klyro 1.0.5 → 1.0.7

package/dist/cli/init.js

@@ -0,0 +1,60 @@
+/**
+ * Project bootstrap shared by `klyro init` and the REPL `/init`:
+ * scan-seeded KLYRO.md (only when absent) + `.mcp.json` skeleton.
+ * Never overwrites user files; returns created vs skipped lists.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+function captureStdout() {
+    const orig = process.stdout.write.bind(process.stdout);
+    let out = '';
+    process.stdout.write = ((c) => {
+        out += String(c);
+        return true;
+    });
+    return {
+        release: () => {
+            process.stdout.write = orig;
+            return out;
+        },
+    };
+}
+export async function initProject(cwd) {
+    const created = [];
+    const skipped = [];
+    const klyroMd = path.join(cwd, 'KLYRO.md');
+    if (fs.existsSync(klyroMd)) {
+        skipped.push('KLYRO.md (exists)');
+    }
+    else {
+        const { runScan } = await import('./scan.js');
+        const cap = captureStdout();
+        try {
+            await runScan({ cwd, json: false });
+        }
+        finally {
+            // release even if scan throws — partial output still seeds the draft
+        }
+        const out = cap.release();
+        fs.writeFileSync(klyroMd, `# KLYRO.md\n\nProject: ${cwd}\n\n## Stack\n\n${out.slice(0, 2000)}\n\n## Conventions\n\n- Prefer smallest change that solves the task.\n- Run verification after edits.\n`, 'utf-8');
+        created.push('KLYRO.md');
+    }
+    const mcpJson = path.join(cwd, '.mcp.json');
+    if (fs.existsSync(mcpJson)) {
+        skipped.push('.mcp.json (exists)');
+    }
+    else {
+        fs.writeFileSync(mcpJson, JSON.stringify({ mcpServers: {} }, null, 2) + '\n', 'utf-8');
+        created.push('.mcp.json');
+    }
+    return { created, skipped };
+}
+export function nextStepsText() {
+    return [
+        'Next steps:',
+        '  klyro login            # store provider key once (or set KLYRO_BASE_URL/_API_KEY/_MODEL)',
+        '  klyro doctor           # verify toolchain, provider, sessions, sandbox',
+        '  klyro agents           # list subagents (add yours in .klyro/agents/*.md)',
+        '  klyro mcp add <n> <cmd># attach a tool server (or https:// URL for remote)',
+    ].join('\n');
+}

package/dist/cli/keychain.d.ts

@@ -0,0 +1,10 @@
+export declare const KEYCHAIN_SERVICE = "klyro";
+export type KeychainBackend = 'macos' | 'linux';
+/** Which OS backend (if any) can store keys on this machine. */
+export declare function keychainAvailable(): KeychainBackend | null;
+/** Read a secret. Returns null when unavailable, missing, or denied. */
+export declare function keychainGet(account: string): Promise<string | null>;
+/** Store a secret. Returns false when unavailable or denied (caller falls back). */
+export declare function keychainSet(account: string, secret: string): Promise<boolean>;
+/** Delete a secret. Returns false when unavailable (caller falls back). */
+export declare function keychainDelete(account: string): Promise<boolean>;

package/dist/cli/keychain.js

@@ -0,0 +1,86 @@
+/**
+ * OS keychain for provider API keys — no new dependencies, platform CLIs only.
+ *
+ *   - macOS: `security` (Keychain Services; always present)
+ *   - Linux: `secret-tool` (libsecret; present on most GNOME desktops)
+ *   - Windows: unavailable (no dependency-free read path) → file fallback
+ *
+ * Every function is best-effort and never throws: missing CLIs, locked
+ * keychains, and headless sessions all degrade to `null`/`false`, and
+ * callers fall back to the 0600 credentials file. Service name is fixed
+ * (`klyro`), accounts are provider ids (`openai`, `anthropic`).
+ */
+import { execFileSync, spawnSync } from 'node:child_process';
+export const KEYCHAIN_SERVICE = 'klyro';
+/** Which OS backend (if any) can store keys on this machine. */
+export function keychainAvailable() {
+    if (process.platform === 'darwin')
+        return 'macos';
+    if (process.platform === 'linux') {
+        try {
+            const r = spawnSync('secret-tool', ['--version'], { stdio: 'ignore', timeout: 5000 });
+            if (r.error)
+                return null;
+            return typeof r.status === 'number' && r.status === 0 ? 'linux' : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    return null;
+}
+function run(args, input) {
+    try {
+        const res = execFileSync(args[0], args.slice(1), {
+            input: input ?? undefined,
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'ignore'],
+            timeout: 10_000,
+        });
+        return { ok: true, out: typeof res === 'string' ? res : '' };
+    }
+    catch {
+        return { ok: false, out: '' };
+    }
+}
+/** Read a secret. Returns null when unavailable, missing, or denied. */
+export async function keychainGet(account) {
+    const backend = keychainAvailable();
+    if (!backend)
+        return null;
+    if (backend === 'macos') {
+        const r = run(['security', 'find-generic-password', '-s', KEYCHAIN_SERVICE, '-a', account, '-w']);
+        const v = r.out.trim();
+        return r.ok && v ? v : null;
+    }
+    const r = run(['secret-tool', 'lookup', 'service', KEYCHAIN_SERVICE, 'account', account]);
+    const v = r.out.replace(/\n$/, '');
+    return r.ok && v ? v : null;
+}
+/** Store a secret. Returns false when unavailable or denied (caller falls back). */
+export async function keychainSet(account, secret) {
+    if (!secret)
+        return false;
+    const backend = keychainAvailable();
+    if (!backend)
+        return false;
+    if (backend === 'macos') {
+        // -U updates an existing item instead of erroring on duplicates.
+        const r = run(['security', 'add-generic-password', '-U', '-s', KEYCHAIN_SERVICE, '-a', account, '-w', secret]);
+        return r.ok;
+    }
+    const r = run(['secret-tool', 'store', '--label', `klyro ${account}`, 'service', KEYCHAIN_SERVICE, 'account', account], secret);
+    return r.ok;
+}
+/** Delete a secret. Returns false when unavailable (caller falls back). */
+export async function keychainDelete(account) {
+    const backend = keychainAvailable();
+    if (!backend)
+        return false;
+    if (backend === 'macos') {
+        const r = run(['security', 'delete-generic-password', '-s', KEYCHAIN_SERVICE, '-a', account]);
+        return r.ok;
+    }
+    const r = run(['secret-tool', 'clear', 'service', KEYCHAIN_SERVICE, 'account', account]);
+    return r.ok;
+}

package/dist/cli/repl.js

@@ -293,6 +293,8 @@ export async function startRepl(opts = {}) {
     let isMounted = false;
     // Live vim input mode for the TUI (toggled by /vim, persisted to config).
     let vimLive = 'insert';
+    // Custom-command recursion guard (a command body may invoke /commands).
+    const customDepthRef = { current: 0 };
     let directHooks;
     // Plain-text mirror for exit replay (scroll.md §1.2: session survives in
     // native scrollback after the alt screen is torn down). Cap 300 lines.
@@ -844,6 +846,7 @@ export async function startRepl(opts = {}) {
         let activeCallId = null;
         let activeCallName = null;
         let activeCallArgs = '';
+        let runEndStatus = 'error';
         try {
             const result = await run({
                 task: taskText,
@@ -976,6 +979,7 @@ export async function startRepl(opts = {}) {
             });
             if (result.finalText)
                 lastAssistantText = result.finalText;
+            runEndStatus = result.status;
             if (result.verification) {
                 const v = result.verification;
                 queuedAppend({
@@ -1015,6 +1019,12 @@ export async function startRepl(opts = {}) {
             queuedAppend({ id: `err-${Date.now()}`, kind: 'error', message });
             queuedStatus({ status: 'error', errorMessage: message });
         }
+        // sessionEnd hooks: best-effort end-of-run side effects. Never throws.
+        try {
+            const { runSessionEndHooks } = await import('./hooks.js');
+            await runSessionEndHooks(cwd, sessionId, runEndStatus);
+        }
+        catch { /* ignore */ }
     }
     async function handleSlash(cmd) {
         switch (cmd.kind) {
@@ -1095,6 +1105,22 @@ export async function startRepl(opts = {}) {
                 });
                 return;
             }
+            case 'memory-append': {
+                // Human write path: same redaction + atomicity as memory_write.
+                if (!cmd.text) {
+                    queuedAppend({ id: `mem-${Date.now()}`, kind: 'text', text: 'usage: /memory append <text>', role: 'assistant' });
+                    return;
+                }
+                try {
+                    const { memoryWrite } = await import('../context/memory.js');
+                    const p = await memoryWrite(cwd, cmd.text);
+                    queuedAppend({ id: `mem-${Date.now()}`, kind: 'text', text: `Noted → ${p}`, role: 'assistant' });
+                }
+                catch (err) {
+                    queuedAppend({ id: `mem-err-${Date.now()}`, kind: 'error', message: `memory append failed: ${err instanceof Error ? err.message : String(err)}` });
+                }
+                return;
+            }
             case 'jobs': {
                 const { listJobs } = await import('../tools/shell/background.js');
                 const jobs = listJobs();
@@ -1151,8 +1177,8 @@ export async function startRepl(opts = {}) {
             case 'undo': {
                 try {
                     const { undo } = await import('../checkpoints/store.js');
-                    await undo(cwd);
-                    queuedAppend({ id: `undo-${Date.now()}`, kind: 'text', text: 'Undone last checkpoint', role: 'assistant' });
+                    await undo(cwd, cmd.n ?? 1);
+                    queuedAppend({ id: `undo-${Date.now()}`, kind: 'text', text: `Undone ${cmd.n ?? 1} checkpoint(s)`, role: 'assistant' });
                 }
                 catch (err) {
                     const msg = err instanceof Error ? err.message : String(err);
@@ -1161,10 +1187,87 @@ export async function startRepl(opts = {}) {
                 return;
             }
             case 'rewind': {
+                // Numbered rewind menu: bare /rewind lists snapshots (1 = latest),
+                // /rewind <n> restores code, /rewind <n> summary adds a revert
+                // report, /rewind <n> preview dry-runs, /rewind <n> full also
+                // truncates the conversation after the snapshot.
+                const { listCheckpointInfo, snapshotFiles, undo } = await import('../checkpoints/store.js');
+                const infos = await listCheckpointInfo(cwd);
+                if (infos.length === 0) {
+                    queuedAppend({ id: `rewind-${Date.now()}`, kind: 'text', text: 'No checkpoints yet — snapshots are taken after each file mutation.', role: 'assistant' });
+                    return;
+                }
+                const n = cmd.n ?? 1;
+                const mode = cmd.mode;
+                if (cmd.n === undefined && !mode) {
+                    const rows = infos.slice(0, 10).map((c) => {
+                        const age = c.ts > 0 ? ` (${Math.max(1, Math.round((Date.now() - c.ts) / 60000))}m ago)` : '';
+                        return `  ${c.index}. ${c.id.slice(0, 12)} · ${c.files} file(s)${age}`;
+                    });
+                    queuedAppend({ id: `rewind-${Date.now()}`, kind: 'text', text: `Checkpoints (1 = latest):\n${rows.join('\n')}\nrun /rewind <n> to restore, /rewind <n> preview to dry-run, /rewind <n> summary for a revert report, /rewind <n> full to also rewind the conversation`, role: 'assistant' });
+                    return;
+                }
+                if (n < 1 || n > infos.length) {
+                    queuedAppend({ id: `rewind-err-${Date.now()}`, kind: 'error', message: `rewind failed: only ${infos.length} checkpoint(s), got n=${n}` });
+                    return;
+                }
+                const target = infos[n - 1];
+                if (mode === 'preview') {
+                    // Dry run: list what WOULD be restored + current dirty state.
+                    const files = await snapshotFiles(cwd, target.id);
+                    let dirty = '';
+                    try {
+                        const { execFileSync } = await import('node:child_process');
+                        dirty = execFileSync('git', ['status', '--porcelain'], { cwd, encoding: 'utf-8', timeout: 5000 });
+                    }
+                    catch {
+                        dirty = '';
+                    }
+                    const listed = files.slice(0, 20).map((f) => `  ${f}`).join('\n') || '  (no files recorded)';
+                    const dirtyLines = dirty.split('\n').map((l) => l.trim()).filter(Boolean).slice(0, 10);
+                    queuedAppend({
+                        id: `rewind-${Date.now()}`,
+                        kind: 'text',
+                        text: `Preview: /rewind ${n} would restore checkpoint ${target.id.slice(0, 12)}:\n${listed}${files.length > 20 ? `\n  … +${files.length - 20} more` : ''}${dirtyLines.length > 0 ? `\nCurrent dirty files that would be overwritten:\n${dirtyLines.map((f) => `  ${f}`).join('\n')}` : '\nWorking tree is clean.'}\nRun /rewind ${n} to apply.`,
+                        role: 'assistant',
+                    });
+                    return;
+                }
                 try {
-                    const { rewind } = await import('../checkpoints/store.js');
-                    await rewind(cwd);
-                    queuedAppend({ id: `rewind-${Date.now()}`, kind: 'text', text: 'Rewound to last checkpoint', role: 'assistant' });
+                    // Capture the pre-restore dirty state so `summary` can report it.
+                    let before = '';
+                    if (mode === 'summary' || mode === 'full') {
+                        try {
+                            const { execFileSync } = await import('node:child_process');
+                            before = execFileSync('git', ['status', '--porcelain'], { cwd, encoding: 'utf-8', timeout: 5000 });
+                        }
+                        catch {
+                            before = '';
+                        }
+                    }
+                    await undo(cwd, n);
+                    let text = `Rewound to checkpoint ${n} (${target.id.slice(0, 12)}, ${target.files} file(s))`;
+                    if (mode === 'summary' || mode === 'full') {
+                        const files = before.split('\n').map((l) => l.trim()).filter(Boolean).slice(0, 20);
+                        text += files.length > 0 ? `\nReverted working-tree changes:\n${files.map((f) => `  ${f}`).join('\n')}` : '\nWorking tree was clean before restore.';
+                    }
+                    if (mode === 'full') {
+                        // Conversation rewind: drop persisted messages/observations at
+                        // or after the snapshot, so resume continues from that point.
+                        if (tuiSessionId) {
+                            try {
+                                const removed = await tuiStore.truncateMessages(tuiSessionId, target.ts > 0 ? target.ts : Date.now());
+                                text += `\nConversation rewound: dropped ${removed.messages} message(s), ${removed.observations} observation(s).`;
+                            }
+                            catch (err) {
+                                text += `\nConversation rewind failed (code restored): ${err instanceof Error ? err.message : String(err)}`;
+                            }
+                        }
+                        else {
+                            text += '\nNo active session — code restored, conversation untouched.';
+                        }
+                    }
+                    queuedAppend({ id: `rewind-${Date.now()}`, kind: 'text', text, role: 'assistant' });
                 }
                 catch (err) {
                     const msg = err instanceof Error ? err.message : String(err);
@@ -1172,6 +1275,27 @@ export async function startRepl(opts = {}) {
                 }
                 return;
             }
+            case 'checkpoints': {
+                try {
+                    const { listCheckpointInfo } = await import('../checkpoints/store.js');
+                    const infos = await listCheckpointInfo(cwd);
+                    if (infos.length === 0) {
+                        queuedAppend({ id: `ckpt-${Date.now()}`, kind: 'text', text: 'No checkpoints yet.', role: 'assistant' });
+                    }
+                    else {
+                        const rows = infos.slice(0, 15).map((c) => {
+                            const age = c.ts > 0 ? ` (${Math.max(1, Math.round((Date.now() - c.ts) / 60000))}m ago)` : '';
+                            return `  ${c.index}. ${c.id.slice(0, 12)} · ${c.files} file(s)${age}`;
+                        });
+                        queuedAppend({ id: `ckpt-${Date.now()}`, kind: 'text', text: `Checkpoints (1 = latest):\n${rows.join('\n')}`, role: 'assistant' });
+                    }
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    queuedAppend({ id: `ckpt-err-${Date.now()}`, kind: 'error', message: `checkpoints failed: ${msg}` });
+                }
+                return;
+            }
             case 'verify': {
                 const { detectVerifiers, primaryVerifyCommand } = await import('../verification/registry.js');
                 const { verify } = await import('../verification/engine.js');
@@ -1339,26 +1463,18 @@ export async function startRepl(opts = {}) {
                 return;
             }
             case 'init': {
-                const { writeFileSync, existsSync } = await import('node:fs');
-                const { join } = await import('node:path');
-                const target = join(cwd, 'KLYRO.md');
-                if (existsSync(target)) {
-                    queuedAppend({ id: `init-${Date.now()}`, kind: 'text', text: `KLYRO.md already exists at ${target}`, role: 'assistant' });
+                try {
+                    const { initProject, nextStepsText } = await import('./init.js');
+                    const { created, skipped } = await initProject(cwd);
+                    const lines = [
+                        ...created.map((f) => `created ${f}`),
+                        ...skipped.map((f) => `kept ${f}`),
+                        nextStepsText(),
+                    ];
+                    queuedAppend({ id: `init-${Date.now()}`, kind: 'text', text: lines.join('\n'), role: 'assistant' });
                 }
-                else {
-                    try {
-                        const { runScan } = await import('./scan.js');
-                        let out = '';
-                        const orig = process.stdout.write.bind(process.stdout);
-                        process.stdout.write = ((c) => { out += String(c); return true; });
-                        await runScan({ cwd, json: false });
-                        process.stdout.write = orig;
-                        writeFileSync(target, `# KLYRO.md\n\nProject: ${cwd}\n\n## Stack\n\n${out.slice(0, 2000)}\n\n## Conventions\n\n- Prefer smallest change that solves the task.\n- Run verification after edits.\n`);
-                        queuedAppend({ id: `init2-${Date.now()}`, kind: 'text', text: `created ${target}`, role: 'assistant' });
-                    }
-                    catch (err) {
-                        queuedAppend({ id: `init-err-${Date.now()}`, kind: 'error', message: `init failed: ${err instanceof Error ? err.message : String(err)}` });
-                    }
+                catch (err) {
+                    queuedAppend({ id: `init-err-${Date.now()}`, kind: 'error', message: `init failed: ${err instanceof Error ? err.message : String(err)}` });
                 }
                 return;
             }
@@ -1633,12 +1749,12 @@ export async function startRepl(opts = {}) {
                 return;
             }
             case 'auth': {
-                const { getStoredKey } = await import('./auth.js');
-                const rows = ['openai', 'anthropic'].map((p) => {
-                    const hasFile = !!getStoredKey(p);
+                const { getStoredKeyAsync } = await import('./auth.js');
+                const rows = await Promise.all(['openai', 'anthropic'].map(async (p) => {
+                    const hasKeychain = !!(await getStoredKeyAsync(p));
                     const hasEnv = !!(p === 'openai' ? process.env.OPENAI_API_KEY : process.env.ANTHROPIC_API_KEY) || !!process.env.KLYRO_API_KEY;
-                    return `  ${p}: ${hasFile ? 'stored key (0600)' : hasEnv ? 'env key' : '—'}`;
-                });
+                    return `  ${p}: ${hasKeychain ? 'stored key (keychain/file)' : hasEnv ? 'env key' : '—'}`;
+                }));
                 queuedAppend({ id: `auth-${Date.now()}`, kind: 'text', text: `Auth:\n${rows.join('\n')}\ncurrent provider: ${currentProvider}\nmanage via /login /logout`, role: 'assistant' });
                 return;
             }
@@ -2573,7 +2689,7 @@ export async function startRepl(opts = {}) {
                 catch { /* persist best-effort */ }
                 if (isMounted && directHooks)
                     directHooks.setVimMode(next);
-                queuedAppend({ id: `vim-${Date.now()}`, kind: 'text', text: `vim mode: ${next}${next === 'normal' ? ' (h/l move · i/a insert · x delete · 0/$ ends · j/k scroll)' : ''}`, role: 'assistant' });
+                queuedAppend({ id: `vim-${Date.now()}`, kind: 'text', text: `vim mode: ${next}${next === 'normal' ? ' (h/l/0/$ move · 3h counts · w/b words · x/D/dd delete · i/a insert · j/k scroll)' : ''}`, role: 'assistant' });
                 return;
             }
             case 'theme':
@@ -2817,6 +2933,48 @@ export async function startRepl(opts = {}) {
                     await handleSlash(parse(target + extra));
                     return;
                 }
+                // Custom command files: .klyro/commands/*.md (project wins).
+                // Body expands $1..$9/$@ and runs as a prompt (recursion-guarded).
+                if (m) {
+                    const { loadCustomCommands, expandArgs } = await import('./slash/custom.js');
+                    const custom = loadCustomCommands(cwd).find((c) => c.name === m[1].toLowerCase());
+                    if (custom) {
+                        const depth = (customDepthRef.current ?? 0) + 1;
+                        if (depth > 3) {
+                            queuedAppend({ id: `cust-${Date.now()}`, kind: 'error', message: `custom command recursion limit: /${custom.name}` });
+                            return;
+                        }
+                        const argList = m[2] ? m[2].split(/\s+/) : [];
+                        const expanded = expandArgs(custom.body, argList);
+                        customDepthRef.current = depth;
+                        try {
+                            if (expanded.trimStart().startsWith('/'))
+                                await handleSlash(parse(expanded));
+                            else
+                                await runWithBridge(expanded);
+                        }
+                        finally {
+                            customDepthRef.current = depth - 1;
+                        }
+                        return;
+                    }
+                }
+                // MCP prompt-commands: /mcp__<server>__<prompt> [args...]
+                if (m) {
+                    const pm = /^mcp__([A-Za-z0-9_-]{1,20})__([A-Za-z0-9_-]+)$/.exec(m[1].toLowerCase());
+                    if (pm) {
+                        const { runMcpPrompt } = await import('../mcp/registry.js');
+                        const tokens = m[2] ? m[2].split(/\s+/).filter(Boolean) : [];
+                        try {
+                            const text = await runMcpPrompt(cwd, pm[1], pm[2], tokens);
+                            await runWithBridge(text);
+                        }
+                        catch (err) {
+                            queuedAppend({ id: `mcp-p-${Date.now()}`, kind: 'error', message: `mcp prompt failed: ${err instanceof Error ? err.message : String(err)}` });
+                        }
+                        return;
+                    }
+                }
                 queuedAppend({
                     id: `unk-${Date.now()}`,
                     kind: 'error',

package/dist/cli/run.d.ts

@@ -66,6 +66,12 @@ export interface RunCliOptions {
     persist?: boolean;
     sessionId?: string;
     sessionsDir?: string;
+    /**
+     * Bare mode (`--bare`): skip MCP servers, all hooks, memory/KLYRO.md/L6
+     * context, and session persistence for fast deterministic runs. The model
+     * gets the base system prompt + tools only.
+     */
+    bare?: boolean;
     /** P1.4 — run the task under a named child-capable orchestrator context. */
     agent?: string;
     maxDepth?: number;
@@ -78,5 +84,5 @@ export interface RunCliOptions {
 export declare function shouldForceExit(lastSigintAt: number | undefined, now: number): boolean;
 export declare function runOnce(opts: RunCliOptions): Promise<number>;
 /** Wrap a system-prompt fn to inject Level-6 context (project map etc.) + KLYRO.md (4.4). */
-export declare function makeRunSystemPrompt(cwd: string, base: SystemPromptFn): Promise<SystemPromptFn>;
+export declare function makeRunSystemPrompt(cwd: string, base: SystemPromptFn, bare?: boolean): Promise<SystemPromptFn>;
 export declare function loadTranscript(path: string): Message[];