@vincemakes/kiso-code 0.11.0 → 0.13.0

package/dist/chat.d.ts

@@ -5,6 +5,7 @@
  * estimates. All bodies moved verbatim from index.ts.
  */
 import { type RunUsage } from "@vincemakes/kiso-tui";
+import { type SaferFailure, type SaferOption } from "@vincemakes/kiso-tui";
 import type { AgentSession, Run } from "@vincemakes/kiso-runtime";
 import { type LineInput } from "./state.js";
 /**
@@ -81,6 +82,68 @@ export declare function usageFromEvent(route: string | undefined, ev: import("@v
  *  first event. */
 export declare function startStatusSpinner(onTick: (glyph: string) => void): () => void;
 export declare function startShellTail(sessionId: string, callId: string, command: string, startedAt: number): () => void;
+/**
+ * R3v2-F1: the format contract, stated FIRMLY. The first cut asked for
+ * "JSON ONLY" and left it there, which a verbose model reads as a
+ * preference — it wrote three sentences of preamble, opened a fence, and
+ * the cap ended the reply mid-string. Forbidding prose, naming the exact
+ * schema, and giving the nothing-is-safer case its own literal answer
+ * are all the same instruction: there is one thing to emit and no room
+ * to be helpful in the margins.
+ *
+ * The schema is an ENVELOPE rather than a bare array because a single
+ * top-level object leaves the model nowhere to put a preamble.
+ */
+export declare const SAFER_SYSTEM_PROMPT: string;
+/**
+ * R3v2-F1: the side query's output ceiling — raised from 500, which was
+ * the cap the live failures hit EXACTLY.
+ *
+ * The JSON-only reply the prompt now asks for is about 200 tokens for
+ * three alternatives, so this ceiling is a runaway guard and not a
+ * budget the answer is expected to approach: it exists so a model that
+ * ignores the contract and writes an essay still stops, not so the
+ * answer has room. Output is billed only when generated, and the query
+ * fires only on a press, so the raise costs nothing on the path that
+ * works and removes the one that could not.
+ */
+export declare const SAFER_MAX_TOKENS = 1500;
+/**
+ * R3v2-F1: WHY the ask failed, when the reply's own text can prove it.
+ *
+ * This side reports the cause and never the copy — the sentences live in
+ * the panel package, next to each other, so there is one place where the
+ * words are chosen and one place they can drift from.
+ *
+ * "Cut short" is a DIAGNOSIS, so it is only claimed when the text shows
+ * it: a reply that closed its JSON and then failed our SHAPE returns
+ * null and gets the unqualified line, because telling that human their
+ * reply was truncated would be a confident wrong answer.
+ */
+export declare function saferFailure(text: string): SaferFailure | null;
+/**
+ * Parse the model's answer DEFENSIVELY — anything unexpected is a
+ * failure, and a failure degrades honestly.
+ *
+ * The temptation here is to be clever: salvage a half-parse, coerce a
+ * string into a command, accept an object where an array was asked for.
+ * All of that produces a list of alternatives the model did not propose,
+ * shown to a human deciding whether to run a destructive command. The
+ * only honest failure mode is the dim line, so anything that is not
+ * exactly the requested shape returns null.
+ *
+ * A fenced code block is the one accommodation, because models emit it
+ * constantly and it changes no content.
+ *
+ * R3v2-F1 widens that accommodation and NOTHING else. Unwrapping the
+ * named `alternatives` envelope, and reading `reason` as the spelling of
+ * `why` the prompt now asks for, are transport details: the entries that
+ * come out are verbatim the entries the model put in. That is the line
+ * between an accommodation and the salvage this parser refuses — a
+ * salvage changes WHICH alternatives are shown, and every rule that does
+ * that is still here. One bad entry still poisons the batch.
+ */
+export declare function parseSaferOptions(text: string): SaferOption[] | null;
 /**
  * Consume a run, answering approval pauses as they arrive. `resumeMode`
  * marks a session.resume() continuation. `faux` picks the status line's

package/dist/chat.js

@@ -6,7 +6,7 @@
  */
 import { readFileSync, statSync } from "node:fs";
 import { escapeTerminal, cacheHitPct, idleStatus, palette, renderEvent, renderRecap, runningStatus, toolTarget, STATUS_GLYPHS, } from "@vincemakes/kiso-tui";
-import { editFileDiff, writeFileDiff } from "@vincemakes/kiso-tui";
+import { deletionRiskHint, editFileDiff, writeFileDiff } from "@vincemakes/kiso-tui";
 import { canonicalTargetPath, shellProgressPath } from "@vincemakes/kiso-tools-node";
 import { canonicalizeUsage } from "@vincemakes/kiso-runtime";
 import { dispatch } from "./dispatch.js";
@@ -178,24 +178,198 @@ function approvalDiff(name, input) {
         return null; // never let the diff break the approval
     }
 }
+/**
+ * TUI2-R3v2 ③ — the safer-options request: its prompt, and its parser.
+ *
+ * The prompt is deliberately small. It carries the pending call and
+ * nothing else — no conversation, no tools, no project context — because
+ * everything it does not send is rent the human pays for pressing a
+ * button, and because "propose a safer version of THIS command" is a
+ * question that needs no history to answer.
+ */
+/** TUI2-R3v2 ③: tools whose NEXT approval is the model's answer to a
+ *  refusal — the "(amended)" marker's source. Per process, cleared as
+ *  soon as it is shown: the marker describes ONE call, not a mode. */
+const amendedCalls = new Set();
+/**
+ * R3v2-F1: the format contract, stated FIRMLY. The first cut asked for
+ * "JSON ONLY" and left it there, which a verbose model reads as a
+ * preference — it wrote three sentences of preamble, opened a fence, and
+ * the cap ended the reply mid-string. Forbidding prose, naming the exact
+ * schema, and giving the nothing-is-safer case its own literal answer
+ * are all the same instruction: there is one thing to emit and no room
+ * to be helpful in the margins.
+ *
+ * The schema is an ENVELOPE rather than a bare array because a single
+ * top-level object leaves the model nowhere to put a preamble.
+ */
+export const SAFER_SYSTEM_PROMPT = [
+    "You propose safer alternatives to a single shell/tool call a human is being asked to approve.",
+    "Reply with JSON ONLY — no prose, no preamble, no code fence, nothing before or after the JSON.",
+    'The exact schema is {"alternatives":[{"command":"...","reason":"..."}]}, with 2-3 entries.',
+    '"command" is the full replacement call. "reason" is ONE line of plain language saying what it does differently.',
+    'Prefer alternatives that avoid irreversible deletion. If you cannot improve on it, reply {"alternatives":[]}.',
+].join(" ");
+/**
+ * R3v2-F1: the side query's output ceiling — raised from 500, which was
+ * the cap the live failures hit EXACTLY.
+ *
+ * The JSON-only reply the prompt now asks for is about 200 tokens for
+ * three alternatives, so this ceiling is a runaway guard and not a
+ * budget the answer is expected to approach: it exists so a model that
+ * ignores the contract and writes an essay still stops, not so the
+ * answer has room. Output is billed only when generated, and the query
+ * fires only on a press, so the raise costs nothing on the path that
+ * works and removes the one that could not.
+ */
+export const SAFER_MAX_TOKENS = 1500;
+/**
+ * R3v2-F1: WHY the ask failed, when the reply's own text can prove it.
+ *
+ * This side reports the cause and never the copy — the sentences live in
+ * the panel package, next to each other, so there is one place where the
+ * words are chosen and one place they can drift from.
+ *
+ * "Cut short" is a DIAGNOSIS, so it is only claimed when the text shows
+ * it: a reply that closed its JSON and then failed our SHAPE returns
+ * null and gets the unqualified line, because telling that human their
+ * reply was truncated would be a confident wrong answer.
+ */
+export function saferFailure(text) {
+    return jsonBody(text) === "truncated" ? { reason: "truncated" } : null;
+}
+/**
+ * R3v2-F1: find the reply's JSON body by BALANCING brackets rather than
+ * by first-and-last.
+ *
+ * `indexOf("[")` / `lastIndexOf("]")` had two failure modes a verbose
+ * model hits constantly: a bracket in the trailing prose moved the end
+ * past the array, and a reply the cap cut in half had no end at all.
+ * Both returned null, and null could not say which — which is why the
+ * degradation line could not either.
+ *
+ * Returns the balanced slice, `"truncated"` when a value opens and the
+ * text ends before it closes, or null when there is no JSON value at
+ * all.
+ */
+function jsonBody(text) {
+    // a CLOSED fence is content-preserving to strip. An OPEN one means
+    // the reply ended inside the block — drop the opener and let the scan
+    // below reach the same verdict from the content.
+    const closed = text.match(/```(?:json)?\s*([\s\S]*?)```/);
+    const body = closed?.[1] ?? text.replace(/^[\s\S]*?```(?:json)?[ \t]*\r?\n/, "");
+    const start = body.search(/[[{]/);
+    if (start < 0)
+        return null;
+    let depth = 0;
+    let inString = false;
+    let escaped = false;
+    for (let i = start; i < body.length; i += 1) {
+        const c = body[i];
+        if (escaped) {
+            escaped = false;
+        }
+        else if (inString) {
+            if (c === "\\")
+                escaped = true;
+            else if (c === '"')
+                inString = false;
+        }
+        else if (c === '"') {
+            inString = true;
+        }
+        else if (c === "[" || c === "{") {
+            depth += 1;
+        }
+        else if (c === "]" || c === "}") {
+            depth -= 1;
+            if (depth === 0)
+                return body.slice(start, i + 1);
+            if (depth < 0)
+                return null;
+        }
+    }
+    return "truncated";
+}
+/**
+ * Parse the model's answer DEFENSIVELY — anything unexpected is a
+ * failure, and a failure degrades honestly.
+ *
+ * The temptation here is to be clever: salvage a half-parse, coerce a
+ * string into a command, accept an object where an array was asked for.
+ * All of that produces a list of alternatives the model did not propose,
+ * shown to a human deciding whether to run a destructive command. The
+ * only honest failure mode is the dim line, so anything that is not
+ * exactly the requested shape returns null.
+ *
+ * A fenced code block is the one accommodation, because models emit it
+ * constantly and it changes no content.
+ *
+ * R3v2-F1 widens that accommodation and NOTHING else. Unwrapping the
+ * named `alternatives` envelope, and reading `reason` as the spelling of
+ * `why` the prompt now asks for, are transport details: the entries that
+ * come out are verbatim the entries the model put in. That is the line
+ * between an accommodation and the salvage this parser refuses — a
+ * salvage changes WHICH alternatives are shown, and every rule that does
+ * that is still here. One bad entry still poisons the batch.
+ */
+export function parseSaferOptions(text) {
+    const body = jsonBody(text);
+    // truncation and absence part ways in saferFailureNote(), which reads
+    // the same scan; for the list itself both are the same nothing.
+    if (body === null || body === "truncated")
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return null;
+    }
+    const envelope = typeof parsed === "object" && parsed !== null ? parsed.alternatives : undefined;
+    const list = Array.isArray(parsed) ? parsed : Array.isArray(envelope) ? envelope : null;
+    if (list === null || list.length === 0)
+        return null;
+    const out = [];
+    for (const item of list.slice(0, 3)) {
+        if (typeof item !== "object" || item === null)
+            return null;
+        const { command, reason, why } = item;
+        if (typeof command !== "string" || command.trim() === "")
+            return null;
+        const line = typeof reason === "string" ? reason : typeof why === "string" ? why : "";
+        out.push({ command: command.trim(), why: line.trim() });
+    }
+    return out.length === 0 ? null : out;
+}
 /** W21 — the panel view for a permission_requested: the rule line (the
  *  why-asked speaker + the §3.5 fix hint), the toolTarget title, the
  *  "▸ run paused" status, and the ALWAYS-verbose args. */
-function approvalView(name, ev) {
+function approvalView(name, ev, amended = false) {
     const speaker = ev.speaker ?? "kiso";
     const input = ev.input ?? {};
     // exactOptionalPropertyTypes: the hint is OMITTED when the speaker has
     // no fix (mode:accept-edits, shell in default) — never `hint: undefined`.
     const hint = fixHintFor(speaker, name);
+    // TUI2-R3v2 ④: the deletion-risk line, for shell calls whose command
+    // matches one of the four irreversible patterns. Local rules, no
+    // request, and absent for every other command — which is most of them.
+    const risk = name === "shell" ? deletionRiskHint(String(input.command ?? "")) : null;
     return {
         flavor: "approval",
         name,
         title: toolTarget(name, input),
         speaker,
         ...(hint !== undefined ? { hint } : {}),
+        ...(risk !== null ? { riskHint: risk } : {}),
         statusText: "▸ run paused",
         args: approvalArgs(name, input),
         fallbackQuestion: `approve ${escapeTerminal(name)}? (y/n) `,
+        // TUI2-R3v2 ③: the v4 frame's "(amended)" marker. It says WHY this
+        // call looks different from the one just refused — without it, a
+        // second approval for the same tool reads as the product asking
+        // twice rather than as the model answering.
+        ...(amended ? { amended: true } : {}),
     };
 }
 /** The panel's ALWAYS-verbose args: edit_file/write_file → the full ±
@@ -433,7 +607,25 @@ submitTurn) {
                     const name = ev.name;
                     body.toolApproval(ev.callId, approvalDiff(name, ev.input ?? {}));
                     const decisionId = ev.decisionId;
-                    const verdict = await askPanel(input, approvalView(name, ev));
+                    // TUI2-R3v2 ③: the on-demand alternatives provider. It is built
+                    // per approval and captured by the panel; it fires ONLY if the
+                    // human presses option 3, which is the whole zero-ambient-rent
+                    // mechanism — no press, no request, nothing in the trace.
+                    const safer = async () => {
+                        const answer = await session.sideQuery({
+                            purpose: "safer-options",
+                            systemPrompt: SAFER_SYSTEM_PROMPT,
+                            prompt: `the pending call is: ${name} ${JSON.stringify(ev.input ?? {})}`,
+                            maxTokens: SAFER_MAX_TOKENS,
+                        });
+                        // R3v2-F1: a failure reports its CAUSE when the reply can
+                        // prove one, so the panel can say which failure this was.
+                        // saferFailure() returns null for every cause we cannot
+                        // demonstrate, which is the unqualified line — unchanged.
+                        return parseSaferOptions(answer) ?? saferFailure(answer);
+                    };
+                    const verdict = await askPanel(input, approvalView(name, ev, amendedCalls.has(name)), { safer });
+                    amendedCalls.delete(name);
                     switch (verdict.action) {
                         case "cancel": {
                             // round 10: a cancellation is a CONSERVATIVE denial,
@@ -465,6 +657,9 @@ submitTurn) {
                             if (verdict.reason.trim() !== "") {
                                 // No+words — the words become the tool_result; the
                                 // run continues with the model seeing the denial.
+                                // TUI2-R3v2 ③: whatever the model proposes next for
+                                // this tool IS the amended call, and the panel says so.
+                                amendedCalls.add(name);
                                 await session.approve(decisionId, false, verdict.reason);
                             }
                             else {

package/dist/index.js

@@ -154,8 +154,8 @@ function editorInput(editor) {
         },
         // W21: the panel — the editor's own state machine takes the
         // keys; the compositor renders it via the bound state.
-        panelAsk(view, onCommit) {
-            editor.beginPanel(view, onCommit);
+        panelAsk(view, onCommit, opts) {
+            editor.beginPanel(view, onCommit, opts);
         },
         panelCancel() {
             editor.cancelPanel();
@@ -202,6 +202,10 @@ function makeLineInput() {
         // "input lives here"; the line-mode path keeps the brick ▌, so
         // pipe bytes do not change)
         dock.bindInput(() => editor.dockState(), "› ");
+        // TUI2-R3v2 ②: the click hit-test's wiring — the compositor places
+        // the panel's option rows, so the compositor is what the editor asks
+        // where they are. Neither side computes the other's geometry.
+        editor.bindPanelRows(() => dock.panelOptionRows());
         dock.bindMenu(() => editor.menuState()); // v3 §04: the slash-command menu
         editor.bindAtItems(atFiles); // KC3 §5: the file source — listed per OPEN
         dock.bindAt(() => editor.atState()); // KC3 §4: the picker's band

package/dist/state.d.ts

@@ -5,7 +5,7 @@
  * creates the mutable ones (setBody / setAgentModel / setExtensionLists);
  * the moved modules read and mutate at call time.
  */
-import { Dock, type AtItem, type Body, type PanelVerdict, type PanelView, type SessionCardView } from "@vincemakes/kiso-tui";
+import { Dock, type AtItem, type Body, type PanelVerdict, type PanelView, type SaferAnswer, type SessionCardView } from "@vincemakes/kiso-tui";
 import type { KisoExtension, StoreRecord } from "@vincemakes/kiso-runtime";
 /** finding #11: KISO_HOME is the ONE root — every default path derives from
  *  it (sessions, trust, extensions, mcp config, skills). The dedicated
@@ -80,7 +80,14 @@ export interface LineInput {
     /** W21: open the approval panel — the editor's state machine takes
      *  the keys (the digits/y/n/tab/esc/enter routing, the rule input,
      *  the tab-amend), the compositor renders the block + the leads. */
-    panelAsk(view: PanelView, onCommit: (v: PanelVerdict) => void): void;
+    /** TUI2-R3v2 ③: `opts.safer` is the on-demand alternatives provider —
+     *  absent for every panel that has no such option (the ask, the pick,
+     *  the trust gate), so those buttons cannot exist to be pressed.
+     *  R3v2-F1: it resolves a SaferAnswer, so a failure that can name its
+     *  cause does — `null` still means a failure with nothing to add. */
+    panelAsk(view: PanelView, onCommit: (v: PanelVerdict) => void, opts?: {
+        safer?: () => Promise<SaferAnswer>;
+    }): void;
     /** W21: cancel the panel — the SIGINT pair to panelAsk. */
     panelCancel(): void;
     /** TUI2-R2 ②: open the session picker — the editor takes the keys

package/dist/trust-ui.d.ts

@@ -5,7 +5,7 @@
  * chat.ts), the don't-ask-again rule writer, and the uncertain-execution
  * decisions. All bodies moved verbatim from index.ts.
  */
-import { type PanelVerdict, type PanelView } from "@vincemakes/kiso-tui";
+import { type PanelVerdict, type PanelView, type SaferAnswer } from "@vincemakes/kiso-tui";
 import type { AskUI } from "@vincemakes/kiso-ask-ext";
 import { type ProjectArtifacts } from "@vincemakes/kiso-runtime";
 import type { AgentSession } from "@vincemakes/kiso-runtime";
@@ -34,7 +34,9 @@ import { type LineInput } from "./state.js";
  * the dead question.
  */
 export declare let pendingAsk: (() => void) | null;
-export declare function askPanel(input: LineInput, view: PanelView): Promise<PanelVerdict>;
+export declare function askPanel(input: LineInput, view: PanelView, opts?: {
+    safer?: () => Promise<SaferAnswer>;
+}): Promise<PanelVerdict>;
 /**
  * KC3.5 — the AskUI bridge: the panel the ask extension asks through.
  *

package/dist/trust-ui.js

@@ -38,7 +38,12 @@ import { getMode } from "./mode.js";
  * the dead question.
  */
 export let pendingAsk = null;
-export function askPanel(input, view) {
+export function askPanel(input, view, 
+// TUI2-R3v2 ③: the safer-options provider, when the caller has one.
+// Only the approval site passes it; every other panel (the ask, the
+// pick, the trust gate, the uncertain resolutions) omits it, so their
+// lists cannot grow a button they have no answer for.
+opts) {
     if (!process.stdin.isTTY) {
         console.log(`[non-interactive — no human to ask: ${view.fallbackQuestion}]`);
         return Promise.resolve({ action: "deny", reason: "no human to ask" });
@@ -63,7 +68,7 @@ export function askPanel(input, view) {
                 settled = true;
                 pendingAsk = null;
                 resolve(verdict);
-            });
+            }, opts);
         }
         else {
             // v2c: a TTY without a dock (rows < 4) — the fallback question

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vincemakes/kiso-code",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "kiso CLI — the durable coding agent that survives kill -9: kiso chat / kiso resume / kiso sessions.",
   "type": "module",
   "license": "MIT",
@@ -18,19 +18,19 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@vincemakes/kiso-ask-ext": "0.11.0",
-    "@vincemakes/kiso-core": "0.11.0",
-    "@vincemakes/kiso-evals": "0.11.0",
-    "@vincemakes/kiso-mcp-ext": "0.11.0",
-    "@vincemakes/kiso-provider-anthropic": "0.11.0",
-    "@vincemakes/kiso-provider-openai": "0.11.0",
-    "@vincemakes/kiso-runtime": "0.11.0",
-    "@vincemakes/kiso-skills-ext": "0.11.0",
-    "@vincemakes/kiso-subagent-ext": "0.11.0",
-    "@vincemakes/kiso-task-ext": "0.11.0",
-    "@vincemakes/kiso-tools-node": "0.11.0",
-    "@vincemakes/kiso-tui": "0.11.0",
-    "@vincemakes/kiso-tui-cells": "0.11.0"
+    "@vincemakes/kiso-ask-ext": "0.13.0",
+    "@vincemakes/kiso-core": "0.13.0",
+    "@vincemakes/kiso-evals": "0.13.0",
+    "@vincemakes/kiso-mcp-ext": "0.13.0",
+    "@vincemakes/kiso-provider-anthropic": "0.13.0",
+    "@vincemakes/kiso-provider-openai": "0.13.0",
+    "@vincemakes/kiso-runtime": "0.13.0",
+    "@vincemakes/kiso-skills-ext": "0.13.0",
+    "@vincemakes/kiso-subagent-ext": "0.13.0",
+    "@vincemakes/kiso-task-ext": "0.13.0",
+    "@vincemakes/kiso-tools-node": "0.13.0",
+    "@vincemakes/kiso-tui": "0.13.0",
+    "@vincemakes/kiso-tui-cells": "0.13.0"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",