@vincemakes/kiso-code 0.39.1 → 0.40.0

package/dist/dispatch.d.ts

@@ -3,8 +3,10 @@
  * turns. The bodies moved verbatim from chat()'s closure; chat provides
  * the context (the chain, the run state, the prompt arming).
  */
+import type { SessionRoute } from "./projects.js";
 import type { AgentSession } from "@vincemakes/kiso-runtime";
 import { type LineInput } from "./state.js";
+import type { UserInputVia } from "@vincemakes/kiso-core";
 /** Everything dispatch touches that chat() owns. */
 export interface DispatchCtx {
     readonly session: AgentSession;
@@ -23,8 +25,10 @@ export interface DispatchCtx {
      *  gone; a binding that has not run yet paints none — an unmeasured
      *  cache is not a 0% cache, and it is not the previous model's either. */
     readonly modelSwitched: () => void;
-    /** submit a real turn: queue + chain (the turn closure lives in chat). */
-    readonly submitTurn: (line: string) => void;
+    /** submit a real turn: queue + chain (the turn closure lives in chat).
+     *  0.40.0: `via` marks a skill turn — `line` is then the composed
+     *  content, and the chip shows `via.line`. */
+    readonly submitTurn: (line: string, via?: UserInputVia) => void;
     /** the /status context estimate. */
     readonly estimateCtx: () => number;
     /** TUI2-R1 (E): the model's context window, as the session is
@@ -38,6 +42,10 @@ export interface DispatchCtx {
     readonly requestReload: () => void;
     /** every durable session id (the /resume validation + listing). */
     readonly sessions: () => readonly string[];
+    /** 0.40.0: an id outside this project's folder — refused with where to
+     *  go, or opened where it is with a line (absent: every such id is "no
+     *  such"). */
+    readonly route?: (id: string) => SessionRoute | null;
     /** the dock's session picker, when one exists (bare /resume). */
     readonly pickSession?: () => Promise<string | null>;
 }

package/dist/dispatch.js

@@ -3,22 +3,53 @@
  * turns. The bodies moved verbatim from chat()'s closure; chat provides
  * the context (the chain, the run state, the prompt arming).
  */
-import { contextRows, contextUnavailableRows, displayVerb, escapeTerminal, helpRows, kUnit, modePickView, modelPickView, palette, renderEvent, settledLabel, slashCommandNames } from "@vincemakes/kiso-tui";
+import { STATUS_GLYPHS, contextRows, contextUnavailableRows, displayVerb, escapeTerminal, helpRows, kUnit, modePickView, modelPickView, compactingStatus, palette, renderEvent, settledLabel, slashCommandNames } from "@vincemakes/kiso-tui";
 import { newSessionId } from "./session-id.js";
 import { buildAdapter, lookupModelMetadata, resolveContinuationScope, resolveReasoning } from "@vincemakes/kiso-runtime/internal";
-import { MODES, MODE_NOTE, getMode, setMode } from "./mode.js";
+import { MODES, MODE_NOTE, OFFERED_MODES, getMode, setMode } from "./mode.js";
 import { clipboardWrite, lastAnswer } from "./clipboard.js";
-import { agentModel, body, bodyLog, codingToolOptions, kisoHome, configModels, dock, lastBinding, mergedConfig, readContextLedger, sessionsDir, setAgentModel, setConfiguredWindow, setCurrentModelName, setModelChoice, setLastBinding } from "./state.js";
+import { protectedBangReason, protectedShellVerdict } from "./protected-shell.js";
+import { agentModel, body, bodyLog, codingToolOptions, protectedFiles, kisoHome, configModels, dock, lastBinding, loadedSkillsCatalog, mergedConfig, readContextLedger, retryOnRow, sessionsDir, setAgentModel, setConfiguredWindow, setCurrentModelName, setModelChoice, setRetryShown, setLastBinding } from "./state.js";
 import { adapterOptionsFor } from "./auth/adapter-options.js";
-import { microcompactThresholdFor } from "./chat.js";
+import { contextWindowTokens, microcompactThresholdFor, startStatusSpinner } from "./chat.js";
 import { authForProfile, directWriteProfile, profileAvailable, resolveContextWindow, unavailableReason } from "./config.js";
 import { shellTool } from "@vincemakes/kiso-tools-node";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
+import { realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { resolveSkillLine, skillsRows } from "./skill-invoke.js";
+/** Where a skill directory really lives. Project and user skills are
+ *  merged into one scan directory by symlink, so the scan root names a
+ *  temp directory; the link's target is the answer a person can use. */
+function skillSource(dir) {
+    const scan = process.env.KISO_SKILLS_DIR ?? join(kisoHome(), "skills");
+    try {
+        return tildePath(dirname(realpathSync(join(scan, dir))));
+    }
+    catch {
+        return tildePath(scan); // a broken link has no target to name
+    }
+}
+function tildePath(p) {
+    const home = homedir();
+    return p === home || p.startsWith(`${home}/`) ? `~${p.slice(home.length)}` : p;
+}
 /** The picker's CLI half (owner 2026-09-08): a profile's LEGAL effort levels
  *  and its default, from the registry, shown wherever the profile is listed
  *  — kiso never silently drops a level, and now it shows the ones it takes.
  *  A model the registry does not know shows `unknown` (nothing is guessed);
  *  it must not read `none`, which is a REAL level since the Responses rows. */
+/** A context figure for a NOTICE, in the status row's own form.
+ *
+ *  `displayCtxRatio` returns NaN as its honest "nobody states this model's
+ *  window", and the status row renders that as `ctx ?`. The `/compact`
+ *  recap multiplied it and interpolated the result, so the same unknown
+ *  reached the screen as `ctx NaN% → NaN%`: one value with a contract, and
+ *  a second consumer that had not read it. The `%` moves inside, because
+ *  the unknown form does not carry one. */
+function ctxPercent(ratio) {
+    return Number.isFinite(ratio) ? `${Math.round(ratio * 100)}%` : "?";
+}
 function effortNote(p) {
     const reasoning = lookupModelMetadata(p.model, p.baseUrl)?.capabilities.reasoning ?? null;
     const effort = reasoning?.effort ?? null;
@@ -119,9 +150,21 @@ export function parseBang(trimmed) {
  *  No approval panel, at any tier including plan: the human typed the
  *  command. That is not a policy exemption, it is structural — this
  *  dispatcher only ever sees lines a human submitted, so a model cannot
- *  reach this branch. */
+ *  reach this branch.
+ *
+ *  One check it does take: kiso never serves its own credential store to a
+ *  model, and `!cmd` hands its output to one. `!!cmd` does not — but the
+ *  two are one keystroke apart, so a line naming a protected file runs
+ *  under neither, and the store stays one `cat` away in the person's own
+ *  terminal. */
 function runBang(command, send, ctx) {
     ctx.chainRef.current = ctx.chainRef.current.then(async () => {
+        const guard = protectedShellVerdict(command, codingToolOptions().workspaceRoot, protectedFiles(), { home: homedir(), kisoHome: kisoHome() });
+        if (guard.refused) {
+            bodyLog(protectedBangReason(guard));
+            ctx.input.prompt();
+            return;
+        }
         const controller = new AbortController();
         activeBang = controller;
         try {
@@ -458,7 +501,7 @@ export function dispatch(line, ctx) {
                     const picked = await new Promise((resolve) => {
                         ctx.input.panelAsk(modePickView({
                             header: `mode — current: ${current}`,
-                            options: MODES.map((name) => ({ label: name, note: [MODE_NOTE[name], ...(name === current ? ["current"] : [])].join(" · ") })),
+                            options: OFFERED_MODES.map((name) => ({ label: name, note: [MODE_NOTE[name], ...(name === current ? ["current"] : [])].join(" · ") })),
                         }, 
                         // DC-12 (design §4): a panel WAITING ON A HUMAN says ❯.
                         ctx.isRunning() ? "❯ run paused" : `▸ ${current}`), (v) => resolve(v.action === "picked" ? v.result : null));
@@ -468,10 +511,10 @@ export function dispatch(line, ctx) {
                         ctx.input.prompt();
                         return; // esc — nothing switched, nothing said
                     }
-                    const chosen = "index" in picked ? MODES[picked.index] : MODES.find((x) => x === picked.custom.trim());
+                    const chosen = "index" in picked ? OFFERED_MODES[picked.index] : MODES.find((x) => x === picked.custom.trim());
                     if (chosen === undefined) {
                         bodyLog(`no such mode: ${"index" in picked ? String(picked.index) : picked.custom.trim()}`);
-                        bodyLog(`tiers: ${MODES.join(" ")}`);
+                        bodyLog(`tiers: ${OFFERED_MODES.join(" ")}`);
                     }
                     else {
                         setMode(chosen);
@@ -482,11 +525,11 @@ export function dispatch(line, ctx) {
                     return;
                 }
                 bodyLog(`mode ${getMode()}`);
-                bodyLog(`tiers: ${MODES.join(" ")}`);
+                bodyLog(`tiers: ${OFFERED_MODES.join(" ")}`);
             }
             else if (m === undefined) {
                 bodyLog(`no such mode: ${trimmed.slice(5).trim()}`);
-                bodyLog(`tiers: ${MODES.join(" ")}`);
+                bodyLog(`tiers: ${OFFERED_MODES.join(" ")}`);
             }
             else {
                 setMode(m);
@@ -655,11 +698,16 @@ export function dispatch(line, ctx) {
                                         ...(profile.baseUrl !== undefined ? { baseUrl: profile.baseUrl } : {}),
                                     }),
                                 },
+                                // A1b: the in-run tiers are drawn from the same window.
+                                contextWindow: contextWindowTokens({ model: profile.model, ...(profile.baseUrl !== undefined ? { baseUrl: profile.baseUrl } : {}) }),
                                 // OR-1: the endpoint is the fourth passenger — the cost
                                 // path and the window lookup key on (model, endpoint).
                                 ...(profile.baseUrl !== undefined ? { baseUrl: profile.baseUrl } : {}),
                                 ...(scope !== undefined ? { scope } : {}),
                                 ...(reasoning !== undefined ? { reasoning } : {}),
+                                // 0.40.0: the NAME the person switched to, recorded for
+                                // display — a direct provider/model has none.
+                                profileName: direct === null ? profName : null,
                             };
                             ctx.session.setModelBinding(binding);
                             setLastBinding(binding);
@@ -721,7 +769,12 @@ export function dispatch(line, ctx) {
             };
             ctx.input.onEscape(onEscape);
             let compactStart = 0;
-            let compactTimer = null;
+            let repaintCompacting = () => { };
+            // 0.40.0 (the owner's dogfood): the row walks the WORKING twinkle,
+            // the same spinner as a running turn — a static glyph repainted
+            // once a second read as a stalled screen while the model thought
+            let glyph = STATUS_GLYPHS[0];
+            let stopSpinner = null;
             // the `as` on the initializer keeps the flow type the full union —
             // onStart fills this during the call, but a closure assignment
             // never re-narrows the outer scope (it would read `never`)
@@ -729,27 +782,51 @@ export function dispatch(line, ctx) {
             // the ctx estimate BEFORE the summarized event lands (the used
             // fraction — the recap's "ctx 91% → 34%" drops after compacting)
             let ctxBefore = null;
+            // 0.40.0: the summary call's progress against its output budget —
+            // the latest report, read by the row; the runtime reports per
+            // streamed chunk and the row repaints at most every 200 ms
+            let progress = null;
+            let lastProgressPaint = 0;
             const compacting = (info) => {
-                const text = (elapsed) => `▘ compacting · ${info.rounds} rounds · ~${kUnit(info.tokens)} tokens · ${Math.max(0, elapsed)}s`;
+                // 0.40.0: composed by the row seam, not a template here — the row
+                // is where the launch build's progress segment plugs in.
+                const text = (elapsed) => compactingStatus(glyph, info.rounds, info.tokens, elapsed, undefined, retryOnRow(), progress);
+                repaintCompacting = () => dock.setStatus(text(Math.round((Date.now() - compactStart) / 1000)), "esc to cancel");
                 compactStart = Date.now();
-                ctxBefore = Math.round(ctx.estimateCtx() * 100);
+                ctxBefore = ctxPercent(ctx.estimateCtx());
                 dock.setStatus(text(0), "esc to cancel");
-                compactTimer = setInterval(() => {
-                    dock.setStatus(text(Math.round((Date.now() - compactStart) / 1000)), "esc to cancel");
-                }, 1000);
+                stopSpinner = startStatusSpinner((next) => {
+                    glyph = next;
+                    repaintCompacting();
+                });
             };
             try {
                 // R3a: /compact <focus> — the words after the command steer
                 // the summary ("keep the auth details"); bare /compact is
                 // byte-identical to the pre-round call.
                 const focus = trimmed.slice(8).trim();
+                setRetryShown(null);
                 const result = await ctx.session.summarize({
                     signal: abort.signal,
+                    // 0.39.2: the gesture gets the measured output budget and
+                    // thinking off where the registry can vouch for turning it
+                    // off. A fixed 4,000 was failing live sessions with "the
+                    // summary turn ended with max_tokens"; a complete checkpoint
+                    // of the reported size measured 18,837.
+                    manualBudget: true,
                     ...(focus !== "" ? { focus } : {}),
                     onStart: (info) => {
                         compactInfo = info;
                         compacting(info);
                     },
+                    onProgress: (p) => {
+                        progress = { produced: p.produced, budget: p.budget, reasoningUnseen: p.reasoningUnseen };
+                        const now = Date.now();
+                        if (now - lastProgressPaint < 200)
+                            return;
+                        lastProgressPaint = now;
+                        repaintCompacting();
+                    },
                 });
                 if (result === null) {
                     body.notice("[/compact] nothing to compact — fewer than 5 rounds yet");
@@ -760,11 +837,11 @@ export function dispatch(line, ctx) {
                     // rounds, the one summary, the savings, the ctx drop
                     // (the estimate BEFORE vs AFTER — the same chars/4
                     // proxy the status bar shows, marked ~), and the time.
-                    const ctxAfter = Math.round(ctx.estimateCtx() * 100);
+                    const ctxAfter = ctxPercent(ctx.estimateCtx());
                     const elapsed = compactStart > 0 ? settledLabel((Date.now() - compactStart) / 1000) : "?s";
                     // a non-null result implies onStart ran — the "?" is
                     // reachable only at the type level
-                    body.notice(`[/compact] ✦ compacted · ${compactInfo?.rounds ?? "?"} rounds → 1 summary · saved ~${kUnit(result.savedTokens)} · ctx ${ctxBefore ?? "?"}% → ${ctxAfter}% · ${elapsed}`);
+                    body.notice(`[/compact] ✦ compacted · ${compactInfo?.rounds ?? "?"} rounds → 1 summary · saved ~${kUnit(result.savedTokens)} · ctx ${ctxBefore ?? "?"} → ${ctxAfter} · ${elapsed}`);
                     // 0.39.1 — the boundary row, under the recap.
                     //
                     // `summarized` is appended OFF-LOOP: session.summarize()
@@ -811,8 +888,10 @@ export function dispatch(line, ctx) {
                 }
             }
             finally {
-                if (compactTimer !== null)
-                    clearInterval(compactTimer);
+                stopSpinner?.();
+                // ADR-0005 Amendment 2: a retry belongs to the call that
+                // announced it — none may outlive the compaction into the idle row.
+                setRetryShown(null);
                 ctx.paintIdle();
             }
             ctx.input.prompt();
@@ -893,8 +972,15 @@ export function dispatch(line, ctx) {
             // would; the validation is the difference
             if (!ctx.sessions().includes(arg)) {
                 ctx.chainRef.current = ctx.chainRef.current.then(async () => {
-                    bodyLog(`no such session: ${escapeTerminal(arg)} — /resume lists them`);
-                    ctx.input.prompt();
+                    const route = ctx.route?.(arg) ?? null;
+                    if (route === null || route.kind === "refused") {
+                        bodyLog(route?.line ?? `no such session: ${escapeTerminal(arg)} — /resume lists them`);
+                        ctx.input.prompt();
+                        return;
+                    }
+                    if (route.kind === "elsewhere" && route.line !== null)
+                        bodyLog(route.line);
+                    ctx.requestSwitch(arg);
                 });
                 return;
             }
@@ -916,6 +1002,16 @@ export function dispatch(line, ctx) {
                     ctx.input.prompt(); // esc — nothing switched, nothing said
                     return;
                 }
+                // 0.40.0: `tab` lists every project; another project's recorded
+                // session is refused with where to go
+                const route = ctx.sessions().includes(picked) ? null : (ctx.route?.(picked) ?? null);
+                if (route?.kind === "refused") {
+                    bodyLog(route.line);
+                    ctx.input.prompt();
+                    return;
+                }
+                if (route?.kind === "elsewhere" && route.line !== null)
+                    bodyLog(route.line);
                 ctx.requestSwitch(picked);
             });
             return;
@@ -928,6 +1024,25 @@ export function dispatch(line, ctx) {
         });
         return;
     }
+    // 0.40.0 — a person's skill: `/skills`, `/skill <name> [args]`, or
+    // `/<name> [args]` for a name no built-in above claimed. Placed AFTER
+    // every built-in so a built-in always wins, and BEFORE the unknown-
+    // command line so an installed skill is never called unknown.
+    const skill = resolveSkillLine(trimmed, loadedSkillsCatalog(), slashCommandNames());
+    if (trimmed === "/skills" || trimmed === "/skill" || skill !== null) {
+        if (skill?.kind === "submit") {
+            ctx.submitTurn(skill.content, skill.via);
+            return;
+        }
+        ctx.chainRef.current = ctx.chainRef.current.then(async () => {
+            if (skill?.kind === "list")
+                bodyLog(skillsRows(loadedSkillsCatalog(), skillSource, tildePath(join(kisoHome(), "skills"))).map(escapeTerminal).join("\n"));
+            else if (skill?.kind === "error")
+                bodyLog(escapeTerminal(skill.message));
+            ctx.input.prompt();
+        });
+        return;
+    }
     // PH-1a (finding PH-F1): an unrecognized slash command is an ERROR,
     // never a turn — the fallthrough used to hand "/clear", "/exit", or a
     // typo to the model, burning a request on text the user meant as a

package/dist/floor.d.ts

@@ -0,0 +1,80 @@
+/**
+ * 0.40.0 — the catastrophe floor (launch-weekend plan §4, minimum shape;
+ * owner, 2026-09-17: "bypass stays bypass: `rm -rf /tmp/probe` runs. The
+ * floor refuses only unrecoverable targets"; the lead's review and rulings
+ * of 2026-09-18).
+ *
+ * A destructive command whose target cannot be recovered is REFUSED, in
+ * every mode, bypass included, as a precondition — a chain member that
+ * denies, and a deny is what nothing outranks. The destructive commands:
+ * `rm`; `git clean -f`, `git reset --hard`, `git checkout -- <paths>` and
+ * the same loss spelled `git checkout .` / `-f`, `git restore` touching
+ * the worktree, `git switch -f` (R5); `find … -delete` with no selecting
+ * primary before it (R6). The unrecoverable targets:
+ *
+ *  - `/`, the home directory, the workspace root or any directory above it;
+ *  - the workspace's `.git` (R7);
+ *  - `~/.ssh`, `~/.config`, `~/.kiso`, `~/.gnupg`, `~/.aws`, or inside one;
+ *  - a system root and what is inside it — except the temp family and the
+ *    software prefixes (/opt/homebrew, /usr/local, linuxbrew), where only
+ *    the root itself is, and /Volumes /Users /home /mnt /media, where the
+ *    root and its direct children are (R8). Inside the workspace or the
+ *    home directory is never a system root's;
+ *  - a wildcard over any of those (`~/*`, `/*`, `*` at the workspace root —
+ *    a component of nothing but globs; `*.log` ranges over SOME entries);
+ *  - a target that is only a variable (`$DIR/`, `"$X"/*`) — empty, it is
+ *    the root of whatever comes after it. `$HOME` and `$PWD` are known.
+ *
+ * This is a reading of the command line, not a guarantee: the sandbox is
+ * the guarantee, and it comes after the launch. So the reading errs toward
+ * seeing a command — it looks inside `$( )`, backticks, `( )`, `sh -c` and
+ * `eval`, through `sudo`/`env`/`timeout`/`command` and shell keywords, and
+ * follows `cd` by its joiner — and a line that knocks the reader out is
+ * denied. Documented, not refused: `xargs rm`, script files and heredocs,
+ * `find -exec rm`, `mv`, `chmod -R`, `rmdir`, `unlink`, `truncate`,
+ * `shred`, `>` truncation, `rsync --delete`, `npx rimraf`, `trash`,
+ * `fish -c`, `ssh`, `docker`, `node -e` / `python -c` / `perl -e`, brace
+ * expansion, `$'…'`, `~+`, popd past one level, nesting past 16.
+ *
+ * The same resolver as the read-only allow decides where a path goes.
+ * Default on; `"floor": "off"` in the USER config turns it off, and a
+ * project config cannot — a repository must not be able to lower it.
+ */
+import type { PolicyCall } from "@vincemakes/kiso-core";
+import type { KisoExtension } from "@vincemakes/kiso-runtime";
+import { type LooseWord } from "./shell-words.js";
+export type FloorVerdict = {
+    readonly refused: false;
+} | {
+    readonly refused: true;
+    readonly why: string;
+};
+/** Past keywords, `sudo -u x`, `env A=1`, `timeout 5`, `command`, … to the
+ *  command that runs. Matched by basename: `/usr/bin/env rm` is env. */
+export declare function unwrap(argv: readonly LooseWord[]): readonly LooseWord[];
+/** `sh -c '…'`, `bash -lc '…'`, `eval …`: the command lines inside.
+ *  eval CONCATENATES its words with spaces and parses the result again —
+ *  that is its meaning, and `eval 'rm -rf ~'` is read that way. It is also
+ *  read once more with each word re-quoted, so `eval sh -c 'rm -rf /'`
+ *  keeps its script whole (B10, the lead's reading): either refusing is a
+ *  refusal. In the re-quoted reading `~` is already expanded and a word
+ *  holding an unknown stays raw — its value is unknown to eval too. */
+export declare function innerLines(argv: readonly LooseWord[], home: string): {
+    readonly lines: readonly string[];
+    readonly subshell: boolean;
+} | null;
+/**
+ * Would the floor refuse this command line? `workspaceRoot` is where the
+ * shell runs it.
+ */
+export declare function floorCheck(commandLine: string, workspaceRoot: string, home?: string): FloorVerdict;
+/** Is there a destructive command anywhere in the line, whatever its
+ *  target? A saved allow is never inherited by one (plan §4). */
+export declare function isDestructive(commandLine: string): boolean;
+/** The chain member, at the chain's head: DENY or ABSTAIN. */
+export declare function floorExtension(on: () => boolean, workspaceRoot: () => string, check?: typeof floorCheck): KisoExtension;
+/** Plan §4: "destructive commands never inherit a saved allow in the
+ *  asking modes" — the predicate the saved-allow wrap
+ *  (protected-writes.ts) is given, keyed on destructiveness, not on the
+ *  target: a saved allow never runs even `rm -rf build` unasked. */
+export declare function isDestructiveCall(call: PolicyCall): boolean;