klyro 1.0.4 → 1.0.6

package/dist/providers/endpoints.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Single provider registration point.
+ *
+ * Everything a new provider needs lives in ONE entry here:
+ *   - default base URL + model (hosted) or probe URL (local)
+ *   - wire protocol kind (OpenAI-compatible vs Anthropic)
+ *   - key env vars for resolution
+ *
+ * Consumers:
+ *   - `src/providers.ts` local-probe list + hosted defaults derive from this
+ *   - `src/providers/model-info.ts` pricing stays model-keyed (unchanged)
+ *   - `registerEndpoint()` allows programmatic/enterprise providers
+ */
+export type ProviderKind = 'openai-compatible' | 'anthropic';
+export interface ProviderEndpoint {
+    /** Stable id, e.g. 'openai', 'ollama'. Lowercase + dashes. */
+    id: string;
+    /** Human label for doctor/help output. */
+    label: string;
+    /** Wire protocol for adapter selection. */
+    kind: ProviderKind;
+    /** Default base URL (hosted) or probe URL (local). */
+    baseURL: string;
+    /** Model used when nothing else specifies one. */
+    defaultModel: string;
+    /** Local servers only: probed in order with `GET <base><probePath>`. */
+    probePath?: string;
+    /** Env vars tried (in order) for this provider's key. */
+    apiKeyEnv?: string[];
+}
+/** Register (or override) a provider endpoint programmatically. */
+export declare function registerEndpoint(def: ProviderEndpoint): void;
+/** All endpoints: builtins with custom overrides applied. */
+export declare function listEndpoints(): ProviderEndpoint[];
+/** Find one endpoint by id (custom wins). */
+export declare function getEndpoint(id: string): ProviderEndpoint | undefined;
+/** Local-probe candidates in order (entries with probePath). */
+export declare function localProbeEndpoints(): ProviderEndpoint[];
+/**
+ * Guess the provider id from a base URL (host matching). Returns undefined
+ * for unknown hosts — callers treat that as generic OpenAI-compatible.
+ */
+export declare function inferProviderId(baseURL: string): string | undefined;

package/dist/providers/endpoints.js

@@ -0,0 +1,104 @@
+const BUILTINS = [
+    {
+        id: 'openai',
+        label: 'OpenAI',
+        kind: 'openai-compatible',
+        baseURL: 'https://api.openai.com/v1',
+        defaultModel: 'gpt-4o-mini',
+        apiKeyEnv: ['KLYRO_API_KEY', 'OPENAI_API_KEY'],
+    },
+    {
+        id: 'anthropic',
+        label: 'Anthropic',
+        kind: 'anthropic',
+        baseURL: 'https://api.anthropic.com/v1',
+        defaultModel: 'claude-3-5-sonnet-20240620',
+        apiKeyEnv: ['KLYRO_API_KEY', 'ANTHROPIC_API_KEY'],
+    },
+    {
+        id: 'ollama',
+        label: 'Ollama',
+        kind: 'openai-compatible',
+        baseURL: 'http://localhost:11434/v1',
+        defaultModel: 'llama3.2',
+        probePath: '/models',
+    },
+    {
+        id: 'lmstudio',
+        label: 'LM Studio',
+        kind: 'openai-compatible',
+        baseURL: 'http://localhost:1234/v1',
+        defaultModel: 'local-model',
+        probePath: '/models',
+    },
+    {
+        id: 'vllm',
+        label: 'vLLM',
+        kind: 'openai-compatible',
+        baseURL: 'http://localhost:8000/v1',
+        defaultModel: 'meta-llama/Llama-3-8B-Instruct',
+        probePath: '/models',
+    },
+    {
+        id: 'llamacpp',
+        label: 'llama.cpp',
+        kind: 'openai-compatible',
+        baseURL: 'http://localhost:8080/v1',
+        defaultModel: 'local-model',
+        probePath: '/models',
+    },
+];
+const custom = new Map();
+function validateEndpoint(def) {
+    if (!/^[a-z0-9-]{1,32}$/.test(def.id))
+        throw new Error(`invalid provider id "${def.id}"`);
+    if (!def.baseURL || !def.defaultModel)
+        throw new Error(`provider "${def.id}" needs baseURL + defaultModel`);
+}
+/** Register (or override) a provider endpoint programmatically. */
+export function registerEndpoint(def) {
+    validateEndpoint(def);
+    custom.set(def.id, def);
+}
+/** All endpoints: builtins with custom overrides applied. */
+export function listEndpoints() {
+    const byId = new Map();
+    for (const d of BUILTINS)
+        byId.set(d.id, d);
+    for (const [id, d] of custom)
+        byId.set(id, d);
+    return [...byId.values()];
+}
+/** Find one endpoint by id (custom wins). */
+export function getEndpoint(id) {
+    return custom.get(id) ?? BUILTINS.find((d) => d.id === id);
+}
+/** Local-probe candidates in order (entries with probePath). */
+export function localProbeEndpoints() {
+    return listEndpoints().filter((d) => d.probePath !== undefined);
+}
+/**
+ * Guess the provider id from a base URL (host matching). Returns undefined
+ * for unknown hosts — callers treat that as generic OpenAI-compatible.
+ */
+export function inferProviderId(baseURL) {
+    let host = '';
+    try {
+        host = new URL(baseURL).hostname.toLowerCase();
+    }
+    catch {
+        return undefined;
+    }
+    if (host === 'api.openai.com')
+        return 'openai';
+    if (host === 'api.anthropic.com')
+        return 'anthropic';
+    for (const d of listEndpoints()) {
+        try {
+            if (new URL(d.baseURL).hostname.toLowerCase() === host && d.id !== 'openai' && d.id !== 'anthropic')
+                return d.id;
+        }
+        catch { /* ignore */ }
+    }
+    return undefined;
+}

package/dist/providers.js

@@ -12,12 +12,15 @@
  *   4. Fall back to api.openai.com with a clear error if no key
  */
 import { assertSafeBaseURL, normalizeBaseURL } from './chat.js';
-const LOCAL_ENDPOINTS = [
-    { name: 'Ollama', baseURL: 'http://localhost:11434/v1', defaultModel: 'llama3.2' },
-    { name: 'LM Studio', baseURL: 'http://localhost:1234/v1', defaultModel: 'local-model' },
-    { name: 'vLLM', baseURL: 'http://localhost:8000/v1', defaultModel: 'meta-llama/Llama-3-8B-Instruct' },
-    { name: 'llama.cpp', baseURL: 'http://localhost:8080/v1', defaultModel: 'local-model' },
-];
+import { localProbeEndpoints } from './providers/endpoints.js';
+/**
+ * Local probe candidates, derived from the single provider registry
+ * (`providers/endpoints.ts`) — adding a local server there automatically
+ * extends probing here.
+ */
+function localProbeList() {
+    return localProbeEndpoints().map((d) => ({ name: d.label, baseURL: d.baseURL, defaultModel: d.defaultModel, probePath: d.probePath ?? '/models' }));
+}
 /**
  * Resolve which provider to use. Does not throw; returns `null` if nothing
  * is reachable.
@@ -147,8 +150,8 @@ export async function resolveProvider() {
         };
     }
     // Probe local endpoints
-    for (const ep of LOCAL_ENDPOINTS) {
-        if (await probeLocal(ep.baseURL)) {
+    for (const ep of localProbeList()) {
+        if (await probeLocal(ep.baseURL, ep.probePath)) {
             return {
                 baseURL: ep.baseURL,
                 apiKey: '',
@@ -160,13 +163,13 @@ export async function resolveProvider() {
     return null;
 }
 /** Hit a cheap endpoint to check if a local server is up. */
-async function probeLocal(baseURL) {
+async function probeLocal(baseURL, probePath = '/models') {
     const ctrl = new AbortController();
     const t = setTimeout(() => ctrl.abort(), 600);
     try {
         // Try the OpenAI-style /models endpoint; some servers (Ollama before load)
         // answer /, others only /v1/models.
-        const res = await fetch(`${baseURL.replace(/\/+$/, '')}/models`, {
+        const res = await fetch(`${baseURL.replace(/\/+$/, '')}${probePath}`, {
             method: 'GET',
             signal: ctrl.signal,
         });

package/dist/shared/error-map.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Single mapper unifying the three error dialects:
+ *   - ToolErrorCode  (tools/normalize.ts — per-tool failures)
+ *   - FailureClass   (verification/classify.ts — verify repair classes)
+ *   → KlyroErrorCode (shared/errors.ts — harness-wide + exit codes)
+ *
+ * Type-only imports keep this module cycle-free: it is safe to import
+ * from tools/, verification/, and cli/ alike.
+ */
+import { EXIT_CODE, type KlyroErrorCode } from './errors.js';
+import type { FailureClass } from '../verification/classify.js';
+export { EXIT_CODE };
+export type { KlyroErrorCode };
+/** Map any tool-layer error code to its harness-wide KlyroErrorCode. */
+export declare function toolErrorToKlyroCode(code: string): KlyroErrorCode;
+/** Map a verification failure class to its harness-wide code. */
+export declare function failureClassToKlyroCode(cls: FailureClass): KlyroErrorCode;
+/** Exit code for any mapped error: single entry point for CLI mapping. */
+export declare function exitCodeFor(code: KlyroErrorCode): number;

package/dist/shared/error-map.js

@@ -0,0 +1,58 @@
+/**
+ * Single mapper unifying the three error dialects:
+ *   - ToolErrorCode  (tools/normalize.ts — per-tool failures)
+ *   - FailureClass   (verification/classify.ts — verify repair classes)
+ *   → KlyroErrorCode (shared/errors.ts — harness-wide + exit codes)
+ *
+ * Type-only imports keep this module cycle-free: it is safe to import
+ * from tools/, verification/, and cli/ alike.
+ */
+import { EXIT_CODE } from './errors.js';
+export { EXIT_CODE };
+/** Map any tool-layer error code to its harness-wide KlyroErrorCode. */
+export function toolErrorToKlyroCode(code) {
+    switch (code) {
+        case 'NOT_FOUND':
+        case 'COMMAND_NOT_FOUND':
+        case 'MATCH_NOT_FOUND':
+        case 'UNKNOWN_TOOL':
+            return 'TOOL_NOT_FOUND';
+        case 'PERMISSION_DENIED':
+        case 'COMMAND_DENIED':
+        case 'POLICY_DENIED':
+            return 'TOOL_DENIED';
+        case 'PATH_ESCAPE':
+            return 'PATH_ESCAPE';
+        case 'TIMEOUT':
+            return 'PROVIDER_TIMEOUT';
+        case 'INVALID_INPUT':
+        case 'INVALID_PATCH':
+        case 'HUNK_MISMATCH':
+        case 'MATCH_AMBIGUOUS':
+            return 'CONFIG_INVALID';
+        case 'ABORTED':
+        case 'STALE':
+        case 'EXIT_NONZERO':
+        case 'IO_ERROR':
+        case 'INTERNAL':
+        default:
+            return 'UNKNOWN';
+    }
+}
+/** Map a verification failure class to its harness-wide code. */
+export function failureClassToKlyroCode(cls) {
+    switch (cls) {
+        case 'introduced':
+            return 'VERIFY_FAILED';
+        case 'pre_existing':
+        case 'flaky':
+            // Not the agent's fault — surfaced as advisory, not a hard failure.
+            return 'UNKNOWN';
+        case 'env':
+            return 'CONFIG_INVALID';
+    }
+}
+/** Exit code for any mapped error: single entry point for CLI mapping. */
+export function exitCodeFor(code) {
+    return EXIT_CODE[code] ?? 1;
+}

package/dist/tools/lsp/diagnostics.d.ts

@@ -3,10 +3,20 @@ export declare const lspDiagnosticsTool: import("../types.js").Tool<{
 }, {
     readonly enabled: false;
     readonly diagnostics: readonly [];
-    readonly note: "LSP off — use /lsp to enable";
+    readonly note: "LSP off via KLYRO_LSP=0";
 } | {
-    readonly enabled: true;
+    readonly enabled: false;
     readonly diagnostics: readonly [];
+    readonly note: "no TypeScript compiler found (node_modules/.bin/tsc missing)";
+} | {
+    readonly enabled: true;
+    readonly diagnostics: {
+        file: string;
+        line: number;
+        col: number;
+        code: string;
+        message: string;
+    }[];
     readonly note?: undefined;
 }>;
 export declare const lspGotoDefinitionTool: import("../types.js").Tool<{
@@ -14,7 +24,28 @@ export declare const lspGotoDefinitionTool: import("../types.js").Tool<{
     line: number;
     character?: number | undefined;
 }, {
-    readonly enabled: boolean;
+    readonly enabled: false;
+    readonly location: null;
+    readonly note: "LSP off via KLYRO_LSP=0";
+    readonly candidates?: undefined;
+} | {
+    readonly enabled: true;
+    readonly location: null;
+    readonly note: `unreadable file: ${string}`;
+    readonly candidates?: undefined;
+} | {
+    readonly enabled: true;
     readonly location: null;
-    readonly note: "stub";
+    readonly note: "no identifier under cursor";
+    readonly candidates?: undefined;
+} | {
+    readonly enabled: true;
+    readonly location: {
+        file: string;
+        line: number;
+        kind: string;
+        name: string;
+    } | null;
+    readonly candidates: number;
+    readonly note?: undefined;
 }>;

package/dist/tools/lsp/diagnostics.js

@@ -1,28 +1,107 @@
 /**
- * 7.5 — LSP bridge stub (off by default, /lsp to enable)
- * Provides diagnostics / goto_definition when LS available, otherwise no-op.
+ * 7.5 — Language intelligence without an LSP client dependency.
+ *
+ * `lsp_diagnostics` runs the TypeScript compiler (`tsc --noEmit`) when the
+ * project has one and filters the output to the requested path (or returns
+ * a capped full-project list). Other languages report "unsupported".
+ * `lsp_goto_definition` resolves the identifier under (line, character) to
+ * its definition via the regex repo-map symbol index. Set KLYRO_LSP=0 to
+ * force both tools off.
  */
+import { spawnSync } from 'node:child_process';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
 import { z } from 'zod';
 import { defineTool } from '../types.js';
 import { safe } from '../normalize.js';
+import { resolveWithinCwd } from '../../policy/path-guard.js';
+import { buildRepoMap } from '../../context/repo-map.js';
+const OFF_NOTE = 'set KLYRO_LSP=1 to re-enable (default on)';
+function isOff() {
+    return process.env.KLYRO_LSP === '0';
+}
 export const lspDiagnosticsTool = defineTool({
     name: 'lsp_diagnostics',
-    description: 'LSP diagnostics (stub — off unless KLYRO_LSP=1)',
+    description: 'TypeScript diagnostics for a file (tsc --noEmit, filtered to path)',
     inputSchema: z.object({ path: z.string().optional() }),
     permission: 'read',
     isConcurrencySafe: true,
     execute: async (input, ctx) => safe(async () => {
-        if (process.env.KLYRO_LSP !== '1')
-            return { enabled: false, diagnostics: [], note: 'LSP off — use /lsp to enable' };
-        // Real would spawn language server; stub returns empty
-        return { enabled: true, diagnostics: [] };
+        if (isOff())
+            return { enabled: false, diagnostics: [], note: 'LSP off via KLYRO_LSP=0' };
+        const target = input.path ? resolveWithinCwd(ctx.cwd, input.path).resolved : null;
+        // Prefer the project's own tsc; fall back to npx tsc on PATH.
+        const tscArgs = ['--noEmit', '--pretty', 'false'];
+        let out = '';
+        try {
+            const local = path.join(ctx.cwd, 'node_modules', '.bin', process.platform === 'win32' ? 'tsc.cmd' : 'tsc');
+            const res = spawnSync(local, tscArgs, { cwd: ctx.cwd, timeout: 90_000, encoding: 'utf-8', maxBuffer: 4 * 1024 * 1024 });
+            out = (res.stdout ?? '') + (res.stderr ?? '');
+        }
+        catch {
+            return { enabled: false, diagnostics: [], note: 'no TypeScript compiler found (node_modules/.bin/tsc missing)' };
+        }
+        const diags = [];
+        for (const ln of out.split('\n')) {
+            const m = /^(.+?)\((\d+),(\d+)\):\s+(error|warning)\s+(TS\d+):\s*(.*)$/.exec(ln.trim());
+            if (!m)
+                continue;
+            const file = m[1].replace(/\\/g, '/');
+            if (target && path.relative(ctx.cwd, path.resolve(ctx.cwd, file)) !== path.relative(ctx.cwd, target))
+                continue;
+            diags.push({ file, line: Number(m[2]), col: Number(m[3]), code: m[5], message: m[6].slice(0, 300) });
+            if (diags.length >= 50)
+                break;
+        }
+        return { enabled: true, diagnostics: diags };
     }),
 });
 export const lspGotoDefinitionTool = defineTool({
     name: 'lsp_goto_definition',
-    description: 'LSP goto_definition (stub)',
+    description: 'Go to definition: identifier under (line, character) resolved via the repo symbol index',
     inputSchema: z.object({ path: z.string().min(1), line: z.number().int().min(1), character: z.number().int().min(0).optional() }),
     permission: 'read',
     isConcurrencySafe: true,
-    execute: async (input) => safe(async () => ({ enabled: process.env.KLYRO_LSP === '1', location: null, note: 'stub' })),
+    execute: async (input, ctx) => safe(async () => {
+        if (isOff())
+            return { enabled: false, location: null, note: 'LSP off via KLYRO_LSP=0' };
+        const { resolved } = resolveWithinCwd(ctx.cwd, input.path);
+        let content;
+        try {
+            content = await fs.readFile(resolved, 'utf-8');
+        }
+        catch {
+            return { enabled: true, location: null, note: `unreadable file: ${input.path}` };
+        }
+        const lines = content.split('\n');
+        const lineText = lines[input.line - 1] ?? '';
+        const col = Math.min(input.character ?? 0, lineText.length);
+        const wordAt = (() => {
+            const isWord = (c) => /[A-Za-z0-9_$]/.test(c);
+            let s = col;
+            let e = col;
+            while (s > 0 && isWord(lineText[s - 1]))
+                s--;
+            while (e < lineText.length && isWord(lineText[e]))
+                e++;
+            const w = lineText.slice(s, e);
+            return w || null;
+        })();
+        if (!wordAt)
+            return { enabled: true, location: null, note: 'no identifier under cursor' };
+        const files = await buildRepoMap({ cwd: ctx.cwd, maxFiles: 300 });
+        const hits = [];
+        for (const f of files) {
+            for (const s of f.symbols) {
+                if (s.name === wordAt)
+                    hits.push({ file: f.path, line: s.line, kind: s.kind, name: s.name });
+            }
+        }
+        // Prefer a definition outside the requesting file (import target),
+        // else the local one.
+        const rel = path.relative(ctx.cwd, resolved);
+        const other = hits.filter((h) => h.file !== rel);
+        const best = other[0] ?? hits[0] ?? null;
+        return { enabled: true, location: best, candidates: hits.length };
+    }),
 });

package/dist/tools/normalize.d.ts

@@ -4,6 +4,7 @@
  * errors without each tool hand-coding the shape.
  */
 import type { ToolResult } from './types.js';
+import type { KlyroErrorCode } from '../shared/errors.js';
 /** Standard tool error codes. Tools may add their own. */
 export declare const TOOL_ERROR_CODES: {
     readonly NOT_FOUND: "NOT_FOUND";
@@ -23,6 +24,8 @@ export declare function toToolError(err: unknown, fallbackCode?: ToolErrorCode):
     code: ToolErrorCode;
     message: string;
     details?: unknown;
+    /** Harness-wide code from the central mapper (shared/error-map.ts). */
+    klyroCode: KlyroErrorCode;
 };
 /** Convenience: wrap a function in try/catch and return a ToolResult.
  *  If the function returns a ToolResult (already-shaped), it is passed through

package/dist/tools/normalize.js

@@ -3,6 +3,7 @@
  * Centralizing this means tools can `throw` and the harness sees structured
  * errors without each tool hand-coding the shape.
  */
+import { toolErrorToKlyroCode } from '../shared/error-map.js';
 /** Standard tool error codes. Tools may add their own. */
 export const TOOL_ERROR_CODES = {
     NOT_FOUND: 'NOT_FOUND',
@@ -19,26 +20,28 @@ export const TOOL_ERROR_CODES = {
 };
 export function toToolError(err, fallbackCode = TOOL_ERROR_CODES.INTERNAL) {
     if (err === null || err === undefined) {
-        return { code: fallbackCode, message: 'Unknown error' };
+        return { code: fallbackCode, message: 'Unknown error', klyroCode: toolErrorToKlyroCode(fallbackCode) };
     }
     if (err instanceof Error) {
         // If the error already declares a tool-level `code` (e.g. PathGuardError),
         // honor it instead of mapping through Node errno.
         const maybeCode = err.code;
         if (typeof maybeCode === 'string' && isToolErrorCode(maybeCode)) {
-            return { code: maybeCode, message: err.message };
+            return { code: maybeCode, message: err.message, klyroCode: toolErrorToKlyroCode(maybeCode) };
         }
         if (typeof maybeCode === 'string') {
             // Looks like a Node errno (e.g. 'ENOENT'); map it.
+            const code = mapNodeErrorCode(maybeCode);
             return {
-                code: mapNodeErrorCode(maybeCode),
+                code,
                 message: err.message,
                 details: { syscall: err.syscall, path: err.path },
+                klyroCode: toolErrorToKlyroCode(code),
             };
         }
-        return { code: fallbackCode, message: err.message, details: err.stack };
+        return { code: fallbackCode, message: err.message, details: err.stack, klyroCode: toolErrorToKlyroCode(fallbackCode) };
     }
-    return { code: fallbackCode, message: String(err) };
+    return { code: fallbackCode, message: String(err), klyroCode: toolErrorToKlyroCode(fallbackCode) };
 }
 const CUSTOM_TOOL_CODES = new Set([
     'MATCH_NOT_FOUND',

package/dist/tools/search/dependencies.d.ts

@@ -9,8 +9,8 @@ import { z } from 'zod';
 declare const InputSchema: z.ZodObject<{
     cwd: z.ZodOptional<z.ZodString>;
     ecosystem: z.ZodOptional<z.ZodEnum<{
-        auto: "auto";
         npm: "npm";
+        auto: "auto";
         python: "python";
         go: "go";
         rust: "rust";
@@ -29,7 +29,7 @@ export interface DependenciesOutput {
 }
 export declare const dependenciesTool: import("../types.js").Tool<{
     cwd?: string | undefined;
-    ecosystem?: "auto" | "npm" | "python" | "go" | "rust" | undefined;
+    ecosystem?: "npm" | "auto" | "python" | "go" | "rust" | undefined;
     maxResults?: number | undefined;
 }, {
     dependencies: never[];

package/dist/tools/shell/background.d.ts

@@ -9,6 +9,12 @@ export declare function startBackground(command: string, cwd: string): string;
 export declare function startBackgroundArgv(argv: string[], cwd: string): string;
 export declare function getOutput(id: string, filter?: string): string;
 export declare function killJob(id: string): void;
+/**
+ * Abort cascade: kill every tracked background job. Called from the
+ * runtime abort path and the REPL `/cancel` handler so a cancelled run
+ * never leaks runaway shells. Returns the killed job ids for audit.
+ */
+export declare function killAllJobs(): string[];
 export declare function listJobs(): Array<{
     id: string;
     command: string;

package/dist/tools/shell/background.js

@@ -90,6 +90,23 @@ export function killJob(id) {
     catch { /* ignore */ }
     jobs.delete(id);
 }
+/**
+ * Abort cascade: kill every tracked background job. Called from the
+ * runtime abort path and the REPL `/cancel` handler so a cancelled run
+ * never leaks runaway shells. Returns the killed job ids for audit.
+ */
+export function killAllJobs() {
+    const killed = [];
+    for (const job of [...jobs.values()]) {
+        try {
+            job.proc.kill('SIGKILL');
+        }
+        catch { /* ignore */ }
+        jobs.delete(job.id);
+        killed.push(job.id);
+    }
+    return killed;
+}
 export function listJobs() {
     return [...jobs.values()].map((j) => ({ id: j.id, command: j.command, cwd: j.cwd, running: j.proc.exitCode === null }));
 }

package/dist/tools/symbols/find-symbol.d.ts

@@ -4,7 +4,7 @@ export declare const findSymbolTool: import("../types.js").Tool<{
 }, {
     readonly name: string;
     readonly hits: readonly [];
-    readonly note: "find_symbol disabled — use grep/repo_map (decision 7.4: ripgrep baseline 4.2s vs tree-sitter 5.8s, no gain)";
+    readonly note: "find_symbol disabled via KLYRO_SYMBOLS=0 — use grep/repo_map";
 } | {
     readonly name: string;
     readonly hits: {

package/dist/tools/symbols/find-symbol.js

@@ -1,7 +1,9 @@
 /**
- * 7.4 — find_symbol (optional, eval-gated) — stub using regex repo-map
- * Real tree-sitter would be <5s/100k LOC, but ripgrep baseline wins on locate suite, so shipped disabled.
- * Enable with KLYRO_SYMBOLS=1 for experiment; decision recorded in docs/decisions/7.4-symbols.md
+ * 7.4 — find_symbol via the regex repo-map (no tree-sitter dependency).
+ * Previously gated behind KLYRO_SYMBOLS=1; enabled by default now — the
+ * regex symbol index is genuinely useful for name lookup even though
+ * ripgrep wins on raw locate speed. Set KLYRO_SYMBOLS=0 to force the
+ * disabled path (kept for the eval comparison).
  */
 import { z } from 'zod';
 import { defineTool } from '../types.js';
@@ -9,13 +11,13 @@ import { safe } from '../normalize.js';
 import { buildRepoMap } from '../../context/repo-map.js';
 export const findSymbolTool = defineTool({
     name: 'find_symbol',
-    description: 'Find symbol by name (regex, disabled unless KLYRO_SYMBOLS=1 — ripgrep wins on locate suite)',
+    description: 'Find a code symbol (function/class/interface/const) by name across the repo',
     inputSchema: z.object({ name: z.string().min(1), kind: z.string().optional() }),
     permission: 'read',
     isConcurrencySafe: true,
     execute: async (input, ctx) => safe(async () => {
-        if (process.env.KLYRO_SYMBOLS !== '1') {
-            return { name: input.name, hits: [], note: 'find_symbol disabled — use grep/repo_map (decision 7.4: ripgrep baseline 4.2s vs tree-sitter 5.8s, no gain)' };
+        if (process.env.KLYRO_SYMBOLS === '0') {
+            return { name: input.name, hits: [], note: 'find_symbol disabled via KLYRO_SYMBOLS=0 — use grep/repo_map' };
         }
         const files = await buildRepoMap({ cwd: ctx.cwd, maxFiles: 200 });
         const q = input.name.toLowerCase();

package/dist/tools/types.d.ts

@@ -8,6 +8,7 @@
  *   4. Normalize errors into { code, message, details? }
  */
 import type { z } from 'zod';
+import type { KlyroErrorCode } from '../shared/errors.js';
 /** Standard tool result — either a typed value or a structured error. */
 export type ToolResult<T> = {
     ok: true;
@@ -18,6 +19,7 @@ export type ToolResult<T> = {
         code: string;
         message: string;
         details?: unknown;
+        klyroCode?: KlyroErrorCode;
     };
 };
 /**
@@ -78,7 +80,12 @@ export interface Tool<TInput, TOutput> {
     description: string;
     /** Zod schema for runtime validation. */
     inputSchema: z.ZodType<TInput>;
-    /** Permission class: read | edit | execute | admin */
+    /**
+     * Permission class: read | edit | execute | admin.
+     * Consumed by the runtime → policy path: the runtime passes this into
+     * `PolicyEngine.evaluate`, and `execute`/`admin` tools with no explicit
+     * allow rule fall through to ask (interactive) / deny (headless).
+     */
     permission?: 'read' | 'edit' | 'execute' | 'admin';
     /** True if tool is safe to run in parallel with others */
     isConcurrencySafe?: boolean;

package/dist/tui/app.d.ts

@@ -31,6 +31,8 @@ export interface AppProps {
         updateTool: (idCall: string, patch: ToolResultPatch) => void;
         appendThinkingDelta: (text: string) => void;
         clearThinking: () => void;
+        pasteText: (text: string) => void;
+        setVimMode: (mode: 'insert' | 'normal') => void;
     }) => void;
     version?: string;
     isFullscreen?: boolean;