@vincemakes/kiso-code 0.40.7 → 0.41.1

package/dist/coding-prompt.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The coding product's prompt policy — the base system prompt and the
+ * project-instruction injection. Moved verbatim from index.ts (R1,
+ * 2026-09-23): the entry module keeps no prompt text of its own.
+ */
+/**
+ * A area: the coding-agent system prompt — ONE constant, byte-stable for the
+ * session's lifetime (D area). Kept under ~80 lines; no template engine.
+ */
+/** The built-in prompt. Exported for scripts/request-surface.mjs — the
+ *  model-side token-rent counter measures the REAL bytes, never a copy. */
+export declare const SYSTEM_PROMPT = "You are kiso, a coding agent. You work in a workspace\ndirectory and change code with tools. Be concise: answer in a few lines\nunless the task genuinely needs more. Never claim a file was changed\nunless a tool confirmed it.\n\nWhat you can reach:\n- The workspace: read_file, list_dir, search_text, write_file, edit_file.\n- This machine and the network: shell \u2014 builds, tests, git, package\n  managers, curl for HTTP, system queries. A request one command can\n  answer is answered by running it.\n- The human: ask_user, for a decision that is theirs.\n\nTool discipline:\n- READ BEFORE YOU EDIT. For any file you are about to change, read it\n  first \u2014 never guess its content.\n- Use edit_file for targeted changes and write_file for full rewrites.\n  Prefer many small edits over one large write.\n- Be careful \u2014 shell has side effects and may take time.\n- search_text and list_dir are cheap \u2014 locate first, then read ranges\n  with read_file offset/limit; never read a whole large file in one call.\n- Do not re-read a file you already read unchanged, or one you changed\n  yourself through a confirmed edit \u2014 rely on the earlier result and\n  on the change you just made.\n- When a tool fails, read the error and adjust; do not repeat the same\n  call blindly.\n\nAn authorization covers what it NAMES: when the scope is not named \u2014\nwhich files, which branches, whether to push \u2014 ask before acting.\nDelivering, sharing or handing over changes means committing locally and\nstopping; pushing, publishing or sending happens only when the human\nnames it.\n\nWorkflow: understand the request, find the relevant code, make the\nsmallest change that works, then verify with a command (tests/build).\nReport what you did in one or two lines per change.";
+/** Hard cap for injected instructions — truncate and say so. */
+/**
+ * A area: read the FIRST present instruction file (AGENTS.md preferred) and
+ * return it as an injected section, or "" when none exists. Truncated at
+ * 8KB with an explicit note. Pure — read once per session, so the prompt
+ * is byte-stable for the session's lifetime.
+ *
+ * kiso never serves its own credential store to a model, and this read is
+ * the one that needs no model at all: a cloned repository whose AGENTS.md
+ * is a symlink to the store would put it in the SYSTEM PROMPT of every
+ * request, with no tool call and no trust prompt. A file that resolves to
+ * a protected one is skipped as though absent.
+ */
+export declare function readProjectInstructions(cwd: string, protectedFiles?: readonly string[]): string;
+/** A area: the session's system prompt — the constant plus any project
+ *  instructions found in the workspace. Deterministic per cwd. */
+export declare function composeSystemPrompt(cwd: string, protectedFiles?: readonly string[]): string;
+/**
+ * The coding agent's tool-table vocabulary — one routing line per tool, in
+ * the table only while that tool is active (0.1.40, R-C item 1: the
+ * reference implementation's content in kiso's voice). ACI-6 made this the
+ * ONE canonical statement of the routing policy; the base prompt above no
+ * longer restates it.
+ *
+ * R1 (2026-09-23): moved verbatim from the runtime's compose.ts, where it
+ * sat as a constant and reached every host whose tools shared these names.
+ * The rows, their order and their position in the table are unchanged —
+ * the byte fixture in tests/fixtures pins that.
+ */
+export declare const CODING_TOOL_RULES: ReadonlyArray<{
+    readonly tool: string;
+    readonly line: string;
+}>;

package/dist/coding-prompt.js

@@ -0,0 +1,105 @@
+/**
+ * The coding product's prompt policy — the base system prompt and the
+ * project-instruction injection. Moved verbatim from index.ts (R1,
+ * 2026-09-23): the entry module keeps no prompt text of its own.
+ */
+import { protectedFiles } from "./state.js";
+import { isProtectedPath, protectedIdentity } from "@vincemakes/kiso-tools-node";
+import { join } from "node:path";
+import { readFileSync } from "node:fs";
+/**
+ * A area: the coding-agent system prompt — ONE constant, byte-stable for the
+ * session's lifetime (D area). Kept under ~80 lines; no template engine.
+ */
+/** The built-in prompt. Exported for scripts/request-surface.mjs — the
+ *  model-side token-rent counter measures the REAL bytes, never a copy. */
+export const SYSTEM_PROMPT = `You are kiso, a coding agent. You work in a workspace
+directory and change code with tools. Be concise: answer in a few lines
+unless the task genuinely needs more. Never claim a file was changed
+unless a tool confirmed it.
+
+What you can reach:
+- The workspace: read_file, list_dir, search_text, write_file, edit_file.
+- This machine and the network: shell — builds, tests, git, package
+  managers, curl for HTTP, system queries. A request one command can
+  answer is answered by running it.
+- The human: ask_user, for a decision that is theirs.
+
+Tool discipline:
+- READ BEFORE YOU EDIT. For any file you are about to change, read it
+  first — never guess its content.
+- Use edit_file for targeted changes and write_file for full rewrites.
+  Prefer many small edits over one large write.
+- Be careful — shell has side effects and may take time.
+- search_text and list_dir are cheap — locate first, then read ranges
+  with read_file offset/limit; never read a whole large file in one call.
+- Do not re-read a file you already read unchanged, or one you changed
+  yourself through a confirmed edit — rely on the earlier result and
+  on the change you just made.
+- When a tool fails, read the error and adjust; do not repeat the same
+  call blindly.
+
+An authorization covers what it NAMES: when the scope is not named —
+which files, which branches, whether to push — ask before acting.
+Delivering, sharing or handing over changes means committing locally and
+stopping; pushing, publishing or sending happens only when the human
+names it.
+
+Workflow: understand the request, find the relevant code, make the
+smallest change that works, then verify with a command (tests/build).
+Report what you did in one or two lines per change.`;
+/** The project-instructions file names, in priority order (A area). */
+const INSTRUCTION_FILES = ["AGENTS.md", "CLAUDE.md"];
+/** Hard cap for injected instructions — truncate and say so. */
+/**
+ * A area: read the FIRST present instruction file (AGENTS.md preferred) and
+ * return it as an injected section, or "" when none exists. Truncated at
+ * 8KB with an explicit note. Pure — read once per session, so the prompt
+ * is byte-stable for the session's lifetime.
+ *
+ * kiso never serves its own credential store to a model, and this read is
+ * the one that needs no model at all: a cloned repository whose AGENTS.md
+ * is a symlink to the store would put it in the SYSTEM PROMPT of every
+ * request, with no tool call and no trust prompt. A file that resolves to
+ * a protected one is skipped as though absent.
+ */
+export function readProjectInstructions(cwd, protectedFiles = []) {
+    const id = protectedIdentity(protectedFiles);
+    for (const name of INSTRUCTION_FILES) {
+        if (isProtectedPath(join(cwd, name), id))
+            continue;
+        let text;
+        try {
+            text = readFileSync(join(cwd, name), "utf8");
+        }
+        catch {
+            continue; // not present — try the next
+        }
+        return `\n\n=== Project instructions (${name}) ===\n${text.length > 8 * 1024 ? text.slice(0, 8 * 1024) + `\n\n[truncated at ${8 * 1024} chars]` : text}`;
+    }
+    return "";
+}
+/** A area: the session's system prompt — the constant plus any project
+ *  instructions found in the workspace. Deterministic per cwd. */
+export function composeSystemPrompt(cwd, protectedFiles = []) {
+    const injected = readProjectInstructions(cwd, protectedFiles);
+    return injected === "" ? SYSTEM_PROMPT : `${SYSTEM_PROMPT}\n${injected}`;
+}
+/**
+ * The coding agent's tool-table vocabulary — one routing line per tool, in
+ * the table only while that tool is active (0.1.40, R-C item 1: the
+ * reference implementation's content in kiso's voice). ACI-6 made this the
+ * ONE canonical statement of the routing policy; the base prompt above no
+ * longer restates it.
+ *
+ * R1 (2026-09-23): moved verbatim from the runtime's compose.ts, where it
+ * sat as a constant and reached every host whose tools shared these names.
+ * The rows, their order and their position in the table are unchanged —
+ * the byte fixture in tests/fixtures pins that.
+ */
+export const CODING_TOOL_RULES = [
+    { tool: "read_file", line: "read files with read_file, never shell cat/head/tail" },
+    { tool: "search_text", line: "search with search_text, never shell grep/rg" },
+    { tool: "list_dir", line: "list with list_dir, never ls" },
+    { tool: "shell", line: "shell for what the file tools cannot do: commands, git, the network, the system" },
+];

package/dist/create-coding-agent.d.ts

@@ -0,0 +1,30 @@
+/**
+ * kiso-code's composition root — the product's choices (trust, config,
+ * credentials, the coding tools, the built-in and loaded extensions, the
+ * coding prompt, the mode tiers) bound into ONE AgentDefinition and handed
+ * to runtime.createAgent(): the one door every agent goes through.
+ *
+ * Moved verbatim from index.ts's makeAgent (R1, 2026-09-23) and renamed;
+ * the body is not edited beyond the rename and activeStoreDir's setter.
+ */
+import { type LineInput } from "./state.js";
+import { type ContextPolicy } from "@vincemakes/kiso-runtime";
+/**
+ * E6: the run-start context policy, OFF unless env-armed (invalid values
+ * are ABSENT, never a crash — the autoCompactFromEnv convention).
+ * The product arming is KISO_CONTEXT_WINDOW → window − POLICY_RESERVE
+ * (the window rides the config as windowTokens; the runtime owns the
+ * arithmetic — never a fixed low absolute). KISO_POLICY_SUMMARY_TRIGGER
+ * survives ONLY as the legacy absolute override when no window is set
+ * (bench back-compat); the window wins when both are set.
+ * KISO_POLICY_SUMMARY_KEEP (rounds) and KISO_POLICY_SUMMARY_KEEP_TOKENS
+ * override the runtime defaults (KEEP_RECENT_ROUNDS = 4,
+ * KEEP_TOKENS_DEFAULT = 20,000) — emitted only when set.
+ * KISO_POLICY_SUMMARY_MAX_FAILURES overrides the (h) circuit-breaker
+ * default (MAX_SUMMARY_FAILURES = 3).
+ * KISO_POLICY_DROP=1 switches the armed mode to the crux C arm
+ * (mechanical drop — same trigger/keep envs); KISO_POLICY_MICROCOMPACT
+ * arms the session-aware override (MIN_TURNS = the no-fire guard).
+ */
+export declare function contextPolicyFromEnv(): ContextPolicy | undefined;
+export declare function createCodingAgent(sessionId: string | undefined, input?: LineInput, modelFlag?: string): Promise<import("@vincemakes/kiso-runtime").AgentRuntime>;

package/dist/create-coding-agent.js

@@ -0,0 +1,350 @@
+/**
+ * kiso-code's composition root — the product's choices (trust, config,
+ * credentials, the coding tools, the built-in and loaded extensions, the
+ * coding prompt, the mode tiers) bound into ONE AgentDefinition and handed
+ * to runtime.createAgent(): the one door every agent goes through.
+ *
+ * Moved verbatim from index.ts's makeAgent (R1, 2026-09-23) and renamed;
+ * the body is not edited beyond the rename and activeStoreDir's setter.
+ */
+import { activeStoreDir, setActiveStoreDir, body, bodyLog, codingToolOptions, extensionsDir, floorOn, kisoHome, loadedExtensions, ownSessionsDir, projectRoot, protectedFiles, secretEnvNamesOf, sessionsDir, setAgentModel, setConfigModels, setConfiguredWindow, setCurrentAgentExtensions, setCurrentFaux, setCurrentModelName, setCurrentProfileName, setExtensionLists, setFloorOn, setMergedConfig, setModelChoice, setNeverInherited, setRetryShown, setSessionStore, setUserProtectedPaths, settingsLayers, workspaceRoot } from "./state.js";
+import { claimProjectDir, projectLayoutActive } from "./projects.js";
+import { migrationNotice, pendingLegacyIds, planMigration, runMigration } from "./session-migration.js";
+import { askUi, resolveProjectTrust } from "./trust-ui.js";
+import { isFirstRun, scaffoldFirstRun } from "./first-run.js";
+import { fauxSkip, readFauxScript } from "./faux-glue.js";
+import { loadProjectConfig, loadUserConfig, mergeConfigs, resolveContextWindow, resolveModel } from "./config.js";
+import { builtInLayer } from "./builtin.js";
+import { recordLearnedWindow, useLearnedWindows } from "./learned-windows.js";
+import { compactionDiscardedNotice, contextWindowTokens, knownContextWindow, unknownWindowNotice, windowLearnedNotice } from "./chat.js";
+import {} from "@vincemakes/kiso-core";
+import { guardSavedAllow, isProtectedWrite } from "./protected-writes.js";
+import { floorExtension, isDestructiveCall } from "./floor.js";
+import { protectedShellExtension } from "./protected-shell.js";
+import { homedir } from "node:os";
+import { breakerExtension } from "./breaker.js";
+import { modeExtensions, modeSystemPrompt } from "./mode.js";
+import { readOnlyShellExtension } from "./readonly-shell.js";
+import { maxRetriesFromEnv } from "./retries.js";
+import { createCodingTools } from "@vincemakes/kiso-tools-node";
+import { runsACheck } from "@vincemakes/kiso-runtime/internal";
+import { providerHost } from "./provider-label.js";
+import { adapterOptionsFor } from "./auth/adapter-options.js";
+import { createFauxProvider } from "@vincemakes/kiso-evals";
+import { sweepStaleMergeDirs } from "./temp-sweep.js";
+import { CODING_TOOL_RULES, composeSystemPrompt } from "./coding-prompt.js";
+import { createAgent, loadExtensions, loadProjectExtensions, SessionStore } from "@vincemakes/kiso-runtime";
+/** LT-1: the stream watchdog's bound from the environment — a non-negative
+ *  number of milliseconds (0 disables it); anything else is ignored. The
+ *  PTY rigs use it to trip the watchdog in seconds against a stub that
+ *  never finishes a stream. */
+function streamIdleFromEnv() {
+    const raw = process.env.KISO_STREAM_IDLE_MS;
+    if (raw === undefined || raw === "")
+        return undefined;
+    const n = Number(raw);
+    return Number.isFinite(n) && n >= 0 ? n : undefined;
+}
+/**
+ * E6: the run-start context policy, OFF unless env-armed (invalid values
+ * are ABSENT, never a crash — the autoCompactFromEnv convention).
+ * The product arming is KISO_CONTEXT_WINDOW → window − POLICY_RESERVE
+ * (the window rides the config as windowTokens; the runtime owns the
+ * arithmetic — never a fixed low absolute). KISO_POLICY_SUMMARY_TRIGGER
+ * survives ONLY as the legacy absolute override when no window is set
+ * (bench back-compat); the window wins when both are set.
+ * KISO_POLICY_SUMMARY_KEEP (rounds) and KISO_POLICY_SUMMARY_KEEP_TOKENS
+ * override the runtime defaults (KEEP_RECENT_ROUNDS = 4,
+ * KEEP_TOKENS_DEFAULT = 20,000) — emitted only when set.
+ * KISO_POLICY_SUMMARY_MAX_FAILURES overrides the (h) circuit-breaker
+ * default (MAX_SUMMARY_FAILURES = 3).
+ * KISO_POLICY_DROP=1 switches the armed mode to the crux C arm
+ * (mechanical drop — same trigger/keep envs); KISO_POLICY_MICROCOMPACT
+ * arms the session-aware override (MIN_TURNS = the no-fire guard).
+ */
+export function contextPolicyFromEnv() {
+    const summaryTrigger = positiveIntEnv("KISO_POLICY_SUMMARY_TRIGGER");
+    const contextWindow = positiveIntEnv("KISO_CONTEXT_WINDOW");
+    const microcompactTrigger = positiveIntEnv("KISO_POLICY_MICROCOMPACT");
+    if (summaryTrigger === undefined && contextWindow === undefined && microcompactTrigger === undefined)
+        return undefined;
+    return {
+        ...(summaryTrigger === undefined && contextWindow === undefined ? {} : {
+            [(process.env.KISO_POLICY_DROP === "1" ? "drop" : "summary")]: {
+                ...(contextWindow !== undefined ? { windowTokens: contextWindow } : summaryTrigger !== undefined ? { triggerTokens: summaryTrigger } : {}),
+                ...kv("keepRounds", "KISO_POLICY_SUMMARY_KEEP"),
+                ...kv("keepTokens", "KISO_POLICY_SUMMARY_KEEP_TOKENS"),
+                ...kv("maxFailures", "KISO_POLICY_SUMMARY_MAX_FAILURES"),
+            },
+        }),
+        ...(microcompactTrigger !== undefined ? { microcompact: { thresholdTokens: microcompactTrigger, ...kv("keepResults", "KISO_POLICY_MICROCOMPACT_KEEP"), ...kv("minTurns", "KISO_POLICY_MICROCOMPACT_MIN_TURNS") } } : {}),
+    };
+}
+/** { [key]: value } when the env int is set — the spread-friendly optional field. */
+function kv(key, env) {
+    const v = positiveIntEnv(env);
+    return v !== undefined ? { [key]: v } : {};
+}
+/** Parse a positive-int env var — absent or invalid is undefined (no crash). */
+function positiveIntEnv(name) {
+    const n = Number.parseInt(process.env[name] ?? "", 10);
+    return Number.isFinite(n) && n > 0 ? n : undefined;
+}
+/**
+ * 0.40.0 — before any session opens: the one-time move of the legacy
+ * folder into project folders (announced once, with the undo), then this
+ * project's folder claimed. Nothing happens under a pinned folder or after
+ * a reversed migration.
+ */
+function prepareSessionFolders() {
+    const home = kisoHome();
+    if (!projectLayoutActive(home))
+        return;
+    if (pendingLegacyIds(home).length > 0) {
+        const result = runMigration(home, planMigration(home));
+        if (result !== null && result.moved > 0) {
+            const line = migrationNotice(result);
+            if (process.stdout.isTTY)
+                bodyLog(line);
+            else
+                process.stderr.write(`${line}\n`);
+        }
+    }
+    claimProjectDir(ownSessionsDir(), projectRoot());
+}
+/** 0.40.7: the stale-merge-directory sweep runs once per process. */
+let tempSwept = false;
+/** Said once per process: the window is unknown, so no ctx gauge. */
+let unknownWindowNoticed = false;
+export async function createCodingAgent(sessionId, input, modelFlag) {
+    // §2.5: the ONE source a reload reads for the model, seeded here from
+    // the startup flag. Without this a session started with `--model X`
+    // would silently revert to the env/config default on its first reload.
+    if (modelFlag !== undefined)
+        setModelChoice(modelFlag);
+    // E3: the project-level trust gate runs BEFORE any extension load (the
+    // mcp/skills merges must be in the env when the user-level extensions
+    // load). Untrusted project capability is never loaded — never silently.
+    const project = input !== undefined ? await resolveProjectTrust(input) : await resolveProjectTrust(undefined);
+    // R-D 0.1.45 (deliverable B): the first-run scaffold lands AFTER the
+    // verdict — pre-trust zero-read/write/scan is absolute. The sessions
+    // dir (SessionStore's constructor mkdirs) moved behind the gate too:
+    // the trust record is the first home write, the scaffold the second.
+    if (isFirstRun())
+        scaffoldFirstRun();
+    // 0.40.0 — one folder per project: the one-time move of the legacy
+    // folder, then this project's folder claimed (made, its workspace
+    // recorded). Both write, so both sit behind the verdict, with the store.
+    prepareSessionFolders();
+    setActiveStoreDir(sessionsDir());
+    const store = new SessionStore(activeStoreDir);
+    // TUI2-R2 ②/③: the navigation surfaces read through THIS store — one
+    // store per process, and the picker/listing never write through it.
+    setSessionStore(store);
+    // E area: the durable script position — computed AFTER the verdict
+    // (fauxSkip's session-log read is a home read: pre-trust zero-read).
+    const fauxSkipTurns = sessionId === undefined ? 0 : fauxSkip(sessionId);
+    // E1: the startup extension scan — a broken extension fails the process
+    // LOUDLY here (loadExtensions throws), never silently.
+    const user = await loadExtensions(extensionsDir());
+    const proj = project !== null ? await loadProjectExtensions(process.cwd(), user) : [];
+    // R-D 0.1.45: the built-in layer registers by module import (builtin.ts)
+    // — a user extension may shadow a built-in, a project one may not.
+    // KC3.5: built-in #4 (ask) registers ONLY where a human can answer —
+    // the panel bridge is the argument, and a non-TTY session has none to
+    // give. A piped run's composed tool table therefore cannot contain
+    // ask_user (T-Q3: the bench's structural byte-identity proof).
+    // Astra F7: the config is READ here — a pure read, its setters still run
+    // below with the rest of merge round B — because the mcp extension spawns
+    // its stdio children while it is being constructed, and the strip needs
+    // the configured secret names by then.
+    const userCfg = loadUserConfig();
+    const projectCfg = loadProjectConfig(process.cwd(), project !== null);
+    const merged = mergeConfigs(userCfg, projectCfg);
+    // 0.40.6: /settings names each value's layer from these
+    settingsLayers.user = userCfg;
+    settingsLayers.project = projectCfg;
+    settingsLayers.modelFlag = modelFlag;
+    const secretEnvNames = secretEnvNamesOf(merged.models ?? {});
+    const builtIn = await builtInLayer(user, proj, input !== undefined && process.stdin.isTTY ? askUi(input) : undefined, secretEnvNames);
+    setExtensionLists(builtIn, user, proj, [...builtIn, ...user, ...proj]);
+    // merge round B — the config surface: user config + (trusted) project config,
+    // resolved with flags > env > project > user > default. The CLI never
+    // imports provider SDKs directly — the runtime's lazy provider
+    // resolution owns them (a config profile only ever NAMES an env var for
+    // its key; the key itself never sits in a config file).
+    setMergedConfig(merged);
+    // DT-1a: what a delegated task may NAME — the configured checks and the
+    // model profiles — handed to the (in-process) subagent extension through
+    // the environment. A model never supplies a command; it names a check.
+    // 0.40.0: and the folder this process keeps its sessions in — a child
+    // writes beside its parent, whatever directory it runs in. Through this
+    // channel and not an exported KISO_SESSIONS_DIR: a variable in
+    // process.env would reach every shell child, and a kiso started from a
+    // shell tool would then write into this project's folder.
+    process.env.KISO_DELEGATION_CONFIG_JSON = JSON.stringify({ checks: merged.checks ?? {}, evaluators: merged.evaluators ?? [], profiles: Object.keys(merged.models ?? {}), sessionsDir: sessionsDir() });
+    setConfigModels(merged.models ?? {});
+    // CW-1 batch 2: the windows endpoints stated by refusing — read before the
+    // first window is asked for (the unknown-window notice below).
+    useLearnedWindows();
+    // 0.40.7: the merge directories a killed kiso left in the temp dir —
+    // once per process, never this process's own (temp-sweep.ts)
+    if (!tempSwept) {
+        tempSwept = true;
+        sweepStaleMergeDirs();
+    }
+    const resolved = resolveModel(modelFlag, merged);
+    // AFTER the model resolves: the window a PROFILE states is about that
+    // profile's model, so it cannot be read before we know which profile is
+    // selected. Reading it a line too early is how the compaction threshold
+    // ended up frozen at the wrong model's value (CTX-1).
+    setConfiguredWindow(resolveContextWindow(merged, resolved?.profile));
+    const model = resolved === null ? "faux" : resolved.profile.model;
+    if (resolved === null) {
+        console.log("[faux mode — set ANTHROPIC_API_KEY or OPENAI_API_KEY, or configure models in ~/.kiso/config.json]\n");
+        setCurrentFaux(true);
+        setCurrentModelName("faux");
+        setCurrentProfileName(null);
+    }
+    else {
+        setCurrentFaux(false);
+        setCurrentModelName(resolved.name);
+        setCurrentProfileName(resolved.name);
+    }
+    setAgentModel(model, resolved?.profile.baseUrl); // v2b: the status bar shows it; OR-1: the endpoint rides along
+    // ADR-0055 Amendment 2: the row says `ctx ?` for an unstated window, but
+    // the tiers still need a number and assume the fallback — say so, once,
+    // at build.
+    if (!unknownWindowNoticed && knownContextWindow() === null) {
+        unknownWindowNoticed = true;
+        console.error(unknownWindowNotice(model));
+    }
+    // W21: the extensions array is built ONCE per agent and shared with
+    // the runtime by reference — the don't-ask-again writer pushes the
+    // generated extension into it so a first-time rule joins the chain
+    // at the NEXT run (the run's policies are fixed at its start; run.ts
+    // re-reads the config's extensions array per run).
+    // LT-2: the loop breaker at the chain HEAD — it speaks first when it speaks,
+    // so `decidedBy` names it; a deny there beats every tier, bypass included.
+    // 0.40.0: the read-only shell allow sits after the tiers — an allow from
+    // it outranks a tier's ask and names itself in decidedBy.
+    // 0.40.0: a saved allow never carries a write into .git/ or .kiso/, nor
+    // a destructive shell command.
+    const workspaceRoot = () => codingToolOptions().workspaceRoot;
+    const neverInherited = (call) => isProtectedWrite(call, workspaceRoot()) || isDestructiveCall(call);
+    setNeverInherited(neverInherited);
+    // 0.40.0: the catastrophe floor, at the chain's HEAD — a deny there
+    // names itself in decidedBy and outranks every tier, bypass included.
+    // Read per agent, so /reload picks up an edited user config.
+    const userConfig = loadUserConfig();
+    setFloorOn(userConfig?.floor !== "off");
+    // kiso never serves its own credential store to a model: the file tools
+    // refuse it through codingToolOptions, and this member denies a shell
+    // line naming it — at the HEAD with the floor, in every mode, and NOT
+    // switched off with it (`floor: "off"` lowers the catastrophe floor,
+    // never this).
+    setUserProtectedPaths(userConfig?.protectedPaths);
+    const extensions = [
+        protectedShellExtension({ files: protectedFiles, workspaceRoot, env: () => ({ home: homedir(), kisoHome: kisoHome() }) }),
+        floorExtension(() => floorOn, workspaceRoot),
+        breakerExtension(),
+        ...modeExtensions(workspaceRoot),
+        readOnlyShellExtension(codingToolOptions),
+        ...loadedExtensions.map((e) => guardSavedAllow(e, neverInherited)),
+    ];
+    setCurrentAgentExtensions(extensions);
+    // E6: the run-start context policy (captured once — exactOptionalPropertyTypes).
+    const contextPolicy = contextPolicyFromEnv();
+    const idleFromEnv = streamIdleFromEnv(); // read once: a narrowed const, not a call per spread
+    const retriesFromEnv = maxRetriesFromEnv();
+    const definition = {
+        model,
+        store,
+        // 0.40.0: a NEW session records where it started; the picker scopes by
+        // it. The profile name is recorded only when the model came from a
+        // config profile — a direct provider/model or an env key names none.
+        workspace: workspaceRoot(),
+        ...(resolved !== null && merged.models?.[resolved.name] === resolved.profile ? { profileName: resolved.name } : {}),
+        // Area 5: the coding tools are bound to the workspace — every path
+        // they touch is canonicalized inside cwd, escapes are refused.
+        tools: [...createCodingTools(codingToolOptions())], // DC-49 — the options live in state.ts, shared with the `!` command's runner
+        toolRules: CODING_TOOL_RULES, // R1: the product's rows, in the runtime's table
+        // Modes: the five tiers ride the E1 policy chain (mode:<tier>
+        // extensions, current tier first) — the old static PERMISSION_POLICY
+        // is gone, its semantics live in the "default" tier. The banner
+        // still counts loadedExtensions only — the modes are in-process,
+        // never a file extension.
+        systemPrompt: (() => {
+            const sp = composeSystemPrompt(process.cwd(), protectedFiles());
+            const extra = modeSystemPrompt();
+            return extra === undefined ? sp : `${sp}\n\n${extra}`;
+        })(),
+        // ADR-0055 Amendment 1 (A1b): compaction is ON by default and runs
+        // INSIDE a run, by tiers drawn from the model's window (CTX-1: the
+        // binding step moves the window with /model and /resume). The
+        // standing microcompact at half the window is gone (A4). Phase rule
+        // 1 reads the user's configured checks first, then the runner table.
+        contextPolicy: {
+            ...(contextPolicy ?? {}),
+            tiers: {
+                windowTokens: contextWindowTokens(),
+                isCheck: (command) => runsACheck(command, Object.values(merged.checks ?? {})),
+                // ADR-0055 Amendment 2: a discarded checkpoint says so, in sizes only.
+                onDiscard: (d) => body.notice(compactionDiscardedNotice(d)),
+                // ADR-0055 Amendment 2 (decision 3): only a window someone stated
+                // arms the overflow belt — read from the LIVE binding, so it moves
+                // with /model and /resume; the fallback reads as null.
+                statedWindow: () => knownContextWindow(),
+                // CW-1 batch 2: an endpoint's refusal stated its cap. The tiers
+                // took it already; kept, it is where the next session starts, and
+                // the status row's denominator moves with it. Said once per new
+                // figure — a refusal at a cap already kept says nothing.
+                onWindowLearned: (w) => {
+                    if (recordLearnedWindow(w.model, w.baseUrl, w.tokens))
+                        body.notice(windowLearnedNotice(w.model, providerHost(w.baseUrl) ?? "", w.tokens));
+                },
+            },
+        },
+        // R3e (owner ruling, 2026-08-28): NO turn limit on an interactive
+        // session. This was `maxTurns: 20`, hardcoded on 2026-08-03 with no
+        // stated reason and no way to change it — and it was the thing that
+        // stopped a real 43-call session dead, mid-task, in silence. The
+        // field survives for the callers that want a bound (subagents, the
+        // SDK, `kiso run`); the interactive front door does not set one.
+        // Modes: the five tiers join at the CHAIN HEAD, before the user/
+        // project extensions (the deny>allow>ask composition keeps a user
+        // deny winning over any mode tier — bypass included).
+        extensions,
+        ...(resolved !== null
+            ? {
+                provider: resolved.profile.kind,
+                // Astra F1 (P0): the wire config is built in ONE place
+                // (auth/adapter-options.ts) — credential shape, the ALWAYS
+                // EXPLICIT endpoint, the session's cache key and the
+                // profile's caching flag. This site and the `/model` site
+                // were the same spread written twice.
+                ...adapterOptionsFor(resolved.profile, resolved.oauthProviderId !== undefined
+                    ? { type: "oauth", providerId: resolved.oauthProviderId }
+                    : { type: "api-key", apiKey: resolved.apiKey ?? "none" }, sessionId),
+                // LT-1: the profile's stream watchdog bound, if it states one.
+                // NOT an adapter option — an agent-definition field the
+                // runtime reads — so it stays here rather than moving into
+                // adapterOptionsFor.
+                ...(resolved.profile.streamIdleMs !== undefined ? { streamIdleMs: resolved.profile.streamIdleMs } : {}),
+            }
+            : { adapter: createFauxProvider(readFauxScript().slice(fauxSkipTurns)) }),
+        // LT-1: KISO_STREAM_IDLE_MS (the test rigs' knob) beats the profile —
+        // the last spread wins, which is why it sits after the profile's.
+        ...(idleFromEnv !== undefined ? { streamIdleMs: idleFromEnv } : {}),
+        ...(retriesFromEnv !== undefined ? { maxRetries: retriesFromEnv } : {}),
+        // ADR-0005 Amendment 2: the kernel announces each retry before its
+        // wait; the running row shows it. Composed with every extension's
+        // hooks by the runtime — an extension observing retries too is heard.
+        hooks: {
+            onRetry: async (info) => {
+                setRetryShown({ attempt: info.attempt, maxRetries: info.maxRetries, code: info.code, until: Date.now() + info.delayMs });
+            },
+        },
+    };
+    return createAgent(definition);
+}

package/dist/index.d.ts

@@ -21,53 +21,12 @@
  * resume.ts, trust-ui.ts (the question surface + E3 merges), faux-glue.ts
  * (the scripted-model plumbing), state.ts (the shared process state).
  * index.ts keeps the entry: banner, input sources, the A area prompt,
- * makeAgent, and main.
+ * createCodingAgent, and main.
  */
-import { type ContextPolicy } from "@vincemakes/kiso-runtime";
 import { type SessionRoute } from "./projects.js";
+export { contextPolicyFromEnv } from "./create-coding-agent.js";
+export { SYSTEM_PROMPT, composeSystemPrompt, readProjectInstructions } from "./coding-prompt.js";
 export { applyProjectMerges } from "./trust-ui.js";
-/**
- * A area: the coding-agent system prompt — ONE constant, byte-stable for the
- * session's lifetime (D area). Kept under ~80 lines; no template engine.
- */
-/** The built-in prompt. Exported for scripts/request-surface.mjs — the
- *  model-side token-rent counter measures the REAL bytes, never a copy. */
-export declare const SYSTEM_PROMPT = "You are kiso, a coding agent. You work in a workspace\ndirectory and change code with tools. Be concise: answer in a few lines\nunless the task genuinely needs more. Never claim a file was changed\nunless a tool confirmed it.\n\nWhat you can reach:\n- The workspace: read_file, list_dir, search_text, write_file, edit_file.\n- This machine and the network: shell \u2014 builds, tests, git, package\n  managers, curl for HTTP, system queries. A request one command can\n  answer is answered by running it.\n- The human: ask_user, for a decision that is theirs.\n\nTool discipline:\n- READ BEFORE YOU EDIT. For any file you are about to change, read it\n  first \u2014 never guess its content.\n- Use edit_file for targeted changes and write_file for full rewrites.\n  Prefer many small edits over one large write.\n- Be careful \u2014 shell has side effects and may take time.\n- search_text and list_dir are cheap \u2014 locate first, then read ranges\n  with read_file offset/limit; never read a whole large file in one call.\n- Do not re-read a file you already read unchanged, or one you changed\n  yourself through a confirmed edit \u2014 rely on the earlier result and\n  on the change you just made.\n- When a tool fails, read the error and adjust; do not repeat the same\n  call blindly.\n\nAn authorization covers what it NAMES: when the scope is not named \u2014\nwhich files, which branches, whether to push \u2014 ask before acting.\nDelivering, sharing or handing over changes means committing locally and\nstopping; pushing, publishing or sending happens only when the human\nnames it.\n\nWorkflow: understand the request, find the relevant code, make the\nsmallest change that works, then verify with a command (tests/build).\nReport what you did in one or two lines per change.";
-/** Hard cap for injected instructions — truncate and say so. */
-/**
- * A area: read the FIRST present instruction file (AGENTS.md preferred) and
- * return it as an injected section, or "" when none exists. Truncated at
- * 8KB with an explicit note. Pure — read once per session, so the prompt
- * is byte-stable for the session's lifetime.
- *
- * kiso never serves its own credential store to a model, and this read is
- * the one that needs no model at all: a cloned repository whose AGENTS.md
- * is a symlink to the store would put it in the SYSTEM PROMPT of every
- * request, with no tool call and no trust prompt. A file that resolves to
- * a protected one is skipped as though absent.
- */
-export declare function readProjectInstructions(cwd: string, protectedFiles?: readonly string[]): string;
-/** A area: the session's system prompt — the constant plus any project
- *  instructions found in the workspace. Deterministic per cwd. */
-export declare function composeSystemPrompt(cwd: string, protectedFiles?: readonly string[]): string;
-/**
- * E6: the run-start context policy, OFF unless env-armed (invalid values
- * are ABSENT, never a crash — the autoCompactFromEnv convention).
- * The product arming is KISO_CONTEXT_WINDOW → window − POLICY_RESERVE
- * (the window rides the config as windowTokens; the runtime owns the
- * arithmetic — never a fixed low absolute). KISO_POLICY_SUMMARY_TRIGGER
- * survives ONLY as the legacy absolute override when no window is set
- * (bench back-compat); the window wins when both are set.
- * KISO_POLICY_SUMMARY_KEEP (rounds) and KISO_POLICY_SUMMARY_KEEP_TOKENS
- * override the runtime defaults (KEEP_RECENT_ROUNDS = 4,
- * KEEP_TOKENS_DEFAULT = 20,000) — emitted only when set.
- * KISO_POLICY_SUMMARY_MAX_FAILURES overrides the (h) circuit-breaker
- * default (MAX_SUMMARY_FAILURES = 3).
- * KISO_POLICY_DROP=1 switches the armed mode to the crux C arm
- * (mechanical drop — same trigger/keep envs); KISO_POLICY_MICROCOMPACT
- * arms the session-aware override (MIN_TURNS = the no-fire guard).
- */
-export declare function contextPolicyFromEnv(): ContextPolicy | undefined;
 export { workspaceRoot } from "./state.js";
 /**
  * 0.40.0 (the owner's dogfood: a uooki session resumed from flowpix2) —