@vincemakes/kiso-code 0.31.1 → 0.32.1

package/dist/dispatch.js

@@ -8,8 +8,10 @@ import { newSessionId } from "./session-id.js";
 import { buildAdapter, lookupModelMetadata, resolveContinuationScope, resolveReasoning } from "@vincemakes/kiso-runtime/internal";
 import { MODES, MODE_NOTE, getMode, setMode } from "./mode.js";
 import { clipboardWrite, lastAnswer } from "./clipboard.js";
-import { agentModel, body, bodyLog, configModels, dock, lastBinding, readContextLedger, sessionsDir, setAgentModel, setCurrentModelName, setLastBinding } from "./state.js";
+import { agentModel, body, bodyLog, codingToolOptions, kisoHome, configModels, dock, lastBinding, readContextLedger, sessionsDir, setAgentModel, setCurrentModelName, setModelChoice, setLastBinding } from "./state.js";
 import { authForProfile, directWriteProfile, profileAvailable, unavailableReason } from "./config.js";
+import { shellTool } from "@vincemakes/kiso-tools-node";
+import { join } from "node:path";
 /** The picker's CLI half (owner 2026-09-08): a profile's LEGAL effort levels
  *  and its default, from the registry, shown wherever the profile is listed
  *  — kiso never silently drops a level, and now it shows the ones it takes.
@@ -77,8 +79,98 @@ import { oauthTokenThunk } from "./auth/token.js";
  *  replay routes through it too — a queued "/last" must never become a
  *  user turn (v2c: the rl lives in main, so lines arrive earlier and the
  *  queue is the common path). */
+/** §2.2 — the `!` command in flight, if one is. A `!` command and a model
+ *  run are never both running (the dispatcher is serialized on the chain),
+ *  so one slot is the whole state. */
+let activeBang = null;
+/** esc while a `!` command runs kills it — the SAME abort the shell tool
+ *  gives a model's call, so the whole process group goes, children
+ *  included. Exported because the esc key reaches the editor first: chat
+ *  offers it here before it reaches a model run, and only one of the two
+ *  can be in flight. */
+export function abortBangCommand() {
+    if (activeBang === null)
+        return false;
+    activeBang.abort();
+    return true;
+}
+/** §2.2 — what a submitted line asks for, if it asks for a shell at all.
+ *  Split out from the dispatcher so the rule is testable without a
+ *  terminal: `null` means this is not the gesture and the line is a turn.
+ *
+ *  `!!` is checked before `!` because the longer prefix is the narrower
+ *  claim; testing `!` first would swallow both. */
+export function parseBang(trimmed) {
+    // a multi-line paste that merely begins with `!` is prose, the same
+    // rule `/` already follows one branch below.
+    if (trimmed.includes("\n") || !trimmed.startsWith("!"))
+        return null;
+    const send = !trimmed.startsWith("!!");
+    return { command: trimmed.slice(send ? 1 : 2).trim(), send };
+}
+/** §2.2 — `!cmd` runs a command and SENDS it, `!!cmd` runs one and shows
+ *  it. Both go through the shell tool's own runner, so the timeout (30 s),
+ *  the output cap (100,000 chars, which names what it dropped), the
+ *  whole-tree kill and the STRIPPED environment are the tool's and not a
+ *  second set of rules. The `!`/`!!` difference is what the MODEL sees,
+ *  never what leaves the machine.
+ *
+ *  No approval panel, at any tier including plan: the human typed the
+ *  command. That is not a policy exemption, it is structural — this
+ *  dispatcher only ever sees lines a human submitted, so a model cannot
+ *  reach this branch. */
+function runBang(command, send, ctx) {
+    ctx.chainRef.current = ctx.chainRef.current.then(async () => {
+        const controller = new AbortController();
+        activeBang = controller;
+        try {
+            const tool = shellTool(codingToolOptions());
+            const result = await tool.execute({ command }, { signal: controller.signal });
+            // one fenced block, read as a terminal transcript: the command
+            // and what it printed. The tool's own overflow note rides inside
+            // `content`, so a capped run says so in the same words a model's
+            // call would.
+            const block = ["```console", `$ ${command}`, result.content, "```"].join("\n");
+            if (send) {
+                // an ORDINARY user turn: durable, in the log, and the model
+                // sees exactly what the human saw.
+                ctx.submitTurn(block);
+                return; // submitTurn owns the prompt from here
+            }
+            bodyLog(block, "words");
+        }
+        finally {
+            activeBang = null;
+        }
+        ctx.input.prompt();
+    });
+}
 export function dispatch(line, ctx) {
     const trimmed = line.trim();
+    // §2.2 — the `!` gesture is the COMPOSER's alone. A piped session, `-p`
+    // and `--task-file` keep `!` as ordinary text: those lines are content,
+    // and a headless run that shelled out because a prompt began with `!`
+    // would be executing its input.
+    if (dock.active && !trimmed.includes("\n")) {
+        if (trimmed.startsWith("\\!")) {
+            // the ONE escape: `\!` sends the literal text starting with `!`.
+            ctx.submitTurn(line.replace("\\!", "!"));
+            return;
+        }
+        const bang = parseBang(trimmed);
+        if (bang !== null) {
+            const { command, send } = bang;
+            if (command === "") {
+                ctx.chainRef.current = ctx.chainRef.current.then(async () => {
+                    bodyLog("!<command> runs it and sends the result · !!<command> runs it and shows it here · \\! sends a literal !");
+                    ctx.input.prompt();
+                });
+                return;
+            }
+            runBang(command, send, ctx);
+            return;
+        }
+    }
     if (trimmed === "/help") {
         // KC3.5 slice ⓪ (the extraction): the ROWS moved to the terminal
         // layer's strings module (helpRows — the KC3 §1 pattern: what the
@@ -170,6 +262,75 @@ export function dispatch(line, ctx) {
         ctx.input.prompt();
         return;
     }
+    if (trimmed === "\x07editor") {
+        // §2.4 — ctrl+g hands the composer to the human's own editor.
+        //
+        // The split: the EDITOR owns the terminal handover (raw mode, the
+        // mouse, bracketed paste — see `externalEdit`), and this owns the
+        // spawn, because the tui package is pure terminal and spawning is
+        // not. Neither reaches into the other.
+        //
+        // $VISUAL before $EDITOR — VISUAL is the variable for a full-screen
+        // editor and EDITOR is the fallback — and NO guess beyond them. In
+        // an environment that sets neither, dropping someone into an editor
+        // they did not choose is the product deciding for them.
+        //
+        // It never SUBMITS. What comes back is text in the composer and
+        // enter is still the human's: one key that both opens an editor and
+        // sends is a gesture with no way back.
+        const bin = process.env.VISUAL ?? process.env.EDITOR ?? "";
+        if (bin.trim() === "") {
+            ctx.chainRef.current = ctx.chainRef.current.then(async () => {
+                bodyLog("no editor configured — set $VISUAL or $EDITOR to open one with ctrl+g");
+                ctx.input.prompt();
+            });
+            return;
+        }
+        // The process spawn lives in its own module, reached HERE and not
+        // imported at the top. The PTY manifest gate classifies a test by
+        // the RESOURCE closure of what it imports, so a static process
+        // import in the dispatcher moves every test that imports the
+        // dispatcher into the single-file-serial pool — it took `!cmd`'s
+        // millisecond-long parser test with it. Loading the module at the
+        // key makes the closure honest: importing the dispatcher cannot
+        // start a process.
+        //
+        // (The gate scans SOURCE, comments included, so naming the node
+        // module here in prose would reclassify this file just as surely as
+        // importing it. Deliberately over-wide — see the gate's own note.)
+        //
+        // Joining the chain is a FIX, not the price of that. Handing the
+        // terminal to a full-screen editor while a turn is streaming rows
+        // into that same terminal gives the child a screen kiso is still
+        // painting over. An idle chain resolves on the next microtask, so
+        // the press that is not mid-turn is unchanged.
+        ctx.chainRef.current = ctx.chainRef.current.then(async () => {
+            const { runExternalEditor } = await import("./external-editor.js");
+            const root = join(kisoHome(), "tmp");
+            ctx.input.externalEdit?.((text) => runExternalEditor(bin, root, text, (msg) => body.notice(msg)));
+            // the external program drew over the screen; the model is the only
+            // authority on what should be there (R14).
+            body.reprint();
+            ctx.input.prompt();
+        });
+        return;
+    }
+    if (trimmed === "\x14think") {
+        // §2.3 — ctrl+t folds the committed thinking blocks, and folds them
+        // back. DC-50's mechanism, not a second one: one boolean, then the
+        // session is reprinted, so the blocks already on screen obey the
+        // switch rather than only the next ones.
+        //
+        // The folded row is `foldThinking`'s, which is what the PIPE writes
+        // — so thinking has two renderings in the product and not three,
+        // and the pipe's byte-identity gate is this row's gate too.
+        //
+        // The live `thinking…` placeholder is NOT touched: it belongs to
+        // the live region, and this switch is about committed blocks.
+        body.toggleThinking();
+        ctx.input.prompt();
+        return;
+    }
     if (trimmed === "\x18copy" || trimmed === "/copy") {
         // E1 §3 — the last answer onto the clipboard, as RAW MARKDOWN.
         //
@@ -493,12 +654,18 @@ export function dispatch(line, ctx) {
                             setLastBinding(binding);
                             setAgentModel(profile.model, profile.baseUrl);
                             setCurrentModelName(arg);
+                            // §2.5: the ONE source a reload reads for the model — a
+                            // switch made here must survive the rebuild.
+                            setModelChoice(arg);
                             // OR-7 (owner, 2026-09-09): the status row is repainted BY the
                             // switch — it used to keep the old model until the next
                             // recap repainted it, so "takes effect on the next turn"
                             // read as "did not take". Painted BEFORE the notice so the
                             // frame that carries the notice already carries the row.
-                            ctx.paintIdle();
+                            // DF-0311-F1: repainted with NO meter — the 0.31.1 dogfood
+                            // (and the owner's) read `gpt-6-astra · CH 92%`, the new
+                            // model beside the previous model's figure.
+                            ctx.modelSwitched();
                             body.notice(`model → ${profName} (${profile.model}${effortTok !== undefined ? ` · ${effortTok}` : ""}) — takes effect on the next turn`);
                         }
                     }
@@ -601,6 +768,17 @@ export function dispatch(line, ctx) {
         });
         return;
     }
+    if (trimmed === "" && dock.active) {
+        // DC-57 (owner ruling 2026-09-10): a bare Enter on the EMPTY composer
+        // does nothing. It used to fall through to the exit below — a rule
+        // from the readline era, where an empty line on a pipe means the
+        // input is over — and the docked editor inherited it, so a stray
+        // Enter at the idle prompt ended the session (measured on 0.32.0).
+        // The pipe path keeps its byte-pinned end; the dock keeps `exit`
+        // and ctrl+c as the ways out.
+        ctx.input.prompt();
+        return;
+    }
     if (trimmed === "exit" || trimmed === "") {
         // PH-1a (finding PH-F11): closing the input MID-RUN killed the very
         // surface a later approval would ask through ("readline was
@@ -634,6 +812,21 @@ export function dispatch(line, ctx) {
         ctx.requestSwitch(newSessionId(sessionsDir()));
         return;
     }
+    if (trimmed === "/reload") {
+        // §2.5: extensions, skills and config, read again into a session that
+        // keeps its conversation. It is a REBUILD — the tool registry is
+        // built in the agent's constructor and has no unregister, so nothing
+        // short of constructing the agent again can drop a tool or add one.
+        // The durable log is untouched: a reload is invisible in the record,
+        // because nothing the model said or did changes.
+        if (ctx.isRunning()) {
+            body.notice("[/reload] a run is in flight — let it finish (esc stops it), then reload");
+            ctx.input.prompt();
+            return;
+        }
+        ctx.requestReload();
+        return;
+    }
     if (trimmed === "/resume" || trimmed.startsWith("/resume ")) {
         // the mini-spec: the in-session door to the durable sessions —
         // /resume <id> switches directly; bare /resume opens the SAME

package/dist/external-editor.d.ts

@@ -0,0 +1,30 @@
+/**
+ * §2.4 — the RUN half of ctrl+g.
+ *
+ * The dispatcher routes and this runs: it owns the temp file and the
+ * spawn, and knows nothing about the composer, the body or the session.
+ * Everything it needs arrives as an argument, which is what lets the
+ * dispatcher reach it through `await import(...)` at the call rather than
+ * a static import.
+ *
+ * That laziness is load-bearing, not stylistic. The PTY manifest gate
+ * classifies a test by the RESOURCE closure of what it imports, so a
+ * static `node:child_process` anywhere in dispatch.ts reclassifies every
+ * test that imports dispatch — a millisecond-long parser test for `!cmd`
+ * was moved into the single-file-serial pool by this module's first
+ * shape. A module the dispatcher only loads when the key is pressed is
+ * honestly outside that closure: nothing that merely imports the
+ * dispatcher can spawn anything.
+ *
+ * The failure contract is the whole point of the return type: `null`
+ * means KEEP WHAT WAS THERE. A failed edit must not eat what the human
+ * had already written.
+ */
+/**
+ * Run `bin` on `text` and return what came back, or `null` when the edit
+ * failed — in which case `onFailure` has already been told, in one line,
+ * what went wrong.
+ *
+ * @param root  the directory temp files live under (`$KISO_HOME/tmp`)
+ */
+export declare function runExternalEditor(bin: string, root: string, text: string, onFailure: (line: string) => void): string | null;

package/dist/external-editor.js

@@ -0,0 +1,55 @@
+/**
+ * §2.4 — the RUN half of ctrl+g.
+ *
+ * The dispatcher routes and this runs: it owns the temp file and the
+ * spawn, and knows nothing about the composer, the body or the session.
+ * Everything it needs arrives as an argument, which is what lets the
+ * dispatcher reach it through `await import(...)` at the call rather than
+ * a static import.
+ *
+ * That laziness is load-bearing, not stylistic. The PTY manifest gate
+ * classifies a test by the RESOURCE closure of what it imports, so a
+ * static `node:child_process` anywhere in dispatch.ts reclassifies every
+ * test that imports dispatch — a millisecond-long parser test for `!cmd`
+ * was moved into the single-file-serial pool by this module's first
+ * shape. A module the dispatcher only loads when the key is pressed is
+ * honestly outside that closure: nothing that merely imports the
+ * dispatcher can spawn anything.
+ *
+ * The failure contract is the whole point of the return type: `null`
+ * means KEEP WHAT WAS THERE. A failed edit must not eat what the human
+ * had already written.
+ */
+import { spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+/**
+ * Run `bin` on `text` and return what came back, or `null` when the edit
+ * failed — in which case `onFailure` has already been told, in one line,
+ * what went wrong.
+ *
+ * @param root  the directory temp files live under (`$KISO_HOME/tmp`)
+ */
+export function runExternalEditor(bin, root, text, onFailure) {
+    // per INVOCATION, not per run: a directory per call is how the tree
+    // grew 400,000 of them once.
+    mkdirSync(root, { recursive: true });
+    const dir = mkdtempSync(join(root, "compose-"));
+    const file = join(dir, "message.md"); // .md so the editor lights it up
+    try {
+        writeFileSync(file, text, "utf8");
+        const r = spawnSync(bin, [file], { stdio: "inherit", shell: false });
+        if (r.error !== undefined || (r.status !== null && r.status !== 0)) {
+            onFailure(`[ctrl+g] ${bin} exited ${r.status ?? "abnormally"} — the composer is unchanged`);
+            return null;
+        }
+        return readFileSync(file, "utf8").replace(/\n+$/, "");
+    }
+    catch (err) {
+        onFailure(`[ctrl+g] ${err instanceof Error ? err.message : String(err)} — the composer is unchanged`);
+        return null;
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}

package/dist/index.js

@@ -30,13 +30,14 @@ import { createInterface } from "node:readline";
 import { Readable } from "node:stream";
 import { fileURLToPath } from "node:url";
 import { join } from "node:path";
-import { Body, Editor, bannerLines, currentGround, resolveGround, setGround, escapeTerminal, extensionsBannerText, idColumn, idleStatus, interactivePrompt, palette, renderSessionLine, sessionListFooter, sessionListRow } from "@vincemakes/kiso-tui";
+import { Body, Editor, PROMPT, bannerLines, currentGround, resolveGround, setGround, escapeTerminal, extensionsBannerText, idColumn, idleStatus, interactivePrompt, palette, renderSessionLine, sessionListFooter, sessionListRow } from "@vincemakes/kiso-tui";
 import { createAgent, disposeExtensions, loadExtensions, loadProjectExtensions, SessionStore, } from "@vincemakes/kiso-runtime";
 import { createFauxProvider } from "@vincemakes/kiso-evals";
 import { createCodingTools } from "@vincemakes/kiso-tools-node";
 import { MODES, getMode, modeExtensions, modeFromEnv, modeSystemPrompt, setMode } from "./mode.js";
+import { breakerExtension } from "./breaker.js";
 import { builtInLayer } from "./builtin.js";
-import { agentModel, atFiles, body, bodyLog, kisoHome, builtInExtensions, currentFaux, dock, extensionsDir, loadedExtensions, mergedConfig, mergedTempPaths, projectExtensions, sessionStoreRef, sessionsDir, setAgentModel, setBody, setConfigModels, setConfiguredWindow, setCurrentAgentExtensions, setCurrentFaux, setCurrentModelName, setExtensionLists, setMergedConfig, setSessionStore, userExtensions, VERSION, lastBinding, acceptDrift, setAcceptDrift } from "./state.js";
+import { agentModel, atFiles, body, bodyLog, codingToolOptions, kisoHome, builtInExtensions, currentFaux, dock, extensionsDir, loadedExtensions, mergedConfig, mergedTempPaths, modelChoice, projectExtensions, configModels, configuredWindow, agentBaseUrl, currentModelName, currentAgentExtensions, sessionStoreRef, sessionsDir, setAgentModel, setBody, setConfigModels, setConfiguredWindow, setCurrentAgentExtensions, setCurrentFaux, setCurrentModelName, setExtensionLists, setMergedConfig, setModelChoice, setSessionStore, userExtensions, VERSION, lastBinding, acceptDrift, setAcceptDrift } from "./state.js";
 import { askUi, resolveProjectTrust } from "./trust-ui.js";
 import { isFirstRun, scaffoldFirstRun } from "./first-run.js";
 import { fauxSkip, readFauxScript } from "./faux-glue.js";
@@ -78,6 +79,17 @@ function openInBrowser(url) {
         // the URL is on screen; opening it is the person's fallback
     }
 }
+/** LT-1: the stream watchdog's bound from the environment — a non-negative
+ *  number of milliseconds (0 disables it); anything else is ignored. The
+ *  PTY rigs use it to trip the watchdog in seconds against a stub that
+ *  never finishes a stream. */
+function streamIdleFromEnv() {
+    const raw = process.env.KISO_STREAM_IDLE_MS;
+    if (raw === undefined || raw === "")
+        return undefined;
+    const n = Number(raw);
+    return Number.isFinite(n) && n >= 0 ? n : undefined;
+}
 /** OR-3: the commands that own their own stdin reader (a hidden key prompt,
  *  an OAuth paste prompt) or read nothing at all — never the editor.
  *  OR-9 adds `update`: npm inherits the terminal for the install's own
@@ -126,6 +138,17 @@ function readlineInput(rl) {
             /* readline has no ctrl+o binding — ignored (W15 rides the
              * editor path only). */
         },
+        onThink() {
+            /* §2.3: same as ctrl+o above — readline has no binding, and a
+             * dock-less session has no committed rows to reprint. */
+        },
+        onEditor() {
+            /* §2.4: readline has no ctrl+g, and a piped session has no
+             * composer to hand over. */
+        },
+        externalEdit() {
+            /* §2.4: nothing to suspend — this path never took the terminal. */
+        },
         onCopy() {
             /* readline has no ctrl+x binding — ignored. `/copy` still
              * works here: it is a typed command, not a key. */
@@ -210,6 +233,15 @@ function editorInput(editor) {
         onExpand(cb) {
             editor.onExpand(cb);
         },
+        onThink(cb) {
+            editor.onThink(cb);
+        },
+        onEditor(cb) {
+            editor.onEditor(cb);
+        },
+        externalEdit(edit) {
+            editor.externalEdit(edit);
+        },
         onCopy(cb) {
             editor.onCopy(cb);
         },
@@ -367,7 +399,15 @@ function makeLineInput() {
         // here", which is the argument W6 made for the box and the only part
         // of it that survives. A prompt character is a third thing saying
         // the same thing, and it cost the row a column.
-        dock.bindInput(() => editor.dockState(), "");
+        // OR-11 (a): ONE literal. The compositor draws this lead and the
+        // editor measures its rows against it; two copies is how they came
+        // to disagree by two columns in the first place.
+        const COMPOSER_LEAD = "";
+        dock.bindInput(() => editor.dockState(), COMPOSER_LEAD);
+        // …and BOTH renderers are live: the dock draws this row while it is
+        // active, the editor's own selfRender draws it (with the brick) when
+        // it is not. The budget follows whichever is drawing.
+        editor.setInputLead(() => (dock.active ? COMPOSER_LEAD : PROMPT));
         // TUI2-R3v2 ②: the click hit-test's wiring — the compositor places
         // the panel's option rows, so the compositor is what the editor asks
         // where they are. Neither side computes the other's geometry.
@@ -591,6 +631,11 @@ function positiveIntEnv(name) {
     return Number.isFinite(n) && n > 0 ? n : undefined;
 }
 async function makeAgent(sessionId, input, modelFlag) {
+    // §2.5: the ONE source a reload reads for the model, seeded here from
+    // the startup flag. Without this a session started with `--model X`
+    // would silently revert to the env/config default on its first reload.
+    if (modelFlag !== undefined)
+        setModelChoice(modelFlag);
     // E3: the project-level trust gate runs BEFORE any extension load (the
     // mcp/skills merges must be in the env when the user-level extensions
     // load). Untrusted project capability is never loaded — never silently.
@@ -652,16 +697,19 @@ async function makeAgent(sessionId, input, modelFlag) {
     // generated extension into it so a first-time rule joins the chain
     // at the NEXT run (the run's policies are fixed at its start; run.ts
     // re-reads the config's extensions array per run).
-    const extensions = [...modeExtensions(), ...loadedExtensions];
+    // LT-2: the loop breaker at the chain HEAD — it speaks first when it speaks,
+    // so `decidedBy` names it; a deny there beats every tier, bypass included.
+    const extensions = [breakerExtension(), ...modeExtensions(), ...loadedExtensions];
     setCurrentAgentExtensions(extensions);
     // E6: the run-start context policy (captured once — exactOptionalPropertyTypes).
     const contextPolicy = contextPolicyFromEnv();
+    const idleFromEnv = streamIdleFromEnv(); // read once: a narrowed const, not a call per spread
     const definition = {
         model,
         store,
         // Area 5: the coding tools are bound to the workspace — every path
         // they touch is canonicalized inside cwd, escapes are refused.
-        tools: [...createCodingTools({ workspaceRoot: process.cwd(), excludeRoots: [kisoHome()] })], // DC-49
+        tools: [...createCodingTools(codingToolOptions())], // DC-49 — the options live in state.ts, shared with the `!` command's runner
         // Modes: the five tiers ride the E1 policy chain (mode:<tier>
         // extensions, current tier first) — the old static PERMISSION_POLICY
         // is gone, its semantics live in the "default" tier. The banner
@@ -706,8 +754,13 @@ async function makeAgent(sessionId, input, modelFlag) {
                 ...(sessionId !== undefined ? { promptCacheKey: sessionId } : {}),
                 ...(resolved.profile.baseUrl !== undefined ? { baseUrl: resolved.profile.baseUrl } : {}),
                 ...(resolved.profile.promptCaching !== undefined ? { promptCaching: resolved.profile.promptCaching } : {}),
+                // LT-1: the profile's stream watchdog bound, if it states one
+                ...(resolved.profile.streamIdleMs !== undefined ? { streamIdleMs: resolved.profile.streamIdleMs } : {}),
             }
             : { adapter: createFauxProvider(readFauxScript().slice(fauxSkipTurns)) }),
+        // LT-1: KISO_STREAM_IDLE_MS (the test rigs' knob) beats the profile —
+        // the last spread wins, which is why it sits after the profile's.
+        ...(idleFromEnv !== undefined ? { streamIdleMs: idleFromEnv } : {}),
     };
     return createAgent(definition);
 }
@@ -794,12 +847,137 @@ class CliUsageError extends Error {
  *  line (the previous conversation stays resumable — clear/switch
  *  never erase history). Faux sessions re-arm the scripted adapter at
  *  the NEW session's durable position, exactly like the picker path. */
-async function chatLoop(agent, firstId, input, autoCompact) {
+/** §2.5 — how many skills are IN FORCE, taken from the extension that
+ *  indexed them rather than by walking the directory again. The first
+ *  version re-scanned `KISO_SKILLS_DIR` for one number in one log line,
+ *  which is a second answer to a question already answered and free to
+ *  disagree with the first (lead's review of 5bee644, observation 2).
+ *  An extension that reports no count is reported as none, never guessed. */
+function skillCount() {
+    // `skills` is declared on the extension's own published type
+    // (extensions/skills/index.d.ts), not invented here.
+    const skills = loadedExtensions.find((e) => e.name === "skills");
+    return skills?.skills ?? 0;
+}
+/**
+ * §2.5 — the reload: the agent is CONSTRUCTED AGAIN on the same session.
+ *
+ * Nothing short of this reloads the whole surface. `run.ts` composes the
+ * system prompt and the approval chain per run, so mutating the shared
+ * extensions array reaches those — but the tool registry is built in the
+ * agent's constructor and has no unregister, and hooks are frozen into
+ * the session's config. Half a reload is worse than none: a prompt that
+ * announces a skill whose tool is not in the table is the DC-19 family.
+ *
+ * LOAD FIRST, SWAP ONLY ON SUCCESS. `loadExtensions` is deliberately
+ * loud, so tearing the old agent down first would leave a typo in an
+ * extension holding a live session with no agent and no way back. The
+ * cost is that two sets of MCP servers are briefly alive; a stdio server
+ * holding an exclusive resource — a port, a lock — fails to start twice
+ * and so fails the reload cleanly, which is the honest outcome.
+ *
+ * The conversation survives because the id does not change and its truth
+ * is the durable log on disk. The record never moves: a reload is
+ * invisible in it, because nothing the model said or did changes.
+ */
+async function reloadAgent(old, id, input) {
+    // Snapshot BEFORE makeAgent: it overwrites every one of these, so the
+    // old set would be unreachable by the time we needed to dispose it.
+    const oldLoaded = loadedExtensions;
+    const oldBuiltIn = builtInExtensions;
+    const oldUser = userExtensions;
+    const oldProject = projectExtensions;
+    const oldTemps = mergedTempPaths.splice(0);
+    // makeAgent publishes the config side BEFORE it can fail on the model,
+    // so a failure past the extension load would leave a NEW window, model
+    // name and profile table beside the OLD agent — and the failure line
+    // says nothing changed. Rather than soften the line, the snapshot makes
+    // it true: a failed reload is atomic, which is what load-then-swap
+    // promises. (Lead's review of 5bee644, observation 1.)
+    const oldCfg = {
+        // RL-F6: makeAgent publishes this BEFORE createAgent, and createAgent
+        // throws on a tool-name collision — a user extension exposing
+        // `read_file` is enough — so a failure CAN land after it. Left
+        // unrestored, the new array stands beside the old agent, whose config
+        // holds the old one by reference, and the don't-ask-again writer
+        // mutates whatever this is: a rule granted after a failed reload goes
+        // into an array nothing reads. RL-F3's family one level up, and the
+        // same symptom — the human grants a rule and is asked again on the
+        // very next identical call.
+        agentExtensions: currentAgentExtensions,
+        merged: mergedConfig,
+        models: configModels,
+        window: configuredWindow,
+        faux: currentFaux,
+        modelName: currentModelName,
+        choice: modelChoice,
+        agent: agentModel,
+        endpoint: agentBaseUrl,
+        delegation: process.env.KISO_DELEGATION_CONFIG_JSON,
+    };
+    let next;
+    try {
+        next = await makeAgent(id, input, modelChoice);
+    }
+    catch (err) {
+        // Nothing is swapped. Clean up whatever the failed attempt managed
+        // to create, put the old set's own temp paths back so exit still
+        // removes them, and restore the lists in case makeAgent got far
+        // enough to publish new ones.
+        for (const p of mergedTempPaths.splice(0)) {
+            try {
+                rmSync(p, { recursive: true, force: true });
+            }
+            catch {
+                // best-effort — the temp dir would be reaped by the OS
+            }
+        }
+        mergedTempPaths.push(...oldTemps);
+        setExtensionLists(oldBuiltIn, oldUser, oldProject, oldLoaded);
+        setCurrentAgentExtensions(oldCfg.agentExtensions);
+        setMergedConfig(oldCfg.merged);
+        setConfigModels(oldCfg.models);
+        setConfiguredWindow(oldCfg.window);
+        setCurrentFaux(oldCfg.faux);
+        setCurrentModelName(oldCfg.modelName);
+        setModelChoice(oldCfg.choice);
+        setAgentModel(oldCfg.agent, oldCfg.endpoint);
+        if (oldCfg.delegation === undefined)
+            delete process.env.KISO_DELEGATION_CONFIG_JSON;
+        else
+            process.env.KISO_DELEGATION_CONFIG_JSON = oldCfg.delegation;
+        bodyLog(`[reload] ${err instanceof Error ? err.message : String(err)} — nothing changed, the previous set is still in force`);
+        return old;
+    }
+    // The new set is built and sound; only now does the old one go.
+    old.close();
+    await disposeExtensions(oldLoaded);
+    for (const p of oldTemps) {
+        try {
+            rmSync(p, { recursive: true, force: true });
+        }
+        catch {
+            // best-effort — the temp dir would be reaped by the OS
+        }
+    }
+    bodyLog(`[reload] ${loadedExtensions.length} extensions, ${skillCount()} skills — the conversation is unchanged`);
+    return next;
+}
+async function chatLoop(first, firstId, input, autoCompact) {
     let id = firstId;
     let prev = null;
+    let agent = first;
+    // §2.5: a rebuilt agent re-enters on the SAME conversation, so it prints
+    // neither the opening banner nor the "switched — previous" line. The
+    // reload said what it did; repeating the session's opening would read
+    // as a new session, which is the one thing it is not.
+    let rebuilt = false;
     for (;;) {
         const session = await agent.session({ id, ...(acceptDrift() ? { acceptDrift: true } : {}) });
-        if (prev === null) {
+        if (rebuilt) {
+            rebuilt = false;
+        }
+        else if (prev === null) {
             bodyLog(`session ${id}\n`);
             // REL-0152-D5: a session with history says what that history WAS.
             // Resuming used to print this one line and drop you at an empty
@@ -854,6 +1032,11 @@ async function chatLoop(agent, firstId, input, autoCompact) {
         const end = await chat(session, currentFaux, input, autoCompact, nav);
         if (end.next === "exit")
             return;
+        if (end.next === "reload") {
+            agent = await reloadAgent(agent, id, input);
+            rebuilt = true;
+            continue; // the same id, the same conversation, a new agent
+        }
         prev = id;
         id = end.id;
     }