kiokuko-dsh 0.2.1 → 0.2.2

package/docs/model-selection.ja.md

@@ -12,7 +12,9 @@ DSHの権限判定、必要な検証を維持し、役小角の契約・WorkUnit
 
 ## 通常実行のモデル自動選択
 
-通常版・modular coreとも `modelAutoMode.mode: off` が既定です。同じDSHプロファイルにdsh-codexを登録して認証し、JevかLayaの判定を準備したうえで、まず `observe` で選択案を確認します。
+Webプロファイルでは [Kiokuko Models](kiokuko-models.md) から接続を設定できます。DSH本体のModelsで設定する必要はありません。登録したモデルは、通常会話・Enno・Deepでネイティブ接続と併用できます。
+
+通常版・modular coreとも `modelAutoMode.mode: off` が既定です。同じDSHプロファイルでKiokuko Modelsまたはdsh-codexからCodexを認証し、JevかLayaの判定を準備したうえで、まず `observe` で選択案を確認します。
 
 ```yaml
 modelAutoMode:
@@ -30,7 +32,7 @@ modelAutoMode:
 
 コマンドは現在のnativeセッションだけを変更します。`on` は手動のモデル指定も解除します。DSHのpickerでモデルを手動選択すると、同じセッションで `on` を再実行するまで手動指定が優先します。変更は次の新しいタスクから反映し、送信済みの要求を途中で切り替えません。`/kioku-decisions status` にも同じ状態を表示します。設定を `off` に変更してDSHを再起動すれば、保存済みのセッション指定も無効になります。
 
-初期候補は `gpt-6-luna` の low・medium・high と `gpt-6-sol` の high です。`modelAutoMode.routes` には最大4件、`id`（`luna-low`、`luna-medium`、`luna-high`、`sol-high`）と `binding`（`provider`、`model`、`reasoningEffort`）を指定できます。IDは経路のラベルなので、登録済みのAstraなども正確なbindingで割り当てられます。候補はDSHの現在の `openai-codex` 一覧、文脈容量・入力形式・推論強度、要求設定の検証、token meterを通ったものに限定します。有効なbindingが2件未満なら判定しません。
+初期候補は `gpt-6-luna` の low・medium・high と `gpt-6-sol` の high です。`modelAutoMode.routes` には最大4件、`id`（`luna-low`、`luna-medium`、`luna-high`、`sol-high`）と `binding`（`provider`、`model`、`reasoningEffort`）を指定できます。IDは経路のラベルなので、登録済みのAstraなども正確なbindingで割り当てられます。候補はCodex由来とResponses方式を確認でき、現在のモデル一覧、文脈容量・入力形式・推論強度、要求設定の検証、token meterを通った接続に限定します。ネイティブの `openai-codex` とKiokuko所有のCodex接続が対象です。名前だけを似せた接続やOpenAI API接続は対象外です。有効なbindingが2件未満なら判定しません。
 
 新しい受付済みの通常タスクでは、現在の依頼文、タスク種別、添付の種類、経路IDと判定基準を選択中のJevかLayaへ送ります。この判定のために添付の内容、全履歴、リポジトリ全体は送信しません。Choice 1問の結果をrunに保存し、継続では同じ経路を使います。再起動時に判定結果が不明なら再送せず元のモデルを維持します。`observe`、棄権、probe失敗、metadata不足、非対応effort、timeout、入力超過でも元のモデルを維持します。取消、セッション同一性の不一致、保存の整合性エラーでは要求を止めます。認証・利用枠・モデル利用不可によるdispatch失敗を別モデルへ自動再送しません。
 
@@ -74,7 +76,6 @@ npm run test:evaluation:model-routing -- --live --provider laya --config PATH
 | OpenRouter・DeepSeek V4.1 Flash | `deepseek/deepseek-v4.1-flash` | `deepseek/deepseek-v4.1-flash` | `deepseek/deepseek-v4.1-flash` | `deepseek/deepseek-v4.1-flash` |
 | OpenRouter・GLM | `z-ai/glm-5.3` | `z-ai/glm-5.3` | `z-ai/glm-5.3-flash` | `z-ai/glm-5.3` |
 | OpenRouter・Qwen | `qwen/qwen3.8-max-0902` | `qwen/qwen3.8-max-0902` | `qwen/qwen3.8-flash` | `qwen/qwen3.8-max-0902` |
-| OrcaRouter・DeepSeek V4.1 Flash | `deepseek/deepseek-v4.1-flash` | `deepseek/deepseek-v4.1-flash` | `deepseek/deepseek-v4.1-flash` | `deepseek/deepseek-v4.1-flash` |
 | Ollama・ローカル標準 | `qwen3-coder:30b` | `qwen3-coder:30b` | `qwen3-coder:30b` | `qwen3-coder:30b` |
 
 これらは版1の構成候補です。適用時にDSHの登録モデルと正確なIDで照合します。
@@ -84,13 +85,11 @@ npm run test:evaluation:model-routing -- --live --provider laya --config PATH
 DeepSeek系の推奨は全5役を **V4.1 Flash** に統一しています。IDは提供元ごとに、
 [DeepSeek公式API](https://www.deepseek.com/en/news/deepseek-v4-1-flash/)、
 [OpenCode Go](https://opencode.ai/docs/go/)、
-[OpenRouter](https://openrouter.ai/deepseek/deepseek-v4.1-flash)、
-[OrcaRouter](https://www.orcarouter.ai/models/deepseek/deepseek-v4.1-flash)で確認しています。
+[OpenRouter](https://openrouter.ai/deepseek/deepseek-v4.1-flash)で確認しています。
 公式APIの専用テンプレートはDSHの`deepseek-official`接続を使います。
 V4.1 Flashが未登録の場合、V4 Proや旧FlashのIDには置き換えません。
 2026-09-11に[OpenCodeのモデル一覧](https://models.opencode.ai/api.json)も確認しています。
 `opencode-go`にはV4.1 Flashが掲載されていますが、Zenに相当する`opencode`にはありません。
-この一覧のOrcaRouter欄にも未掲載で、OrcaRouter公式モデルページの更新と差があります。
 Zen・Ollamaで推奨テンプレートにないモデルを使う場合は、以下の登録済みモデル選択を使います。
 
 [dsh-codex](https://github.com/askdkc/dsh-codex)を使う場合は、
@@ -100,7 +99,7 @@ Zen・Ollamaで推奨テンプレートにないモデルを使う場合は、
 [OpenAIのモデルガイド](https://developers.openai.com/api/docs/models)を基にした推奨で、
 タスク別の速度・利用枠消費を実測して最適化したものではありません。
 
-この専用テンプレートは、[dsh-codexの登録・接続実装](https://github.com/askdkc/dsh-codex/blob/e2e61b6d8f3b511cf2dac99688e97b8728cb122c/src/index.ts)
+このテンプレートはKiokuko ModelsのCodex接続にも対応し、Codex由来とResponses方式を確認して、安定した `kiokuko-…` 登録IDを保存します。ネイティブ接続は [dsh-codexの登録・接続実装](https://github.com/askdkc/dsh-codex/blob/e2e61b6d8f3b511cf2dac99688e97b8728cb122c/src/index.ts)
 に合わせて`openai-codex` / `codex` / `responses`を使用します。接続先や通信方式を
 重ねて質問せず、選択した構成に保存します。DSH本体のモデル検証を優先し、
 旧`modelRoutes`の値を再入力させません。プラグイン設定ファイルは変更しません。モデルはDSH経由の現在の登録一覧に存在する正確なIDだけを割り当て、
@@ -114,9 +113,8 @@ DSHの設定を使い、重ねて質問しません。Kiokukoは認証情報を
 
 モデル名から選ぶ場合は、**「DSHに設定済みのモデルから選ぶ」→役割を変更→接続を選択→
 モデル名で検索・選択→構成を確認して開始**と進みます。
-**OpenCode Go、OpenCode Zen、OpenRouter、Ollama、OrcaRouter**の登録済み接続を選べます。
+**OpenCode Go、OpenCode Zen、OpenRouter、Ollama**の登録済み接続を選べます。
 一覧は現在のDSHプロファイルから取得し、接続名・モデル名と正確なIDを表示します。
-同じモデル名でもOpenRouterとOrcaRouterの割り当ては別々に保持します。
 接続が表示されない場合はDSHに登録し、「一覧を再取得」で更新してください。
 公開モデル一覧は推奨IDの参照元で、DSHへのモデル登録は行いません。
 公開一覧の`ollama-cloud`と、ローカルOllamaのインストール済みモデルは別の一覧です。

package/docs/model-selection.md

@@ -13,7 +13,9 @@ plan approval or automatic Enno continuation.
 
 ## Automatic model selection
 
-`modelAutoMode` is off by default in both the full plugin and modular core. To try it, install and authenticate dsh-codex in the same DSH profile, configure a Jev or Laya typed-decision backend, then use `observe` before enabling automatic routing:
+In Web profiles, [Kiokuko Models](kiokuko-models.md) manages connections without requiring DSH's Models settings. Its registered models are available to ordinary chat, Enno and Deep alongside native connections.
+
+`modelAutoMode` is off by default in both the full plugin and modular core. To try it, authenticate Codex through Kiokuko Models or dsh-codex in the same DSH profile, configure a Jev or Laya typed-decision backend, then use `observe` before enabling automatic routing:
 
 ```yaml
 modelAutoMode:
@@ -31,7 +33,7 @@ modelAutoMode:
 
 The command changes only the current native session. `on` also clears its manual model pin; a model selected in DSH's picker pins that session until `on` is run again. Changes apply at the next new task boundary, without changing a request already sent. `/kioku-decisions status` includes the same session projection. To reset session overrides after a configuration change, restart DSH; changing `modelAutoMode.mode` to `off` and restarting disables routing.
 
-The initial preset offers `gpt-6-luna` at low, medium and high effort, plus `gpt-6-sol` at high effort. Up to four exact route bindings can be configured under `modelAutoMode.routes`; each has an `id` from `luna-low`, `luna-medium`, `luna-high`, `sol-high`, and a `binding` with `provider`, `model`, and `reasoningEffort`. These are route labels, so a registered Astra or other GPT model may be assigned explicitly. No new model ID is guessed or substituted. DSH's live `openai-codex` catalog, model context and modality metadata, supported efforts, call-config validation and token meter must all confirm a candidate. Fewer than two valid bindings skips classification.
+The initial preset offers `gpt-6-luna` at low, medium and high effort, plus `gpt-6-sol` at high effort. Up to four exact route bindings can be configured under `modelAutoMode.routes`; each has an `id` from `luna-low`, `luna-medium`, `luna-high`, `sol-high`, and a `binding` with `provider`, `model`, and `reasoningEffort`. These are route labels, so a registered Astra or other GPT model may be assigned explicitly. No new model ID is guessed or substituted. A candidate must have a validated Codex origin and Responses protocol, live model context and modality metadata, supported efforts, call-config validation and token meter. Both native `openai-codex` and Kiokuko-owned Codex routes qualify; an arbitrary provider name or OpenAI API connection does not. Fewer than two valid bindings skips classification.
 
 For a new admitted normal task, Kiokuko sends the current task text, task type, attachment kinds, route IDs and rubric to the selected Jev or Laya backend. It does not send attachment bytes, full history or repository contents for this classification. One Choice result selects a route or abstains. The route is stored against the exact run and reused for continuations; an unknown in-flight decision after restart is retained without another classifier call. `observe` records a proposal but keeps the current model. A failed probe, missing metadata, unsupported effort, timeout, oversized input or abstention also keeps the current model. Cancellation, stale session identity and storage integrity failures stop the request. Dispatch authentication, quota and unavailable-model errors remain ordinary failures; no alternate model is retried automatically.
 
@@ -63,8 +65,8 @@ above nine, type consecutive digits (`1`, `2`, Enter selects option 12); Backspa
 corrects the number. Digits typed in the search field remain search text, and Enter
 submits the search. IME composition and repeated key events do not select or submit.
 
-Enno offers twelve versioned templates across **OpenAI, DeepSeek, OpenCode Go,
-OpenCode Zen, OpenRouter, OrcaRouter and Ollama**, plus a custom configured-model selector. The complete
+Enno offers eleven versioned templates across **OpenAI, DeepSeek, OpenCode Go,
+OpenCode Zen, OpenRouter and Ollama**, plus a custom configured-model selector. The complete
 [template table and configuration reference](model-selection.ja.md) lists exact
 model IDs. OpenAI assigns Astra to ideal/Zenki/check, Sol to the Goki head and
 Luna to workers. Go and OpenRouter provide GLM and Qwen variants; Zen uses GLM.
@@ -74,14 +76,12 @@ downloads models. Reasoning uses model defaults; reflection uses the check model
 All DeepSeek recommendations use **V4.1 Flash for all five roles**. Exact IDs differ:
 `deepseek-flash` on [DeepSeek's API](https://www.deepseek.com/en/news/deepseek-v4-1-flash/),
 `deepseek-v4.1-flash` on [OpenCode Go](https://opencode.ai/docs/go/), and
-`deepseek/deepseek-v4.1-flash` on [OpenRouter](https://openrouter.ai/deepseek/deepseek-v4.1-flash)
-and [OrcaRouter](https://www.orcarouter.ai/models/deepseek/deepseek-v4.1-flash).
+`deepseek/deepseek-v4.1-flash` on [OpenRouter](https://openrouter.ai/deepseek/deepseek-v4.1-flash).
 The direct DeepSeek template uses DSH's `deepseek-official` connection. These templates
 never substitute V4 Pro or an older Flash ID when V4.1 Flash is unavailable.
 The [OpenCode model registry](https://models.opencode.ai/api.json) was also checked
 on 2026-09-11. Its `opencode-go` entry includes V4.1 Flash; its Zen entry (`opencode`)
-does not. Its OrcaRouter entry also lacks V4.1 Flash, although OrcaRouter's own model
-page lists the ID above. Registry entries can lag provider changes. Zen and Ollama
+does not. Registry entries can lag provider changes. Zen and Ollama
 use the configured-model selector for models without a verified template ID.
 
 For [dsh-codex](https://github.com/askdkc/dsh-codex), choose **OpenAI Codex・推奨（dsh-codex）**
@@ -89,8 +89,10 @@ from the template menu, then confirm the configuration. It assigns Astra to
 ideal/planning/check, Sol to the Goki head and Luna to workers, following the
 [OpenAI model guide](https://developers.openai.com/api/docs/models). This is a
 quality/workload recommendation, not a measured per-task latency or quota optimum.
-The plugin-specific template binds the exact `openai-codex` / `codex` / `responses`
-contract from [dsh-codex's implementation](https://github.com/askdkc/dsh-codex/blob/e2e61b6d8f3b511cf2dac99688e97b8728cb122c/src/index.ts)
+The template also accepts a Kiokuko Models Codex connection with verified origin
+and Responses metadata, storing its stable `kiokuko-…` registration ID. The native
+route retains the `openai-codex` / `codex` / `responses` contract from
+[dsh-codex's implementation](https://github.com/askdkc/dsh-codex/blob/e2e61b6d8f3b511cf2dac99688e97b8728cb122c/src/index.ts)
 without asking for the connection again. Native DSH model validation takes
 precedence over legacy `modelRoutes` declarations; the plugin configuration file
 remains untouched. Recommended models must exist in the current DSH catalog;
@@ -116,9 +118,9 @@ than requested again. Back and cancel retain confirmed model assignments.
 
 To choose by model name, select **DSHに設定済みのモデルから選ぶ**, edit a role,
 select its connection, then search or select a model name and confirm the configuration.
-This works with configured **OpenCode Go, OpenCode Zen, OpenRouter, Ollama and OrcaRouter**
+This works with configured **OpenCode Go, OpenCode Zen, OpenRouter and Ollama**
 connections. Every entry displays its name and exact ID; the same model on OpenRouter
-and OrcaRouter remains a distinct binding. Lists come from the current DSH profile.
+Each connection remains a distinct binding. Lists come from the current DSH profile.
 Register a missing connection in DSH and select **一覧を再取得** to refresh it.
 The public registry is a recommendation reference; it does not register models in
 DSH. Its `ollama-cloud` catalog is separate from a local Ollama installation.

package/docs/owned-execution.md

@@ -0,0 +1,99 @@
+# Kiokuko-owned development execution
+
+Kiokuko registers native `kioku_read`, `kioku_write`, `kioku_edit`,
+`kioku_remove`, `kioku_exec`, and `kioku_result` tools. They use Node filesystem
+and process services directly; stock DSH filesystem/shell sandbox settings do
+not control this executor. Native presentation and PTC transport both remain
+supported. Plan, goal, cancellation, admitted identity, and Enno delegation
+scope still apply.
+
+Ordinary project reads, edits, builds, tests, PATH commands and investigation
+needed for development require no additional confirmation. Bash/zsh inherit
+the user's environment and may start child processes. Source/data deletion and
+existing durable user database mutation require confirmation of concrete
+targets. Generated artifacts and temporary/disposable data do not. Declare
+`destructiveTargets` for destructive commands: arbitrary shell/Lisp/FFI code
+cannot be completely classified in advance. An unknown side effect does not
+justify refusing execution or treating its result as verification.
+
+## Tools and replay
+
+- `kioku_read({path})` returns content and its SHA256.
+- `kioku_write({path,content,expectedHash?})` and
+  `kioku_edit({path,oldText,newText,expectedHash?})` compare the actual file with
+  the requested result. An edit requires exactly one matching occurrence.
+  `expectedHash:null` requires a new file; changed hashes reject a stale edit.
+- `kioku_remove({path,expectedHash?})` removes a single file.
+- `kioku_exec({command,cwd?,shell?,background?,timeoutMs?,destructiveTargets?})`
+  executes in the canonical cwd, including project subdirectories.
+- `kioku_result({operationId,cancel?})` retrieves or cancels the existing
+  process. It never starts the command again. Collect background operations
+  until their receipt is terminal.
+
+Each tool returns a host-generated receipt with operation/run/session/generation
+identity, actual cwd/command, file hashes, process exit/signal/cancellation/timeout,
+and verification and persistence states. Process output is bounded at 32 MiB;
+the host parses complete output before returning a 24,000-character preview.
+Observed/displayed byte counts and an output digest distinguish the two scopes.
+Environment variables and full command output are not persisted in execution receipts or passed as supervisor command-line arguments. Secret-bearing
+commands and previews are redacted.
+
+Operation identity is tied to the native call. Replaying it with another
+run/generation or changed arguments conflicts. SQLite receipts and a private
+local journal beside the configured database survive restart. A failed SQLite
+save leaves `persistence:pending`; retrieving the result retries storage without
+repeating edits/tests. If the outbox is unavailable, execution can use a database reservation; failure of both stores is reported as pending and cannot promise durable replay protection. A started receipt after a crash becomes unknown, and
+its effect is never automatically retried. Loss of both durable stores cannot
+be reconstructed from a model's success report. After restart, saved receipts restore terminal metadata and verification summaries; full output previews and read contents are not restored from the journal. Use a new read operation to inspect current file contents.
+
+## Verification and memory
+
+Register conditions and source/test/configuration paths with `task_completion`
+before running the check. Memory application reviews may specify a repository-relative `cwd`; omitted values retain the historical repository-root meaning. Actual directory, command, source digest, run and generation must match. Owned shell and Lisp process calls feed the existing
+completion and memory-application records. Exit zero alone does not establish
+test success: complete Node TAP and Cargo harness summaries distinguish passed,
+failed, cancelled, ignored/skipped, filtered and zero/incomplete test runs.
+Include every relevant input in the registered source set.
+
+Finalization receives structured observations and source-bound checks. Candidate
+memories cite stored receipts from the same run/session and retain conditions
+and source versions. Existing transactions, leases and effect deduplication own
+memory saving; memory retries do not rerun development tools. A staged, secret-scanned extraction is reused after adoption fails only when its run, source log, evidence manifest and entry revisions still match. Retrieval exposes
+execution provenance and recomputes source freshness. Historical results are
+explicitly `currentTaskVerification:false`; they do not complete a new task.
+Unrelated generated files and ordinary reads do not invalidate declared source checks. Unknown side effects mark affected verification unknown without rejecting execution. Tool responses return work, verification, receiptPersistence and memoryStorage separately; not_scheduled is not a successful memory save.
+
+## Lisp and Plan
+
+`lisp.executionMode` defaults to `development`, including when an old profile
+omits it or has `approvalMode:ask`. Ordinary tools and Lisp coexist. Process RPC
+and workspace proposals use the owned executor; helper toolsets still compile
+and validate their schemas/examples. Worker failures leave ordinary tools
+available. `executionMode:protected` explicitly selects the legacy isolated
+worker/approval/fence behavior for compatibility; it is not the default.
+
+Lisp source can directly call filesystem/FFI APIs in development mode. Such
+effects are not independent process/test proof. Prefer `kioku.tools:call-tool`
+and `kioku.process` for observed results. Plan blocks effectful owned/Lisp
+operations. An explicit human implementation instruction or plan approval
+requests Plan exit at the next accepted native boundary; merely presenting a
+plan does not exit it.
+
+## Local acceptance
+
+```sh
+npm run typecheck
+KIOKUKO_REQUIRE_DSH_NATIVE=1 KIOKUKO_DSH_PACKAGE_ROOT="$PWD/tests/fixtures/dsh-runtime/node_modules" node scripts/run-tests.mjs tests/dsh/integration/owned-native-lifecycle.test.ts
+KIOKUKO_REQUIRE_CARGO_RUNTIME=1 node scripts/run-tests.mjs tests/dsh/integration/owned-execution.test.ts
+KIOKUKO_REQUIRE_LISP_RUNTIME=1 KIOKUKO_DSH_PACKAGE_ROOT="$PWD/tests/fixtures/dsh-runtime/node_modules" npm run test:lisp
+npm run build
+npm run test:skill-delivery
+npm run test:modules
+npm run pack:check
+```
+
+The runtime tests use disposable profiles/databases and scripted provider
+responses. They establish local/native execution, persistence and retrieval;
+they do not prove a live provider or the user's installed profile. The test
+runner bounds concurrent Lisp compilation to two files. Set
+`KIOKUKO_TEST_CONCURRENCY` (1–64) to override it.

package/lisp/supervisor.mjs

@@ -1,7 +1,7 @@
 // Trusted host helper, never evaluated inside Lisp. stdin is a parent-liveness
 // pipe. It stays outside the worker sandbox so arbitrary Lisp cannot disable it.
 import { spawn } from 'node:child_process'
-import { openSync, closeSync } from 'node:fs'
+import { openSync, closeSync, writeSync } from 'node:fs'
 const launch = JSON.parse(process.argv[2])
 let child, closing = false
 const kill = () => {
@@ -21,6 +21,12 @@ const stdio = ['ignore', 'inherit', 'inherit', launch.protocol ? 3 : 'ignore']
 if (filter !== undefined) stdio.push(filter)
 child = spawn(launch.command, launch.args, { cwd: launch.cwd, env: launch.env, stdio, detached: !!launch.group })
 if (filter !== undefined) closeSync(filter)
+// Stream one JSON object: older readers still consume the complete terminal
+// object, while current readers observe the prefix only after actual spawn.
+child.once('spawn',()=>{if(launch.report){try{writeSync(4,'{"processStarted":true,')}catch{/* host already stopped */}}})
 child.once('error', error => { process.stderr.write(`LISP_LAUNCH_ERROR: ${error.message}\n`); process.exit(70) })
-child.once('exit', (code, signal) => { if (launch.group) kill(); process.exit(signal ? 128 : code ?? 70) })
+child.once('exit', (code, signal) => {
+  if(launch.report){try{writeSync(4,JSON.stringify({exitCode:code,signal}).slice(1)+'\n')}catch{/* host already stopped */}}
+  if (launch.group) kill(); process.exit(signal ? 128 : code ?? 70)
+})
 if (closing) kill()

package/lisp/tools.lisp

@@ -9,6 +9,7 @@
 (defpackage :kioku.decisions (:use :cl) (:export :status :evaluate :assess-relevance :classify-failure :assess-change :service-error :error-code))
 (defpackage :kioku.typesafe (:use :cl) (:export :status :evaluate :service-error :error-code))
 (defpackage :kioku.tools (:use :cl) (:export :describe-tools :describe-symbol :available-tools :call-tool))
+(defpackage :kioku.code (:use :cl) (:shadow :open) (:export :capabilities :open :outline :enclosing :query :span :semantic :release :with-snapshot :service-error :error-code))
 (defpackage :kioku.user (:use :cl))
 (in-package :kioku.internal)
 (defvar *wire*)
@@ -40,6 +41,8 @@
       (unless (and reply (equal id (gethash "id" reply))) (error "RPC_MISMATCH"))
       (unless (eq yason:true (gethash "ok" reply))
         (let ((code (gethash "code" reply "")))
+          (when (and (stringp code) (alexandria:starts-with-subseq "CODE_" code))
+            (error 'kioku.code:service-error :code code :message (gethash "error" reply)))
           (when (and (stringp code) (alexandria:starts-with-subseq "DECISION_" code))
             (error 'kioku.decisions:service-error :code code :message (gethash "error" reply)))
           (when (and (stringp code) (alexandria:starts-with-subseq "TYPESAFE_" code))
@@ -275,7 +278,7 @@
     (vector (question "change" "Does the change satisfy the requirement without an evident regression?"
       (vector (choice "yes" "Satisfies requirement") (choice "no" "Missing requirement or regression") (choice "abstain" "Insufficient evidence"))))))
 (in-package :kioku.environment)
-(defun status () (kioku.internal:object "generation" kioku.internal:*generation* "sbcl" (lisp-implementation-version) "os" (software-type) "architecture" (machine-type) "scratch" (namestring (kioku.files:scratch)) "network" yason:false "hostWrites" "proposals only" "libraries" #("yason" "cl-ppcre" "cl-csv")))
+(defun status () (kioku.internal:object "generation" kioku.internal:*generation* "sbcl" (lisp-implementation-version) "os" (software-type) "architecture" (machine-type) "scratch" (namestring (kioku.files:scratch)) "executionMode" (or (uiop:getenv "KIOKU_EXECUTION_MODE") "protected") "network" (if (equal (uiop:getenv "KIOKU_EXECUTION_MODE") "development") "normal user environment" yason:false) "hostWrites" (if (equal (uiop:getenv "KIOKU_EXECUTION_MODE") "development") "owned tools and direct Lisp; only host receipts prove observed effects" "proposals only") "libraries" #("yason" "cl-ppcre" "cl-csv")))
 (in-package :kioku.tools)
 (defun available-tools () (kioku.internal:rpc "tools-list" (kioku.internal:object)))
 (defun call-tool (name &optional (arguments (kioku.internal:object)))
@@ -296,7 +299,7 @@
       (kioku.internal:object "package" "kioku.user" "generation" kioku.internal:*generation*
                             "symbols" (coerce (task-functions) 'vector))))
   (let ((package (find-package (string-upcase name))))
-    (when (and package (member (package-name package) '("KIOKU.TOOLS" "KIOKU.PROCESS" "KIOKU.FILES" "KIOKU.DATA" "KIOKU.OBJECTS" "KIOKU.ENVIRONMENT" "KIOKU.CI" "KIOKU.PACKAGES" "KIOKU.TYPESAFE") :test #'equal))
+    (when (and package (member (package-name package) '("KIOKU.TOOLS" "KIOKU.PROCESS" "KIOKU.FILES" "KIOKU.DATA" "KIOKU.OBJECTS" "KIOKU.ENVIRONMENT" "KIOKU.CI" "KIOKU.PACKAGES" "KIOKU.TYPESAFE" "KIOKU.CODE") :test #'equal))
       (return-from describe-symbol
         (kioku.internal:object "package" (string-downcase (package-name package))
           "symbols" (coerce (sort (loop for symbol being the external-symbols of package
@@ -306,7 +309,7 @@
         (multiple-value-bind (symbol end) (read-from-string name)
           (unless (and (symbolp symbol) (symbol-package symbol) (fboundp symbol)
                        (zerop (length (string-trim '(#\Space #\Tab #\Newline #\Return) (subseq name end))))
-                       (member (package-name (symbol-package symbol)) '("KIOKU.USER" "KIOKU.TOOLS" "KIOKU.PROCESS" "KIOKU.FILES" "KIOKU.DATA" "KIOKU.OBJECTS" "KIOKU.ENVIRONMENT" "KIOKU.CI" "KIOKU.PACKAGES" "KIOKU.TYPESAFE") :test #'equal))
+                       (member (package-name (symbol-package symbol)) '("KIOKU.USER" "KIOKU.TOOLS" "KIOKU.PROCESS" "KIOKU.FILES" "KIOKU.DATA" "KIOKU.OBJECTS" "KIOKU.ENVIRONMENT" "KIOKU.CI" "KIOKU.PACKAGES" "KIOKU.TYPESAFE" "KIOKU.CODE") :test #'equal))
             (error "UNKNOWN_SYMBOL"))
           (kioku.internal:object "symbol" name "arguments" (kioku.internal::printed (sb-introspect:function-lambda-list symbol)) "documentation" (or (documentation symbol 'function) "No function documentation."))))))
 
@@ -521,3 +524,28 @@
         (list (loop for line in lines while (< (length out) cap) do (visit line)))
         (vector (loop for line across lines while (< (length out) cap) do (visit line)))))
     (coerce out 'simple-vector)))
+
+(in-package :kioku.code)
+(define-condition service-error (error)
+  ((code :initarg :code :reader error-code) (message :initarg :message :reader service-message))
+  (:report (lambda (condition stream) (format stream "~A: ~A" (error-code condition) (service-message condition)))))
+(defun %request (method &rest pairs)
+  (let ((args (make-hash-table :test 'equal)))
+    (loop for (key value) on pairs by #'cddr when value do (setf (gethash key args) value))
+    (kioku.internal:rpc method args)))
+(defun capabilities () (%request "code-capabilities"))
+(defun open (path) (%request "code-open" "path" path))
+(defun outline (handle &key range limit) (%request "code-outline" "handle" handle "range" range "limit" limit))
+(defun enclosing (handle position &key kinds) (%request "code-enclosing" "handle" handle "position" position "kinds" (and kinds (coerce kinds 'vector))))
+(defun query (handle query-id &key range limit) (%request "code-query" "handle" handle "queryId" query-id "range" range "limit" limit))
+(defun span (node-handle &key max-chars) (%request "code-span" "nodeHandle" node-handle "maxChars" max-chars))
+(defun semantic (handle kind &key position limit) (%request "code-semantic" "handle" handle "kind" kind "position" position "limit" limit))
+(defun release (handle) (%request "code-release" "handle" handle))
+(defmacro with-snapshot ((handle path) &body body)
+  "Bind HANDLE only for an accepted snapshot; always release, including errors."
+  (let ((response (gensym "SNAPSHOT")))
+    `(let ((,response (open ,path)))
+       (if (member (gethash "status" ,response) '("ok" "partial") :test #'equal)
+           (let ((,handle (gethash "handle" (gethash "data" ,response))))
+             (unwind-protect (progn ,@body) (release ,handle)))
+           ,response))))

package/migrations/035_owned_execution.sql

@@ -0,0 +1,19 @@
+CREATE TABLE dsh_owned_operations (
+  operation_id TEXT PRIMARY KEY,
+  run_id TEXT NOT NULL REFERENCES ledger_runs(run_id) ON DELETE CASCADE,
+  session_id TEXT NOT NULL,
+  generation TEXT NOT NULL,
+  request_digest TEXT NOT NULL,
+  state TEXT NOT NULL CHECK(state IN ('started','completed','unknown')),
+  receipt_json TEXT NOT NULL CHECK(json_valid(receipt_json)),
+  updated_at TEXT NOT NULL
+);
+CREATE INDEX idx_dsh_owned_operations_run ON dsh_owned_operations(run_id, generation);
+CREATE TABLE memory_execution_links (
+  entry_id TEXT NOT NULL REFERENCES entries(id) ON DELETE CASCADE,
+  revision INTEGER NOT NULL,
+  operation_id TEXT NOT NULL REFERENCES dsh_owned_operations(operation_id),
+  PRIMARY KEY(entry_id, revision, operation_id)
+);
+ALTER TABLE dsh_memory_finalizations ADD COLUMN staged_capsule_json TEXT CHECK(staged_capsule_json IS NULL OR json_valid(staged_capsule_json));
+ALTER TABLE dsh_memory_finalizations ADD COLUMN staged_binding_hash TEXT;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kiokuko-dsh",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Kiokuko plugin for DeepSeek Harness",
   "type": "module",
   "license": "MIT",
@@ -102,7 +102,7 @@
       ]
     },
     "permissions": {
-      "summary": "Local Kiokuko state and managed files, optional network-backed Skills, embeddings and configured provider-independent typed decisions, DSH-managed TypeSafe credentials, and protected or approved subprocesses.",
+      "summary": "Kiokuko-owned local development execution, candidate memory and host receipts; normal user environment, PATH commands and child processes. Concrete confirmation for source/data deletion and durable user database changes.",
       "readPaths": [
         "Configured Kiokuko SQLite database and embedding assets",
         "Registered project roots and their repository metadata",
@@ -117,12 +117,13 @@
         "DSH run, lease, receipt, retrieval, Deep inputs/artifacts/budgets/reports, post-completion memory-finalization, and embedding state inside that database",
         ".agenticreplay/runs and .agenticreplay/exports inside verified session workspaces, or the configured Kiokuko data directory",
         "Legacy history compatibility under DSH's native write lease: exact rejected v3 file or validated new v3 generation from retained v0, identical .bak, disposable validation artifacts, and automatic deletion of confirmed identity-mismatched native logs",
-        "Opt-in Lisp scratch, input snapshots, verified compiled bundle cache, durable operation journal, and approved file changes with host backups"
+        "Opt-in Lisp scratch, input snapshots, verified compiled bundle cache, durable operation journal, and approved file changes with host backups",
+        "Project files through owned native tools; private execution outbox beside the configured Kiokuko database"
       ],
       "commands": [
         "Restricted repository-relative verifier and backup subprocesses when explicitly requested",
         "Read-only fixed-argument Git commands for an explicitly captured Diff review",
-        "Opt-in protected SBCL and brokered subprocesses; no implicit runtime installation or VM"
+        "Owned bash/zsh, PATH commands, builds/tests and Lisp with the normal user environment; explicit protected Lisp compatibility mode remains available"
       ],
       "externalServices": [
         "GitHub or skills.sh for optional Skill discovery and source retrieval",
@@ -132,12 +133,14 @@
         "DSH-configured model provider for automatic memory review (active by default, up to 12 worker dispatches per project per UTC day), ordinary finalization and configured memory evolution",
         "Configured TypeSafe fixed endpoint or explicit Nimble HTTPS/loopback endpoint for automatic task/Skill/draft decisions, projected memory reuse after a synthetic readiness probe, and Lisp; no redirects, retries or provider substitution; exact roles.check no-tool fallback for complete draft review",
         "Explicit Laya-CoreML Unix socket for local finite decisions using the existing v1 worker or optional strict operations; no subprocess client, automatic worker startup, model downloads or provider substitution",
-        "DSH-configured admitted provider/model for default-active source-backed index reasoning: up to 8 worker dispatches per workspace per UTC day; no retrieval-time generation or automatic resend of uncertain dispatches"
+        "DSH-configured admitted provider/model for default-active source-backed index reasoning: up to 8 worker dispatches per workspace per UTC day; no retrieval-time generation or automatic resend of uncertain dispatches",
+        "User-configured AI API endpoints and vendored provider OAuth flows through Kiokuko Models"
       ],
       "credentials": [
         "Optional user-provided GitHub or embedding credentials; never bundled or persisted by the plugin",
         "TYPESAFE_API_KEY resolved per explicit call; optional DSH-managed set/unset via /kioku-typesafe-key, inherited environment precedence, no worker or Kiokuko storage exposure; input visible while typing",
-        "Optional separate Nimble bearer credential reference through DSH; TYPESAFE_API_KEY is prohibited for Nimble; credentials are never persisted in decision records"
+        "Optional separate Nimble bearer credential reference through DSH; TYPESAFE_API_KEY is prohibited for Nimble; credentials are never persisted in decision records",
+        "Shared dsh-auth credentials: human Web login/key replacement/logout; logout also affects dsh-cli"
       ],
       "failureBoundaries": [
         "Repository identity, run identity, lease, revision, and integrity mismatches fail closed",
@@ -154,7 +157,7 @@
   },
   "scripts": {
     "clean:dist": "node --input-type=module --eval \"import { rmSync } from 'node:fs'; rmSync('dist', { recursive: true, force: true });\"",
-    "build": "npm run clean:dist && tsc -p tsconfig.build.json && node scripts/compile-skill-prompts.mjs && node scripts/build-dsh-client.mjs && node scripts/build-history-codecs.mjs && node scripts/build-plugin-entry.mjs",
+    "build": "npm run clean:dist && tsc -p tsconfig.build.json && node scripts/build-model-transports.mjs && node scripts/compile-skill-prompts.mjs && node scripts/build-dsh-client.mjs && node scripts/build-history-codecs.mjs && node scripts/build-plugin-entry.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "node scripts/run-tests.mjs tests/dsh",
     "test:harness": "node --import tsx scripts/run-harness-evaluation.mjs",
@@ -237,16 +240,20 @@
     "test:ci:prepare": "npm run verify:prepare",
     "test:ci:embedding": "node scripts/run-local-embedding-smoke.mjs --offline",
     "test:ci:approval:web": "npm run build && node scripts/run-ci-native.mjs browser-approval",
-    "test:ci:shortcuts:web": "npm run build && node scripts/run-ci-native.mjs browser-shortcuts"
+    "test:ci:shortcuts:web": "npm run build && node scripts/run-ci-native.mjs browser-shortcuts",
+    "test:models:web": "npm run build && node scripts/verify-models-web.mjs",
+    "test:code-intelligence": "node scripts/run-code-intelligence.mjs",
+    "test:code-intelligence:packed": "node scripts/run-code-intelligence.mjs --packed",
+    "test:code-intelligence:benchmark": "node scripts/benchmark-code-intelligence.mjs"
   },
   "dependencies": {
     "@deepseek-ai/cosmokit": "1.8.5",
-    "@deepseek-ai/schemastery": "3.18.4",
+    "@deepseek-ai/schemastery": "3.18.5-alpha.1",
+    "agenticreplay": ">=0.1.0 <1.0.0",
     "jsonc-parser": "3.3.1",
     "semver": "7.8.5",
     "yaml": "2.9.0",
-    "zod": "4.5.4",
-    "agenticreplay": ">=0.1.0 <1.0.0"
+    "zod": "4.5.4"
   },
   "overrides": {
     "adm-zip": "0.6.1",
@@ -254,7 +261,12 @@
     "global-agent": "4.1.3"
   },
   "peerDependencies": {
+    "@ai-sdk/provider": "4.0.21",
     "@deepseek-ai/cordis": "~4.0.5-alpha.1",
+    "@deepseek-ai/dsh-agent": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-attachment": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-llm": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.2.1-alpha.2",
     "@huggingface/hub": "2.16.1",
     "@huggingface/transformers": "4.2.0",
     "sqlite-vec": "0.1.9"
@@ -268,11 +280,34 @@
     },
     "sqlite-vec": {
       "optional": true
+    },
+    "@deepseek-ai/dsh-llm": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-llm-pi-ai": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-agent": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-attachment": {
+      "optional": true
+    },
+    "@ai-sdk/provider": {
+      "optional": true
     }
   },
   "devDependencies": {
+    "@ai-sdk/anthropic": "4.0.71",
+    "@ai-sdk/google": "4.0.87",
+    "@ai-sdk/openai": "4.0.83",
+    "@ai-sdk/openai-compatible": "3.0.62",
+    "@ai-sdk/provider": "4.0.21",
     "@deepseek-ai/cordis": "4.0.5-alpha.1",
+    "@deepseek-ai/dsh-agent": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-attachment": "0.2.1-alpha.2",
     "@deepseek-ai/dsh-llm": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.2.1-alpha.2",
     "@deepseek-ai/dsh-session-format": "0.2.1-alpha.2",
     "@deepseek-ai/dsh-session-format-v0-to-v1": "0.2.1-alpha.2",
     "@deepseek-ai/dsh-session-format-v1-to-v2": "0.2.1-alpha.2",