@vincemakes/kiso-code 0.31.1 → 0.32.0

package/dist/breaker.d.ts

@@ -0,0 +1,57 @@
+/**
+ * LT-2 — the loop breaker (kiso-doc/kiso-lt1-mini-spec-2026-09-09.md, part
+ * one, corrected by the chain law — see below).
+ *
+ * An agent that keeps issuing the SAME failing call — same tool, same
+ * input, failure after failure — is not making progress, and since R3e
+ * removed the silent turn limit nothing stopped it. This extension does,
+ * in the one place the product already decides tool calls: the approval
+ * chain. It rides the chain like the five mode tiers do (a `decide()` that
+ * speaks or abstains), placed at the HEAD so that when it speaks, the
+ * verdict's `decidedBy` names it.
+ *
+ * THE VERDICT IS A DENY WITH A REASON, NOT AN ASK. The spec asked for a
+ * human question; the chain composes deny > allow > ask over the speaking
+ * verdicts, so an `ask` from here would lose to the tier's `allow` (a read
+ * under `default`, anything under `bypass`) and the loop would go on. A
+ * deny wins over every tier — the same law that lets a user extension's
+ * deny beat `bypass` — and the model receives it as the call's result with
+ * the reason (the 1c grammar: refuse with a reason and continue), so the
+ * next turn has to change course. The human sees the denial on the
+ * transcript with `decidedBy: breaker`; the 50-turn checkpoint (part two)
+ * is where a human is asked.
+ *
+ * Counting: CONSECUTIVE failed results of one (tool, input) key within a
+ * run. A success, a different call, or the run's terminal resets it. The
+ * third identical attempt is denied. N = 3 is named below; dogfood moves it
+ * with a finding, never silently.
+ */
+import type { Event, KisoExtension, PolicyVerdict } from "@vincemakes/kiso-core";
+/** The third identical failed attempt is the one refused. */
+export declare const BREAKER_LIMIT = 3;
+/** The name the verdict wears (`decidedBy`). */
+export declare const BREAKER_NAME = "breaker";
+/** A stable key for (tool, input): object keys sorted at every depth, so
+ *  two calls that mean the same thing key the same whatever order the
+ *  model wrote the fields in. */
+export declare function callKey(name: string, input: unknown): string;
+/** The per-run state, kept small: the last failed key and how many times
+ *  in a row it failed. `calls` maps a callId to its key while a call is in
+ *  flight (the failure arrives on the result event, keyed by callId). */
+export interface BreakerState {
+    lastKey: string | null;
+    failures: number;
+    readonly calls: Map<string, string>;
+}
+export declare function breakerState(): BreakerState;
+/** What the log says, applied to the state. Exported so the rule is testable
+ *  as a pure function of the event sequence. */
+export declare function observe(state: BreakerState, event: Event): void;
+/** The verdict for a call about to be decided: the (limit − 1)th consecutive
+ *  failure of this exact key has already happened, so this attempt would be
+ *  the limit-th — refused, with the count in the reason. */
+export declare function verdict(state: BreakerState, name: string, input: unknown, limit?: number): PolicyVerdict;
+/** The extension: one state per process (a session runs one run at a time,
+ *  and the terminal resets it), the log observed through the hook, the
+ *  verdict through the chain. */
+export declare function breakerExtension(limit?: number): KisoExtension;

package/dist/breaker.js

@@ -0,0 +1,119 @@
+/**
+ * LT-2 — the loop breaker (kiso-doc/kiso-lt1-mini-spec-2026-09-09.md, part
+ * one, corrected by the chain law — see below).
+ *
+ * An agent that keeps issuing the SAME failing call — same tool, same
+ * input, failure after failure — is not making progress, and since R3e
+ * removed the silent turn limit nothing stopped it. This extension does,
+ * in the one place the product already decides tool calls: the approval
+ * chain. It rides the chain like the five mode tiers do (a `decide()` that
+ * speaks or abstains), placed at the HEAD so that when it speaks, the
+ * verdict's `decidedBy` names it.
+ *
+ * THE VERDICT IS A DENY WITH A REASON, NOT AN ASK. The spec asked for a
+ * human question; the chain composes deny > allow > ask over the speaking
+ * verdicts, so an `ask` from here would lose to the tier's `allow` (a read
+ * under `default`, anything under `bypass`) and the loop would go on. A
+ * deny wins over every tier — the same law that lets a user extension's
+ * deny beat `bypass` — and the model receives it as the call's result with
+ * the reason (the 1c grammar: refuse with a reason and continue), so the
+ * next turn has to change course. The human sees the denial on the
+ * transcript with `decidedBy: breaker`; the 50-turn checkpoint (part two)
+ * is where a human is asked.
+ *
+ * Counting: CONSECUTIVE failed results of one (tool, input) key within a
+ * run. A success, a different call, or the run's terminal resets it. The
+ * third identical attempt is denied. N = 3 is named below; dogfood moves it
+ * with a finding, never silently.
+ */
+/** The third identical failed attempt is the one refused. */
+export const BREAKER_LIMIT = 3;
+/** The name the verdict wears (`decidedBy`). */
+export const BREAKER_NAME = "breaker";
+/** A stable key for (tool, input): object keys sorted at every depth, so
+ *  two calls that mean the same thing key the same whatever order the
+ *  model wrote the fields in. */
+export function callKey(name, input) {
+    return `${name}\0${stable(input)}`;
+}
+function stable(v) {
+    if (Array.isArray(v))
+        return `[${v.map(stable).join(",")}]`;
+    if (v !== null && typeof v === "object") {
+        const o = v;
+        return `{${Object.keys(o)
+            .sort()
+            .map((k) => `${JSON.stringify(k)}:${stable(o[k])}`)
+            .join(",")}}`;
+    }
+    return JSON.stringify(v) ?? "undefined";
+}
+export function breakerState() {
+    return { lastKey: null, failures: 0, calls: new Map() };
+}
+/** What the log says, applied to the state. Exported so the rule is testable
+ *  as a pure function of the event sequence. */
+export function observe(state, event) {
+    switch (event.type) {
+        case "tool_call_end":
+            state.calls.set(event.callId, callKey(event.name, event.input));
+            return;
+        case "tool_result": {
+            const key = state.calls.get(event.callId);
+            state.calls.delete(event.callId);
+            if (key === undefined)
+                return;
+            if (!event.isError) {
+                state.lastKey = null;
+                state.failures = 0;
+                return;
+            }
+            if (state.lastKey === key)
+                state.failures += 1;
+            else {
+                state.lastKey = key;
+                state.failures = 1;
+            }
+            return;
+        }
+        case "terminal":
+            // a run's end is a clean slate: the next run starts at zero
+            state.lastKey = null;
+            state.failures = 0;
+            state.calls.clear();
+            return;
+        default:
+            return;
+    }
+}
+/** The verdict for a call about to be decided: the (limit − 1)th consecutive
+ *  failure of this exact key has already happened, so this attempt would be
+ *  the limit-th — refused, with the count in the reason. */
+export function verdict(state, name, input, limit = BREAKER_LIMIT) {
+    if (state.lastKey !== null && state.lastKey === callKey(name, input) && state.failures >= limit - 1) {
+        return {
+            action: "deny",
+            reason: `${BREAKER_NAME}: the same ${name} call failed ${state.failures} times in a row — change the input or the approach; the identical call is not tried again`,
+        };
+    }
+    return { action: "abstain" };
+}
+/** The extension: one state per process (a session runs one run at a time,
+ *  and the terminal resets it), the log observed through the hook, the
+ *  verdict through the chain. */
+export function breakerExtension(limit = BREAKER_LIMIT) {
+    const state = breakerState();
+    return {
+        name: BREAKER_NAME,
+        hooks: {
+            async onEvent(event) {
+                observe(state, event);
+            },
+        },
+        approvals: [
+            {
+                decide: async (payload) => verdict(state, payload.name, payload.input, limit),
+            },
+        ],
+    };
+}

package/dist/chat.d.ts

@@ -170,6 +170,19 @@ export declare function parseSaferOptions(text: string): SaferOption[] | null;
  * echo is UI, the chip is the record; the momentary double-render is
  * the design's explicit point).
  */
+/** LT-2b — the turn checkpoint (kiso-doc/kiso-lt1-mini-spec-2026-09-09.md,
+ *  part two). R3e stands: no hard turn limit on an interactive session. What
+ *  a long run gets instead is a QUESTION every CHECKPOINT_TURNS model turns —
+ *  the run is paused between two model turns (the generator is simply not
+ *  pulled while the panel is up; the kernel does nothing meanwhile) and the
+ *  human answers. "Keep going" resumes it, the next question one checkpoint
+ *  later; "Stop here" aborts the run — `aborted by user`, resumable, never
+ *  silent. A decline (esc) is "keep going": the run was already running, and
+ *  esc on a panel is the panel's decline, not the run's abort. Headless
+ *  entries never see it: the panel needs the dock, and a pipe, `-p` or a
+ *  task file has none. 50 is named here; a finding moves it, never a stray
+ *  edit. */
+export declare const CHECKPOINT_TURNS = 50;
 export declare function consumeRun(session: AgentSession, run: Run, input: LineInput, turnNo: number, faux: boolean, statusCb: ((usage: RunUsage, ctxRatio: number, costUsd?: number | null) => void) | null, 
 /** W21: the amend words ("Yes + feedback") ride the NEXT user turn —
  *  threaded from chat's submitTurn; absent in the recovery flow
@@ -185,6 +198,14 @@ export type ChatEnd = {
 } | {
     readonly next: "switch";
     readonly id: string;
+}
+/** §2.5: the caller REBUILDS the agent and re-enters on the same id.
+ *  Not "switch": switching keeps the agent and only changes the id,
+ *  which would reload nothing at all — the tool registry lives in the
+ *  agent's constructor. */
+ | {
+    readonly next: "reload";
+    readonly id: string;
 };
 /** The session-navigation seam main provides: the OTHER sessions'
  *  ids, and (when a dock is up) the existing picker. */

package/dist/chat.js

@@ -6,11 +6,11 @@
  */
 import { readFileSync, statSync } from "node:fs";
 import { escapeTerminal, cacheHitPct, idleStatus, palette, renderEvent, renderRecap, runningStatus, toolTarget, verifyOfferView, STATUS_GLYPHS, } from "@vincemakes/kiso-tui";
-import { deletionRiskHint, editFileDiff, writeFileDiff } from "@vincemakes/kiso-tui";
+import { askView, deletionRiskHint, editFileDiff, writeFileDiff } from "@vincemakes/kiso-tui";
 import { canonicalTargetPath, shellProgressPath } from "@vincemakes/kiso-tools-node";
 import { canonicalizeUsage } from "@vincemakes/kiso-runtime";
 import { canonicalizeUsageForModel, requestBudget } from "@vincemakes/kiso-runtime/internal";
-import { dispatch } from "./dispatch.js";
+import { dispatch, abortBangCommand } from "./dispatch.js";
 import { agentBaseUrl, agentModel, body, bodyLog, configuredWindow, dock } from "./state.js";
 import { attachImages } from "./attachments.js";
 import { lookupModelMetadata } from "@vincemakes/kiso-runtime/internal";
@@ -542,6 +542,37 @@ function toRenderInput(ev) {
  * echo is UI, the chip is the record; the momentary double-render is
  * the design's explicit point).
  */
+/** LT-2b — the turn checkpoint (kiso-doc/kiso-lt1-mini-spec-2026-09-09.md,
+ *  part two). R3e stands: no hard turn limit on an interactive session. What
+ *  a long run gets instead is a QUESTION every CHECKPOINT_TURNS model turns —
+ *  the run is paused between two model turns (the generator is simply not
+ *  pulled while the panel is up; the kernel does nothing meanwhile) and the
+ *  human answers. "Keep going" resumes it, the next question one checkpoint
+ *  later; "Stop here" aborts the run — `aborted by user`, resumable, never
+ *  silent. A decline (esc) is "keep going": the run was already running, and
+ *  esc on a panel is the panel's decline, not the run's abort. Headless
+ *  entries never see it: the panel needs the dock, and a pipe, `-p` or a
+ *  task file has none. 50 is named here; a finding moves it, never a stray
+ *  edit. */
+export const CHECKPOINT_TURNS = 50;
+async function checkpointAsk(input, turns) {
+    const verdict = await askPanel(input, askView({
+        questions: [
+            {
+                question: `${turns} turns and still working — keep going?`,
+                header: "checkpoint",
+                options: [
+                    { label: "Keep going", description: `the next question at ${turns + CHECKPOINT_TURNS}` },
+                    { label: "Stop here", description: "the run ends as aborted by you; kiso resume continues it later" },
+                ],
+            },
+        ],
+    }));
+    if (verdict.action !== "answers" || !("answers" in verdict.result))
+        return true; // declined: nothing changes
+    const first = verdict.result.answers[0];
+    return !(first !== undefined && "choice" in first && first.choice === "Stop here");
+}
 export async function consumeRun(session, run, input, turnNo, faux, statusCb, 
 /** W21: the amend words ("Yes + feedback") ride the NEXT user turn —
  *  threaded from chat's submitTurn; absent in the recovery flow
@@ -572,8 +603,16 @@ submitTurn) {
         tailers.delete(callId);
     };
     try {
+        let modelTurns = 0;
         for await (const ev of run) {
             last = ev;
+            // LT-2b: a model turn ends with its stop; every CHECKPOINT_TURNS of them
+            // the human is asked before the run is pulled any further
+            if (ev.type === "stop" && dock.active) {
+                modelTurns += 1;
+                if (modelTurns % CHECKPOINT_TURNS === 0 && !(await checkpointAsk(input, modelTurns)))
+                    run.abort();
+            }
             if (ev.type !== "thinking") {
                 if (thinkingSince !== null) {
                     thoughtSeconds += (Date.now() - thinkingSince) / 1000;
@@ -878,6 +917,9 @@ export async function chat(session, faux, input, autoCompact, nav) {
     // the switch directive — set once by dispatch's /clear or /resume,
     // resolved through the end signal so the final awaits still run
     let switchTo = null;
+    // §2.5: the reload directive — same resolution path as switchTo, so the
+    // final awaits still run before chat() returns.
+    let reloadReq = false;
     let resolveEnd = () => { };
     const endSignal = new Promise((r) => {
         resolveEnd = r;
@@ -1031,6 +1073,13 @@ export async function chat(session, faux, input, autoCompact, nav) {
             exitAtEmptyPrompt();
     });
     input.onEscape(() => {
+        // §2.2: a `!` command is offered the key FIRST. The two are never
+        // both in flight — the dispatcher is serialized on the chain — so
+        // this is an ordering, not a precedence rule.
+        if (abortBangCommand()) {
+            console.log("\n[aborting command]");
+            return;
+        }
         if (currentRun) {
             console.log("\n[aborting run]");
             pendingAsk?.();
@@ -1137,6 +1186,17 @@ export async function chat(session, faux, input, autoCompact, nav) {
     // a turn ended. One call, and the SAME formatter — a boot-time copy of
     // the row would drift from the real one the moment either changed.
     paintIdle();
+    // DF-0311-F1 (the 0.31.1 dogfood, reproduced by the owner): the meter is
+    // the last TURN's figure. After /model the row named the NEW model beside
+    // the OLD model's CH until the next recap — and beside a model whose
+    // cache is unobservable (OR-10) that is a measurement it never had. A new
+    // binding starts with no meter; its first turn paints the first figure.
+    // The session's running cost is untouched: it is the session's, not the
+    // binding's, and the row does not render it anyway.
+    const modelSwitched = () => {
+        runUsage = { in: null, out: null, cache: null, known: false };
+        paintIdle();
+    };
     const statusCb = (u, ctx, costUsd) => {
         runUsage = u;
         addCost(costUsd ?? null);
@@ -1207,6 +1267,7 @@ export async function chat(session, faux, input, autoCompact, nav) {
         chainRef,
         isRunning: () => currentRun !== null,
         paintIdle,
+        modelSwitched,
         submitTurn,
         estimateCtx: () => displayCtxRatio(session),
         contextWindow: () => contextWindowTokens(),
@@ -1217,6 +1278,10 @@ export async function chat(session, faux, input, autoCompact, nav) {
             switchTo = id;
             resolveEnd();
         },
+        requestReload: () => {
+            reloadReq = true;
+            resolveEnd();
+        },
         sessions: () => nav?.sessions() ?? [],
         ...(nav?.pick !== undefined ? { pickSession: nav.pick } : {}),
     };
@@ -1256,6 +1321,8 @@ export async function chat(session, faux, input, autoCompact, nav) {
     // chain action (the sentinel's control char marks the key, so a typed
     // "expand" turn is never intercepted).
     input.onExpand(() => dispatch("\x12expand", dispatchCtx));
+    input.onThink?.(() => dispatch("\x14think", dispatchCtx));
+    input.onEditor?.(() => dispatch("\x07editor", dispatchCtx));
     // E1 §3 — ctrl+x and `/copy` are the same action reached two ways, so
     // they are the same sentinel: one implementation, one behaviour.
     input.onCopy(() => dispatch("\x18copy", dispatchCtx));
@@ -1323,5 +1390,9 @@ export async function chat(session, faux, input, autoCompact, nav) {
     // runs before the exit or the chain is already settled. One level is
     // enough: the /compact segment appends nothing of its own.
     await chainRef.current;
-    return switchTo === null ? { next: "exit" } : { next: "switch", id: switchTo };
+    if (switchTo !== null)
+        return { next: "switch", id: switchTo };
+    // a switch beats a reload: /resume and /clear are going somewhere else,
+    // and the agent they land on is rebuilt by the caller either way.
+    return reloadReq ? { next: "reload", id: session.id } : { next: "exit" };
 }

package/dist/config.d.ts

@@ -46,6 +46,9 @@ export interface ModelProfile {
     /** PH-1c.1: opt-in Anthropic prompt caching for this profile —
      *  default off (a request-byte cost behavior never flips silently). */
     readonly promptCaching?: boolean;
+    /** LT-1: milliseconds the model stream may go silent before the request
+     *  is aborted and retried. Default 120,000; 0 disables the watchdog. */
+    readonly streamIdleMs?: number;
 }
 export interface AutoCompactConfig {
     readonly thresholdRatio: number;

package/dist/config.js

@@ -100,12 +100,15 @@ export function parseConfig(text, source) {
                 fail(`models.${name}.baseUrl`, "expected a string");
             if (p.promptCaching !== undefined && typeof p.promptCaching !== "boolean")
                 fail(`models.${name}.promptCaching`, "expected a boolean");
+            if (p.streamIdleMs !== undefined && (typeof p.streamIdleMs !== "number" || !Number.isFinite(p.streamIdleMs) || p.streamIdleMs < 0))
+                fail(`models.${name}.streamIdleMs`, "expected a non-negative number of milliseconds (0 disables the stream watchdog)");
             models[name] = {
                 kind: p.kind,
                 model: p.model,
                 ...(typeof p.apiKeyEnv === "string" ? { apiKeyEnv: p.apiKeyEnv } : {}),
                 ...(typeof p.baseUrl === "string" ? { baseUrl: p.baseUrl } : {}),
                 ...(typeof p.promptCaching === "boolean" ? { promptCaching: p.promptCaching } : {}),
+                ...(typeof p.streamIdleMs === "number" ? { streamIdleMs: p.streamIdleMs } : {}),
             };
         }
         out.models = models;

package/dist/dispatch.d.ts

@@ -18,6 +18,11 @@ export interface DispatchCtx {
     readonly isRunning: () => boolean;
     /** the /mode switch repaints the status bar at once. */
     readonly paintIdle: () => void;
+    /** DF-0311-F1: a successful /model switch repaints the row with NO meter.
+     *  The meter is the last TURN's figure, measured on the binding that is
+     *  gone; a binding that has not run yet paints none — an unmeasured
+     *  cache is not a 0% cache, and it is not the previous model's either. */
+    readonly modelSwitched: () => void;
     /** submit a real turn: queue + chain (the turn closure lives in chat). */
     readonly submitTurn: (line: string) => void;
     /** the /status context estimate. */
@@ -28,13 +33,28 @@ export interface DispatchCtx {
     /** the /resume+/clear mini-spec: end this chat() with a switch to
      *  another session — main re-enters chat there; the editor survives. */
     readonly requestSwitch: (id: string) => void;
+    /** §2.5: end this chat() with a REBUILD of the agent on the SAME
+     *  session — extensions, skills and config are read again. */
+    readonly requestReload: () => void;
     /** every durable session id (the /resume validation + listing). */
     readonly sessions: () => readonly string[];
     /** the dock's session picker, when one exists (bare /resume). */
     readonly pickSession?: () => Promise<string | null>;
 }
-/** The ONE dispatcher — slash commands, exit, and turns. The recovery
- *  replay routes through it too — a queued "/last" must never become a
- *  user turn (v2c: the rl lives in main, so lines arrive earlier and the
- *  queue is the common path). */
+/** esc while a `!` command runs kills it — the SAME abort the shell tool
+ *  gives a model's call, so the whole process group goes, children
+ *  included. Exported because the esc key reaches the editor first: chat
+ *  offers it here before it reaches a model run, and only one of the two
+ *  can be in flight. */
+export declare function abortBangCommand(): boolean;
+/** §2.2 — what a submitted line asks for, if it asks for a shell at all.
+ *  Split out from the dispatcher so the rule is testable without a
+ *  terminal: `null` means this is not the gesture and the line is a turn.
+ *
+ *  `!!` is checked before `!` because the longer prefix is the narrower
+ *  claim; testing `!` first would swallow both. */
+export declare function parseBang(trimmed: string): {
+    readonly command: string;
+    readonly send: boolean;
+} | null;
 export declare function dispatch(line: string, ctx: DispatchCtx): void;

package/dist/dispatch.js

@@ -8,8 +8,10 @@ import { newSessionId } from "./session-id.js";
 import { buildAdapter, lookupModelMetadata, resolveContinuationScope, resolveReasoning } from "@vincemakes/kiso-runtime/internal";
 import { MODES, MODE_NOTE, getMode, setMode } from "./mode.js";
 import { clipboardWrite, lastAnswer } from "./clipboard.js";
-import { agentModel, body, bodyLog, configModels, dock, lastBinding, readContextLedger, sessionsDir, setAgentModel, setCurrentModelName, setLastBinding } from "./state.js";
+import { agentModel, body, bodyLog, codingToolOptions, kisoHome, configModels, dock, lastBinding, readContextLedger, sessionsDir, setAgentModel, setCurrentModelName, setModelChoice, setLastBinding } from "./state.js";
 import { authForProfile, directWriteProfile, profileAvailable, unavailableReason } from "./config.js";
+import { shellTool } from "@vincemakes/kiso-tools-node";
+import { join } from "node:path";
 /** The picker's CLI half (owner 2026-09-08): a profile's LEGAL effort levels
  *  and its default, from the registry, shown wherever the profile is listed
  *  — kiso never silently drops a level, and now it shows the ones it takes.
@@ -77,8 +79,98 @@ import { oauthTokenThunk } from "./auth/token.js";
  *  replay routes through it too — a queued "/last" must never become a
  *  user turn (v2c: the rl lives in main, so lines arrive earlier and the
  *  queue is the common path). */
+/** §2.2 — the `!` command in flight, if one is. A `!` command and a model
+ *  run are never both running (the dispatcher is serialized on the chain),
+ *  so one slot is the whole state. */
+let activeBang = null;
+/** esc while a `!` command runs kills it — the SAME abort the shell tool
+ *  gives a model's call, so the whole process group goes, children
+ *  included. Exported because the esc key reaches the editor first: chat
+ *  offers it here before it reaches a model run, and only one of the two
+ *  can be in flight. */
+export function abortBangCommand() {
+    if (activeBang === null)
+        return false;
+    activeBang.abort();
+    return true;
+}
+/** §2.2 — what a submitted line asks for, if it asks for a shell at all.
+ *  Split out from the dispatcher so the rule is testable without a
+ *  terminal: `null` means this is not the gesture and the line is a turn.
+ *
+ *  `!!` is checked before `!` because the longer prefix is the narrower
+ *  claim; testing `!` first would swallow both. */
+export function parseBang(trimmed) {
+    // a multi-line paste that merely begins with `!` is prose, the same
+    // rule `/` already follows one branch below.
+    if (trimmed.includes("\n") || !trimmed.startsWith("!"))
+        return null;
+    const send = !trimmed.startsWith("!!");
+    return { command: trimmed.slice(send ? 1 : 2).trim(), send };
+}
+/** §2.2 — `!cmd` runs a command and SENDS it, `!!cmd` runs one and shows
+ *  it. Both go through the shell tool's own runner, so the timeout (30 s),
+ *  the output cap (100,000 chars, which names what it dropped), the
+ *  whole-tree kill and the STRIPPED environment are the tool's and not a
+ *  second set of rules. The `!`/`!!` difference is what the MODEL sees,
+ *  never what leaves the machine.
+ *
+ *  No approval panel, at any tier including plan: the human typed the
+ *  command. That is not a policy exemption, it is structural — this
+ *  dispatcher only ever sees lines a human submitted, so a model cannot
+ *  reach this branch. */
+function runBang(command, send, ctx) {
+    ctx.chainRef.current = ctx.chainRef.current.then(async () => {
+        const controller = new AbortController();
+        activeBang = controller;
+        try {
+            const tool = shellTool(codingToolOptions());
+            const result = await tool.execute({ command }, { signal: controller.signal });
+            // one fenced block, read as a terminal transcript: the command
+            // and what it printed. The tool's own overflow note rides inside
+            // `content`, so a capped run says so in the same words a model's
+            // call would.
+            const block = ["```console", `$ ${command}`, result.content, "```"].join("\n");
+            if (send) {
+                // an ORDINARY user turn: durable, in the log, and the model
+                // sees exactly what the human saw.
+                ctx.submitTurn(block);
+                return; // submitTurn owns the prompt from here
+            }
+            bodyLog(block, "words");
+        }
+        finally {
+            activeBang = null;
+        }
+        ctx.input.prompt();
+    });
+}
 export function dispatch(line, ctx) {
     const trimmed = line.trim();
+    // §2.2 — the `!` gesture is the COMPOSER's alone. A piped session, `-p`
+    // and `--task-file` keep `!` as ordinary text: those lines are content,
+    // and a headless run that shelled out because a prompt began with `!`
+    // would be executing its input.
+    if (dock.active && !trimmed.includes("\n")) {
+        if (trimmed.startsWith("\\!")) {
+            // the ONE escape: `\!` sends the literal text starting with `!`.
+            ctx.submitTurn(line.replace("\\!", "!"));
+            return;
+        }
+        const bang = parseBang(trimmed);
+        if (bang !== null) {
+            const { command, send } = bang;
+            if (command === "") {
+                ctx.chainRef.current = ctx.chainRef.current.then(async () => {
+                    bodyLog("!<command> runs it and sends the result · !!<command> runs it and shows it here · \\! sends a literal !");
+                    ctx.input.prompt();
+                });
+                return;
+            }
+            runBang(command, send, ctx);
+            return;
+        }
+    }
     if (trimmed === "/help") {
         // KC3.5 slice ⓪ (the extraction): the ROWS moved to the terminal
         // layer's strings module (helpRows — the KC3 §1 pattern: what the
@@ -170,6 +262,75 @@ export function dispatch(line, ctx) {
         ctx.input.prompt();
         return;
     }
+    if (trimmed === "\x07editor") {
+        // §2.4 — ctrl+g hands the composer to the human's own editor.
+        //
+        // The split: the EDITOR owns the terminal handover (raw mode, the
+        // mouse, bracketed paste — see `externalEdit`), and this owns the
+        // spawn, because the tui package is pure terminal and spawning is
+        // not. Neither reaches into the other.
+        //
+        // $VISUAL before $EDITOR — VISUAL is the variable for a full-screen
+        // editor and EDITOR is the fallback — and NO guess beyond them. In
+        // an environment that sets neither, dropping someone into an editor
+        // they did not choose is the product deciding for them.
+        //
+        // It never SUBMITS. What comes back is text in the composer and
+        // enter is still the human's: one key that both opens an editor and
+        // sends is a gesture with no way back.
+        const bin = process.env.VISUAL ?? process.env.EDITOR ?? "";
+        if (bin.trim() === "") {
+            ctx.chainRef.current = ctx.chainRef.current.then(async () => {
+                bodyLog("no editor configured — set $VISUAL or $EDITOR to open one with ctrl+g");
+                ctx.input.prompt();
+            });
+            return;
+        }
+        // The process spawn lives in its own module, reached HERE and not
+        // imported at the top. The PTY manifest gate classifies a test by
+        // the RESOURCE closure of what it imports, so a static process
+        // import in the dispatcher moves every test that imports the
+        // dispatcher into the single-file-serial pool — it took `!cmd`'s
+        // millisecond-long parser test with it. Loading the module at the
+        // key makes the closure honest: importing the dispatcher cannot
+        // start a process.
+        //
+        // (The gate scans SOURCE, comments included, so naming the node
+        // module here in prose would reclassify this file just as surely as
+        // importing it. Deliberately over-wide — see the gate's own note.)
+        //
+        // Joining the chain is a FIX, not the price of that. Handing the
+        // terminal to a full-screen editor while a turn is streaming rows
+        // into that same terminal gives the child a screen kiso is still
+        // painting over. An idle chain resolves on the next microtask, so
+        // the press that is not mid-turn is unchanged.
+        ctx.chainRef.current = ctx.chainRef.current.then(async () => {
+            const { runExternalEditor } = await import("./external-editor.js");
+            const root = join(kisoHome(), "tmp");
+            ctx.input.externalEdit?.((text) => runExternalEditor(bin, root, text, (msg) => body.notice(msg)));
+            // the external program drew over the screen; the model is the only
+            // authority on what should be there (R14).
+            body.reprint();
+            ctx.input.prompt();
+        });
+        return;
+    }
+    if (trimmed === "\x14think") {
+        // §2.3 — ctrl+t folds the committed thinking blocks, and folds them
+        // back. DC-50's mechanism, not a second one: one boolean, then the
+        // session is reprinted, so the blocks already on screen obey the
+        // switch rather than only the next ones.
+        //
+        // The folded row is `foldThinking`'s, which is what the PIPE writes
+        // — so thinking has two renderings in the product and not three,
+        // and the pipe's byte-identity gate is this row's gate too.
+        //
+        // The live `thinking…` placeholder is NOT touched: it belongs to
+        // the live region, and this switch is about committed blocks.
+        body.toggleThinking();
+        ctx.input.prompt();
+        return;
+    }
     if (trimmed === "\x18copy" || trimmed === "/copy") {
         // E1 §3 — the last answer onto the clipboard, as RAW MARKDOWN.
         //
@@ -493,12 +654,18 @@ export function dispatch(line, ctx) {
                             setLastBinding(binding);
                             setAgentModel(profile.model, profile.baseUrl);
                             setCurrentModelName(arg);
+                            // §2.5: the ONE source a reload reads for the model — a
+                            // switch made here must survive the rebuild.
+                            setModelChoice(arg);
                             // OR-7 (owner, 2026-09-09): the status row is repainted BY the
                             // switch — it used to keep the old model until the next
                             // recap repainted it, so "takes effect on the next turn"
                             // read as "did not take". Painted BEFORE the notice so the
                             // frame that carries the notice already carries the row.
-                            ctx.paintIdle();
+                            // DF-0311-F1: repainted with NO meter — the 0.31.1 dogfood
+                            // (and the owner's) read `gpt-6-astra · CH 92%`, the new
+                            // model beside the previous model's figure.
+                            ctx.modelSwitched();
                             body.notice(`model → ${profName} (${profile.model}${effortTok !== undefined ? ` · ${effortTok}` : ""}) — takes effect on the next turn`);
                         }
                     }
@@ -634,6 +801,21 @@ export function dispatch(line, ctx) {
         ctx.requestSwitch(newSessionId(sessionsDir()));
         return;
     }
+    if (trimmed === "/reload") {
+        // §2.5: extensions, skills and config, read again into a session that
+        // keeps its conversation. It is a REBUILD — the tool registry is
+        // built in the agent's constructor and has no unregister, so nothing
+        // short of constructing the agent again can drop a tool or add one.
+        // The durable log is untouched: a reload is invisible in the record,
+        // because nothing the model said or did changes.
+        if (ctx.isRunning()) {
+            body.notice("[/reload] a run is in flight — let it finish (esc stops it), then reload");
+            ctx.input.prompt();
+            return;
+        }
+        ctx.requestReload();
+        return;
+    }
     if (trimmed === "/resume" || trimmed.startsWith("/resume ")) {
         // the mini-spec: the in-session door to the durable sessions —
         // /resume <id> switches directly; bare /resume opens the SAME