klyro 1.0.18 → 1.0.21

package/dist/agent/anthropic-adapter.js

@@ -17,6 +17,7 @@
  */
 import { assertSafeBaseURL } from '../chat.js';
 import { parseRetryAfterMs } from './provider-adapter.js';
+import { redact } from '../policy/secret-redactor.js';
 import { estimateTokens } from '../context/tokenizer.js';
 import { proxiedFetch } from '../shared/proxy.js';
 const DEFAULT_VERSION = '2023-06-01';
@@ -174,7 +175,9 @@ async function* streamAnthropic(req, opts) {
         yield {
             kind: 'error',
             code: isOverflow ? 'REQUEST_TOO_LARGE' : `http_${resp.status}`,
-            message: `Anthropic API returned ${resp.status}: ${text.slice(0, 500)}`,
+            // Redact before slicing (mirrors the OpenAI adapter): a 400 body can
+            // echo the prompt, leaking secrets into transcript/logs/trace.
+            message: `Anthropic API returned ${resp.status}: ${redact(text).slice(0, 500)}`,
             retryable,
             status: String(resp.status),
             ...(retryAfterMs !== undefined ? { retryAfterMs } : {}),
@@ -204,6 +207,11 @@ async function* streamAnthropic(req, opts) {
             if (done)
                 break;
             buf += decoder.decode(value, { stream: true });
+            // SSE spec: CRLF/CR line endings normalize to LF (same as the
+            // OpenAI adapter) — otherwise '\n\n' never matches and the stream
+            // stalls to timeout.
+            if (buf.includes('\r'))
+                buf = buf.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
             // Split on SSE event boundary.
             const events = [];
             let idx = 0;

package/dist/agent/child-worker.js

@@ -130,20 +130,34 @@ export async function forkChild(entry, payload, opts = {}) {
         });
         child.on('close', (code, signal) => {
             cleanup();
-            const first = stdoutCap.text().split('\n').find((l) => l.trim().length > 0);
-            if (code === 0 && first) {
+            // The child may print progress/log lines before the JSON result —
+            // scan from the LAST non-empty line back so an early log line can't
+            // mask the result (previously the first line was parsed instead).
+            const lines = stdoutCap.text().split('\n').map((l) => l.trim()).filter((l) => l.length > 0);
+            let parsed = null;
+            for (let i = lines.length - 1; i >= 0; i--) {
                 try {
-                    resolve(JSON.parse(first));
-                }
-                catch {
-                    reject(new ChildCrashError('child exited 0 but emitted malformed ChildResult', 'exit', stderr.slice(-1000)));
+                    const cand = JSON.parse(lines[i]);
+                    if (cand && typeof cand === 'object' && typeof cand.status === 'string') {
+                        parsed = cand;
+                        break;
+                    }
                 }
+                catch { /* not JSON — keep scanning */ }
+            }
+            if (code === 0 && parsed) {
+                resolve(parsed);
                 return;
             }
             const cause = signal === 'SIGKILL' || signal === 'SIGTERM'
                 ? (killedForTimeout ? 'timeout' : 'oom')
                 : 'exit';
-            reject(new ChildCrashError(`child exited ${code ?? signal ?? '??'} without a ChildResult` + (stderr ? `: ${stderr.slice(-500)}` : ''), cause, stderr.slice(-1000)));
+            // Exit 0 with no parseable result keeps the historical "malformed"
+            // message (pinned by forkChild tests); other exits name the cause.
+            const what = code === 0
+                ? 'child exited 0 but emitted malformed ChildResult'
+                : `child exited ${code ?? signal ?? '??'} without a ChildResult`;
+            reject(new ChildCrashError(what + (stderr ? `: ${stderr.slice(-500)}` : ''), cause, stderr.slice(-1000)));
         });
     });
 }

package/dist/agent/orchestrator.js

@@ -666,13 +666,36 @@ export class AgentOrchestrator {
                 return {
                     ok: false,
                     error: {
-                        code: 'MERGE_CONFLICT',
-                        message: `merge of ${meta.worktree.branch} conflicted`,
-                        details: { conflictFiles: merged.conflictFiles },
+                        code: merged.error ? 'MERGE_FAILED' : 'MERGE_CONFLICT',
+                        message: merged.error
+                            ? `merge of ${meta.worktree.branch} failed: ${merged.error}`
+                            : `merge of ${meta.worktree.branch} conflicted`,
+                        details: { conflictFiles: merged.conflictFiles, ...(merged.error ? { error: merged.error } : {}) },
                     },
                 };
             }
-            await removeWorktree({ repoCwd: meta.repoCwd, worktreePath: meta.worktree.worktreePath }).catch(() => undefined);
+            // Post-merge the branch content is committed, so a dirty worktree must
+            // not strand it: try a clean remove first, fall back to force, and
+            // only delete the branch once the worktree is really gone. Never
+            // report success while orphaning `.klyro/worktrees/<taskId>`.
+            try {
+                await removeWorktree({ repoCwd: meta.repoCwd, worktreePath: meta.worktree.worktreePath });
+            }
+            catch {
+                try {
+                    await removeWorktree({ repoCwd: meta.repoCwd, worktreePath: meta.worktree.worktreePath, force: true });
+                }
+                catch (err) {
+                    return {
+                        ok: false,
+                        error: {
+                            code: 'WORKTREE_CLEANUP',
+                            message: `merged ${meta.worktree.branch} but could not remove worktree ${meta.worktree.worktreePath}`,
+                            details: { worktreePath: meta.worktree.worktreePath, error: err instanceof Error ? err.message : String(err) },
+                        },
+                    };
+                }
+            }
             await deleteBranch({ repoCwd: meta.repoCwd, branch: meta.worktree.branch });
             didMerge = true;
         }

package/dist/agent/provider-adapter.js

@@ -293,6 +293,11 @@ async function* streamChatCompletions(url, opts, req, fetchImpl) {
             if (done)
                 break;
             buf += decoder.decode(value, { stream: true });
+            // SSE spec: CRLF/CR line endings normalize to LF. Without this a
+            // CRLF stream never contains '\n\n', so no event boundary splits
+            // and the stream stalls to timeout.
+            if (buf.includes('\r'))
+                buf = buf.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
             // SSE: events separated by \n\n
             let idx;
             while ((idx = buf.indexOf('\n\n')) !== -1) {

package/dist/agent/retry.js

@@ -210,9 +210,12 @@ export function retryingAdapter(inner, opts = {}) {
                     ? retryAfterRaw
                     : undefined;
                 opts.onRetry?.({ attempt: attempt + 1, status, ...(retryAfterMs !== undefined ? { retryAfterMs } : {}) });
-                // Honor a server-provided Retry-After delay when present; otherwise
-                // fall back to exponential backoff with jitter.
-                const delay = retryAfterMs ?? computeBackoff(attempt, cfg.baseMs, cfg.maxMs);
+                // Honor a server-provided Retry-After delay when present, capped at
+                // maxMs: an unbounded server delay (malicious or buggy endpoint)
+                // could otherwise park the agent for hours per attempt.
+                const delay = retryAfterMs !== undefined
+                    ? Math.min(retryAfterMs, cfg.maxMs)
+                    : computeBackoff(attempt, cfg.baseMs, cfg.maxMs);
                 // Abort-aware backoff: Ctrl+C during the sleep must stop promptly
                 // instead of stalling up to maxMs before noticing.
                 if (delay > 0)

package/dist/agent/runtime.js

@@ -106,11 +106,16 @@ export async function run(opts, deps) {
         return [{ role: 'user', content: [text(opts.task)] }];
     })();
     const usage = { input: 0, output: 0 };
+    // Effective model for cost accounting: the request actually sends
+    // parentContext.model when an orchestrator overrides it, so budget
+    // warnings and the max-cost guard must rate against the same model —
+    // otherwise a cheap-model budget supervises expensive-model spend.
+    const effectiveModel = opts.parentContext?.model ?? opts.model;
     /** Emit one `budget_warning` per threshold the cost ratio has crossed. */
     const checkBudgetWarnings = () => {
         if (maxCost === undefined || maxCost <= 0)
             return;
-        const ratio = estimateCost(opts.model, usage) / maxCost;
+        const ratio = estimateCost(effectiveModel, usage) / maxCost;
         for (const threshold of BUDGET_WARNING_THRESHOLDS) {
             if (ratio >= threshold && !firedBudgetWarnings.has(threshold)) {
                 firedBudgetWarnings.add(threshold);
@@ -309,7 +314,7 @@ export async function run(opts, deps) {
     outer: while (steps < maxSteps) {
         // 5.1 limits: max-cost, max-time
         if (maxCost !== undefined) {
-            const cost = estimateCost(opts.model, usage);
+            const cost = estimateCost(effectiveModel, usage);
             if (cost >= maxCost) {
                 setPhase('limit');
                 await closeTracer();
@@ -512,10 +517,12 @@ export async function run(opts, deps) {
                 }
                 // L15 failover: a terminal provider error swaps to the next chained
                 // adapter and re-issues the step (bounded by chain length). Context
-                // overflow is excluded — it owns its own recovery above. By the time
-                // an error reaches the runtime, per-adapter retries are exhausted,
-                // so any provider error here is terminal for the active adapter.
-                if (failoverQueue.length > 0) {
+                // overflow is excluded — it owns its own recovery above, and a
+                // second overflow must abort, not re-spray the oversized transcript
+                // at the next provider. By the time an error reaches the runtime,
+                // per-adapter retries are exhausted, so any provider error here is
+                // terminal for the active adapter.
+                if (failoverQueue.length > 0 && ev.code !== 'REQUEST_TOO_LARGE') {
                     const next = failoverQueue.shift();
                     failoverPending = true;
                     failoverFrom = activeAdapter.id;
@@ -1082,6 +1089,7 @@ export async function run(opts, deps) {
                     await snapshot(opts.cwd, [...fileEditCounts.keys()].slice(-20), {
                         ...(sessionId !== undefined ? { sessionId } : {}),
                         eventId: call.id,
+                        transcript,
                     });
                 }
                 catch { /* ignore */ }
@@ -1176,6 +1184,7 @@ export async function run(opts, deps) {
                         await snapshot(opts.cwd, [fileChanged.path], {
                             ...(sessionId !== undefined ? { sessionId } : {}),
                             eventId: call.id,
+                            transcript,
                         });
                     }
                     catch { /* ignore */ }

package/dist/agent/worktree-manager.d.ts

@@ -30,6 +30,8 @@ export interface WorktreeInfo {
 export interface MergeResult {
     merged: boolean;
     conflictFiles: string[];
+    /** Present when the merge failed for a non-conflict reason (bad branch, dirty tree, git error). */
+    error?: string;
 }
 /** True when `cwd` is inside a git working tree. Never throws — false on any failure. */
 export declare function ensureGitRepo(cwd: string): Promise<boolean>;

package/dist/agent/worktree-manager.js

@@ -86,7 +86,8 @@ export async function mergeWorktree(opts) {
         await git(opts.repoCwd, ['merge', '--no-ff', '--no-edit', opts.branch]);
         return { merged: true, conflictFiles: [] };
     }
-    catch {
+    catch (err) {
+        const errText = err instanceof Error ? err.message : String(err);
         const conflictFiles = await unmergedFiles(opts.repoCwd);
         try {
             await git(opts.repoCwd, ['merge', '--abort']);
@@ -94,7 +95,13 @@ export async function mergeWorktree(opts) {
         catch {
             /* best-effort: leave the repo as-is if abort itself fails */
         }
-        return { merged: false, conflictFiles };
+        // Only call it a conflict when unmerged paths exist; anything else
+        // (unknown branch, dirty tree, git missing) is a hard error, not an
+        // empty MERGE_CONFLICT the caller can't act on.
+        if (conflictFiles.length > 0 || /CONFLICT/i.test(errText)) {
+            return { merged: false, conflictFiles };
+        }
+        return { merged: false, conflictFiles, error: errText };
     }
 }
 async function unmergedFiles(repoCwd) {

package/dist/checkpoints/store.d.ts

@@ -14,6 +14,7 @@
 export interface SnapshotOptions {
     sessionId?: string;
     eventId?: string;
+    transcript?: unknown[];
 }
 /** Checkpoint meta on disk — sessionId/eventId are absent on old metas. */
 export interface CheckpointMeta {
@@ -23,6 +24,7 @@ export interface CheckpointMeta {
     ts: number;
     sessionId?: string;
     eventId?: string;
+    transcriptHash?: string;
 }
 export declare function snapshot(cwd: string, files: string[], opts?: SnapshotOptions): Promise<string>;
 export declare function listCheckpoints(cwd: string): Promise<string[]>;
@@ -37,6 +39,17 @@ export interface CheckpointInfo {
 export declare function listCheckpointInfo(cwd: string): Promise<CheckpointInfo[]>;
 /** File paths a snapshot would restore (for `/rewind <n> preview`). */
 export declare function snapshotFiles(cwd: string, id: string): Promise<string[]>;
+/**
+ * Transcript captured at a checkpoint, or null when the snapshot predates
+ * transcript capture or the payload is missing/corrupt.
+ *
+ * The stored hash is verified on read: a checkpoint is only ever trusted for
+ * restoring the conversation when its transcript.json still matches the
+ * transcriptHash recorded in .meta.json. A mismatch (partial write, manual
+ * edit, tampering) yields null so the caller can report "conversation
+ * untouched" instead of rewinding onto unverified content.
+ */
+export declare function readSnapshotTranscript(cwd: string, id: string): Promise<unknown[] | null>;
 export declare function diff(cwd: string, id?: string): Promise<string>;
 export declare function undo(cwd: string, n?: number): Promise<void>;
 export declare function rewind(cwd: string): Promise<void>;

package/dist/checkpoints/store.js

@@ -97,6 +97,14 @@ export async function snapshot(cwd, files, opts) {
         meta.sessionId = opts.sessionId;
     if (opts?.eventId !== undefined)
         meta.eventId = opts.eventId;
+    if (opts?.transcript) {
+        const transcriptPath = path.join(dest, 'transcript.json');
+        await fs.writeFile(transcriptPath, JSON.stringify(opts.transcript), 'utf-8');
+        lockDown(transcriptPath, 0o600);
+        await fsyncFile(transcriptPath);
+        const hash = crypto.createHash('sha256').update(JSON.stringify(opts.transcript)).digest('hex');
+        meta.transcriptHash = hash;
+    }
     await fs.writeFile(metaTmp, JSON.stringify(meta, null, 2));
     lockDown(metaTmp, 0o600);
     await fsyncFile(metaTmp);
@@ -208,6 +216,35 @@ export async function snapshotFiles(cwd, id) {
         return [];
     }
 }
+/**
+ * Transcript captured at a checkpoint, or null when the snapshot predates
+ * transcript capture or the payload is missing/corrupt.
+ *
+ * The stored hash is verified on read: a checkpoint is only ever trusted for
+ * restoring the conversation when its transcript.json still matches the
+ * transcriptHash recorded in .meta.json. A mismatch (partial write, manual
+ * edit, tampering) yields null so the caller can report "conversation
+ * untouched" instead of rewinding onto unverified content.
+ */
+export async function readSnapshotTranscript(cwd, id) {
+    try {
+        const dir = path.join(ckptDir(cwd), id);
+        const meta = JSON.parse(await fs.readFile(path.join(dir, '.meta.json'), 'utf-8'));
+        const raw = await fs.readFile(path.join(dir, 'transcript.json'), 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (!Array.isArray(parsed))
+            return null;
+        if (typeof meta.transcriptHash === 'string') {
+            const actual = crypto.createHash('sha256').update(raw).digest('hex');
+            if (actual !== meta.transcriptHash)
+                return null;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
 export async function diff(cwd, id) {
     const ckpts = await listCheckpoints(cwd);
     const target = id ?? ckpts[ckpts.length - 1];
@@ -218,9 +255,33 @@ export async function diff(cwd, id) {
     return new Promise((resolve) => {
         const child = spawn('git', ['diff', '--stat'], { cwd, shell: false, windowsHide: true });
         const sink = cappedOutput(64 * 1024);
+        let done = false;
+        // A wedged git (locked index) must not hang undo diagnostics forever.
+        const t = setTimeout(() => {
+            if (done)
+                return;
+            done = true;
+            try {
+                child.kill('SIGKILL');
+            }
+            catch { /* ignore */ }
+            resolve('No diff (git timed out)');
+        }, 10_000);
         child.stdout.on('data', (b) => sink.push(b));
-        child.on('close', () => resolve(sink.text() || 'No diff'));
-        child.on('error', () => resolve('No git diff available'));
+        child.on('close', () => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(t);
+            resolve(sink.text() || 'No diff');
+        });
+        child.on('error', () => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(t);
+            resolve('No git diff available');
+        });
     });
 }
 export async function undo(cwd, n = 1) {
@@ -232,6 +293,8 @@ export async function undo(cwd, n = 1) {
     const metaRaw = await fs.readFile(path.join(srcDir, '.meta.json'), 'utf-8');
     const meta = JSON.parse(metaRaw);
     // Restore modified/created files to their snapshotted content…
+    // Transcript restore is handled by caller via transcript snapshot — read via
+    // readSnapshotTranscript() if the caller wants conversation rewind.
     for (const f of meta.files) {
         const src = containedPath(cwd, srcDir, f);
         const dest = src ? containedPath(cwd, cwd, f) : null;

package/dist/cli/dotenv.js

@@ -89,7 +89,7 @@ const BLOCKED_DOTENV_SECURITY_RELAXATIONS = new Set([
     'KLYRO_WORKER',
 ]);
 /** npm reads `npm_config_*` from the environment — a repo must not pick the registry. */
-const BLOCKED_DOTENV_PREFIXES = ['NPM_CONFIG_'];
+const BLOCKED_DOTENV_PREFIXES = ['NPM_CONFIG_', 'KLYRO_SANDBOX']; // KLYRO_SANDBOX=0 / KLYRO_SANDBOX_NET=1 de-harden the shell sandbox (see shell-exec.ts)
 /** True when a `.env` key would change process behaviour or loosen a boundary. */
 export function isBlockedDotenvKey(key) {
     const k = key.toUpperCase();

package/dist/cli/repl.js

@@ -711,8 +711,6 @@ export async function startRepl(opts = {}) {
             directHooks.clearTranscript();
         else
             pendingQueue.length = 0;
-        if (isMounted && directHooks)
-            directHooks.clearTranscript();
     }
     // Update nudge (best-effort, cached 24h, silent fail): a single stderr
     // line when a newer version exists. No prompt, no blocking — the check
@@ -956,7 +954,12 @@ export async function startRepl(opts = {}) {
                         // streamingId is closed by status change; no extra handling needed
                     }
                     else if (ev.kind === 'usage') {
-                        queuedStatus({ usageInput: ev.input, usageOutput: ev.output });
+                        queuedStatus({
+                            usageInput: ev.input,
+                            usageOutput: ev.output,
+                            usageCacheRead: ev.cacheRead ?? 0,
+                            usageCacheWrite: ev.cacheWrite ?? 0,
+                        });
                     }
                     else if (ev.kind === 'plan_update') {
                         queuedPlan(ev.plan);
@@ -1261,6 +1264,20 @@ export async function startRepl(opts = {}) {
                     }
                     await undo(cwd, n);
                     let text = `Rewound to checkpoint ${n} (${target.id.slice(0, 12)}, ${target.files} file(s))`;
+                    // If transcript was captured for this checkpoint, restore it into the
+                    // active REPL session so /rewind full also reverts the conversation.
+                    const { readSnapshotTranscript } = await import('../checkpoints/store.js');
+                    const raw = await readSnapshotTranscript(cwd, target.id);
+                    // readSnapshotTranscript returns `unknown[]`; verify minimal Message shape
+                    // before giving it to adoptTranscript to avoid runtime type errors.
+                    const isMessage = (v) => !!v && typeof v === 'object' && 'role' in v && 'content' in v;
+                    if (Array.isArray(raw) && raw.length > 0 && raw.every(isMessage)) {
+                        sessionMessages = adoptTranscript(raw);
+                        text += '\nConversation restored from checkpoint transcript.';
+                    }
+                    else if (mode === 'full') {
+                        text += '\nConversation rewind skipped — no transcript captured for this checkpoint.';
+                    }
                     if (mode === 'summary' || mode === 'full') {
                         const files = before.split('\n').map((l) => l.trim()).filter(Boolean).slice(0, 20);
                         text += files.length > 0 ? `\nReverted working-tree changes:\n${files.map((f) => `  ${f}`).join('\n')}` : '\nWorking tree was clean before restore.';
@@ -2074,8 +2091,8 @@ export async function startRepl(opts = {}) {
                         queuedAppend({ id: `ckpt-${Date.now()}`, kind: 'text', text: 'Working tree clean — nothing to checkpoint.', role: 'assistant' });
                     }
                     else {
-                        const id = await snapshot(cwd, files.slice(0, 50));
-                        queuedAppend({ id: `ckpt2-${Date.now()}`, kind: 'text', text: `checkpoint ${String(id).slice(0, 8)} — ${files.length} file(s)`, role: 'assistant' });
+                        const id = await snapshot(cwd, files.slice(0, 50), { transcript: sessionMessages });
+                        queuedAppend({ id: `ckpt2-${Date.now()}`, kind: 'text', text: `checkpoint ${String(id).slice(0, 8)} — ${files.length} file(s)` + ` (conversation archived)`, role: 'assistant' });
                     }
                 }
                 catch (err) {

package/dist/eval/harness.js

@@ -23,7 +23,7 @@ import { globTool } from '../tools/search/glob.js';
 import { grepTool } from '../tools/search/grep.js';
 import { gitStatusTool } from '../tools/git/git-status.js';
 import { gitDiffTool } from '../tools/git/git-diff.js';
-import { PolicyEngine, builtinRules, DEFAULT_POLICY_CONFIG } from '../policy/engine.js';
+import { PolicyEngine, builtinRules, clonePolicyConfig } from '../policy/engine.js';
 import { DenyAllApprovalPrompt } from '../policy/approval.js';
 import { defaultSystemPrompt } from '../agent/runtime.js';
 import { verify } from '../verification/engine.js';
@@ -59,7 +59,9 @@ export async function runTask(t, opts = {}) {
         .register(listDirTool).register(globTool).register(grepTool)
         .register(shellExecTool).register(runVerifyTool)
         .register(gitStatusTool).register(gitDiffTool);
-    const policy = new PolicyEngine(builtinRules(), DEFAULT_POLICY_CONFIG);
+    // Clone: registerMcpServers mutates the config via addAsk — sharing the
+    // global DEFAULT_POLICY_CONFIG would leak ask-rules across tasks/runs.
+    const policy = new PolicyEngine(builtinRules(), clonePolicyConfig());
     try {
         const result = await run({ task: t.task, cwd, model: 'mock', maxSteps: 12, nonInteractive: true }, { adapter: scriptedAdapter(t.script), registry: reg, policy, approval: new DenyAllApprovalPrompt(), systemPrompt: defaultSystemPrompt });
         let observedStatus = result.status;
@@ -72,7 +74,10 @@ export async function runTask(t, opts = {}) {
             }
         }
         let details = '';
-        let pass = result.status === t.expectStatus;
+        // Grade the *observed* status (agent result possibly overridden by the
+        // verify step above) — a failed verifyCommand must fail the task even
+        // when the agent itself reported 'complete'.
+        let pass = observedStatus === t.expectStatus;
         if (t.expectToolCalls !== undefined && result.toolCalls !== t.expectToolCalls) {
             details += ` toolCalls=${result.toolCalls} expected=${t.expectToolCalls};`;
             pass = false;

package/dist/mcp/remote.js

@@ -15,18 +15,42 @@ export function isLoopback(url) {
 /** Parse a Streamable-HTTP SSE body (`data: {...}` lines) into JSON payloads. */
 export function parseSseBody(text) {
     const out = [];
+    // Consecutive data: lines belong to ONE event per the SSE spec (joined
+    // with \n). Parse the joined chunk first; if that fails, fall back to
+    // per-line parsing so servers that (against spec) emit bare JSON per
+    // line without blank separators keep working.
+    let parts = [];
+    const flush = () => {
+        if (parts.length === 0)
+            return;
+        const joined = parts.join('\n').trim();
+        parts = [];
+        if (joined === '[DONE]')
+            return;
+        try {
+            out.push(JSON.parse(joined));
+            return;
+        }
+        catch { /* try per-line below */ }
+        for (const part of joined.split('\n')) {
+            const t = part.trim();
+            if (!t || t === '[DONE]')
+                continue;
+            try {
+                out.push(JSON.parse(t));
+            }
+            catch { /* ignore malformed lines */ }
+        }
+    };
     for (const line of text.split('\n')) {
         const t = line.trim();
-        if (!t.startsWith('data:'))
-            continue;
-        const payload = t.slice(5).trim();
-        if (payload === '[DONE]')
+        if (!t.startsWith('data:')) {
+            flush();
             continue;
-        try {
-            out.push(JSON.parse(payload));
         }
-        catch { /* ignore malformed lines */ }
+        parts.push(t.slice(5).trim());
     }
+    flush();
     return out;
 }
 export class RemoteMcpClient {

package/dist/mcp/sse.js

@@ -163,7 +163,6 @@ export class SseMcpClient {
             return;
         this.pending.delete(m.id);
         clearTimeout(p.timer);
-        clearTimeout(p.timer);
         if (m.error)
             p.reject(new McpError(`mcp server "${this.name}" error: ${m.error.message ?? 'unknown'}`, 'SERVER_ERROR', m.error));
         else

package/dist/persistence/audit.d.ts

@@ -93,12 +93,6 @@ export declare class AuditLog {
     private readonly keepSegments;
     /** Serializes chained appends so concurrent writes can't fork the chain. */
     private chain;
-    /**
-     * Cached last-written hash: avoids re-reading the whole file (O(n) per
-     * write) on every append. Null = not loaded yet — first append reads the
-     * file (picks up an existing chain), then the cache takes over.
-     */
-    private lastHash;
     constructor(filePath: string, maxBytes?: number, keepSegments?: number);
     write(event: AuditEvent): Promise<void>;
     private appendChained;

package/dist/persistence/audit.js

@@ -64,9 +64,9 @@ export const AUDIT_ROTATE_KEEP = 5;
  * Rotate an audit log once it exceeds `maxBytes`: shift the newest segment
  * over the oldest (deleted), leave a fresh live file. Each segment carries
  * its own GENESIS-rooted chain, so rotation is tamper-evident per segment.
- * Returns true when a rotation actually happened (the caller must reset its
- * in-memory chain tip to GENESIS — the next live record starts a fresh
- * chain). Best-effort — rotation failures never break appends.
+ * Callers re-read the tail after rotating, so the next live record starts
+ * a fresh chain with no in-memory state to reset. Best-effort — rotation
+ * failures never break appends.
  */
 async function rotateAuditLog(filePath, maxBytes, keep) {
     try {
@@ -97,12 +97,6 @@ export class AuditLog {
     keepSegments;
     /** Serializes chained appends so concurrent writes can't fork the chain. */
     chain = Promise.resolve();
-    /**
-     * Cached last-written hash: avoids re-reading the whole file (O(n) per
-     * write) on every append. Null = not loaded yet — first append reads the
-     * file (picks up an existing chain), then the cache takes over.
-     */
-    lastHash = null;
     constructor(filePath, maxBytes = AUDIT_MAX_BYTES, keepSegments = AUDIT_ROTATE_KEEP) {
         this.filePath = filePath;
         this.maxBytes = maxBytes;
@@ -115,17 +109,16 @@ export class AuditLog {
         return task;
     }
     async appendChained(event) {
-        // Rotation leaves a fresh live file and resets the in-memory tip: the
-        // next live record restarts at GENESIS (each segment is its own chain).
-        const rotated = await rotateAuditLog(this.filePath, this.maxBytes, this.keepSegments);
-        if (rotated)
-            this.lastHash = AUDIT_GENESIS;
-        if (this.lastHash === null)
-            this.lastHash = await prevHashFor(this.filePath);
-        const prevHash = this.lastHash;
+        // Rotation leaves a fresh live file; the tail read below then naturally
+        // restarts at GENESIS (each segment is its own chain).
+        await rotateAuditLog(this.filePath, this.maxBytes, this.keepSegments);
+        // Always re-read the tail instead of caching the tip: a cached tip forks
+        // the chain whenever another instance or process appends in between
+        // (e.g. a long-lived TUI plus a one-shot CLI on the same project).
+        // Audit volume is low and segments are size-bounded, so the read is cheap.
+        const prevHash = await prevHashFor(this.filePath);
         const body = { ...event, prevHash };
         const record = { ...body, prevHash, hash: sha256Hex(canonicalJson(body)) };
-        this.lastHash = record.hash;
         await SessionStore.appendJsonl(this.filePath, record);
     }
 }

package/dist/persistence/store.js

@@ -297,20 +297,26 @@ export class SessionStore {
             await fs.unlink(tmp).catch(() => undefined);
             throw new Error(`Failed to write session ${id}`);
         }
-        // Update index with simple retry for concurrent writers (optimistic)
-        for (let attempt = 0; attempt < 3; attempt++) {
-            try {
-                const idx = await this.readIndex();
-                idx[id] = data.record;
-                await this.writeIndex(idx);
-                return;
-            }
-            catch (err) {
-                if (attempt === 2)
-                    throw err;
-                await new Promise((r) => setTimeout(r, 10 * (attempt + 1)));
+        // Update index under the shared 'index' lock (same key create/delete
+        // use): the read-modify-write below races under concurrent writers on
+        // different sessions, and last-writer-wins would silently drop entries.
+        // Deadlock-free: no caller holds 'index' while calling writeSession
+        // (create/delete write the index inline instead).
+        await this.withLock('index', async () => {
+            for (let attempt = 0; attempt < 3; attempt++) {
+                try {
+                    const idx = await this.readIndex();
+                    idx[id] = data.record;
+                    await this.writeIndex(idx);
+                    return;
+                }
+                catch (err) {
+                    if (attempt === 2)
+                        throw err;
+                    await new Promise((r) => setTimeout(r, 10 * (attempt + 1)));
+                }
             }
-        }
+        });
     }
     async appendMessage(id, message) {
         return this.withLock(id, async () => {