klyro 1.0.18 → 1.0.21

package/dist/policy/engine.js

@@ -76,6 +76,18 @@ export class PolicyEngine {
                 call.name === 'memory_write') {
                 return { action: 'deny', reason: 'plan mode: writes blocked — use /permissions to allow or switch mode' };
             }
+            // plan mode is read-only investigation: shells run only allowlisted
+            // read-only commands, and nothing may escape to subagents or MCP
+            // servers (both can write through their own tool surfaces).
+            if (call.name === 'shell_exec' || call.name === 'run_verify') {
+                const cmd = asString(call.input.command);
+                if (!cmd || !startsWithAny(cmd, ctx.config.shellAllow)) {
+                    return { action: 'deny', reason: 'plan mode: only allowlisted read-only commands — use /permissions to allow or switch mode' };
+                }
+            }
+            if (call.name === 'spawn_agent' || call.name.startsWith('mcp__')) {
+                return { action: 'deny', reason: 'plan mode: subagents and MCP tools blocked — use /permissions to allow or switch mode' };
+            }
         }
         else if (ctx.config.mode === 'accept-edits') {
             // accept-edits: auto-allow edit tools
@@ -196,7 +208,8 @@ function isEnvPath(p) {
     // not secrets — reads AND writes are allowed.
     if (/[.](example|sample|template|dist)$/.test(lower))
         return false;
-    return /(^|\/)\.env(\.|$)/.test(lower) || lower.endsWith('.env');
+    // Separator class covers POSIX and Windows paths (C:\proj\.env.local).
+    return /(^|[/\\])\.env(\.|$)/.test(lower) || lower.endsWith('.env');
 }
 function extractPatchPaths(patch) {
     const out = [];
@@ -238,9 +251,25 @@ export function matchesGlobRule(call, rule) {
 }
 function startsWithAny(haystack, needles) {
     const h = haystack.trim().toLowerCase();
+    // Quote-stripped variant: `rm -rf "/"` is `rm -rf /` with camouflage.
+    // Stripping quotes can only add deny matches at position 0, never remove.
+    const variants = [h, h.replace(/['"]/g, '')];
     return needles.some((n) => {
         const nl = n.toLowerCase().replace(/\s+$/, ''); // strip trailing ws from needle
-        return h === nl || h.startsWith(nl + ' ') || h.startsWith(nl + '\t');
+        return variants.some((hv) => {
+            if (hv === nl)
+                return true;
+            if (!hv.startsWith(nl))
+                return false;
+            // Boundary after the needle: end, whitespace, quote, or a path
+            // separator/glob/chain char. Without the separator class, `rm -rf /*`,
+            // `rm -rf ~/*`, `rm -rf ./*` and `rm -rf ./` all slip past the deny
+            // list. Note this intentionally also matches scoped forms like
+            // `rm -rf ./build` — destructive-prefix commands stay denied and the
+            // caller allowlists (or uses a bare relative path).
+            const c = hv[nl.length];
+            return c === undefined || /[\s/'"`*?\[\\;&|]/.test(c);
+        });
     });
 }
 /** Branches that `git push` must never target without an explicit opt-out. */
@@ -407,13 +436,20 @@ export const writeFileCwdRule = {
         if (!p)
             return null;
         if (p.includes('..') || path.isAbsolute(p)) {
-            // Check if absolute is inside additionalDirs
+            // Absolute paths are fine inside the workspace roots (cwd or
+            // additionalDirs) — only true escapes are denied.
             if (path.isAbsolute(p)) {
-                const allowed = (ctx.config.additionalDirs ?? []).some((dir) => {
-                    const rel = path.relative(path.resolve(dir), path.resolve(p));
-                    return !rel.startsWith('..') && !path.isAbsolute(rel);
+                const roots = [ctx.cwd, ...(ctx.config.additionalDirs ?? [])];
+                const inside = roots.some((dir) => {
+                    try {
+                        const rel = path.relative(path.resolve(dir), path.resolve(p));
+                        return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+                    }
+                    catch {
+                        return false; // different drive on Windows: not inside
+                    }
                 });
-                if (allowed)
+                if (inside)
                     return null;
             }
             return { action: 'deny', reason: 'path traversal or absolute path not allowed' };

package/dist/providers/model-info.d.ts

@@ -39,4 +39,7 @@ export declare function ratesFor(modelId: string): {
  * other families keep ignoring those counters.
  */
 export declare function isAnthropicModel(modelId: string): boolean;
-export declare function estimateCost(modelId: string, inputTokens: number, outputTokens: number): number;
+export declare function estimateCost(modelId: string, inputTokens: number, outputTokens: number, cache?: {
+    read?: number;
+    write?: number;
+}): number;

package/dist/providers/model-info.js

@@ -70,9 +70,17 @@ export function ratesFor(modelId) {
 export function isAnthropicModel(modelId) {
     return /anthropic|claude/i.test(modelId);
 }
-export function estimateCost(modelId, inputTokens, outputTokens) {
+export function estimateCost(modelId, inputTokens, outputTokens, cache) {
     // Single source: delegate to ratesFor so registry, family fallbacks, and
     // local-$0 rules live in exactly one place (no split-brain with getModelInfo).
     const { input, output } = ratesFor(modelId);
-    return (inputTokens / 1000) * input + (outputTokens / 1000) * output;
+    let cost = (inputTokens / 1000) * input + (outputTokens / 1000) * output;
+    // Cache-aware (Anthropic billing): cacheRead at 0.1x input, cacheWrite at
+    // 1.25x input. Other families ignore cache counters. Mirrors the
+    // runtime's estimateCost — keep the two in sync.
+    if (isAnthropicModel(modelId)) {
+        cost += ((cache?.read ?? 0) / 1000) * input * 0.1;
+        cost += ((cache?.write ?? 0) / 1000) * input * 1.25;
+    }
+    return cost;
 }

package/dist/repl.js

@@ -94,8 +94,10 @@ export async function repl(system) {
                 // EOF on stdin (Ctrl-D) or close — exit cleanly.
                 break;
             }
-            if (!line)
-                break; // empty line on EOF
+            // EOF on stdin (Ctrl-D) rejects the question and exits via the
+            // catch above. An empty line is just a stray Enter — keep going.
+            if (line === '')
+                continue;
             const step = splitContinuedLine(continued, line);
             continued = step.pending;
             if (step.complete === undefined)

package/dist/tools/git/run-git.js

@@ -4,13 +4,32 @@ export function runGit(args, cwd, timeoutMs = 15_000) {
         const child = spawn('git', args, { cwd, stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true, shell: false });
         const out = [];
         const err = [];
-        const timer = setTimeout(() => { try {
-            child.kill('SIGKILL');
-        }
-        catch { /* noop */ } }, timeoutMs);
+        let done = false;
+        const timer = setTimeout(() => {
+            if (done)
+                return;
+            done = true;
+            try {
+                child.kill('SIGKILL');
+            }
+            catch { /* noop */ }
+            resolve({ code: 1, out: Buffer.concat(out).toString('utf-8'), err: 'git timed out' });
+        }, timeoutMs);
         child.stdout.on('data', (b) => out.push(b));
         child.stderr.on('data', (b) => err.push(b));
+        // Missing git binary / bad cwd emits 'error' with no 'close' — without
+        // this every caller hangs to its own timeout instead of failing fast.
+        child.on('error', (e) => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(timer);
+            resolve({ code: 1, out: Buffer.concat(out).toString('utf-8'), err: String(e?.message ?? e) });
+        });
         child.on('close', (code) => {
+            if (done)
+                return;
+            done = true;
             clearTimeout(timer);
             resolve({ code: code ?? 1, out: Buffer.concat(out).toString('utf-8'), err: Buffer.concat(err).toString('utf-8') });
         });

package/dist/tools/lsp/diagnostics.d.ts

@@ -49,3 +49,53 @@ export declare const lspGotoDefinitionTool: import("../types.js").Tool<{
     readonly candidates: number;
     readonly note?: undefined;
 }>;
+export declare const lspReferencesTool: import("../types.js").Tool<{
+    path: string;
+    line: number;
+    character?: number | undefined;
+}, {
+    readonly enabled: false;
+    readonly references: readonly [];
+    readonly note: "LSP off via KLYRO_LSP=0";
+} | {
+    readonly enabled: true;
+    readonly references: readonly [];
+    readonly note: `unreadable file: ${string}`;
+} | {
+    readonly enabled: true;
+    readonly references: readonly [];
+    readonly note: "no identifier under cursor";
+} | {
+    readonly enabled: true;
+    readonly references: {
+        file: string;
+        line: number;
+        kind: string;
+        name: string;
+    }[];
+    readonly note?: undefined;
+}>;
+export declare const lspOutlineTool: import("../types.js").Tool<{
+    path: string;
+}, {
+    readonly enabled: false;
+    readonly outline: readonly [];
+    readonly note: "LSP off via KLYRO_LSP=0";
+} | {
+    readonly enabled: true;
+    readonly outline: readonly [];
+    readonly note: `unreadable file: ${string}`;
+} | {
+    readonly enabled: true;
+    readonly outline: {
+        name: string;
+        kind: string;
+        line: number;
+        children: Array<{
+            name: string;
+            kind: string;
+            line: number;
+        }>;
+    }[];
+    readonly note?: undefined;
+}>;

package/dist/tools/lsp/diagnostics.js

@@ -5,8 +5,10 @@
  * project has one and filters the output to the requested path (or returns
  * a capped full-project list). Other languages report "unsupported".
  * `lsp_goto_definition` resolves the identifier under (line, character) to
- * its definition via the regex repo-map symbol index. Set KLYRO_LSP=0 to
- * force both tools off.
+ * its definition via the regex repo-map symbol index.
+ * `lsp_references` finds all references to the identifier under (line, character).
+ * `lsp_outline` returns a hierarchical symbol outline for a file.
+ * Set KLYRO_LSP=0 to force all tools off.
  */
 import { spawnSync } from 'node:child_process';
 import * as fs from 'node:fs/promises';
@@ -15,7 +17,7 @@ import { z } from 'zod';
 import { defineTool } from '../types.js';
 import { safe } from '../normalize.js';
 import { resolveWithinCwd } from '../../policy/path-guard.js';
-import { buildRepoMap } from '../../context/repo-map.js';
+import { buildRepoMap, extractSymbols } from '../../context/repo-map.js';
 function isOff() {
     return process.env.KLYRO_LSP === '0';
 }
@@ -104,3 +106,107 @@ export const lspGotoDefinitionTool = defineTool({
         return { enabled: true, location: best, candidates: hits.length };
     }),
 });
+export const lspReferencesTool = defineTool({
+    name: 'lsp_references',
+    description: 'Find all references to the identifier under (line, character) via the repo symbol index',
+    inputSchema: z.object({ path: z.string().min(1), line: z.number().int().min(1), character: z.number().int().min(0).optional() }),
+    permission: 'read',
+    isConcurrencySafe: true,
+    execute: async (input, ctx) => safe(async () => {
+        if (isOff())
+            return { enabled: false, references: [], note: 'LSP off via KLYRO_LSP=0' };
+        const { resolved } = resolveWithinCwd(ctx.cwd, input.path, ctx.agentAllowedPaths);
+        let content;
+        try {
+            content = await fs.readFile(resolved, 'utf-8');
+        }
+        catch {
+            return { enabled: true, references: [], note: `unreadable file: ${input.path}` };
+        }
+        const lines = content.split('\n');
+        const lineText = lines[input.line - 1] ?? '';
+        const col = Math.min(input.character ?? 0, lineText.length);
+        const wordAt = (() => {
+            const isWord = (c) => /[A-Za-z0-9_$]/.test(c);
+            let s = col;
+            let e = col;
+            while (s > 0 && isWord(lineText[s - 1]))
+                s--;
+            while (e < lineText.length && isWord(lineText[e]))
+                e++;
+            const w = lineText.slice(s, e);
+            return w || null;
+        })();
+        if (!wordAt)
+            return { enabled: true, references: [], note: 'no identifier under cursor' };
+        const files = await buildRepoMap({ cwd: ctx.cwd, maxFiles: 300 });
+        const refs = [];
+        const seen = new Set();
+        for (const f of files) {
+            for (const s of f.symbols) {
+                if (s.name === wordAt) {
+                    const key = `${f.path}:${s.line}:${s.name}`;
+                    if (!seen.has(key)) {
+                        seen.add(key);
+                        refs.push({ file: f.path, line: s.line, kind: s.kind, name: s.name });
+                    }
+                }
+            }
+        }
+        return { enabled: true, references: refs.slice(0, 100) };
+    }),
+});
+export const lspOutlineTool = defineTool({
+    name: 'lsp_outline',
+    description: 'Hierarchical symbol outline for a file via the repo symbol index',
+    inputSchema: z.object({ path: z.string().min(1) }),
+    permission: 'read',
+    isConcurrencySafe: true,
+    execute: async (input, ctx) => safe(async () => {
+        if (isOff())
+            return { enabled: false, outline: [], note: 'LSP off via KLYRO_LSP=0' };
+        const { resolved } = resolveWithinCwd(ctx.cwd, input.path, ctx.agentAllowedPaths);
+        // Symbol-extract this file directly rather than via buildRepoMap: the repo
+        // map is a whole-tree walk capped by maxFiles, so a single-file query can
+        // never be served from it (it would return whichever file the walk reached
+        // first, and the caller's path would usually be absent).
+        let content;
+        try {
+            content = await fs.readFile(resolved, 'utf-8');
+        }
+        catch {
+            return { enabled: true, outline: [], note: `unreadable file: ${input.path}` };
+        }
+        const symbols = extractSymbols(content, path.extname(resolved).toLowerCase());
+        // Build simple hierarchy: classes/interfaces as parents, methods/fields as children
+        const outline = [];
+        for (const sym of symbols) {
+            if (['class', 'interface', 'type'].includes(sym.kind)) {
+                outline.push({ name: sym.name, kind: sym.kind, line: sym.line, children: [] });
+            }
+        }
+        for (const sym of symbols) {
+            if (['method', 'function', 'property', 'field', 'const'].includes(sym.kind)) {
+                // Assign to the nearest preceding class/interface
+                let parentIdx = -1;
+                for (let i = outline.length - 1; i >= 0; i--) {
+                    const parent = outline[i];
+                    if (parent && parent.line < sym.line) {
+                        parentIdx = i;
+                        break;
+                    }
+                }
+                if (parentIdx >= 0) {
+                    const parentEntry = outline[parentIdx];
+                    if (parentEntry) {
+                        parentEntry.children.push({ name: sym.name, kind: sym.kind, line: sym.line });
+                    }
+                }
+                else {
+                    outline.push({ name: sym.name, kind: sym.kind, line: sym.line, children: [] });
+                }
+            }
+        }
+        return { enabled: true, outline };
+    }),
+});

package/dist/tools/registry.js

@@ -24,7 +24,7 @@ import { askUserTool } from './plan/ask-user.js';
 import { repoMapTool } from './repo-map.js';
 import { importsOfTool, importersOfTool } from './search/imports.js';
 import { findSymbolTool } from './symbols/find-symbol.js';
-import { lspDiagnosticsTool, lspGotoDefinitionTool } from './lsp/diagnostics.js';
+import { lspDiagnosticsTool, lspGotoDefinitionTool, lspReferencesTool, lspOutlineTool } from './lsp/diagnostics.js';
 import { expandResultTool } from './expand-result.js';
 import { memoryWriteTool } from './memory-write.js';
 import { webFetchTool } from './web/web-fetch.js';
@@ -117,6 +117,8 @@ export const builtinRegistry = () => {
     r.register(findSymbolTool);
     r.register(lspDiagnosticsTool);
     r.register(lspGotoDefinitionTool);
+    r.register(lspReferencesTool);
+    r.register(lspOutlineTool);
     r.register(expandResultTool);
     r.register(memoryWriteTool);
     r.register(webFetchTool);

package/dist/tools/shell/background.js

@@ -1,21 +1,58 @@
 /**
  * 4.3 — Background shell: shell(run_in_background), bash_output, kill_shell, /jobs
  */
-import { spawn } from 'node:child_process';
+import { spawn, spawnSync } from 'node:child_process';
 import { findBlockedReason, filteredEnv } from './shell-exec.js';
 const jobs = new Map();
 let counter = 0;
 const MAX_JOBS = 5;
 const JOB_TTL_MS = 10 * 60 * 1000;
+/** Tree-kill: proc.kill() alone leaves grandchildren behind (shell:true). */
+function killTree(proc) {
+    try {
+        if (process.platform === 'win32') {
+            if (proc.pid !== undefined) {
+                spawnSync('taskkill', ['/F', '/T', '/PID', String(proc.pid)], { windowsHide: true });
+            }
+        }
+        else if (proc.pid !== undefined) {
+            // Detached group kill when we own the group, else single kill.
+            try {
+                process.kill(-proc.pid, 'SIGKILL');
+            }
+            catch {
+                try {
+                    proc.kill('SIGKILL');
+                }
+                catch { /* ignore */ }
+            }
+        }
+        else {
+            try {
+                proc.kill('SIGKILL');
+            }
+            catch { /* ignore */ }
+        }
+    }
+    catch { /* ignore */ }
+}
+function watchJob(job) {
+    // A failed spawn (bad cwd, missing shell) emits 'error' with no 'close'
+    // guarantee — without a listener Node throws and takes down the process.
+    job.proc.on('error', (e) => {
+        job.output += `\n[spawn failed: ${e?.message ?? e}]`;
+    });
+    job.proc.on('close', () => {
+        setTimeout(() => { if (jobs.get(job.id)?.proc.exitCode !== null)
+            jobs.delete(job.id); }, JOB_TTL_MS);
+    });
+}
 function pruneJobs() {
     if (jobs.size <= MAX_JOBS)
         return;
     const sorted = [...jobs.values()].sort((a, b) => a.start - b.start);
     for (const j of sorted.slice(0, jobs.size - MAX_JOBS)) {
-        try {
-            j.proc.kill('SIGKILL');
-        }
-        catch { /* ignore */ }
+        killTree(j.proc);
         jobs.delete(j.id);
     }
     for (const j of [...jobs.values()]) {
@@ -33,18 +70,19 @@ export function startBackground(command, cwd) {
         throw new Error(`Command blocked: ${blocked}`);
     const id = `job-${++counter}-${Date.now().toString(36)}`;
     // Filtered env, same call shape as shell_exec — background children must
-    // not inherit secrets from the parent process.
-    const proc = spawn(command, { cwd, shell: true, windowsHide: true, env: filteredEnv() });
+    // not inherit secrets from the parent process. Detached on POSIX so
+    // killTree can take the whole group (mirrors shell_exec).
+    const proc = spawn(command, {
+        cwd, shell: true, windowsHide: true, env: filteredEnv(),
+        ...(process.platform === 'win32' ? {} : { detached: true }),
+    });
     const job = { id, command, cwd, proc, output: '', start: Date.now() };
     jobs.set(id, job);
     proc.stdout?.on('data', (b) => { job.output += b.toString(); if (job.output.length > 1_000_000)
         job.output = job.output.slice(-1_000_000); });
     proc.stderr?.on('data', (b) => { job.output += b.toString(); if (job.output.length > 1_000_000)
         job.output = job.output.slice(-1_000_000); });
-    proc.on('close', () => {
-        setTimeout(() => { if (jobs.get(id)?.proc.exitCode !== null)
-            jobs.delete(id); }, JOB_TTL_MS);
-    });
+    watchJob(job);
     return id;
 }
 /**
@@ -66,10 +104,7 @@ export function startBackgroundArgv(argv, cwd) {
         job.output = job.output.slice(-1_000_000); });
     proc.stderr?.on('data', (b) => { job.output += b.toString(); if (job.output.length > 1_000_000)
         job.output = job.output.slice(-1_000_000); });
-    proc.on('close', () => {
-        setTimeout(() => { if (jobs.get(id)?.proc.exitCode !== null)
-            jobs.delete(id); }, JOB_TTL_MS);
-    });
+    watchJob(job);
     return id;
 }
 export function getOutput(id, filter) {
@@ -84,10 +119,7 @@ export function killJob(id) {
     const job = jobs.get(id);
     if (!job)
         throw new Error(`No job ${id}`);
-    try {
-        job.proc.kill('SIGKILL');
-    }
-    catch { /* ignore */ }
+    killTree(job.proc);
     jobs.delete(id);
 }
 /**
@@ -98,10 +130,7 @@ export function killJob(id) {
 export function killAllJobs() {
     const killed = [];
     for (const job of [...jobs.values()]) {
-        try {
-            job.proc.kill('SIGKILL');
-        }
-        catch { /* ignore */ }
+        killTree(job.proc);
         jobs.delete(job.id);
         killed.push(job.id);
     }

package/dist/tools/verify/run-verify.js

@@ -10,6 +10,7 @@ import { spawn, spawnSync } from 'node:child_process';
 import { z } from 'zod';
 import { defineTool } from '../types.js';
 import { safe, TOOL_ERROR_CODES } from '../normalize.js';
+import { resolveWithinCwd } from '../../policy/path-guard.js';
 import { filteredVerifyEnv } from '../../verification/registry.js';
 const InputSchema = z.object({
     command: z.string().min(1).describe('Verification command, e.g. "npm test" or "tsc --noEmit"'),
@@ -24,7 +25,16 @@ export const runVerifyTool = defineTool({
     inputSchema: InputSchema,
     execute: async (input, ctx) => {
         return safe(async () => {
-            const cwd = input.cwd ?? ctx.cwd;
+            // Contain the model-supplied cwd to the workspace (mirrors shell_exec):
+            // without this the verify command could run in /etc, ~/.ssh, or any
+            // other directory outside the sandbox roots.
+            let cwd;
+            try {
+                cwd = resolveWithinCwd(ctx.cwd, input.cwd ?? '.').resolved;
+            }
+            catch {
+                throw Object.assign(new Error('run_verify cwd escapes workspace (POLICY_DENIED)'), { code: TOOL_ERROR_CODES.PATH_ESCAPE });
+            }
             const timeoutMs = input.timeoutMs ?? DEFAULT_TIMEOUT_MS;
             // S2: verify commands run with filtered env; servers needing keys must use explicit config.
             const env = filteredVerifyEnv();

package/dist/tui/app.d.ts

@@ -37,4 +37,9 @@ export interface AppProps {
     version?: string;
     isFullscreen?: boolean;
 }
+declare const MAX_TRANSCRIPT_ITEMS = 500;
+export { MAX_TRANSCRIPT_ITEMS as TRANSCRIPT_ITEM_CAP };
+export declare function capTranscript<T extends {
+    kind: string;
+}>(prev: T[]): T[];
 export declare function App(props: AppProps): React.JSX.Element;