klyro 1.0.6 → 1.0.7

package/dist/providers.js

@@ -85,7 +85,7 @@ export async function resolveProvider() {
     }
     // Persisted config — the "set once, works in every terminal" layer.
     {
-        const { getStoredKey } = await import('./cli/auth.js');
+        const { getStoredKeyAsync } = await import('./cli/auth.js');
         if (cfgBase) {
             try {
                 assertSafeBaseURL(cfgBase, { allowInsecure });
@@ -96,7 +96,7 @@ export async function resolveProvider() {
                 return null;
             }
             {
-                const key = envKey ?? cfgKey ?? getStoredKey(cfgProvider ?? 'openai') ?? getStoredKey('openai') ?? getStoredKey('anthropic') ?? '';
+                const key = envKey ?? cfgKey ?? (await getStoredKeyAsync(cfgProvider ?? 'openai')) ?? (await getStoredKeyAsync('openai')) ?? (await getStoredKeyAsync('anthropic')) ?? '';
                 return {
                     baseURL: normalizeBaseURL(cfgBase),
                     apiKey: key,
@@ -114,8 +114,8 @@ export async function resolveProvider() {
             };
         }
         // Stored keys alone (e.g. `klyro login` with defaults, or key-only setup).
-        const anthropicKey = getStoredKey('anthropic');
-        const openaiKey = getStoredKey('openai');
+        const anthropicKey = await getStoredKeyAsync('anthropic');
+        const openaiKey = await getStoredKeyAsync('openai');
         if (cfgProvider === 'anthropic' && anthropicKey) {
             return {
                 baseURL: normalizeBaseURL('https://api.anthropic.com/v1'),

package/dist/tools/shell/shell-exec.d.ts

@@ -17,6 +17,19 @@ declare const InputSchema: z.ZodObject<{
 }, z.core.$strip>;
 /** Reset the sticky cwd (e.g. after /cd changes the session directory). */
 export declare function resetPersistentCwd(): void;
+/** Bounds for the tool-output dir (G5d) — oldest-first LRU prune. */
+export declare const TOOL_OUTPUT_MAX_FILES = 50;
+export declare const TOOL_OUTPUT_MAX_BYTES: number;
+/**
+ * Prune a directory: delete oldest files until both the file-count and
+ * total-bytes bounds hold. Pure helper (exported for unit tests).
+ */
+export declare function pruneDir(dir: string, maxFiles: number, maxBytes: number): Promise<string[]>;
+/**
+ * Prune `~/.klyro/tool-output/` (≤50 files, ≤50MB). Best-effort — never
+ * throws, failures just leave the dir unpruned until the next write.
+ */
+export declare function pruneToolOutput(): Promise<void>;
 export declare function filteredEnv(extra?: Record<string, string>): NodeJS.ProcessEnv;
 /**
  * Protected-branch push helpers (mirror policy engine shellDenyRule).

package/dist/tools/shell/shell-exec.js

@@ -41,14 +41,68 @@ let persistentCwd = null;
 export function resetPersistentCwd() {
     persistentCwd = null;
 }
+/** Bounds for the tool-output dir (G5d) — oldest-first LRU prune. */
+export const TOOL_OUTPUT_MAX_FILES = 50;
+export const TOOL_OUTPUT_MAX_BYTES = 50 * 1024 * 1024;
+/**
+ * Prune a directory: delete oldest files until both the file-count and
+ * total-bytes bounds hold. Pure helper (exported for unit tests).
+ */
+export async function pruneDir(dir, maxFiles, maxBytes) {
+    const fs = await import('node:fs/promises');
+    const path = await import('node:path');
+    const entries = await fs.readdir(dir, { withFileTypes: true });
+    const files = [];
+    for (const e of entries) {
+        if (!e.isFile())
+            continue;
+        try {
+            const st = await fs.stat(path.join(dir, e.name));
+            files.push({ file: path.join(dir, e.name), mtimeMs: st.mtimeMs, size: st.size });
+        }
+        catch { /* raced deletion */ }
+    }
+    // Oldest first.
+    files.sort((a, b) => a.mtimeMs - b.mtimeMs);
+    const deleted = [];
+    while (files.length > maxFiles)
+        deleted.push(files.shift().file);
+    let total = files.reduce((s, f) => s + f.size, 0);
+    while (total > maxBytes && files.length > 0) {
+        const f = files.shift();
+        total -= f.size;
+        deleted.push(f.file);
+    }
+    await Promise.all(deleted.map((f) => fs.rm(f, { force: true }).catch(() => undefined)));
+    return deleted;
+}
+/**
+ * Prune `~/.klyro/tool-output/` (≤50 files, ≤50MB). Best-effort — never
+ * throws, failures just leave the dir unpruned until the next write.
+ */
+export async function pruneToolOutput() {
+    try {
+        await pruneDir(FULL_OUTPUT_DIR, TOOL_OUTPUT_MAX_FILES, TOOL_OUTPUT_MAX_BYTES);
+    }
+    catch {
+        /* dir missing or unreadable — nothing to prune */
+    }
+}
 // Filtered env — only safe vars, secrets stripped
 const ALLOWED_ENV_PREFIXES = ['PATH', 'HOME', 'USER', 'SHELL', 'TERM', 'LANG', 'NODE_', 'NPM_', 'PNPM_', 'YARN_'];
+/**
+ * Secret-name test: SECRET/TOKEN/KEY anywhere in the name. KEY covers
+ * allowed-prefix vars such as NODE_*_API_KEY / NPM_*_KEY that the prefix
+ * allowlist would otherwise admit. Case-insensitive to catch mixed-case
+ * exporters (e.g. npm_config_key). Mirrors verification/registry.ts.
+ */
+const SECRET_NAME_RE = /SECRET|TOKEN|KEY/i;
 export function filteredEnv(extra) {
     const out = {};
     for (const [k, v] of Object.entries(process.env)) {
         if (k.startsWith('KLYRO_') && k.includes('API_KEY'))
             continue;
-        if (k.includes('SECRET') || k.includes('TOKEN') || k === 'ANTHROPIC_API_KEY' || k === 'OPENAI_API_KEY')
+        if (SECRET_NAME_RE.test(k) || k === 'ANTHROPIC_API_KEY' || k === 'OPENAI_API_KEY')
             continue;
         if (ALLOWED_ENV_PREFIXES.some((p) => k.startsWith(p)) || k === 'PWD' || k === 'TMPDIR' || k === 'TEMP') {
             out[k] = v;
@@ -59,7 +113,7 @@ export function filteredEnv(extra) {
         for (const [k, v] of Object.entries(extra)) {
             if (k === 'NODE_OPTIONS' || k === 'LD_PRELOAD' || k === 'LD_LIBRARY_PATH')
                 continue;
-            if (k.includes('SECRET') || k.includes('TOKEN') || k === 'ANTHROPIC_API_KEY' || k === 'OPENAI_API_KEY')
+            if (SECRET_NAME_RE.test(k) || k === 'ANTHROPIC_API_KEY' || k === 'OPENAI_API_KEY')
                 continue;
             if (ALLOWED_ENV_PREFIXES.some((p) => k.startsWith(p)) || k === 'PATH' || k === 'PWD' || k === 'TMPDIR' || k === 'TEMP') {
                 out[k] = v;
@@ -131,6 +185,12 @@ const DANGEROUS_PATTERNS = [
     { pattern: /\bwget\b.*(?:\s--method=POST\b|\s--body-data\b)/i, reason: 'exfiltration: wget --method=POST/--body-data denied' },
     { pattern: /\bInvoke-RestMethod\b/i, reason: 'exfiltration: Invoke-RestMethod denied' },
     { pattern: /\bStart-BitsTransfer\b/i, reason: 'exfiltration: Start-BitsTransfer denied' },
+    // Windows has no native sandbox backend, so PowerShell network primitives
+    // are the primary upload/exfil vectors there — denied outright (partial
+    // mitigation; genuinely honest limits are documented in the audit, the real
+    // boundary is the bwrap/landlock sandbox on POSIX).
+    { pattern: /\b(Invoke-WebRequest|iwr)\b/i, reason: 'exfiltration: Invoke-WebRequest/iwr denied (no win32 sandbox backend)' },
+    { pattern: /\bSystem\.Net\.WebClient\b/i, reason: 'exfiltration: System.Net.WebClient denied (no win32 sandbox backend)' },
     // Protected-branch push deny (mirrors policy engine shellDenyRule).
     // Explicit `git push ... main|master|production`. Honored only when
     // KLYRO_ALLOW_MAIN_PUSH=1 is NOT set (see findBlockedReason). Bare
@@ -426,6 +486,8 @@ export const shellExecTool = defineTool({
                 const fullPath = path.join(FULL_OUTPUT_DIR, `${outId}.txt`);
                 const fullContent = `STDOUT:\n${fullOutBuf.toString('utf-8')}\n\nSTDERR:\n${fullErrBuf.toString('utf-8')}\n`;
                 await fs.writeFile(fullPath, fullContent, 'utf-8');
+                // G5d: bound the tool-output dir (~50 files / 50MB LRU). Best-effort.
+                await pruneToolOutput();
             }
             catch { /* ignore */ }
             // Head+tail truncation: keep first 15k and last 15k chars

package/dist/tui/app.js

@@ -10,6 +10,7 @@ import { execFileSync } from 'node:child_process';
 import { TuiApprovalBridge, ApprovalModal } from './approval.js';
 import { parse as parseSlash, suggestCommands } from '../cli/slash/parser.js';
 import { loadCustomCommands, listCompletableFiles } from '../cli/slash/custom.js';
+import { loadMcpServers } from '../mcp/config.js';
 import { tokens, g } from './tokens.js';
 import { initialScroll, scrollReducer, resolveTopRow, maxTopFor, badgeLabel, } from './scroll-model.js';
 import { buildIndex, itemAtRow, MeasureCache } from './measure.js';
@@ -129,7 +130,7 @@ function MarkdownText({ text, dim, width }) {
                     else if (p.color)
                         color = p.color;
                     else if (p.href)
-                        color = 'blue';
+                        color = tokens.colors.info;
                     else if (p.dim)
                         color = dimColor;
                     else if (p.code)
@@ -395,12 +396,16 @@ export function App(props) {
         }
     }, []);
     // Flush pending tail before unmount so no trailing delta is lost.
+    // (React may drop post-unmount setStates; the turn-end effect above is
+    // the primary guarantee — this covers paths that unmount mid-stream.)
     useEffect(() => () => {
+        flushStream();
+        flushThinking();
         if (streamTimer.current)
             clearTimeout(streamTimer.current);
         if (thinkingTimer.current)
             clearTimeout(thinkingTimer.current);
-    }, []);
+    }, [flushStream, flushThinking]);
     const width = stdout?.columns ?? 100;
     const height = stdout?.rows ?? 30;
     const isFullscreen = props.isFullscreen ?? false;
@@ -696,8 +701,21 @@ export function App(props) {
             return [];
         }
     }, [props.cwd]);
+    // MCP prompt stems: `/mcp__<server>__` completes server names so prompt
+    // commands are discoverable; full prompt names need a live connection
+    // (see `klyro mcp prompts`), so the stem carries that hint.
+    const mcpStems = useMemo(() => {
+        if (!input.startsWith('/mcp__'))
+            return [];
+        try {
+            return Object.keys(loadMcpServers(props.cwd).servers).map((s) => ({ name: `mcp__${s}__`, hint: 'mcp server — run `mcp prompts <server>` for names' }));
+        }
+        catch {
+            return [];
+        }
+    }, [props.cwd, input]);
     const slashSuggest = input.startsWith('/') && !input.slice(1).includes(' ') && !awaitingApproval
-        ? suggestCommands(input, 6, customCmds)
+        ? suggestCommands(input, 6, [...customCmds, ...mcpStems])
         : [];
     // `@` file completion — fuzzy over the workspace file index while typing
     // a mention token (no space yet). Directories carry trailing `/`.
@@ -709,7 +727,11 @@ export function App(props) {
             return [];
         }
     }, [props.cwd]);
-    const atToken = /^@(\S*)$/.exec(input);
+    // @-completion now matches a mention at ANY position (mid-line included),
+    // not just a whole-input `^@token`. Complete-at-cursor semantics: the token
+    // ends at the end of input (Tab-completion surface). `foo bar @ut` completes
+    // just like a bare `@ut` did.
+    const atToken = /(?:^|\s)@(\S*)$/.exec(input);
     const pathSuggest = atToken && !awaitingApproval
         ? suggestCommands(`/${atToken[1] ?? ''}`, 6, fileIndex.map((f) => ({ name: f, hint: 'file' }))).map((d) => ({ ...d, name: `@${d.name}` }))
         : [];
@@ -728,7 +750,15 @@ export function App(props) {
         }
         if ((key.tab || inputStr === '\t') && pathSuggest.length > 0) {
             const top = pathSuggest[0];
-            setInput(`${top.name} `);
+            // Mid-line @: splice the completed filename into the mention token,
+            // preserving the message prefix (`look at @ut` → `look at @util.ts`).
+            const m = /(?:^|\s)@(\S*)$/.exec(input);
+            if (m && m[1] !== undefined) {
+                setInput(input.slice(0, input.length - m[1].length) + top.name.slice(1) + ' ');
+            }
+            else {
+                setInput(`${top.name} `);
+            }
             setVimCursor(null);
             return;
         }

package/dist/tui/app.test.js

@@ -603,8 +603,9 @@ describe('App', () => {
         stdin.write(KEY_HOME);
         await waitForMatch(lastFrame, /⇅ 0\/\d+/);
         hooks.append({ id: 'late-1', kind: 'text', text: 'LATE-1-tag', role: 'assistant' });
-        // Badge counts lines grown while pinned.
-        await waitForMatch(lastFrame, /↓ \d+ unread/);
+        // Badge counts lines grown while pinned (idle shows "jump to end" affordance).
+        await waitForMatch(lastFrame, /↓ \d+/);
+        expect(lastFrame() ?? '').toContain('· jump to end');
         hooks.clearTranscript();
         // Wait for transcript content to actually clear (no stale MSG-* items) —
         // this is the "no stale badge" invariant: after a clear, the view must

package/dist/tui/approval.js

@@ -22,6 +22,7 @@ import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
 import { useEffect, useState } from 'react';
 import { Box, Text, useInput } from 'ink';
 import { approvalChoiceForKey, sanitizeForPrompt } from '../policy/approval.js';
+import { tokens } from './tokens.js';
 class TuiApprovalBridge {
     pending = null;
     // Fan-out set: BOTH the App (awaitingApproval gate) and the ApprovalModal
@@ -159,5 +160,6 @@ export function ApprovalModal({ bridge }) {
         const clean = sanitizeForPrompt(s);
         return !full && clean.length > n ? clean.slice(0, n) + '…' : clean;
     };
-    return (_jsxs(Box, { flexDirection: "column", borderStyle: "double", borderColor: "yellow", paddingX: 1, marginY: 1, children: [_jsxs(Text, { color: "yellow", bold: true, children: ["\u26A0 approval needed \u2014 ", pending.toolName] }), _jsxs(Text, { color: "gray", children: ["  reason: \"", trunc(pending.reason), "\""] }), pending.summary ? _jsxs(Text, { children: ["  \"", trunc(pending.summary), "\""] }) : null, editing !== null ? (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsx(Text, { color: "yellow", bold: true, children: "  editing input JSON (Enter = submit, Esc = back):" }), _jsxs(Text, { wrap: "wrap", children: ["  ", (editing.length > 1500 ? editing.slice(0, 1500) + '…' : editing) + '▌'] }), editError ? _jsxs(Text, { color: "red", children: ["  ", editError] }) : null] })) : null, explain ? _jsxs(Text, { color: "cyan", children: ["  Explain: This tool will ", pending.toolName, " with the shown args. [y] once, [a] session, [A] always\u2192settings, [n] deny, [e] edit, [f] full text, [?] toggle help."] }) : null, _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: "green", children: "[y] once" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "green", children: "[a] session" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "green", children: "[A] always" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "red", children: "[n] deny" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "yellow", children: "[e] edit" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "cyan", children: "[f] full" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "cyan", children: "[?] explain" }), _jsx(Text, { color: "gray", children: "  (Enter = deny)" })] })] }));
+    const c = tokens.colors;
+    return (_jsxs(Box, { flexDirection: "column", borderStyle: "double", borderColor: c.warn, paddingX: 1, marginY: 1, children: [_jsxs(Text, { color: c.warn, bold: true, children: ["\u26A0 approval needed \u2014 ", pending.toolName] }), _jsxs(Text, { color: c.dim, children: ["  reason: \"", trunc(pending.reason), "\""] }), pending.summary ? _jsxs(Text, { children: ["  \"", trunc(pending.summary), "\""] }) : null, editing !== null ? (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsx(Text, { color: c.warn, bold: true, children: "  editing input JSON (Enter = submit, Esc = back):" }), _jsxs(Text, { wrap: "wrap", children: ["  ", (editing.length > 1500 ? editing.slice(0, 1500) + '…' : editing) + '▌'] }), editError ? _jsxs(Text, { color: c.err, children: ["  ", editError] }) : null] })) : null, explain ? _jsxs(Text, { color: c.info, children: ["  Explain: This tool will ", pending.toolName, " with the shown args. [y] once, [a] session, [A] always\u2192settings, [n] deny, [e] edit, [f] full text, [?] toggle help."] }) : null, _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: c.ok, children: "[y] once" }), _jsx(Text, { color: c.dim, children: "  " }), _jsx(Text, { color: c.ok, children: "[a] session" }), _jsx(Text, { color: c.dim, children: "  " }), _jsx(Text, { color: c.ok, children: "[A] always" }), _jsx(Text, { color: c.dim, children: "  " }), _jsx(Text, { color: c.err, children: "[n] deny" }), _jsx(Text, { color: c.dim, children: "  " }), _jsx(Text, { color: c.warn, children: "[e] edit" }), _jsx(Text, { color: c.dim, children: "  " }), _jsx(Text, { color: c.info, children: "[f] full" }), _jsx(Text, { color: c.dim, children: "  " }), _jsx(Text, { color: c.info, children: "[?] explain" }), _jsx(Text, { color: c.dim, children: "  (Enter = deny)" })] })] }));
 }

package/dist/tui/scroll-model.d.ts

@@ -64,6 +64,6 @@ export interface Resolved {
 /** Anchor → topRow, run once per frame after the line index rebuild (§5.3). */
 export declare function resolveTopRow(s: ScrollState, ctx: ScrollCtx): Resolved;
 /** Badge label per §7.2 (Claude Code style: "N unread" / "jump to end").
- *  Empty string = hidden. `idle` = agent done streaming, the only new lines
- *  are the ones already counted — the affordance flips to "jump to end". */
+ *  Empty string = hidden. `idle` = agent done streaming; when idle the badge
+ *  flips to the actionable "jump to end" affordance instead of a raw count. */
 export declare function badgeLabel(atBottom: boolean, newSinceUnstick: number, idle: boolean): string;

package/dist/tui/scroll-model.js

@@ -88,12 +88,18 @@ export function resolveTopRow(s, ctx) {
     return { topRow, atBottom: topRow >= maxTop - FOLLOW_EPSILON };
 }
 /** Badge label per §7.2 (Claude Code style: "N unread" / "jump to end").
- *  Empty string = hidden. `idle` = agent done streaming, the only new lines
- *  are the ones already counted — the affordance flips to "jump to end". */
+ *  Empty string = hidden. `idle` = agent done streaming; when idle the badge
+ *  flips to the actionable "jump to end" affordance instead of a raw count. */
 export function badgeLabel(atBottom, newSinceUnstick, idle) {
     if (atBottom || newSinceUnstick <= 0)
         return '';
-    void idle; // Ink can't capture the idle click; count is shown either way (§7.2)
+    // When the agent is idle (no more lines arriving), show the actionable
+    // affordance; otherwise keep the live unread count.
+    if (idle) {
+        if (newSinceUnstick >= 1000)
+            return '↓ 999+ · jump to end';
+        return `↓ ${newSinceUnstick} · jump to end`;
+    }
     if (newSinceUnstick >= 1000)
         return '↓ 999+ unread';
     return `↓ ${newSinceUnstick} unread`;

package/dist/tui/tokens.d.ts

@@ -8,16 +8,16 @@ export declare const tokens: {
         readonly bgElevated: "#FAF7F2";
         readonly fg: "#1A1A1A";
         readonly soft: "#F5F5F5";
-        readonly dim: "#9A9A9A";
+        readonly dim: "#6B6B6B";
         readonly guide: "#3A3A3A";
         readonly accent: "#FF6B1A";
         readonly accentSoft: "#FFF1E6";
-        readonly ok: "#2FA36B";
-        readonly err: "#E06C6C";
-        readonly warn: "#D9A021";
-        readonly info: "#6FA8DC";
-        readonly diffAddBg: "#12250F";
-        readonly diffDelBg: "#2A1212";
+        readonly ok: "#1B7A4D";
+        readonly err: "#B3261E";
+        readonly warn: "#8A5A00";
+        readonly info: "#1F6FB2";
+        readonly diffAddBg: "#DFF5DF";
+        readonly diffDelBg: "#F9DEDC";
     };
     readonly ansi: {
         readonly accent: "yellowBright";
@@ -89,7 +89,4 @@ export declare const glyphAscii: {
 };
 export declare function isAsciiMode(): boolean;
 export declare function g(name: keyof typeof glyphs): string;
-export declare const spacing: {
-    readonly sidebar: 28;
-    readonly inspector: 36;
-};
+export declare const spacing: {};

package/dist/tui/tokens.js

@@ -8,19 +8,22 @@ export const tokens = {
         bgElevated: '#FAF7F2',
         fg: '#1A1A1A',
         soft: '#F5F5F5',
-        dim: '#9A9A9A',
+        // dim/guide raised for WCAG AA on white: #6B6B6B ≈ 4.86:1 (was #9A9A9A ≈
+        // 2.9:1). guide stays the muted row glyph and is kept readable.
+        dim: '#6B6B6B',
         guide: '#3A3A3A',
         accent: '#FF6B1A',
         accentSoft: '#FFF1E6',
-        // Status hues are deliberately distinct from the orange brand: ok reads
-        // green, warn reads amber, err reads red. (Previously ok/warn reused the
-        // accent hex and were indistinguishable in the transcript.)
-        ok: '#2FA36B',
-        err: '#E06C6C',
-        warn: '#D9A021',
-        info: '#6FA8DC',
-        diffAddBg: '#12250F',
-        diffDelBg: '#2A1212',
+        // Status hues deliberately distinct from the orange brand. These are
+        // darkened for AA 4.5:1 on white (they were ~2.4-3:1).
+        ok: '#1B7A4D',
+        err: '#B3261E',
+        warn: '#8A5A00',
+        info: '#1F6FB2',
+        // Diff rollover backgrounds are LIGHT-mode hexes (the TUI bg is white);
+        // the dark hexes here were legacy dark-theme leftovers.
+        diffAddBg: '#DFF5DF',
+        diffDelBg: '#F9DEDC',
     },
     ansi: {
         accent: 'yellowBright',
@@ -98,4 +101,8 @@ export function g(name) {
         return glyphAscii[name] ?? glyphs[name];
     return glyphs[name];
 }
-export const spacing = { sidebar: 28, inspector: 36 };
+// Sidebar/inspector pixel widths live in the TUI_DESIGN doc, not here —
+// the old `spacing = {sidebar: 28, inspector: 36}` held dead numbers (the
+// sidebar layout is unused in the render). Keep a placeholder so old imports
+// don't break, but route new code to the doc.
+export const spacing = {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "klyro",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "description": "Klyro — autonomous coding harness CLI that streams from any OpenAI-compatible or Anthropic LLM endpoint.",
   "type": "module",
   "main": "dist/index.js",