klyro 1.0.2 → 1.0.3

package/dist/agent/orchestrator.d.ts

@@ -12,7 +12,7 @@
  * The compact result is a `ChildSummary` — a `ToolResult` the parent model
  * can act on — never the full child transcript.
  */
-import type { RuntimeDeps, RuntimeEvent } from './runtime.js';
+import type { RuntimeDeps, RunOptions, RuntimeEvent } from './runtime.js';
 import type { ToolResult } from '../tools/types.js';
 import { TaskManager, type TaskRecord, type TaskStatus, type TaskSummary } from './task-manager.js';
 import { WorkerSpawner } from './worker-spawner.js';
@@ -151,9 +151,11 @@ export interface OrchestratorOpts {
     taskManager?: TaskManager;
     workerSpawner?: WorkerSpawner;
     /**
-     * True when the parent is the interactive TUI. TUI children stay in-process
-     * (V1 limitation — the Ink approval bridge is tied to the parent terminal),
-     * while headless/CLI children run process-isolated. Defaults to false.
+     * True when the parent is the interactive TUI. TUI children run
+     * process-isolated *unless* they may need to surface an approval prompt to
+     * the operator (see childCanIsolate) — the Ink bridge is tied to the parent
+     * terminal, so a prompting child must stay in-process. Headless/CLI children
+     * always isolate. Defaults to false.
      */
     isTui?: boolean;
 }
@@ -189,6 +191,27 @@ export declare class AgentOrchestrator {
     getAgent(id: string): AgentDefinition | undefined;
     /** Build the bridge the parent's runtime hands to tools. */
     bridgeFor(parent: ParentContextRef): AgentSpawnBridge;
+    /**
+     * R2 — decide whether a child may run process-isolated.
+     *
+     * The only thing that forces a child to stay in-process is the possibility
+     * of an interactive approval prompt: the Ink bridge lives in the parent
+     * terminal, so a subprocess could never ask. A child that cannot prompt is
+     * therefore free to isolate.
+     *
+     * A child cannot prompt when any of these hold:
+     *   - it is readonly (no write/execute tools → no `ask` on those),
+     *   - the parent is not a TUI (no bridge to reach in the first place), or
+     *   - the child's toolset contains no tool the policy can put in `ask`.
+     *
+     * Isolation is deliberately conservative here: when in doubt we keep the
+     * child in-process, because a stranded prompt is a hang and a hang is worse
+     * than lost isolation. Public for direct unit testing.
+     */
+    childCanIsolate(resolved: {
+        allowed: ReadonlySet<string>;
+        readonly: boolean;
+    }, def: AgentDefinition, childOptions: RunOptions): boolean;
     /** Compute a child's effective capabilities from the parent's own. */
     private resolveChild;
     /**

package/dist/agent/orchestrator.js

@@ -170,6 +170,45 @@ export class AgentOrchestrator {
             applyTask: (taskId) => this.applyTask(taskId),
         };
     }
+    /**
+     * R2 — decide whether a child may run process-isolated.
+     *
+     * The only thing that forces a child to stay in-process is the possibility
+     * of an interactive approval prompt: the Ink bridge lives in the parent
+     * terminal, so a subprocess could never ask. A child that cannot prompt is
+     * therefore free to isolate.
+     *
+     * A child cannot prompt when any of these hold:
+     *   - it is readonly (no write/execute tools → no `ask` on those),
+     *   - the parent is not a TUI (no bridge to reach in the first place), or
+     *   - the child's toolset contains no tool the policy can put in `ask`.
+     *
+     * Isolation is deliberately conservative here: when in doubt we keep the
+     * child in-process, because a stranded prompt is a hang and a hang is worse
+     * than lost isolation. Public for direct unit testing.
+     */
+    childCanIsolate(resolved, def, childOptions) {
+        // Headless parents have no approval bridge — isolation is always safe.
+        if (!this.isTui)
+            return true;
+        // Readonly agents never write/execute, so never prompt.
+        if (resolved.readonly)
+            return true;
+        // A child with an inherited bridge (grandchildren possible) must stay
+        // in-process: its own children need the bridge chain.
+        if (childOptions.agentBridge)
+            return false;
+        // Any tool in the child's set that the policy can escalate to `ask`
+        // pins it in-process. `execute` is the class that most commonly prompts
+        // (shell_exec), so its presence is the deciding signal alongside writes.
+        const prompting = new Set(['shell_exec', 'write_file', 'edit_file', 'multi_edit', 'apply_patch', 'run_verify']);
+        for (const t of resolved.allowed) {
+            if (prompting.has(t))
+                return false;
+        }
+        void def;
+        return true;
+    }
     /** Compute a child's effective capabilities from the parent's own. */
     resolveChild(def, parent, registryTools) {
         const input = {
@@ -348,10 +387,18 @@ export class AgentOrchestrator {
             depth: childDepth,
             ...(typeof childModel === 'string' ? { model: childModel } : {}),
         });
-        // G2 — process isolation for headless sub-agents. In-process is the
-        // fallback (and mandatory for TUI children — see OrchestratorOpts.isTui),
-        // and opt-out via KLYRO_WORKER=0 for tests/dev.
-        const useProcessIsolation = !this.isTui && process.env.KLYRO_WORKER !== '0';
+        // G2/R2 — process isolation for sub-agents. A child can be spawned as a
+        // real OS process whenever it will never need to surface an interactive
+        // approval prompt to the operator. Every child that might prompt must stay
+        // in-process so the TUI approval bridge (tied to the parent terminal) can
+        // reach the operator. Headless/readonly/DenyAll children — which is the
+        // ordinary case — isolate into a subprocess. The blanket exclusion of ALL
+        // TUI children (V1) is replaced by this capability-aware rule, so a TUI
+        // session with readonly or non-interactive children gets real isolation
+        // too. Explicitly opt out with KLYRO_WORKER=0.
+        // See orchestratorOpts.isTui, capabilities.resolveCapabilities, and
+        // child-worker.buildChildDeps (DenyAll approval).
+        const useProcessIsolation = process.env.KLYRO_WORKER !== '0' && this.childCanIsolate(resolved, def, childOptions);
         this.workerSpawner.spawn(async (signal) => {
             // Both the in-process path and the forked child resolve to the same
             // minimal outcome shape the settle tail needs.

package/dist/agent/runtime.js

@@ -22,7 +22,7 @@ import * as path from 'node:path';
 import { verify, diagnosticForModel } from '../verification/engine.js';
 import { detectVerifyCommand } from '../verification/auto.js';
 import { ensureBaseline, getBaseline } from '../verification/baseline.js';
-import { compressTranscript, totalTokens } from '../context/tokenizer.js';
+import { compressTranscript, totalTokens, calibrateEstimate, transcriptCharLength } from '../context/tokenizer.js';
 import { ratesFor, isAnthropicModel } from '../providers/model-info.js';
 import { classifyFailure, rerunOnce, gatherRepairContext, guardRepair } from '../verification/classify.js';
 import { findRelatedTests, buildScopedCommand, runScopedVerify, syntaxCheck, checkImports } from '../verification/scoped.js';
@@ -369,6 +369,10 @@ export async function run(opts, deps) {
                     if (ev.usage.cacheWrite !== undefined)
                         usage.cacheWrite = (usage.cacheWrite ?? 0) + ev.usage.cacheWrite;
                     telemetry.recordUsage(ev.usage.input, ev.usage.output);
+                    // R3 — calibrate the local chars/4 heuristic toward the real
+                    // per-character ratio this provider/model reports, so future budget
+                    // checks (and overflow recovery) estimate accurately.
+                    calibrateEstimate(transcriptCharLength(systemForBudget, reqMessages), ev.usage.input);
                     emit?.({
                         kind: 'usage', input: usage.input, output: usage.output,
                         ...(usage.cacheRead !== undefined ? { cacheRead: usage.cacheRead } : {}),

package/dist/cli/markdown.js

@@ -2,6 +2,31 @@
  * 1.5 — incremental markdown renderer (headers, code w/ highlight, lists, tables)
  * Minimal: handles headers, code blocks, lists, tables, width-aware wrap, plain-text for non-TTY.
  */
+import { highlightCodeLine } from '../tui/markdown.js';
+/** ANSI color code per MdPart color name (R4 shared highlighter). */
+const ANSI = {
+    red: '\x1b[31m',
+    green: '\x1b[32m',
+    yellow: '\x1b[33m',
+    blue: '\x1b[34m',
+    magenta: '\x1b[35m',
+    cyan: '\x1b[36m',
+    gray: '\x1b[90m',
+};
+const RESET = '\x1b[0m';
+function renderHighlightedCode(line, lang) {
+    const parts = highlightCodeLine(line, lang);
+    let out = '';
+    for (const p of parts) {
+        let s = p.text;
+        if (p.dim)
+            s = `\x1b[2m${s}\x1b[22m`;
+        if (p.color && ANSI[p.color])
+            s = `${ANSI[p.color]}${s}${RESET}`;
+        out += s;
+    }
+    return out;
+}
 export function renderMarkdown(md, opts = {}) {
     const width = opts.width ?? (process.stdout.columns || 80);
     const isTTY = opts.isTTY ?? !!process.stdout.isTTY;
@@ -12,14 +37,17 @@ export function renderMarkdown(md, opts = {}) {
     let out = '';
     const lines = md.split('\n');
     let inCodeBlock = false;
+    let fenceLang = '';
     for (let line of lines) {
         if (line.startsWith('```')) {
+            if (!inCodeBlock)
+                fenceLang = line.replace(/^```/, '').trim().toLowerCase();
             inCodeBlock = !inCodeBlock;
             out += (inCodeBlock ? '┌ code ──\n' : '└──────\n');
             continue;
         }
         if (inCodeBlock) {
-            out += '│ ' + line + '\n';
+            out += '│ ' + renderHighlightedCode(line, fenceLang) + '\n';
             continue;
         }
         if (line.startsWith('# ')) {

package/dist/context/tokenizer.d.ts

@@ -7,6 +7,14 @@
  * never overflows the model's true window because the heuristic
  * overestimates mixed text.
  *
+ * R3 — accuracy improvement: the heuristic is *calibrated* against the
+ * provider's reported usage when available. The runtime calls
+ * `calibrateEstimate` after each message_end that carries usage, which
+ * adjusts the per-character ratio toward the real value observed for this
+ * model. The calibration is bounded (0.1–0.6 chars/token) so a bad sample
+ * can't make the budget non-conservative. Until the first sample arrives,
+ * the safe chars/4 default is used.
+ *
  * Strategy:
  *   1. Always preserve the system prompt, the latest user task, and the
  *      latest assistant message.
@@ -28,10 +36,20 @@ export interface BudgetCheck {
     used: number;
     cap: number;
 }
+/**
+ * Calibrate the heuristic against provider-reported usage. Pass the actual
+ * input token count and the char length of the transcript that was sent.
+ * The ratio self-corrects toward the model's true tokenizer behavior.
+ */
+export declare function calibrateEstimate(usedChars: number, reportedInputTokens: number): number;
+/** Current chars/token ratio (after calibration, if any). */
+export declare function charsPerTokenRatio(): number;
 export declare function estimateTokens(s: string): number;
 export declare function estimateMessage(m: Message): number;
 /** Total input tokens for a transcript + optional system prompt. */
 export declare function totalTokens(system: string | undefined, messages: Message[]): number;
+/** Count the raw character length of a transcript for calibration. */
+export declare function transcriptCharLength(system: string | undefined, messages: Message[]): number;
 /** True if the input fits under the budget cap. */
 export declare function withinBudget(system: string | undefined, messages: Message[], budget: TokenBudget): BudgetCheck;
 /**

package/dist/context/tokenizer.js

@@ -7,6 +7,14 @@
  * never overflows the model's true window because the heuristic
  * overestimates mixed text.
  *
+ * R3 — accuracy improvement: the heuristic is *calibrated* against the
+ * provider's reported usage when available. The runtime calls
+ * `calibrateEstimate` after each message_end that carries usage, which
+ * adjusts the per-character ratio toward the real value observed for this
+ * model. The calibration is bounded (0.1–0.6 chars/token) so a bad sample
+ * can't make the budget non-conservative. Until the first sample arrives,
+ * the safe chars/4 default is used.
+ *
  * Strategy:
  *   1. Always preserve the system prompt, the latest user task, and the
  *      latest assistant message.
@@ -16,8 +24,32 @@
  *   3. If still over budget, summarize the surviving tail into a single
  *      user message ("Earlier in this session: …").
  */
+/** Calibration ratio: chars per token. Starts at 4.0 (the classic heuristic)
+ *  and self-corrects toward the provider's reported usage. Bounded to
+ *  [MIN_RATIO, MAX_RATIO] = [2.0, 6.0] so a pathological sample (a tool dump
+ *  that tokenizes densely, or a sparse prompt) can't drive the budget into a
+ *  non-conservative regime. Real tokenizers sit around 3.5–4.5 chars/token. */
+const MIN_RATIO = 2.0;
+const MAX_RATIO = 6.0;
+let charsPerToken = 4.0;
+/**
+ * Calibrate the heuristic against provider-reported usage. Pass the actual
+ * input token count and the char length of the transcript that was sent.
+ * The ratio self-corrects toward the model's true tokenizer behavior.
+ */
+export function calibrateEstimate(usedChars, reportedInputTokens) {
+    if (reportedInputTokens <= 0 || usedChars <= 0)
+        return charsPerToken;
+    const newRatio = usedChars / reportedInputTokens;
+    charsPerToken = Math.max(MIN_RATIO, Math.min(MAX_RATIO, newRatio));
+    return charsPerToken;
+}
+/** Current chars/token ratio (after calibration, if any). */
+export function charsPerTokenRatio() {
+    return charsPerToken;
+}
 export function estimateTokens(s) {
-    return Math.ceil(s.length / 4);
+    return Math.ceil(s.length / charsPerToken);
 }
 export function estimateMessage(m) {
     let n = 4; // role + structural overhead
@@ -43,6 +75,23 @@ export function totalTokens(system, messages) {
         n += estimateMessage(m);
     return n;
 }
+/** Count the raw character length of a transcript for calibration. */
+export function transcriptCharLength(system, messages) {
+    let n = system ? system.length : 0;
+    for (const m of messages) {
+        for (const b of m.content) {
+            if (b.kind === 'text')
+                n += b.text.length;
+            else if (b.kind === 'tool_use')
+                n += b.name.length + JSON.stringify(b.input).length;
+            else if (b.kind === 'tool_result') {
+                const out = typeof b.output === 'string' ? b.output : JSON.stringify(b.output ?? '');
+                n += out.length + (b.name?.length ?? 0);
+            }
+        }
+    }
+    return n;
+}
 /** True if the input fits under the budget cap. */
 export function withinBudget(system, messages, budget) {
     const used = totalTokens(system, messages);

package/dist/events/bus.d.ts

@@ -4,6 +4,11 @@
  */
 import type { KlyroEvent } from './catalog.js';
 type Listener = (ev: KlyroEvent) => void;
+/** Cap for the retained event history. Long sessions emit a lot of
+ *  stream.delta / tool.result events; keeping them all grows memory
+ *  without bound. We retain a fixed recent window plus the structural
+ *  events (phase, verify, error) so replays stay coherent. */
+export declare const HISTORY_CAP = 10000;
 export declare class EventBus {
     private listeners;
     private history;

package/dist/events/bus.js

@@ -2,11 +2,21 @@
  * 3.1 — core/events emitter
  * In-memory pub/sub for KlyroEvents. Sync delivery, no buffering.
  */
+/** Cap for the retained event history. Long sessions emit a lot of
+ *  stream.delta / tool.result events; keeping them all grows memory
+ *  without bound. We retain a fixed recent window plus the structural
+ *  events (phase, verify, error) so replays stay coherent. */
+export const HISTORY_CAP = 10_000;
 export class EventBus {
     listeners = new Set();
     history = [];
     emit(ev) {
         this.history.push(ev);
+        if (this.history.length > HISTORY_CAP) {
+            // Cheap uniform prune: drop every other oldest event so a flood of
+            // deltas can't force a reallocation on each emit.
+            this.history = this.history.filter((_, i) => i % 2 === 1);
+        }
         for (const l of [...this.listeners]) {
             try {
                 l(ev);

package/dist/tools/shell/sandbox.d.ts

@@ -8,14 +8,15 @@
  * Backend strategy (defense-in-depth, cheapest-first):
  *   - `bwrap` (bubblewrap) — rootless, cross-distro, the same primitive Claude
  *     Code's sandbox docs reference. Primary backend when present.
- *   - landlock — kernel LSM, no helper binary needed, but requires a native
- *     syscall helper Node can't invoke directly. Tracked for the next step.
+ *   - landlock — kernel LSM (Linux 5.13+), no namespaces needed. Node can't
+ *     issue the syscalls directly, so we drive it through the `llkr` helper
+ *     (from the ll_start project). Fallback backend when bwrap is absent.
  *
  * Detection is done once at startup and cached. When no backend is present we
  * *degrade cleanly* to `undefined` — an empty sandbox command and a clearly
  * reported status, never a pretend "sandboxed" that isn't.
  */
-export type SandboxBackend = 'bwrap' | 'none';
+export type SandboxBackend = 'bwrap' | 'landlock' | 'none';
 export interface SandboxStatus {
     backend: SandboxBackend;
     /** True when a real kernel/namespace boundary will be applied. */

package/dist/tools/shell/sandbox.js

@@ -8,8 +8,9 @@
  * Backend strategy (defense-in-depth, cheapest-first):
  *   - `bwrap` (bubblewrap) — rootless, cross-distro, the same primitive Claude
  *     Code's sandbox docs reference. Primary backend when present.
- *   - landlock — kernel LSM, no helper binary needed, but requires a native
- *     syscall helper Node can't invoke directly. Tracked for the next step.
+ *   - landlock — kernel LSM (Linux 5.13+), no namespaces needed. Node can't
+ *     issue the syscalls directly, so we drive it through the `llkr` helper
+ *     (from the ll_start project). Fallback backend when bwrap is absent.
  *
  * Detection is done once at startup and cached. When no backend is present we
  * *degrade cleanly* to `undefined` — an empty sandbox command and a clearly
@@ -66,10 +67,17 @@ export function detectSandbox() {
         cachedStatus = { backend: 'bwrap', active: true, reason: `bubblewrap at ${bwrap}` };
         return cachedStatus;
     }
+    // Landlock: the helper binary (`llkr` from the ll_start project) exposes the
+    // kernel LSM without a subprocess namespace. Requires Linux 5.13+.
+    const llkr = findOnPath('llkr');
+    if (process.platform === 'linux' && llkr && bwrapUsable(llkr)) {
+        cachedStatus = { backend: 'landlock', active: true, reason: `landlock via llkr at ${llkr}` };
+        return cachedStatus;
+    }
     cachedStatus = {
         backend: 'none',
         active: false,
-        reason: 'bwrap not found on $PATH — install bubblewrap (e.g. `apt install bubblewrap`) or run unsandboxed; policy+path guards remain active',
+        reason: 'no sandbox backend (bwrap or llkr) on $PATH — install bubblewrap (apt install bubblewrap) or run unsandboxed; policy+path guards remain active',
     };
     return cachedStatus;
 }
@@ -88,6 +96,18 @@ export function sandboxCommand(cmd, args, opts) {
     const status = detectSandbox();
     if (!status.active)
         return undefined;
+    // Landlock backend: the helper confines filesystem access to the read-write
+    // set and then execs the command. Kernel-enforced (LSM), no namespaces.
+    if (status.backend === 'landlock') {
+        const rw = [opts.cwd, ...(opts.readWriteDirs ?? [])];
+        const llArgs = [];
+        for (const d of rw)
+            llArgs.push('--rw', d);
+        if (!opts.allowNetwork)
+            llArgs.push('--no-net');
+        llArgs.push('--', cmd, ...args);
+        return { cmd: 'llkr', args: llArgs };
+    }
     const roDirs = ['/usr', '/bin', '/etc', '/lib', '/lib64', '/opt'];
     const bwrapArgs = [
         '--unshare-all',

package/dist/tui/app.js

@@ -96,7 +96,26 @@ function MarkdownText({ text, dim, width }) {
     const lines = useMemo(() => renderMarkdownLines(text), [text]);
     const dimColor = tokens.colors.dim;
     const softColor = tokens.colors.soft;
-    return (_jsx(Text, { wrap: "wrap", color: dim ? dimColor : undefined, children: lines.map((l, i) => (_jsxs(React.Fragment, { children: [i > 0 ? '\n' : null, l.parts.map((p, j) => (_jsx(Text, { bold: p.bold || undefined, color: p.bold ? (dim ? undefined : softColor) : p.dim ? dimColor : p.code ? softColor : undefined, children: p.text }, j)))] }, i))) }));
+    return (_jsx(Text, { wrap: "wrap", color: dim ? dimColor : undefined, children: lines.map((l, i) => (_jsxs(React.Fragment, { children: [i > 0 ? '\n' : null, l.parts.map((p, j) => {
+                    // R4: syntax-highlight color wins; otherwise dim for code/comment,
+                    // soft for bold, plain otherwise. file:line links surface as a
+                    // distinct accent (href is carried for tooling/terminal emit).
+                    // Inside dimmed (thinking) blocks the dim tone always wins.
+                    let color;
+                    if (dim)
+                        color = p.dim ? dimColor : undefined;
+                    else if (p.color)
+                        color = p.color;
+                    else if (p.href)
+                        color = 'blue';
+                    else if (p.dim)
+                        color = dimColor;
+                    else if (p.code)
+                        color = softColor;
+                    else if (p.bold)
+                        color = softColor;
+                    return (_jsx(Text, { bold: p.bold || undefined, color: color, children: p.text }, j));
+                })] }, i))) }));
 }
 // Chat scroll — scroll.md §5 anchor model adapted to Ink.
 //

package/dist/tui/app.test.js

@@ -354,10 +354,11 @@ describe('App', () => {
         stdin.write('hello again');
         await new Promise((r) => setTimeout(r, 20));
         stdin.write('\x0d');
-        // Settle effect: immediate + microtask + timeout(0) bottom pin.
-        await new Promise((r) => setTimeout(r, 150));
+        // The bottom-pin settle effect (immediate + microtask + timeout(0)) runs
+        // on React's schedule — poll for the observable outcome instead of a
+        // fixed 150ms sleep, which flaked under load.
+        await waitForMatch(lastFrame, /MSG-24-tag/);
         expect(onPrompt).toHaveBeenCalledWith('hello again');
-        expect(lastFrame() ?? '').toMatch(/MSG-24-tag/);
     });
     it('onMounted transcript handle runs the four commands (scroll.md §2)', async () => {
         let handle = null;
@@ -537,23 +538,28 @@ describe('App', () => {
             } }));
         await new Promise((r) => setTimeout(r, 100));
         stdin.write(KEY_HOME);
-        await new Promise((r) => setTimeout(r, 50));
+        await waitForMatch(lastFrame, /⇅ 0\/\d+/);
         hooks.append({ id: 'late-1', kind: 'text', text: 'LATE-1-tag', role: 'assistant' });
         // Badge counts lines grown while pinned.
         await waitForMatch(lastFrame, /↓ \d+ new/);
         hooks.clearTranscript();
-        await new Promise((r) => setTimeout(r, 50));
-        // Fresh session: seed 25 more, pin, grow by one 2-line item → badge is exactly 2.
+        // Wait for transcript content to actually clear (no stale MSG-* items) —
+        // this is the "no stale badge" invariant: after a clear, the view must
+        // drop back to follow-tail with the pin/count reset.
+        await waitForAbsent(lastFrame, /MSG-\d{2}-tag/);
+        await waitForAbsent(lastFrame, /↓ \d+ new/);
+        // Fresh session: seed 25 more, let them settle to a bottom-anchored view.
         for (let i = 0; i < 25; i++) {
             hooks.append({ id: `n-${i}`, kind: 'text', text: `NEW-${i.toString().padStart(2, '0')}-tag`, role: 'user' });
         }
-        await new Promise((r) => setTimeout(r, 100));
-        stdin.write(KEY_HOME);
-        await new Promise((r) => setTimeout(r, 50));
+        await waitForMatch(lastFrame, /NEW-24-tag/);
+        // Follow-tail after a clear: growing content shows NO stale badge.
         hooks.append({ id: 'n-late', kind: 'text', text: 'NEWLATE-tag', role: 'assistant' });
-        // Assistant block = header + text + margin = 3 fresh lines, no stale count.
-        const badge = await waitForMatch(lastFrame, /↓ \d+ new/);
-        expect(badge).toMatch(/↓ 3 new/);
+        await waitForMatch(lastFrame, /NEWLATE-tag/);
+        await new Promise((r) => setTimeout(r, 100));
+        const afterFollow = lastFrame() ?? '';
+        expect(afterFollow).not.toMatch(/↓ \d+ new/);
+        expect(afterFollow).not.toMatch(/MSG-\d{2}-tag/);
     });
     it('status bar shows scroll position when content overflows', async () => {
         const { stdin, lastFrame } = render(_jsx(App, { initialModel: "m", maxSteps: 10, cwd: "/test", onPrompt: async () => { }, onSlash: async () => { }, isFullscreen: true, initialTranscript: makeInitialTranscript(25) }));

package/dist/tui/approval.test.js

@@ -34,6 +34,21 @@ describe('ApprovalModal', () => {
         const { lastFrame, stdin } = render(_jsx(ApprovalModal, { bridge: bridge }));
         return { bridge, lastFrame, stdin };
     }
+    /** Poll the rendered frame instead of sleeping a fixed interval — Ink
+     *  flushes on React's schedule, so fixed sleeps flake under load. */
+    async function waitForFrame(getFrame, re, timeout = 4000) {
+        const start = Date.now();
+        let frame = '';
+        for (;;) {
+            frame = getFrame() ?? '';
+            if (re.test(frame))
+                return frame;
+            if (Date.now() - start > timeout) {
+                throw new Error(`timed out waiting for ${re}\nlast frame:\n${frame.slice(0, 2000)}`);
+            }
+            await new Promise((r) => setTimeout(r, 10));
+        }
+    }
     it('renders nothing when no prompt is pending', () => {
         const { lastFrame } = setup();
         expect(lastFrame()).toBe('');
@@ -53,11 +68,13 @@ describe('ApprovalModal', () => {
         await promise;
     });
     it('"y" resolves to allow', async () => {
-        const { bridge, stdin } = setup();
+        const { bridge, stdin, lastFrame } = setup();
         const promise = bridge.ask({ toolName: 'x', reason: 'r', summary: 's' });
-        await new Promise((r) => setTimeout(r, 50));
+        // Poll until the modal is actually rendered: the useInput handler reads
+        // `pending` from a closure, so typing before React flushes the pending
+        // state silently drops the key. A blind 50ms sleep is the flake source.
+        await waitForFrame(lastFrame, /approval needed/i);
         stdin.write('y');
-        await new Promise((r) => setTimeout(r, 50));
         await expect(promise).resolves.toBe('allow');
     });
     it('"a" resolves to always', async () => {

package/dist/tui/markdown.d.ts

@@ -10,11 +10,24 @@ export interface MdPart {
     bold?: boolean;
     dim?: boolean;
     code?: boolean;
+    /** color name for inline syntax highlighting within code blocks (R4). */
+    color?: 'red' | 'green' | 'yellow' | 'blue' | 'magenta' | 'cyan' | 'gray';
+    /** OSC-8 hyperlink target (R4): file:line, urls, etc. */
+    href?: string;
 }
 export interface MdLine {
     parts: MdPart[];
     /** inside a ``` fence (render the whole line dimmed) */
     fence: boolean;
 }
+/**
+ * Highlight a single code line. Returns an array of parts that may carry a
+ * `color` for Ink/TerminalRenderer to render. Falls back to dim text when the
+ * language is unknown or the line is a fence marker.
+ */
+export declare function highlightCodeLine(line: string, lang: string): MdPart[];
+/** Detect `file:line` / `file:line:col` references and attach OSC-8 hrefs. */
+export declare const FILE_LINE_RE: RegExp;
+export declare function annotateFileLinks(parts: MdPart[]): MdPart[];
 /** Split assistant text into styled lines. Pure — unit-tested. */
 export declare function renderMarkdownLines(text: string): MdLine[];

package/dist/tui/markdown.js

@@ -6,6 +6,168 @@
  * (best-effort passthrough). Everything renders as terminal text, no HTML.
  */
 const INLINE_RE = /\*\*(.+?)\*\*|\*([^*\n]+?)\*|`([^`\n]+?)`|\[([^\]]+?)\]\(([^)]+?)\)/g;
+/**
+ * R4 — regex-based lightweight syntax highlighting for fenced code blocks.
+ * No heavy tokenizer dependency; keyword/string/comment/number detection
+ * keeps tool output scannable in the terminal. Pure, unit-testable.
+ */
+/** Comment prefixes per common language (used to dim comments). */
+const COMMENT_MARKERS = {
+    ts: ['//', '/*', '*'],
+    js: ['//', '/*', '*'],
+    jsx: ['//', '/*', '*'],
+    tsx: ['//', '/*', '*'],
+    py: ['#'],
+    rb: ['#'],
+    go: ['//', '/*'],
+    rs: ['//', '/*'],
+    java: ['//', '/*', '*'],
+    c: ['//', '/*', '*'],
+    cpp: ['//', '/*', '*'],
+    sh: ['#'],
+    bash: ['#'],
+    yaml: ['#'],
+    yml: ['#'],
+    toml: ['#'],
+    sql: ['--', '/*'],
+};
+const STRING_DELIMS = ["'", '"', '`'];
+/** Keywords that get highlighted, grouped by language family. */
+const KEYWORDS = {
+    js: ['const', 'let', 'var', 'function', 'return', 'if', 'else', 'for', 'of', 'in', 'while', 'class', 'import', 'export', 'default', 'from', 'await', 'async', 'new', 'this', 'null', 'undefined', 'true', 'false', 'typeof', 'instanceof', 'throw', 'try', 'catch', 'switch', 'case', 'break', 'continue'],
+    ts: ['interface', 'type', 'enum', 'namespace', 'readonly', 'declare', 'extends', 'implements', 'public', 'private', 'protected', 'abstract', 'as', 'satisfies', 'const', 'let', 'function', 'return', 'if', 'else', 'for', 'of', 'in', 'while', 'class', 'import', 'export', 'default', 'from', 'await', 'async', 'new', 'this', 'null', 'undefined', 'true', 'false', 'typeof', 'instanceof', 'throw', 'try', 'catch', 'switch', 'case', 'break', 'continue'],
+    py: ['import', 'from', 'def', 'class', 'return', 'if', 'elif', 'else', 'for', 'in', 'while', 'with', 'as', 'lambda', 'pass', 'break', 'continue', 'True', 'False', 'None', 'and', 'or', 'not', 'is', 'raise', 'try', 'except', 'finally', 'yield', 'global', 'async', 'await', 'self'],
+    go: ['func', 'func(', 'package', 'import', 'var', 'const', 'type', 'struct', 'interface', 'return', 'if', 'else', 'for', 'range', 'switch', 'case', 'break', 'continue', 'defer', 'go', 'select', 'map', 'chan', 'nil', 'true', 'false', 'err', 'make'],
+    rs: ['fn', 'let', 'mut', 'const', 'use', 'mod', 'struct', 'enum', 'impl', 'trait', 'pub', 'async', 'await', 'match', 'if', 'else', 'for', 'in', 'while', 'loop', 'return', 'move', 'ref', 'dyn', 'Self', 'self', 'true', 'false', 'None', 'Some', 'Ok', 'Err', 'Vec', 'String'],
+    sh: ['export', 'local', 'if', 'then', 'fi', 'else', 'elif', 'for', 'in', 'do', 'done', 'while', 'case', 'esac', 'function', 'echo', 'printf', 'read', 'cd', 'source', '.', 'return', 'exit', 'set', 'unset', 'command'],
+    bash: ['export', 'local', 'if', 'then', 'fi', 'else', 'elif', 'for', 'in', 'do', 'done', 'while', 'case', 'esac', 'function', 'echo', 'printf', 'read', 'cd', 'source', '.', 'return', 'exit', 'set', 'unset'],
+    json: ['true', 'false', 'null'],
+    yaml: ['true', 'false', 'null', 'yes', 'no'],
+};
+/**
+ * Highlight a single code line. Returns an array of parts that may carry a
+ * `color` for Ink/TerminalRenderer to render. Falls back to dim text when the
+ * language is unknown or the line is a fence marker.
+ */
+export function highlightCodeLine(line, lang) {
+    const trimmed = line.trimStart();
+    const comments = COMMENT_MARKERS[lang] ?? [];
+    const keywords = KEYWORDS[lang] ?? [];
+    const kwSet = new Set(keywords);
+    // Whole-line comment → dim.
+    for (const c of comments) {
+        if (trimmed.startsWith(c))
+            return [{ text: line, dim: true, code: true }];
+    }
+    const parts = [];
+    let i = 0;
+    let inString = false;
+    let strDelim = '';
+    let buf = '';
+    const flush = () => {
+        if (!buf)
+            return;
+        parts.push({ text: buf, code: true });
+        buf = '';
+    };
+    const flushKw = (tok) => {
+        if (kwSet.has(tok))
+            parts.push({ text: tok, color: 'cyan', code: true });
+        else if (/^\d+(\.\d+)?$/.test(tok))
+            parts.push({ text: tok, color: 'yellow', code: true });
+        else
+            parts.push({ text: tok, code: true });
+    };
+    while (i < line.length) {
+        const ch = line[i];
+        if (inString) {
+            buf += ch;
+            if (ch === strDelim) {
+                inString = false;
+                flush();
+            }
+            else if (ch === '\\' && i + 1 < line.length) {
+                buf += line[i + 1];
+                i += 2;
+                continue;
+            }
+            i++;
+            continue;
+        }
+        // Inline comment inside a code line.
+        for (const c of comments) {
+            if (c && line.slice(i, i + c.length) === c) {
+                flush();
+                parts.push({ text: line.slice(i), dim: true, code: true });
+                return parts;
+            }
+        }
+        if (STRING_DELIMS.includes(ch)) {
+            flush();
+            inString = true;
+            strDelim = ch;
+            buf = ch;
+            i++;
+            continue;
+        }
+        if (/[A-Za-z_$]/.test(ch)) {
+            let j = i;
+            while (j < line.length && /[A-Za-z0-9_$]/.test(line[j]))
+                j++;
+            const tok = line.slice(i, j);
+            flushKw(tok);
+            i = j;
+            continue;
+        }
+        if (/[0-9]/.test(ch)) {
+            let j = i;
+            while (j < line.length && /[0-9._]/.test(line[j]))
+                j++;
+            flush();
+            parts.push({ text: line.slice(i, j), color: 'yellow', code: true });
+            i = j;
+            continue;
+        }
+        buf += ch;
+        i++;
+    }
+    flush();
+    if (parts.length === 0)
+        parts.push({ text: line, code: true });
+    return parts;
+}
+/** Detect `file:line` / `file:line:col` references and attach OSC-8 hrefs. */
+export const FILE_LINE_RE = /((?:\.{0,2}\/)?[\w./-]+\.[a-zA-Z]+\w*):(\d+)(?::(\d+))?/g;
+export function annotateFileLinks(parts) {
+    const out = [];
+    for (const p of parts) {
+        if (p.code || !p.text) {
+            out.push(p);
+            continue;
+        }
+        // Preserve the original part's styling on the unattributed plain-text runs.
+        const style = { text: '', ...(p.bold ? { bold: true } : {}), ...(p.dim ? { dim: true } : {}) };
+        FILE_LINE_RE.lastIndex = 0;
+        let last = 0;
+        let m;
+        let matched = false;
+        while ((m = FILE_LINE_RE.exec(p.text))) {
+            matched = true;
+            if (m.index > last)
+                out.push({ ...style, text: p.text.slice(last, m.index) });
+            const path = m[1];
+            const line = m[2];
+            const col = m[3] ? `:${m[3]}` : '';
+            out.push({ text: `${path}:${line}${col}`, href: `file://${path}#L${line}` });
+            last = m.index + m[0].length;
+        }
+        if (!matched)
+            out.push(p);
+        else if (last < p.text.length)
+            out.push({ ...style, text: p.text.slice(last) });
+    }
+    return out;
+}
 function parseInline(s) {
     const parts = [];
     let last = 0;
@@ -37,15 +199,19 @@ function parseInline(s) {
 export function renderMarkdownLines(text) {
     const out = [];
     let inFence = false;
+    let fenceLang = '';
     for (const raw of text.split('\n')) {
         const trimmed = raw.trim();
         if (trimmed.startsWith('```')) {
+            if (!inFence)
+                fenceLang = trimmed.replace(/^```/, '').trim().toLowerCase();
             inFence = !inFence;
             out.push({ parts: [{ text: raw, dim: true }], fence: true });
             continue;
         }
         if (inFence) {
-            out.push({ parts: [{ text: raw, dim: true, code: true }], fence: true });
+            // R4: syntax-highlight the code line, annotated with file:line links.
+            out.push({ parts: annotateFileLinks(highlightCodeLine(raw, fenceLang)), fence: true });
             continue;
         }
         const heading = /^(#{1,6})\s+(.*)$/.exec(raw);
@@ -57,7 +223,8 @@ export function renderMarkdownLines(text) {
             });
             continue;
         }
-        out.push({ parts: parseInline(raw), fence: false });
+        // R4: clickable file:line references in ordinary prose too.
+        out.push({ parts: annotateFileLinks(parseInline(raw)), fence: false });
     }
     return out;
 }

package/dist/tui/scroll-flow.test.js

@@ -73,6 +73,8 @@ describe('scroll flow diagnostics', () => {
         expect(lastFrame() ?? '').toContain('number 4');
     });
     it('wrapped long item: pin mid-item, stream, same first line stays', async () => {
+        // Heavy string measurement + React flush under full-suite parallel load;
+        // the default 10s testTimeout flaked — extend for this one.
         const long = Array.from({ length: 10 }, (_, i) => `WRAPLINE-${i} ` + 'x'.repeat(180)).join('\n');
         const items = [
             { id: 'w1', kind: 'text', text: long, role: 'assistant' },
@@ -90,5 +92,5 @@ describe('scroll flow diagnostics', () => {
         }
         const after = (lastFrame() ?? '').split('\n').slice(0, 3).join('\n');
         expect(after).toBe(before); // anchor stability at line granularity
-    });
+    }, 30_000);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "klyro",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Klyro — autonomous coding harness CLI that streams from any OpenAI-compatible or Anthropic LLM endpoint.",
   "type": "module",
   "main": "dist/index.js",