@vincemakes/kiso-code 0.39.2 → 0.40.1

package/dist/config.js

@@ -12,7 +12,7 @@
  *                      "anthropic" | "openai-responses")
  *   models?: { [name]: { kind: "openai-compat"|"anthropic"|"openai-responses",
  *                        baseUrl?: string, model: string, apiKeyEnv: string } }
- *   mode?: "manual"|"default"|"accept-edits"|"plan"|"bypass"
+ *   mode?: "manual"|"default"|"accept-edits"|"plan"|"bypass"|"dontAsk"
  *   contextWindow?: number      — tokens
  *   autoCompact?: { thresholdRatio: number }   — 0<r<1; default off
  *   projectTrust?: "ask" | "never"             — no "always" (the ruling)
@@ -27,13 +27,14 @@
  * with an invalid value is likewise loud; unknown top-level keys are
  * ignored (forward compatibility).
  */
-import { readFileSync } from "node:fs";
+import { readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
 import { join } from "node:path";
 import { kisoHome } from "./state.js";
 import { AuthError, getCredential, providerIdOf } from "./auth/credentials.js";
 import { BUILTIN_MANIFESTS } from "@vincemakes/kiso-runtime/internal";
 const KINDS = ["openai-compat", "anthropic", "openai-responses"];
-const MODES_LIST = ["manual", "default", "accept-edits", "plan", "bypass"];
+const MODES_LIST = ["manual", "default", "accept-edits", "plan", "bypass", "dontAsk"];
 export class ConfigError extends Error {
 }
 /** Parse + validate one config file. Broken JSON / invalid known values →
@@ -66,6 +67,36 @@ export function parseConfig(text, source) {
             fail("theme", "belongs in the USER config — a terminal is a property of the person at it, not of the project");
         out.theme = obj.theme;
     }
+    if (obj.floor !== undefined) {
+        if (obj.floor !== "catastrophe" && obj.floor !== "off")
+            fail("floor", 'expected "catastrophe" or "off"');
+        if (source.startsWith("<cwd>"))
+            fail("floor", "belongs in the USER config — a project must never be able to lower the floor");
+        out.floor = obj.floor;
+    }
+    if (obj.protectedPaths !== undefined) {
+        if (source.startsWith("<cwd>"))
+            fail("protectedPaths", "belongs in the USER config — a project must never be able to change what kiso guards");
+        if (!Array.isArray(obj.protectedPaths))
+            fail("protectedPaths", "expected an array of paths");
+        for (const [i, p] of obj.protectedPaths.entries()) {
+            // a relative path would be read against whatever directory kiso
+            // runs in — a different file in every project
+            if (typeof p !== "string" || !(p.startsWith("/") || p.startsWith("~/")))
+                fail(`protectedPaths[${i}]`, "expected an absolute path or one starting with ~/");
+            // kiso protects FILES. A directory listed here would protect
+            // nothing under it — a security setting that silently does
+            // nothing — so it is refused where the person can see it.
+            // (Read at every agent build: a directory created later is
+            // caught at the next start or /reload.)
+            const path = p;
+            const full = path.startsWith("~/") ? join(homedir(), path.slice(2)) : path;
+            if (path.endsWith("/") || statSync(full, { throwIfNoEntry: false })?.isDirectory() === true) {
+                fail(`protectedPaths[${i}]`, `${path} is a directory — kiso protects files, so list the files in it (for ~/.aws: "~/.aws/credentials", "~/.aws/config")`);
+            }
+        }
+        out.protectedPaths = obj.protectedPaths;
+    }
     if (obj.checks !== undefined) {
         if (obj.checks === null || typeof obj.checks !== "object" || Array.isArray(obj.checks))
             fail("checks", "expected an object of name → command");

package/dist/dispatch.d.ts

@@ -3,8 +3,10 @@
  * turns. The bodies moved verbatim from chat()'s closure; chat provides
  * the context (the chain, the run state, the prompt arming).
  */
+import type { SessionRoute } from "./projects.js";
 import type { AgentSession } from "@vincemakes/kiso-runtime";
 import { type LineInput } from "./state.js";
+import type { UserInputVia } from "@vincemakes/kiso-core";
 /** Everything dispatch touches that chat() owns. */
 export interface DispatchCtx {
     readonly session: AgentSession;
@@ -23,8 +25,10 @@ export interface DispatchCtx {
      *  gone; a binding that has not run yet paints none — an unmeasured
      *  cache is not a 0% cache, and it is not the previous model's either. */
     readonly modelSwitched: () => void;
-    /** submit a real turn: queue + chain (the turn closure lives in chat). */
-    readonly submitTurn: (line: string) => void;
+    /** submit a real turn: queue + chain (the turn closure lives in chat).
+     *  0.40.0: `via` marks a skill turn — `line` is then the composed
+     *  content, and the chip shows `via.line`. */
+    readonly submitTurn: (line: string, via?: UserInputVia) => void;
     /** the /status context estimate. */
     readonly estimateCtx: () => number;
     /** TUI2-R1 (E): the model's context window, as the session is
@@ -33,11 +37,17 @@ export interface DispatchCtx {
     /** the /resume+/clear mini-spec: end this chat() with a switch to
      *  another session — main re-enters chat there; the editor survives. */
     readonly requestSwitch: (id: string) => void;
+    /** DC-57: true once this entry has been asked to leave — the guard that keeps a departing session from answering a batch's later lines. */
+    readonly leaving: () => boolean;
     /** §2.5: end this chat() with a REBUILD of the agent on the SAME
      *  session — extensions, skills and config are read again. */
     readonly requestReload: () => void;
     /** every durable session id (the /resume validation + listing). */
     readonly sessions: () => readonly string[];
+    /** 0.40.0: an id outside this project's folder — refused with where to
+     *  go, or opened where it is with a line (absent: every such id is "no
+     *  such"). */
+    readonly route?: (id: string) => SessionRoute | null;
     /** the dock's session picker, when one exists (bare /resume). */
     readonly pickSession?: () => Promise<string | null>;
 }

package/dist/dispatch.js

@@ -3,17 +3,39 @@
  * turns. The bodies moved verbatim from chat()'s closure; chat provides
  * the context (the chain, the run state, the prompt arming).
  */
-import { contextRows, contextUnavailableRows, displayVerb, escapeTerminal, helpRows, kUnit, modePickView, modelPickView, palette, renderEvent, settledLabel, slashCommandNames } from "@vincemakes/kiso-tui";
+import { STATUS_GLYPHS, contextRows, contextUnavailableRows, displayVerb, escapeTerminal, helpRows, kUnit, modePickView, modelPickView, compactingStatus, palette, renderEvent, settledLabel, slashCommandNames } from "@vincemakes/kiso-tui";
 import { newSessionId } from "./session-id.js";
 import { buildAdapter, lookupModelMetadata, resolveContinuationScope, resolveReasoning } from "@vincemakes/kiso-runtime/internal";
-import { MODES, MODE_NOTE, getMode, setMode } from "./mode.js";
+import { MODES, MODE_NOTE, OFFERED_MODES, getMode, setMode } from "./mode.js";
 import { clipboardWrite, lastAnswer } from "./clipboard.js";
-import { agentModel, body, bodyLog, codingToolOptions, kisoHome, configModels, dock, lastBinding, mergedConfig, readContextLedger, sessionsDir, setAgentModel, setConfiguredWindow, setCurrentModelName, setModelChoice, setLastBinding } from "./state.js";
+import { protectedBangReason, protectedShellVerdict } from "./protected-shell.js";
+import { agentBaseUrl, currentProfileName, setCurrentProfileName, currentModelName, agentModel, body, bodyLog, codingToolOptions, protectedFiles, kisoHome, configModels, dock, lastBinding, loadedSkillsCatalog, mergedConfig, readContextLedger, retryOnRow, sessionsDir, setAgentModel, setConfiguredWindow, setCurrentModelName, setModelChoice, setRetryShown, setLastBinding } from "./state.js";
 import { adapterOptionsFor } from "./auth/adapter-options.js";
-import { microcompactThresholdFor } from "./chat.js";
+import { profileProviderLabel, providerLabel } from "./provider-label.js";
+import { queuedSwitchLines } from "./state.js";
+import { contextWindowTokens, microcompactThresholdFor, startStatusSpinner } from "./chat.js";
 import { authForProfile, directWriteProfile, profileAvailable, resolveContextWindow, unavailableReason } from "./config.js";
 import { shellTool } from "@vincemakes/kiso-tools-node";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
+import { realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { resolveSkillLine, skillsRows } from "./skill-invoke.js";
+/** Where a skill directory really lives. Project and user skills are
+ *  merged into one scan directory by symlink, so the scan root names a
+ *  temp directory; the link's target is the answer a person can use. */
+function skillSource(dir) {
+    const scan = process.env.KISO_SKILLS_DIR ?? join(kisoHome(), "skills");
+    try {
+        return tildePath(dirname(realpathSync(join(scan, dir))));
+    }
+    catch {
+        return tildePath(scan); // a broken link has no target to name
+    }
+}
+function tildePath(p) {
+    const home = homedir();
+    return p === home || p.startsWith(`${home}/`) ? `~${p.slice(home.length)}` : p;
+}
 /** The picker's CLI half (owner 2026-09-08): a profile's LEGAL effort levels
  *  and its default, from the registry, shown wherever the profile is listed
  *  — kiso never silently drops a level, and now it shows the ones it takes.
@@ -130,9 +152,21 @@ export function parseBang(trimmed) {
  *  No approval panel, at any tier including plan: the human typed the
  *  command. That is not a policy exemption, it is structural — this
  *  dispatcher only ever sees lines a human submitted, so a model cannot
- *  reach this branch. */
+ *  reach this branch.
+ *
+ *  One check it does take: kiso never serves its own credential store to a
+ *  model, and `!cmd` hands its output to one. `!!cmd` does not — but the
+ *  two are one keystroke apart, so a line naming a protected file runs
+ *  under neither, and the store stays one `cat` away in the person's own
+ *  terminal. */
 function runBang(command, send, ctx) {
     ctx.chainRef.current = ctx.chainRef.current.then(async () => {
+        const guard = protectedShellVerdict(command, codingToolOptions().workspaceRoot, protectedFiles(), { home: homedir(), kisoHome: kisoHome() });
+        if (guard.refused) {
+            bodyLog(protectedBangReason(guard));
+            ctx.input.prompt();
+            return;
+        }
         const controller = new AbortController();
         activeBang = controller;
         try {
@@ -158,6 +192,18 @@ function runBang(command, send, ctx) {
     });
 }
 export function dispatch(line, ctx) {
+    // DC-57 (the owner's ruling, 2026-09-21): a session that is LEAVING — a
+    // switch or a reload has been requested from an earlier segment of the
+    // chain — does not answer new lines. They are queued for the session the
+    // person asked for and replayed by its `chat()` entry. The guard lives
+    // HERE, not only at the input edge: a batch that arrived before the
+    // switch was requested still runs its segments after it (the chain is
+    // FIFO), which is exactly how a pasted prompt used to land in the
+    // departing session.
+    if (ctx.leaving()) {
+        queuedSwitchLines.push(line);
+        return;
+    }
     const trimmed = line.trim();
     // §2.2 — the `!` gesture is the COMPOSER's alone. A piped session, `-p`
     // and `--task-file` keep `!` as ordinary text: those lines are content,
@@ -442,6 +488,21 @@ export function dispatch(line, ctx) {
             bodyLog(`session ${ctx.session.id}`);
             bodyLog(`${ctx.session.log.all.length} events`);
             bodyLog(`ctx ${ctxPct}`);
+            // The owner, 2026-09-21: /status is where "what am I actually
+            // running on" is answered, so the identity is spelled out HERE —
+            // the model, the host the request goes to, the profile it came
+            // from and the key it spends. The status row stays short; this
+            // line is the disambiguation two same-named profiles need.
+            //
+            // REVIEW (2026-09-21): the profile is named only when what is in
+            // hand IS a profile key. `currentModelName` holds whatever the
+            // resolution produced — a profile alias after `/model`, a MODEL ID
+            // after a switch or a resume — so printing it unconditionally
+            // claimed `profile deepseek-v4-flash` for a session that was
+            // restored, not switched. (The real fix is to stop overloading that
+            // variable; until then, a label that cannot lie.)
+            const profileOf = currentProfileName === null ? "" : ` · profile ${currentProfileName}`;
+            bodyLog(`model ${agentModel}${providerLabel(agentBaseUrl)}${profileOf}`);
             ctx.input.prompt();
         });
         return;
@@ -469,7 +530,7 @@ export function dispatch(line, ctx) {
                     const picked = await new Promise((resolve) => {
                         ctx.input.panelAsk(modePickView({
                             header: `mode — current: ${current}`,
-                            options: MODES.map((name) => ({ label: name, note: [MODE_NOTE[name], ...(name === current ? ["current"] : [])].join(" · ") })),
+                            options: OFFERED_MODES.map((name) => ({ label: name, note: [MODE_NOTE[name], ...(name === current ? ["current"] : [])].join(" · ") })),
                         }, 
                         // DC-12 (design §4): a panel WAITING ON A HUMAN says ❯.
                         ctx.isRunning() ? "❯ run paused" : `▸ ${current}`), (v) => resolve(v.action === "picked" ? v.result : null));
@@ -479,10 +540,10 @@ export function dispatch(line, ctx) {
                         ctx.input.prompt();
                         return; // esc — nothing switched, nothing said
                     }
-                    const chosen = "index" in picked ? MODES[picked.index] : MODES.find((x) => x === picked.custom.trim());
+                    const chosen = "index" in picked ? OFFERED_MODES[picked.index] : MODES.find((x) => x === picked.custom.trim());
                     if (chosen === undefined) {
                         bodyLog(`no such mode: ${"index" in picked ? String(picked.index) : picked.custom.trim()}`);
-                        bodyLog(`tiers: ${MODES.join(" ")}`);
+                        bodyLog(`tiers: ${OFFERED_MODES.join(" ")}`);
                     }
                     else {
                         setMode(chosen);
@@ -493,11 +554,11 @@ export function dispatch(line, ctx) {
                     return;
                 }
                 bodyLog(`mode ${getMode()}`);
-                bodyLog(`tiers: ${MODES.join(" ")}`);
+                bodyLog(`tiers: ${OFFERED_MODES.join(" ")}`);
             }
             else if (m === undefined) {
                 bodyLog(`no such mode: ${trimmed.slice(5).trim()}`);
-                bodyLog(`tiers: ${MODES.join(" ")}`);
+                bodyLog(`tiers: ${OFFERED_MODES.join(" ")}`);
             }
             else {
                 setMode(m);
@@ -535,8 +596,20 @@ export function dispatch(line, ctx) {
                             // the note keeps what tells two rows apart; the levels
                             // left it for the axis below (they were being cut off
                             // the end of the note column at 100 columns).
-                            const marks = [`profile: ${name}`, ...(profileAvailable(profile) ? [] : ["unavailable"]), ...(profile.model === agentModel ? ["current"] : [])];
-                            return { label: `${profile.kind}/${profile.model}`, note: marks.join(" · "), ...effortAxis(profile) };
+                            // The owner, 2026-09-21: two profiles can name ONE model
+                            // id and reach two accounts, so the current mark follows
+                            // the PROFILE the session is on (`currentModelName`), not
+                            // the model id — the id alone marked both such rows, or
+                            // neither. The row's own provider rides the label, so two
+                            // rows that share an id still read differently.
+                            // 0.40.1 (the owner's dogfood, 2026-09-21): the `profile: <key>` prefix
+                            // is gone — the row already names the model and its endpoint, and the
+                            // profile key is what `/model <name>` takes, not what a chooser
+                            // reading a list needs. What remains is what the chooser CANNOT
+                            // infer: availability, and which one is live.
+                            const marks = [...(profileAvailable(profile) ? [] : ["unavailable"]), ...(name === currentProfileName ? ["current"] : [])];
+                            const host = profileProviderLabel(profile.kind, profile.baseUrl);
+                            return { label: `${profile.kind}/${profile.model}${host === "" ? "" : ` ${host}`}`, note: marks.join(" · "), ...effortAxis(profile) };
                         }),
                         // PH-1a (finding PH-F4): the example must be a syntax
                         // directWriteProfile actually ACCEPTS — the old
@@ -585,7 +658,8 @@ export function dispatch(line, ctx) {
                 else {
                     for (const name of names) {
                         const p = configModels[name];
-                        bodyLog(`  ${name} → ${p.kind}/${p.model} · ${signInNote(p)} ${profileAvailable(p) ? "(available)" : "(unavailable)"} · ${effortNote(p)}`);
+                        const hostOf = profileProviderLabel(p.kind, p.baseUrl);
+                        bodyLog(`  ${name} → ${p.kind}/${p.model}${hostOf === "" ? "" : ` ${hostOf}`} · ${signInNote(p)} ${profileAvailable(p) ? "(available)" : "(unavailable)"} · ${effortNote(p)}`);
                     }
                 }
                 bodyLog("switch with /model <profile-name|provider/model>");
@@ -666,16 +740,22 @@ export function dispatch(line, ctx) {
                                         ...(profile.baseUrl !== undefined ? { baseUrl: profile.baseUrl } : {}),
                                     }),
                                 },
+                                // A1b: the in-run tiers are drawn from the same window.
+                                contextWindow: contextWindowTokens({ model: profile.model, ...(profile.baseUrl !== undefined ? { baseUrl: profile.baseUrl } : {}) }),
                                 // OR-1: the endpoint is the fourth passenger — the cost
                                 // path and the window lookup key on (model, endpoint).
                                 ...(profile.baseUrl !== undefined ? { baseUrl: profile.baseUrl } : {}),
                                 ...(scope !== undefined ? { scope } : {}),
                                 ...(reasoning !== undefined ? { reasoning } : {}),
+                                // 0.40.0: the NAME the person switched to, recorded for
+                                // display — a direct provider/model has none.
+                                profileName: direct === null ? profName : null,
                             };
                             ctx.session.setModelBinding(binding);
                             setLastBinding(binding);
                             setAgentModel(profile.model, profile.baseUrl);
                             setCurrentModelName(arg);
+                            setCurrentProfileName(direct === null ? null : profName);
                             // §2.5: the ONE source a reload reads for the model — a
                             // switch made here must survive the rebuild.
                             setModelChoice(arg);
@@ -695,7 +775,7 @@ export function dispatch(line, ctx) {
                             // (and the owner's) read `gpt-6-astra · CH 92%`, the new
                             // model beside the previous model's figure.
                             ctx.modelSwitched();
-                            body.notice(`model → ${profName} (${profile.model}${effortTok !== undefined ? ` · ${effortTok}` : ""}) — takes effect on the next turn`);
+                            body.notice(`model → ${profName} (${profile.model}${providerLabel(profile.baseUrl) === "" ? "" : ` ${providerLabel(profile.baseUrl)}`}${effortTok !== undefined ? ` · ${effortTok}` : ""}) — takes effect on the next turn`);
                         }
                     }
                 }
@@ -732,7 +812,12 @@ export function dispatch(line, ctx) {
             };
             ctx.input.onEscape(onEscape);
             let compactStart = 0;
-            let compactTimer = null;
+            let repaintCompacting = () => { };
+            // 0.40.0 (the owner's dogfood): the row walks the WORKING twinkle,
+            // the same spinner as a running turn — a static glyph repainted
+            // once a second read as a stalled screen while the model thought
+            let glyph = STATUS_GLYPHS[0];
+            let stopSpinner = null;
             // the `as` on the initializer keeps the flow type the full union —
             // onStart fills this during the call, but a closure assignment
             // never re-narrows the outer scope (it would read `never`)
@@ -740,20 +825,30 @@ export function dispatch(line, ctx) {
             // the ctx estimate BEFORE the summarized event lands (the used
             // fraction — the recap's "ctx 91% → 34%" drops after compacting)
             let ctxBefore = null;
+            // 0.40.0: the summary call's progress against its output budget —
+            // the latest report, read by the row; the runtime reports per
+            // streamed chunk and the row repaints at most every 200 ms
+            let progress = null;
+            let lastProgressPaint = 0;
             const compacting = (info) => {
-                const text = (elapsed) => `▘ compacting · ${info.rounds} rounds · ~${kUnit(info.tokens)} tokens · ${Math.max(0, elapsed)}s`;
+                // 0.40.0: composed by the row seam, not a template here — the row
+                // is where the launch build's progress segment plugs in.
+                const text = (elapsed) => compactingStatus(glyph, info.rounds, info.tokens, elapsed, undefined, retryOnRow(), progress);
+                repaintCompacting = () => dock.setStatus(text(Math.round((Date.now() - compactStart) / 1000)), "esc to cancel");
                 compactStart = Date.now();
                 ctxBefore = ctxPercent(ctx.estimateCtx());
                 dock.setStatus(text(0), "esc to cancel");
-                compactTimer = setInterval(() => {
-                    dock.setStatus(text(Math.round((Date.now() - compactStart) / 1000)), "esc to cancel");
-                }, 1000);
+                stopSpinner = startStatusSpinner((next) => {
+                    glyph = next;
+                    repaintCompacting();
+                });
             };
             try {
                 // R3a: /compact <focus> — the words after the command steer
                 // the summary ("keep the auth details"); bare /compact is
                 // byte-identical to the pre-round call.
                 const focus = trimmed.slice(8).trim();
+                setRetryShown(null);
                 const result = await ctx.session.summarize({
                     signal: abort.signal,
                     // 0.39.2: the gesture gets the measured output budget and
@@ -767,6 +862,14 @@ export function dispatch(line, ctx) {
                         compactInfo = info;
                         compacting(info);
                     },
+                    onProgress: (p) => {
+                        progress = { produced: p.produced, budget: p.budget, reasoningUnseen: p.reasoningUnseen };
+                        const now = Date.now();
+                        if (now - lastProgressPaint < 200)
+                            return;
+                        lastProgressPaint = now;
+                        repaintCompacting();
+                    },
                 });
                 if (result === null) {
                     body.notice("[/compact] nothing to compact — fewer than 5 rounds yet");
@@ -828,8 +931,10 @@ export function dispatch(line, ctx) {
                 }
             }
             finally {
-                if (compactTimer !== null)
-                    clearInterval(compactTimer);
+                stopSpinner?.();
+                // ADR-0005 Amendment 2: a retry belongs to the call that
+                // announced it — none may outlive the compaction into the idle row.
+                setRetryShown(null);
                 ctx.paintIdle();
             }
             ctx.input.prompt();
@@ -910,8 +1015,15 @@ export function dispatch(line, ctx) {
             // would; the validation is the difference
             if (!ctx.sessions().includes(arg)) {
                 ctx.chainRef.current = ctx.chainRef.current.then(async () => {
-                    bodyLog(`no such session: ${escapeTerminal(arg)} — /resume lists them`);
-                    ctx.input.prompt();
+                    const route = ctx.route?.(arg) ?? null;
+                    if (route === null || route.kind === "refused") {
+                        bodyLog(route?.line ?? `no such session: ${escapeTerminal(arg)} — /resume lists them`);
+                        ctx.input.prompt();
+                        return;
+                    }
+                    if (route.kind === "elsewhere" && route.line !== null)
+                        bodyLog(route.line);
+                    ctx.requestSwitch(arg);
                 });
                 return;
             }
@@ -933,6 +1045,16 @@ export function dispatch(line, ctx) {
                     ctx.input.prompt(); // esc — nothing switched, nothing said
                     return;
                 }
+                // 0.40.0: `tab` lists every project; another project's recorded
+                // session is refused with where to go
+                const route = ctx.sessions().includes(picked) ? null : (ctx.route?.(picked) ?? null);
+                if (route?.kind === "refused") {
+                    bodyLog(route.line);
+                    ctx.input.prompt();
+                    return;
+                }
+                if (route?.kind === "elsewhere" && route.line !== null)
+                    bodyLog(route.line);
                 ctx.requestSwitch(picked);
             });
             return;
@@ -945,6 +1067,25 @@ export function dispatch(line, ctx) {
         });
         return;
     }
+    // 0.40.0 — a person's skill: `/skills`, `/skill <name> [args]`, or
+    // `/<name> [args]` for a name no built-in above claimed. Placed AFTER
+    // every built-in so a built-in always wins, and BEFORE the unknown-
+    // command line so an installed skill is never called unknown.
+    const skill = resolveSkillLine(trimmed, loadedSkillsCatalog(), slashCommandNames());
+    if (trimmed === "/skills" || trimmed === "/skill" || skill !== null) {
+        if (skill?.kind === "submit") {
+            ctx.submitTurn(skill.content, skill.via);
+            return;
+        }
+        ctx.chainRef.current = ctx.chainRef.current.then(async () => {
+            if (skill?.kind === "list")
+                bodyLog(skillsRows(loadedSkillsCatalog(), skillSource, tildePath(join(kisoHome(), "skills"))).map(escapeTerminal).join("\n"));
+            else if (skill?.kind === "error")
+                bodyLog(escapeTerminal(skill.message));
+            ctx.input.prompt();
+        });
+        return;
+    }
     // PH-1a (finding PH-F1): an unrecognized slash command is an ERROR,
     // never a turn — the fallthrough used to hand "/clear", "/exit", or a
     // typo to the model, burning a request on text the user meant as a

package/dist/floor.d.ts

@@ -0,0 +1,80 @@
+/**
+ * 0.40.0 — the catastrophe floor (launch-weekend plan §4, minimum shape;
+ * owner, 2026-09-17: "bypass stays bypass: `rm -rf /tmp/probe` runs. The
+ * floor refuses only unrecoverable targets"; the lead's review and rulings
+ * of 2026-09-18).
+ *
+ * A destructive command whose target cannot be recovered is REFUSED, in
+ * every mode, bypass included, as a precondition — a chain member that
+ * denies, and a deny is what nothing outranks. The destructive commands:
+ * `rm`; `git clean -f`, `git reset --hard`, `git checkout -- <paths>` and
+ * the same loss spelled `git checkout .` / `-f`, `git restore` touching
+ * the worktree, `git switch -f` (R5); `find … -delete` with no selecting
+ * primary before it (R6). The unrecoverable targets:
+ *
+ *  - `/`, the home directory, the workspace root or any directory above it;
+ *  - the workspace's `.git` (R7);
+ *  - `~/.ssh`, `~/.config`, `~/.kiso`, `~/.gnupg`, `~/.aws`, or inside one;
+ *  - a system root and what is inside it — except the temp family and the
+ *    software prefixes (/opt/homebrew, /usr/local, linuxbrew), where only
+ *    the root itself is, and /Volumes /Users /home /mnt /media, where the
+ *    root and its direct children are (R8). Inside the workspace or the
+ *    home directory is never a system root's;
+ *  - a wildcard over any of those (`~/*`, `/*`, `*` at the workspace root —
+ *    a component of nothing but globs; `*.log` ranges over SOME entries);
+ *  - a target that is only a variable (`$DIR/`, `"$X"/*`) — empty, it is
+ *    the root of whatever comes after it. `$HOME` and `$PWD` are known.
+ *
+ * This is a reading of the command line, not a guarantee: the sandbox is
+ * the guarantee, and it comes after the launch. So the reading errs toward
+ * seeing a command — it looks inside `$( )`, backticks, `( )`, `sh -c` and
+ * `eval`, through `sudo`/`env`/`timeout`/`command` and shell keywords, and
+ * follows `cd` by its joiner — and a line that knocks the reader out is
+ * denied. Documented, not refused: `xargs rm`, script files and heredocs,
+ * `find -exec rm`, `mv`, `chmod -R`, `rmdir`, `unlink`, `truncate`,
+ * `shred`, `>` truncation, `rsync --delete`, `npx rimraf`, `trash`,
+ * `fish -c`, `ssh`, `docker`, `node -e` / `python -c` / `perl -e`, brace
+ * expansion, `$'…'`, `~+`, popd past one level, nesting past 16.
+ *
+ * The same resolver as the read-only allow decides where a path goes.
+ * Default on; `"floor": "off"` in the USER config turns it off, and a
+ * project config cannot — a repository must not be able to lower it.
+ */
+import type { PolicyCall } from "@vincemakes/kiso-core";
+import type { KisoExtension } from "@vincemakes/kiso-runtime";
+import { type LooseWord } from "./shell-words.js";
+export type FloorVerdict = {
+    readonly refused: false;
+} | {
+    readonly refused: true;
+    readonly why: string;
+};
+/** Past keywords, `sudo -u x`, `env A=1`, `timeout 5`, `command`, … to the
+ *  command that runs. Matched by basename: `/usr/bin/env rm` is env. */
+export declare function unwrap(argv: readonly LooseWord[]): readonly LooseWord[];
+/** `sh -c '…'`, `bash -lc '…'`, `eval …`: the command lines inside.
+ *  eval CONCATENATES its words with spaces and parses the result again —
+ *  that is its meaning, and `eval 'rm -rf ~'` is read that way. It is also
+ *  read once more with each word re-quoted, so `eval sh -c 'rm -rf /'`
+ *  keeps its script whole (B10, the lead's reading): either refusing is a
+ *  refusal. In the re-quoted reading `~` is already expanded and a word
+ *  holding an unknown stays raw — its value is unknown to eval too. */
+export declare function innerLines(argv: readonly LooseWord[], home: string): {
+    readonly lines: readonly string[];
+    readonly subshell: boolean;
+} | null;
+/**
+ * Would the floor refuse this command line? `workspaceRoot` is where the
+ * shell runs it.
+ */
+export declare function floorCheck(commandLine: string, workspaceRoot: string, home?: string): FloorVerdict;
+/** Is there a destructive command anywhere in the line, whatever its
+ *  target? A saved allow is never inherited by one (plan §4). */
+export declare function isDestructive(commandLine: string): boolean;
+/** The chain member, at the chain's head: DENY or ABSTAIN. */
+export declare function floorExtension(on: () => boolean, workspaceRoot: () => string, check?: typeof floorCheck): KisoExtension;
+/** Plan §4: "destructive commands never inherit a saved allow in the
+ *  asking modes" — the predicate the saved-allow wrap
+ *  (protected-writes.ts) is given, keyed on destructiveness, not on the
+ *  target: a saved allow never runs even `rm -rf build` unasked. */
+export declare function isDestructiveCall(call: PolicyCall): boolean;