@agentwhy/cli 0.1.0 → 0.2.1

package/dist/core/detector/prompt-signals.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 /**
  * The signals of specification §6.2, read out of the text a delegation carried.
  *

package/dist/core/guarded-places.js

@@ -0,0 +1,42 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
+import { isAbsolute, join, relative, sep } from 'node:path';
+/**
+ * Where macOS asks the person before an app reads, under their home directory (`which-project.md` V10b): Desktop,
+ * Documents, Downloads, iCloud Drive and the folders other cloud drives keep. **Documented by Apple, measured here only
+ * for Documents** (2026-10-01).
+ */
+const UNDER_HOME = [['Desktop'], ['Documents'], ['Downloads'], ['Library', 'Mobile Documents'], ['Library', 'CloudStorage']];
+/** Other disks, removable or on a network: one place each, asked about as a kind rather than by name. */
+const VOLUMES = '/Volumes';
+/**
+ * The guarded place a folder lies in, as the root of that place, or `undefined` where it lies in none. Compared without
+ * regard to case, as the file system macOS starts with compares names. A pure answer about a path: nothing is read.
+ */
+export function guardedPlaceOf(path, home) {
+    for (const parts of UNDER_HOME) {
+        const root = join(home, ...parts);
+        if (sameOrWithin(root, path))
+            return root;
+    }
+    if (!within(VOLUMES, path))
+        return undefined;
+    // `within` compared without case; the disk's own name is read from the path once its first part is `/Volumes`'s.
+    const disk = relative(VOLUMES, VOLUMES + path.slice(VOLUMES.length)).split(sep)[0];
+    return disk === undefined || disk === '' ? undefined : join(VOLUMES, disk);
+}
+/**
+ * Whether a run working in `workingDirectory` must leave `path` alone (V10b): it lies in a guarded place, and not in the
+ * one the working directory lies in - which the app agentwhy runs under can read already, or it could not work there.
+ */
+export function leftAlone(path, workingDirectory, home) {
+    const place = guardedPlaceOf(path, home);
+    return place !== undefined && place.toLowerCase() !== guardedPlaceOf(workingDirectory, home)?.toLowerCase();
+}
+function sameOrWithin(folder, path) {
+    return relative(folder.toLowerCase(), path.toLowerCase()) === '' || within(folder, path);
+}
+function within(folder, path) {
+    const between = relative(folder.toLowerCase(), path.toLowerCase());
+    return between !== '' && between !== '..' && !between.startsWith(`..${sep}`) && !isAbsolute(between);
+}

package/dist/core/nearest-project.js

@@ -1,6 +1,9 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { isAbsolute, relative, sep } from 'node:path';
 /**
- * A folder that is gone cannot be offered, so only projects whose folder exists are considered. Where the folder lies
+ * A folder that is gone cannot be offered, so only projects whose folder is not known to be gone are considered - one not
+ * looked at (V10b) is looked at when it is picked. Where the folder lies
  * inside more than one project, the nearest - the deepest - is the one; the projects inside it keep the listing's order.
  * Paths are compared through `relative`, which compares a Windows path without regard to case, as its file system does.
  *
@@ -9,7 +12,7 @@ import { isAbsolute, relative, sep } from 'node:path';
  * offered the home directory as the project above it, which setup then refuses.
  */
 export function nearestProject(folder, listing, noProject) {
-    const present = listing.projects.filter((project) => project.exists && !noProject(project.path));
+    const present = listing.projects.filter((project) => project.folder !== 'gone' && !noProject(project.path));
     const itself = present.find((project) => relative(project.path, folder) === '');
     if (itself !== undefined)
         return { kind: 'itself', project: itself };

package/dist/core/policy/glob.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 /**
  * Path-glob matching, written out rather than taken from a library or from an experimental Node API, because
  * which paths count as protected is the security decision of this tool: it has to be small enough to read and

package/dist/core/policy/parse-policy.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { isJsonObject, parseJsonObject } from '../../shared/json.js';
 export const POLICY_VERSION = 1;
 const LEVELS = ['no-read', 'no-disclose'];

package/dist/core/policy/policy.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { matchesGlob } from './glob.js';
 /**
  * The entry that protects this path, or undefined. An exception wins over every protecting pattern, so a path
@@ -14,7 +16,17 @@ export function protectionOf(policy, path) {
 export function protects(policy, path) {
     return protectionOf(policy, path) !== undefined;
 }
-/** The same policy with only what is kept from the agent: what a hook that stops a command may act on (F57). */
+/**
+ * The same policy with only what is kept from the agent: what a hook that stops a command may act on (F57). A told
+ * pattern becomes one of the allowed, not merely absent: dropped, a broader blocking pattern answered for the file -
+ * `demo.env`, told by its name but inside the blocked `.env` wildcard, was still refused - and a file the person said
+ * their AI may read was kept from it (found by the maintainer, 2026-10-02).
+ */
 export function blockingOnly(policy) {
-    return { ...policy, protected: policy.protected.filter((entry) => entry.mode !== 'tell') };
+    const told = policy.protected.filter((entry) => entry.mode === 'tell');
+    return {
+        ...policy,
+        protected: policy.protected.filter((entry) => entry.mode !== 'tell'),
+        allowed: [...policy.allowed, ...told.map((entry) => entry.pattern)],
+    };
 }

package/dist/core/policy/resolve-policy.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { DEFAULT_POLICY } from './default-policy.js';
 /**
  * Chooses the policy: an explicit file, else the environment's own deny rules, else the built-in default.

package/dist/core/redaction/entropy.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 /**
  * Class C of spec §5.4: entropy alone. It **redacts and never reports** — a high-entropy string is not
  * evidence of anything, and lesson L001 measured what happens without that rule: in one session, 385 `toolu_`

package/dist/core/redaction/redactor.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { createHash } from 'node:crypto';
 import { displayPath, displayPathsIn, insideProject, forSharing, OUTSIDE_THE_PROJECT, } from '../project-root.js';
 import { looksRandom } from './entropy.js';

package/dist/core/redaction/value-shapes.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 /**
  * The exclusions of spec §5.4 — "the real work here". Without them class B is a noise generator, because a
  * sensitive name sits beside a harmless value far more often than beside a secret: `SECRET_ENABLED=true`,

package/dist/core/redaction/value-trace.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 /**
  * Values read from protected resources, held as salted digests of their runs and asked about other text
  * (`specs/2026-09-15-what-came-back.md` R3, R4). No value is kept and no run of one (§5.4 rule 6): what is kept is the digest

package/dist/core/session-catalogue.js

@@ -1,3 +1,10 @@
+/**
+ * Whether no AI's store of conversations was there at all, where this listing looked: then "not used here yet" is not
+ * the likely reason, and running somewhere conversations are not saved is (R28, amended 2026-10-01).
+ */
+export function noStoreAnywhere(listing) {
+    return listing.searched.length > 0 && listing.searched.every((place) => place.store === 'missing');
+}
 /**
  * What names a session wherever two AIs' sessions meet - a row, a file, a cached report, `report --input`: its id where
  * Claude Code wrote it, as it always was, and the id after its AI's name otherwise, so equal ids never overwrite each

package/dist/core/session-filter.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 const HOUR = 3_600_000;
 const DAY = 24 * HOUR;
 const UNIT = { h: HOUR, d: DAY, w: 7 * DAY };

package/dist/infrastructure/clack-asker.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { isCancel, text } from '@clack/prompts';
 /** One line of text, through `@clack/prompts`. A blank answer comes back as an empty string, never as a cancellation. */
 export class ClackAsker {

package/dist/infrastructure/clack-chooser.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { autocomplete, isCancel } from '@clack/prompts';
 /** Rows shown at once. The rest are reached by moving, or found by typing. */
 const VISIBLE = 10;

package/dist/infrastructure/clack-multi-chooser.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { isCancel, multiselect } from '@clack/prompts';
 /**
  * A list with boxes, through `@clack/prompts` - the package the session chooser already uses, so no new dependency

package/dist/infrastructure/file-alert-store.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { lstat, mkdir, readdir, readFile, rm, stat, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 /** One directory of its own, so pruning never looks at a file this tool did not write. */
@@ -70,6 +72,9 @@ export class FileAlertStore {
         }
         return remembered;
     }
+    peek(sessionId) {
+        return this.#read(sessionId);
+    }
     /** A session id is not a file name until this makes it one: no separator, no `..`, no length worth worrying about. */
     #fileFor(sessionId) {
         const safe = sessionId.replace(UNSAFE, '-').slice(0, 80);
@@ -109,12 +114,14 @@ function isRemembered(value) {
         return false;
     const record = value;
     return typeof record.agentId === 'string' && typeof record.level === 'string' && typeof record.words === 'string' &&
-        (record.counts === undefined || areCounts(record.counts));
+        (record.counts === undefined || areCounts(record.counts)) && (record.notByRule === undefined || record.notByRule === true) &&
+        (record.told === undefined || record.told === true) && (record.data === undefined || record.data === true);
 }
-/** Counts that are not two whole numbers are counts this did not write: the record is read as one without them. */
+/** Counts that are not whole numbers are counts this did not write: the record is read as one without them. */
 function areCounts(value) {
     if (value === null || typeof value !== 'object')
         return false;
     const counts = value;
-    return Number.isInteger(counts.values) && Number.isInteger(counts.reached);
+    return Number.isInteger(counts.values) && Number.isInteger(counts.reached) &&
+        [counts.told, counts.data].every((count) => count === undefined || Number.isInteger(count));
 }

package/dist/infrastructure/file-checked-store.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { appendFile, mkdir, readFile } from 'node:fs/promises';
 import { dirname } from 'node:path';
 /** A session id as Claude Code names a transcript: nothing that could be a path or carry anything else. */

package/dist/infrastructure/file-mark-store.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { appendFile, mkdir, readFile } from 'node:fs/promises';
 import { dirname } from 'node:path';
 import { isMarkResult } from '../ports/mark-store.js';

package/dist/infrastructure/file-onboarding-store.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { appendFile, mkdir, readFile } from 'node:fs/promises';
 import { dirname } from 'node:path';
 /**

package/dist/infrastructure/file-page-servers.js

@@ -0,0 +1,51 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
+import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+/** Anything but these is not a name this store wrote: a project's key is turned into one before it is used. */
+const UNSAFE = /[^A-Za-z0-9._-]/g;
+/**
+ * The running page server of each project (`2026-10-02-a-page-not-a-file.md` PF2), in the person's own agentwhy
+ * folder: one small file a project, readable by its owner alone, since the address holds the page's token. Never
+ * throws: a record that cannot be read or written is no record, and a new server is started instead.
+ */
+export class FilePageServers {
+    #directory;
+    constructor(agentwhyDirectory) {
+        this.#directory = join(agentwhyDirectory, 'servers');
+    }
+    async read(project) {
+        try {
+            const parsed = JSON.parse(await readFile(this.#fileFor(project), 'utf8'));
+            return isRecord(parsed) ? parsed : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    async write(project, record) {
+        try {
+            await mkdir(this.#directory, { recursive: true, mode: 0o700 });
+            await writeFile(this.#fileFor(project), JSON.stringify(record), { encoding: 'utf8', mode: 0o600 });
+        }
+        catch {
+            // No record is a server that is not reused: the next open starts its own.
+        }
+    }
+    async remove(project, pid) {
+        const known = await this.read(project);
+        if (known?.pid !== pid)
+            return;
+        await rm(this.#fileFor(project), { force: true }).catch(() => undefined);
+    }
+    #fileFor(project) {
+        const safe = project.replace(UNSAFE, '-').slice(0, 200);
+        return join(this.#directory, `${safe === '' ? 'project' : safe}.json`);
+    }
+}
+function isRecord(value) {
+    if (value === null || typeof value !== 'object')
+        return false;
+    const record = value;
+    return typeof record.url === 'string' && Number.isInteger(record.pid) && typeof record.startedAt === 'number';
+}

package/dist/infrastructure/folder-window.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { execFile } from 'node:child_process';
 import { realpath } from 'node:fs/promises';
 /**

package/dist/infrastructure/node-agentwhy-invocation.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { constants } from 'node:fs';
 import { access, readFile, realpath, stat } from 'node:fs/promises';
 import { delimiter, dirname, join, sep } from 'node:path';

package/dist/infrastructure/node-background-run.js

@@ -0,0 +1,45 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
+import { spawn } from 'node:child_process';
+/**
+ * agentwhy started again as a process of its own (`2026-10-02-a-page-not-a-file.md` PF3): detached, its streams closed,
+ * not waited for - so the command that started it returns at once, and the page server it runs outlives it. Measured on
+ * 2026-10-02 (PFB1): such a process outlived its command in Claude Code in VS Code and in the desktop app, and in Codex
+ * when the command ran outside its sandbox.
+ */
+export class NodeBackgroundRun {
+    #node;
+    #script;
+    /**
+     * The processes this started that have ended, as Node says when it reaps one: an ended child's id may be given to
+     * another process, so asking the system by id would not tell them apart.
+     */
+    #ended = new Set();
+    constructor(node, script) {
+        this.#node = node;
+        this.#script = script;
+    }
+    start(args) {
+        if (this.#script === undefined)
+            return Promise.resolve(undefined);
+        return new Promise((resolve) => {
+            try {
+                const child = spawn(this.#node, [this.#script, ...args], { detached: true, stdio: 'ignore' });
+                child.once('error', () => resolve(undefined));
+                child.once('spawn', () => {
+                    const { pid } = child;
+                    if (pid !== undefined)
+                        child.once('exit', () => this.#ended.add(pid));
+                    child.unref();
+                    resolve(pid);
+                });
+            }
+            catch {
+                resolve(undefined);
+            }
+        });
+    }
+    running(pid) {
+        return !this.#ended.has(pid);
+    }
+}

package/dist/infrastructure/node-browser.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { spawn } from 'node:child_process';
 /**
  * What each platform calls to open a file with whatever is registered for it. The empty argument after `start`

package/dist/infrastructure/node-file-system.js

@@ -1,5 +1,9 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
+import { randomBytes } from 'node:crypto';
 import { createReadStream } from 'node:fs';
-import { mkdir, open, readdir, readFile, stat, writeFile } from 'node:fs/promises';
+import { chmod, lstat, mkdir, open, readdir, readFile, readlink, realpath, rename, stat, unlink, writeFile } from 'node:fs/promises';
+import { basename, dirname, join, resolve } from 'node:path';
 import { FileAccessError } from '../ports/file-access-error.js';
 /**
  * The owner alone, for everything this writes. What it writes is a report: which protected files an agent
@@ -16,6 +20,26 @@ export class NodeFileSystem {
     async writeText(path, text) {
         await attempt(path, () => writeFile(path, text, { mode: OWNER_ONLY_FILE }));
     }
+    /**
+     * AO15: the text goes to a temporary file beside the real target - a link followed, so a dotfiles link stays a link -
+     * with the target's mode, and then takes its place in one rename. A failure removes the temporary file and leaves the
+     * target as it was.
+     */
+    async replaceText(path, text) {
+        const target = await attempt(path, () => realTarget(path));
+        const mode = await stat(target).then((found) => found.mode & 0o777, () => OWNER_ONLY_FILE);
+        const temporary = join(dirname(target), `.${basename(target)}.agentwhy-${randomBytes(6).toString('hex')}.tmp`);
+        try {
+            await attempt(path, () => writeFile(temporary, text, { mode, flag: 'wx' }));
+            // The mode a file is created with is cut by the process's umask; the target's own is set again before the rename.
+            await attempt(path, () => chmod(temporary, mode));
+            await attempt(path, () => rename(temporary, target));
+        }
+        catch (error) {
+            await unlink(temporary).catch(() => undefined);
+            throw error;
+        }
+    }
     async ensureDirectory(path) {
         await attempt(path, () => mkdir(path, { recursive: true, mode: OWNER_ONLY_DIRECTORY }));
     }
@@ -88,6 +112,23 @@ function entryKind(entry) {
         return 'directory';
     return 'other';
 }
+/**
+ * The file a path names, every link followed; a file not there yet is named by its folder's real path. A link whose
+ * target is not there yet is followed to that target, so the write creates it and the link stays a link.
+ */
+async function realTarget(path) {
+    try {
+        return await realpath(path);
+    }
+    catch (error) {
+        if (!(error instanceof Error && 'code' in error && error.code === 'ENOENT'))
+            throw error;
+        const linked = await lstat(path).then((found) => found.isSymbolicLink(), () => false);
+        if (linked)
+            return realTarget(resolve(dirname(path), await readlink(path)));
+        return join(await realpath(dirname(path)), basename(path));
+    }
+}
 async function attempt(path, operation) {
     try {
         return await operation();

package/dist/infrastructure/node-local-server.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { createServer } from 'node:http';
 const LOOPBACK = '127.0.0.1';
 /**

package/dist/infrastructure/node-page-probe.js

@@ -0,0 +1,40 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
+import { request } from 'node:http';
+/** The computer's own addresses: a record that named anything else was not written by `start`, and is not asked. */
+const LOOPBACK = new Set(['127.0.0.1', 'localhost', '[::1]']);
+/**
+ * Asks a page once (`2026-10-02-a-page-not-a-file.md` PF3): an answer of 200 is a server that is running and this page
+ * is one it serves. Asking also brings a served page up to date (R75), so a conversation begun since the server started
+ * has its report by the time it is opened - and that takes as long as reading it does. Found by review: 3 s took a
+ * running server busy with a long conversation for a dead one, and started a second beside it.
+ */
+export class NodePageProbe {
+    #timeoutMs;
+    constructor(timeoutMs = 10_000) {
+        this.#timeoutMs = timeoutMs;
+    }
+    answers(url) {
+        let parsed;
+        try {
+            parsed = new URL(url);
+        }
+        catch {
+            return Promise.resolve(false);
+        }
+        if (parsed.protocol !== 'http:' || !LOOPBACK.has(parsed.hostname))
+            return Promise.resolve(false);
+        return new Promise((resolve) => {
+            const asking = request(parsed, { method: 'GET', timeout: this.#timeoutMs }, (response) => {
+                response.resume();
+                resolve(response.statusCode === 200);
+            });
+            asking.on('error', () => resolve(false));
+            asking.on('timeout', () => {
+                asking.destroy();
+                resolve(false);
+            });
+            asking.end();
+        });
+    }
+}

package/dist/infrastructure/os-notifier.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { execFile } from 'node:child_process';
 /**
  * A system notification (`specs/2026-09-16-when-an-agent-finishes.md` R15). On macOS through `osascript`, which showed

package/dist/infrastructure/real-directory.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { realpathSync } from 'node:fs';
 /**
  * A directory as the system names it, every link followed: what a shell's working directory is given as, where `HOME`

package/dist/infrastructure/shell-command-trial.js

@@ -0,0 +1,60 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
+import { spawn } from 'node:child_process';
+/** How much of standard error is kept to say why a trial failed: its first line, cut short. */
+const STDERR_KEPT = 300;
+/**
+ * `2026-10-02-codex-approves-its-own-hook.md` AO14, AOB8: a command line run as Codex runs a hook on macOS and Linux -
+ * `$SHELL -lc "<command>"`, else `/bin/sh` - with its input on standard input, from the given folder. On Windows
+ * Codex's way is not measured, so nothing is tried. The environment is this process's, not Codex's: what passes here
+ * is what can be promised, and no more. A timeout ends the shell; a process it started may outlive it briefly, which
+ * a trial accepts - the answer is already "timed out".
+ */
+export class ShellCommandTrial {
+    #options;
+    constructor(options) {
+        this.#options = options;
+    }
+    run(trial) {
+        if (this.#options.platform === 'win32')
+            return Promise.resolve({ kind: 'not-tried' });
+        const shell = this.#options.shell === undefined || this.#options.shell === '' ? '/bin/sh' : this.#options.shell;
+        return new Promise((resolve) => {
+            let settled = false;
+            let timer;
+            const done = (outcome) => {
+                if (settled)
+                    return;
+                settled = true;
+                if (timer !== undefined)
+                    clearTimeout(timer);
+                resolve(outcome);
+            };
+            const child = spawn(shell, ['-lc', trial.commandLine], {
+                cwd: trial.folder,
+                env: { ...this.#options.environment },
+                stdio: ['pipe', 'ignore', 'pipe'],
+            });
+            let stderr = '';
+            child.stderr?.on('data', (chunk) => {
+                if (stderr.length < STDERR_KEPT)
+                    stderr += chunk.toString('utf8');
+            });
+            timer = setTimeout(() => {
+                if (settled)
+                    return;
+                child.kill('SIGKILL');
+                done({ kind: 'timed-out' });
+            }, trial.timeoutMs);
+            child.on('error', (error) => done({ kind: 'not-started', reason: error.message }));
+            child.on('close', (code, signal) => {
+                if (code === null)
+                    return done({ kind: 'not-started', reason: `ended by ${signal ?? 'a signal'}` });
+                done({ kind: 'ran', exitCode: code, stderr: (stderr.split('\n')[0] ?? '').slice(0, STDERR_KEPT) });
+            });
+            // A command that exits before reading leaves a closed pipe; what it did is read from its exit, never this write.
+            child.stdin?.on('error', () => { });
+            child.stdin?.end(trial.input);
+        });
+    }
+}

package/dist/infrastructure/terminal-banner.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 /**
  * The lines drawn above the first question a command asks, and above none of the ones after it. `init` asks up to
  * three things in a row; the mark belongs at the top of that conversation, not before every prompt. One banner is

package/dist/ports/command-trial.js

@@ -0,0 +1 @@
+export {};

package/dist/ports/directory-reader.js

@@ -1 +1,14 @@
-export {};
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
+import { FileAccessError } from './file-access-error.js';
+/** Whether a folder is there: an error the port names is "no", and nothing else is swallowed. */
+export async function isDirectory(directories, path) {
+    try {
+        return (await directories.kindOf(path)) === 'directory';
+    }
+    catch (error) {
+        if (!(error instanceof FileAccessError))
+            throw error;
+        return false;
+    }
+}

package/dist/ports/file-replacer.js

@@ -0,0 +1 @@
+export {};

package/dist/ports/mark-store.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 /**
  * What a person says they did about a file (R31; `for-people-who-build-with-ai.md` F25, F50): the keys it held were
  * replaced, a template's values are placeholders, what could be done about a file whose contents cannot be changed was

package/dist/ports/page-server.js

@@ -0,0 +1 @@
+export {};

package/dist/refuse/command-reach.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { resolve } from 'node:path';
 import { hasGlob, matchesName, reachOf } from '../core/access/search-reach.js';
 import { protectionOf } from '../core/policy/policy.js';