@vincemakes/kiso-code 0.31.1 → 0.32.0

package/dist/external-editor.d.ts

@@ -0,0 +1,30 @@
+/**
+ * §2.4 — the RUN half of ctrl+g.
+ *
+ * The dispatcher routes and this runs: it owns the temp file and the
+ * spawn, and knows nothing about the composer, the body or the session.
+ * Everything it needs arrives as an argument, which is what lets the
+ * dispatcher reach it through `await import(...)` at the call rather than
+ * a static import.
+ *
+ * That laziness is load-bearing, not stylistic. The PTY manifest gate
+ * classifies a test by the RESOURCE closure of what it imports, so a
+ * static `node:child_process` anywhere in dispatch.ts reclassifies every
+ * test that imports dispatch — a millisecond-long parser test for `!cmd`
+ * was moved into the single-file-serial pool by this module's first
+ * shape. A module the dispatcher only loads when the key is pressed is
+ * honestly outside that closure: nothing that merely imports the
+ * dispatcher can spawn anything.
+ *
+ * The failure contract is the whole point of the return type: `null`
+ * means KEEP WHAT WAS THERE. A failed edit must not eat what the human
+ * had already written.
+ */
+/**
+ * Run `bin` on `text` and return what came back, or `null` when the edit
+ * failed — in which case `onFailure` has already been told, in one line,
+ * what went wrong.
+ *
+ * @param root  the directory temp files live under (`$KISO_HOME/tmp`)
+ */
+export declare function runExternalEditor(bin: string, root: string, text: string, onFailure: (line: string) => void): string | null;

package/dist/external-editor.js

@@ -0,0 +1,55 @@
+/**
+ * §2.4 — the RUN half of ctrl+g.
+ *
+ * The dispatcher routes and this runs: it owns the temp file and the
+ * spawn, and knows nothing about the composer, the body or the session.
+ * Everything it needs arrives as an argument, which is what lets the
+ * dispatcher reach it through `await import(...)` at the call rather than
+ * a static import.
+ *
+ * That laziness is load-bearing, not stylistic. The PTY manifest gate
+ * classifies a test by the RESOURCE closure of what it imports, so a
+ * static `node:child_process` anywhere in dispatch.ts reclassifies every
+ * test that imports dispatch — a millisecond-long parser test for `!cmd`
+ * was moved into the single-file-serial pool by this module's first
+ * shape. A module the dispatcher only loads when the key is pressed is
+ * honestly outside that closure: nothing that merely imports the
+ * dispatcher can spawn anything.
+ *
+ * The failure contract is the whole point of the return type: `null`
+ * means KEEP WHAT WAS THERE. A failed edit must not eat what the human
+ * had already written.
+ */
+import { spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+/**
+ * Run `bin` on `text` and return what came back, or `null` when the edit
+ * failed — in which case `onFailure` has already been told, in one line,
+ * what went wrong.
+ *
+ * @param root  the directory temp files live under (`$KISO_HOME/tmp`)
+ */
+export function runExternalEditor(bin, root, text, onFailure) {
+    // per INVOCATION, not per run: a directory per call is how the tree
+    // grew 400,000 of them once.
+    mkdirSync(root, { recursive: true });
+    const dir = mkdtempSync(join(root, "compose-"));
+    const file = join(dir, "message.md"); // .md so the editor lights it up
+    try {
+        writeFileSync(file, text, "utf8");
+        const r = spawnSync(bin, [file], { stdio: "inherit", shell: false });
+        if (r.error !== undefined || (r.status !== null && r.status !== 0)) {
+            onFailure(`[ctrl+g] ${bin} exited ${r.status ?? "abnormally"} — the composer is unchanged`);
+            return null;
+        }
+        return readFileSync(file, "utf8").replace(/\n+$/, "");
+    }
+    catch (err) {
+        onFailure(`[ctrl+g] ${err instanceof Error ? err.message : String(err)} — the composer is unchanged`);
+        return null;
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}

package/dist/index.js

@@ -30,13 +30,14 @@ import { createInterface } from "node:readline";
 import { Readable } from "node:stream";
 import { fileURLToPath } from "node:url";
 import { join } from "node:path";
-import { Body, Editor, bannerLines, currentGround, resolveGround, setGround, escapeTerminal, extensionsBannerText, idColumn, idleStatus, interactivePrompt, palette, renderSessionLine, sessionListFooter, sessionListRow } from "@vincemakes/kiso-tui";
+import { Body, Editor, PROMPT, bannerLines, currentGround, resolveGround, setGround, escapeTerminal, extensionsBannerText, idColumn, idleStatus, interactivePrompt, palette, renderSessionLine, sessionListFooter, sessionListRow } from "@vincemakes/kiso-tui";
 import { createAgent, disposeExtensions, loadExtensions, loadProjectExtensions, SessionStore, } from "@vincemakes/kiso-runtime";
 import { createFauxProvider } from "@vincemakes/kiso-evals";
 import { createCodingTools } from "@vincemakes/kiso-tools-node";
 import { MODES, getMode, modeExtensions, modeFromEnv, modeSystemPrompt, setMode } from "./mode.js";
+import { breakerExtension } from "./breaker.js";
 import { builtInLayer } from "./builtin.js";
-import { agentModel, atFiles, body, bodyLog, kisoHome, builtInExtensions, currentFaux, dock, extensionsDir, loadedExtensions, mergedConfig, mergedTempPaths, projectExtensions, sessionStoreRef, sessionsDir, setAgentModel, setBody, setConfigModels, setConfiguredWindow, setCurrentAgentExtensions, setCurrentFaux, setCurrentModelName, setExtensionLists, setMergedConfig, setSessionStore, userExtensions, VERSION, lastBinding, acceptDrift, setAcceptDrift } from "./state.js";
+import { agentModel, atFiles, body, bodyLog, codingToolOptions, kisoHome, builtInExtensions, currentFaux, dock, extensionsDir, loadedExtensions, mergedConfig, mergedTempPaths, modelChoice, projectExtensions, configModels, configuredWindow, agentBaseUrl, currentModelName, currentAgentExtensions, sessionStoreRef, sessionsDir, setAgentModel, setBody, setConfigModels, setConfiguredWindow, setCurrentAgentExtensions, setCurrentFaux, setCurrentModelName, setExtensionLists, setMergedConfig, setModelChoice, setSessionStore, userExtensions, VERSION, lastBinding, acceptDrift, setAcceptDrift } from "./state.js";
 import { askUi, resolveProjectTrust } from "./trust-ui.js";
 import { isFirstRun, scaffoldFirstRun } from "./first-run.js";
 import { fauxSkip, readFauxScript } from "./faux-glue.js";
@@ -78,6 +79,17 @@ function openInBrowser(url) {
         // the URL is on screen; opening it is the person's fallback
     }
 }
+/** LT-1: the stream watchdog's bound from the environment — a non-negative
+ *  number of milliseconds (0 disables it); anything else is ignored. The
+ *  PTY rigs use it to trip the watchdog in seconds against a stub that
+ *  never finishes a stream. */
+function streamIdleFromEnv() {
+    const raw = process.env.KISO_STREAM_IDLE_MS;
+    if (raw === undefined || raw === "")
+        return undefined;
+    const n = Number(raw);
+    return Number.isFinite(n) && n >= 0 ? n : undefined;
+}
 /** OR-3: the commands that own their own stdin reader (a hidden key prompt,
  *  an OAuth paste prompt) or read nothing at all — never the editor.
  *  OR-9 adds `update`: npm inherits the terminal for the install's own
@@ -126,6 +138,17 @@ function readlineInput(rl) {
             /* readline has no ctrl+o binding — ignored (W15 rides the
              * editor path only). */
         },
+        onThink() {
+            /* §2.3: same as ctrl+o above — readline has no binding, and a
+             * dock-less session has no committed rows to reprint. */
+        },
+        onEditor() {
+            /* §2.4: readline has no ctrl+g, and a piped session has no
+             * composer to hand over. */
+        },
+        externalEdit() {
+            /* §2.4: nothing to suspend — this path never took the terminal. */
+        },
         onCopy() {
             /* readline has no ctrl+x binding — ignored. `/copy` still
              * works here: it is a typed command, not a key. */
@@ -210,6 +233,15 @@ function editorInput(editor) {
         onExpand(cb) {
             editor.onExpand(cb);
         },
+        onThink(cb) {
+            editor.onThink(cb);
+        },
+        onEditor(cb) {
+            editor.onEditor(cb);
+        },
+        externalEdit(edit) {
+            editor.externalEdit(edit);
+        },
         onCopy(cb) {
             editor.onCopy(cb);
         },
@@ -367,7 +399,15 @@ function makeLineInput() {
         // here", which is the argument W6 made for the box and the only part
         // of it that survives. A prompt character is a third thing saying
         // the same thing, and it cost the row a column.
-        dock.bindInput(() => editor.dockState(), "");
+        // OR-11 (a): ONE literal. The compositor draws this lead and the
+        // editor measures its rows against it; two copies is how they came
+        // to disagree by two columns in the first place.
+        const COMPOSER_LEAD = "";
+        dock.bindInput(() => editor.dockState(), COMPOSER_LEAD);
+        // …and BOTH renderers are live: the dock draws this row while it is
+        // active, the editor's own selfRender draws it (with the brick) when
+        // it is not. The budget follows whichever is drawing.
+        editor.setInputLead(() => (dock.active ? COMPOSER_LEAD : PROMPT));
         // TUI2-R3v2 ②: the click hit-test's wiring — the compositor places
         // the panel's option rows, so the compositor is what the editor asks
         // where they are. Neither side computes the other's geometry.
@@ -591,6 +631,11 @@ function positiveIntEnv(name) {
     return Number.isFinite(n) && n > 0 ? n : undefined;
 }
 async function makeAgent(sessionId, input, modelFlag) {
+    // §2.5: the ONE source a reload reads for the model, seeded here from
+    // the startup flag. Without this a session started with `--model X`
+    // would silently revert to the env/config default on its first reload.
+    if (modelFlag !== undefined)
+        setModelChoice(modelFlag);
     // E3: the project-level trust gate runs BEFORE any extension load (the
     // mcp/skills merges must be in the env when the user-level extensions
     // load). Untrusted project capability is never loaded — never silently.
@@ -652,16 +697,19 @@ async function makeAgent(sessionId, input, modelFlag) {
     // generated extension into it so a first-time rule joins the chain
     // at the NEXT run (the run's policies are fixed at its start; run.ts
     // re-reads the config's extensions array per run).
-    const extensions = [...modeExtensions(), ...loadedExtensions];
+    // LT-2: the loop breaker at the chain HEAD — it speaks first when it speaks,
+    // so `decidedBy` names it; a deny there beats every tier, bypass included.
+    const extensions = [breakerExtension(), ...modeExtensions(), ...loadedExtensions];
     setCurrentAgentExtensions(extensions);
     // E6: the run-start context policy (captured once — exactOptionalPropertyTypes).
     const contextPolicy = contextPolicyFromEnv();
+    const idleFromEnv = streamIdleFromEnv(); // read once: a narrowed const, not a call per spread
     const definition = {
         model,
         store,
         // Area 5: the coding tools are bound to the workspace — every path
         // they touch is canonicalized inside cwd, escapes are refused.
-        tools: [...createCodingTools({ workspaceRoot: process.cwd(), excludeRoots: [kisoHome()] })], // DC-49
+        tools: [...createCodingTools(codingToolOptions())], // DC-49 — the options live in state.ts, shared with the `!` command's runner
         // Modes: the five tiers ride the E1 policy chain (mode:<tier>
         // extensions, current tier first) — the old static PERMISSION_POLICY
         // is gone, its semantics live in the "default" tier. The banner
@@ -706,8 +754,13 @@ async function makeAgent(sessionId, input, modelFlag) {
                 ...(sessionId !== undefined ? { promptCacheKey: sessionId } : {}),
                 ...(resolved.profile.baseUrl !== undefined ? { baseUrl: resolved.profile.baseUrl } : {}),
                 ...(resolved.profile.promptCaching !== undefined ? { promptCaching: resolved.profile.promptCaching } : {}),
+                // LT-1: the profile's stream watchdog bound, if it states one
+                ...(resolved.profile.streamIdleMs !== undefined ? { streamIdleMs: resolved.profile.streamIdleMs } : {}),
             }
             : { adapter: createFauxProvider(readFauxScript().slice(fauxSkipTurns)) }),
+        // LT-1: KISO_STREAM_IDLE_MS (the test rigs' knob) beats the profile —
+        // the last spread wins, which is why it sits after the profile's.
+        ...(idleFromEnv !== undefined ? { streamIdleMs: idleFromEnv } : {}),
     };
     return createAgent(definition);
 }
@@ -794,12 +847,137 @@ class CliUsageError extends Error {
  *  line (the previous conversation stays resumable — clear/switch
  *  never erase history). Faux sessions re-arm the scripted adapter at
  *  the NEW session's durable position, exactly like the picker path. */
-async function chatLoop(agent, firstId, input, autoCompact) {
+/** §2.5 — how many skills are IN FORCE, taken from the extension that
+ *  indexed them rather than by walking the directory again. The first
+ *  version re-scanned `KISO_SKILLS_DIR` for one number in one log line,
+ *  which is a second answer to a question already answered and free to
+ *  disagree with the first (lead's review of 5bee644, observation 2).
+ *  An extension that reports no count is reported as none, never guessed. */
+function skillCount() {
+    // `skills` is declared on the extension's own published type
+    // (extensions/skills/index.d.ts), not invented here.
+    const skills = loadedExtensions.find((e) => e.name === "skills");
+    return skills?.skills ?? 0;
+}
+/**
+ * §2.5 — the reload: the agent is CONSTRUCTED AGAIN on the same session.
+ *
+ * Nothing short of this reloads the whole surface. `run.ts` composes the
+ * system prompt and the approval chain per run, so mutating the shared
+ * extensions array reaches those — but the tool registry is built in the
+ * agent's constructor and has no unregister, and hooks are frozen into
+ * the session's config. Half a reload is worse than none: a prompt that
+ * announces a skill whose tool is not in the table is the DC-19 family.
+ *
+ * LOAD FIRST, SWAP ONLY ON SUCCESS. `loadExtensions` is deliberately
+ * loud, so tearing the old agent down first would leave a typo in an
+ * extension holding a live session with no agent and no way back. The
+ * cost is that two sets of MCP servers are briefly alive; a stdio server
+ * holding an exclusive resource — a port, a lock — fails to start twice
+ * and so fails the reload cleanly, which is the honest outcome.
+ *
+ * The conversation survives because the id does not change and its truth
+ * is the durable log on disk. The record never moves: a reload is
+ * invisible in it, because nothing the model said or did changes.
+ */
+async function reloadAgent(old, id, input) {
+    // Snapshot BEFORE makeAgent: it overwrites every one of these, so the
+    // old set would be unreachable by the time we needed to dispose it.
+    const oldLoaded = loadedExtensions;
+    const oldBuiltIn = builtInExtensions;
+    const oldUser = userExtensions;
+    const oldProject = projectExtensions;
+    const oldTemps = mergedTempPaths.splice(0);
+    // makeAgent publishes the config side BEFORE it can fail on the model,
+    // so a failure past the extension load would leave a NEW window, model
+    // name and profile table beside the OLD agent — and the failure line
+    // says nothing changed. Rather than soften the line, the snapshot makes
+    // it true: a failed reload is atomic, which is what load-then-swap
+    // promises. (Lead's review of 5bee644, observation 1.)
+    const oldCfg = {
+        // RL-F6: makeAgent publishes this BEFORE createAgent, and createAgent
+        // throws on a tool-name collision — a user extension exposing
+        // `read_file` is enough — so a failure CAN land after it. Left
+        // unrestored, the new array stands beside the old agent, whose config
+        // holds the old one by reference, and the don't-ask-again writer
+        // mutates whatever this is: a rule granted after a failed reload goes
+        // into an array nothing reads. RL-F3's family one level up, and the
+        // same symptom — the human grants a rule and is asked again on the
+        // very next identical call.
+        agentExtensions: currentAgentExtensions,
+        merged: mergedConfig,
+        models: configModels,
+        window: configuredWindow,
+        faux: currentFaux,
+        modelName: currentModelName,
+        choice: modelChoice,
+        agent: agentModel,
+        endpoint: agentBaseUrl,
+        delegation: process.env.KISO_DELEGATION_CONFIG_JSON,
+    };
+    let next;
+    try {
+        next = await makeAgent(id, input, modelChoice);
+    }
+    catch (err) {
+        // Nothing is swapped. Clean up whatever the failed attempt managed
+        // to create, put the old set's own temp paths back so exit still
+        // removes them, and restore the lists in case makeAgent got far
+        // enough to publish new ones.
+        for (const p of mergedTempPaths.splice(0)) {
+            try {
+                rmSync(p, { recursive: true, force: true });
+            }
+            catch {
+                // best-effort — the temp dir would be reaped by the OS
+            }
+        }
+        mergedTempPaths.push(...oldTemps);
+        setExtensionLists(oldBuiltIn, oldUser, oldProject, oldLoaded);
+        setCurrentAgentExtensions(oldCfg.agentExtensions);
+        setMergedConfig(oldCfg.merged);
+        setConfigModels(oldCfg.models);
+        setConfiguredWindow(oldCfg.window);
+        setCurrentFaux(oldCfg.faux);
+        setCurrentModelName(oldCfg.modelName);
+        setModelChoice(oldCfg.choice);
+        setAgentModel(oldCfg.agent, oldCfg.endpoint);
+        if (oldCfg.delegation === undefined)
+            delete process.env.KISO_DELEGATION_CONFIG_JSON;
+        else
+            process.env.KISO_DELEGATION_CONFIG_JSON = oldCfg.delegation;
+        bodyLog(`[reload] ${err instanceof Error ? err.message : String(err)} — nothing changed, the previous set is still in force`);
+        return old;
+    }
+    // The new set is built and sound; only now does the old one go.
+    old.close();
+    await disposeExtensions(oldLoaded);
+    for (const p of oldTemps) {
+        try {
+            rmSync(p, { recursive: true, force: true });
+        }
+        catch {
+            // best-effort — the temp dir would be reaped by the OS
+        }
+    }
+    bodyLog(`[reload] ${loadedExtensions.length} extensions, ${skillCount()} skills — the conversation is unchanged`);
+    return next;
+}
+async function chatLoop(first, firstId, input, autoCompact) {
     let id = firstId;
     let prev = null;
+    let agent = first;
+    // §2.5: a rebuilt agent re-enters on the SAME conversation, so it prints
+    // neither the opening banner nor the "switched — previous" line. The
+    // reload said what it did; repeating the session's opening would read
+    // as a new session, which is the one thing it is not.
+    let rebuilt = false;
     for (;;) {
         const session = await agent.session({ id, ...(acceptDrift() ? { acceptDrift: true } : {}) });
-        if (prev === null) {
+        if (rebuilt) {
+            rebuilt = false;
+        }
+        else if (prev === null) {
             bodyLog(`session ${id}\n`);
             // REL-0152-D5: a session with history says what that history WAS.
             // Resuming used to print this one line and drop you at an empty
@@ -854,6 +1032,11 @@ async function chatLoop(agent, firstId, input, autoCompact) {
         const end = await chat(session, currentFaux, input, autoCompact, nav);
         if (end.next === "exit")
             return;
+        if (end.next === "reload") {
+            agent = await reloadAgent(agent, id, input);
+            rebuilt = true;
+            continue; // the same id, the same conversation, a new agent
+        }
         prev = id;
         id = end.id;
     }

package/dist/state.d.ts

@@ -12,6 +12,14 @@ import type { KisoExtension, StoreRecord } from "@vincemakes/kiso-runtime";
  *  env vars (KISO_EXTENSIONS_DIR / KISO_MCP_CONFIG / KISO_SKILLS_DIR)
  *  still override their own path; nothing hard-codes ~/.kiso anymore. */
 export declare function kisoHome(): string;
+/** DC-49 — the workspace the coding tools may touch, and the one place it
+ *  is decided. The session's own tool set and the `!` command's runner both
+ *  need it, and two copies of a ruling-bearing literal is how a later DC-49
+ *  amendment reaches one caller and not the other. */
+export declare function codingToolOptions(): {
+    readonly workspaceRoot: string;
+    readonly excludeRoots: readonly string[];
+};
 export declare function sessionsDir(): string;
 /** E1: the extension scan directory — KISO_EXTENSIONS_DIR overrides. */
 export declare function extensionsDir(): string;
@@ -77,6 +85,15 @@ export interface LineInput {
     /** W15: the expand key (ctrl+o) — the chain-level action, never the
      *  editor's own interpretation. */
     onExpand(cb: () => void): void;
+    /** §2.3: the thinking key (ctrl+t) — the same chain-level shape as
+     *  onExpand. Optional: the readline input has no such key, and a
+     *  dock-less session has nothing to reprint. */
+    onThink?(cb: () => void): void;
+    /** §2.4: the external-editor key (ctrl+g). */
+    onEditor?(cb: () => void): void;
+    /** §2.4: hand the terminal over, run `edit`, take it back. The editor
+     *  owns the handover; the CLI owns the spawn. */
+    externalEdit?(edit: (text: string) => string | null): void;
     /** E1 §3: the copy key (ctrl+x) — the chain-level action, never the
      *  composer's own. The readline input ignores it; `/copy` is the
      *  route that works everywhere. */
@@ -178,6 +195,24 @@ export declare let configModels: Readonly<Record<string, import("./config.js").M
 export declare function setConfigModels(models: Readonly<Record<string, import("./config.js").ModelProfile>>): void;
 /** The name of the model currently driving the session ("faux" or the
  *  profile name / provider/model write / env model). */
+/**
+ * §2.5 — the profile the human CHOSE by name, and the only source a
+ * rebuild may read for the model.
+ *
+ * Not `currentModelName`: that holds whatever resolution produced, and
+ * an env-resolved session's name ("gpt-4o", "claude-sonnet-5") is not a
+ * key in `models`, so handing it back to `resolveModel` throws. Not the
+ * startup flag either, or a `/model` switch would silently revert on the
+ * first reload — the effort-axis round produced that bug once already
+ * from having two sources for the model.
+ *
+ * One variable, seeded by `makeAgent` from the startup flag and
+ * overwritten by `/model`. Undefined means "resolve exactly as this
+ * process did at startup", which is the right answer for a session that
+ * never named a profile.
+ */
+export declare let modelChoice: string | undefined;
+export declare function setModelChoice(value: string | undefined): void;
 export declare let currentModelName: string;
 export declare function setCurrentModelName(value: string): void;
 /** E1: the extensions loaded by makeAgent — their names feed the banner. */

package/dist/state.js

@@ -18,6 +18,13 @@ import { AT_CAP, AT_SKIP, Dock } from "@vincemakes/kiso-tui";
 export function kisoHome() {
     return process.env.KISO_HOME ?? join(homedir(), ".kiso");
 }
+/** DC-49 — the workspace the coding tools may touch, and the one place it
+ *  is decided. The session's own tool set and the `!` command's runner both
+ *  need it, and two copies of a ruling-bearing literal is how a later DC-49
+ *  amendment reaches one caller and not the other. */
+export function codingToolOptions() {
+    return { workspaceRoot: process.cwd(), excludeRoots: [kisoHome()] };
+}
 export function sessionsDir() {
     return join(kisoHome(), "sessions");
 }
@@ -246,6 +253,26 @@ export function setConfigModels(models) {
 }
 /** The name of the model currently driving the session ("faux" or the
  *  profile name / provider/model write / env model). */
+/**
+ * §2.5 — the profile the human CHOSE by name, and the only source a
+ * rebuild may read for the model.
+ *
+ * Not `currentModelName`: that holds whatever resolution produced, and
+ * an env-resolved session's name ("gpt-4o", "claude-sonnet-5") is not a
+ * key in `models`, so handing it back to `resolveModel` throws. Not the
+ * startup flag either, or a `/model` switch would silently revert on the
+ * first reload — the effort-axis round produced that bug once already
+ * from having two sources for the model.
+ *
+ * One variable, seeded by `makeAgent` from the startup flag and
+ * overwritten by `/model`. Undefined means "resolve exactly as this
+ * process did at startup", which is the right answer for a session that
+ * never named a profile.
+ */
+export let modelChoice;
+export function setModelChoice(value) {
+    modelChoice = value;
+}
 export let currentModelName = "faux";
 export function setCurrentModelName(value) {
     currentModelName = value;

package/dist/trust-ui.js

@@ -162,17 +162,38 @@ export function askUi(input) {
 export async function addDontAskAgainRule(rule) {
     const dir = extensionsDir();
     const file = join(dir, "dont-ask-again.mjs");
-    const existed = existsSync(file);
+    // §2.5: the LIVE extension, found by name in the array the chain reads.
+    // This is the only handle on the rules that is guaranteed to be the one
+    // in force, and finding it also tells us whether this is a first rule.
+    const at = currentAgentExtensions.findIndex((e) => e.name === "dont-ask-again");
+    const live = at >= 0 ? currentAgentExtensions[at] : undefined;
+    // Every rule the session already grants, plus this one (RL-F2: the file
+    // used to be rewritten with ONLY the newest rule, so a second grant
+    // erased the first from disk — invisible in-session, because the
+    // in-memory Set kept both, and only discovered at the next start).
+    //
+    // RL-F5: a file generated BEFORE this change exports RULES and puts
+    // nothing on the extension, so `live.rules` is undefined for it and a
+    // union starting from nothing would rewrite the file with this grant
+    // alone — every rule the human gave under 0.31.x gone, in exactly the
+    // way RL-F2 was invisible. The rules come out of the file instead, and
+    // the migration costs one grant.
+    const existing = live?.rules !== undefined ? [...live.rules] : rulesInFile(file);
+    const rules = [...new Set([...existing, rule])].sort();
     const module = [
         "// generated by kiso — the \"2 Yes, don't ask again for <tool>\" rule.",
         "// HUMAN-EDITABLE and HUMAN-DELETABLE — this file IS the revocation path:",
         "// delete a rule from the set (or the whole file) to be asked again.",
         "// ALLOW-ONLY by design (R3): never emits deny or ask — the mode moat",
         "// and the safe-defaults moat keep their teeth.",
-        `export const RULES = new Set(${JSON.stringify([rule])});`,
+        `const RULES = new Set(${JSON.stringify(rules)});`,
         "",
         "export default {",
         '  name: "dont-ask-again",',
+        "  // the live handle: kiso mutates THIS set to make a new rule take",
+        "  // effect without a reload. It is the same object the decide below",
+        "  // closes over, which is the whole point.",
+        "  rules: RULES,",
         "  approvals: [",
         "    {",
         "      decide(call) {",
@@ -185,21 +206,57 @@ export async function addDontAskAgainRule(rule) {
     ].join("\n");
     mkdirSync(dir, { recursive: true });
     writeFileSync(file, module, "utf8");
-    // The live in-session effect: a file that existed at startup was
-    // imported by the loader — ONE namespace — so mutating the exported
-    // RULES Set is live NOW (the current run's chain reads the same Set).
-    const mod = (await import(pathToFileURL(file).href));
-    if (mod.RULES !== undefined && !mod.RULES.has(rule))
-        mod.RULES.add(rule);
-    // A FIRST-time rule (a file that did not exist at startup) is not yet
-    // in the current run's chain — the chain is fixed at a run's start —
-    // so the generated extension joins the NEXT run's policies (run.ts
-    // re-reads the session config's extensions array, shared by
-    // reference). The honest story: a new rule applies from the next run.
-    if (!existed && mod.default !== undefined) {
+    // The live in-session effect. This used to re-import the plain file URL
+    // and mutate the module's exported Set, on the stated assumption that a
+    // file the loader imported is ONE namespace. §2.5's loader appends a
+    // per-load nonce so `/reload` can pick up edited code, and that
+    // assumption died with it: the loader holds `file?load=N` and a plain
+    // import is the startup namespace. A rule granted after any reload
+    // would mutate a Set nothing reads — the human clicks don't-ask-again
+    // and is asked again on the very next identical call.
+    //
+    // So there is no second import. The rule is added THROUGH the live
+    // extension, which is one source of truth by construction.
+    if (live?.rules !== undefined) {
+        live.rules.add(rule);
+        return;
+    }
+    // Either a FIRST rule (no such extension loaded) or the RL-F5 migration
+    // (a legacy extension is loaded but has no live handle). The freshly
+    // written file is imported and joins the chain — REPLACING the legacy
+    // entry rather than sitting beside it, because two extensions of the
+    // same name in the chain is a second source of truth and the whole point
+    // of the handle is that there is one. The chain is fixed at a run's
+    // start, so a first rule applies from the NEXT run (run.ts re-reads the
+    // session config's extensions array, shared by reference).
+    //
+    // The nonce is the loader's own lesson applied here: a plain file URL is
+    // cached forever, so a second grant in one process would import the
+    // bytes of the first.
+    const mod = (await import(`${pathToFileURL(file).href}?grant=${(grantSerial += 1)}`));
+    if (mod.default === undefined)
+        return;
+    if (at >= 0)
+        currentAgentExtensions[at] = mod.default;
+    else
         currentAgentExtensions.push(mod.default);
+}
+/** RL-F5 — the rules a generated file already holds. The `new Set([...])`
+ *  literal is JSON, which is what makes reading it back honest rather than
+ *  a parser. An unreadable or hand-edited-past-recognition file yields
+ *  nothing, and the new rule stands alone — the file is documented as
+ *  human-editable, so kiso must not fail on what a human wrote there. */
+function rulesInFile(file) {
+    try {
+        const m = /new Set\((\[[^\]]*\])\)/.exec(readFileSync(file, "utf8"));
+        return m === null ? [] : JSON.parse(m[1]);
+    }
+    catch {
+        return [];
     }
 }
+/** RL-F5: distinguishes each grant's import of the generated file. */
+let grantSerial = 0;
 /**
  * W21 — the §3.5 fix-hint table: per speaker, the ONE-line path to stop
  * being asked. The hint names the FIX, never a bypass ("switch to
@@ -309,8 +366,24 @@ function readMcpConfig(path) {
 }
 /** Merge user-level + project-level mcp.json into one temp file and point
  *  KISO_MCP_CONFIG at it — the mcp extension reads it at load time. */
+/**
+ * RL-F4 — the user mcp.json as it was BEFORE any merge, and RL-F1's exact
+ * sibling one function up. `applyMcpMerge` read `KISO_MCP_CONFIG` and then
+ * assigned the merged file to it, so a second merge — which is what a
+ * reload is — took the first merged file as the user config. That file
+ * already holds the project's servers, so the "exists in both" check
+ * throws for every one of them and EVERY reload fails in exactly the
+ * projects that carry MCP servers.
+ *
+ * Found by the lead reviewing the commit that fixed RL-F1 in the function
+ * below. The lesson is the sibling, not the loop: a defect found in one
+ * function is a question to ask of every function beside it, and I fixed
+ * one merge without looking at the other.
+ */
+let originalUserMcpPath;
 function applyMcpMerge(root) {
-    const userPath = process.env.KISO_MCP_CONFIG ?? join(kisoHome(), "mcp.json");
+    originalUserMcpPath ??= process.env.KISO_MCP_CONFIG ?? join(kisoHome(), "mcp.json");
+    const userPath = originalUserMcpPath;
     const user = readMcpConfig(userPath);
     const project = readMcpConfig(join(root, "mcp.json"));
     const userServers = user.mcpServers ?? {};
@@ -323,17 +396,37 @@ function applyMcpMerge(root) {
         }
     }
     const merged = { mcpServers: { ...userServers, ...projectServers } };
-    const temp = join(tmpdir(), `kiso-mcp-merged-${process.pid}.json`);
+    // RL-F4, second half: the path used to be `kiso-mcp-merged-<pid>.json`,
+    // the SAME file on every merge in one process — so a reload's cleanup of
+    // the paths the previous set owned deleted the file the new set had just
+    // been merged into. One directory per merge, and the directory is what is
+    // recorded, so the cleanup removes exactly what that merge created.
+    const dir = mkdtempSync(join(tmpdir(), "kiso-mcp-"));
+    const temp = join(dir, "mcp.json");
     writeFileSync(temp, `${JSON.stringify(merged, null, 2)}\n`, "utf8");
     process.env.KISO_MCP_CONFIG = temp;
-    mergedTempPaths.push(temp);
+    mergedTempPaths.push(dir);
 }
 /** Merge user-level + project-level skills into one temp scan dir (project
  *  skill dirs symlinked first; a name in both → project wins + a stderr
  *  note) and point KISO_SKILLS_DIR at it — the skills extension's existing
  *  scan reads it at load time and per read_skill call. */
+/**
+ * §2.5 — the user skills directory as it was BEFORE any merge.
+ *
+ * `applySkillsMerge` ends by pointing `KISO_SKILLS_DIR` at the merged
+ * directory it just made. Read twice — which is exactly what a reload
+ * does — that is a loop: the second merge takes the FIRST merge as its
+ * user directory. A skill deleted from the real user directory would
+ * survive forever, and each merge would produce a temp directory the
+ * previous one's symlinks depend on, so none of them could ever be
+ * removed. This tree has already lost an afternoon to 449,956 stale
+ * temp directories.
+ */
+let originalUserSkillsDir;
 function applySkillsMerge(root) {
-    const userDir = process.env.KISO_SKILLS_DIR ?? join(kisoHome(), "skills");
+    originalUserSkillsDir ??= process.env.KISO_SKILLS_DIR ?? join(kisoHome(), "skills");
+    const userDir = originalUserSkillsDir;
     const projectDir = join(root, "skills");
     const merged = mkdtempSync(join(tmpdir(), "kiso-skills-"));
     mergedTempPaths.push(merged);