@kontextmind/kxm 0.7.176 → 0.7.178

package/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "kxm",
       "source": "./plugins/kxm",
       "description": "Durable workflows, peer agents, and kxm tui",
-      "version": "0.7.176",
+      "version": "0.7.178",
       "category": "development",
       "tags": ["kxm", "multi-agent", "workflows", "mcp"]
     }

package/CHANGELOG.md

@@ -6,6 +6,16 @@ All notable user-facing changes are documented here. The project follows [Semant
 
 ### Added
 
+- **KXM configuration now has one owner-validated terminal editor.**
+  `kxm config edit --scope project|user` and OMP/Pi `/kxm config` publish the
+  same `kxm.config.v1` surface. Accepted writes are saved and re-read; rejected
+  values leave file bytes unchanged; clear removes only the selected scope's
+  override. Non-TTY and dry-run calls render one plain frame without writing.
+  The editor excludes endpoints, key references, credentials, arrays, dynamic
+  maps, roster, routes, gates, roles, and workflow definitions. Pi/OMP package
+  discovery now loads the tracked extension bundle, so the private TUI
+  workspace is bundled rather than becoming an unresolved runtime dependency.
+
 - **Hub project identity and its access key live in `.kxm/config.yaml`.**
   `hub.local` and `hub.cloud` hold the URL, the project id to present, and a
   key reference (`key.op` is an `op://` reference, `key.env` is an environment

package/docs/architecture/index.md

@@ -2,7 +2,8 @@
 
 Read from `plans/kxm-roadmap/state.json` and the pages linked below.
 
-Verified date: null. A review pass has not set `architecture.verified`.
+Verified date: 2026-10-11. The roadmap review checked every page listed here
+against the current checkout.
 
 | Page | What it covers |
 | --- | --- |

package/docs/architecture/inventory.md

@@ -1,15 +1,17 @@
 # Surfaces
 
-Read from `plugins/kxm/src/cli.ts`, `scripts/kxm-hub.mjs`, `plugins/kxm/src/hub.ts`,
-`plugins/kxm/src/runtime-supervisor.ts`, `plugins/kxm/src/runtime-paths.ts`,
-`plugins/kxm/src/mcp-server.ts`, `plugins/kxm/src/oneshot-producer.ts`,
-`plugins/kxm/src/studio-layout.ts`, `plugins/kxm/src/cli/types.ts`
-(`workspaceDirs`), `plugins/kxm/src/local-snapshot.ts`, and
-`scripts/kxm-worker.mjs`.
+Read from `plugins/kxm/src/cli.ts`, `plugins/kxm/src/config-editor.ts`,
+`plugins/kxm/src/extension.ts`, `scripts/kxm-hub.mjs`,
+`plugins/kxm/src/hub.ts`, `plugins/kxm/src/runtime-supervisor.ts`,
+`plugins/kxm/src/runtime-paths.ts`, `plugins/kxm/src/mcp-server.ts`,
+`plugins/kxm/src/oneshot-producer.ts`, `plugins/kxm/src/studio-layout.ts`,
+`plugins/kxm/src/cli/types.ts` (`workspaceDirs`),
+`plugins/kxm/src/local-snapshot.ts`, and `scripts/kxm-worker.mjs`.
 
 | Surface | Started by | Listener or path | Store it owns | Defining file |
 | --- | --- | --- | --- | --- |
 | `kxm` CLI | `node scripts/kxm.mjs` or the installed bin | no listener | none | `plugins/kxm/src/cli.ts` |
+| Configuration editor | `kxm config edit --scope project\|user`; OMP/Pi `/kxm config` uses project scope | `.kxm/config.yaml` or the user `config.yaml` | the selected config file; only bounded non-secret scalar fields | `plugins/kxm/src/config-editor.ts` |
 | Hub | `kxm hub start` via `scripts/kxm-hub.mjs` | `127.0.0.1:7331` | `.kxm/state/kxm.db` under the workspace state dir | `plugins/kxm/src/hub.ts` |
 | Hub credentials | written when the hub starts | `hub-env.json` under the user state root | that JSON file, not SQLite | `plugins/kxm/src/hub-env.ts` |
 | Hub cloud binding | `kxm hub bind <url> --cloud --token-env/--token-command` | no listener; writes the binding record and never stores the token | binding record; token stays in the named env or command | `plugins/kxm/src/cli/hub.ts` |

package/docs/contributing/development.md

@@ -170,8 +170,10 @@ see the [plugin README](../../plugins/kxm/README.md).
 ### Pi package
 
 The root `package.json` carries the `pi-package` keyword and a `pi` block:
-`pi.extensions` lists `./plugins/kxm/src/extension.ts` and `pi.skills` lists
-`./plugins/kxm/skills`. Pi loads the TypeScript source itself.
+`pi.extensions` lists the tracked `./plugins/kxm/dist/extension.js` bundle and
+`pi.skills` lists `./plugins/kxm/skills`. Development can still load
+`plugins/kxm/src/extension.ts` explicitly; published installs use the bundle so
+private workspace packages are never unresolved runtime dependencies.
 
 ### Agent Skills
 

package/docs/contributing/test-matrix.md

@@ -135,6 +135,7 @@ The context suites in detail:
 |---|---|
 | `init`, `validate`, `export` and `watch` in isolated workspaces | `cli.test.ts`, `github-watch.test.ts` |
 | Every mutating command under `--dry-run` leaves the workspace, state root and hub untouched | `cli-experience.test.ts` ("every mutating command under --dry-run leaves the workspace, state root, and hub untouched") |
+| Owner-validated config editor: persisted writes, exact-byte refusals, scope inheritance, scalar-only publication, CLI frames, and OMP/Pi lifecycle | `config-editor.test.ts` |
 | Hub auto-start reuses a healthy or claimed hub, persists one admin key, and fails closed on bad claims | `hub-autostart.test.ts` |
 | Hub-local session brief from SQLite without message bodies; `hub bind` reports on, off or unknown | `session-work.test.ts`, `cli.test.ts` |
 | Session manifests, fail-closed rosters, worker and result envelopes, hub-owned envelope fields | `session.test.ts`, `cli.test.ts`, `envelope.test.ts`, `envelope-contract.test.ts` |

package/docs/contributing/tui-components.md

@@ -8,10 +8,10 @@ The kit is the workspace package
 [`packages/core/tui`](../../packages/core/tui) (`@kontextmind/tui`), also
 published on the product as `@kontextmind/kxm/tui`. It is one declarative
 surface model, one renderer, one input decoder, one contribution registry, and
-thin host adapters. Today `kxm dash` uses only its ANSI theme; the panel,
-registry and adapters are exported for integrators, and no shipped `kxm` command
-draws a panel yet. See [Packages and workspaces](packages.md) for the layout
-convention it follows.
+thin host adapters. `kxm config edit --scope project|user` and OMP/Pi
+`/kxm config` ship the first production panel on this kit. `kxm dash` uses its
+ANSI theme but keeps its existing hub and SSE loop. See
+[Packages and workspaces](packages.md) for the layout convention the kit follows.
 
 ## Package layout
 
@@ -99,6 +99,24 @@ The reducer is pure
 effects; the component layer runs them. That is the same contract that keeps
 `kxm dash` navigation testable, and it is why no key handling needs a terminal.
 
+## Shipped configuration editor
+
+The `kxm/config` contribution in
+[`config-editor.ts`](../../plugins/kxm/src/config-editor.ts) owns the supported
+`kxm.config.v1` fields. Both `kxm config edit` and `/kxm config` register that
+same contribution; the CLI uses the standalone adapter, while the OMP/Pi
+extension uses the generic Pi custom panel.
+
+Project scope shows built-in, user, then project values. User scope deliberately
+shows only built-in and user values, so a project override cannot make a
+successful user edit look unchanged. Clear deletes the selected scope's key;
+the registry then re-reads the inherited value from disk.
+
+The descriptor exposes only bounded scalar preferences. It does not expose hub
+URLs, key references, credentials, arrays, dynamic maps, roster, routes, gates,
+roles, or workflow definitions. Unknown section/field pairs and invalid values
+are rejected before the config writer runs.
+
 ## Adding a surface
 
 1. Write the descriptor table. Each row is one setting: id, key path, label,

package/docs/reference/cli-reference.md

@@ -101,7 +101,7 @@ kxm -V
 `--dry-run` changes nothing: no file is written, deleted, or moved, no request that changes hub or Runtime state is sent, no process is started, and no remote command runs. A command that cannot say what it would do without doing some of it refuses the flag instead of acting.
 
 - Plan with `planned`: `backup`, `restore`, `config set`, `role add|remove|modify|resume`, `workflow add|remove|modify`, `goal create`, `task create|run|sync`, `memory note|sync`, `skills evaluate|promote|reject`, `context promote`, `context wiki-compile --out`, `auth token`, `session token`, `session brief`, and `ssh run|file|close`. Each prints its normal result plus `dryRun: true` and `planned`, a list of `{action, target}` entries whose `action` is `write`, `delete`, `move`, `request`, or `ssh`. Text mode prints `dry run: <summary>` and one indented `would <action> <target>` line per entry (`session brief` appends `dry run: would write <file>` lines to the brief instead).
-- Plan in their own shape (described in each section): `init`, `run`, `runs drive|cancel`, `docs build|serve`, `runtime start|stop|sync-retry`, `hub start|stop|bind|unbind`, `session start|stop`, `agent worker`, `dash`, `studio serve`, `models inventory-refresh`, `routes admit|disable`, `update`, `completion install`, `workflow start|signal|export|checkpoint|record|wait`, every `peer` subcommand, `gate degrade|signal`, `skills create`, and `improve report`. `gate github watch --dry-run` still polls GitHub but does not post the signal.
+- Plan in their own shape (described in each section): `init`, `run`, `runs drive|cancel`, `docs build|serve`, `runtime start|stop|sync-retry`, `hub start|stop|bind|unbind`, `session start|stop`, `agent worker`, `dash`, `studio serve`, `models inventory-refresh`, `routes admit|disable`, `update`, `completion install`, `workflow start|signal|export|checkpoint|record|wait`, every `peer` subcommand, `gate degrade|signal`, `skills create`, `improve report`, and `config edit`. `config edit --dry-run` prints one plain frame and writes nothing. `gate github watch --dry-run` still polls GitHub but does not post the signal.
 - Read-only commands run as usual, without leaving a trace: a local SQLite store is opened without creating `-wal` or `-shm` files, and `runs status|list|receipt` only attach to a running Runtime supervisor. With no supervisor running they exit 2 with `dry_run_unsupported` instead of starting one. `context wiki-compile --dry-run` still asks the hub to compile, which is a read.
 - Refused: `kxm models` (the interactive screen) and `kxm prices acknowledge` exit 2 with `dry_run_unsupported`. The CLI keeps one list of the commands that answer `--dry-run` and refuses every other command the same way before it runs, so a command added without dry-run support fails closed.
 
@@ -339,6 +339,34 @@ Stop harness extensions from starting a hub (Not run):
 kxm config set hub.autoStart off --scope user
 ```
 
+### `kxm config edit`
+
+```text
+kxm config edit --scope project|user
+```
+
+Opens the terminal editor for one fixed list of scalar `kxm.config.v1` preferences. The same editor is `/kxm config` inside the OMP/Pi TUI, and that command mounts only when the session mode is `tui`.
+
+| Option | Argument | Default | Description |
+|---|---|---|---|
+| `--scope` | `project` or `user` | none | Which file a write or clear changes. Required |
+
+- `--scope project` writes `.kxm/config.yaml` and shows built-in, then user, then project. `--scope user` writes `$KXM_USER_CONFIG_DIR/config.yaml` (default `~/.config/kxm/config.yaml`) and shows built-in, then user. The project file does not mask the user view.
+- A write checks the section and field together, then checks the value. A refusal leaves that file's bytes unchanged. Clear deletes only that scope's key.
+- The editor accepts workflow and harness ids that contain `@`. Whitespace and control characters are refused.
+- A stored scalar whose runtime type does not match the field is shown with `stored type does not match this field`. The text `true` is not a boolean.
+- It does not edit hub URLs, key references, credentials, arrays, dynamic maps, roster, routes, gates, roles, or workflow YAML. `kxm config get`, `set`, and `list` are unchanged and still accept keys this editor does not.
+- No TTY, and `--dry-run`, each print one plain frame and write nothing. `--json`, or a scope other than `project` or `user`, exits 2 and writes nothing.
+
+```bash
+kxm config edit --scope project --dry-run
+```
+
+```text
+KXM configuration
+...
+```
+
 ## `kxm completion`
 
 ```text

package/docs/reference/config-reference.md

@@ -1315,6 +1315,14 @@ every reader found in `plugins/kxm/src`, `scripts/`, and `packages/`; the
 | `telemetry.anonymize` | Boolean | `true` | Not read by any code path yet |
 | `telemetry.userTelemetryDir` | Path | none | Not read by any code path yet |
 
+The terminal editor exposes a fixed non-secret scalar subset of this table:
+theme and token budget; default workflow and harness; dashboard settings;
+default tracker; hub auto-start; improvement policy and thresholds; shadow
+execution and circuit-breaker scalars; and federated/anonymized telemetry
+flags. It deliberately excludes arrays, dynamic maps, paths, sync-provider
+details, hub endpoints and key references, credentials, and trusted roster,
+route, gate, role, or workflow-definition files.
+
 Under `auto_threshold`, `minRuns`, `minPassRate` and `minCostSavings` are the
 distinct runs, the accepted share, and the mean recorded cost per attempt a
 candidate needs before `kxm improve` reports it ready for review. A group with
@@ -1376,9 +1384,15 @@ Commands:
 - `kxm config list` prints `user`, `defaults`, `dash`, `sync`, and
   `loadedFrom`; `--json` prints every section. An empty `loadedFrom` means no
   file was found.
-
-There is no `kxm config unset`. Delete the key from the file to fall back to
-the next layer; setting `null` stores `null`.
+- `kxm config edit --scope project|user` opens the owner-validated terminal
+  editor. Project scope shows Base → User → Project; user scope shows Base →
+  User so a project override cannot mask the edit. Clear deletes that scope's
+  leaf and re-reads the inherited value. Non-TTY and `--dry-run` calls print one
+  plain frame without writing. Invalid scope and `--json` are refused.
+
+There is no standalone `kxm config unset` command. The editor's clear action
+deletes its supported key from the selected scope; for other keys, delete the
+key from the file. Setting `null` stores `null` and does not mean inherit.
 
 ### Configuration layers
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontextmind/kxm",
-  "version": "0.7.176",
+  "version": "0.7.178",
   "description": "KXM local-first multi-agent orchestration and operator dashboard",
   "type": "module",
   "author": "KontextMind",
@@ -70,7 +70,7 @@
   },
   "pi": {
     "extensions": [
-      "./plugins/kxm/src/extension.ts"
+      "./plugins/kxm/dist/extension.js"
     ],
     "skills": [
       "./plugins/kxm/skills"
@@ -78,7 +78,7 @@
   },
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.3.289",
-    "@earendil-works/pi-tui": "0.87.1",
+    "@earendil-works/pi-tui": "1.0.2",
     "@modelcontextprotocol/sdk": "1.32.0",
     "yaml": "^2.9.0"
   },
@@ -95,7 +95,7 @@
     }
   },
   "devDependencies": {
-    "@earendil-works/pi-coding-agent": "0.87.1",
+    "@earendil-works/pi-coding-agent": "1.0.2",
     "@modelcontextprotocol/sdk": "1.32.0",
     "@playwright/test": "1.63.0",
     "@types/node": "26.6.4",

package/plugins/kxm/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "kxm",
   "displayName": "KXM",
-  "version": "0.7.176",
+  "version": "0.7.178",
   "description": "Headless multi-agent orchestration, durable workflows, and a live operator dashboard for Pi and Claude Code",
   "author": {
     "name": "KontextMind",

package/plugins/kxm/dist/claude-hook.js

@@ -1275,7 +1275,7 @@ function sessionBriefPickerEnabled(input) {
 function parseKxmSlashArgs(args) {
   const raw = String(args ?? "").trim().toLowerCase();
   if (raw === "" || raw === "brief") return "brief";
-  if (raw === "status" || raw === "hub" || raw === "memory" || raw === "progress" || raw === "workflow" || raw === "help") return raw;
+  if (raw === "status" || raw === "hub" || raw === "memory" || raw === "progress" || raw === "workflow" || raw === "config" || raw === "help") return raw;
   return "help";
 }
 function kxmSlashCompletions(prefix) {
@@ -1295,7 +1295,7 @@ var init_session_work = __esm({
     MAX_SESSION_BRIEF_PLANS = 5;
     SESSION_BRIEF_SCHEMA = "kxm.session-brief.v1";
     DEFAULT_SESSION_BRIEF_STALE_SECONDS = 5;
-    KXM_SLASH_SUBCOMMANDS = ["status", "hub", "memory", "progress", "workflow", "help"];
+    KXM_SLASH_SUBCOMMANDS = ["status", "hub", "memory", "progress", "workflow", "config", "help"];
   }
 });
 
@@ -9182,6 +9182,7 @@ function loadKxmConfig(repoRoot = process.cwd(), options = {}) {
   const userConfigFile = join6(userDir, "config.yaml");
   const repoDir = repoConfigDirectory(repoRoot);
   const repoConfigFile = join6(repoDir, "config.yaml");
+  const includeProject = options.layers !== "user";
   let userRaw = {};
   let userLoadedPath;
   if (existsSync7(userConfigFile)) {
@@ -9195,7 +9196,7 @@ function loadKxmConfig(repoRoot = process.cwd(), options = {}) {
   }
   let repoRaw = {};
   let repoLoadedPath;
-  if (existsSync7(repoConfigFile)) {
+  if (includeProject && existsSync7(repoConfigFile)) {
     try {
       const text = readFileSync7(repoConfigFile, "utf8");
       repoRaw = (0, import_yaml2.parse)(text) ?? {};