kiokuko-dsh 0.2.1 → 0.2.3

package/PERMISSIONS.md

@@ -9,7 +9,7 @@ This document describes the full compatibility package. The
 Skills and uses the shared database, intake, ledger and scoped memory. It mounts
 source-backed index reasoning by default. AgenticReplay, Deep, other advanced-memory workers,
 session-history repair and the full browser client are optional. Enno retains the existing compatibility host adapter;
-Lisp adds protected execution and its existing explicit approval boundaries.
+Lisp adds composable tools in the normal development environment; explicit protected mode retains its legacy approval boundaries.
 Omitted managed Skills are preserved on disk. Configured startup rejects unsafe
 Skill collisions before mounting its runtime; it does not rewrite `AGENTS.md`.
 
@@ -72,8 +72,8 @@ Skill collisions before mounting its runtime; it does not rewrite `AGENTS.md`.
 
 - Repository-relative final verifiers and backup operations may run restricted
   subprocesses only when the corresponding Kiokuko operation explicitly
-  requests them. The plugin does not provide an implicit model-facing shell
-  tool.
+  requests them. Ordinary development uses the explicit owned `kioku_exec`
+  shell tool described below.
 - Diff review runs fixed-argument, read-only Git subprocesses. A user-started
   analysis sends the selected, sanitized snapshot and limited Kiokuko context
   to the exact DSH model connection chosen in the review UI. It supplies no
@@ -193,31 +193,14 @@ uploaded automatically. Deletion and disabling instructions are in
 [AgenticReplay recording](docs/agenticreplay-recording.md).
 # Optional Common Lisp mode
 
-With `lisp.enabled: true`, `/kioku-lisp enable` starts an OS-protected SBCL for the
-current session. It reads bundled runtime libraries and explicitly selected input
-copies and a verified compiled bundle, and writes its own scratch/cache. Initial
-Lisp enable compiles bundled sources in a supervised sandbox; the host publishes
-the completed bundle for read-only reuse. Runtime/compiler/source changes select
-a new entry. Invalid entries are quarantined and require explicit recovery. The
-host stores operation records and
-independent backups beside the Kiokuko database. No credentials or inherited
-environment are forwarded, and direct network/host IPC access is denied. The
-host may run repository-scoped `gh run list`/`gh run view --log-failed` reads on
-behalf of Lisp without copying credentials into the worker. Verification accepts
-only six fixed npm targets and requires native human confirmation showing the
-command, package script, exact working directory and timeout. The directory may
-be the workspace root, a workspace subdirectory, or a subdirectory of the current
-worker's scratch. Traversal and symlink directories are refused, and directory
-identity and scripts are rechecked after approval. These approved verifiers run
-on the host, including npm lifecycle scripts, outside the worker sandbox;
-arbitrary shell input is not accepted. Brokered worker programs can select only a
-scratch-relative working directory and retain the existing OS restrictions.
-
-File deletion and replacement require the native human confirmation for the exact
-proposal. Generic operations reject databases/sidecars, credential paths, links,
-directories, plugin files and host state. Refusal, skip, cancellation and missing
-confirmation UI never grant permission. Normal tools and child bypasses remain
-blocked until a human safely disables the mode. Plugin unload retains the fence.
+With lisp.enabled: true, Lisp runs in supervised workers with the normal user environment and child processes. It coexists with ordinary tools; worker failure does not restrict normal coding. Kiokuko-owned kioku_read/write/edit/remove/exec/result use Node filesystem/process APIs, independently of stock DSH filesystem/bash sandbox and approval configuration. DSH tool identity, Plan/goal state, cancellation and admitted execution ownership still apply.
+
+Project edits, development-related external reads, PATH commands, builds/tests, generated/temp/disposable artifacts, helper compilation/registration and routine Kioku saving need no additional approval. Source/data deletion and existing durable user DB mutations require concrete confirmation. Declare destructiveTargets for such commands. Arbitrary Lisp/shell code is not a security sandbox; unclassified code is not rejected merely because static side-effect analysis is impossible. Direct effects bypassing the owned tools have no host verification receipt.
+
+Host receipts record operation/run/session/generation, cwd, sanitized command, file hashes, process exit/signal/cancel/timeout, complete-output digest and test summaries before preview truncation. Environment variables and full outputs are not persisted. Known secret-bearing command/output text is redacted, but arbitrary secrets cannot all be recognized. Process groups are terminated on cancellation. Background results are collected without replaying effects.
+
+Receipts and source-bound checks feed existing completion/memory application and candidate finalization. Related source/test/config edits make checks stale; unrelated generated files do not. Saving failure is explicit and does not undo or rerun development. Interrupted started records remain unknown after restart. Memory candidates carry evidence references and current source freshness; evidence never automatically verifies a generalized lesson. Legacy profile approval settings still load; destructive review cannot be disabled by their ask/auto values.
+
 See [Common Lisp setup and recovery](docs/lisp.md) for commands and limits.
 
 # Configured typed decisions
@@ -299,3 +282,13 @@ the host-owned profile identity. Current DSH exposes `lisp.approvalMode` through
 the native `kiokuko-dsh` configuration form and saves its profile patch. This
 compatibility difference does not change the controls or scope. No separate
 preference file or database migration is used.
+
+## Web model management
+
+Settings → Kiokuko Models and `/kiokuko model` permit explicit human connection,
+login, API-key replacement, logout, model discovery and selection. Non-secret settings
+are profile-local. Credentials share dsh-auth's existing canonical store and locks;
+logout affects dsh-cli too. The authenticated Web transport protects the JSON POST
+operations. No secret enters model-visible commands or ordinary settings responses.
+Infron sends the explicitly selected Standard/Flex tier; it does not silently change
+tier on failure. [Storage, permissions and recovery](docs/kiokuko-models.md).

package/README.ja.md

@@ -88,8 +88,8 @@ DSH 更新後に Kiokuko を読み込めない場合は、[起動失敗時の復
 - Arch Linux: `sudo pacman -S sbcl`
 
 `~/.dsh/profiles/web/cordis.patch.yml` の `kiokuko-dsh` 行に次を追加し（他の `config` 値は保持）、
-プラグインを再読み込みすると、最初の実装・不具合修正の前に Lisp モードを使うか確認します。
-選択はセッション内で保持します。`/kioku-lisp enable` でも有効にできます。
+プラグインを再読み込みすると、実装タスクごとに Goal・実装項目・観測可能な条件を示してから Lisp モードを使うか確認します。
+選択はそのタスクと範囲に保存し、新しいタスクでは再確認します。`/kioku-lisp enable` は明示的な手動切替です。
 読み込まれた設定は `dsh --profile web --dump-config` で確認できます。
 
 ```yaml
@@ -100,11 +100,11 @@ DSH 更新後に Kiokuko を読み込めない場合は、[起動失敗時の復
       sbclPath: sbcl
 ```
 
-Linux では別途 Bubblewrap が必要です。
-Lisp を選ぶと、Lisp 用ツールで通常実行します。役小角を使う場合は「Lispモードを使わない」を選んでください。
-自由入力は相談・訂正として AI に渡します。
-削除・既存ファイルの置換はユーザーの確認後に実行します。
+既定の開発モードでは Bubblewrap は不要です。Linux で明示的に保護互換モードを選ぶ場合に必要です。
+「使う」は Lisp、「使わない」は通常ツール、「取消・作業を保持」は準備内容を残して取消です。閉じる・未回答では実装を始めません。通常実行／役小角の選択は別に保持します。Lisp の起動失敗はブロッカーとして残し、復旧または明示的な経路変更後に再開します。
+選択後の通常の編集・テストには追加確認を求めません。ソース・実データの削除と既存の永続DB変更は対象を確認します。各項目の最新の証拠と、通常の利用入口からの最終確認が揃った場合だけ完了します。[Goal 駆動コーディング](docs/coding-workflow.md)と[独自実行、レシート、記憶の再利用](docs/owned-execution.md)を参照してください。
 [設定、API、停止・復旧方法](docs/lisp.md)を参照してください。
+永続 Lisp では、`kioku.code` からディスク上のコードの構造と読み取り専用の LSP 結果を取得できます。V1 service を提供する任意の provider が必要です。公開済みの `dsh-lsp-server` v0.1.12 は未対応なので、現時点では[ローカルの provider 修正](patches/code-intelligence/README.md)を使います。[API と上限](docs/lisp.md#read-only-code-intelligence)を確認してください。
 
 ## 型付き判定（Jev / Laya / Nimble）
 
@@ -177,3 +177,5 @@ TypeSafe または Nimble の利用確認が成功すると、既存検索の候
 ObservationPack（既定値 `observationPack: { mode: auto }`）は、大きな正常終了のツール結果をモデルへ2回提示した後、抜粋と `observation_read` で原文を取得できる参照に置き換えます。[Semantic compaction](docs/semantic-compaction.md) は、TODOの完了境界でも前倒し判定を行い、通常・Enno・Lisp モードで、DSH の自動圧縮前に古いツール出力を選んで短縮します。既定値は `semanticCompaction: { mode: auto, preemptive: true, budgetMs: 5000 }` です。利用可能と確認された型付き判定バックエンドと、対応するネイティブサービスが必要です。`/kioku-decisions status` で有効状態と直近の結果を確認できます。
 
 Layaの圧縮には独立した設定があり、`typedDecisions.laya-coreml.compaction.mode: off` が既定です。明示的な `shadow` は履歴を変えずに評価し、`auto` は `experimental_not_qualified` として停止します。ObservationPackとnative summaryは既存設定を維持します。Akinatorは検証済みのdebug／research／writingだけを自動判定し、任意Skillは完全な説明を持つ最大4候補から最大1個を選びます。[Layaの設定と評価](docs/semantic-compaction.md#local-laya)を参照してください。
+
+任意の V1 code provider の導入手順と検証済みの構成は、[連携ガイド](docs/code-intelligence.md)を参照してください。

package/README.md

@@ -10,6 +10,7 @@ Inspect sources and corrections with `/kioku-memory explain ENTRY_ID`; explicitl
 
 ## Features
 
+- **Kiokuko Models** — Connect and authenticate from Web Settings or `/kiokuko model`, independently of native Models settings. Includes Infron Standard/Flex. [Setup and shared credentials](docs/kiokuko-models.md)
 - **Execution modes** — Choose normal execution or 役小角(enno-oduno) for role-based planning and verification. [Details](docs/model-selection.md)
 - **Project memory** — Retrieve useful project knowledge for later work. [Concepts](docs/concepts.md)
 - **Deep planning** — Run bounded, read-only investigation with four roles. [Usage](docs/deep-planning.md)
@@ -88,8 +89,9 @@ Install SBCL first:
 - Arch Linux: `sudo pacman -S sbcl`
 
 Add this to the `kiokuko-dsh` row in `~/.dsh/profiles/web/cordis.patch.yml`
-(keep other `config` values), then reload the plugin. The first implementation or
-debugging request asks whether to use Lisp; the session retains your choice.
+(keep other `config` values), then reload the plugin. Each implementation task
+shows its Goal, items and observable checks before asking whether to use Lisp.
+The choice belongs to that task and scope; a new task asks again.
 You can also enable it with `/kioku-lisp enable`.
 Check the loaded configuration with `dsh --profile web --dump-config`.
 
@@ -101,11 +103,13 @@ Check the loaded configuration with `dsh --profile web --dump-config`.
       sbclPath: sbcl
 ```
 
-Linux also requires Bubblewrap.
-Choosing Lisp starts normal execution with the Lisp tools. Choose not to use Lisp
-if you want Enno. Free text is passed to the AI as a discussion or correction.
-Deletion and replacement of existing files require human confirmation.
+The default development mode does not require Bubblewrap. The explicit protected compatibility mode does on Linux.
+Choose “使う” to use Lisp, “使わない” to use ordinary tools, or “取消・作業を保持” to cancel while preserving prepared work. Closing the question leaves implementation pending. Lisp choice and normal/Enno selection are separate. A failed Lisp startup remains a recoverable blocker until the selected route works or you explicitly change it.
+Ordinary edits and tests run without further confirmation after that choice. Source/data deletion and existing durable user database mutation require a concrete review. Lisp and ordinary tools coexist. Completion requires current item evidence and a fresh final check through the user’s entry point. See [Goal-driven coding](docs/coding-workflow.md) and [owned execution, receipts and memory reuse](docs/owned-execution.md).
 See [setup, APIs, limits and recovery](docs/lisp.md).
+Persistent Lisp can optionally inspect parser-backed disk snapshots and read-only
+LSP results through `kioku.code`. The provider must advertise V1; published
+`dsh-lsp-server` v0.1.12 does not. See the [local provider prerequisite](patches/code-intelligence/README.md) and [API and budgets](docs/lisp.md#read-only-code-intelligence).
 
 ## Typed decisions (Jev / Laya / Nimble)
 
@@ -178,3 +182,5 @@ are optional; `memoryReuse.mode: off` disables this additional selection.
 ObservationPack (`observationPack: { mode: auto }`) preserves large successful native tool results for two model calls, then replaces them with excerpts and an `observation_read` handle. [Semantic compaction](docs/semantic-compaction.md) evaluates TODO completion boundaries and selectively shortens old tool results before native automatic compaction in normal, Enno and Lisp modes. It defaults to `semanticCompaction: { mode: auto, preemptive: true, budgetMs: 5000 }` and requires a ready typed-decision backend and supported native services. Inspect activation and the last outcome with `/kioku-decisions status`.
 
 Laya compaction separately defaults to `typedDecisions.laya-coreml.compaction.mode: off`. Explicit `shadow` evaluates without changing history; `auto` remains `experimental_not_qualified`. This switch preserves ObservationPack and native summaries. Akinator uses only the verified debug/research/writing range, and optional Skill selection uses up to four complete candidates with at most one model-selected addition. See [Laya settings and evaluation](docs/semantic-compaction.md#local-laya).
+
+For the optional V1 code provider, see [installation and verified platform status](docs/code-intelligence.md).

package/THIRD_PARTY_NOTICES.md

@@ -86,3 +86,11 @@ Permission is hereby granted, free of charge, to any person obtaining a copy of
 The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
 
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+# dsh-auth and model transports
+
+The selected MIT-licensed dsh-auth sources are vendored at
+`348082d873f563ed76ec7a70f2ff717038d5fe70`. See
+[provenance and local changes](docs/dsh-auth-provenance.md) and the complete
+[upstream license](docs/dsh-auth-LICENSE.txt). Bundled AI SDK dependency licenses
+are shipped in `dist/dsh/models/vendor/THIRD_PARTY_NOTICES.txt`.