kward 0.80.0 → 0.81.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e9128f608c2a864ad996598d285d4042758ea1bc1b3a76a1224984ef23129544
-  data.tar.gz: c9d718290398f95e1420e5e12225e43aaba6bf6c64c868fb6d175d5725aaf19d
+  metadata.gz: d2033aa9b07468c6668842a3b0ba51ef73cb0c1c58db95927c1159668129e345
+  data.tar.gz: 0f7c86a02ccf5e76f01adf3a8d654b3bd559ef27c93f6479dfd6724401427435
 SHA512:
-  metadata.gz: 6b0e53fddfa2de055b11b6bbe0965496e2abc860162ed0888642bb353ae64e0e0fdbfbe14ed7412198c8c60583c1d55fd6d9cd7fec7a43eb37db456a494f5a1a
-  data.tar.gz: 2396aceedf67453422924616d92031160d3eee67ae448347d2f367a05d48a97d9ae39789b2100c3c47bdbc5925c85e4922146a50c72ee662d863f8ad597dacbd
+  metadata.gz: 934c63dbcde19c9eba5dbdfb843a5cbb82a873d73371746d3db19c5698c27aa53ecef3820bb7099a928e077f05d04178190e4ddafef3ff8ed9e82aa7233c2d75
+  data.tar.gz: 05ac5a0a3a695f9b49c56059915e642511c85f0dcaa68e406f0b470763b589497a92950416a0f7eddb2a69b304c9b7f6bcef3bcbea49cedd8032b06871c3cfba

data/CHANGELOG.md

@@ -2,6 +2,46 @@
 
 All notable changes to Kward will be documented in this file.
 
+## [Unreleased]
+
+## [0.81.0] - 2026-08-20
+
+### Added
+
+- Added `capture <command>` inside `/shell` and `/capture <command>` in the normal composer for bounded, sanitized, transcript-friendly command execution.
+- Added Tab completion for shell commands and paths when the normal interactive prompt input begins with `!`.
+- Added workspace-scoped, digest-aware project skill trust decisions with interactive Allow, Deny, and Review prompts plus `/skills` and `kward skills` management commands.
+
+### Changed
+
+- Displayed packaged plugins with their folder name in the startup plugin list, such as `folder/plugin.rb`.
+- Added a frozen composer display for line-oriented Git PTY commands while preserving the full-terminal handoff for full-screen programs.
+- Changed external `/shell` commands and one-shot `!command` input to use interactive PTY terminal handoff by default, while retaining `pty` and `/pty` for compatibility.
+- Made aliases configured in `ekwsh.yml` available to leading-`!` execution and command completion.
+- Removed interactive PTY start and exit-status messages while retaining the submitted command echo.
+- Changed shell and leading-`!` completion so the candidate list appears in an interactive overlay while repeated Tab presses cycle through candidates in the composer.
+- Removed the `Tab` and `Shift+Tab` reasoning-effort shortcuts so the composer keeps its normal completion behavior.
+
+### Fixed
+
+- Refreshed composer status immediately after reasoning selection and interactive PTY commands, so reasoning levels and Git branch state no longer remain stale until the next input.
+- Prevented composer flicker during interactive prompt, bang-command, and slash-command submission by deferring the submitted composer's repaint to the next command state.
+- Preserved the busy composer while writing normal-turn transcript output so user-submission rendering does not clear it.
+- Bound CSI-u `Ctrl+Q` input to close the read-only `/git diff` viewer, matching the existing raw-key binding and ESC behavior.
+- Routed leading-`!` commands and aliases resolving to `kward edit <filename>` into the integrated editor instead of spawning a nested Kward process.
+- Preserved safe, line-oriented PTY output such as `ls` by redrawing it into the transient transcript when returning from `/shell`, `!command`, or `/pty`, while leaving full-screen and keyboard-driven sessions terminal-owned.
+- Removed legacy `pty` and `capture` mode markers from configured aliases expanded by `!command`, preventing valid aliases such as `glog: pty git log` from failing with status 127.
+- Hardened interactive PTY cleanup, final-output draining, input EOF handling, resize propagation, and stopped-child recovery so terminal handoff reliably returns control to Kward.
+- Normalized binary-tagged UTF-8 shell output before transcript rendering, preventing interactive `!` commands such as `tree` from crashing the composer.
+- Deferred interactive warning output until startup transcript replay completes, keeping Runtime diagnostics visible instead of immediately overwriting them with the replayed transcript.
+
+## [0.80.1] - 2026-07-27
+
+### Fixed
+
+- Avoided repeated full-buffer syntax scans while rendering generic-language editor lines, keeping Python and other supported languages responsive during cursor movement.
+- Routed interactive configuration, plugin, skill, compaction, memory, and logging warnings through synchronized `Runtime>` output so diagnostics cannot corrupt the terminal layout.
+
 ## [0.80.0] - 2026-07-27
 
 ### Added

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    kward (0.80.0)
+    kward (0.81.0)
       base64
       nokogiri
       tiktoken_ruby
@@ -146,7 +146,7 @@ CHECKSUMS
   html-proofer (5.2.1) sha256=fdd958a7cbf9c3255fb96fe7cfc4e611f64e2706e469488a3326309ad007d2fd
   io-event (1.16.2) sha256=9f9cb0a96ea5c3850a672606c65f27bc96d7621399ef6196acbfe2be0cd1279c
   json (2.19.9) sha256=9b9025b7cdddafa38d316eca0b2358488e42d417045c1b90d216a9fefe46b79a
-  kward (0.80.0)
+  kward (0.81.0)
   logger (1.7.0) sha256=196edec7cc44b66cfb40f9755ce11b392f21f7967696af15d274dde7edff0203
   metrics (0.15.0) sha256=61ded5bac95118e995b1bc9ed4a5f19bc9814928a312a85b200abbdac9039072
   minitest (6.0.6) sha256=153ea36d1d987a62942382b61075745042a2b3123b1cd48f4c3675af9cc7d6f1

data/README.md

@@ -72,7 +72,7 @@ Work safely:
 Everyday workflows:
 
 - [Sessions](doc/session-management.md): resume, clone, fork, rewind, compact, and navigate saved work.
-- [Interactive composer](doc/composer.md): use multiline input, completion, history, files, reasoning shortcuts, busy input, and images.
+- [Interactive composer](doc/composer.md): use multiline input, completion, history, files, reasoning selection, busy input, and images.
 - [Tabs](doc/tabs.md): keep several conversations open and run work in another tab.
 - [Project files](doc/files.md): browse, search, mention, open, and edit workspace files.
 - [Integrated editor](doc/editor.md): open files from the shell or composer, edit in-place, and choose editor keybindings.

data/doc/composer.md

@@ -38,7 +38,7 @@ The composer supports familiar line-editing keys:
 | `Alt+D` | Delete the word after the cursor |
 | `Ctrl+U` / `Ctrl+K` | Kill from the cursor to the start or end of the line |
 | `Ctrl+Y` | Yank the most recently killed composer text |
-| `Ctrl+L` | Redraw the terminal UI |
+| `Ctrl+L` | Redraw the terminal UI and remove transient current-view output |
 | `Ctrl+D` | Delete at the cursor, or exit when the composer is empty |
 
 These are composer bindings. The integrated editor, shell, Git view, file browser, and plugin interfaces have their own keymaps.
@@ -115,15 +115,12 @@ History survives restarts. It contains submitted prompt text and successful `$pa
 
 ## Change reasoning effort
 
-When no slash or file picker is open, Tab cycles forward through reasoning efforts supported by the current model. Shift+Tab cycles backward. The selection wraps and is persisted for later turns.
+The composer status line shows the current provider, model, and reasoning effort. Use `/reasoning` or `/model` to choose the reasoning effort explicitly.
 
-The composer status line shows the current provider, model, and reasoning effort. Use `/reasoning` or `/model` when you prefer the explicit picker.
-
-Tab is context-sensitive:
+Tab follows the normal completion behavior:
 
 - in slash or `@path` completion, it accepts the selected match,
 - in `$path` completion, it opens the selected file,
-- otherwise, it changes reasoning effort,
 - in other modal interfaces, it follows that interface's own controls.
 
 ## Work with tabs
@@ -214,6 +211,6 @@ If rendering becomes corrupted after resize or after an external program writes
 /redraw
 ```
 
-You can also press `Ctrl+L`. If a shortcut never reaches Kward, prefer its slash-command equivalent or change `composer.tab_keybindings` in `/settings`.
+You can also press `Ctrl+L`; it rebuilds the durable current-tab view without deleting the conversation transcript, removing transient shell output. If a shortcut never reaches Kward, prefer its slash-command equivalent or change `composer.tab_keybindings` in `/settings`.
 
-For full-screen interactive programs such as Vim or `less`, use `/pty <command>` or `pty <command>` inside `/shell` so the program temporarily owns the terminal instead of fighting the composer.
+External commands inside `/shell` and one-shot `!command` input receive an interactive PTY by default, so full-screen programs such as Vim or `less` temporarily own the terminal. Use `capture <command>` inside `/shell` or `/capture <command>` from the normal composer when output should remain in Kward's transcript instead.

data/doc/configuration.md

@@ -81,7 +81,17 @@ long-polling adapter and setup instructions.
 
 ### Project skills
 
-Kward loads user-level skills but skips project-level skills by default. Enable them only for repositories you trust, either through `/settings` → Tools & Search → Trust project skills or with:
+Kward loads user-level skills automatically. Project-level skills require an explicit workspace trust decision. In the interactive TUI, Kward asks when a new or changed skill appears; use `/skills status`, `/skills trust`, `/skills untrust`, and `/new` to inspect, manage, and activate decisions.
+
+For non-interactive use:
+
+```bash
+kward --working-directory /path/to/project skills status
+kward --working-directory /path/to/project skills review
+kward --working-directory /path/to/project skills trust
+```
+
+Trust records are stored in `~/.kward/trusted_project_skills.json`. The legacy global override remains available:
 
 ```json
 {
@@ -176,7 +186,7 @@ aliases:
 
 `env` values are applied when shell mode starts, after Kward's conservative color defaults. Keys must look like environment variable names (`A_Z`, digits after the first character, and underscores); invalid keys are ignored. Values are converted to strings.
 
-`aliases` expand the first word of a command once. For example, `ll lib` runs `ls -la lib`. Built-in `ekwsh` commands such as `cd`, `pwd`, `export`, `unset`, `alias`, `clear`, `pty`, and `exit` take precedence over aliases. Run `alias` inside `ekwsh` to list configured aliases. Aliases are also included in command-name Tab completion.
+`aliases` expand the first word of a command once. For example, `ll lib` runs `ls -la lib`. Configured aliases are available both inside `/shell` and after the normal composer's `!` prefix, including command-name Tab completion. Built-in `ekwsh` commands such as `cd`, `pwd`, `export`, `unset`, `alias`, `capture`, `clear`, `pty`, and `exit` take precedence over aliases inside `/shell`. External commands receive an interactive PTY by default. An alias value can begin with `capture` when its `/shell` output should use the configured timeout, output limit, and transcript sanitization. Leading-`!` alias invocations are always interactive, so Kward removes a leading `capture` or legacy `pty` mode marker from the expanded alias before execution. Run `alias` inside `ekwsh` to list configured aliases. Aliases created at runtime with that built-in belong only to the current `/shell` session and are not available to `!command` input.
 
 ## Provider and model settings
 
@@ -355,7 +365,7 @@ The busy composer shows a short Ctrl+C cancellation hint by default. To hide it:
 
 This only hides the hint text; Ctrl+C still stops the current running response.
 
-In the normal composer prompt, `Tab` cycles forward through the current model's reasoning efforts and `Shift+Tab` cycles backward. The shortcuts wrap around and update the persisted reasoning setting; file and slash-command completion overlays keep their existing `Tab` completion behavior.
+In the normal composer prompt, choose reasoning effort with `/reasoning` or `/model`; `Tab` keeps its normal file and slash-command completion behavior.
 
 `tab_keybindings` controls how the composer handles tab navigation shortcuts:
 

data/doc/permissions.md

@@ -175,7 +175,7 @@ The policy runs before Kward dispatches a model-requested tool. It does not cons
 
 - a permitted shell command can access files, processes, credentials, and network services available to your user account;
 - command-text rules are useful review controls, not a reliable way to enforce network destinations or all subprocess behavior;
-- direct commands that you type yourself—`!command`, `/shell`, and `/pty`—are treated as your actions and are outside this first policy scope;
+- direct commands that you type yourself—`!command`, `/capture`, `/shell`, and `/pty`—are treated as your actions and are outside this first policy scope;
 - plugins, hooks, and MCP servers are trusted local extensions with their own process access.
 
 For sensitive work, use a restricted operating-system account, container, virtual machine, or disposable checkout. [Command sandboxing](sandboxing.md) is a separate, opt-in operating-system boundary for model-requested `run_shell_command` workers. It can add filesystem and child-network restrictions, but does not cover Kward's host process, extensions, or direct interactive commands.

data/doc/rpc.md

@@ -76,6 +76,7 @@ Read `capabilities` at runtime instead of assuming every feature is available. I
 - `memory`: opt-in structured memory support, interactive prompt injection only, JSON/JSONL local storage, and dedicated `memory/*` methods.
 - `commands`: supported `commands/list` capability for prompt, skill, and plugin command sources, plus plugin execution through `commands/run` or plugin slash turns.
 - `skillCapture`: capture a reviewed personal `SKILL.md` from any saved session’s active branch through `skills/captureSessions`, `skills/captureDraft`, and `skills/saveCapturedDraft`.
+- `projectSkillTrust`: explicitly unsupported over RPC. RPC clients cannot answer the interactive Allow/Deny/Review decision, so project skills remain skipped unless the global `skills.trust_project` override is enabled.
 - `mcp`: local stdio MCP server support through the shared `mcpServers` config. RPC exposes MCP tools to turns and advertises discovery with `methods: ["tools/list", "mcp/status"]`, `toolMetadata: true`, and `serverStatus: true`. It does not support MCP resources, prompts, sampling, or Streamable HTTP.
 - `startupResources`: supported startup resource listing for context, skills, prompts, and plugins.
 - `extensionUi`: question bridge support via `ui/question` and `ui/answerQuestion`, plus plugin footer updates via `ui/footer`; other UI primitives are explicitly unsupported.
@@ -83,7 +84,7 @@ Read `capabilities` at runtime instead of assuming every feature is available. I
 - `security`: trusted-local behavior and optional per-turn tool approval. By default, RPC turns have no workspace mutation guard or tool approval, so shell commands and file changes can run. Clients can inspect file-tool guardrails through `capabilities.events.tools.workspaceGuardrails` and `runtime/state.workspaceGuardrailsEnabled`. `security.sandbox` reports the command sandbox mode, enforcement backend, and filesystem and network capabilities; session pinning and one-time elevation are unsupported. See [Command sandboxing](sandboxing.md) for the boundary and its limits.
 - `export`: supported transcript export formats. Currently `markdown` and `html`; default is `markdown`.
 - `starterPack`: explicitly unsupported (`supported: false`, reason `cliOnlyInstallCommand`). Use `kward init` from the shell.
-- `shell`: explicitly unsupported (`supported: false`, reason `interactiveTuiOnly`) because `/shell` is the local embedded TUI shell.
+- `shell`: explicitly unsupported (`supported: false`, reason `interactiveTuiOnly`) because `/shell`, `!command`, `/capture`, and PTY handoff require the local TUI. Model-requested `run_shell_command` tools remain bounded, captured, and noninteractive over RPC.
 - `logging`: local redacted telemetry, its directory and enabled categories, `logging/stats` and `logging/tokenCsv`, bucketed `usageCsv` support, JSONL storage, and 10 MB rotation with manual retention. Logs contain redacted metadata only. Configuration uses the `logging` key and `KWARD_LOGGING` environment prefix.
 
 ### `shutdown`

data/doc/sandboxing.md

@@ -77,9 +77,9 @@ worker. The strict agent also disables configured MCP clients and lifecycle
 hooks because they run in the Kward host process rather than inside the command
 sandbox.
 
-This does not contain the interactive `/shell`, `!command`, or `/pty` features;
-those are user-directed host-process operations. Generic model-requested shell
-commands still cannot write Git metadata. Active worktree tabs additionally
+This does not contain the user-directed `/shell`, `!command`, `/capture`, or
+`/pty` features; those are user-directed host-process operations. Generic
+model-requested shell commands still cannot write Git metadata. Active worktree tabs additionally
 expose a narrow `git_commit` tool for explicit agent-requested commits; it runs
 through the trusted host-side Git workflow rather than widening the shell
 sandbox. The interactive `/git` flow remains available for manual review and
@@ -111,7 +111,7 @@ It does not sandbox:
 - the Kward Ruby host process;
 - model-provider, search-provider, or RPC traffic;
 - trusted Ruby plugins;
-- MCP servers, lifecycle hooks, `/shell`, `!command`, or `/pty`.
+- MCP servers, lifecycle hooks, `/shell`, `!command`, `/capture`, or `/pty`.
 
 Sandboxed command workers receive a minimal environment: Kward preserves only
 basic terminal, locale, and path variables, then supplies a private `HOME` and

data/doc/security.md

@@ -56,8 +56,9 @@ Kward's built-in file tools normally resolve paths inside the active workspace.
 
 These protections reduce accidental edits. They do not contain the whole process:
 
-- With `sandbox.mode: off` (the default), `run_shell_command`, `!command`, `/shell`, and `/pty` run with your user permissions.
-- A non-off [command sandbox](sandboxing.md) restricts only model-requested `run_shell_command` workers and their descendants. It does not cover `!command`, `/shell`, or `/pty`.
+- With `sandbox.mode: off` (the default), `run_shell_command`, `!command`, `/capture`, `/shell`, and `/pty` run with your user permissions.
+- A non-off [command sandbox](sandboxing.md) restricts only model-requested `run_shell_command` workers and their descendants. It does not cover `!command`, `/capture`, `/shell`, or `/pty`.
+- External `/shell` commands, `!command`, and `/pty` forward child output directly to your terminal so interactive programs work. This bypasses transcript control-sequence sanitization; run only commands you trust with terminal access. `capture <command>` and `/capture <command>` sanitize their captured output.
 - Plugins, command hooks, and MCP servers are local processes with the same general operating-system access.
 - Read-before-edit applies to Kward's file tools, not to arbitrary shell commands or extension code.
 
@@ -67,7 +68,7 @@ You can disable the file boundary with `tools.workspace_guardrails: false`, but
 
 A worktree-backed tab uses its linked worktree as the active workspace and requires an OS-enforced `workspace_write` command sandbox. If the platform cannot provide filesystem enforcement, Kward refuses to activate the worktree rather than running model-requested shell commands unrestricted.
 
-The strict worktree agent disables configured MCP clients and lifecycle hooks for that tab because those extensions run outside the command-worker sandbox. The interactive `/shell`, `!command`, and `/pty` features remain host-process features and are not covered by the worktree boundary. Use them only when you intentionally want to run a user-directed command outside the model command sandbox.
+The strict worktree agent disables configured MCP clients and lifecycle hooks for that tab because those extensions run outside the command-worker sandbox. The interactive `/shell`, `!command`, `/capture`, and `/pty` features remain host-process features and are not covered by the worktree boundary. Use them only when you intentionally want to run a user-directed command outside the model command sandbox.
 
 Git worktrees share repository metadata. Kward keeps Git metadata protection enabled for generic model-requested commands. Active worktree tabs provide a narrow host-side `git_commit` tool for explicit agent commits; the interactive `/git` flow remains the manual review, staging, and commit path.
 
@@ -95,13 +96,9 @@ A repository-level `AGENTS.md` is guidance for the model, not executable code. K
 
 ### Project skills
 
-Project skills under `.kward/skills/` and `.agents/skills/` are skipped by default. Enable them only after reviewing their `SKILL.md` instructions and supporting files:
+Project skills under `.kward/skills/` and `.agents/skills/` require an explicit trust decision. In the interactive TUI, Kward asks for `Allow`, `Deny`, or `Review` when a new or changed skill appears. Review shows bounded `SKILL.md` content and lists referenced resources without executing them. Decisions are stored per canonical workspace and skill digest in `~/.kward/trusted_project_skills.json`, so changes require another review.
 
-```text
-/settings → Tools & Search → Trust project skills
-```
-
-This setting trusts project skills generally; it is not a per-repository digest. A skill's `allowed-tools` metadata does not grant permissions or constrain tools in Kward.
+Use `/skills status`, `/skills trust`, `/skills untrust`, or the non-interactive `kward skills` command to manage the records. The legacy `skills.trust_project` setting remains a global override. A skill's `allowed-tools` metadata does not grant permissions or constrain tools in Kward.
 
 ### Workspace hooks