@vincemakes/kiso-code 0.12.0 → 0.13.0

package/dist/chat.d.ts

@@ -5,7 +5,7 @@
  * estimates. All bodies moved verbatim from index.ts.
  */
 import { type RunUsage } from "@vincemakes/kiso-tui";
-import { type SaferOption } from "@vincemakes/kiso-tui";
+import { type SaferFailure, type SaferOption } from "@vincemakes/kiso-tui";
 import type { AgentSession, Run } from "@vincemakes/kiso-runtime";
 import { type LineInput } from "./state.js";
 /**
@@ -82,6 +82,45 @@ export declare function usageFromEvent(route: string | undefined, ev: import("@v
  *  first event. */
 export declare function startStatusSpinner(onTick: (glyph: string) => void): () => void;
 export declare function startShellTail(sessionId: string, callId: string, command: string, startedAt: number): () => void;
+/**
+ * R3v2-F1: the format contract, stated FIRMLY. The first cut asked for
+ * "JSON ONLY" and left it there, which a verbose model reads as a
+ * preference — it wrote three sentences of preamble, opened a fence, and
+ * the cap ended the reply mid-string. Forbidding prose, naming the exact
+ * schema, and giving the nothing-is-safer case its own literal answer
+ * are all the same instruction: there is one thing to emit and no room
+ * to be helpful in the margins.
+ *
+ * The schema is an ENVELOPE rather than a bare array because a single
+ * top-level object leaves the model nowhere to put a preamble.
+ */
+export declare const SAFER_SYSTEM_PROMPT: string;
+/**
+ * R3v2-F1: the side query's output ceiling — raised from 500, which was
+ * the cap the live failures hit EXACTLY.
+ *
+ * The JSON-only reply the prompt now asks for is about 200 tokens for
+ * three alternatives, so this ceiling is a runaway guard and not a
+ * budget the answer is expected to approach: it exists so a model that
+ * ignores the contract and writes an essay still stops, not so the
+ * answer has room. Output is billed only when generated, and the query
+ * fires only on a press, so the raise costs nothing on the path that
+ * works and removes the one that could not.
+ */
+export declare const SAFER_MAX_TOKENS = 1500;
+/**
+ * R3v2-F1: WHY the ask failed, when the reply's own text can prove it.
+ *
+ * This side reports the cause and never the copy — the sentences live in
+ * the panel package, next to each other, so there is one place where the
+ * words are chosen and one place they can drift from.
+ *
+ * "Cut short" is a DIAGNOSIS, so it is only claimed when the text shows
+ * it: a reply that closed its JSON and then failed our SHAPE returns
+ * null and gets the unqualified line, because telling that human their
+ * reply was truncated would be a confident wrong answer.
+ */
+export declare function saferFailure(text: string): SaferFailure | null;
 /**
  * Parse the model's answer DEFENSIVELY — anything unexpected is a
  * failure, and a failure degrades honestly.
@@ -95,6 +134,14 @@ export declare function startShellTail(sessionId: string, callId: string, comman
  *
  * A fenced code block is the one accommodation, because models emit it
  * constantly and it changes no content.
+ *
+ * R3v2-F1 widens that accommodation and NOTHING else. Unwrapping the
+ * named `alternatives` envelope, and reading `reason` as the spelling of
+ * `why` the prompt now asks for, are transport details: the entries that
+ * come out are verbatim the entries the model put in. That is the line
+ * between an accommodation and the salvage this parser refuses — a
+ * salvage changes WHICH alternatives are shown, and every rule that does
+ * that is still here. One bad entry still poisons the batch.
  */
 export declare function parseSaferOptions(text: string): SaferOption[] | null;
 /**

package/dist/chat.js

@@ -191,12 +191,106 @@ function approvalDiff(name, input) {
  *  refusal — the "(amended)" marker's source. Per process, cleared as
  *  soon as it is shown: the marker describes ONE call, not a mode. */
 const amendedCalls = new Set();
-const SAFER_SYSTEM_PROMPT = [
+/**
+ * R3v2-F1: the format contract, stated FIRMLY. The first cut asked for
+ * "JSON ONLY" and left it there, which a verbose model reads as a
+ * preference — it wrote three sentences of preamble, opened a fence, and
+ * the cap ended the reply mid-string. Forbidding prose, naming the exact
+ * schema, and giving the nothing-is-safer case its own literal answer
+ * are all the same instruction: there is one thing to emit and no room
+ * to be helpful in the margins.
+ *
+ * The schema is an ENVELOPE rather than a bare array because a single
+ * top-level object leaves the model nowhere to put a preamble.
+ */
+export const SAFER_SYSTEM_PROMPT = [
     "You propose safer alternatives to a single shell/tool call a human is being asked to approve.",
-    "Answer with JSON ONLY: an array of 2-3 objects, each {\"command\": string, \"why\": string}.",
-    '"command" is the full replacement call. "why" is ONE short plain-language line saying what it does differently.',
-    "Prefer alternatives that avoid irreversible deletion. If you cannot improve on it, answer [].",
+    "Reply with JSON ONLY — no prose, no preamble, no code fence, nothing before or after the JSON.",
+    'The exact schema is {"alternatives":[{"command":"...","reason":"..."}]}, with 2-3 entries.',
+    '"command" is the full replacement call. "reason" is ONE line of plain language saying what it does differently.',
+    'Prefer alternatives that avoid irreversible deletion. If you cannot improve on it, reply {"alternatives":[]}.',
 ].join(" ");
+/**
+ * R3v2-F1: the side query's output ceiling — raised from 500, which was
+ * the cap the live failures hit EXACTLY.
+ *
+ * The JSON-only reply the prompt now asks for is about 200 tokens for
+ * three alternatives, so this ceiling is a runaway guard and not a
+ * budget the answer is expected to approach: it exists so a model that
+ * ignores the contract and writes an essay still stops, not so the
+ * answer has room. Output is billed only when generated, and the query
+ * fires only on a press, so the raise costs nothing on the path that
+ * works and removes the one that could not.
+ */
+export const SAFER_MAX_TOKENS = 1500;
+/**
+ * R3v2-F1: WHY the ask failed, when the reply's own text can prove it.
+ *
+ * This side reports the cause and never the copy — the sentences live in
+ * the panel package, next to each other, so there is one place where the
+ * words are chosen and one place they can drift from.
+ *
+ * "Cut short" is a DIAGNOSIS, so it is only claimed when the text shows
+ * it: a reply that closed its JSON and then failed our SHAPE returns
+ * null and gets the unqualified line, because telling that human their
+ * reply was truncated would be a confident wrong answer.
+ */
+export function saferFailure(text) {
+    return jsonBody(text) === "truncated" ? { reason: "truncated" } : null;
+}
+/**
+ * R3v2-F1: find the reply's JSON body by BALANCING brackets rather than
+ * by first-and-last.
+ *
+ * `indexOf("[")` / `lastIndexOf("]")` had two failure modes a verbose
+ * model hits constantly: a bracket in the trailing prose moved the end
+ * past the array, and a reply the cap cut in half had no end at all.
+ * Both returned null, and null could not say which — which is why the
+ * degradation line could not either.
+ *
+ * Returns the balanced slice, `"truncated"` when a value opens and the
+ * text ends before it closes, or null when there is no JSON value at
+ * all.
+ */
+function jsonBody(text) {
+    // a CLOSED fence is content-preserving to strip. An OPEN one means
+    // the reply ended inside the block — drop the opener and let the scan
+    // below reach the same verdict from the content.
+    const closed = text.match(/```(?:json)?\s*([\s\S]*?)```/);
+    const body = closed?.[1] ?? text.replace(/^[\s\S]*?```(?:json)?[ \t]*\r?\n/, "");
+    const start = body.search(/[[{]/);
+    if (start < 0)
+        return null;
+    let depth = 0;
+    let inString = false;
+    let escaped = false;
+    for (let i = start; i < body.length; i += 1) {
+        const c = body[i];
+        if (escaped) {
+            escaped = false;
+        }
+        else if (inString) {
+            if (c === "\\")
+                escaped = true;
+            else if (c === '"')
+                inString = false;
+        }
+        else if (c === '"') {
+            inString = true;
+        }
+        else if (c === "[" || c === "{") {
+            depth += 1;
+        }
+        else if (c === "]" || c === "}") {
+            depth -= 1;
+            if (depth === 0)
+                return body.slice(start, i + 1);
+            if (depth < 0)
+                return null;
+        }
+    }
+    return "truncated";
+}
 /**
  * Parse the model's answer DEFENSIVELY — anything unexpected is a
  * failure, and a failure degrades honestly.
@@ -210,31 +304,41 @@ const SAFER_SYSTEM_PROMPT = [
  *
  * A fenced code block is the one accommodation, because models emit it
  * constantly and it changes no content.
+ *
+ * R3v2-F1 widens that accommodation and NOTHING else. Unwrapping the
+ * named `alternatives` envelope, and reading `reason` as the spelling of
+ * `why` the prompt now asks for, are transport details: the entries that
+ * come out are verbatim the entries the model put in. That is the line
+ * between an accommodation and the salvage this parser refuses — a
+ * salvage changes WHICH alternatives are shown, and every rule that does
+ * that is still here. One bad entry still poisons the batch.
  */
 export function parseSaferOptions(text) {
-    const fenced = text.match(/```(?:json)?\s*([\s\S]*?)```/);
-    const body = (fenced?.[1] ?? text).trim();
-    const start = body.indexOf("[");
-    const end = body.lastIndexOf("]");
-    if (start < 0 || end <= start)
+    const body = jsonBody(text);
+    // truncation and absence part ways in saferFailureNote(), which reads
+    // the same scan; for the list itself both are the same nothing.
+    if (body === null || body === "truncated")
         return null;
     let parsed;
     try {
-        parsed = JSON.parse(body.slice(start, end + 1));
+        parsed = JSON.parse(body);
     }
     catch {
         return null;
     }
-    if (!Array.isArray(parsed) || parsed.length === 0)
+    const envelope = typeof parsed === "object" && parsed !== null ? parsed.alternatives : undefined;
+    const list = Array.isArray(parsed) ? parsed : Array.isArray(envelope) ? envelope : null;
+    if (list === null || list.length === 0)
         return null;
     const out = [];
-    for (const item of parsed.slice(0, 3)) {
+    for (const item of list.slice(0, 3)) {
         if (typeof item !== "object" || item === null)
             return null;
-        const { command, why } = item;
+        const { command, reason, why } = item;
         if (typeof command !== "string" || command.trim() === "")
             return null;
-        out.push({ command: command.trim(), why: typeof why === "string" ? why.trim() : "" });
+        const line = typeof reason === "string" ? reason : typeof why === "string" ? why : "";
+        out.push({ command: command.trim(), why: line.trim() });
     }
     return out.length === 0 ? null : out;
 }
@@ -512,9 +616,13 @@ submitTurn) {
                             purpose: "safer-options",
                             systemPrompt: SAFER_SYSTEM_PROMPT,
                             prompt: `the pending call is: ${name} ${JSON.stringify(ev.input ?? {})}`,
-                            maxTokens: 500,
+                            maxTokens: SAFER_MAX_TOKENS,
                         });
-                        return parseSaferOptions(answer);
+                        // R3v2-F1: a failure reports its CAUSE when the reply can
+                        // prove one, so the panel can say which failure this was.
+                        // saferFailure() returns null for every cause we cannot
+                        // demonstrate, which is the unqualified line — unchanged.
+                        return parseSaferOptions(answer) ?? saferFailure(answer);
                     };
                     const verdict = await askPanel(input, approvalView(name, ev, amendedCalls.has(name)), { safer });
                     amendedCalls.delete(name);

package/dist/state.d.ts

@@ -5,7 +5,7 @@
  * creates the mutable ones (setBody / setAgentModel / setExtensionLists);
  * the moved modules read and mutate at call time.
  */
-import { Dock, type AtItem, type Body, type PanelVerdict, type PanelView, type SaferOption, type SessionCardView } from "@vincemakes/kiso-tui";
+import { Dock, type AtItem, type Body, type PanelVerdict, type PanelView, type SaferAnswer, type SessionCardView } from "@vincemakes/kiso-tui";
 import type { KisoExtension, StoreRecord } from "@vincemakes/kiso-runtime";
 /** finding #11: KISO_HOME is the ONE root — every default path derives from
  *  it (sessions, trust, extensions, mcp config, skills). The dedicated
@@ -82,9 +82,11 @@ export interface LineInput {
      *  the tab-amend), the compositor renders the block + the leads. */
     /** TUI2-R3v2 ③: `opts.safer` is the on-demand alternatives provider —
      *  absent for every panel that has no such option (the ask, the pick,
-     *  the trust gate), so those buttons cannot exist to be pressed. */
+     *  the trust gate), so those buttons cannot exist to be pressed.
+     *  R3v2-F1: it resolves a SaferAnswer, so a failure that can name its
+     *  cause does — `null` still means a failure with nothing to add. */
     panelAsk(view: PanelView, onCommit: (v: PanelVerdict) => void, opts?: {
-        safer?: () => Promise<readonly SaferOption[] | null>;
+        safer?: () => Promise<SaferAnswer>;
     }): void;
     /** W21: cancel the panel — the SIGINT pair to panelAsk. */
     panelCancel(): void;

package/dist/trust-ui.d.ts

@@ -5,7 +5,7 @@
  * chat.ts), the don't-ask-again rule writer, and the uncertain-execution
  * decisions. All bodies moved verbatim from index.ts.
  */
-import { type PanelVerdict, type PanelView, type SaferOption } from "@vincemakes/kiso-tui";
+import { type PanelVerdict, type PanelView, type SaferAnswer } from "@vincemakes/kiso-tui";
 import type { AskUI } from "@vincemakes/kiso-ask-ext";
 import { type ProjectArtifacts } from "@vincemakes/kiso-runtime";
 import type { AgentSession } from "@vincemakes/kiso-runtime";
@@ -35,7 +35,7 @@ import { type LineInput } from "./state.js";
  */
 export declare let pendingAsk: (() => void) | null;
 export declare function askPanel(input: LineInput, view: PanelView, opts?: {
-    safer?: () => Promise<readonly SaferOption[] | null>;
+    safer?: () => Promise<SaferAnswer>;
 }): Promise<PanelVerdict>;
 /**
  * KC3.5 — the AskUI bridge: the panel the ask extension asks through.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vincemakes/kiso-code",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "kiso CLI — the durable coding agent that survives kill -9: kiso chat / kiso resume / kiso sessions.",
   "type": "module",
   "license": "MIT",
@@ -18,19 +18,19 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@vincemakes/kiso-ask-ext": "0.12.0",
-    "@vincemakes/kiso-core": "0.12.0",
-    "@vincemakes/kiso-evals": "0.12.0",
-    "@vincemakes/kiso-mcp-ext": "0.12.0",
-    "@vincemakes/kiso-provider-anthropic": "0.12.0",
-    "@vincemakes/kiso-provider-openai": "0.12.0",
-    "@vincemakes/kiso-runtime": "0.12.0",
-    "@vincemakes/kiso-skills-ext": "0.12.0",
-    "@vincemakes/kiso-subagent-ext": "0.12.0",
-    "@vincemakes/kiso-task-ext": "0.12.0",
-    "@vincemakes/kiso-tools-node": "0.12.0",
-    "@vincemakes/kiso-tui": "0.12.0",
-    "@vincemakes/kiso-tui-cells": "0.12.0"
+    "@vincemakes/kiso-ask-ext": "0.13.0",
+    "@vincemakes/kiso-core": "0.13.0",
+    "@vincemakes/kiso-evals": "0.13.0",
+    "@vincemakes/kiso-mcp-ext": "0.13.0",
+    "@vincemakes/kiso-provider-anthropic": "0.13.0",
+    "@vincemakes/kiso-provider-openai": "0.13.0",
+    "@vincemakes/kiso-runtime": "0.13.0",
+    "@vincemakes/kiso-skills-ext": "0.13.0",
+    "@vincemakes/kiso-subagent-ext": "0.13.0",
+    "@vincemakes/kiso-task-ext": "0.13.0",
+    "@vincemakes/kiso-tools-node": "0.13.0",
+    "@vincemakes/kiso-tui": "0.13.0",
+    "@vincemakes/kiso-tui-cells": "0.13.0"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",