M0: compilable skeleton — Kigi 0.1.0 fork surgery

Hard fork of xai-org/grok-build (Apache-2.0) re-targeted as Kigi, an unofficial Kimi Code CLI community build. Rename & identity - 72 xai-*/xai-grok-* crates -> kigi-* (explicit: xai-grok-pager-bin -> kigi-bin [binary `kigi`], xai-grok-pager -> kigi-tui; rest mechanical); ptyctl, ptyctl-cli, third_party/ unchanged; proto package xai.grok.tools.v1 -> kigi.tools.v1 - Config home ~/.kigi (KIGI_SHARE_DIR override), env prefix GROK_* -> KIGI_*, `kigi --version` carries the unofficial-community-build notice - clap identity, help text, startup banner, prompt templates rebranded (templates re-encrypted) Deletions (PRD removal list #5/#6/#7/#9/#10) - voice input (xai-grok-voice) and all TUI wiring - telemetry: Mixpanel client, external OTel stream, Sentry, OTLP layers, trace/GCS/S3 upload queues (kigi-file-utils halved), workspace upload module & dc_log, heap-profile uploader, auth-diagnostics uploader, session-analytics halves of feedback; local zero-egress observability preserved in new kigi-log crate (unified log, --debug firehose, subsystem file logs, opt-in instrumentation) - announcements (crate, remote-settings fields, TUI surfaces) - plugin marketplace (crate, sources/browse/CTA/extensions-modal tab); direct plugin install/uninstall/update via kigi-agent git_install kept - relay/gateway/assets endpoints and features (agent relay, headless relay transport, gateway bridge, LeaderEnvUrls); leader IPC socket now ~/.kigi/leader.sock + KIGI_LEADER_SOCKET, no ws-url derivation - functional types rehomed instead of deleted: PermissionMode -> kigi-config-types, McpInitStrategy -> kigi-mcp, PrCreationSource -> session signals, TerminalDiagnostics -> kigi-pager-render, agent_id -> shell util Endpoints - kigi-env rewritten: single production KigiEndpoints {coding_api_base_url https://api.kimi.com/coding/v1 (KIGI_CODE_BASE_URL), oauth_host https://auth.kimi.com (KIGI_OAUTH_HOST), update_base_url (GitHub Releases API), upgrade_page_url}; GrokBuildEnvironment enum deleted Toolchain & workspace hygiene - Rust 1.97.0 pinned; edition 2024; full cargo update; git2 hoisted to workspace at 0.21 (Option->Result API migration), quick-xml 0.41 - Root Cargo.toml hand-maintained (PRD §8.1): version 0.1.0 inherited by all members, members sorted, unused deps pruned - cargo-deny advisories gate (deny.toml with documented transitive exceptions); CI workflow (check/clippy/fmt/deny/test, macOS+Linux) - cross-crate test seams re-gated behind `test-support` cargo feature; insta snapshot baselines renamed to the kigi_tui prefix - clippy --workspace --all-targets: zero warnings; fmt clean Fixes surfaced by the port - updater probe/installer divergence (bin/kigi vs bin/grok symlink set) - idle model-metadata refresh dead under KIGI_CODE_BASE_URL override (new is_effective_coding_endpoint_url, loopback+override aware) - macOS symlinked-TMPDIR fixture canonicalization (foreign_sessions, fast-worktree); RSS measurement tests serialized via serial_test Docs & legal (Apache §4) - NOTICE added (upstream attribution + change statement); THIRD-PARTY notices sustained; kigi-tools ported-code notices extended; README, CONTRIBUTING, SECURITY, AGENTS.md rewritten Out of scope for M0 (tracked): Kimi auth/inference (M1), search/fetch, command parity, config import (M2), Computer Hub excision & final brand-token sweep (M2), distribution & self-update rewrite (M3).
2026-07-17 05:31:01 -04:00
commit d6c20fc13f
2612 changed files with 1353757 additions and 0 deletions
@@ -0,0 +1,127 @@
+//! Reminder policy — wraps kigi-tools reminder config.
+
+/// Default per-prompt fire cap for the runtime turn-end TodoGate. Used
+/// only as the default for `TodoGateConfig`; the runtime consumer reads
+/// the live value from `ReminderPolicy.todo_gate.max_fires_per_prompt`,
+/// so this constant is NOT a hardcoded cap.
+pub const DEFAULT_TODO_GATE_MAX_FIRES: u32 = 2;
+
+/// Session-level system reminder policy.
+///
+/// Controls whether system reminders are enabled and configures
+/// the TodoNudge and TodoGate behavior.
+#[derive(Debug, Clone)]
+pub struct ReminderPolicy {
+    /// Whether system reminders are enabled at all.
+    pub enabled: bool,
+    /// Configuration for the periodic TodoWrite nudge reminder.
+    pub todo_nudge: TodoNudgeConfig,
+    /// Configuration for the runtime turn-end TodoGate.
+    pub todo_gate: TodoGateConfig,
+}
+
+impl Default for ReminderPolicy {
+    fn default() -> Self {
+        Self {
+            enabled: true,
+            todo_nudge: TodoNudgeConfig::default(),
+            todo_gate: TodoGateConfig::default(),
+        }
+    }
+}
+
+/// Configuration for the TodoWrite nudge reminder.
+///
+/// The system will remind the model to use `todo_write` when it
+/// hasn't done so within a configurable number of turns.
+#[derive(Debug, Clone)]
+pub struct TodoNudgeConfig {
+    /// Whether the TodoNudge reminder is enabled.
+    pub enabled: bool,
+    /// Number of turns since last `todo_write` call before nudging.
+    pub turns_since_todo_write: u32,
+    /// Minimum turns between nudge reminders.
+    pub turns_between_reminders: u32,
+}
+
+impl Default for TodoNudgeConfig {
+    fn default() -> Self {
+        Self {
+            enabled: true,
+            turns_since_todo_write: 3,
+            turns_between_reminders: 5,
+        }
+    }
+}
+
+/// Configuration for the runtime turn-end TodoGate.
+///
+/// The gate inspects `TodoState` after every content-only assistant
+/// message and forces another turn via `<system-reminder>` injection
+/// if pending/unbacked-in-progress todos remain — see
+/// `kigi-shell::session::acp_session::evaluate_todo_gate`.
+///
+/// **Disabled by default.** Operators opt in via the remote
+/// `todo_gate_enabled = true` remote settings key, or via the
+/// `--todo-gate` CLI flag (session-scoped force-enable, highest
+/// precedence).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct TodoGateConfig {
+    /// Whether the gate runs at all.
+    pub enabled: bool,
+    /// Hard cap on how many times the gate may fire per user prompt
+    /// before the next turn is allowed to end with `TurnOutcome::Completed`.
+    /// Bounds the worst-case extra inference cost.
+    pub max_fires_per_prompt: u32,
+}
+
+impl Default for TodoGateConfig {
+    fn default() -> Self {
+        Self {
+            enabled: false,
+            max_fires_per_prompt: DEFAULT_TODO_GATE_MAX_FIRES,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn default_todo_gate_is_disabled_with_const_cap() {
+        let cfg = TodoGateConfig::default();
+        assert!(!cfg.enabled, "TodoGate must be opt-in");
+        assert_eq!(cfg.max_fires_per_prompt, DEFAULT_TODO_GATE_MAX_FIRES);
+        assert_eq!(DEFAULT_TODO_GATE_MAX_FIRES, 2);
+    }
+
+    #[test]
+    fn reminder_policy_default_disables_gate_but_keeps_nudge_and_global_enabled() {
+        let policy = ReminderPolicy::default();
+        assert!(
+            policy.enabled,
+            "global system reminders stay enabled by default"
+        );
+        assert!(
+            !policy.todo_gate.enabled,
+            "TodoGate ships disabled; remote/local opt-in required"
+        );
+        assert_eq!(policy.todo_gate.max_fires_per_prompt, 2);
+        // The two reminder mechanisms are independent — flipping one
+        // must not change the other (regression guard).
+        assert!(policy.todo_nudge.enabled);
+    }
+
+    #[test]
+    fn todo_gate_enable_does_not_disturb_nudge() {
+        // Remote opt-in (or `[reminder.todo_gate] enabled = true` local
+        // config) flips the gate to on without touching the periodic
+        // TodoNudge as a side-effect.
+        let mut policy = ReminderPolicy::default();
+        policy.todo_gate.enabled = true;
+        assert!(policy.todo_gate.enabled);
+        assert!(policy.todo_nudge.enabled, "TodoNudge must stay enabled");
+        assert!(policy.enabled, "global enable must stay true");
+    }
+}