@vincemakes/kiso-code 0.46.1 → 0.47.0

package/dist/config.js

@@ -153,6 +153,10 @@ export function parseConfig(text, source) {
         out.model = obj.model;
     }
     if (obj.models !== undefined) {
+        // 0.46.2: a profile names where requests go and which of the
+        // person's env vars is the key — a repository must never choose that
+        if (source.startsWith("<cwd>"))
+            fail("models", 'belongs in the USER config — a project may pick one of your profiles with "model", never define one');
         if (obj.models === null || typeof obj.models !== "object" || Array.isArray(obj.models))
             fail("models", "expected an object of profiles");
         const models = {};
@@ -261,15 +265,43 @@ export function loadProjectConfig(cwd, trusted) {
         return null;
     return readConfigFile(join(cwd, ".kiso", "config.json"), "<cwd>/.kiso/config.json");
 }
-/** Merge: project wins over user (each layer's own keys only). */
+/** 0.46.2 — how much a tier lets run without a person, strictest first;
+ *  `manual` sits with `default` (both ask). */
+const MODE_LOOSENESS = { plan: 0, manual: 1, default: 1, "accept-edits": 2, "full-access": 3 };
+/**
+ * 0.46.2 — a repository's config may only make kiso STRICTER. A project
+ * mode looser than the user level (the user config's mode, else
+ * `default`) is refused, and a project may turn don't-ask on but never off
+ * — including the switch the old `dontAsk` mode spelling carries. Flags
+ * and env are the person's own choice and are not judged here.
+ */
+function assertProjectTightens(u, p) {
+    const where = "config <cwd>/.kiso/config.json";
+    const base = parseMode(u.mode ?? "default");
+    const proj = p.mode !== undefined ? parseMode(p.mode) : undefined;
+    if (proj !== undefined && base !== undefined && MODE_LOOSENESS[proj.mode] > MODE_LOOSENESS[base.mode]) {
+        const than = u.mode !== undefined ? `your config's "${u.mode}"` : "the default";
+        throw new ConfigError(`${where}: mode — "${p.mode}" is looser than ${than}: a project can make the mode stricter, never looser`);
+    }
+    if (p.dontAsk === false) {
+        throw new ConfigError(`${where}: dontAsk — a project can turn don't-ask on, never off`);
+    }
+    if (base?.dontAsk === true && proj !== undefined && proj.dontAsk !== true && p.dontAsk !== true) {
+        throw new ConfigError(`${where}: mode — "${p.mode}" would turn off the don't-ask switch your config's "${u.mode}" carries: a project can turn don't-ask on, never off`);
+    }
+}
+/** Merge: a project's keys win over the user's (each layer's own keys
+ *  only) — except that a project may only tighten (assertProjectTightens). */
 export function mergeConfigs(user, project) {
     const u = user ?? {};
     const p = project ?? {};
+    assertProjectTightens(u, p);
     return {
         ...(u.model !== undefined ? { model: u.model } : {}),
         ...(p.model !== undefined ? { model: p.model } : {}),
+        // 0.46.2: profiles come from the user config only — parseConfig
+        // refuses a project's `models`, so there is nothing here to merge
         ...(u.models !== undefined ? { models: u.models } : {}),
-        ...(p.models !== undefined ? { models: { ...u.models, ...p.models } } : u.models !== undefined ? { models: u.models } : {}),
         ...(u.mode !== undefined ? { mode: u.mode } : {}),
         ...(p.mode !== undefined ? { mode: p.mode } : {}),
         ...(u.dontAsk !== undefined ? { dontAsk: u.dontAsk } : {}),
@@ -521,8 +553,11 @@ export function resolveAutoCompact(merged) {
     }
     return merged.autoCompact;
 }
-/** Project-trust policy: config.projectTrust (project wins over user) —
- *  "ask" (the E3 gate, default) or "never" (the gate auto-refuses). */
+/** Project-trust policy: the USER config's projectTrust — "ask" (the E3
+ *  gate, default) or "never" (the gate auto-refuses). The gate passes
+ *  loadUserConfig() alone (trust-ui.ts): a project never relaxes its own
+ *  gate, and it could not anyway, since an untrusted project's config is
+ *  never read. */
 export function resolveProjectTrustPolicy(merged) {
     return merged.projectTrust ?? "ask";
 }

package/dist/create-coding-agent.js

@@ -7,7 +7,8 @@
  * Moved verbatim from index.ts's makeAgent (R1, 2026-09-23) and renamed;
  * the body is not edited beyond the rename and activeStoreDir's setter.
  */
-import { activeStoreDir, childTurnBudget, setActiveStoreDir, body, bodyLog, codingToolOptions, extensionsDir, floorOn, kisoHome, loadedExtensions, ownSessionsDir, projectRoot, protectedFiles, secretEnvNamesOf, sessionsDir, setAgentModel, setConfigModels, setConfiguredWindow, setCurrentAgentExtensions, setCurrentFaux, setCurrentModelName, setCurrentProfileName, setExtensionLists, setFloorOn, setMergedConfig, setModelChoice, setNeverInherited, setRetryShown, setSessionStore, setUserProtectedPaths, settingsLayers, workspaceRoot } from "./state.js";
+import { onInRunSummary } from "./in-run-compaction.js";
+import { activeStoreDir, childTurnBudget, setActiveStoreDir, body, bodyLog, dock, codingToolOptions, extensionsDir, floorOn, kisoHome, loadedExtensions, ownSessionsDir, projectRoot, protectedFiles, secretEnvNamesOf, sessionsDir, setAgentModel, setConfigModels, setConfiguredWindow, setCurrentAgentExtensions, setCurrentFaux, setCurrentModelName, setCurrentProfileName, setExtensionLists, setFloorOn, setMergedConfig, setModelChoice, setNeverInherited, setRetryShown, setSessionStore, setUserProtectedPaths, settingsLayers, workspaceRoot } from "./state.js";
 import { claimProjectDir, projectLayoutActive } from "./projects.js";
 import { migrationNotice, pendingLegacyIds, planMigration, runMigration } from "./session-migration.js";
 import { askUi, resolveProjectTrust } from "./trust-ui.js";
@@ -18,8 +19,8 @@ import { builtInLayer } from "./builtin.js";
 import { recordLearnedWindow, useLearnedWindows } from "./learned-windows.js";
 import { compactionDiscardedNotice, contextWindowTokens, knownContextWindow, unknownWindowNotice, windowLearnedNotice } from "./chat.js";
 import {} from "@vincemakes/kiso-core";
-import { guardSavedAllow, isProtectedWrite } from "./protected-writes.js";
-import { floorExtension, isDestructiveCall } from "./floor.js";
+import { guardSavedAllow, neverInheritedCall } from "./protected-writes.js";
+import { floorExtension } from "./floor.js";
 import { protectedShellExtension } from "./protected-shell.js";
 import { homedir } from "node:os";
 import { breakerExtension } from "./breaker.js";
@@ -202,7 +203,12 @@ export async function createCodingAgent(sessionId, input, modelFlag) {
     setConfiguredWindow(resolveContextWindow(merged, resolved?.profile));
     const model = resolved === null ? "faux" : resolved.profile.model;
     if (resolved === null) {
-        console.log("[faux mode — set ANTHROPIC_API_KEY or OPENAI_API_KEY, or configure models in ~/.kiso/config.json]\n");
+        // the last sweep (owner, 2026-10-06): on a dock this line was written
+        // into the frame and painted over at once — the opening's MODEL row
+        // says it instead (opening.ts). A pipe, and -p, keep it.
+        if (!dock.active) {
+            console.log("[faux mode — set ANTHROPIC_API_KEY or OPENAI_API_KEY, or configure models in ~/.kiso/config.json]\n");
+        }
         setCurrentFaux(true);
         setCurrentModelName("faux");
         setCurrentProfileName(null);
@@ -230,9 +236,10 @@ export async function createCodingAgent(sessionId, input, modelFlag) {
     // 0.40.0: the read-only shell allow sits after the tiers — an allow from
     // it outranks a tier's ask and names itself in decidedBy.
     // 0.40.0: a saved allow never carries a write into .git/ or .kiso/, nor
-    // a destructive shell command.
+    // a destructive shell command; 0.46.2: nor a command across the remote
+    // boundary (remote-boundary.ts).
     const workspaceRoot = () => codingToolOptions().workspaceRoot;
-    const neverInherited = (call) => isProtectedWrite(call, workspaceRoot()) || isDestructiveCall(call);
+    const neverInherited = (call) => neverInheritedCall(call, workspaceRoot());
     setNeverInherited(neverInherited);
     // 0.40.0: the catastrophe floor, at the chain's HEAD — a deny there
     // names itself in decidedBy and outranks every tier, bypass included.
@@ -301,6 +308,9 @@ export async function createCodingAgent(sessionId, input, modelFlag) {
                 isCheck: (command) => runsACheck(command, Object.values(merged.checks ?? {})),
                 // ADR-0055 Amendment 2: a discarded checkpoint says so, in sizes only.
                 onDiscard: (d) => body.notice(compactionDiscardedNotice(d)),
+                // the compaction round (owner, 2026-10-06): a summary inside a run
+                // is drawn while it runs — the running row reads it
+                onSummary: onInRunSummary,
                 // ADR-0055 Amendment 2 (decision 3): only a window someone stated
                 // arms the overflow belt — read from the LIVE binding, so it moves
                 // with /model and /resume; the fallback reads as null.

package/dist/dispatch.d.ts

@@ -69,4 +69,6 @@ export declare function parseBang(trimmed: string): {
     readonly command: string;
     readonly send: boolean;
 } | null;
+export declare function markCompactWhy(why: string): void;
+export declare function markAutoCompact(): void;
 export declare function dispatch(line: string, ctx: DispatchCtx): void;