@vincemakes/kiso-code 0.10.0 → 0.12.0

package/dist/chat.d.ts

@@ -5,6 +5,7 @@
  * estimates. All bodies moved verbatim from index.ts.
  */
 import { type RunUsage } from "@vincemakes/kiso-tui";
+import { type SaferOption } from "@vincemakes/kiso-tui";
 import type { AgentSession, Run } from "@vincemakes/kiso-runtime";
 import { type LineInput } from "./state.js";
 /**
@@ -81,6 +82,21 @@ export declare function usageFromEvent(route: string | undefined, ev: import("@v
  *  first event. */
 export declare function startStatusSpinner(onTick: (glyph: string) => void): () => void;
 export declare function startShellTail(sessionId: string, callId: string, command: string, startedAt: number): () => void;
+/**
+ * Parse the model's answer DEFENSIVELY — anything unexpected is a
+ * failure, and a failure degrades honestly.
+ *
+ * The temptation here is to be clever: salvage a half-parse, coerce a
+ * string into a command, accept an object where an array was asked for.
+ * All of that produces a list of alternatives the model did not propose,
+ * shown to a human deciding whether to run a destructive command. The
+ * only honest failure mode is the dim line, so anything that is not
+ * exactly the requested shape returns null.
+ *
+ * A fenced code block is the one accommodation, because models emit it
+ * constantly and it changes no content.
+ */
+export declare function parseSaferOptions(text: string): SaferOption[] | null;
 /**
  * Consume a run, answering approval pauses as they arrive. `resumeMode`
  * marks a session.resume() continuation. `faux` picks the status line's

package/dist/chat.js

@@ -6,7 +6,7 @@
  */
 import { readFileSync, statSync } from "node:fs";
 import { escapeTerminal, cacheHitPct, idleStatus, palette, renderEvent, renderRecap, runningStatus, toolTarget, STATUS_GLYPHS, } from "@vincemakes/kiso-tui";
-import { editFileDiff, writeFileDiff } from "@vincemakes/kiso-tui";
+import { deletionRiskHint, editFileDiff, writeFileDiff } from "@vincemakes/kiso-tui";
 import { canonicalTargetPath, shellProgressPath } from "@vincemakes/kiso-tools-node";
 import { canonicalizeUsage } from "@vincemakes/kiso-runtime";
 import { dispatch } from "./dispatch.js";
@@ -178,24 +178,94 @@ function approvalDiff(name, input) {
         return null; // never let the diff break the approval
     }
 }
+/**
+ * TUI2-R3v2 ③ — the safer-options request: its prompt, and its parser.
+ *
+ * The prompt is deliberately small. It carries the pending call and
+ * nothing else — no conversation, no tools, no project context — because
+ * everything it does not send is rent the human pays for pressing a
+ * button, and because "propose a safer version of THIS command" is a
+ * question that needs no history to answer.
+ */
+/** TUI2-R3v2 ③: tools whose NEXT approval is the model's answer to a
+ *  refusal — the "(amended)" marker's source. Per process, cleared as
+ *  soon as it is shown: the marker describes ONE call, not a mode. */
+const amendedCalls = new Set();
+const SAFER_SYSTEM_PROMPT = [
+    "You propose safer alternatives to a single shell/tool call a human is being asked to approve.",
+    "Answer with JSON ONLY: an array of 2-3 objects, each {\"command\": string, \"why\": string}.",
+    '"command" is the full replacement call. "why" is ONE short plain-language line saying what it does differently.',
+    "Prefer alternatives that avoid irreversible deletion. If you cannot improve on it, answer [].",
+].join(" ");
+/**
+ * Parse the model's answer DEFENSIVELY — anything unexpected is a
+ * failure, and a failure degrades honestly.
+ *
+ * The temptation here is to be clever: salvage a half-parse, coerce a
+ * string into a command, accept an object where an array was asked for.
+ * All of that produces a list of alternatives the model did not propose,
+ * shown to a human deciding whether to run a destructive command. The
+ * only honest failure mode is the dim line, so anything that is not
+ * exactly the requested shape returns null.
+ *
+ * A fenced code block is the one accommodation, because models emit it
+ * constantly and it changes no content.
+ */
+export function parseSaferOptions(text) {
+    const fenced = text.match(/```(?:json)?\s*([\s\S]*?)```/);
+    const body = (fenced?.[1] ?? text).trim();
+    const start = body.indexOf("[");
+    const end = body.lastIndexOf("]");
+    if (start < 0 || end <= start)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(body.slice(start, end + 1));
+    }
+    catch {
+        return null;
+    }
+    if (!Array.isArray(parsed) || parsed.length === 0)
+        return null;
+    const out = [];
+    for (const item of parsed.slice(0, 3)) {
+        if (typeof item !== "object" || item === null)
+            return null;
+        const { command, why } = item;
+        if (typeof command !== "string" || command.trim() === "")
+            return null;
+        out.push({ command: command.trim(), why: typeof why === "string" ? why.trim() : "" });
+    }
+    return out.length === 0 ? null : out;
+}
 /** W21 — the panel view for a permission_requested: the rule line (the
  *  why-asked speaker + the §3.5 fix hint), the toolTarget title, the
  *  "▸ run paused" status, and the ALWAYS-verbose args. */
-function approvalView(name, ev) {
+function approvalView(name, ev, amended = false) {
     const speaker = ev.speaker ?? "kiso";
     const input = ev.input ?? {};
     // exactOptionalPropertyTypes: the hint is OMITTED when the speaker has
     // no fix (mode:accept-edits, shell in default) — never `hint: undefined`.
     const hint = fixHintFor(speaker, name);
+    // TUI2-R3v2 ④: the deletion-risk line, for shell calls whose command
+    // matches one of the four irreversible patterns. Local rules, no
+    // request, and absent for every other command — which is most of them.
+    const risk = name === "shell" ? deletionRiskHint(String(input.command ?? "")) : null;
     return {
         flavor: "approval",
         name,
         title: toolTarget(name, input),
         speaker,
         ...(hint !== undefined ? { hint } : {}),
+        ...(risk !== null ? { riskHint: risk } : {}),
         statusText: "▸ run paused",
         args: approvalArgs(name, input),
         fallbackQuestion: `approve ${escapeTerminal(name)}? (y/n) `,
+        // TUI2-R3v2 ③: the v4 frame's "(amended)" marker. It says WHY this
+        // call looks different from the one just refused — without it, a
+        // second approval for the same tool reads as the product asking
+        // twice rather than as the model answering.
+        ...(amended ? { amended: true } : {}),
     };
 }
 /** The panel's ALWAYS-verbose args: edit_file/write_file → the full ±
@@ -433,7 +503,21 @@ submitTurn) {
                     const name = ev.name;
                     body.toolApproval(ev.callId, approvalDiff(name, ev.input ?? {}));
                     const decisionId = ev.decisionId;
-                    const verdict = await askPanel(input, approvalView(name, ev));
+                    // TUI2-R3v2 ③: the on-demand alternatives provider. It is built
+                    // per approval and captured by the panel; it fires ONLY if the
+                    // human presses option 3, which is the whole zero-ambient-rent
+                    // mechanism — no press, no request, nothing in the trace.
+                    const safer = async () => {
+                        const answer = await session.sideQuery({
+                            purpose: "safer-options",
+                            systemPrompt: SAFER_SYSTEM_PROMPT,
+                            prompt: `the pending call is: ${name} ${JSON.stringify(ev.input ?? {})}`,
+                            maxTokens: 500,
+                        });
+                        return parseSaferOptions(answer);
+                    };
+                    const verdict = await askPanel(input, approvalView(name, ev, amendedCalls.has(name)), { safer });
+                    amendedCalls.delete(name);
                     switch (verdict.action) {
                         case "cancel": {
                             // round 10: a cancellation is a CONSERVATIVE denial,
@@ -465,6 +549,9 @@ submitTurn) {
                             if (verdict.reason.trim() !== "") {
                                 // No+words — the words become the tool_result; the
                                 // run continues with the model seeing the denial.
+                                // TUI2-R3v2 ③: whatever the model proposes next for
+                                // this tool IS the amended call, and the panel says so.
+                                amendedCalls.add(name);
                                 await session.approve(decisionId, false, verdict.reason);
                             }
                             else {

package/dist/index.js

@@ -154,8 +154,8 @@ function editorInput(editor) {
         },
         // W21: the panel — the editor's own state machine takes the
         // keys; the compositor renders it via the bound state.
-        panelAsk(view, onCommit) {
-            editor.beginPanel(view, onCommit);
+        panelAsk(view, onCommit, opts) {
+            editor.beginPanel(view, onCommit, opts);
         },
         panelCancel() {
             editor.cancelPanel();
@@ -202,6 +202,10 @@ function makeLineInput() {
         // "input lives here"; the line-mode path keeps the brick ▌, so
         // pipe bytes do not change)
         dock.bindInput(() => editor.dockState(), "› ");
+        // TUI2-R3v2 ②: the click hit-test's wiring — the compositor places
+        // the panel's option rows, so the compositor is what the editor asks
+        // where they are. Neither side computes the other's geometry.
+        editor.bindPanelRows(() => dock.panelOptionRows());
         dock.bindMenu(() => editor.menuState()); // v3 §04: the slash-command menu
         editor.bindAtItems(atFiles); // KC3 §5: the file source — listed per OPEN
         dock.bindAt(() => editor.atState()); // KC3 §4: the picker's band

package/dist/state.d.ts

@@ -5,7 +5,7 @@
  * creates the mutable ones (setBody / setAgentModel / setExtensionLists);
  * the moved modules read and mutate at call time.
  */
-import { Dock, type AtItem, type Body, type PanelVerdict, type PanelView, type SessionCardView } from "@vincemakes/kiso-tui";
+import { Dock, type AtItem, type Body, type PanelVerdict, type PanelView, type SaferOption, type SessionCardView } from "@vincemakes/kiso-tui";
 import type { KisoExtension, StoreRecord } from "@vincemakes/kiso-runtime";
 /** finding #11: KISO_HOME is the ONE root — every default path derives from
  *  it (sessions, trust, extensions, mcp config, skills). The dedicated
@@ -80,7 +80,12 @@ export interface LineInput {
     /** W21: open the approval panel — the editor's state machine takes
      *  the keys (the digits/y/n/tab/esc/enter routing, the rule input,
      *  the tab-amend), the compositor renders the block + the leads. */
-    panelAsk(view: PanelView, onCommit: (v: PanelVerdict) => void): void;
+    /** TUI2-R3v2 ③: `opts.safer` is the on-demand alternatives provider —
+     *  absent for every panel that has no such option (the ask, the pick,
+     *  the trust gate), so those buttons cannot exist to be pressed. */
+    panelAsk(view: PanelView, onCommit: (v: PanelVerdict) => void, opts?: {
+        safer?: () => Promise<readonly SaferOption[] | null>;
+    }): void;
     /** W21: cancel the panel — the SIGINT pair to panelAsk. */
     panelCancel(): void;
     /** TUI2-R2 ②: open the session picker — the editor takes the keys

package/dist/trust-ui.d.ts

@@ -5,7 +5,7 @@
  * chat.ts), the don't-ask-again rule writer, and the uncertain-execution
  * decisions. All bodies moved verbatim from index.ts.
  */
-import { type PanelVerdict, type PanelView } from "@vincemakes/kiso-tui";
+import { type PanelVerdict, type PanelView, type SaferOption } from "@vincemakes/kiso-tui";
 import type { AskUI } from "@vincemakes/kiso-ask-ext";
 import { type ProjectArtifacts } from "@vincemakes/kiso-runtime";
 import type { AgentSession } from "@vincemakes/kiso-runtime";
@@ -34,7 +34,9 @@ import { type LineInput } from "./state.js";
  * the dead question.
  */
 export declare let pendingAsk: (() => void) | null;
-export declare function askPanel(input: LineInput, view: PanelView): Promise<PanelVerdict>;
+export declare function askPanel(input: LineInput, view: PanelView, opts?: {
+    safer?: () => Promise<readonly SaferOption[] | null>;
+}): Promise<PanelVerdict>;
 /**
  * KC3.5 — the AskUI bridge: the panel the ask extension asks through.
  *

package/dist/trust-ui.js

@@ -38,7 +38,12 @@ import { getMode } from "./mode.js";
  * the dead question.
  */
 export let pendingAsk = null;
-export function askPanel(input, view) {
+export function askPanel(input, view, 
+// TUI2-R3v2 ③: the safer-options provider, when the caller has one.
+// Only the approval site passes it; every other panel (the ask, the
+// pick, the trust gate, the uncertain resolutions) omits it, so their
+// lists cannot grow a button they have no answer for.
+opts) {
     if (!process.stdin.isTTY) {
         console.log(`[non-interactive — no human to ask: ${view.fallbackQuestion}]`);
         return Promise.resolve({ action: "deny", reason: "no human to ask" });
@@ -63,7 +68,7 @@ export function askPanel(input, view) {
                 settled = true;
                 pendingAsk = null;
                 resolve(verdict);
-            });
+            }, opts);
         }
         else {
             // v2c: a TTY without a dock (rows < 4) — the fallback question

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vincemakes/kiso-code",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "kiso CLI — the durable coding agent that survives kill -9: kiso chat / kiso resume / kiso sessions.",
   "type": "module",
   "license": "MIT",
@@ -18,19 +18,19 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@vincemakes/kiso-ask-ext": "0.10.0",
-    "@vincemakes/kiso-core": "0.10.0",
-    "@vincemakes/kiso-evals": "0.10.0",
-    "@vincemakes/kiso-mcp-ext": "0.10.0",
-    "@vincemakes/kiso-provider-anthropic": "0.10.0",
-    "@vincemakes/kiso-provider-openai": "0.10.0",
-    "@vincemakes/kiso-runtime": "0.10.0",
-    "@vincemakes/kiso-skills-ext": "0.10.0",
-    "@vincemakes/kiso-subagent-ext": "0.10.0",
-    "@vincemakes/kiso-task-ext": "0.10.0",
-    "@vincemakes/kiso-tools-node": "0.10.0",
-    "@vincemakes/kiso-tui": "0.10.0",
-    "@vincemakes/kiso-tui-cells": "0.10.0"
+    "@vincemakes/kiso-ask-ext": "0.12.0",
+    "@vincemakes/kiso-core": "0.12.0",
+    "@vincemakes/kiso-evals": "0.12.0",
+    "@vincemakes/kiso-mcp-ext": "0.12.0",
+    "@vincemakes/kiso-provider-anthropic": "0.12.0",
+    "@vincemakes/kiso-provider-openai": "0.12.0",
+    "@vincemakes/kiso-runtime": "0.12.0",
+    "@vincemakes/kiso-skills-ext": "0.12.0",
+    "@vincemakes/kiso-subagent-ext": "0.12.0",
+    "@vincemakes/kiso-task-ext": "0.12.0",
+    "@vincemakes/kiso-tools-node": "0.12.0",
+    "@vincemakes/kiso-tui": "0.12.0",
+    "@vincemakes/kiso-tui-cells": "0.12.0"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",