klyro 1.0.4 → 1.0.6

package/dist/mcp/config.d.ts

@@ -7,9 +7,11 @@ export declare const McpServerPolicySchema: z.ZodObject<{
 }, z.core.$strip>;
 export type McpServerPolicy = z.infer<typeof McpServerPolicySchema>;
 export declare const McpServerSpecSchema: z.ZodObject<{
-    command: z.ZodString;
+    command: z.ZodOptional<z.ZodString>;
     args: z.ZodOptional<z.ZodArray<z.ZodString>>;
     env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    url: z.ZodOptional<z.ZodString>;
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     disabled: z.ZodOptional<z.ZodBoolean>;
     policy: z.ZodOptional<z.ZodObject<{
         allowTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -38,3 +40,10 @@ export declare function expandEnv(value: string): string;
 export declare function loadMcpServers(cwd: string): McpServersConfig;
 /** Servers eligible for connection (configured and not disabled). */
 export declare function enabledServers(cfg: McpServersConfig): Record<string, McpServerSpec>;
+/** Server names are bounded: the registry builds `mcp__<server>__<tool>` (≤64 chars). */
+export declare const MCP_NAME_RE: RegExp;
+export declare function projectMcpPath(cwd: string): string;
+/** Add (or reject duplicates of) a project-level MCP server. Throws on invalid input. */
+export declare function addProjectServer(cwd: string, name: string, spec: unknown): void;
+/** Remove a project-level MCP server. Returns false when absent. */
+export declare function removeProjectServer(cwd: string, name: string): boolean;

package/dist/mcp/config.js

@@ -19,11 +19,23 @@ export const McpServerPolicySchema = z.object({
     timeoutMs: z.number().int().positive().optional(),
 });
 export const McpServerSpecSchema = z.object({
-    command: z.string().min(1),
+    /** stdio transport: command to spawn. Required unless `url` is set. */
+    command: z.string().min(1).optional(),
     args: z.array(z.string()).optional(),
     env: z.record(z.string(), z.string()).optional(),
+    /** Remote transport: Streamable-HTTP JSON-RPC endpoint. Required unless `command` is set. */
+    url: z.string().url().optional(),
+    /** Extra HTTP headers for remote transport (`${env:VAR}` expanded). */
+    headers: z.record(z.string(), z.string()).optional(),
     disabled: z.boolean().optional(),
     policy: McpServerPolicySchema.optional(),
+}).superRefine((s, ctx) => {
+    if (!s.command && !s.url) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'MCP server needs either "command" (stdio) or "url" (remote HTTP)' });
+    }
+    if (s.command && s.url) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'MCP server takes either "command" or "url", not both' });
+    }
 });
 /** Upper bound for per-server timeouts — larger values are clamped, not rejected. */
 export const MAX_MCP_TIMEOUT_MS = 600_000;
@@ -82,6 +94,12 @@ export function loadMcpServers(cwd) {
                     env[k] = expandEnv(v);
                 spec.env = env;
             }
+            if (spec.headers) {
+                const headers = {};
+                for (const [k, v] of Object.entries(spec.headers))
+                    headers[k] = expandEnv(v);
+                spec.headers = headers;
+            }
             servers[name] = spec;
             sources[name] = label;
         }
@@ -97,3 +115,48 @@ export function enabledServers(cfg) {
     }
     return out;
 }
+/** Server names are bounded: the registry builds `mcp__<server>__<tool>` (≤64 chars). */
+export const MCP_NAME_RE = /^[A-Za-z0-9_-]{1,20}$/;
+export function projectMcpPath(cwd) {
+    return path.join(cwd, '.mcp.json');
+}
+function readProjectDoc(cwd) {
+    const raw = readJsonFile(projectMcpPath(cwd));
+    const doc = (raw && typeof raw === 'object' && !Array.isArray(raw) ? raw : {});
+    const servers = normalizeRaw(doc);
+    return { doc, servers: { ...servers } };
+}
+function writeProjectDoc(cwd, doc, servers) {
+    const next = { ...doc };
+    if ('mcpServers' in next)
+        next['mcpServers'] = servers;
+    else
+        next['servers'] = servers;
+    if (Object.keys(next).length === 0)
+        next['mcpServers'] = servers;
+    const tmp = `${projectMcpPath(cwd)}.tmp-${process.pid}`;
+    fs.writeFileSync(tmp, JSON.stringify(next, null, 2) + '\n', 'utf-8');
+    fs.renameSync(tmp, projectMcpPath(cwd));
+}
+/** Add (or reject duplicates of) a project-level MCP server. Throws on invalid input. */
+export function addProjectServer(cwd, name, spec) {
+    if (!MCP_NAME_RE.test(name))
+        throw new Error(`invalid server name "${name}" (want 1-20 chars of A-Za-z0-9_-)`);
+    const parsed = McpServerSpecSchema.safeParse(spec);
+    if (!parsed.success)
+        throw new Error(`invalid server spec: ${parsed.error.issues.map((i) => i.message).join('; ')}`);
+    const { doc, servers } = readProjectDoc(cwd);
+    if (name in servers)
+        throw new Error(`server "${name}" already configured in ${projectMcpPath(cwd)} (remove it first)`);
+    servers[name] = parsed.data;
+    writeProjectDoc(cwd, doc, servers);
+}
+/** Remove a project-level MCP server. Returns false when absent. */
+export function removeProjectServer(cwd, name) {
+    const { doc, servers } = readProjectDoc(cwd);
+    if (!(name in servers))
+        return false;
+    delete servers[name];
+    writeProjectDoc(cwd, doc, servers);
+    return true;
+}

package/dist/mcp/registry.d.ts

@@ -30,6 +30,11 @@ export declare const MCP_SUCCESS_MAX_CHARS = 12000;
  * behind a plausible-looking name.
  */
 export declare function sanitizeMcpName(server: string, tool: string): string;
+/**
+ * Construct the right client for a spec: remote HTTP when `url` is set,
+ * else stdio. Used by registration, probe, and prompt runs.
+ */
+export declare function makeMcpClient(name: string, spec: McpServerSpec): McpClientLike;
 export declare function registerMcpServers(cfg: {
     servers: Record<string, McpServerSpec>;
 }, opts: RegisterMcpOpts): Promise<McpRegisterResult>;
@@ -52,3 +57,11 @@ export declare function loadAndRegisterMcp(opts: {
         source: 'global' | 'project';
     }) => Promise<boolean>;
 }): Promise<McpRegisterResult>;
+/**
+ * Run one MCP prompt (`/mcp__<server>__<prompt>`) on demand: fresh stdio
+ * connection per invocation (no client lifecycle to manage), redacted
+ * output. Typing the prompt name is explicit consent, so project servers
+ * connect without the registration-time approval gate. Throws McpError /
+ * Error on unknown server, disabled server, or prompt failure.
+ */
+export declare function runMcpPrompt(cwd: string, server: string, prompt: string, args: Record<string, string>): Promise<string>;

package/dist/mcp/registry.js

@@ -11,10 +11,12 @@
  *   3. `requireApproval` servers add an ask-rule to the PolicyEngine so the
  *      runtime loop prompts before executing.
  *
- * Permission class: no code in src consumes `Tool.permission` (it is
- * write-only metadata today), so we pick the most restrictive class,
- * 'admin' — the same class as `spawn_agent`, since MCP tools execute
- * arbitrary external side effects (read/write/network) outside our control.
+ * Permission class: the runtime passes each tool's `permission` into
+ * `PolicyEngine.evaluate`, and `execute`/`admin` tools with no explicit
+ * allow rule fall through to ask (interactive) or deny (headless). We
+ * pick the most restrictive class, 'admin' — the same class as
+ * `spawn_agent`, since MCP tools execute arbitrary external side effects
+ * (read/write/network) outside our control.
  *
  * Debug capture: when `KLYRO_MCP_DEBUG=1` is set, every MCP tool success
  * AND error ALSO writes the UNREDACTED raw JSON payload (pre-redaction,
@@ -28,6 +30,7 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import { McpClient, McpError } from './client.js';
+import { RemoteMcpClient } from './remote.js';
 import { loadMcpServers } from './config.js';
 import { evaluateMcpPolicy } from './policy.js';
 import { jsonSchemaToZod } from './schema.js';
@@ -139,9 +142,20 @@ async function executeMcpTool(server, spec, toolDef, client, input, ctx) {
         return { ok: false, error: { code: 'TOOL_ERROR', message: redact(errMessage(err)) } };
     }
 }
+/**
+ * Construct the right client for a spec: remote HTTP when `url` is set,
+ * else stdio. Used by registration, probe, and prompt runs.
+ */
+export function makeMcpClient(name, spec) {
+    if (spec.url)
+        return new RemoteMcpClient(name, spec);
+    if (!spec.command)
+        throw new McpError(`mcp server "${name}" has neither command nor url`, 'INVALID_SPEC');
+    return new McpClient(name, spec);
+}
 export async function registerMcpServers(cfg, opts) {
     const { registry, policy } = opts;
-    const factory = opts.clientFactory ?? ((name, spec) => new McpClient(name, spec));
+    const factory = opts.clientFactory ?? makeMcpClient;
     const registered = [];
     const errors = [];
     const skipped = [];
@@ -289,3 +303,31 @@ export async function loadAndRegisterMcp(opts) {
         };
     }
 }
+/**
+ * Run one MCP prompt (`/mcp__<server>__<prompt>`) on demand: fresh stdio
+ * connection per invocation (no client lifecycle to manage), redacted
+ * output. Typing the prompt name is explicit consent, so project servers
+ * connect without the registration-time approval gate. Throws McpError /
+ * Error on unknown server, disabled server, or prompt failure.
+ */
+export async function runMcpPrompt(cwd, server, prompt, args) {
+    const cfg = loadMcpServers(cwd);
+    const spec = cfg.servers[server];
+    if (!spec)
+        throw new Error(`mcp server not found: ${server}`);
+    if (spec.disabled)
+        throw new Error(`mcp server disabled: ${server}`);
+    const client = makeMcpClient(server, spec);
+    if (!client.promptsGet)
+        throw new Error(`mcp server "${server}" does not support prompts`);
+    try {
+        const withConnect = client;
+        if (typeof withConnect.connect === 'function')
+            await withConnect.connect();
+        const text = await client.promptsGet(prompt, args);
+        return redact(text).slice(0, 8000);
+    }
+    finally {
+        await client.close().catch(() => undefined);
+    }
+}

package/dist/mcp/remote.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Remote MCP transport — JSON-RPC 2.0 over HTTP POST (Streamable HTTP).
+ *
+ * Covers servers that speak plain request/response JSON-RPC at an HTTPS
+ * endpoint (the common self-hosted shape). Pure SSE-stream servers that
+ * require a persistent GET event stream are NOT supported — `probe` reports
+ * that explicitly. Custom headers (e.g. Authorization) come from the spec
+ * with `${env:VAR}` expansion applied at load time.
+ */
+import type { McpServerSpec } from './config.js';
+import { type McpClientLike, type McpToolDef, type McpCallResult, type McpResource, type McpPromptDef } from './client.js';
+/** Parse a Streamable-HTTP SSE body (`data: {...}` lines) into JSON payloads. */
+export declare function parseSseBody(text: string): unknown[];
+export declare class RemoteMcpClient implements McpClientLike {
+    readonly name: string;
+    private readonly spec;
+    private nextId;
+    private readonly headers;
+    private readonly timeoutMs;
+    constructor(name: string, spec: McpServerSpec);
+    connect(): Promise<void>;
+    listTools(signal?: AbortSignal): Promise<McpToolDef[]>;
+    callTool(name: string, args: unknown, signal?: AbortSignal): Promise<McpCallResult>;
+    listResources(signal?: AbortSignal): Promise<McpResource[]>;
+    promptsList(signal?: AbortSignal): Promise<McpPromptDef[]>;
+    promptsGet(name: string, args?: Record<string, string>, signal?: AbortSignal): Promise<string>;
+    close(): Promise<void>;
+    private request;
+}

package/dist/mcp/remote.js

@@ -0,0 +1,153 @@
+import { McpError } from './client.js';
+const PROTOCOL_VERSION = '2024-11-05';
+const DEFAULT_TIMEOUT_MS = 30_000;
+/** Parse a Streamable-HTTP SSE body (`data: {...}` lines) into JSON payloads. */
+export function parseSseBody(text) {
+    const out = [];
+    for (const line of text.split('\n')) {
+        const t = line.trim();
+        if (!t.startsWith('data:'))
+            continue;
+        const payload = t.slice(5).trim();
+        if (payload === '[DONE]')
+            continue;
+        try {
+            out.push(JSON.parse(payload));
+        }
+        catch { /* ignore malformed lines */ }
+    }
+    return out;
+}
+export class RemoteMcpClient {
+    name;
+    spec;
+    nextId = 1;
+    headers;
+    timeoutMs;
+    constructor(name, spec) {
+        this.name = name;
+        this.spec = spec;
+        if (!spec.url)
+            throw new McpError(`mcp server "${name}" has no url`, 'INVALID_SPEC');
+        this.headers = { 'Content-Type': 'application/json', Accept: 'application/json, text/event-stream', ...(spec.headers ?? {}) };
+        this.timeoutMs = spec.policy?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    }
+    async connect() {
+        // Handshake doubles as reachability probe; failures surface typed errors.
+        await this.request('initialize', {
+            protocolVersion: PROTOCOL_VERSION,
+            capabilities: {},
+            clientInfo: { name: 'klyro', version: 'remote' },
+        });
+        // Best-effort initialized notification (no id → no response expected).
+        try {
+            await fetch(this.spec.url, {
+                method: 'POST',
+                headers: this.headers,
+                body: JSON.stringify({ jsonrpc: '2.0', method: 'notifications/initialized' }),
+                signal: AbortSignal.timeout(5000),
+            });
+        }
+        catch { /* notification is best-effort */ }
+    }
+    async listTools(signal) {
+        const res = (await this.request('tools/list', {}, this.timeoutMs, signal));
+        return Array.isArray(res.tools) ? res.tools : [];
+    }
+    async callTool(name, args, signal) {
+        const res = (await this.request('tools/call', { name, arguments: args ?? {} }, this.timeoutMs, signal));
+        const blocks = Array.isArray(res.content) ? res.content : [];
+        const text = blocks.map((b) => (typeof b.text === 'string' ? b.text : JSON.stringify(b))).join('\n');
+        return { text, isError: res.isError === true, raw: res };
+    }
+    async listResources(signal) {
+        const res = (await this.request('resources/list', {}, this.timeoutMs, signal));
+        return Array.isArray(res.resources) ? res.resources : [];
+    }
+    async promptsList(signal) {
+        try {
+            const res = (await this.request('prompts/list', {}, this.timeoutMs, signal));
+            return Array.isArray(res.prompts) ? res.prompts : [];
+        }
+        catch (err) {
+            if (err instanceof McpError && err.code === 'SERVER_ERROR' && err.details?.code === -32601)
+                return [];
+            throw err;
+        }
+    }
+    async promptsGet(name, args, signal) {
+        const res = (await this.request('prompts/get', { name, arguments: args ?? {} }, this.timeoutMs, signal));
+        const parts = [];
+        if (typeof res.description === 'string' && res.description)
+            parts.push(res.description);
+        for (const m of Array.isArray(res.messages) ? res.messages : []) {
+            const c = m.content;
+            if (c && typeof c.text === 'string')
+                parts.push(c.text);
+            else if (c !== undefined)
+                parts.push(JSON.stringify(c));
+        }
+        return parts.join('\n\n');
+    }
+    async close() {
+        // Stateless HTTP — nothing to tear down.
+    }
+    async request(method, params, timeoutMs = this.timeoutMs, signal) {
+        if (signal?.aborted)
+            throw new McpError(`mcp call "${method}" aborted`, 'ABORTED');
+        const ctrl = new AbortController();
+        const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+        const onAbort = () => ctrl.abort();
+        signal?.addEventListener('abort', onAbort, { once: true });
+        const id = this.nextId++;
+        try {
+            const res = await fetch(this.spec.url, {
+                method: 'POST',
+                headers: this.headers,
+                body: JSON.stringify({ jsonrpc: '2.0', id, method, params }),
+                signal: ctrl.signal,
+            });
+            const ctype = res.headers.get('content-type') ?? '';
+            const text = await res.text();
+            if (!res.ok)
+                throw new McpError(`mcp server "${this.name}" HTTP ${res.status}: ${text.slice(0, 300)}`, 'HTTP_ERROR', { status: res.status });
+            let body;
+            if (ctype.includes('text/event-stream')) {
+                const events = parseSseBody(text);
+                const last = [...events].reverse().find((e) => typeof e === 'object' && e !== null && 'result' in e);
+                const errs = [...events].reverse().find((e) => typeof e === 'object' && e !== null && 'error' in e);
+                if (!last && errs?.error)
+                    throw new McpError(`mcp server "${this.name}" error: ${errs.error.message ?? 'unknown'}`, 'SERVER_ERROR', errs.error);
+                if (!last)
+                    throw new McpError(`mcp server "${this.name}" empty SSE stream`, 'PROTOCOL_ERROR');
+                body = last.result;
+            }
+            else {
+                try {
+                    body = JSON.parse(text);
+                }
+                catch {
+                    throw new McpError(`mcp server "${this.name}" returned non-JSON`, 'PROTOCOL_ERROR');
+                }
+                const env = body;
+                if (env && typeof env === 'object' && 'error' in env && env.error) {
+                    throw new McpError(`mcp server "${this.name}" error: ${env.error.message ?? 'unknown'}`, 'SERVER_ERROR', env.error);
+                }
+                body = env && typeof env === 'object' && 'result' in env ? env.result : body;
+            }
+            return body;
+        }
+        catch (err) {
+            if (err instanceof McpError)
+                throw err;
+            if (err instanceof Error && err.name === 'AbortError') {
+                throw new McpError(`mcp call "${method}" timed out after ${timeoutMs}ms`, 'TIMEOUT');
+            }
+            throw new McpError(`mcp call "${method}" failed: ${err instanceof Error ? err.message : String(err)}`, 'IO_ERROR');
+        }
+        finally {
+            clearTimeout(timer);
+            signal?.removeEventListener('abort', onAbort);
+        }
+    }
+}

package/dist/mcp/serve.d.ts

@@ -0,0 +1,23 @@
+import { type ToolRegistry } from '../tools/registry.js';
+import type { ToolContext } from '../tools/types.js';
+import { PolicyEngine } from '../policy/engine.js';
+interface JsonRpcRequest {
+    jsonrpc?: string;
+    id?: string | number | null;
+    method?: string;
+    params?: {
+        name?: string;
+        arguments?: unknown;
+    };
+}
+export interface ServeDeps {
+    registry?: ToolRegistry;
+    policy?: PolicyEngine;
+    ctx?: ToolContext;
+}
+export declare function makeServeDeps(cwd: string, overrides?: ServeDeps): Required<ServeDeps>;
+/** Pure request handler — unit-tested without stdio. Returns null for notifications. */
+export declare function handleMcpRequest(deps: Required<ServeDeps>, msg: JsonRpcRequest): Promise<Record<string, unknown> | null>;
+/** Stdio loop: one JSON-RPC message per line on stdin, responses on stdout. */
+export declare function serveStdio(cwd: string): Promise<number>;
+export {};

package/dist/mcp/serve.js

@@ -0,0 +1,111 @@
+/**
+ * `klyro mcp serve` — expose the builtin tool registry as a minimal MCP
+ * server over stdio (newline-delimited JSON-RPC 2.0).
+ *
+ * Supported methods: `initialize`, `ping`, `tools/list`, `tools/call`.
+ * Every call is gated by the PolicyEngine (default config + builtin rules)
+ * in headless mode: `allow` runs, `deny`/`ask` are refused as tool errors
+ * (serve cannot prompt, so nothing privileged runs without an explicit
+ * allow rule) — serving never bypasses policy.
+ */
+import * as readline from 'node:readline';
+import { builtinRegistry } from '../tools/registry.js';
+import { PolicyEngine, builtinRules, DEFAULT_POLICY_CONFIG } from '../policy/engine.js';
+import { readVersion } from '../version.js';
+export function makeServeDeps(cwd, overrides = {}) {
+    return {
+        registry: overrides.registry ?? builtinRegistry(),
+        policy: overrides.policy ?? new PolicyEngine(builtinRules(), DEFAULT_POLICY_CONFIG),
+        ctx: overrides.ctx ?? { cwd, env: process.env, nonInteractive: true },
+    };
+}
+/** Pure request handler — unit-tested without stdio. Returns null for notifications. */
+export async function handleMcpRequest(deps, msg) {
+    const id = msg.id ?? null;
+    if (msg.method === undefined || typeof msg.method !== 'string') {
+        if (id === null || id === undefined)
+            return null;
+        return { jsonrpc: '2.0', id, error: { code: -32600, message: 'Invalid Request' } };
+    }
+    if (id === null || id === undefined)
+        return null; // notification — no response
+    if (msg.method === 'initialize') {
+        return {
+            jsonrpc: '2.0', id,
+            result: {
+                protocolVersion: '2024-11-05',
+                capabilities: { tools: {} },
+                serverInfo: { name: 'klyro', version: readVersion() },
+            },
+        };
+    }
+    if (msg.method === 'ping')
+        return { jsonrpc: '2.0', id, result: {} };
+    if (msg.method === 'tools/list') {
+        const schemas = deps.registry.jsonSchemas();
+        return {
+            jsonrpc: '2.0', id,
+            result: {
+                tools: deps.registry.list().map((t) => ({
+                    name: t.name,
+                    description: t.description,
+                    inputSchema: schemas[t.name] ?? { type: 'object' },
+                })),
+            },
+        };
+    }
+    if (msg.method === 'tools/call') {
+        const name = msg.params?.name;
+        const args = msg.params?.arguments ?? {};
+        if (typeof name !== 'string' || !deps.registry.get(name)) {
+            return { jsonrpc: '2.0', id, error: { code: -32602, message: `Unknown tool: ${String(name)}` } };
+        }
+        const decision = await deps.policy.evaluate({ name, input: (args ?? {}), permission: deps.registry.get(name)?.permission }, { cwd: deps.ctx.cwd, nonInteractive: true });
+        if (decision.action !== 'allow') {
+            return {
+                jsonrpc: '2.0', id,
+                result: {
+                    content: [{ type: 'text', text: `POLICY_DENIED: ${decision.action === 'deny' ? decision.reason ?? 'denied' : 'approval required (non-interactive serve cannot prompt)'}` }],
+                    isError: true,
+                },
+            };
+        }
+        const res = await deps.registry.execute(name, args, deps.ctx);
+        if (!res.ok) {
+            const e = res.error;
+            return { jsonrpc: '2.0', id, result: { content: [{ type: 'text', text: `${e.code ?? 'ERROR'}: ${e.message ?? ''}` }], isError: true } };
+        }
+        return { jsonrpc: '2.0', id, result: { content: [{ type: 'text', text: typeof res.value === 'string' ? res.value : JSON.stringify(res.value) }] } };
+    }
+    return { jsonrpc: '2.0', id, error: { code: -32601, message: `Method not found: ${msg.method}` } };
+}
+/** Stdio loop: one JSON-RPC message per line on stdin, responses on stdout. */
+export async function serveStdio(cwd) {
+    const deps = makeServeDeps(cwd);
+    const rl = readline.createInterface({ input: process.stdin, crlfDelay: Infinity });
+    for await (const line of rl) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        let msg;
+        try {
+            msg = JSON.parse(trimmed);
+        }
+        catch {
+            process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id: null, error: { code: -32700, message: 'Parse error' } }) + '\n');
+            continue;
+        }
+        try {
+            const res = await handleMcpRequest(deps, msg);
+            if (res)
+                process.stdout.write(JSON.stringify(res) + '\n');
+        }
+        catch (err) {
+            const id = msg.id ?? null;
+            if (id !== null && id !== undefined) {
+                process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id, error: { code: -32603, message: err instanceof Error ? err.message : String(err) } }) + '\n');
+            }
+        }
+    }
+    return 0;
+}

package/dist/policy/approval.d.ts

@@ -11,7 +11,17 @@ export type ApprovalChoice =
 /** Yes, and auto-allow this pattern for the rest of the session. */
  | 'always'
 /** Yes, session-allow AND persist the pattern to settings (survives restarts). */
- | 'always-persist';
+ | 'always-persist'
+/**
+ * Yes, but with edited input. Produced by the TUI modal (`e`): the
+ * runtime re-validates + re-evaluates policy on `editedInput` (bounded
+ * re-prompt loop) instead of running the original call. The stdin prompt
+ * has no editor — `e` there stays `deny`.
+ */
+ | {
+    kind: 'edit';
+    editedInput: Record<string, unknown>;
+};
 export interface ApprovalRequest {
     toolName: string;
     reason: string;
@@ -37,6 +47,10 @@ export declare function sanitizeForPrompt(s: string): string;
  * so stdin stays consistent): lowercase `a` = session-only, UPPERCASE `A` =
  * persist to settings. Case MUST be checked before lowercasing — the old TUI
  * code lowercased first, so `A` silently became session-only `always`.
+ *
+ * NOTE: `e` maps to `deny` here, but the TUI modal intercepts `e` BEFORE
+ * this mapper to open inline edit mode (edit-and-retry). Only callers
+ * without an editor (stdin prompt) should rely on the `e`→`deny` mapping.
  */
 export declare function approvalChoiceForKey(inputStr: string): ApprovalChoice | 'expand' | 'explain' | null;
 /** Default prompt backed by readline on stdin/stdout. */

package/dist/policy/approval.js

@@ -30,6 +30,10 @@ export function sanitizeForPrompt(s) {
  * so stdin stays consistent): lowercase `a` = session-only, UPPERCASE `A` =
  * persist to settings. Case MUST be checked before lowercasing — the old TUI
  * code lowercased first, so `A` silently became session-only `always`.
+ *
+ * NOTE: `e` maps to `deny` here, but the TUI modal intercepts `e` BEFORE
+ * this mapper to open inline edit mode (edit-and-retry). Only callers
+ * without an editor (stdin prompt) should rely on the `e`→`deny` mapping.
  */
 export function approvalChoiceForKey(inputStr) {
     if (inputStr === 'A')
@@ -101,6 +105,10 @@ export class PatternApprovalCache {
         if (key && this.session.has(key))
             return 'allow';
         const choice = await this.inner.ask(req);
+        // Edited input is a new call, not an approval of the pattern — pass
+        // through without caching so the re-evaluated call prompts on its own.
+        if (typeof choice === 'object')
+            return choice;
         if ((choice === 'always' || choice === 'always-persist') && key) {
             this.session.add(key);
         }

package/dist/policy/engine.d.ts

@@ -20,6 +20,13 @@ export interface ToolCallLike {
     name: string;
     /** Parsed tool input. */
     input: Record<string, unknown>;
+    /**
+     * Tool risk class from the registry (`read|edit|execute|admin`).
+     * The runtime always passes this; when present, `execute`/`admin`
+     * tools fall through to ask/deny instead of the legacy default-allow
+     * (see evaluate). Omitted in unit tests → legacy default-allow.
+     */
+    permission?: 'read' | 'edit' | 'execute' | 'admin';
 }
 export interface PolicyContext {
     cwd: string;
@@ -55,7 +62,10 @@ export interface PolicyRule {
 export declare const DEFAULT_POLICY_CONFIG: PolicyConfig;
 /**
  * Compose multiple rules. The first rule to return a Decision wins.
- * If none return a Decision, the default is `allow`.
+ * If none return a Decision, privileged tools (`execute`/`admin`, when
+ * the caller passes `permission`) fall through to ask (interactive) or
+ * deny (headless) instead of allow; everything else defaults to `allow`.
+ * `auto` mode keeps the legacy allow-everything behavior.
  */
 export declare class PolicyEngine {
     private readonly rules;

package/dist/policy/engine.js

@@ -44,7 +44,10 @@ export const DEFAULT_POLICY_CONFIG = {
 };
 /**
  * Compose multiple rules. The first rule to return a Decision wins.
- * If none return a Decision, the default is `allow`.
+ * If none return a Decision, privileged tools (`execute`/`admin`, when
+ * the caller passes `permission`) fall through to ask (interactive) or
+ * deny (headless) instead of allow; everything else defaults to `allow`.
+ * `auto` mode keeps the legacy allow-everything behavior.
  */
 export class PolicyEngine {
     rules;
@@ -116,6 +119,16 @@ export class PolicyEngine {
             if (d)
                 return d;
         }
+        // Privileged-class default: an `execute`/`admin` tool that no rule
+        // explicitly allowed must not run silently. Interactive sessions get
+        // an approval prompt; headless sessions get a denial naming the
+        // escape hatch (an explicit `tool`/`tool(glob)` allow rule).
+        if (ctx.config.mode !== 'auto' && (call.permission === 'execute' || call.permission === 'admin')) {
+            if (ctx.nonInteractive) {
+                return { action: 'deny', reason: `${call.name} is a privileged ${call.permission} tool — pre-approve with an allow rule (e.g. "${call.name}")` };
+            }
+            return { action: 'ask', reason: `${call.name} is a privileged ${call.permission} tool and needs approval` };
+        }
         return { action: 'allow' };
     }
     evaluateGlobRules(call) {

package/dist/policy/secret-redactor.js

@@ -12,7 +12,10 @@ import { Transform } from 'node:stream';
 const PATTERNS = [
     { name: 'aws-key', re: /AKIA[0-9A-Z]{16}/g },
     { name: 'aws-secret', re: /(?:aws_secret_access_key|secret)\s*[:=]\s*[A-Za-z0-9/+=]{40}/gi },
-    { name: 'aws-secret-b64', re: /(?<![A-Za-z0-9/+=])(?=[A-Za-z0-9/+=]*[+/=])[A-Za-z0-9/+=]{40,}={0,2}(?![A-Za-z0-9/+=])/g, },
+    // Long base64-ish runs must BOTH contain a +/= (excludes pure-hex SHAs
+    // and hashes) AND a digit (excludes letter-only words/sentences that
+    // happen to be long). Genuine secrets mix classes; prose rarely does.
+    { name: 'aws-secret-b64', re: /(?<![A-Za-z0-9/+=])(?=[A-Za-z0-9/+=]*[+/=])(?=[A-Za-z0-9/+=]*[0-9])[A-Za-z0-9/+=]{40,}={0,2}(?![A-Za-z0-9/+=])/g, },
     { name: 'pem-block', re: /-----BEGIN [A-Z ]+PRIVATE KEY-----[\s\S]*?-----END [A-Z ]+PRIVATE KEY-----/g },
     { name: 'github-token', re: /gh[pousr]_[A-Za-z0-9]{36,255}/g },
     { name: 'slack-token', re: /xox[abprs]-[A-Za-z0-9-]{10,}/g },