@vincemakes/kiso-code 0.1.43 → 0.1.45

package/dist/builtin.d.ts

@@ -0,0 +1,2 @@
+import type { KisoExtension } from "@vincemakes/kiso-runtime";
+export declare function builtInLayer(user: readonly KisoExtension[], project: readonly KisoExtension[]): Promise<readonly KisoExtension[]>;

package/dist/builtin.js

@@ -0,0 +1,31 @@
+/**
+ * R-D 0.1.45 — the built-in layer: the four official extensions (mcp,
+ * skills, subagent, task), shipped in the cli package and registered by
+ * MODULE IMPORT — never a disk scan (the user layer's loadExtensions stays
+ * word-for-word untouched). The cascade, base → top: built-in → user
+ * (~/.kiso/extensions) → project (.kiso/extensions, trust-gated).
+ *
+ *  - a user extension may SHADOW a built-in by name — the user's deliberate
+ *    install wins (a built-in cannot be uninstalled), loudly, and the
+ *    shadowed built-in leaves the loaded set and the banner;
+ *  - the project layer may NOT shadow anything below — the same-name
+ *    refusal the loader already applies to the user layer, spelled out
+ *    for the built-in layer too.
+ */
+import createMcp from "@vincemakes/kiso-mcp-ext";
+import createSkills from "@vincemakes/kiso-skills-ext";
+import createSubagent from "@vincemakes/kiso-subagent-ext";
+import createTask from "@vincemakes/kiso-task-ext";
+export async function builtInLayer(user, project) {
+    const all = await Promise.all([createMcp(), createSkills(), createSubagent(), createTask()]);
+    const shadowed = all.filter((b) => user.some((u) => u.name === b.name));
+    for (const s of shadowed) {
+        console.error(`[extensions] user extension "${s.name}" shadows the built-in — the built-in is not loaded`);
+    }
+    for (const p of project) {
+        if (all.some((b) => b.name === p.name)) {
+            throw new Error(`[extensions] extension name "${p.name}" exists in both the built-in and the project-level extensions — refusing to shadow`);
+        }
+    }
+    return all.filter((b) => !shadowed.includes(b));
+}

package/dist/first-run.d.ts

@@ -0,0 +1,9 @@
+/** First-run detection. Called only post-gate, so the verdict precedes
+ *  even the first home READ. */
+export declare function isFirstRun(): boolean;
+/** Materialize the config surface (never clobbering a user's own config)
+ *  and stamp the sentinel — the sequence's second home write. SILENT on
+ *  purpose: every stream line must match a known cell format (the v2d
+ *  lint), and the PTY grids pin the startup stream byte-for-byte — the
+ *  first-run sequence is evidenced by the FILES, not an announcement. */
+export declare function scaffoldFirstRun(): void;

package/dist/first-run.js

@@ -0,0 +1,37 @@
+/**
+ * R-D 0.1.45 (deliverable B) — the first-run scaffold. A fresh install's
+ * FIRST startup materializes the config surface (the file the faux-mode
+ * notice names) and stamps the sentinel that ends first-run.
+ *
+ * Runs AFTER the E3 trust gate: pre-trust zero-read/write/scan is
+ * absolute — the trust question is the process's first home access of
+ * any kind, the trust record the first home write, the scaffold the
+ * second. First-run detection never precedes the verdict.
+ */
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { kisoHome } from "./state.js";
+/** The sentinel: present = the home has seen the 0.1.45 first-run
+ *  sequence (its config surface exists — no re-scaffold, no re-note). */
+const SENTINEL = "first-run";
+/** The minimal config surface — an empty models layer changes nothing
+ *  (faux stays the default), but the file the notice points at exists. */
+const CONFIG_SCAFFOLD = `${JSON.stringify({ models: {} }, null, 2)}\n`;
+/** First-run detection. Called only post-gate, so the verdict precedes
+ *  even the first home READ. */
+export function isFirstRun() {
+    return !existsSync(join(kisoHome(), SENTINEL));
+}
+/** Materialize the config surface (never clobbering a user's own config)
+ *  and stamp the sentinel — the sequence's second home write. SILENT on
+ *  purpose: every stream line must match a known cell format (the v2d
+ *  lint), and the PTY grids pin the startup stream byte-for-byte — the
+ *  first-run sequence is evidenced by the FILES, not an announcement. */
+export function scaffoldFirstRun() {
+    const home = kisoHome();
+    mkdirSync(home, { recursive: true });
+    const config = join(home, "config.json");
+    if (!existsSync(config))
+        writeFileSync(config, CONFIG_SCAFFOLD, "utf8");
+    writeFileSync(join(home, SENTINEL), "", "utf8");
+}

package/dist/index.js

@@ -22,8 +22,9 @@
  * index.ts keeps the entry: banner, input sources, the A area prompt,
  * makeAgent, and main.
  */
-import { readFileSync, rmSync } from "node:fs";
+import { readFileSync, realpathSync, rmSync } from "node:fs";
 import { createInterface } from "node:readline";
+import { fileURLToPath } from "node:url";
 import { join } from "node:path";
 import { Body, Editor, bannerLines, palette, renderSessionLine } from "@vincemakes/kiso-tui";
 import { escapeTerminal } from "@vincemakes/kiso-tui";
@@ -31,8 +32,10 @@ import { createAgent, disposeExtensions, loadExtensions, loadProjectExtensions,
 import { createFauxProvider } from "@vincemakes/kiso-evals";
 import { createCodingTools } from "@vincemakes/kiso-tools-node";
 import { MODES, modeExtensions, modeFromEnv, modeSystemPrompt, setMode } from "./mode.js";
-import { body, bodyLog, currentFaux, dock, extensionsDir, loadedExtensions, mergedConfig, mergedTempPaths, projectExtensions, sessionsDir, setAgentModel, setBody, setConfigModels, setConfiguredWindow, setCurrentAgentExtensions, setCurrentFaux, setCurrentModelName, setExtensionLists, setMergedConfig, userExtensions, VERSION } from "./state.js";
+import { builtInLayer } from "./builtin.js";
+import { body, bodyLog, builtInExtensions, currentFaux, dock, extensionsDir, loadedExtensions, mergedConfig, mergedTempPaths, projectExtensions, sessionsDir, setAgentModel, setBody, setConfigModels, setConfiguredWindow, setCurrentAgentExtensions, setCurrentFaux, setCurrentModelName, setExtensionLists, setMergedConfig, userExtensions, VERSION } from "./state.js";
 import { interactivePrompt, resolveProjectTrust } from "./trust-ui.js";
+import { isFirstRun, scaffoldFirstRun } from "./first-run.js";
 import { fauxSkip, readFauxScript } from "./faux-glue.js";
 import { autoCompactFromEnv, chat, contextWindowTokens } from "./chat.js";
 import { loadProjectConfig, loadUserConfig, mergeConfigs, resolveAutoCompact, resolveContextWindow, resolveModel } from "./config.js";
@@ -188,17 +191,21 @@ function makeLineInput() {
     }
     return readlineInput(createInterface({ input: process.stdin, output: process.stdout }));
 }
-/** E3: the `[N extensions: ...]` text — user-level names, then project-level
- *  ones marked with `project:`. Byte-identical to the historical text when
- *  no project extensions are loaded. */
+/** R-D 0.1.45: the `[N extensions: ...]` text — the built-in column, then
+ *  the user-level names, then the project-level ones marked `project:`.
+ *  The built-in column is the banner's truthful face of the built-in layer:
+ *  a fresh install reads `[4 extensions: built-in: mcp, skills, subagent,
+ *  task]` with zero disk setup. */
 function bannerExtensionText() {
-    const total = userExtensions.length + projectExtensions.length;
+    const total = builtInExtensions.length + userExtensions.length + projectExtensions.length;
     if (total === 0)
         return "";
     const parts = [];
     // 0.1.26 (MCP lazy connection): an extension with a live `connecting` flag shows
     // its in-flight state in the banner — "mcp (connecting…)".
     const label = (e) => e.connecting === true ? `${e.name} (connecting…)` : e.name;
+    if (builtInExtensions.length > 0)
+        parts.push(`built-in: ${builtInExtensions.map(label).join(", ")}`);
     if (userExtensions.length > 0)
         parts.push(userExtensions.map(label).join(", "));
     if (projectExtensions.length > 0)
@@ -290,22 +297,29 @@ export function composeSystemPrompt(cwd) {
     const injected = readProjectInstructions(cwd);
     return injected === "" ? SYSTEM_PROMPT : `${SYSTEM_PROMPT}\n${injected}`;
 }
-async function makeAgent(fauxSkipTurns = 0, input, modelFlag) {
-    const store = new SessionStore(sessionsDir());
+async function makeAgent(sessionId, input, modelFlag) {
     // E3: the project-level trust gate runs BEFORE any extension load (the
     // mcp/skills merges must be in the env when the user-level extensions
     // load). Untrusted project capability is never loaded — never silently.
     const project = input !== undefined ? await resolveProjectTrust(input) : await resolveProjectTrust(undefined);
+    // R-D 0.1.45 (deliverable B): the first-run scaffold lands AFTER the
+    // verdict — pre-trust zero-read/write/scan is absolute. The sessions
+    // dir (SessionStore's constructor mkdirs) moved behind the gate too:
+    // the trust record is the first home write, the scaffold the second.
+    if (isFirstRun())
+        scaffoldFirstRun();
+    const store = new SessionStore(sessionsDir());
+    // E area: the durable script position — computed AFTER the verdict
+    // (fauxSkip's session-log read is a home read: pre-trust zero-read).
+    const fauxSkipTurns = sessionId === undefined ? 0 : fauxSkip(sessionId);
     // E1: the startup extension scan — a broken extension fails the process
     // LOUDLY here (loadExtensions throws), never silently.
     const user = await loadExtensions(extensionsDir());
-    if (project !== null) {
-        const proj = await loadProjectExtensions(process.cwd(), user);
-        setExtensionLists(user, proj, [...user, ...proj]);
-    }
-    else {
-        setExtensionLists(user, [], user);
-    }
+    const proj = project !== null ? await loadProjectExtensions(process.cwd(), user) : [];
+    // R-D 0.1.45: the built-in layer registers by module import (builtin.ts)
+    // — a user extension may shadow a built-in, a project one may not.
+    const builtIn = await builtInLayer(user, proj);
+    setExtensionLists(builtIn, user, proj, [...builtIn, ...user, ...proj]);
     // merge round B — the config surface: user config + (trusted) project config,
     // resolved with flags > env > project > user > default. The CLI never
     // imports provider SDKs directly — the runtime's lazy provider
@@ -445,7 +459,7 @@ async function main() {
                 dock.enter();
                 // E area: a resumed session continues the script at its durable
                 // position — never restarts it (fauxSkip).
-                const agent = await makeAgent(fauxSkip(id), input, modelFlag);
+                const agent = await makeAgent(id, input, modelFlag);
                 applyConfigMode();
                 const session = await agent.session({ id });
                 bodyLog(`session ${id}\n`);
@@ -463,7 +477,7 @@ async function main() {
                 // (argv = [node, script, resume, id, prompt?]).
                 const prompt = process.argv[4];
                 dock.enter();
-                const agent = await makeAgent(fauxSkip(arg), input, modelFlag);
+                const agent = await makeAgent(arg, input, modelFlag);
                 applyConfigMode();
                 const session = await agent.session({ id: arg });
                 faux = currentFaux;
@@ -471,7 +485,7 @@ async function main() {
                 break;
             }
             case "sessions": {
-                const agent = await makeAgent(0, undefined, modelFlag);
+                const agent = await makeAgent(undefined, undefined, modelFlag);
                 for (const meta of agent.sessions()) {
                     console.log(renderSessionLine(meta));
                 }
@@ -494,7 +508,7 @@ async function main() {
                 // chat — the first argument is the session id.
                 const id = command ?? new Date().toISOString().replace(/[:.]/g, "-").slice(0, 16);
                 dock.enter();
-                const agent = await makeAgent(fauxSkip(id));
+                const agent = await makeAgent(id);
                 const session = await agent.session({ id });
                 bodyLog(`session ${id}\n`);
                 extensionsBanner(recentSessions(id, agent));
@@ -528,14 +542,22 @@ async function main() {
         }
     }
 }
-main()
-    .then(() => process.exit(0))
-    .catch((err) => {
-    // round 10: top-level errors are terminal-escaped. v2a: the exit is EXPLICIT
-    // — natural drain is racy on a TTY (readline leaves the stdio handles
-    // active and the loop sometimes never drains). main's finally already
-    // ran (agent.close, dispose, temp cleanup) — nothing is skipped, no
-    // lock is left behind; the exit code is honest.
-    console.error(escapeTerminal(err instanceof Error ? err.message : String(err)));
-    process.exit(1);
-});
+// R-D 0.1.45 (deliverable B): main runs ONLY as the entry — the CLI is
+// import-clean. The unconditional module-scope run executed the full
+// startup under the importing process's argv and REAL home whenever a
+// test imported src/index.js for its functions (harmless before the
+// first-run scaffold existed; the scaffold WRITES the home). The bin is
+// a symlink, so argv[1] is realpathed before the comparison.
+if (process.argv[1] !== undefined && realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)) {
+    main()
+        .then(() => process.exit(0))
+        .catch((err) => {
+        // round 10: top-level errors are terminal-escaped. v2a: the exit is EXPLICIT
+        // — natural drain is racy on a TTY (readline leaves the stdio handles
+        // active and the loop sometimes never drains). main's finally already
+        // ran (agent.close, dispose, temp cleanup) — nothing is skipped, no
+        // lock is left behind; the exit code is honest.
+        console.error(escapeTerminal(err instanceof Error ? err.message : String(err)));
+        process.exit(1);
+    });
+}

package/dist/state.d.ts

@@ -87,13 +87,17 @@ export declare let currentModelName: string;
 export declare function setCurrentModelName(value: string): void;
 /** E1: the extensions loaded by makeAgent — their names feed the banner. */
 export declare let loadedExtensions: readonly KisoExtension[];
+/** R-D 0.1.45: the BUILT-IN layer — the four official extensions, shipped
+ *  with the cli (module imports, never a disk scan; builtin.ts). The
+ *  banner's marked column; a user extension may shadow a built-in. */
+export declare let builtInExtensions: readonly KisoExtension[];
 /** E1: the USER-level extensions alone — the banner's unmarked part (E3:
  *  loadedExtensions later includes the project-level ones too). */
 export declare let userExtensions: readonly KisoExtension[];
 /** E3: the PROJECT-level extensions (loaded after the trust gate) — the
  *  banner distinguishes them from the user-level ones. */
 export declare let projectExtensions: readonly KisoExtension[];
-export declare function setExtensionLists(user: readonly KisoExtension[], project: readonly KisoExtension[], loaded: readonly KisoExtension[]): void;
+export declare function setExtensionLists(builtIn: readonly KisoExtension[], user: readonly KisoExtension[], project: readonly KisoExtension[], loaded: readonly KisoExtension[]): void;
 /** W21: the CURRENT agent's extensions array — set by makeAgent, the
  *  don't-ask-again writer pushes the generated extension into it so a
  *  first-time rule joins the chain at the NEXT run (the run's policies

package/dist/state.js

@@ -78,13 +78,18 @@ export function setCurrentModelName(value) {
 }
 /** E1: the extensions loaded by makeAgent — their names feed the banner. */
 export let loadedExtensions = [];
+/** R-D 0.1.45: the BUILT-IN layer — the four official extensions, shipped
+ *  with the cli (module imports, never a disk scan; builtin.ts). The
+ *  banner's marked column; a user extension may shadow a built-in. */
+export let builtInExtensions = [];
 /** E1: the USER-level extensions alone — the banner's unmarked part (E3:
  *  loadedExtensions later includes the project-level ones too). */
 export let userExtensions = [];
 /** E3: the PROJECT-level extensions (loaded after the trust gate) — the
  *  banner distinguishes them from the user-level ones. */
 export let projectExtensions = [];
-export function setExtensionLists(user, project, loaded) {
+export function setExtensionLists(builtIn, user, project, loaded) {
+    builtInExtensions = builtIn;
     userExtensions = user;
     projectExtensions = project;
     loadedExtensions = loaded;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vincemakes/kiso-code",
-  "version": "0.1.43",
+  "version": "0.1.45",
   "description": "kiso CLI — the coding-agent reference product: kiso chat / kiso resume / kiso sessions.",
   "type": "module",
   "license": "MIT",
@@ -18,12 +18,16 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@vincemakes/kiso-core": "0.1.34",
-    "@vincemakes/kiso-evals": "0.1.35",
-    "@vincemakes/kiso-provider-anthropic": "0.1.35",
-    "@vincemakes/kiso-provider-openai": "0.1.35",
-    "@vincemakes/kiso-runtime": "0.1.35",
-    "@vincemakes/kiso-tools-node": "0.1.35",
+    "@vincemakes/kiso-core": "0.1.35",
+    "@vincemakes/kiso-evals": "0.1.36",
+    "@vincemakes/kiso-mcp-ext": "0.1.45",
+    "@vincemakes/kiso-provider-anthropic": "0.1.36",
+    "@vincemakes/kiso-provider-openai": "0.1.36",
+    "@vincemakes/kiso-runtime": "0.1.36",
+    "@vincemakes/kiso-skills-ext": "0.1.45",
+    "@vincemakes/kiso-subagent-ext": "0.1.45",
+    "@vincemakes/kiso-task-ext": "0.1.45",
+    "@vincemakes/kiso-tools-node": "0.1.36",
     "@vincemakes/kiso-tui": "0.1.42",
     "@vincemakes/kiso-tui-cells": "0.1.42"
   },