@vincemakes/kiso-code 0.12.0 → 0.14.0

package/dist/chat.d.ts

@@ -5,7 +5,7 @@
  * estimates. All bodies moved verbatim from index.ts.
  */
 import { type RunUsage } from "@vincemakes/kiso-tui";
-import { type SaferOption } from "@vincemakes/kiso-tui";
+import { type SaferFailure, type SaferOption } from "@vincemakes/kiso-tui";
 import type { AgentSession, Run } from "@vincemakes/kiso-runtime";
 import { type LineInput } from "./state.js";
 /**
@@ -82,6 +82,45 @@ export declare function usageFromEvent(route: string | undefined, ev: import("@v
  *  first event. */
 export declare function startStatusSpinner(onTick: (glyph: string) => void): () => void;
 export declare function startShellTail(sessionId: string, callId: string, command: string, startedAt: number): () => void;
+/**
+ * R3v2-F1: the format contract, stated FIRMLY. The first cut asked for
+ * "JSON ONLY" and left it there, which a verbose model reads as a
+ * preference — it wrote three sentences of preamble, opened a fence, and
+ * the cap ended the reply mid-string. Forbidding prose, naming the exact
+ * schema, and giving the nothing-is-safer case its own literal answer
+ * are all the same instruction: there is one thing to emit and no room
+ * to be helpful in the margins.
+ *
+ * The schema is an ENVELOPE rather than a bare array because a single
+ * top-level object leaves the model nowhere to put a preamble.
+ */
+export declare const SAFER_SYSTEM_PROMPT: string;
+/**
+ * R3v2-F1: the side query's output ceiling — raised from 500, which was
+ * the cap the live failures hit EXACTLY.
+ *
+ * The JSON-only reply the prompt now asks for is about 200 tokens for
+ * three alternatives, so this ceiling is a runaway guard and not a
+ * budget the answer is expected to approach: it exists so a model that
+ * ignores the contract and writes an essay still stops, not so the
+ * answer has room. Output is billed only when generated, and the query
+ * fires only on a press, so the raise costs nothing on the path that
+ * works and removes the one that could not.
+ */
+export declare const SAFER_MAX_TOKENS = 1500;
+/**
+ * R3v2-F1: WHY the ask failed, when the reply's own text can prove it.
+ *
+ * This side reports the cause and never the copy — the sentences live in
+ * the panel package, next to each other, so there is one place where the
+ * words are chosen and one place they can drift from.
+ *
+ * "Cut short" is a DIAGNOSIS, so it is only claimed when the text shows
+ * it: a reply that closed its JSON and then failed our SHAPE returns
+ * null and gets the unqualified line, because telling that human their
+ * reply was truncated would be a confident wrong answer.
+ */
+export declare function saferFailure(text: string): SaferFailure | null;
 /**
  * Parse the model's answer DEFENSIVELY — anything unexpected is a
  * failure, and a failure degrades honestly.
@@ -95,6 +134,14 @@ export declare function startShellTail(sessionId: string, callId: string, comman
  *
  * A fenced code block is the one accommodation, because models emit it
  * constantly and it changes no content.
+ *
+ * R3v2-F1 widens that accommodation and NOTHING else. Unwrapping the
+ * named `alternatives` envelope, and reading `reason` as the spelling of
+ * `why` the prompt now asks for, are transport details: the entries that
+ * come out are verbatim the entries the model put in. That is the line
+ * between an accommodation and the salvage this parser refuses — a
+ * salvage changes WHICH alternatives are shown, and every rule that does
+ * that is still here. One bad entry still poisons the batch.
  */
 export declare function parseSaferOptions(text: string): SaferOption[] | null;
 /**

package/dist/chat.js

@@ -5,7 +5,7 @@
  * estimates. All bodies moved verbatim from index.ts.
  */
 import { readFileSync, statSync } from "node:fs";
-import { escapeTerminal, cacheHitPct, idleStatus, palette, renderEvent, renderRecap, runningStatus, toolTarget, STATUS_GLYPHS, } from "@vincemakes/kiso-tui";
+import { escapeTerminal, cacheHitPct, idleStatus, palette, renderEvent, renderRecap, runningStatus, toolTarget, verifyOfferView, STATUS_GLYPHS, } from "@vincemakes/kiso-tui";
 import { deletionRiskHint, editFileDiff, writeFileDiff } from "@vincemakes/kiso-tui";
 import { canonicalTargetPath, shellProgressPath } from "@vincemakes/kiso-tools-node";
 import { canonicalizeUsage } from "@vincemakes/kiso-runtime";
@@ -191,12 +191,106 @@ function approvalDiff(name, input) {
  *  refusal — the "(amended)" marker's source. Per process, cleared as
  *  soon as it is shown: the marker describes ONE call, not a mode. */
 const amendedCalls = new Set();
-const SAFER_SYSTEM_PROMPT = [
+/**
+ * R3v2-F1: the format contract, stated FIRMLY. The first cut asked for
+ * "JSON ONLY" and left it there, which a verbose model reads as a
+ * preference — it wrote three sentences of preamble, opened a fence, and
+ * the cap ended the reply mid-string. Forbidding prose, naming the exact
+ * schema, and giving the nothing-is-safer case its own literal answer
+ * are all the same instruction: there is one thing to emit and no room
+ * to be helpful in the margins.
+ *
+ * The schema is an ENVELOPE rather than a bare array because a single
+ * top-level object leaves the model nowhere to put a preamble.
+ */
+export const SAFER_SYSTEM_PROMPT = [
     "You propose safer alternatives to a single shell/tool call a human is being asked to approve.",
-    "Answer with JSON ONLY: an array of 2-3 objects, each {\"command\": string, \"why\": string}.",
-    '"command" is the full replacement call. "why" is ONE short plain-language line saying what it does differently.',
-    "Prefer alternatives that avoid irreversible deletion. If you cannot improve on it, answer [].",
+    "Reply with JSON ONLY — no prose, no preamble, no code fence, nothing before or after the JSON.",
+    'The exact schema is {"alternatives":[{"command":"...","reason":"..."}]}, with 2-3 entries.',
+    '"command" is the full replacement call. "reason" is ONE line of plain language saying what it does differently.',
+    'Prefer alternatives that avoid irreversible deletion. If you cannot improve on it, reply {"alternatives":[]}.',
 ].join(" ");
+/**
+ * R3v2-F1: the side query's output ceiling — raised from 500, which was
+ * the cap the live failures hit EXACTLY.
+ *
+ * The JSON-only reply the prompt now asks for is about 200 tokens for
+ * three alternatives, so this ceiling is a runaway guard and not a
+ * budget the answer is expected to approach: it exists so a model that
+ * ignores the contract and writes an essay still stops, not so the
+ * answer has room. Output is billed only when generated, and the query
+ * fires only on a press, so the raise costs nothing on the path that
+ * works and removes the one that could not.
+ */
+export const SAFER_MAX_TOKENS = 1500;
+/**
+ * R3v2-F1: WHY the ask failed, when the reply's own text can prove it.
+ *
+ * This side reports the cause and never the copy — the sentences live in
+ * the panel package, next to each other, so there is one place where the
+ * words are chosen and one place they can drift from.
+ *
+ * "Cut short" is a DIAGNOSIS, so it is only claimed when the text shows
+ * it: a reply that closed its JSON and then failed our SHAPE returns
+ * null and gets the unqualified line, because telling that human their
+ * reply was truncated would be a confident wrong answer.
+ */
+export function saferFailure(text) {
+    return jsonBody(text) === "truncated" ? { reason: "truncated" } : null;
+}
+/**
+ * R3v2-F1: find the reply's JSON body by BALANCING brackets rather than
+ * by first-and-last.
+ *
+ * `indexOf("[")` / `lastIndexOf("]")` had two failure modes a verbose
+ * model hits constantly: a bracket in the trailing prose moved the end
+ * past the array, and a reply the cap cut in half had no end at all.
+ * Both returned null, and null could not say which — which is why the
+ * degradation line could not either.
+ *
+ * Returns the balanced slice, `"truncated"` when a value opens and the
+ * text ends before it closes, or null when there is no JSON value at
+ * all.
+ */
+function jsonBody(text) {
+    // a CLOSED fence is content-preserving to strip. An OPEN one means
+    // the reply ended inside the block — drop the opener and let the scan
+    // below reach the same verdict from the content.
+    const closed = text.match(/```(?:json)?\s*([\s\S]*?)```/);
+    const body = closed?.[1] ?? text.replace(/^[\s\S]*?```(?:json)?[ \t]*\r?\n/, "");
+    const start = body.search(/[[{]/);
+    if (start < 0)
+        return null;
+    let depth = 0;
+    let inString = false;
+    let escaped = false;
+    for (let i = start; i < body.length; i += 1) {
+        const c = body[i];
+        if (escaped) {
+            escaped = false;
+        }
+        else if (inString) {
+            if (c === "\\")
+                escaped = true;
+            else if (c === '"')
+                inString = false;
+        }
+        else if (c === '"') {
+            inString = true;
+        }
+        else if (c === "[" || c === "{") {
+            depth += 1;
+        }
+        else if (c === "]" || c === "}") {
+            depth -= 1;
+            if (depth === 0)
+                return body.slice(start, i + 1);
+            if (depth < 0)
+                return null;
+        }
+    }
+    return "truncated";
+}
 /**
  * Parse the model's answer DEFENSIVELY — anything unexpected is a
  * failure, and a failure degrades honestly.
@@ -210,34 +304,59 @@ const SAFER_SYSTEM_PROMPT = [
  *
  * A fenced code block is the one accommodation, because models emit it
  * constantly and it changes no content.
+ *
+ * R3v2-F1 widens that accommodation and NOTHING else. Unwrapping the
+ * named `alternatives` envelope, and reading `reason` as the spelling of
+ * `why` the prompt now asks for, are transport details: the entries that
+ * come out are verbatim the entries the model put in. That is the line
+ * between an accommodation and the salvage this parser refuses — a
+ * salvage changes WHICH alternatives are shown, and every rule that does
+ * that is still here. One bad entry still poisons the batch.
  */
 export function parseSaferOptions(text) {
-    const fenced = text.match(/```(?:json)?\s*([\s\S]*?)```/);
-    const body = (fenced?.[1] ?? text).trim();
-    const start = body.indexOf("[");
-    const end = body.lastIndexOf("]");
-    if (start < 0 || end <= start)
+    const body = jsonBody(text);
+    // truncation and absence part ways in saferFailureNote(), which reads
+    // the same scan; for the list itself both are the same nothing.
+    if (body === null || body === "truncated")
         return null;
     let parsed;
     try {
-        parsed = JSON.parse(body.slice(start, end + 1));
+        parsed = JSON.parse(body);
     }
     catch {
         return null;
     }
-    if (!Array.isArray(parsed) || parsed.length === 0)
+    const envelope = typeof parsed === "object" && parsed !== null ? parsed.alternatives : undefined;
+    const list = Array.isArray(parsed) ? parsed : Array.isArray(envelope) ? envelope : null;
+    if (list === null || list.length === 0)
         return null;
     const out = [];
-    for (const item of parsed.slice(0, 3)) {
+    for (const item of list.slice(0, 3)) {
         if (typeof item !== "object" || item === null)
             return null;
-        const { command, why } = item;
+        const { command, reason, why } = item;
         if (typeof command !== "string" || command.trim() === "")
             return null;
-        out.push({ command: command.trim(), why: typeof why === "string" ? why.trim() : "" });
+        const line = typeof reason === "string" ? reason : typeof why === "string" ? why : "";
+        out.push({ command: command.trim(), why: line.trim() });
     }
     return out.length === 0 ? null : out;
 }
+/** TV-1B — the plain-word verdict tail for the settled checklist.
+ *  "no passing check yet" covers both never-ran and ran-and-failed
+ *  without lying; "outdated" claims only what the trajectory proves. */
+function taskVerdictWords(kind) {
+    switch (kind) {
+        case "verified":
+            return "checked \u2713";
+        case "stale":
+            return "check outdated \u2014 work may have changed after it";
+        case "none":
+            return "no passing check yet";
+        case "unreadable":
+            return "task list unreadable";
+    }
+}
 /** W21 — the panel view for a permission_requested: the rule line (the
  *  why-asked speaker + the §3.5 fix hint), the toolTarget title, the
  *  "▸ run paused" status, and the ALWAYS-verbose args. */
@@ -406,6 +525,15 @@ submitTurn) {
             // construction (ADR-0040).
             switch (ev.type) {
                 case "user_input":
+                    // TV-1B: a system-sourced input is PRODUCT MACHINERY — visible
+                    // (every durable input renders) but never painted as the
+                    // user's words. Provenance is honest on screen, not only in
+                    // the log.
+                    if (ev.source === "system") {
+                        body.notice("\u25c6 verification pass");
+                        body.notice(`  ${typeof ev.content === "string" ? ev.content : ""}`);
+                        break;
+                    }
                     body.userLine(typeof ev.content === "string" ? ev.content : "");
                     break;
                 case "thinking":
@@ -512,9 +640,13 @@ submitTurn) {
                             purpose: "safer-options",
                             systemPrompt: SAFER_SYSTEM_PROMPT,
                             prompt: `the pending call is: ${name} ${JSON.stringify(ev.input ?? {})}`,
-                            maxTokens: 500,
+                            maxTokens: SAFER_MAX_TOKENS,
                         });
-                        return parseSaferOptions(answer);
+                        // R3v2-F1: a failure reports its CAUSE when the reply can
+                        // prove one, so the panel can say which failure this was.
+                        // saferFailure() returns null for every cause we cannot
+                        // demonstrate, which is the unqualified line — unchanged.
+                        return parseSaferOptions(answer) ?? saferFailure(answer);
                     };
                     const verdict = await askPanel(input, approvalView(name, ev, amendedCalls.has(name)), { safer });
                     amendedCalls.delete(name);
@@ -579,6 +711,19 @@ submitTurn) {
                     // events (zero tokens). The dock's status bar still paints.
                     statusCb?.(usage, estimateCtxRatio(session));
                     const ratio = estimateCtxRatio(session);
+                    // TV-1B: the settle verdict — the checklist stops lying. When
+                    // every item is CLAIMED done, the settled block's tail says
+                    // what the projection actually proves ("no passing check yet"
+                    // covers never-ran AND ran-and-failed; "may have changed"
+                    // claims trajectory knowledge, never filesystem knowledge).
+                    // A run that emitted no task_set still gets the block: the
+                    // claims live in the durable log, and the settle SYNTHESIZES
+                    // the display from session.assessTasks() — a UI projection,
+                    // never a new durable fact.
+                    const tv = session.assessTasks();
+                    if (tv.claims.length > 0 && tv.allClaimedDone) {
+                        body.checklist(taskVerdictWords(tv.evidence.kind), tv.claims.map((c) => ({ text: c.text, status: c.status })));
+                    }
                     // W14: the turn record closes HERE — before the recap logs, so
                     // the commit loop folds the quiet turn's held cells first (the
                     // fold line lands above the recap, natural cell order).
@@ -651,9 +796,9 @@ export async function chat(session, faux, input, autoCompact) {
         console.log("\n[exit requested]");
         input.close();
     };
-    const turn = (text) => new Promise((resolve, reject) => {
+    const turn = (text, seedSource) => new Promise((resolve, reject) => {
         queued = Math.max(0, queued - 1); // a queued turn starts
-        const run = session.run(text);
+        const run = seedSource !== undefined ? session.run(text, { source: seedSource }) : session.run(text);
         currentRun = run;
         turnNo += 1;
         const myTurn = turnNo;
@@ -684,6 +829,41 @@ export async function chat(session, faux, input, autoCompact) {
                 // exit, so the release always runs.
                 if (eotSeen)
                     exitAtEmptyPrompt();
+                // TV-1B — the thin task driver. A VERIFICATION turn settling
+                // consumes the task-set identity it produced (a verifier's
+                // own task_set belongs to the SAME accepted offer) and never
+                // opens another offer. A normal COMPLETED settle may offer —
+                // gated so the suggestion always yields to human intent.
+                if (seedSource === "system") {
+                    const after = session.assessTasks();
+                    if (after.lastTaskSetSeq !== null)
+                        offeredTaskSeqs.add(after.lastTaskSetSeq);
+                }
+                else if (last?.type === "terminal" &&
+                    last.outcome.kind === "completed" &&
+                    process.stdin.isTTY &&
+                    !cancelled &&
+                    !eotSeen &&
+                    pendingAsk === null &&
+                    pendingTurns.length === 0 &&
+                    input.line() === "") {
+                    const tv = session.assessTasks();
+                    if (tv.claims.length > 0 &&
+                        tv.allClaimedDone &&
+                        (tv.evidence.kind === "none" || tv.evidence.kind === "stale") &&
+                        tv.lastTaskSetSeq !== null &&
+                        !offeredTaskSeqs.has(tv.lastTaskSetSeq)) {
+                        const verdict = await askPanel(input, verifyOfferView());
+                        // an explicit answer — Yes, Not now, OR Esc — consumes
+                        // the offer for THIS claims-set; only gate-suppression
+                        // (above) leaves it live for a later settle.
+                        offeredTaskSeqs.add(tv.lastTaskSetSeq);
+                        if (verdict.action === "allow") {
+                            queued += 1; // turn() decrements — keep the ledger honest
+                            chainRef.current = chainRef.current.then(() => turn(VERIFY_SEED, "system"));
+                        }
+                    }
+                }
                 // round 8: after EVERY turn the prompt is re-armed — the human
                 // never types blind after the first turn.
                 input.prompt();
@@ -788,6 +968,14 @@ export async function chat(session, faux, input, autoCompact) {
     // A slot leaves the queue when its turn STARTS or when the user
     // pops it (cancelled — the chain segment skips it).
     const pendingTurns = [];
+    // TV-1B — the offer memory: session-local BY DESIGN (a dead process's
+    // "not now" should not silence a live one; resume re-offers once,
+    // honestly), keyed by the assessed claims' identity.
+    const offeredTaskSeqs = new Set();
+    // The fixed verification seed — durable with source:"system": WHO asked
+    // is provenance in the log; on the provider wire it stays an ordinary
+    // user-role message (never a system-prompt escalation).
+    const VERIFY_SEED = "Verify the completed work: run the project's checks and report what passes and what fails.";
     // v2b: the live status bar (docked only). Modes: /mode switches repaint
     // it immediately through paintStatus (the last turn stats are kept).
     // v3 §03: the status bar has TWO states. Idle: the mode is ALWAYS

package/dist/state.d.ts

@@ -5,7 +5,7 @@
  * creates the mutable ones (setBody / setAgentModel / setExtensionLists);
  * the moved modules read and mutate at call time.
  */
-import { Dock, type AtItem, type Body, type PanelVerdict, type PanelView, type SaferOption, type SessionCardView } from "@vincemakes/kiso-tui";
+import { Dock, type AtItem, type Body, type PanelVerdict, type PanelView, type SaferAnswer, type SessionCardView } from "@vincemakes/kiso-tui";
 import type { KisoExtension, StoreRecord } from "@vincemakes/kiso-runtime";
 /** finding #11: KISO_HOME is the ONE root — every default path derives from
  *  it (sessions, trust, extensions, mcp config, skills). The dedicated
@@ -82,9 +82,11 @@ export interface LineInput {
      *  the tab-amend), the compositor renders the block + the leads. */
     /** TUI2-R3v2 ③: `opts.safer` is the on-demand alternatives provider —
      *  absent for every panel that has no such option (the ask, the pick,
-     *  the trust gate), so those buttons cannot exist to be pressed. */
+     *  the trust gate), so those buttons cannot exist to be pressed.
+     *  R3v2-F1: it resolves a SaferAnswer, so a failure that can name its
+     *  cause does — `null` still means a failure with nothing to add. */
     panelAsk(view: PanelView, onCommit: (v: PanelVerdict) => void, opts?: {
-        safer?: () => Promise<readonly SaferOption[] | null>;
+        safer?: () => Promise<SaferAnswer>;
     }): void;
     /** W21: cancel the panel — the SIGINT pair to panelAsk. */
     panelCancel(): void;

package/dist/trust-ui.d.ts

@@ -5,7 +5,7 @@
  * chat.ts), the don't-ask-again rule writer, and the uncertain-execution
  * decisions. All bodies moved verbatim from index.ts.
  */
-import { type PanelVerdict, type PanelView, type SaferOption } from "@vincemakes/kiso-tui";
+import { type PanelVerdict, type PanelView, type SaferAnswer } from "@vincemakes/kiso-tui";
 import type { AskUI } from "@vincemakes/kiso-ask-ext";
 import { type ProjectArtifacts } from "@vincemakes/kiso-runtime";
 import type { AgentSession } from "@vincemakes/kiso-runtime";
@@ -35,7 +35,7 @@ import { type LineInput } from "./state.js";
  */
 export declare let pendingAsk: (() => void) | null;
 export declare function askPanel(input: LineInput, view: PanelView, opts?: {
-    safer?: () => Promise<readonly SaferOption[] | null>;
+    safer?: () => Promise<SaferAnswer>;
 }): Promise<PanelVerdict>;
 /**
  * KC3.5 — the AskUI bridge: the panel the ask extension asks through.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vincemakes/kiso-code",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "kiso CLI — the durable coding agent that survives kill -9: kiso chat / kiso resume / kiso sessions.",
   "type": "module",
   "license": "MIT",
@@ -18,19 +18,19 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@vincemakes/kiso-ask-ext": "0.12.0",
-    "@vincemakes/kiso-core": "0.12.0",
-    "@vincemakes/kiso-evals": "0.12.0",
-    "@vincemakes/kiso-mcp-ext": "0.12.0",
-    "@vincemakes/kiso-provider-anthropic": "0.12.0",
-    "@vincemakes/kiso-provider-openai": "0.12.0",
-    "@vincemakes/kiso-runtime": "0.12.0",
-    "@vincemakes/kiso-skills-ext": "0.12.0",
-    "@vincemakes/kiso-subagent-ext": "0.12.0",
-    "@vincemakes/kiso-task-ext": "0.12.0",
-    "@vincemakes/kiso-tools-node": "0.12.0",
-    "@vincemakes/kiso-tui": "0.12.0",
-    "@vincemakes/kiso-tui-cells": "0.12.0"
+    "@vincemakes/kiso-ask-ext": "0.14.0",
+    "@vincemakes/kiso-core": "0.14.0",
+    "@vincemakes/kiso-evals": "0.14.0",
+    "@vincemakes/kiso-mcp-ext": "0.14.0",
+    "@vincemakes/kiso-provider-anthropic": "0.14.0",
+    "@vincemakes/kiso-provider-openai": "0.14.0",
+    "@vincemakes/kiso-runtime": "0.14.0",
+    "@vincemakes/kiso-skills-ext": "0.14.0",
+    "@vincemakes/kiso-subagent-ext": "0.14.0",
+    "@vincemakes/kiso-task-ext": "0.14.0",
+    "@vincemakes/kiso-tools-node": "0.14.0",
+    "@vincemakes/kiso-tui": "0.14.0",
+    "@vincemakes/kiso-tui-cells": "0.14.0"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",