@aragon-agent/cli 0.6.34 → 0.6.36

package/dist/agent/model-profile-settings.js

@@ -4,7 +4,10 @@ import { mergePersistedConfig } from '../config/store.js';
 import { adaptLegacyConnectionPatch, assertLegacyFastTarget, commitModelSettings, readModelSettingsDisk, } from '../config/model-profile-store.js';
 import { projectModelProfiles, resolveModelProfileState } from '../config/model-profile-resolution.js';
 import { validateModelProfiles } from '../config/model-profiles.js';
+import { applyHeldToLive, carrySessionKit } from '../config/kit-resolution.js';
+import { findKit } from '../config/model-kits.js';
 import { registerProfileSecrets } from '../logging/secret-registry.js';
+import { getLogger } from '../logging/logger.js';
 /** Capture both baselines when the editor opens, without migrating or writing anything. */
 export function createModelSettingsDraft(live, liveRevision) {
     const disk = readModelSettingsDisk();
@@ -15,6 +18,11 @@ export function createModelSettingsDraft(live, liveRevision) {
         profiles: disk.config?.modelProfiles
             ? structuredClone(disk.config.modelProfiles) : undefined,
         activateRoles: [], patch: {},
+        // SEEDED FROM THE LIVE CONFIG (RV-P0-2). Without this line `draft.sessionKit`
+        // is always `undefined`, the `undefined` case below means "release", and any
+        // save made from the settings screen would silently drop a session kit the
+        // user just applied - the exact opposite of "this session only".
+        sessionKit: live.sessionKit ? structuredClone(live.sessionKit) : undefined,
         ...(!disk.ok ? { readError: 'Cannot read config. Repair it with aragon config edit.' } : {}),
     };
 }
@@ -61,6 +69,47 @@ function hasConnectionPatch(patch, role) {
     const section = role === 'main' ? patch : patch.fast;
     return !!section && ['provider', 'model', 'baseUrl'].some((key) => key in section);
 }
+/**
+ * The slots THIS transaction explicitly decided, and that therefore leave the
+ * session kit (§4.3 / D-6).
+ *
+ * Released BY SLOT, never wholesale: a user who only retargeted the subagent
+ * must not lose the main and fast choices the kit made for this session, and a
+ * user who retargeted main must not have it silently ignored. Per-slot is the
+ * only rule shaped like the data (three independent slots).
+ */
+export function releasedSlots(draft) {
+    const held = draft.sessionKit?.held ?? [];
+    if (!held.length)
+        return [];
+    // THE APPLY ITSELF RELEASES NOTHING (`kit-apply.ts` sets this marker). Without
+    // it the apply's own writes - `activateRoles`, `patch.team`, the re-bound
+    // library - read as "the user decided every slot", and the save would drop the
+    // three slots it was just handed.
+    if (draft.sessionKitFresh)
+        return [];
+    const kit = findKit(draft.profiles ?? draft.baseline.modelProfiles, draft.sessionKit?.id);
+    if (!kit)
+        return [...held];
+    const released = new Set();
+    for (const role of ['main', 'fast']) {
+        if (draft.activateRoles.includes(role) || connectionChanged(draft, role)
+            || hasConnectionPatch(draft.patch, role))
+            released.add(role);
+    }
+    if (draft.patch.team !== undefined)
+        released.add('subagent');
+    return [...released].filter((slot) => held.includes(slot));
+}
+/** The session kit as it stands AFTER this transaction's explicit decisions. */
+function narrowedSessionKit(draft) {
+    const current = draft.sessionKit;
+    if (!current)
+        return null;
+    const released = releasedSlots(draft);
+    const held = current.held.filter((slot) => !released.includes(slot));
+    return held.length ? { id: current.id, held } : null;
+}
 function liveCandidate(live, candidate, draft) {
     const patch = draft.patch;
     const normalizedPatch = {};
@@ -128,8 +177,16 @@ function liveCandidate(live, candidate, draft) {
             next.apiKeyOverrideTarget = undefined;
         }
         else {
-            next.fast = { ...next.fast, provider: projected.fast.provider,
-                model: projected.fast.model, baseUrl: projected.fast.baseUrl };
+            // I-13 (RV-P1-7): `projectModelProfiles` projects fast ONLY when the
+            // library binds one. With `fastId: null` the projection's `fast` is just the
+            // file's untouched section (`projected` starts as `{...file}`), so copying it
+            // here would resurrect the disk's fast endpoint underneath a kit that
+            // deliberately turned the tier off - the live config would then say "off"
+            // while naming a model nobody chose.
+            if (projected.modelProfiles?.fastId) {
+                next.fast = { ...next.fast, provider: projected.fast.provider,
+                    model: projected.fast.model, baseUrl: projected.fast.baseUrl };
+            }
         }
     }
     if (next.apiKeyOverride && !next.apiKeyOverrideTarget
@@ -139,49 +196,100 @@ function liveCandidate(live, candidate, draft) {
     next.modelProfileState = resolveModelProfileState(next);
     return next;
 }
-/** Validate and prepare everything before the one synchronous, atomic disk commit. */
-export function saveModelSettings(input) {
-    const { draft, controller } = input;
-    if (controller.isModelSettingsBusy())
-        return rejected('busy');
-    if (draft.liveRevision !== controller.getSettingsRevision())
-        return rejected('conflict');
-    const disk = readModelSettingsDisk();
-    if (!disk.ok || draft.readError)
-        return rejected('read_failed');
-    if (disk.revision !== draft.diskRevision)
-        return rejected('conflict');
-    const issues = validateModelProfiles(draft.profiles ?? disk.config?.modelProfiles);
+/**
+ * Build both candidates and the snapshot.
+ *
+ * TWO CANDIDATES, NAMED DIFFERENTLY ON PURPOSE (RV-P0-1 / I-14). `diskCandidate`
+ * is the commit side and never learns about a held slot; `liveCandidateInput`
+ * is what the session sees and is never committed. Collapsing them into one
+ * variable is the defect this split exists to prevent: one unrelated save would
+ * then write the session's kit into the user's permanent defaults, and nothing
+ * visible would change.
+ */
+function prepareModelSettings(input) {
+    const { draft, controller, current } = input;
+    const issues = validateModelProfiles(draft.profiles ?? current.modelProfiles);
     if (issues.length)
-        return { ...rejected('invalid'), issues };
-    let snapshot;
-    let candidate;
+        return { failure: { ...rejected('invalid'), issues } };
     try {
-        const current = disk.config ?? structuredClone(DEFAULT_CONFIG);
         const profilesChanged = draft.activateRoles.length > 0
             || JSON.stringify(draft.profiles) !== JSON.stringify(draft.baseline.modelProfiles);
         const implicitLegacy = draft.profiles === undefined || !profilesChanged;
         const patch = adaptLegacyConnectionPatch({ current, patch: implicitLegacy
                 ? draft.patch : { ...draft.patch, modelProfiles: draft.profiles } });
-        candidate = mergePersistedConfig(current, patch);
-        registerProfileSecrets(candidate);
-        const next = liveCandidate(controller.getConfig(), candidate, draft);
+        const diskCandidate = mergePersistedConfig(current, patch);
+        registerProfileSecrets(diskCandidate);
+        const sessionKit = narrowedSessionKit(draft);
+        const applied = applyHeldToLive(diskCandidate, sessionKit);
+        if (applied.dropped.length) {
+            getLogger().warn('agent', 'session_kit_slots_dropped', { slots: applied.dropped });
+        }
+        const next = liveCandidate(controller.getConfig(), applied.candidate, draft);
+        next.sessionKit = sessionKit ?? undefined;
         // Disk preferences cannot reveal startup/session gateways retained by the live main role.
         if (implicitLegacy && current.modelProfiles?.fastId && hasConnectionPatch(draft.patch, 'fast')) {
             assertLegacyFastTarget(next.fast, next);
         }
-        snapshot = controller.prepareModelSettingsSnapshot(next);
+        const snapshot = controller.prepareModelSettingsSnapshot(next);
+        return { prepared: { diskCandidate, liveCandidateInput: applied.candidate, snapshot } };
     }
     catch (error) {
         const code = error.code ?? 'invalid';
-        return rejected(code);
+        return { failure: rejected(code) };
     }
-    const commit = commitModelSettings({ candidate, diskRevision: draft.diskRevision });
+}
+/** Validate and prepare everything before the one synchronous, atomic disk commit. */
+export function saveModelSettings(input) {
+    const { draft, controller } = input;
+    if (controller.isModelSettingsBusy())
+        return rejected('busy');
+    if (draft.liveRevision !== controller.getSettingsRevision())
+        return rejected('conflict');
+    const disk = readModelSettingsDisk();
+    if (!disk.ok || draft.readError)
+        return rejected('read_failed');
+    if (disk.revision !== draft.diskRevision)
+        return rejected('conflict');
+    const prepared = prepareModelSettings({ draft, controller,
+        current: disk.config ?? structuredClone(DEFAULT_CONFIG) });
+    if (!prepared.prepared)
+        return prepared.failure;
+    const commit = commitModelSettings({ candidate: prepared.prepared.diskCandidate,
+        diskRevision: draft.diskRevision });
     if (!commit.ok)
         return rejected(commit.code ?? 'write_failed');
-    return applyPreparedSnapshot(controller, snapshot, true);
+    return applyPreparedSnapshot(controller, prepared.prepared.snapshot, true);
+}
+/**
+ * The SAME prepare chain, without the commit: a session kit (§4.2 exit B).
+ *
+ * NO `diskRevision` GATE: nothing is written, so a save that landed elsewhere is
+ * not this operation's business. It still refuses while work is in flight
+ * (`busy`) and still refuses a draft whose disk could not be read, so "nothing
+ * changed" is guaranteed for every other failure too (I-10).
+ */
+export function previewModelSettings(draft, controller) {
+    if (controller.isModelSettingsBusy())
+        return rejected('busy');
+    if (draft.readError)
+        return rejected('read_failed');
+    const disk = readModelSettingsDisk();
+    if (!disk.ok)
+        return rejected('read_failed');
+    const prepared = prepareModelSettings({ draft, controller,
+        current: disk.config ?? structuredClone(DEFAULT_CONFIG) });
+    if (!prepared.prepared)
+        return prepared.failure;
+    return applyPreparedSnapshot(controller, prepared.prepared.snapshot, false);
 }
-function applyPreparedSnapshot(controller, snapshot, persisted) {
+/**
+ * Apply a prepared snapshot.
+ *
+ * `persisted` HAS NO DEFAULT (RV-P1-4): the one attribute that distinguishes
+ * "the file now says this" from "only this process says this" is not something
+ * a call site should be able to forget.
+ */
+export function applyPreparedSnapshot(controller, snapshot, persisted) {
     try {
         controller.applyModelSettingsSnapshot(snapshot);
     }
@@ -220,14 +328,19 @@ export function reloadModelSettings(controller) {
         if (live.unicode !== undefined)
             resolved.unicode = live.unicode;
         resolved.reducedMotion ||= !live.color;
+        // THE SESSION KIT SURVIVES A RELOAD (D-6): the three connections it holds
+        // must come from the kit, not from the file we just re-read, and the
+        // projection has to be recomputed so the live config stays equivalent to
+        // what its own bindings say (I-3).
+        const carried = carrySessionKit({ resolved, previous: live });
         const after = readModelSettingsDisk();
         if (!after.ok)
             return rejected('read_failed');
         if (after.revision !== disk.revision)
             return rejected('conflict');
-        if (resolved.modelProfileState?.main.invalid)
+        if (carried.modelProfileState?.main.invalid)
             return rejected('invalid');
-        return applyPreparedSnapshot(controller, controller.prepareModelSettingsSnapshot(resolved), false);
+        return applyPreparedSnapshot(controller, controller.prepareModelSettingsSnapshot(carried), false);
     }
     catch {
         return rejected('invalid');

package/dist/agent/reducer.d.ts

@@ -16,13 +16,13 @@ import type { AgentMode } from './agent-mode.js';
 import type { DispatchOutcome, SubagentRun, SubagentSpec, TeamSnapshot } from '../team/types.js';
 import type { FastReview, FastSnapshot } from '../fast/types.js';
 import type { CompactionMode, CompactionRecord, CompactionSnapshot, CompactionUiTrigger, ContextUsageSnapshot } from '../compaction/types.js';
-import type { TodoItem, TodoSnapshot } from '../todo/types.js';
+import type { AcceptanceSnapshot, TodoItem, TodoSnapshot } from '../todo/types.js';
 import type { JobKind, ServiceSnapshot, ServiceStatus } from '../proc/types.js';
 import type { RetryPhase } from './retry-view.js';
 import type { FilePatch } from '../tools/patch.js';
 export type NoticeLevel = 'info' | 'warn' | 'error';
 export type ToastLevel = NoticeLevel | 'success';
-export type Overlay = null | 'settings' | 'model' | 'help' | 'queue' | 'confirm' | 'question' | 'plan';
+export type Overlay = null | 'settings' | 'model' | 'help' | 'queue' | 'confirm' | 'question' | 'plan' | 'kit' | 'prompts' | 'prompt-pick' | 'agents';
 export type ToolStatus = 'pending' | 'running' | 'done' | 'error';
 /** Ephemeral, auto-dismissed acknowledgement (spec §3.9). */
 export interface Toast {
@@ -147,6 +147,17 @@ export type Entry = {
     items: TodoItem[];
     doneCount: number;
     total: number;
+    /**
+     * The acceptance projection, copied from `TodoSnapshot.acceptance` on every
+     * `todoUpdate` (todo-acceptance-criteria §6.10).
+     *
+     * OPTIONAL, NOT `AcceptanceSnapshot | null` REQUIRED, and that asymmetry with
+     * the snapshot is deliberate (P1-4): `TodoSnapshot` has exactly one writer, so
+     * it can fail closed; an `Entry` does not - its sources include `entries` read
+     * back from a session file written before this feature existed, where the key
+     * is simply absent.
+     */
+    acceptance?: AcceptanceSnapshot | null;
     /** The turn that owns this card is still running, so it may be rewritten. */
     live: boolean;
     /**

package/dist/agent/reducer.js

@@ -1020,6 +1020,7 @@ export function viewReducer(state, action) {
                 items: action.snapshot.items,
                 doneCount: action.snapshot.doneCount,
                 total: action.snapshot.total,
+                acceptance: action.snapshot.acceptance,
                 live: true,
             });
             // Rewrite the turn's card when there is one; otherwise append and record

package/dist/cli.js

@@ -170,6 +170,10 @@ function toFlags(opts) {
         // C-9). A value flag is no less inert than a boolean one when this line is
         // missing.
         todoFollow: opts.todoFollow,
+        // Site three of three once more, for `--todo-acceptance`: a flag declared in
+        // commander and on `CliFlags` but missing HERE is inert, with no compile error
+        // and no runtime error (todo-acceptance-criteria §6.8.2).
+        todoAcceptance: opts.todoAcceptance,
         // Site three of three for `--retry` / `--retry-max` — five features, same
         // trap (`mouse` P1-2, `team` P1-4, `todo` C-9, render L4, now retry). A flag
         // needs the `.option()` declaration below, a field on `CliFlags`, AND a line
@@ -1319,6 +1323,9 @@ function createSessionWriter(input) {
         readView: input.readView,
         readHistory: () => controller.getSessionSnapshot(),
         readTodos: () => controller.getTodoSnapshot()?.items ?? [],
+        // The verdicts travel with the plan; read from the STORE, not from the render
+        // projection, so a checkpoint taken while the capability is off still saves them.
+        readAcceptance: () => controller.getAcceptanceItems(),
         // READ AT WRITE TIME: `/model` rebuilds the config, and a checkpoint that
         // recorded the model from launch would name the wrong one after a switch.
         readModel: () => {
@@ -2068,6 +2075,11 @@ function buildProgram() {
         // passed, so `!== undefined` in `resolveTodoConfig` already distinguishes it
         // from silence. An unrecognized mode is clamped to `notify`, not rejected.
         .option('--todo-follow <mode>', 'What to do when a run ends with unfinished steps: notify (default) | auto | off')
+        // A PAIR, and for the same reason `--todo-panel` needs one: `acceptance` is
+        // PERSISTED, so a lone `--no-todo-acceptance` would make commander default
+        // `opts.todoAcceptance` to `true` and overwrite a stored `false`.
+        .option('--todo-acceptance', 'Plan acceptance criteria with every todo list (the default)')
+        .option('--no-todo-acceptance', 'Plan steps only: no acceptance criteria, no verify phase')
         // BOTH FORMS, positive first, for the reason recorded five times above:
         // `retry.enabled` is PERSISTED, so a lone `--no-retry` would make commander
         // default `opts.retry` to `true` and silently overwrite a stored `false`.

package/dist/commands/agents-command.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `/agents` — open the subagent board (tui-subagent-panel §6.4).
+ *
+ * A SECOND DOOR, not a fallback. `Ctrl+B` is the fast path, but a key is undiscoverable
+ * unless the user reads `/help`, and `/agents` is what the palette advertises. Both
+ * entries share ONE guard (`state.team === null && lastTeamEntry(...) === null`) so the
+ * key and the command can never disagree about whether there is a board to show: an
+ * empty board would read as a broken feature, and the honest answer is a notice that
+ * says no dispatch has happened yet.
+ *
+ * The body lives in its own module for the reason `kit-command.ts` and
+ * `queue-command.ts` do: `builtins.ts` is already well past a thousand lines.
+ */
+import type { CommandRegistry } from './registry.js';
+export declare function registerAgentsCommand(registry: CommandRegistry): void;

package/dist/commands/agents-command.js

@@ -0,0 +1,27 @@
+/**
+ * `/agents` — open the subagent board (tui-subagent-panel §6.4).
+ *
+ * A SECOND DOOR, not a fallback. `Ctrl+B` is the fast path, but a key is undiscoverable
+ * unless the user reads `/help`, and `/agents` is what the palette advertises. Both
+ * entries share ONE guard (`state.team === null && lastTeamEntry(...) === null`) so the
+ * key and the command can never disagree about whether there is a board to show: an
+ * empty board would read as a broken feature, and the honest answer is a notice that
+ * says no dispatch has happened yet.
+ *
+ * The body lives in its own module for the reason `kit-command.ts` and
+ * `queue-command.ts` do: `builtins.ts` is already well past a thousand lines.
+ */
+import { lastTeamEntry } from '../ui/team-status.js';
+export function registerAgentsCommand(registry) {
+    registry.register({
+        name: 'agents',
+        description: 'Open the subagent board: every child, its facts and its timeline',
+        run: (ctx) => {
+            if (ctx.state.team === null && lastTeamEntry(ctx.state.entries) === null) {
+                ctx.notify('info', 'No subagent dispatch yet.');
+                return;
+            }
+            ctx.setOverlay('agents');
+        },
+    });
+}

package/dist/commands/builtins.js

@@ -14,6 +14,7 @@ import { computeCost, formatCost, formatDuration, formatTokens } from '../agent/
 import { mergePendingEntries } from '../agent/queued-messages.js';
 import { TODO_FOLLOW_LIMITS } from '../todo/limits.js';
 import { buildContinuationMessage } from '../todo/follow-through.js';
+import { planIsResolved } from '../todo/acceptance.js';
 import { MODE_LABEL, nextMode } from '../agent/agent-mode.js';
 import { loadSession, resolveSessionPath, saveSession } from '../session/persist.js';
 import { applyRestoredSession } from '../session/startup-session.js';
@@ -23,6 +24,9 @@ import { getLogger } from '../logging/logger.js';
 import { resolveFastTier } from '../fast/resolve.js';
 import { subagentModelSummary } from '../ui/overlays/model-profile-state.js';
 import { registerQueueCommand } from './queue-command.js';
+import { registerPromptCommands } from '../prompts/command.js';
+import { registerKitCommand } from './kit-command.js';
+import { registerAgentsCommand } from './agents-command.js';
 import { perfCommand } from './perf.js';
 import { runCompactCommand } from '../compaction/command.js';
 import { runClearCommand } from './clear-command.js';
@@ -157,6 +161,102 @@ function runTeamModelCommand(ctx, subject) {
     ctx.persistConfig({ team: teamPatch });
     ctx.toast('success', `Subagent model: ${entry.name}${disambiguation} (${entry.provider}:${entry.model}).`);
 }
+/** Rows `/todo status` prints before it says how many it did not. */
+const ACCEPT_STATUS_ROWS = 8;
+/**
+ * `/todo acceptance on|off|reset`, and the bare form equal to `/todo status`'s
+ * acceptance section (todo-acceptance-criteria §6.14).
+ *
+ * EVERY MUTATING BRANCH IS "TWO CALLS PLUS PERSIST", the rule `/todo panel` and
+ * `/todo follow` already follow: `setTodoConfig` (or `setTodoAcceptanceEnabled`) is
+ * what the session sees, and `persistConfig` is what survives it. Only one of the two
+ * reports success while changing nothing.
+ */
+function runTodoAcceptance(ctx, value) {
+    const controller = ctx.controller;
+    if (!value || value === 'status') {
+        const lines = acceptanceStatusLines(controller.getTodoSnapshot()?.acceptance ?? null, controller.getTodoConfig().acceptance);
+        if (lines.length === 0) {
+            ctx.notify('info', 'No acceptance criteria. Todo planning: ' +
+                (controller.isTodoEnabled() ? 'on' : 'off') + '.');
+            return;
+        }
+        for (const line of lines)
+            ctx.notify('info', line);
+        return;
+    }
+    if (value === 'on' || value === 'off') {
+        const acceptance = value === 'on';
+        controller.setTodoAcceptanceEnabled(acceptance);
+        ctx.persistConfig({ todo: { acceptance } });
+        ctx.toast('success', `Acceptance criteria ${acceptance ? 'on' : 'off'}.`);
+        return;
+    }
+    if (value === 'reset') {
+        if (controller.isRunning()) {
+            ctx.notify('warn', 'Cannot reset the acceptance criteria while a run is in progress.');
+            return;
+        }
+        // THE COUNT COMES FROM THE STORE (a named writer, §6.2.3), never recomputed here,
+        // and `0` means the table was already fully unchecked - in which case a notice
+        // would announce that nothing happened.
+        const reopened = controller.reopenAcceptance();
+        if (reopened === 0) {
+            ctx.notify('info', 'No checked criteria to reset.');
+            return;
+        }
+        ctx.toast('info', `${reopened} ${reopened === 1 ? 'criterion is' : 'criteria are'} ` +
+            'unchecked again.');
+        return;
+    }
+    ctx.notify('warn', 'Usage: /todo acceptance [on|off|reset]');
+}
+/**
+ * The acceptance section of `/todo status`, as at most two notification bodies.
+ *
+ * RETURNS NOTHING WHEN THERE IS NOTHING TO SAY, which is what keeps the disabled
+ * path and the no-criteria path byte-identical to the pre-feature command (I-5).
+ * The list is bounded at eight rows by "unchecked and failed first, then the rest",
+ * with `... and N more` closing it: the full table lives in the transcript card, and
+ * a command that floods the transcript is not a status command.
+ */
+function acceptanceStatusLines(acceptance, enabled) {
+    if (!enabled || !acceptance || acceptance.total === 0)
+        return [];
+    const header = `Acceptance ${acceptance.checkedCount}/${acceptance.total} checked` +
+        (acceptance.failedCount > 0 ? ` (${acceptance.failedCount} failed)` : '');
+    const rows = acceptance.items
+        .map((item, index) => ({ item, index }))
+        .sort((left, right) => rank(left.item.status) - rank(right.item.status));
+    const shown = rows.slice(0, ACCEPT_STATUS_ROWS);
+    const lines = shown.map(({ item, index }) => `  ${String(index + 1).padStart(2)}. ${markerWord(item.status)} ${item.content}` +
+        (item.status === 'failed' && item.evidence.length > 0 ? `\n      ${item.evidence}` : ''));
+    if (rows.length > shown.length)
+        lines.push(`  ... and ${rows.length - shown.length} more`);
+    return [header, ...lines];
+}
+/**
+ * Failures first, then everything still open, then the settled verdicts: `/todo status`
+ * is read to find out what is WRONG, and the eight-row budget means the order decides
+ * what survives the cut.
+ */
+function rank(status) {
+    if (status === 'failed')
+        return 0;
+    if (status === 'in_progress' || status === 'pending')
+        return 1;
+    return 2;
+}
+/** ASCII markers: this module is inside the glyph scanner's scope. */
+function markerWord(status) {
+    if (status === 'passed')
+        return '[x]';
+    if (status === 'failed')
+        return '[!]';
+    if (status === 'in_progress')
+        return ' > ';
+    return '[ ]';
+}
 function formatFastStatus(controller) {
     const status = controller.getFastStatus();
     const cfg = controller.getFastConfig();
@@ -687,7 +787,8 @@ const COMMANDS = [
     },
     {
         name: 'todo',
-        description: 'Todo planning: status | on | off | panel on|off | follow <mode> | clear | continue',
+        description: 'Todo planning: status | on | off | panel on|off | follow <mode> | ' +
+            'acceptance [on|off|reset] | clear | continue',
         /**
          * `/todo on` CANNOT turn planning on in a session that started with
          * `--no-todo`, for the reason `/team on` above records at length: the tool
@@ -738,6 +839,16 @@ const COMMANDS = [
                     : '';
                 ctx.notify('info', `Todos: ${snapshot.doneCount}/${snapshot.total} done.${active} Panel: ${panel}. ` +
                     `Follow-through: ${follow}.`);
+                // THE ACCEPTANCE SECTION, appended and NOTHING ELSE (todo-acceptance-criteria
+                // §6.14): with no criteria the two calls above are byte-identical to the
+                // version without this feature.
+                for (const line of acceptanceStatusLines(snapshot.acceptance, todoCfg.acceptance)) {
+                    ctx.notify('info', line);
+                }
+                return;
+            }
+            if (verb === 'acceptance') {
+                runTodoAcceptance(ctx, value);
                 return;
             }
             if (verb === 'on' || verb === 'off') {
@@ -819,7 +930,10 @@ const COMMANDS = [
                     return;
                 }
                 const snapshot = controller.getTodoSnapshot();
-                if (!snapshot || snapshot.doneCount >= snapshot.total) {
+                // `planIsResolved`, NOT `doneCount >= total` (§6.14): in the verification
+                // phase every step is done and the command has to keep working, or the user's
+                // only manual route into the last stage is refused with "Nothing left".
+                if (!snapshot || planIsResolved(snapshot.items, snapshot.acceptance?.items ?? null)) {
                     ctx.notify('info', 'Nothing left to continue.');
                     return;
                 }
@@ -838,7 +952,8 @@ const COMMANDS = [
                 return;
             }
             ctx.notify('warn', `Unknown argument "${verb}" - use ` +
-                '/todo [status|on|off|panel on|off|follow <mode>|clear|continue].');
+                '/todo [status|on|off|panel on|off|follow <mode>|acceptance [on|off|reset]|' +
+                'clear|continue].');
         },
     },
     {
@@ -1016,6 +1131,11 @@ const COMMANDS = [
                     // `/resume` restores `messages`, so the belief that justifies the
                     // panel comes back — and the panel has to come back with it (§3.13).
                     todos: ctx.controller.getTodoSnapshot()?.items ?? [],
+                    // The verdicts travel with the plan, for the same reason: a resume that
+                    // restored the steps and dropped the conclusions would show a plan as
+                    // "not started" that the user had already watched being verified. Read
+                    // from the STORE, so a save taken while the capability is off keeps them.
+                    acceptance: ctx.controller.getAcceptanceItems(),
                 });
                 ctx.notify('info', `Saved session to ${path}`);
             }
@@ -1371,6 +1491,17 @@ export function registerBuiltinCommands(registry) {
     for (const command of COMMANDS)
         registry.register(command);
     registerQueueCommand(registry);
+    // The command BODY lives in its own module (builtins.ts is already 1.5k lines);
+    // this line is the whole registration (agent-model-kits §4.9).
+    registerKitCommand(registry);
+    // Same shape, one feature later (quick-prompt-library §4.3 / P1-3): the body is
+    // `prompts/command.ts` and its capabilities arrive on `CommandContext.prompts`.
+    // REGISTERED UNCONDITIONALLY, even with `prompts.enabled=false` - that is the only
+    // way the command can report that the feature is off (D-19 / AC-30).
+    registerPromptCommands(registry);
+    // The read-only subagent board (tui-subagent-panel §6.4). Same shape again: the
+    // body is `commands/agents-command.ts` and the registration is this one line.
+    registerAgentsCommand(registry);
 }
 /**
  * Every built-in command name INCLUDING aliases (`quit`), for documentation and
@@ -1380,7 +1511,7 @@ export function registerBuiltinCommands(registry) {
  * `registry.get(name)` instead, because that is the only check that stays
  * correct when commands are registered dynamically (§7.1 / P1-2).
  */
-export const BUILTIN_COMMAND_NAMES = ['queue', ...COMMANDS.flatMap((c) => [
+export const BUILTIN_COMMAND_NAMES = ['queue', 'prompts', 'agents', ...COMMANDS.flatMap((c) => [
         c.name,
         ...(c.aliases ?? []),
     ])].sort();

package/dist/commands/kit-command.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `/kit` - the slash surface for agent model kits (agent-model-kits §4.9).
+ *
+ * ASCII ONLY - `src/commands/**` is inside `glyphs.test.ts::inScope`.
+ *
+ * WHY A COMMAND AT ALL, WHEN `ctrl+K` EXISTS: a key that a terminal, tmux, an
+ * input method or a IME can swallow needs an equivalent that cannot be swallowed
+ * (`R-4`), and the same reading is what a user pastes into an issue. The two
+ * surfaces call the SAME controller methods, so they can never diverge in
+ * behaviour - only in how the answer is rendered.
+ *
+ * THERE IS NO `/kit default` (D-7): the session path is forbidden from writing
+ * the file, so a "make this the default" verb here would be the one hole in that
+ * promise. Setting a default is a settings action, with a Save the user sees.
+ */
+import type { CommandRegistry, CommandContext } from './registry.js';
+/** The command body; `registerKitCommand` is the only registration site. */
+export declare function runKitCommand(ctx: CommandContext): void;
+/** Registered from `builtins.ts` with one line, next to every other subsystem. */
+export declare function registerKitCommand(registry: CommandRegistry): void;