klyro 1.0.20 → 1.0.21

package/dist/agent/anthropic-adapter.js

@@ -17,6 +17,7 @@
  */
 import { assertSafeBaseURL } from '../chat.js';
 import { parseRetryAfterMs } from './provider-adapter.js';
+import { redact } from '../policy/secret-redactor.js';
 import { estimateTokens } from '../context/tokenizer.js';
 import { proxiedFetch } from '../shared/proxy.js';
 const DEFAULT_VERSION = '2023-06-01';
@@ -174,7 +175,9 @@ async function* streamAnthropic(req, opts) {
         yield {
             kind: 'error',
             code: isOverflow ? 'REQUEST_TOO_LARGE' : `http_${resp.status}`,
-            message: `Anthropic API returned ${resp.status}: ${text.slice(0, 500)}`,
+            // Redact before slicing (mirrors the OpenAI adapter): a 400 body can
+            // echo the prompt, leaking secrets into transcript/logs/trace.
+            message: `Anthropic API returned ${resp.status}: ${redact(text).slice(0, 500)}`,
             retryable,
             status: String(resp.status),
             ...(retryAfterMs !== undefined ? { retryAfterMs } : {}),
@@ -204,6 +207,11 @@ async function* streamAnthropic(req, opts) {
             if (done)
                 break;
             buf += decoder.decode(value, { stream: true });
+            // SSE spec: CRLF/CR line endings normalize to LF (same as the
+            // OpenAI adapter) — otherwise '\n\n' never matches and the stream
+            // stalls to timeout.
+            if (buf.includes('\r'))
+                buf = buf.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
             // Split on SSE event boundary.
             const events = [];
             let idx = 0;

package/dist/agent/child-worker.js

@@ -130,20 +130,34 @@ export async function forkChild(entry, payload, opts = {}) {
         });
         child.on('close', (code, signal) => {
             cleanup();
-            const first = stdoutCap.text().split('\n').find((l) => l.trim().length > 0);
-            if (code === 0 && first) {
+            // The child may print progress/log lines before the JSON result —
+            // scan from the LAST non-empty line back so an early log line can't
+            // mask the result (previously the first line was parsed instead).
+            const lines = stdoutCap.text().split('\n').map((l) => l.trim()).filter((l) => l.length > 0);
+            let parsed = null;
+            for (let i = lines.length - 1; i >= 0; i--) {
                 try {
-                    resolve(JSON.parse(first));
-                }
-                catch {
-                    reject(new ChildCrashError('child exited 0 but emitted malformed ChildResult', 'exit', stderr.slice(-1000)));
+                    const cand = JSON.parse(lines[i]);
+                    if (cand && typeof cand === 'object' && typeof cand.status === 'string') {
+                        parsed = cand;
+                        break;
+                    }
                 }
+                catch { /* not JSON — keep scanning */ }
+            }
+            if (code === 0 && parsed) {
+                resolve(parsed);
                 return;
             }
             const cause = signal === 'SIGKILL' || signal === 'SIGTERM'
                 ? (killedForTimeout ? 'timeout' : 'oom')
                 : 'exit';
-            reject(new ChildCrashError(`child exited ${code ?? signal ?? '??'} without a ChildResult` + (stderr ? `: ${stderr.slice(-500)}` : ''), cause, stderr.slice(-1000)));
+            // Exit 0 with no parseable result keeps the historical "malformed"
+            // message (pinned by forkChild tests); other exits name the cause.
+            const what = code === 0
+                ? 'child exited 0 but emitted malformed ChildResult'
+                : `child exited ${code ?? signal ?? '??'} without a ChildResult`;
+            reject(new ChildCrashError(what + (stderr ? `: ${stderr.slice(-500)}` : ''), cause, stderr.slice(-1000)));
         });
     });
 }

package/dist/agent/orchestrator.js

@@ -666,13 +666,36 @@ export class AgentOrchestrator {
                 return {
                     ok: false,
                     error: {
-                        code: 'MERGE_CONFLICT',
-                        message: `merge of ${meta.worktree.branch} conflicted`,
-                        details: { conflictFiles: merged.conflictFiles },
+                        code: merged.error ? 'MERGE_FAILED' : 'MERGE_CONFLICT',
+                        message: merged.error
+                            ? `merge of ${meta.worktree.branch} failed: ${merged.error}`
+                            : `merge of ${meta.worktree.branch} conflicted`,
+                        details: { conflictFiles: merged.conflictFiles, ...(merged.error ? { error: merged.error } : {}) },
                     },
                 };
             }
-            await removeWorktree({ repoCwd: meta.repoCwd, worktreePath: meta.worktree.worktreePath }).catch(() => undefined);
+            // Post-merge the branch content is committed, so a dirty worktree must
+            // not strand it: try a clean remove first, fall back to force, and
+            // only delete the branch once the worktree is really gone. Never
+            // report success while orphaning `.klyro/worktrees/<taskId>`.
+            try {
+                await removeWorktree({ repoCwd: meta.repoCwd, worktreePath: meta.worktree.worktreePath });
+            }
+            catch {
+                try {
+                    await removeWorktree({ repoCwd: meta.repoCwd, worktreePath: meta.worktree.worktreePath, force: true });
+                }
+                catch (err) {
+                    return {
+                        ok: false,
+                        error: {
+                            code: 'WORKTREE_CLEANUP',
+                            message: `merged ${meta.worktree.branch} but could not remove worktree ${meta.worktree.worktreePath}`,
+                            details: { worktreePath: meta.worktree.worktreePath, error: err instanceof Error ? err.message : String(err) },
+                        },
+                    };
+                }
+            }
             await deleteBranch({ repoCwd: meta.repoCwd, branch: meta.worktree.branch });
             didMerge = true;
         }

package/dist/agent/provider-adapter.js

@@ -293,6 +293,11 @@ async function* streamChatCompletions(url, opts, req, fetchImpl) {
             if (done)
                 break;
             buf += decoder.decode(value, { stream: true });
+            // SSE spec: CRLF/CR line endings normalize to LF. Without this a
+            // CRLF stream never contains '\n\n', so no event boundary splits
+            // and the stream stalls to timeout.
+            if (buf.includes('\r'))
+                buf = buf.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
             // SSE: events separated by \n\n
             let idx;
             while ((idx = buf.indexOf('\n\n')) !== -1) {

package/dist/agent/retry.js

@@ -210,9 +210,12 @@ export function retryingAdapter(inner, opts = {}) {
                     ? retryAfterRaw
                     : undefined;
                 opts.onRetry?.({ attempt: attempt + 1, status, ...(retryAfterMs !== undefined ? { retryAfterMs } : {}) });
-                // Honor a server-provided Retry-After delay when present; otherwise
-                // fall back to exponential backoff with jitter.
-                const delay = retryAfterMs ?? computeBackoff(attempt, cfg.baseMs, cfg.maxMs);
+                // Honor a server-provided Retry-After delay when present, capped at
+                // maxMs: an unbounded server delay (malicious or buggy endpoint)
+                // could otherwise park the agent for hours per attempt.
+                const delay = retryAfterMs !== undefined
+                    ? Math.min(retryAfterMs, cfg.maxMs)
+                    : computeBackoff(attempt, cfg.baseMs, cfg.maxMs);
                 // Abort-aware backoff: Ctrl+C during the sleep must stop promptly
                 // instead of stalling up to maxMs before noticing.
                 if (delay > 0)

package/dist/agent/runtime.js

@@ -106,11 +106,16 @@ export async function run(opts, deps) {
         return [{ role: 'user', content: [text(opts.task)] }];
     })();
     const usage = { input: 0, output: 0 };
+    // Effective model for cost accounting: the request actually sends
+    // parentContext.model when an orchestrator overrides it, so budget
+    // warnings and the max-cost guard must rate against the same model —
+    // otherwise a cheap-model budget supervises expensive-model spend.
+    const effectiveModel = opts.parentContext?.model ?? opts.model;
     /** Emit one `budget_warning` per threshold the cost ratio has crossed. */
     const checkBudgetWarnings = () => {
         if (maxCost === undefined || maxCost <= 0)
             return;
-        const ratio = estimateCost(opts.model, usage) / maxCost;
+        const ratio = estimateCost(effectiveModel, usage) / maxCost;
         for (const threshold of BUDGET_WARNING_THRESHOLDS) {
             if (ratio >= threshold && !firedBudgetWarnings.has(threshold)) {
                 firedBudgetWarnings.add(threshold);
@@ -309,7 +314,7 @@ export async function run(opts, deps) {
     outer: while (steps < maxSteps) {
         // 5.1 limits: max-cost, max-time
         if (maxCost !== undefined) {
-            const cost = estimateCost(opts.model, usage);
+            const cost = estimateCost(effectiveModel, usage);
             if (cost >= maxCost) {
                 setPhase('limit');
                 await closeTracer();
@@ -512,10 +517,12 @@ export async function run(opts, deps) {
                 }
                 // L15 failover: a terminal provider error swaps to the next chained
                 // adapter and re-issues the step (bounded by chain length). Context
-                // overflow is excluded — it owns its own recovery above. By the time
-                // an error reaches the runtime, per-adapter retries are exhausted,
-                // so any provider error here is terminal for the active adapter.
-                if (failoverQueue.length > 0) {
+                // overflow is excluded — it owns its own recovery above, and a
+                // second overflow must abort, not re-spray the oversized transcript
+                // at the next provider. By the time an error reaches the runtime,
+                // per-adapter retries are exhausted, so any provider error here is
+                // terminal for the active adapter.
+                if (failoverQueue.length > 0 && ev.code !== 'REQUEST_TOO_LARGE') {
                     const next = failoverQueue.shift();
                     failoverPending = true;
                     failoverFrom = activeAdapter.id;

package/dist/agent/worktree-manager.d.ts

@@ -30,6 +30,8 @@ export interface WorktreeInfo {
 export interface MergeResult {
     merged: boolean;
     conflictFiles: string[];
+    /** Present when the merge failed for a non-conflict reason (bad branch, dirty tree, git error). */
+    error?: string;
 }
 /** True when `cwd` is inside a git working tree. Never throws — false on any failure. */
 export declare function ensureGitRepo(cwd: string): Promise<boolean>;

package/dist/agent/worktree-manager.js

@@ -86,7 +86,8 @@ export async function mergeWorktree(opts) {
         await git(opts.repoCwd, ['merge', '--no-ff', '--no-edit', opts.branch]);
         return { merged: true, conflictFiles: [] };
     }
-    catch {
+    catch (err) {
+        const errText = err instanceof Error ? err.message : String(err);
         const conflictFiles = await unmergedFiles(opts.repoCwd);
         try {
             await git(opts.repoCwd, ['merge', '--abort']);
@@ -94,7 +95,13 @@ export async function mergeWorktree(opts) {
         catch {
             /* best-effort: leave the repo as-is if abort itself fails */
         }
-        return { merged: false, conflictFiles };
+        // Only call it a conflict when unmerged paths exist; anything else
+        // (unknown branch, dirty tree, git missing) is a hard error, not an
+        // empty MERGE_CONFLICT the caller can't act on.
+        if (conflictFiles.length > 0 || /CONFLICT/i.test(errText)) {
+            return { merged: false, conflictFiles };
+        }
+        return { merged: false, conflictFiles, error: errText };
     }
 }
 async function unmergedFiles(repoCwd) {

package/dist/checkpoints/store.js

@@ -255,9 +255,33 @@ export async function diff(cwd, id) {
     return new Promise((resolve) => {
         const child = spawn('git', ['diff', '--stat'], { cwd, shell: false, windowsHide: true });
         const sink = cappedOutput(64 * 1024);
+        let done = false;
+        // A wedged git (locked index) must not hang undo diagnostics forever.
+        const t = setTimeout(() => {
+            if (done)
+                return;
+            done = true;
+            try {
+                child.kill('SIGKILL');
+            }
+            catch { /* ignore */ }
+            resolve('No diff (git timed out)');
+        }, 10_000);
         child.stdout.on('data', (b) => sink.push(b));
-        child.on('close', () => resolve(sink.text() || 'No diff'));
-        child.on('error', () => resolve('No git diff available'));
+        child.on('close', () => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(t);
+            resolve(sink.text() || 'No diff');
+        });
+        child.on('error', () => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(t);
+            resolve('No git diff available');
+        });
     });
 }
 export async function undo(cwd, n = 1) {

package/dist/cli/dotenv.js

@@ -89,7 +89,7 @@ const BLOCKED_DOTENV_SECURITY_RELAXATIONS = new Set([
     'KLYRO_WORKER',
 ]);
 /** npm reads `npm_config_*` from the environment — a repo must not pick the registry. */
-const BLOCKED_DOTENV_PREFIXES = ['NPM_CONFIG_'];
+const BLOCKED_DOTENV_PREFIXES = ['NPM_CONFIG_', 'KLYRO_SANDBOX']; // KLYRO_SANDBOX=0 / KLYRO_SANDBOX_NET=1 de-harden the shell sandbox (see shell-exec.ts)
 /** True when a `.env` key would change process behaviour or loosen a boundary. */
 export function isBlockedDotenvKey(key) {
     const k = key.toUpperCase();

package/dist/cli/repl.js

@@ -711,8 +711,6 @@ export async function startRepl(opts = {}) {
             directHooks.clearTranscript();
         else
             pendingQueue.length = 0;
-        if (isMounted && directHooks)
-            directHooks.clearTranscript();
     }
     // Update nudge (best-effort, cached 24h, silent fail): a single stderr
     // line when a newer version exists. No prompt, no blocking — the check
@@ -956,7 +954,12 @@ export async function startRepl(opts = {}) {
                         // streamingId is closed by status change; no extra handling needed
                     }
                     else if (ev.kind === 'usage') {
-                        queuedStatus({ usageInput: ev.input, usageOutput: ev.output });
+                        queuedStatus({
+                            usageInput: ev.input,
+                            usageOutput: ev.output,
+                            usageCacheRead: ev.cacheRead ?? 0,
+                            usageCacheWrite: ev.cacheWrite ?? 0,
+                        });
                     }
                     else if (ev.kind === 'plan_update') {
                         queuedPlan(ev.plan);

package/dist/eval/harness.js

@@ -23,7 +23,7 @@ import { globTool } from '../tools/search/glob.js';
 import { grepTool } from '../tools/search/grep.js';
 import { gitStatusTool } from '../tools/git/git-status.js';
 import { gitDiffTool } from '../tools/git/git-diff.js';
-import { PolicyEngine, builtinRules, DEFAULT_POLICY_CONFIG } from '../policy/engine.js';
+import { PolicyEngine, builtinRules, clonePolicyConfig } from '../policy/engine.js';
 import { DenyAllApprovalPrompt } from '../policy/approval.js';
 import { defaultSystemPrompt } from '../agent/runtime.js';
 import { verify } from '../verification/engine.js';
@@ -59,7 +59,9 @@ export async function runTask(t, opts = {}) {
         .register(listDirTool).register(globTool).register(grepTool)
         .register(shellExecTool).register(runVerifyTool)
         .register(gitStatusTool).register(gitDiffTool);
-    const policy = new PolicyEngine(builtinRules(), DEFAULT_POLICY_CONFIG);
+    // Clone: registerMcpServers mutates the config via addAsk — sharing the
+    // global DEFAULT_POLICY_CONFIG would leak ask-rules across tasks/runs.
+    const policy = new PolicyEngine(builtinRules(), clonePolicyConfig());
     try {
         const result = await run({ task: t.task, cwd, model: 'mock', maxSteps: 12, nonInteractive: true }, { adapter: scriptedAdapter(t.script), registry: reg, policy, approval: new DenyAllApprovalPrompt(), systemPrompt: defaultSystemPrompt });
         let observedStatus = result.status;
@@ -72,7 +74,10 @@ export async function runTask(t, opts = {}) {
             }
         }
         let details = '';
-        let pass = result.status === t.expectStatus;
+        // Grade the *observed* status (agent result possibly overridden by the
+        // verify step above) — a failed verifyCommand must fail the task even
+        // when the agent itself reported 'complete'.
+        let pass = observedStatus === t.expectStatus;
         if (t.expectToolCalls !== undefined && result.toolCalls !== t.expectToolCalls) {
             details += ` toolCalls=${result.toolCalls} expected=${t.expectToolCalls};`;
             pass = false;

package/dist/mcp/remote.js

@@ -15,18 +15,42 @@ export function isLoopback(url) {
 /** Parse a Streamable-HTTP SSE body (`data: {...}` lines) into JSON payloads. */
 export function parseSseBody(text) {
     const out = [];
+    // Consecutive data: lines belong to ONE event per the SSE spec (joined
+    // with \n). Parse the joined chunk first; if that fails, fall back to
+    // per-line parsing so servers that (against spec) emit bare JSON per
+    // line without blank separators keep working.
+    let parts = [];
+    const flush = () => {
+        if (parts.length === 0)
+            return;
+        const joined = parts.join('\n').trim();
+        parts = [];
+        if (joined === '[DONE]')
+            return;
+        try {
+            out.push(JSON.parse(joined));
+            return;
+        }
+        catch { /* try per-line below */ }
+        for (const part of joined.split('\n')) {
+            const t = part.trim();
+            if (!t || t === '[DONE]')
+                continue;
+            try {
+                out.push(JSON.parse(t));
+            }
+            catch { /* ignore malformed lines */ }
+        }
+    };
     for (const line of text.split('\n')) {
         const t = line.trim();
-        if (!t.startsWith('data:'))
-            continue;
-        const payload = t.slice(5).trim();
-        if (payload === '[DONE]')
+        if (!t.startsWith('data:')) {
+            flush();
             continue;
-        try {
-            out.push(JSON.parse(payload));
         }
-        catch { /* ignore malformed lines */ }
+        parts.push(t.slice(5).trim());
     }
+    flush();
     return out;
 }
 export class RemoteMcpClient {

package/dist/mcp/sse.js

@@ -163,7 +163,6 @@ export class SseMcpClient {
             return;
         this.pending.delete(m.id);
         clearTimeout(p.timer);
-        clearTimeout(p.timer);
         if (m.error)
             p.reject(new McpError(`mcp server "${this.name}" error: ${m.error.message ?? 'unknown'}`, 'SERVER_ERROR', m.error));
         else

package/dist/persistence/audit.d.ts

@@ -93,12 +93,6 @@ export declare class AuditLog {
     private readonly keepSegments;
     /** Serializes chained appends so concurrent writes can't fork the chain. */
     private chain;
-    /**
-     * Cached last-written hash: avoids re-reading the whole file (O(n) per
-     * write) on every append. Null = not loaded yet — first append reads the
-     * file (picks up an existing chain), then the cache takes over.
-     */
-    private lastHash;
     constructor(filePath: string, maxBytes?: number, keepSegments?: number);
     write(event: AuditEvent): Promise<void>;
     private appendChained;

package/dist/persistence/audit.js

@@ -64,9 +64,9 @@ export const AUDIT_ROTATE_KEEP = 5;
  * Rotate an audit log once it exceeds `maxBytes`: shift the newest segment
  * over the oldest (deleted), leave a fresh live file. Each segment carries
  * its own GENESIS-rooted chain, so rotation is tamper-evident per segment.
- * Returns true when a rotation actually happened (the caller must reset its
- * in-memory chain tip to GENESIS — the next live record starts a fresh
- * chain). Best-effort — rotation failures never break appends.
+ * Callers re-read the tail after rotating, so the next live record starts
+ * a fresh chain with no in-memory state to reset. Best-effort — rotation
+ * failures never break appends.
  */
 async function rotateAuditLog(filePath, maxBytes, keep) {
     try {
@@ -97,12 +97,6 @@ export class AuditLog {
     keepSegments;
     /** Serializes chained appends so concurrent writes can't fork the chain. */
     chain = Promise.resolve();
-    /**
-     * Cached last-written hash: avoids re-reading the whole file (O(n) per
-     * write) on every append. Null = not loaded yet — first append reads the
-     * file (picks up an existing chain), then the cache takes over.
-     */
-    lastHash = null;
     constructor(filePath, maxBytes = AUDIT_MAX_BYTES, keepSegments = AUDIT_ROTATE_KEEP) {
         this.filePath = filePath;
         this.maxBytes = maxBytes;
@@ -115,17 +109,16 @@ export class AuditLog {
         return task;
     }
     async appendChained(event) {
-        // Rotation leaves a fresh live file and resets the in-memory tip: the
-        // next live record restarts at GENESIS (each segment is its own chain).
-        const rotated = await rotateAuditLog(this.filePath, this.maxBytes, this.keepSegments);
-        if (rotated)
-            this.lastHash = AUDIT_GENESIS;
-        if (this.lastHash === null)
-            this.lastHash = await prevHashFor(this.filePath);
-        const prevHash = this.lastHash;
+        // Rotation leaves a fresh live file; the tail read below then naturally
+        // restarts at GENESIS (each segment is its own chain).
+        await rotateAuditLog(this.filePath, this.maxBytes, this.keepSegments);
+        // Always re-read the tail instead of caching the tip: a cached tip forks
+        // the chain whenever another instance or process appends in between
+        // (e.g. a long-lived TUI plus a one-shot CLI on the same project).
+        // Audit volume is low and segments are size-bounded, so the read is cheap.
+        const prevHash = await prevHashFor(this.filePath);
         const body = { ...event, prevHash };
         const record = { ...body, prevHash, hash: sha256Hex(canonicalJson(body)) };
-        this.lastHash = record.hash;
         await SessionStore.appendJsonl(this.filePath, record);
     }
 }

package/dist/persistence/store.js

@@ -297,20 +297,26 @@ export class SessionStore {
             await fs.unlink(tmp).catch(() => undefined);
             throw new Error(`Failed to write session ${id}`);
         }
-        // Update index with simple retry for concurrent writers (optimistic)
-        for (let attempt = 0; attempt < 3; attempt++) {
-            try {
-                const idx = await this.readIndex();
-                idx[id] = data.record;
-                await this.writeIndex(idx);
-                return;
-            }
-            catch (err) {
-                if (attempt === 2)
-                    throw err;
-                await new Promise((r) => setTimeout(r, 10 * (attempt + 1)));
+        // Update index under the shared 'index' lock (same key create/delete
+        // use): the read-modify-write below races under concurrent writers on
+        // different sessions, and last-writer-wins would silently drop entries.
+        // Deadlock-free: no caller holds 'index' while calling writeSession
+        // (create/delete write the index inline instead).
+        await this.withLock('index', async () => {
+            for (let attempt = 0; attempt < 3; attempt++) {
+                try {
+                    const idx = await this.readIndex();
+                    idx[id] = data.record;
+                    await this.writeIndex(idx);
+                    return;
+                }
+                catch (err) {
+                    if (attempt === 2)
+                        throw err;
+                    await new Promise((r) => setTimeout(r, 10 * (attempt + 1)));
+                }
             }
-        }
+        });
     }
     async appendMessage(id, message) {
         return this.withLock(id, async () => {

package/dist/policy/engine.js

@@ -76,6 +76,18 @@ export class PolicyEngine {
                 call.name === 'memory_write') {
                 return { action: 'deny', reason: 'plan mode: writes blocked — use /permissions to allow or switch mode' };
             }
+            // plan mode is read-only investigation: shells run only allowlisted
+            // read-only commands, and nothing may escape to subagents or MCP
+            // servers (both can write through their own tool surfaces).
+            if (call.name === 'shell_exec' || call.name === 'run_verify') {
+                const cmd = asString(call.input.command);
+                if (!cmd || !startsWithAny(cmd, ctx.config.shellAllow)) {
+                    return { action: 'deny', reason: 'plan mode: only allowlisted read-only commands — use /permissions to allow or switch mode' };
+                }
+            }
+            if (call.name === 'spawn_agent' || call.name.startsWith('mcp__')) {
+                return { action: 'deny', reason: 'plan mode: subagents and MCP tools blocked — use /permissions to allow or switch mode' };
+            }
         }
         else if (ctx.config.mode === 'accept-edits') {
             // accept-edits: auto-allow edit tools
@@ -196,7 +208,8 @@ function isEnvPath(p) {
     // not secrets — reads AND writes are allowed.
     if (/[.](example|sample|template|dist)$/.test(lower))
         return false;
-    return /(^|\/)\.env(\.|$)/.test(lower) || lower.endsWith('.env');
+    // Separator class covers POSIX and Windows paths (C:\proj\.env.local).
+    return /(^|[/\\])\.env(\.|$)/.test(lower) || lower.endsWith('.env');
 }
 function extractPatchPaths(patch) {
     const out = [];
@@ -238,9 +251,25 @@ export function matchesGlobRule(call, rule) {
 }
 function startsWithAny(haystack, needles) {
     const h = haystack.trim().toLowerCase();
+    // Quote-stripped variant: `rm -rf "/"` is `rm -rf /` with camouflage.
+    // Stripping quotes can only add deny matches at position 0, never remove.
+    const variants = [h, h.replace(/['"]/g, '')];
     return needles.some((n) => {
         const nl = n.toLowerCase().replace(/\s+$/, ''); // strip trailing ws from needle
-        return h === nl || h.startsWith(nl + ' ') || h.startsWith(nl + '\t');
+        return variants.some((hv) => {
+            if (hv === nl)
+                return true;
+            if (!hv.startsWith(nl))
+                return false;
+            // Boundary after the needle: end, whitespace, quote, or a path
+            // separator/glob/chain char. Without the separator class, `rm -rf /*`,
+            // `rm -rf ~/*`, `rm -rf ./*` and `rm -rf ./` all slip past the deny
+            // list. Note this intentionally also matches scoped forms like
+            // `rm -rf ./build` — destructive-prefix commands stay denied and the
+            // caller allowlists (or uses a bare relative path).
+            const c = hv[nl.length];
+            return c === undefined || /[\s/'"`*?\[\\;&|]/.test(c);
+        });
     });
 }
 /** Branches that `git push` must never target without an explicit opt-out. */
@@ -407,13 +436,20 @@ export const writeFileCwdRule = {
         if (!p)
             return null;
         if (p.includes('..') || path.isAbsolute(p)) {
-            // Check if absolute is inside additionalDirs
+            // Absolute paths are fine inside the workspace roots (cwd or
+            // additionalDirs) — only true escapes are denied.
             if (path.isAbsolute(p)) {
-                const allowed = (ctx.config.additionalDirs ?? []).some((dir) => {
-                    const rel = path.relative(path.resolve(dir), path.resolve(p));
-                    return !rel.startsWith('..') && !path.isAbsolute(rel);
+                const roots = [ctx.cwd, ...(ctx.config.additionalDirs ?? [])];
+                const inside = roots.some((dir) => {
+                    try {
+                        const rel = path.relative(path.resolve(dir), path.resolve(p));
+                        return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+                    }
+                    catch {
+                        return false; // different drive on Windows: not inside
+                    }
                 });
-                if (allowed)
+                if (inside)
                     return null;
             }
             return { action: 'deny', reason: 'path traversal or absolute path not allowed' };

package/dist/providers/model-info.d.ts

@@ -39,4 +39,7 @@ export declare function ratesFor(modelId: string): {
  * other families keep ignoring those counters.
  */
 export declare function isAnthropicModel(modelId: string): boolean;
-export declare function estimateCost(modelId: string, inputTokens: number, outputTokens: number): number;
+export declare function estimateCost(modelId: string, inputTokens: number, outputTokens: number, cache?: {
+    read?: number;
+    write?: number;
+}): number;

package/dist/providers/model-info.js

@@ -70,9 +70,17 @@ export function ratesFor(modelId) {
 export function isAnthropicModel(modelId) {
     return /anthropic|claude/i.test(modelId);
 }
-export function estimateCost(modelId, inputTokens, outputTokens) {
+export function estimateCost(modelId, inputTokens, outputTokens, cache) {
     // Single source: delegate to ratesFor so registry, family fallbacks, and
     // local-$0 rules live in exactly one place (no split-brain with getModelInfo).
     const { input, output } = ratesFor(modelId);
-    return (inputTokens / 1000) * input + (outputTokens / 1000) * output;
+    let cost = (inputTokens / 1000) * input + (outputTokens / 1000) * output;
+    // Cache-aware (Anthropic billing): cacheRead at 0.1x input, cacheWrite at
+    // 1.25x input. Other families ignore cache counters. Mirrors the
+    // runtime's estimateCost — keep the two in sync.
+    if (isAnthropicModel(modelId)) {
+        cost += ((cache?.read ?? 0) / 1000) * input * 0.1;
+        cost += ((cache?.write ?? 0) / 1000) * input * 1.25;
+    }
+    return cost;
 }

package/dist/repl.js

@@ -94,8 +94,10 @@ export async function repl(system) {
                 // EOF on stdin (Ctrl-D) or close — exit cleanly.
                 break;
             }
-            if (!line)
-                break; // empty line on EOF
+            // EOF on stdin (Ctrl-D) rejects the question and exits via the
+            // catch above. An empty line is just a stray Enter — keep going.
+            if (line === '')
+                continue;
             const step = splitContinuedLine(continued, line);
             continued = step.pending;
             if (step.complete === undefined)