@aragon-agent/cli 0.6.34 → 0.6.36

package/dist/config/model-profiles.d.ts

@@ -1,3 +1,4 @@
+import { type AgentKit } from './model-kits.js';
 export type ModelRole = 'main' | 'fast';
 export interface ModelProfile {
     id: string;
@@ -14,6 +15,16 @@ export interface ModelProfilesConfig {
     entries: ModelProfile[];
     mainId: string | null;
     fastId: string | null;
+    /**
+     * Agent model kits (agent-model-kits D-2). OPTIONAL because a file written by
+     * a pre-KIT build simply has no such key; `emptyModelProfiles` still fills it
+     * in, so every library this build CREATES is explicit.
+     */
+    kits?: AgentKit[];
+    /** The `Set default` pointer (D-13); a dangling value normalizes to null. */
+    defaultKitId?: string | null;
+    /** Forward migration marker (D-3). Always 1; never a functional decision. */
+    kitsVersion?: 1;
 }
 export interface ProfileBindingState {
     selectedId: string | null;
@@ -42,7 +53,16 @@ export declare function emptyModelProfileState(invalid?: boolean): ModelProfiles
  * copy of these four clauses is one edit away from disagreeing with the config layer.
  */
 export declare function isValidEndpointUrl(value: string | null | undefined): boolean;
-/** Validate untrusted input; diagnostics never include supplied values. */
+/**
+ * Validate untrusted input; diagnostics never include supplied values.
+ *
+ * THE KIT SECTION IS STRUCTURAL ONLY (agent-model-kits RV-P1-1). `mainId` /
+ * `fastId` above are `missing_reference` because a dangling ROLE BINDING leaves
+ * the whole library unreadable (there is no "nothing bound" recovery path once
+ * a bound id is gone), while a dangling KIT SLOT degrades at resolution time
+ * into `Profile missing` and a refused apply - the same discipline
+ * `team.modelProfileId` already follows (`schema.ts` clampTeamConfig).
+ */
 export declare function validateModelProfiles(value: unknown): ProfileValidationIssue[];
 /**
  * Disk-tolerance gate for a profile-level context window (profile-context-window 5.3).
@@ -55,11 +75,29 @@ export declare function validateModelProfiles(value: unknown): ProfileValidation
  * (invariant 4 - one bad number must not drop the user's credentials).
  */
 export declare function normalizeProfileContextWindow(value: unknown): number | null;
-/** Normalize a valid library into a safe field whitelist; throws a fixed error if invalid. */
+/**
+ * Normalize a valid library into a safe field whitelist; throws a fixed error if invalid.
+ *
+ * THE THREE KIT KEYS ARE LISTED EXPLICITLY, NEVER `...spread` (R-2): this
+ * literal IS the whitelist (F-3), so a key missing from it disappears at the
+ * next write - a save that only touched `thinking` would silently delete every
+ * kit the user owns. `normalizeKits` is TOTAL, so a hand-edited kit degrades
+ * instead of taking the library (and the credentials in it) with it.
+ */
 export declare function normalizeModelProfiles(value: unknown): ModelProfilesConfig;
 /** Create an entry with a stable UUID and a frozen default name. */
 export declare function createModelProfile(input: Omit<ModelProfile, 'id'>): ModelProfile;
 /** Duplicate the current draft entry, including its explicitly edited credential. */
 export declare function duplicateModelProfile(entry: ModelProfile): ModelProfile;
-/** Remove an unused entry; binding references must be changed explicitly first. */
+/** Ids of the kits whose three slots name `id`, for the reference message. */
+export declare function kitNamesForProfile(library: ModelProfilesConfig, id: string): string[];
+/**
+ * Remove an unused entry; binding references must be changed explicitly first.
+ *
+ * The message NAMES the kits that would be orphaned (D-9): a throw that only
+ * says "still in use" sends the user hunting through three separate screens for
+ * the reference it means, and the kits are the reference nobody thinks of.
+ * (The UI never reaches this throw - it unbinds, and deletes the kits, inside
+ * the draft first - so this is the library-level backstop, F-25.)
+ */
 export declare function removeModelProfile(library: ModelProfilesConfig, id: string): ModelProfilesConfig;

package/dist/config/model-profiles.js

@@ -1,9 +1,11 @@
 import { randomUUID } from 'node:crypto';
 import { ADAPTER_PROVIDERS, clampContextWindow, isAutoToken } from './schema.js';
+import { normalizeKits, validateKits } from './model-kits.js';
 const CONTROL = /[\u0000-\u001f\u007f-\u009f]/;
 /** Return a fresh empty library without initiating a disk migration. */
 export function emptyModelProfiles() {
-    return { version: 1, entries: [], mainId: null, fastId: null };
+    return { version: 1, entries: [], mainId: null, fastId: null, kits: [],
+        defaultKitId: null, kitsVersion: 1 };
 }
 /** Return independently mutable role state. */
 export function emptyModelProfileState(invalid = false) {
@@ -69,7 +71,16 @@ function validateEntry(value, index) {
     }
     return issues;
 }
-/** Validate untrusted input; diagnostics never include supplied values. */
+/**
+ * Validate untrusted input; diagnostics never include supplied values.
+ *
+ * THE KIT SECTION IS STRUCTURAL ONLY (agent-model-kits RV-P1-1). `mainId` /
+ * `fastId` above are `missing_reference` because a dangling ROLE BINDING leaves
+ * the whole library unreadable (there is no "nothing bound" recovery path once
+ * a bound id is gone), while a dangling KIT SLOT degrades at resolution time
+ * into `Profile missing` and a refused apply - the same discipline
+ * `team.modelProfileId` already follows (`schema.ts` clampTeamConfig).
+ */
 export function validateModelProfiles(value) {
     if (value === undefined)
         return [];
@@ -99,6 +110,7 @@ export function validateModelProfiles(value) {
                 message: 'Select an existing profile or Current custom.' });
         }
     }
+    issues.push(...validateKits(value.kits));
     return issues;
 }
 /**
@@ -116,19 +128,29 @@ export function normalizeProfileContextWindow(value) {
         return null;
     return clampContextWindow(value, null);
 }
-/** Normalize a valid library into a safe field whitelist; throws a fixed error if invalid. */
+/**
+ * Normalize a valid library into a safe field whitelist; throws a fixed error if invalid.
+ *
+ * THE THREE KIT KEYS ARE LISTED EXPLICITLY, NEVER `...spread` (R-2): this
+ * literal IS the whitelist (F-3), so a key missing from it disappears at the
+ * next write - a save that only touched `thinking` would silently delete every
+ * kit the user owns. `normalizeKits` is TOTAL, so a hand-edited kit degrades
+ * instead of taking the library (and the credentials in it) with it.
+ */
 export function normalizeModelProfiles(value) {
     if (validateModelProfiles(value).length)
         throw new Error('Invalid model profiles.');
     if (value === undefined)
         return emptyModelProfiles();
     const library = value;
+    const { kits, defaultKitId, kitsVersion } = normalizeKits(library.kits, library.defaultKitId);
     return { version: 1, mainId: library.mainId, fastId: library.fastId,
         entries: library.entries.map((entry) => ({ id: entry.id, name: entry.name.trim()
                 || [...entry.model.trim()].slice(0, 80).join(''), provider: entry.provider,
             model: entry.model.trim(), baseUrl: entry.baseUrl?.trim() || null,
             apiKey: entry.apiKey?.trim() || null,
-            contextWindow: normalizeProfileContextWindow(entry.contextWindow) })) };
+            contextWindow: normalizeProfileContextWindow(entry.contextWindow) })),
+        kits, defaultKitId, kitsVersion };
 }
 /** Create an entry with a stable UUID and a frozen default name. */
 export function createModelProfile(input) {
@@ -139,9 +161,28 @@ export function createModelProfile(input) {
 export function duplicateModelProfile(entry) {
     return { ...entry, id: randomUUID(), name: `${[...entry.name].slice(0, 73).join('')} (copy)` };
 }
-/** Remove an unused entry; binding references must be changed explicitly first. */
+/** Ids of the kits whose three slots name `id`, for the reference message. */
+export function kitNamesForProfile(library, id) {
+    return (library.kits ?? []).filter((kit) => kit.mainProfileId === id
+        || kit.fastProfileId === id
+        || (kit.subagent.model === 'profile' && kit.subagent.modelProfileId === id))
+        .map((kit) => kit.name);
+}
+/**
+ * Remove an unused entry; binding references must be changed explicitly first.
+ *
+ * The message NAMES the kits that would be orphaned (D-9): a throw that only
+ * says "still in use" sends the user hunting through three separate screens for
+ * the reference it means, and the kits are the reference nobody thinks of.
+ * (The UI never reaches this throw - it unbinds, and deletes the kits, inside
+ * the draft first - so this is the library-level backstop, F-25.)
+ */
 export function removeModelProfile(library, id) {
     if (library.mainId === id || library.fastId === id)
         throw new Error('Profile is still in use.');
+    const kits = kitNamesForProfile(library, id);
+    if (kits.length) {
+        throw new Error(`Profile is used by kit ${kits.map((name) => `"${name}"`).join(', ')}.`);
+    }
     return { ...library, entries: library.entries.filter((entry) => entry.id !== id) };
 }

package/dist/config/schema.d.ts

@@ -489,6 +489,17 @@ export interface TodoConfig {
      * be, and would mean replacing both merges first.
      */
     followThrough: FollowThroughMode;
+    /**
+     * Must a plan also declare acceptance criteria, and does the UI show them
+     * (todo-acceptance-criteria §6.8.1). Default TRUE.
+     *
+     * THE FOURTH SCALAR, and it is a scalar for exactly the reason above: both
+     * hand-written merges in `config/store.ts` spread the whole `todo` object, so a
+     * new scalar key flows through them automatically. `clampTodoConfig` below is the
+     * only other place that has to know about it - a value that is missing THERE
+     * would silently keep the default and make `--no-todo-acceptance` look broken.
+     */
+    acceptance: boolean;
 }
 export declare const DEFAULT_TODO_CONFIG: TodoConfig;
 /**
@@ -851,6 +862,43 @@ export declare const DEFAULT_JOBS_CONFIG: JobsConfig;
  * resolve to `undefined` and the setting would silently never apply.
  */
 export declare function clampJobsConfig(raw: unknown): JobsConfig;
+/**
+ * The quick-prompt library's three POLICY scalars (quick-prompt-library D-19).
+ *
+ * THE LIBRARY ITSELF IS NOT HERE (D-3). Two hundred prompts with bodies is user
+ * content that grows with usage, and `ui-state.ts:5-13` already wrote the rule:
+ * anything carrying user content opens its own file. `config.json` holds the three
+ * decisions that are about BEHAVIOUR - whether the key exists, what a fill does to
+ * a non-empty draft, and whether the header teaches the key.
+ *
+ * ONE LEVEL DEEP, like every section beside it: `runConfigGet` splits on a single
+ * dot, so `prompts.hint` resolves and `prompts.some.nested` would not.
+ */
+export interface PromptsConfig {
+    /**
+     * `false` stops `Ctrl+P` and the header hint; `/prompts` STAYS REGISTERED and
+     * reports that the feature is off (D-19 / AC-30). Removing the command as well
+     * would leave the one surface that can explain the switch unable to run.
+     */
+    enabled: boolean;
+    /**
+     * What a fill does to a draft that already has text in it (D-6).
+     * `insert` keeps the user's words; `replace` overwrites them.
+     */
+    insertMode: 'insert' | 'replace';
+    /** Whether the header's right-hand column may teach `^P prompts`. */
+    hint: boolean;
+}
+export declare const DEFAULT_PROMPTS_CONFIG: PromptsConfig;
+/**
+ * THE single gate for every `prompts` read AND write, like the eleven sections
+ * above it.
+ *
+ * An unrecognized `insertMode` falls back to `insert` rather than to `replace`,
+ * and that direction is deliberate: a typo must never silently start DISCARDING
+ * what the user has already typed into the composer.
+ */
+export declare function clampPromptsConfig(raw: unknown): PromptsConfig;
 /**
  * Parse `0.9`, `90%` or `90` into a ratio, or `null` when it is neither.
  *
@@ -1013,6 +1061,8 @@ export interface PersistedConfig {
     bash: BashConfig;
     /** Background jobs and bounded waiting. The ELEVENTH; scalars only (see JobsConfig). */
     jobs: JobsConfig;
+    /** Quick prompts. The TWELFTH; three scalars (see PromptsConfig). */
+    prompts: PromptsConfig;
 }
 export declare const DEFAULT_CONFIG: PersistedConfig;
 /**
@@ -1044,6 +1094,22 @@ export interface CliConfig {
     modelSettingsRestartRequired?: boolean;
     modelProfiles?: import('./model-profiles.js').ModelProfilesConfig;
     modelProfileState?: import('./model-profiles.js').ModelProfilesRuntime;
+    /**
+     * The SESSION kit (agent-model-kits D-5 / §7.2). RUNTIME-ONLY.
+     *
+     * IT IS NOT IN `PersistedConfig` AND IT NEVER WILL BE (I-5 / I-14): `ctrl+K`
+     * and `/kit use` promise "this session only", and that promise is worth more
+     * than a saved convenience - it is what makes "one keystroke changed my
+     * defaults" structurally impossible rather than merely unlikely.
+     *
+     * `held` is the only fact worth storing: WHICH slots still belong to the kit.
+     * The bindings are derivable, and a stored copy of them would be a second
+     * truth (I-7: every held slot must have been written into the live config).
+     */
+    sessionKit?: {
+        id: string;
+        held: import('./model-kits.js').KitSlot[];
+    };
     apiKeyOverrideTarget?: {
         provider: string;
         baseUrl: string | null;
@@ -1335,6 +1401,24 @@ export interface CliConfig {
      * `undefined` and report an empty value for a setting that IS on disk.
      */
     jobs: JobsConfig;
+    /**
+     * Quick prompts (quick-prompt-library D-19). The TWELFTH nested object; three
+     * scalars, one level deep.
+     *
+     * ON `CliConfig` AS WELL AS `PersistedConfig`, for the reason every section above
+     * records: `App` reads `cfg.prompts?.enabled` / `.hint` / `.insertMode` from a
+     * `CliConfig`, so a key added to the persisted shape alone would round-trip
+     * through the `config` commands, appear in `config list`, and change nothing.
+     *
+     * OPTIONAL ON THIS SHAPE ONLY, and `loadConfig` always fills it. The reason is the
+     * one the `jobs` note above does not have to state: `CliConfig` is built by hand in
+     * ~20 test fixtures, and a REQUIRED section turns every one of them into a compile
+     * error for a feature none of them is about. The three readers then fall back to the
+     * DOCUMENTED defaults (`enabled: true`, `insertMode: 'insert'`, `hint: true`), so a
+     * missing section can only ever behave like a default session - never like a
+     * disabled or destructive one.
+     */
+    prompts?: PromptsConfig;
     /**
      * Lifetime submit count driving the composer hint fade (`HINT_FADE_AFTER`).
      *

package/dist/config/schema.js

@@ -578,6 +578,7 @@ export const DEFAULT_TODO_CONFIG = {
     enabled: true,
     panel: true,
     followThrough: 'notify',
+    acceptance: true,
 };
 /**
  * There is no enum helper in this file, so this follows the `isThinkingLevel`
@@ -606,6 +607,10 @@ export function clampTodoConfig(raw) {
         // `ARAGON_TODO_FOLLOW=garbage` therefore resolves to `'notify'` and throws
         // nothing (AC-5).
         followThrough: followMode(src.followThrough, DEFAULT_TODO_CONFIG.followThrough),
+        // The fourth key needs nothing beyond this line: no migration, because
+        // `CONFIG_VERSION` is only stamped and never branched, and an old file reaches
+        // the new default through `{ ...DEFAULT, ...partial } + clamp`.
+        acceptance: bool(src.acceptance, DEFAULT_TODO_CONFIG.acceptance),
     };
 }
 export const DEFAULT_RETRY_CONFIG = {
@@ -958,6 +963,31 @@ export function clampJobsConfig(raw) {
         noticeSteer: bool(src.noticeSteer, DEFAULT_JOBS_CONFIG.noticeSteer),
     };
 }
+export const DEFAULT_PROMPTS_CONFIG = {
+    enabled: true,
+    insertMode: 'insert',
+    hint: true,
+};
+const PROMPT_INSERT_MODES = ['insert', 'replace'];
+/**
+ * THE single gate for every `prompts` read AND write, like the eleven sections
+ * above it.
+ *
+ * An unrecognized `insertMode` falls back to `insert` rather than to `replace`,
+ * and that direction is deliberate: a typo must never silently start DISCARDING
+ * what the user has already typed into the composer.
+ */
+export function clampPromptsConfig(raw) {
+    const src = (raw && typeof raw === 'object' ? raw : {});
+    const mode = typeof src.insertMode === 'string' ? src.insertMode.trim().toLowerCase() : '';
+    return {
+        enabled: bool(src.enabled, DEFAULT_PROMPTS_CONFIG.enabled),
+        insertMode: PROMPT_INSERT_MODES.includes(mode)
+            ? mode
+            : DEFAULT_PROMPTS_CONFIG.insertMode,
+        hint: bool(src.hint, DEFAULT_PROMPTS_CONFIG.hint),
+    };
+}
 /**
  * Parse `0.9`, `90%` or `90` into a ratio, or `null` when it is neither.
  *
@@ -1062,6 +1092,15 @@ export const DEFAULT_CONFIG = {
     // to `undefined` would throw on `config.jobs.waitSeconds` at construction
     // rather than quietly disabling something.
     jobs: DEFAULT_JOBS_CONFIG,
+    // And one section later again, for the seventh time, and this one has BOTH
+    // failure directions at once: `prompts.enabled` and `prompts.hint` are `true` by
+    // default, so a `config.json` predating this feature would resolve them to
+    // `undefined` (falsy) and arrive with the key and its hint silently off - while
+    // `prompts.insertMode` would be `undefined`, which is neither `'insert'` nor
+    // `'replace'` and would make `planPromptFill` fall through to its `replace`
+    // branch. That branch discards the user's own words, so the miss would be a data
+    // loss rather than a missing hint.
+    prompts: DEFAULT_PROMPTS_CONFIG,
 };
 /**
  * Runtime state that used to be stored in `config.json` by mistake

package/dist/config/store.js

@@ -17,7 +17,7 @@ import { getConfigPath, getSessionsDir } from './app-paths.js';
 import { registerProfileSecrets, registerSecretsFrom } from '../logging/secret-registry.js';
 import { adaptLegacyConnectionPatch, ModelProfileConfigError, readModelSettingsDisk } from './model-profile-store.js';
 import { normalizeModelProfiles } from './model-profiles.js';
-import { clampBashConfig, clampJobsConfig, CONFIG_VERSION, DEFAULT_CONFIG, clampCompactionConfig, clampFastConfig, clampLogConfig, clampMaxTokens, clampRetryConfig, clampSkillsConfig, clampTeamConfig, clampTodoConfig, clampContextWindow, clampUpdateConfig, isAutoToken, stripLegacyStateKeys, } from './schema.js';
+import { clampBashConfig, clampJobsConfig, clampPromptsConfig, CONFIG_VERSION, DEFAULT_CONFIG, clampCompactionConfig, clampFastConfig, clampLogConfig, clampMaxTokens, clampRetryConfig, clampSkillsConfig, clampTeamConfig, clampTodoConfig, clampContextWindow, clampUpdateConfig, isAutoToken, stripLegacyStateKeys, } from './schema.js';
 /**
  * Normalize `maxTokens` for both directions of the config file.
  *
@@ -195,6 +195,11 @@ export function normalizePersistedConfig(input) {
         // outright, which is a crash on the first `job_wait` rather than a silently
         // wrong setting.
         jobs: clampJobsConfig({ ...DEFAULT_CONFIG.jobs, ...(partial.jobs ?? {}) }),
+        // And the twelfth, on the same line and for the same reason - with one extra
+        // edge: without it `prompts.insertMode` reads `undefined`, which is neither
+        // `'insert'` nor `'replace'`, so a fill into a non-empty draft would take the
+        // branch that REPLACES what the user typed.
+        prompts: clampPromptsConfig({ ...DEFAULT_CONFIG.prompts, ...(partial.prompts ?? {}) }),
     };
 }
 /**
@@ -302,6 +307,12 @@ export function mergePersistedConfig(current, patch) {
         // absent — with `noticeSteer`'s default masking it on the next load, so the
         // user would never learn that their privacy switch had been turned back on.
         jobs: clampJobsConfig({ ...current.jobs, ...(patch.jobs ?? {}) }),
+        // The twelfth section, and the seventh time this file records the same trap.
+        // `aragon config set prompts.hint false` sends `{ prompts: { hint: false } }`;
+        // without this line the shallow top-level spread REPLACES the section and
+        // `insertMode` is written absent - which reads back as neither `'insert'` nor
+        // `'replace'`, i.e. the next fill overwrites the user's own draft.
+        prompts: clampPromptsConfig({ ...current.prompts, ...(patch.prompts ?? {}) }),
     };
     return merged;
 }

package/dist/config/ui-state.d.ts

@@ -90,6 +90,21 @@ export interface UiState {
      * others for the same reasons the two above record, and NOT a schema bump.
      */
     scrollModeNoticeVersion: number;
+    /**
+     * Which revision of the "Ctrl+P moved to the prompt library" notice this user has
+     * been shown (`0` = none; quick-prompt-library D-20).
+     *
+     * A VERSION BESIDE THE OTHERS AND NOT A SCHEMA BUMP, for the third time in this
+     * file: bumping `UI_STATE_SCHEMA` makes `readFromDisk` discard the whole object, so
+     * every user's `submitCount` resets and the composer hint un-fades - to re-show one
+     * line. A NEW field simply reads as its default on an older file, which is exactly
+     * the behaviour wanted here.
+     *
+     * IT EXISTS BECAUSE THE KEY MOVED. `Ctrl+P` now opens the prompt library and the
+     * mode fallback is `Ctrl+N`; the audience for that sentence is every existing user,
+     * and a boolean could only ever say "shown", never "shown WHAT".
+     */
+    promptKeyNoticeVersion: number;
 }
 /** Read the state, caching it for the life of the process. Never throws. */
 export declare function loadUiState(): UiState;
@@ -107,6 +122,9 @@ export declare function setVtInputNoticeVersion(version: number): void;
 /** `0` on a file written before the field existed. */
 export declare function getScrollModeNoticeVersion(): number;
 export declare function setScrollModeNoticeVersion(version: number): void;
+/** `0` on a file written before the field existed; see the field's comment. */
+export declare function getPromptKeyNoticeVersion(): number;
+export declare function setPromptKeyNoticeVersion(version: number): void;
 /**
  * Migration-only: fill in fields that are still at their default, and never
  * overwrite a value already here. A second import — after a half-finished

package/dist/config/ui-state.js

@@ -38,6 +38,7 @@ const DEFAULT_UI_STATE = {
     mouseNoticeVersion: 0,
     vtInputNoticeVersion: 0,
     scrollModeNoticeVersion: 0,
+    promptKeyNoticeVersion: 0,
 };
 let memory = null;
 /** Non-negative integer or `fallback`; shared by both numeric fields. */
@@ -71,6 +72,7 @@ function readFromDisk() {
             mouseNoticeVersion: coerceCount(parsed.mouseNoticeVersion, DEFAULT_UI_STATE.mouseNoticeVersion),
             vtInputNoticeVersion: coerceCount(parsed.vtInputNoticeVersion, DEFAULT_UI_STATE.vtInputNoticeVersion),
             scrollModeNoticeVersion: coerceCount(parsed.scrollModeNoticeVersion, DEFAULT_UI_STATE.scrollModeNoticeVersion),
+            promptKeyNoticeVersion: coerceCount(parsed.promptKeyNoticeVersion, DEFAULT_UI_STATE.promptKeyNoticeVersion),
         };
     }
     catch {
@@ -151,6 +153,13 @@ export function getScrollModeNoticeVersion() {
 export function setScrollModeNoticeVersion(version) {
     update({ scrollModeNoticeVersion: version });
 }
+/** `0` on a file written before the field existed; see the field's comment. */
+export function getPromptKeyNoticeVersion() {
+    return loadUiState().promptKeyNoticeVersion;
+}
+export function setPromptKeyNoticeVersion(version) {
+    update({ promptKeyNoticeVersion: version });
+}
 /**
  * Migration-only: fill in fields that are still at their default, and never
  * overwrite a value already here. A second import — after a half-finished

package/dist/exec/events.d.ts

@@ -192,6 +192,22 @@ export interface ExecTodoEvent {
         content: string;
         status: 'pending' | 'in_progress' | 'completed';
     }[];
+    /**
+     * Acceptance counts (todo-acceptance-criteria §6.13.2). `null` when the capability
+     * is off or the plan has no criteria.
+     *
+     * REQUIRED BUT NULLABLE, not optional: `runner` is the only producer and can
+     * always answer, while for a consumer `null` and "field absent" mean the same
+     * thing under the forward-compatibility contract above. Per-criterion `evidence`
+     * never reaches this stream (I-8) - a machine consumer that needs it reads the
+     * session file.
+     */
+    acceptance: {
+        total: number;
+        checked: number;
+        passed: number;
+        failed: number;
+    } | null;
 }
 export interface ExecTeamEvent {
     type: 'team';
@@ -371,6 +387,15 @@ export interface ExecResultEvent {
         id: string;
     };
     todos: ExecTodoCounts | null;
+    /**
+     * The acceptance tally for the run (todo-acceptance-criteria §6.13.2), on the same
+     * terms as `ExecTodoEvent.acceptance`: required but nullable, no evidence.
+     */
+    acceptance: {
+        total: number;
+        passed: number;
+        failed: number;
+    } | null;
     error: ExecErrorInfo | null;
 }
 /**

package/dist/exec/events.js

@@ -44,6 +44,10 @@ export const EXEC_CAPABILITIES = [
     // Background job lifecycle events (long-task-jobs §4.10). A consumer that does
     // not know the `job` type ignores it; this string is how it asks first.
     'background-jobs',
+    // Acceptance counts on the todo event and the result event
+    // (todo-acceptance-criteria §6.13.2). APPEND-ONLY: a wrapper detects support by
+    // asking for this string, and an older wrapper never asks.
+    'todo-acceptance',
 ];
 export function buildInitEvent(params) {
     return {

package/dist/exec/index.js

@@ -112,7 +112,7 @@ async function execute(input) {
     });
     if (plan.saved) {
         controller.replaceMessages(plan.saved.messages, plan.saved.compactionIdentity);
-        controller.restoreTodos(plan.saved.todos);
+        controller.restoreTodos(plan.saved.todos, plan.saved.acceptance);
     }
     const config = controller.getConfig();
     emitter.init({
@@ -190,6 +190,14 @@ async function execute(input) {
         cost: buildCost(controller, stats.usage, stats.compactionBilling),
         model: { provider: config.provider, id: config.model },
         todos: todo ? { total: todo.total, done: todo.doneCount } : null,
+        // The verdict tally for the run, with no per-criterion evidence (I-8).
+        acceptance: todo?.acceptance
+            ? {
+                total: todo.acceptance.total,
+                passed: todo.acceptance.passedCount,
+                failed: todo.acceptance.failedCount,
+            }
+            : null,
         error: stats.errorCode && stats.errorMessage
             ? { code: stats.errorCode, message: stats.errorMessage }
             : null,
@@ -288,6 +296,7 @@ function failedResult(sessionId, config, message, code, durationMs) {
         cost: { amount: 0, currency: 'USD', known: false },
         model: { provider: config.provider, id: config.model },
         todos: null,
+        acceptance: null,
         error: { code, message },
     };
 }
@@ -479,6 +488,12 @@ function persist(plan, controller, turns, usage, cli, at) {
                 ...(controller.getSessionSnapshot?.() ?? { messages: controller.getMessages() }),
                 entries: [],
                 todos: controller.getTodoSnapshot?.()?.items ?? [],
+                // From the STORE, not the render projection: a run whose capability is off
+                // must still persist the verdicts it already has. OPTIONAL CALL, like the line
+                // above: `ExecControllerFactory` is a port, and a caller whose controller
+                // predates this feature must keep saving sessions rather than fail on a method
+                // it never heard of - the failure mode would be a session silently not written.
+                acceptance: controller.getAcceptanceItems?.() ?? [],
             },
             meta,
         });

package/dist/exec/runner.js

@@ -108,6 +108,16 @@ export class ExecRunner {
                 done: doneCount,
                 activeIndex,
                 items: items.map((item) => ({ content: item.content, status: item.status })),
+                // Counts only, never per-criterion evidence (I-8): this stream is a machine
+                // surface, and a criterion's evidence is written for a human to read.
+                acceptance: event.snapshot.acceptance
+                    ? {
+                        total: event.snapshot.acceptance.total,
+                        checked: event.snapshot.acceptance.checkedCount,
+                        passed: event.snapshot.acceptance.passedCount,
+                        failed: event.snapshot.acceptance.failedCount,
+                    }
+                    : null,
             });
         });
         if (todos)

package/dist/input/keymap.js

@@ -7,7 +7,15 @@
  * does not own so the caller can drop unknown control bytes instead of
  * inserting them into the buffer.
  */
-/** Map a Ctrl-modified key to an intent, if any. */
+/**
+ * Map a Ctrl-modified key to an intent, if any.
+ *
+ * `Ctrl+K` IS DELIBERATELY NOT HERE (agent-model-kits D-15). That byte belongs
+ * to the Agent-kit picker on the main screen, and this recognizer runs BEFORE
+ * `PromptInput`'s `if (key.ctrl) return` - so keeping the binding would delete
+ * the user's draft in one listener while the other opened the overlay. The
+ * capability moved to `Alt+K` (`fromMeta`) instead of being dropped.
+ */
 function fromCtrl(input, key) {
     if (key.leftArrow)
         return 'wordLeft';
@@ -22,8 +30,6 @@ function fromCtrl(input, key) {
             return 'deleteWordBack';
         case 'u':
             return 'killToStart';
-        case 'k':
-            return 'killToEnd';
         default:
             return null;
     }
@@ -34,6 +40,11 @@ function fromMeta(input) {
         return 'wordLeft';
     if (input === 'f')
         return 'wordRight';
+    // `killToEnd` LIVES HERE NOW (agent-model-kits D-15). `Alt+K` keeps the
+    // capability, and it keeps the kill family together: `M-k` is kill-sentence in
+    // the Emacs tradition this keymap already borrows `Ctrl+W` and `Alt+B/F` from.
+    if (input === 'k')
+        return 'killToEnd';
     if (input === '\x7f' || input === '\b')
         return 'deleteWordBack';
     return null;
@@ -63,7 +74,10 @@ function fromRaw(input) {
             return 'deleteWordBack';
         case '\x15': // Ctrl+U (raw)
             return 'killToStart';
-        case '\x0b': // Ctrl+K (raw)
+        case '\x1bk':
+            // Alt+K (raw ESC + k). `\x0b` (Ctrl+K) is deliberately ABSENT: it belongs
+            // to the Agent-kit picker, and a case for it here would be a dead binding
+            // that still looks alive to every future reader.
             return 'killToEnd';
         default:
             return null;

package/dist/proc/limits.d.ts

@@ -79,6 +79,22 @@ export declare const PROC_LIMITS: {
     readonly outputCoalesceMs: 100;
     /** `SIGTERM` -> `SIGKILL` escalation window for a graceful stop. */
     readonly stopGraceMs: 3000;
+    /**
+     * How long to KEEP ASKING whether the `SIGKILL` actually landed before
+     * declaring the job `stopped`.
+     *
+     * THIS NUMBER IS NOT A GUESS ABOUT THE PLATFORM. `killTree` spawns `taskkill`,
+     * which is a process of its own: a Windows tree kill of a shell plus its node
+     * child measures ~0.8 s on the reference machine (while starting `cmd` costs
+     * 50 ms), so the fixed 250 ms this used to allow expired first and `stop()`
+     * reported `stopped` with the child still running - AC-18 caught exactly that.
+     * The wait stays BOUNDED against the opposite failure (a promise that never
+     * resolves); at this deadline the record keeps the honest `killIncomplete`
+     * flag instead.
+     */
+    readonly killVerifyMs: 2000;
+    /** Liveness poll interval while waiting for a `SIGKILL` to land. */
+    readonly killVerifyPollMs: 50;
     /** Below this many terminal columns the status chip degrades to `[N]`. */
     readonly statusCompactCols: 92;
     /**

package/dist/proc/limits.js

@@ -79,6 +79,22 @@ export const PROC_LIMITS = {
     outputCoalesceMs: 100,
     /** `SIGTERM` -> `SIGKILL` escalation window for a graceful stop. */
     stopGraceMs: 3000,
+    /**
+     * How long to KEEP ASKING whether the `SIGKILL` actually landed before
+     * declaring the job `stopped`.
+     *
+     * THIS NUMBER IS NOT A GUESS ABOUT THE PLATFORM. `killTree` spawns `taskkill`,
+     * which is a process of its own: a Windows tree kill of a shell plus its node
+     * child measures ~0.8 s on the reference machine (while starting `cmd` costs
+     * 50 ms), so the fixed 250 ms this used to allow expired first and `stop()`
+     * reported `stopped` with the child still running - AC-18 caught exactly that.
+     * The wait stays BOUNDED against the opposite failure (a promise that never
+     * resolves); at this deadline the record keeps the honest `killIncomplete`
+     * flag instead.
+     */
+    killVerifyMs: 2000,
+    /** Liveness poll interval while waiting for a `SIGKILL` to land. */
+    killVerifyPollMs: 50,
     /** Below this many terminal columns the status chip degrades to `[N]`. */
     statusCompactCols: 92,
     // --- long-task-jobs: bounded waiting, progress, notices, log mirror --------