftMs = Date.now() - runStartMs;
+                }
                 if (output === 'json') {
                     stdout.write(JSON.stringify(ev) + '\n');
                     return;
@@ -436,9 +498,12 @@ export async function runOnce(opts) {
     // [budget] warnings. Human/silent → stderr one-liner; json → additive
     // cost_usd/usage fields on the final object (purely additive, no shape break).
     const finalCost = estimateCost(opts.model, result.usage.input, result.usage.output);
-    const costLine = `$${finalCost.toFixed(4)} · ${result.usage.input} in / ${result.usage.output} out${result.usage.estimated ? ' (estimated)' : ''}`;
+    const totalMs = Date.now() - runStartMs;
+    logInfo('run finish', { status: result.status, steps: result.steps, toolCalls: result.toolCalls, totalMs });
+    const ttftPart = ttftMs !== undefined ? ` · ttft ${ttftMs}ms` : '';
+    const costLine = `$${finalCost.toFixed(4)} · ${result.usage.input} in / ${result.usage.output} out${result.usage.estimated ? ' (estimated)' : ''}${ttftPart} · total ${totalMs}ms`;
     if (output === 'json') {
-        stdout.write(JSON.stringify({ kind: 'cost', cost_usd: finalCost, usage: result.usage }) + '\n');
+        stdout.write(JSON.stringify({ kind: 'cost', cost_usd: finalCost, usage: result.usage, ttft_ms: ttftMs ?? null, total_ms: totalMs }) + '\n');
     }
     else {
         stderr.write(`klyro: cost ${costLine}\n`);
@@ -457,6 +522,8 @@ export async function runOnce(opts) {
                 toolCalls: result.toolCalls,
                 cost_usd: finalCost,
                 usage: result.usage,
+                ttft_ms: ttftMs ?? null,
+                total_ms: totalMs,
                 ...(result.verification ? { verification: result.verification } : {}),
                 ...(sessionId ? { session_id: sessionId } : {}),
                 ...extra,
@@ -523,7 +590,7 @@ export async function runOnce(opts) {
 async function dryRunReport(opts) {
     // Assemble the REAL prompt (Level-6 context + KLYRO.md), not the bare base —
     // otherwise dry-run shows a different prompt than production runs use.
-    const systemPromptFn = await makeRunSystemPrompt(opts.cwd, opts.systemPrompt ?? defaultRunSystemPrompt);
+    const systemPromptFn = withSystemPromptOverrides(await makeRunSystemPrompt(opts.cwd, opts.systemPrompt ?? defaultRunSystemPrompt), { replace: opts.systemPromptText, append: opts.appendSystemPrompt });
     const { resolveSystemPrompt } = await import('../agent/runtime.js');
     const { system, suffix } = resolveSystemPrompt(systemPromptFn, { cwd: opts.cwd });
     const systemPrompt = suffix ? `${system}\n\n${suffix}` : system;
@@ -536,6 +603,7 @@ async function dryRunReport(opts) {
         maxSteps: opts.maxSteps,
         maxTokens: opts.maxTokens,
         temperature: opts.temperature,
+        reasoningEffort: opts.reasoningEffort,
         // Secrets must never leak into a printable report: redact both the
         // assembled system prompt and the task before printing.
         systemPrompt: redact(systemPrompt),

package/dist/cli/update.js

@@ -13,6 +13,7 @@ import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import * as os from 'node:os';
 import { createHash } from 'node:crypto';
+import { proxiedFetch } from '../shared/proxy.js';
 const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
 const REGISTRY_BASE = 'https://registry.npmjs.org/klyro';
 const FETCH_TIMEOUT_MS = 3000;
@@ -64,7 +65,7 @@ async function fetchWithTimeout(url, timeoutMs = FETCH_TIMEOUT_MS) {
     const ctrl = new AbortController();
     const t = setTimeout(() => ctrl.abort(), timeoutMs);
     try {
-        const res = await fetch(url, { signal: ctrl.signal });
+        const res = await proxiedFetch(url, { signal: ctrl.signal, timeoutMs });
         if (!res.ok)
             throw new Error(`HTTP ${res.status}`);
         return res;
@@ -95,6 +96,11 @@ async function verifyTarballIntegrity(dist) {
 export async function checkForUpdate(current) {
     if (process.env.KLYRO_NO_UPDATE_CHECK === '1')
         return null;
+    // Disabled in CI unless explicitly enabled (1.5): automated pipelines
+    // must never phone home or suggest interactive updates.
+    if ((process.env.CI === 'true' || process.env.GITHUB_ACTIONS === 'true') && process.env.KLYRO_UPDATE_CHECK !== '1') {
+        return null;
+    }
     const cache = cachePath();
     try {
         const raw = await fs.readFile(cache, 'utf-8');

package/dist/context/accounting.js

@@ -2,8 +2,8 @@
  * 8.1 — Accounting & stable assembly
  * Live token estimate, ctx%, compactAt, reserveOutput, toolResultMax
  */
-import { totalTokens } from './tokenizer.js';
 import { getModelInfo } from '../providers/model-info.js';
+import { totalTokens } from './tokenizer.js';
 /**
  * Single output-reserve used by every budget in the harness (displayed
  * accounting, runtime enforcement, compaction elide). One constant so the

package/dist/context/level7.d.ts

@@ -61,6 +61,10 @@ export declare class RuntimeTelemetry {
     private errorCount;
     private recent;
     constructor(opts?: Level7Options);
+    private muted;
+    /** Disable telemetry accumulation + reporting (also via KLYRO_TELEMETRY=0). */
+    mute(): void;
+    isMuted(): boolean;
     setMaxSteps(n: number): void;
     recordStepStart(step: number): void;
     recordUsage(input: number, output: number): void;

package/dist/context/level7.js

@@ -40,14 +40,29 @@ export class RuntimeTelemetry {
             maxRecentCalls: opts.maxRecentCalls ?? DEFAULT_MAX_RECENT,
             maxChars: opts.maxChars ?? DEFAULT_MAX_CHARS,
         };
+        // KLYRO_TELEMETRY=0 disables telemetry accumulation + reporting.
+        this.muted = process.env.KLYRO_TELEMETRY === '0';
+    }
+    muted = false;
+    /** Disable telemetry accumulation + reporting (also via KLYRO_TELEMETRY=0). */
+    mute() {
+        this.muted = true;
+    }
+    isMuted() {
+        return this.muted;
     }
     setMaxSteps(n) { this.maxSteps = n; }
-    recordStepStart(step) { this.step = step; }
+    recordStepStart(step) { if (!this.muted)
+        this.step = step; }
     recordUsage(input, output) {
+        if (this.muted)
+            return;
         this.inputTokens += input;
         this.outputTokens += output;
     }
     recordToolCall(call, latencyMs, isError) {
+        if (this.muted)
+            return;
         this.toolCallCount++;
         if (isError)
             this.errorCount++;
@@ -63,6 +78,8 @@ export class RuntimeTelemetry {
         }
     }
     recordError(msg) {
+        if (this.muted)
+            return;
         this.lastError = msg;
     }
     /**
@@ -89,6 +106,8 @@ export class RuntimeTelemetry {
         };
     }
     format() {
+        if (this.muted)
+            return emptyTelemetryBlock();
         const s = this.snapshot();
         const lines = [];
         lines.push('# Runtime telemetry');

package/dist/context/project-map.js

@@ -21,6 +21,7 @@
  *     what to walk past.
  */
 import * as fs from 'node:fs/promises';
+import { statSync, readFileSync } from 'node:fs';
 import * as path from 'node:path';
 export const IGNORED_DIRS = new Set([
     'node_modules', '.git', 'dist', 'build', '.next', '.turbo',
@@ -246,7 +247,7 @@ function detectPackageManager(root, pkg) {
         // Avoid the async cost by re-using the root listing we already do.
         // (Caller threads the listing into detectFrameworks; here we re-stat directly.)
         try {
-            require('node:fs').statSync(path.join(root, lock));
+            statSync(path.join(root, lock));
             return pm;
         }
         catch { /* not present */ }
@@ -295,9 +296,9 @@ function extractBuildCommands(pkg, root) {
     // Makefile: pick the first `target:` block as a hint.
     // (Don't try to parse make fully — just surface the targets as a single hint.)
     try {
-        const stat = require('node:fs').statSync(path.join(root, 'Makefile'));
+        const stat = statSync(path.join(root, 'Makefile'));
         if (stat.isFile() && stat.size < MAX_BYTES) {
-            const raw = require('node:fs').readFileSync(path.join(root, 'Makefile'), 'utf-8');
+            const raw = readFileSync(path.join(root, 'Makefile'), 'utf-8');
             const targets = [...raw.matchAll(/^([a-zA-Z_][\w-]*)\s*:/gm)].map((m) => m[1]).slice(0, 6);
             if (targets.length)
                 out.push(`make <target>  # targets: ${targets.join(', ')}`);
@@ -368,11 +369,11 @@ async function gitHead(root) {
 }
 function lockfileHash(root) {
     const candidates = ['pnpm-lock.yaml', 'yarn.lock', 'package-lock.json', 'bun.lockb', 'Cargo.lock', 'go.sum', 'poetry.lock', 'uv.lock'];
-    let h = crypto.createHash('sha1');
+    const h = crypto.createHash('sha1');
     let found = false;
     for (const f of candidates) {
         try {
-            const d = require('node:fs').readFileSync(path.join(root, f));
+            const d = readFileSync(path.join(root, f));
             h.update(d);
             found = true;
         }
@@ -456,17 +457,17 @@ function detectMonorepo(root, rootFiles, rootDirs) {
         return true;
     if (rootDirs.includes('packages') || rootDirs.includes('apps')) {
         try {
-            const s = require('node:fs').statSync(path.join(root, 'packages'));
+            const s = statSync(path.join(root, 'packages'));
             if (s.isDirectory())
                 return true;
         }
-        catch { }
+        catch { /* ignore — best-effort probe */ }
         try {
-            const s2 = require('node:fs').statSync(path.join(root, 'apps'));
+            const s2 = statSync(path.join(root, 'apps'));
             if (s2.isDirectory())
                 return true;
         }
-        catch { }
+        catch { /* ignore — best-effort probe */ }
     }
     return false;
 }
@@ -477,20 +478,20 @@ async function detectRuntimeVersions(root) {
         if (v)
             out['node'] = v.trim();
     }
-    catch { }
+    catch { /* ignore — best-effort probe */ }
     try {
         const pkg = await readJsonSafe(path.join(root, 'package.json'));
         const eng = pkg?.engines;
         if (eng?.node)
             out['node-eng'] = eng.node;
     }
-    catch { }
+    catch { /* ignore — best-effort probe */ }
     try {
         const py = await readTextSafe(path.join(root, '.python-version'));
         if (py)
             out['python'] = py.trim();
     }
-    catch { }
+    catch { /* ignore — best-effort probe */ }
     try {
         const go = await readTextSafe(path.join(root, 'go.mod'));
         if (go) {
@@ -499,7 +500,7 @@ async function detectRuntimeVersions(root) {
                 out['go'] = m[1];
         }
     }
-    catch { }
+    catch { /* ignore — best-effort probe */ }
     return out;
 }
 async function detectEntryPoints(root) {

package/dist/eval/harness.d.ts

@@ -77,7 +77,7 @@ export interface FileFixture {
     script?: StreamEvent[][];
 }
 export declare function loadFileFixture(dir: string): Promise<FileFixture>;
-export declare function runFileFixture(fixture: FileFixture, opts?: {
+export declare function runFileFixture(fixture: FileFixture, _opts?: {
     runs?: number;
     parallel?: number;
 }): Promise<TaskResult>;

package/dist/eval/harness.js

@@ -122,7 +122,7 @@ export async function runTask(t, opts = {}) {
             try {
                 await fs.rm(cwd, { recursive: true, force: true });
             }
-            catch { }
+            catch { /* ignore — best-effort tmp cleanup */ }
         }
     }
 }
@@ -177,7 +177,7 @@ export async function loadFileFixture(dir) {
     catch { /* no script → static fixture */ }
     return { dir, task: task.trim(), checkSh, meta, ...(repo ? { repo } : {}), ...(script ? { script } : {}) };
 }
-export async function runFileFixture(fixture, opts = {}) {
+export async function runFileFixture(fixture, _opts = {}) {
     const start = Date.now();
     const tmp = path.join(os.tmpdir(), 'klyro-eval-file-' + Math.random().toString(36).slice(2));
     await fs.mkdir(tmp, { recursive: true });