tonedial 0.1.5 → 0.1.7

package/dist/core/reader.js

@@ -1,6 +1,7 @@
 // Hooks may run without PATH or after the package moves. The seeded reader is standalone.
 import { CONTEXT_ARTIFACT_FILENAME, CONTEXT_GUIDE_FILENAME, } from "./paths.js";
-export const READER_PROTOCOL_VERSION = 2;
+import { DELIVERY_OFF_MARKER } from "./anchors.js";
+export const READER_PROTOCOL_VERSION = 3;
 export const GUIDE_FORMAT_VERSION = 1;
 export const GUIDE_FORMAT_MARKER = `<!-- tonedial-guide:${GUIDE_FORMAT_VERSION} -->`;
 /** Stable, short repair guidance shared by the emitted source and diagnostics. */
@@ -25,6 +26,7 @@ export const READER_REPAIR_HINTS = {
     event: "use a supported hook event",
     input: "retry the hook with a valid event payload",
     response: "retry the hook when the response is available",
+    "delivery-marker": "regenerate the tone artifact",
     "style-marker": "regenerate the tone artifact",
     unreadable: "run tonedial doctor and resolve the reported path",
 };
@@ -50,6 +52,7 @@ const GUIDE_FILENAME = ${JSON.stringify(CONTEXT_GUIDE_FILENAME)};
 const ARTIFACT_FILENAME = ${JSON.stringify(CONTEXT_ARTIFACT_FILENAME)};
 const LOCK_FILENAME = "operations.lock";
 const GUIDE_MARKER = ${JSON.stringify(GUIDE_FORMAT_MARKER)};
+const DELIVERY_OFF_MARKER = ${JSON.stringify(DELIVERY_OFF_MARKER)};
 const REPAIR_HINTS = ${JSON.stringify(READER_REPAIR_HINTS)};
 const PROVIDERS = new Set(["codex", "claude", "antigravity"]);
 const EVENTS = new Set(["SessionStart", "UserPromptSubmit", "Stop", "PreInvocation"]);
@@ -338,6 +341,13 @@ function styleMarker(artifact) {
   return match === null ? null : { verbosity: Number(match[1]), care: Number(match[2]) };
 }
 
+function deliveryEnabled(artifact) {
+  const line = artifact.split(/\r?\n/, 3)[2] ?? "";
+  if (line === DELIVERY_OFF_MARKER) return false;
+  if (line.startsWith("<!-- tonedial-delivery:")) throw new ReaderFailure("delivery-marker");
+  return true;
+}
+
 // shortcut: ambiguous data-like prose skips feedback; refine only with verified host format metadata.
 function literalPayload(text) {
   const value = text.trim();
@@ -400,8 +410,12 @@ async function main() {
   const hint = providerHint(args);
   try {
     const { provider, state, event } = parseArgs(args);
-    const input = event === "Stop" ? await hookInput() : null;
     const pair = readPair(state);
+    if (!deliveryEnabled(pair.artifact)) {
+      empty(provider, event);
+      return;
+    }
+    const input = event === "Stop" ? await hookInput() : null;
     if (event === "Stop") {
       const result = styleFeedback(pair, input);
       if (result.diagnostic !== null) {

package/dist/core/resolve.js

@@ -5,6 +5,7 @@ export function toCompileInput(stored) {
         // The slug rides in the generation comment, so the model reads it. `unsaved` is what the
         // artifact says once tone settings have moved away from the profile that named them.
         preset: stored.unsaved ? null : stored.preset,
+        ...(stored.enabled ? {} : { enabled: false }),
         axes: stored.axes,
         speech_level: stored.speech_level,
         persona: hasPersona ? p : null,

package/dist/core/seeds.js

@@ -11,13 +11,13 @@ import { captureRawEntry, caseRenameMatchesCurrent, isNoop, planChange, planEntr
 import { BUNDLED, builtinPresetDir, LEGACY_BUILTIN_SLUGS, RETIRED_PRESETS } from "./presets.js";
 import { SKILL_MD, SKILL_NAME, SKILL_TRAITS_MD } from "./skill.js";
 // Bump for changed generated content; freshness also checks each managed seed's bytes/provenance.
-export const SEED_VERSION = 21;
+export const SEED_VERSION = 24;
 /** The state-root operating boundaries. The compiler owns the current tone separately. */
 export const GUIDE_MD = `${GUIDE_FORMAT_MARKER}
 ToneDial changes manner only; it never expands task scope or permissions.
 Use the ToneDial CLI for configuration changes.
 AGENTS.md is the operating guide, TONE.md is the current compiled tone, and the ToneDial skill
-explains explicit in-session tuning and reloads.
+explains delivery controls, explicit in-session tuning and reloads.
 `;
 /** Existing generated runtime families are repaired without inferring any native connection. */
 export function generatedSeedSelection(paths, config, native, t = catalogue("en").cli) {
@@ -73,7 +73,7 @@ export function seedFiles(paths, selection) {
     };
     const native = [
         reader,
-        { id: "skill/body", version: 21, path: join(paths.skill, SKILL_NAME, "SKILL.md"), label: `skill/${SKILL_NAME}/SKILL.md`, contents: SKILL_MD },
+        { id: "skill/body", version: 22, path: join(paths.skill, SKILL_NAME, "SKILL.md"), label: `skill/${SKILL_NAME}/SKILL.md`, contents: SKILL_MD },
         {
             id: "skill/traits",
             version: 12,

package/dist/core/skill.js

@@ -5,6 +5,7 @@ export const SKILL_NAME = "tonedial";
 /** The current command envelope, shared by both installed control entry points. */
 const JSON_MD = `Require zero exit status and a JSON result with \`ok: true\` and \`schema: 3\`
 for every successful CLI step before continuing. Parse JSON rather than scraping human output.
+\`get --json\`, \`show --json\`, and \`compile --check --json\` report the shared \`enabled\` delivery state.
 \`chars\` reports the current TONE.md Unicode character count; no size target or maximum applies.
 Schema 3 removes guard and ceiling fields and reports advisory \`riskAxes\`; persisted config
 remains schema 2. Custom profiles use preset schema 2; legacy schema 1 and journal formats
@@ -65,6 +66,10 @@ Require zero exit status, \`ok: true\`, and \`schema: 3\` before continuing.
 This read-only command reports destinations; it does not prove that either file exists,
 matches the saved settings, or has been loaded.
 
+If it reports \`enabled: false\`, do not read or apply the context pair. Report that the settings
+are saved but delivery remains off. This also applies to tone changes made while delivery is off.
+Continue below only when it reports \`enabled: true\`.
+
 Read the complete UTF-8 file at the returned absolute \`agentsPath\` first (\`AGENTS.md\`).
 Its first line must be \`${GUIDE_FORMAT_MARKER}\`; otherwise stop the reload.
 Then read the complete UTF-8 file at the returned absolute \`path\` (\`TONE.md\`).
@@ -86,6 +91,22 @@ This reload affects only the current conversation. It does not fire a lifecycle
 earlier context, or reload other open sessions. Future delivery still depends on an installed,
 enabled, and trusted native hook.
 `;
+const DELIVERY_MD = `## Pause and resume delivery
+
+For an explicit request to turn ToneDial off, run \`tonedial off --json\`, then run
+\`tonedial compile --check --json\`. Require both results to report \`enabled: false\`.
+Do not read the guide or artifact afterward. Report that saved settings, profiles and the full
+\`TONE.md\` remain. The current ToneDial reader emits no ToneDial context.
+Already delivered context cannot be removed from an open conversation; stop applying the saved
+manner where possible and name a fresh conversation as the clean check. Do not promise a perfect reset.
+The successful command proves the marker was saved, not that a native reader ran.
+A reader installed before this switch must be refreshed through the user's existing tools and scope
+before it can honor the marker.
+
+For an explicit request to turn ToneDial on, run \`tonedial on --json\`, then follow the reload
+procedure below. Turning delivery on does not prove that a native hook is installed, trusted,
+enabled or running. Neither command changes axes, persona, address, register, safeword or profiles.
+`;
 /** Explicit setting requests use the same CLI mapping through either installed entry point. */
 const SETTINGS_MD = `## Explicit settings
 
@@ -195,6 +216,12 @@ If repair fails, report its phase, affected path, safe error code and operation
 Some file changes may already be applied; a failure is not evidence that all files stayed unchanged.
 Preserve the operation record and follow the reported scoped read-only diagnosis.
 Default doctor output focuses on blockers; \`--verbose\` and JSON retain the operation history.
+If doctor reports an unreadable operation record, use its exact scoped
+\`doctor --fix --quarantine-operation <id>\` command. Preview or approve that replacement through
+the normal repair gate; never delete the record directly. The replacement stops the damaged
+record from blocking recovery, while the repair journal keeps its original bytes and mode for
+explicit rollback. If several records are unreadable, run the next exact command doctor reports;
+each invocation quarantines one record, and the last continues the application rebuild.
 For an explicitly selected stopped operation, \`doctor --fix --from-operation <id>\` continues
 application repair using valid current settings first; it does not undo the earlier changes.
 Preview that exact ID and scope with \`--dry-run\` before applying the approved repair.
@@ -214,7 +241,7 @@ Do not claim that setup, repair, or migration proves host activation or model ad
  */
 export const SKILL_MD = `---
 name: tonedial
-description: Use when the user wants to check, change, or reload ToneDial manner, tone, personality, register, preset, user description, agent role, address terms, or safeword — including requests like "be gentler", "act as a database specialist", "remember my background in ToneDial", "more formal", "call me friend", or asking what the current tone settings are.
+description: Use when the user wants to check, change, pause, resume, or reload ToneDial manner, tone, personality, register, preset, user description, agent role, address terms, or safeword — including requests like "turn ToneDial off", "be gentler", "act as a database specialist", "remember my background in ToneDial", "more formal", "call me friend", or asking what the current tone settings are.
 ---
 
 # tonedial
@@ -233,6 +260,7 @@ the user to complete CLI installation and explicit setup; do not install it or g
 tonedial get --json
 \`\`\`
 
+The top-level \`enabled\` field reports whether native delivery is on.
 The \`values\` object carries the twelve axis levels and the separate settings under their
 editable keys. An unset setting is \`null\`; description text is returned in full.
 For the formatted overview, preset state and advisory \`riskAxes\`, use \`tonedial show --json\`.
@@ -277,9 +305,11 @@ ${SETTINGS_MD}
 
 ${SETUP_MD}
 
+${DELIVERY_MD}
+
 ## Apply it in this session
 
-Successful \`set\`, \`address\`, \`persona\`, \`use\`, \`reset\`, \`save\`, and approved \`create\` commands recompile \`TONE.md\`; that is a saved state
+Successful \`on\`, \`off\`, \`set\`, \`address\`, \`persona\`, \`use\`, \`reset\`, \`save\`, and approved \`create\` commands recompile \`TONE.md\`; that is a saved state
 change, not evidence of a session reload.
 
 ${RELOAD_MD}
@@ -294,9 +324,9 @@ in the same message still faces every confirmation and permission check it other
 For an explicit request to restore the default axes, run \`tonedial reset --json\`, then follow
 the reload steps above. Saved presets remain available through \`tonedial use <slug> --json\`.
 Reset restores axes only; it does not disable hooks, unload instructions, or clear persona,
-safeword, or other settings. ToneDial has no persistent tone-off switch.
-For "turn tone off" or an ambiguous "go back to normal", explain that limit and ask whether
-the user wants an axis reset before changing state; do not silently equate off with reset.
+safeword, or other settings. Use \`tonedial off --json\` to pause delivery without changing them.
+For an ambiguous "go back to normal", ask whether the user means delivery off or an axis reset;
+do not silently equate them.
 
 ## A separate test conversation
 
@@ -452,12 +482,13 @@ selected by critique or persona. Bravado grades effort claims without replacing
  * command name stays `/tone` even though the tool is `tonedial`: it is what a person types
  * mid-sentence, and the two extra characters are paid every time.
  */
-export const TONE_COMMAND_VERSION = 13;
+export const TONE_COMMAND_VERSION = 16;
 export const TONE_COMMAND_MD = `---
-description: Check, change, or reload this agent's tone, preset, or ToneDial settings
+description: Check, change, pause, resume, or reload this agent's tone, preset, or ToneDial settings
 ---
 
-Run \`tonedial get --json\` and report the requested current settings from \`values\` in plain language.
+Run \`tonedial get --json\` and report the requested current settings from \`values\` and the
+delivery state from \`enabled\` in plain language.
 Use the same installed CLI and environment throughout.
 ${JSON_MD}
 Otherwise report the failed step and stop that flow.
@@ -479,13 +510,15 @@ ${SETTINGS_MD}
 
 ${SETUP_MD}
 
+${DELIVERY_MD}
+
 ${RELOAD_MD}
 
 An explicit axis-reset request uses \`tonedial reset --json\` followed by the same reload steps.
 Reset restores axes only; it does not disable hooks, unload instructions, or clear persona,
 safeword, or other settings. Saved presets remain available.
-\`/tone off\` is not a persistent tone-off switch. Explain that limit and ask whether the user
-wants an axis reset before changing state; never silently equate off with reset.
+For an ambiguous \`/tone normal\`, ask whether the user means delivery off or an axis reset;
+never silently equate them.
 
 Never edit ToneDial's config, guide, or artifact directly; the CLI is the source of truth.
 `;

package/dist/wiring/apply.js

@@ -832,7 +832,7 @@ function validateEntryRebuildAction(action, prepared = false) {
     const value = snapshotRecord(action.metadata ?? null);
     if (action.kind !== "entry-rebuild" || !normalizedPath(action.path) || action.realPath !== action.path || value === null ||
         Object.keys(value).sort().join(",") !== ["schema", "reason", "boundary", "boundaryIdentity", "parents", "stash", "stashIdentity", "archive", "prepared", "preparedIdentity", "createdParents", ...(Object.hasOwn(value, "recipes") ? ["recipes"] : [])].sort().join(",") ||
-        value.schema !== 1 || !["generated", "restore-config", "restore-preset"].includes(value.reason) ||
+        value.schema !== 1 || !["generated", "restore-config", "restore-preset", "quarantine-operation"].includes(value.reason) ||
         !normalizedPath(value.boundary) || !lexicallyInside(action.path, value.boundary) || !identityTextValue(value.boundaryIdentity) ||
         !Array.isArray(value.parents) || value.parents.length === 0 || !normalizedPath(value.stash) ||
         dirname(value.stash) !== dirname(action.path) || !new RegExp(`^\\.${basename(action.path).replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\.tonedial-rebuild-[0-9a-f]{32}$`).test(basename(value.stash)) ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tonedial",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Set a coding agent's manner once and keep it across every project.",
   "license": "MIT",
   "type": "module",