@vincemakes/kiso-code 0.1.14 → 0.1.16

package/dist/index.js

@@ -17,6 +17,9 @@
  */
 import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { createInterface } from "node:readline";
+import { Body } from "./body.js";
+import { editFileDiff, writeFileDiff } from "./diff.js";
+import { MODES, getMode, modeExtensions, modeFromEnv, modeSystemPrompt, setMode } from "./mode.js";
 import { Editor, PROMPT as EDITOR_PROMPT } from "./editor.js";
 import { homedir, tmpdir } from "node:os";
 import { dirname, join } from "node:path";
@@ -26,17 +29,6 @@ import { createFauxProvider } from "@vincemakes/kiso-evals";
 import { createCodingTools } from "@vincemakes/kiso-tools-node";
 import { escapeTerminal, foldResult, foldThinking, palette, renderEvent, renderSessionLine, renderStatusLine, renderTerminalGap, renderToolSummary, } from "./render.js";
 import { Dock } from "./dock.js";
-const PERMISSION_POLICY = {
-    rules: [
-        { tool: "read_file", action: "allow" },
-        { tool: "list_dir", action: "allow" },
-        { tool: "search_text", action: "allow" },
-        { tool: "write_file", action: "defer" },
-        { tool: "edit_file", action: "defer" },
-        { tool: "shell", action: "defer" },
-    ],
-    default: "deny",
-};
 /** 发现#11: KISO_HOME is the ONE root — every default path derives from
  *  it (sessions, trust, extensions, mcp config, skills). The dedicated
  *  env vars (KISO_EXTENSIONS_DIR / KISO_MCP_CONFIG / KISO_SKILLS_DIR)
@@ -209,17 +201,15 @@ function makeLineInput() {
 /** v2b: the bottom-anchored UI — docked only on a color TTY; pipes and
  *  NO_COLOR stay the v2a line mode byte-for-byte. */
 const dock = new Dock();
-/** v2b: body output routes through the dock when docked (the cursor into
- *  the scroll region, then back to the input line); otherwise a plain
- *  write — pipes are byte-identical to v2a. */
-function bodyWrite(text) {
-    if (dock.active)
-        dock.writeBody(text);
-    else
-        process.stdout.write(text);
-}
+/** v2d: the body renderer — the ONE writer of the stdout scroll region
+ *  (the frozen area + the active tail). Pipes run it in passthrough (the
+ *  v2b/v2c line-mode bytes, byte-for-byte). Created in main; closed on
+ *  every exit path. */
+let body;
+/** v2d: body output routes through the cell renderer — the single writer.
+ *  bodyLog adds the trailing newline; internal newlines are preserved. */
 function bodyLog(text) {
-    bodyWrite(`${text}\n`);
+    body.raw(text.split("\n"));
 }
 /** v2b: the spinner merged into the STATUS BAR (the v2a standalone glyph
  *  is gone) — docked only, 200ms rotation between the request and the
@@ -261,6 +251,21 @@ function bannerExtensionText() {
         parts.push(`project: ${projectExtensions.map((e) => e.name).join(", ")}`);
     return ` · [${total} extension${total === 1 ? "" : "s"}: ${parts.join(" · ")}]`;
 }
+/** Modes: the status-bar indicator — the default tier shows nothing; the
+ *  others show their blue name, the dangerous ones (plan/bypass) with the
+ *  ⚠ prefix. */
+function modeStatusText() {
+    if (getMode() === "default")
+        return "";
+    const p = palette();
+    const danger = getMode() === "plan" || getMode() === "bypass" ? "⚠ " : "";
+    return `${p.blue}${danger}${getMode()}${p.reset}`;
+}
+/** Modes: append the mode indicator to a composed status base. */
+function statusWithMode(base) {
+    const mode = modeStatusText();
+    return mode === "" ? base : `${base} · ${mode}`;
+}
 /** E1: the startup banner line(s) — TTY: logo + merged extensions; off-TTY:
  *  the historical `[N extensions: ...]` standalone line (zero change). */
 function extensionsBanner() {
@@ -519,15 +524,26 @@ async function makeAgent(fauxSkipTurns = 0, input) {
         // Area 5: the coding tools are bound to the workspace — every path
         // they touch is canonicalized inside cwd, escapes are refused.
         tools: [...createCodingTools({ workspaceRoot: process.cwd() })],
-        permissionPolicy: PERMISSION_POLICY,
-        systemPrompt: composeSystemPrompt(process.cwd()),
+        // Modes: the five tiers ride the E1 policy chain (mode:<tier>
+        // extensions, current tier first) — the old static PERMISSION_POLICY
+        // is gone, its semantics live in the "default" tier. The banner
+        // still counts loadedExtensions only — the modes are in-process,
+        // never a file extension.
+        systemPrompt: (() => {
+            const sp = composeSystemPrompt(process.cwd());
+            const extra = modeSystemPrompt();
+            return extra === undefined ? sp : `${sp}\n\n${extra}`;
+        })(),
         // C 区: microcompact is ON by default in the product — threshold =
         // half the model window (KISO_CONTEXT_WINDOW override included;
         // 200k window → 100k tokens). Long sessions compact old read/list/
         // search/shell outputs instead of silently growing past the window.
         microcompact: { thresholdTokens: contextWindowTokens() / 2 },
         maxTurns: 20,
-        extensions: loadedExtensions,
+        // Modes: the five tiers join at the CHAIN HEAD, before the user/
+        // project extensions (the deny>ask>allow composition keeps a user
+        // deny winning over any mode tier — bypass included).
+        extensions: [...modeExtensions(), ...loadedExtensions],
         ...(provider !== undefined
             ? {
                 provider,
@@ -700,43 +716,48 @@ const DEFAULT_CONTEXT_WINDOW = 200_000;
  * line's form; `liveInput` (non-null only in interactive chat) carries the
  * last line THIS process's readline consumed — the double-echo filter.
  */
-async function consumeRun(session, run, input, turnNo, lastToolRef, faux, liveInput, lastThinking, statusCb) {
+/** v2e: the approval-moment mini-diff — edit_file/write_file changes as
+ *  ± lines; other tools get null (no diff, no cost). The file read is
+ *  best-effort: an unreadable file yields NO diff, never a failure —
+ *  the diff must never break the approval. */
+function approvalDiff(name, input) {
+    if (name !== "edit_file" && name !== "write_file")
+        return null;
+    const path = typeof input.path === "string" ? input.path : "";
+    if (path === "")
+        return null;
+    let oldContent = null;
+    try {
+        oldContent = readFileSync(path, "utf8");
+    }
+    catch {
+        // a new write_file target (or an unreadable one) — all + degrades
+    }
+    try {
+        if (name === "edit_file") {
+            const search = typeof input.search === "string" ? input.search : "";
+            const replace = typeof input.replace === "string" ? input.replace : "";
+            if (search === "")
+                return null;
+            return editFileDiff(oldContent ?? "", search, replace);
+        }
+        const content = typeof input.content === "string" ? input.content : "";
+        return writeFileDiff(oldContent, content);
+    }
+    catch {
+        return null; // never let the diff break the approval
+    }
+}
+async function consumeRun(session, run, input, turnNo, faux, liveInput, statusCb) {
     let last;
-    // B 区: tool_call_end → (name, input) for the summary; tool_result →
-    // one summary line. Usage events feed the status line.
-    const pendingCalls = new Map();
     let usage = { in: null, out: null, cache: null, known: false };
-    // v2b: thinking blocks buffer and fold to ONE dim line at the block's
-    // end (foldThinking); the FULL text goes to /think.
-    let thinkingBuf = "";
-    const flushThinking = () => {
-        if (thinkingBuf === "")
-            return;
-        lastThinking.current = thinkingBuf;
-        bodyWrite(foldThinking(thinkingBuf));
-        thinkingBuf = "";
-    };
-    let thinkingOpen = false;
-    // v2b: liveness merged into the status bar (docked); a running timer
-    // shows "running <tool> Ns" during a tool execution.
-    const stopSpinner = startStatusSpinner();
-    let stopRunning = null;
-    let firstEvent = true;
     try {
         for await (const ev of run) {
-            if (firstEvent) {
-                firstEvent = false;
-                stopSpinner();
-            }
             last = ev;
-            // v2a (双回显): the interactive readline already echoed an input THIS
-            // process consumed — rendering the event again is the double echo.
-            // Replayed history (recovery/resume — nobody typed) keeps the event
-            // render. Deterministic: exact content match with the consumed line,
-            // on a TTY (the only place an echo exists to hand over).
+            // v2a (双回显): the interactive echo was already rendered by the
+            // input source — rendering the event again is the double echo.
             // v2b: DOCKED — the echo lives in the input row (H), NOT the body;
-            // the body render is the ONLY visible copy of the sent line. The
-            // user's typed text must not vanish after Enter.
+            // the body render is the ONLY visible copy of the sent line.
             if (ev.type === "user_input" &&
                 liveInput !== null &&
                 liveInput.current === (typeof ev.content === "string" ? ev.content : "") &&
@@ -744,78 +765,91 @@ async function consumeRun(session, run, input, turnNo, lastToolRef, faux, liveIn
                 !dock.active) {
                 continue;
             }
-            const prevThinking = thinkingOpen;
-            thinkingOpen = ev.type === "thinking";
-            if (prevThinking && !thinkingOpen)
-                flushThinking();
-            if (ev.type === "thinking") {
-                thinkingBuf += ev.text;
-                continue;
-            }
-            if (ev.type === "tool_call_end") {
-                pendingCalls.set(ev.callId, { name: ev.name, input: ev.input ?? {} });
-            }
-            if (ev.type === "tool_execution_started") {
-                stopRunning = startRunningTimer(ev.name);
-            }
-            if (ev.type === "tool_result") {
-                stopRunning?.();
-                stopRunning = null;
-                const call = pendingCalls.get(ev.callId);
-                pendingCalls.delete(ev.callId);
-                if (call !== undefined) {
+            // v2d: EVERY event only mutates a cell — the Body is the single
+            // writer of the scroll region, so interleaving is impossible by
+            // construction (ADR-0040).
+            switch (ev.type) {
+                case "user_input":
+                    body.userLine(typeof ev.content === "string" ? ev.content : "");
+                    break;
+                case "thinking":
+                    body.thinkingAppend(ev.text);
+                    break;
+                case "tool_call_end":
+                    body.toolStart(ev.name, ev.callId, ev.input ?? {});
+                    break;
+                case "tool_execution_started":
+                    body.toolRunning(ev.callId);
+                    break;
+                case "tool_execution_succeeded":
+                    body.toolSucceeded(ev.callId);
+                    break;
+                case "tool_execution_failed":
+                    body.toolFailed(ev.callId, ev.error);
+                    break;
+                case "tool_result": {
                     const text = typeof ev.content === "string" ? ev.content : "";
-                    lastToolRef.current = { name: call.name, input: call.input, result: { content: text, isError: ev.isError } };
-                    bodyLog(renderToolSummary(call.name, call.input, { content: text, isError: ev.isError }));
+                    body.toolResult(ev.callId, { content: text, isError: ev.isError });
+                    break;
                 }
-            }
-            if (ev.type === "usage") {
-                usage = { in: ev.inputTokens, out: ev.outputTokens, cache: ev.cacheRead, known: ev.known };
-                statusCb?.(usage, estimateCtxRatio(session));
-            }
-            if (ev.type === "uncertain_pending") {
-                // 裁决 #12 (ADR-0038): the ⚠ line is pure INFORMATION now — the
-                // approval chain guards retries, and the human question belongs
-                // only to the crash window's recovery flow (resolveUncertains).
-                // Old logs may still carry the event; replay shows the fact.
-                bodyLog(`\n⚠ ${escapeTerminal(ev.name)} FAILED — the side effect may have applied.\n  ${escapeTerminal(ev.error)}\n`);
-                continue;
-            }
-            const rendered = renderEvent(ev, prevThinking);
-            if (rendered.prompt) {
-                // v2b (docked): the detail scrolls into the body; the question
-                // takes over the status position; the answer lands at the input
-                // line. Pipes keep the v2a inline render.
-                bodyWrite(rendered.text);
-                const decisionId = ev.decisionId;
-                const name = ev.name;
-                // 八: the tool name is model text — escaped on every output path.
-                const answer = await ask(input, `approve ${escapeTerminal(name)}? (y/n) `);
-                if (answer === CANCELLED) {
-                    // 十: a cancellation is a CONSERVATIVE denial, explicitly
-                    // distinguished from the user typing "n".
-                    bodyLog("[approval cancelled — treated as a denial]\n");
-                    await session.approve(decisionId, false);
-                    continue;
+                case "text_delta":
+                    body.textAppend(ev.text);
+                    break;
+                case "text_end":
+                    body.textEnd();
+                    break;
+                case "usage":
+                    usage = { in: ev.inputTokens, out: ev.outputTokens, cache: ev.cacheRead, known: ev.known };
+                    statusCb?.(usage, estimateCtxRatio(session));
+                    break;
+                case "uncertain_pending":
+                    // 裁决 #12 (ADR-0038): the ⚠ line is pure INFORMATION now — the
+                    // approval chain guards retries, and the human question belongs
+                    // only to the crash window's recovery flow (resolveUncertains).
+                    body.notice(`⚠ ${escapeTerminal(ev.name)} FAILED — the side effect may have applied. ${escapeTerminal(ev.error)}`);
+                    break;
+                case "permission_requested": {
+                    // v2d: the ToolCell shows the ⏸ badge; the question takes over
+                    // the dock status position; the answer lands at the input line.
+                    // v2e: the mini-diff for edit/write at the approval moment —
+                    // the human sees the change BEFORE deciding (auto-allowed tools
+                    // skip the diff: nobody is looking).
+                    const name = ev.name;
+                    body.toolApproval(ev.callId, approvalDiff(name, ev.input ?? {}));
+                    const decisionId = ev.decisionId;
+                    const answer = await ask(input, `approve ${escapeTerminal(name)}? (y/n) `);
+                    if (answer === CANCELLED) {
+                        // 十: a cancellation is a CONSERVATIVE denial, explicitly
+                        // distinguished from the user typing "n".
+                        body.notice("[approval cancelled — treated as a denial]");
+                        await session.approve(decisionId, false);
+                        continue;
+                    }
+                    await session.approve(decisionId, answer.trim().toLowerCase().startsWith("y"));
+                    break;
+                }
+                case "terminal":
+                    statusCb?.(usage, estimateCtxRatio(session));
+                    statusCb?.(usage, estimateCtxRatio(session));
+                    // v2a rhythm: the honest label (\ndone\n — the completed
+                    // marker), the status line hugging it, then EXACTLY one blank
+                    // line before the next prompt.
+                    body.terminal(renderEvent(ev).text, renderStatusLine(turnNo, usage, estimateCtxRatio(session), faux) ?? "");
+                    break;
+                default: {
+                    // Events without a cell (stop, …) — the generic render, byte-
+                    // preserved for the pipe path.
+                    const rendered = renderEvent(ev);
+                    if (rendered.text !== "") {
+                        body.raw(rendered.text.replace(/\n$/, "").split("\n"));
+                    }
+                    break;
                 }
-                await session.approve(decisionId, answer.trim().toLowerCase().startsWith("y"));
-            }
-            else {
-                bodyWrite(rendered.text);
-            }
-            if (ev.type === "terminal") {
-                statusCb?.(usage, estimateCtxRatio(session));
-                // v2a rhythm: the status line hugs the terminal (有什么显什么 —
-                // null = nothing to show), then EXACTLY one blank line before
-                // the next prompt.
-                bodyWrite(renderTerminalGap(renderStatusLine(turnNo, usage, estimateCtxRatio(session), faux)));
             }
         }
-        flushThinking();
+        body.thinkingEnd(); // a trailing thinking block folds at the run's end
     }
     finally {
-        stopSpinner();
-        stopRunning?.();
     }
     return last;
 }
@@ -861,7 +895,7 @@ async function chat(session, faux, input) {
         (async () => {
             let last;
             try {
-                last = await consumeRun(session, run, input, myTurn, lastToolRef, faux, liveInput, lastThinking, statusCb);
+                last = await consumeRun(session, run, input, myTurn, faux, liveInput, statusCb);
                 currentRun = null;
                 // 八: a faux script that ran out of declared turns exits
                 // loudly with a non-zero status — never a silent status 0.
@@ -935,24 +969,29 @@ async function chat(session, faux, input) {
     let chain = Promise.resolve();
     let replReady = false;
     const queuedLines = [];
-    // B 区: user-turn counter for the status line, and the /last buffer.
+    // B 区: user-turn counter for the status line. /last and /think read
+    // the body (the ToolCell / ThinkingCell final states).
     let turnNo = 0;
-    const lastToolRef = { current: null };
     // v2a: the last line THIS process's readline consumed — the double-echo
     // filter (see consumeRun). Only interactive chat sets it.
     const liveInput = { current: null };
-    // v2b: the last complete thinking block, for /think.
-    const lastThinking = { current: null };
     // v2c: turns submitted while another runs are QUEUED on the chain — the
     // live count rides the status bar (+N queued).
     let queued = 0;
-    // v2b: the live status bar (docked only).
+    // v2b: the live status bar (docked only). Modes: /mode switches repaint
+    // it immediately through paintStatus (the last turn stats are kept).
+    let statusSt = null;
     const statusCb = (u, ctx) => {
         if (!dock.active)
             return;
-        const st = renderStatusLine(turnNo, u, ctx, faux);
-        const base = st === null ? `${session.id} · ${agentModel}` : `${session.id} · ${agentModel} · ${st}`;
-        dock.setStatus(queued > 0 ? `${base} · +${queued} queued` : base);
+        statusSt = renderStatusLine(turnNo, u, ctx, faux);
+        paintStatus();
+    };
+    const paintStatus = () => {
+        if (!dock.active)
+            return;
+        const base = statusSt === null ? `${session.id} · ${agentModel}` : `${session.id} · ${agentModel} · ${statusSt}`;
+        dock.setStatus(`${statusWithMode(base)}${queued > 0 ? ` · +${queued} queued` : ""}`);
     };
     // The ONE dispatcher: slash commands, exit, and turns. The recovery
     // replay routes through it too — a queued "/last" must never become a
@@ -970,16 +1009,17 @@ async function chat(session, faux, input) {
                 bodyLog(cmd("/think", "show the last full thinking block"));
                 bodyLog(cmd("/last", "show the most recent tool call's input and output"));
                 bodyLog(cmd("/status", "show session id, event count, and context estimate"));
+                bodyLog(cmd("/mode", "show the approval tier; /mode <name> switches (manual/default/accept-edits/plan/bypass)"));
                 bodyLog(cmd("exit", "leave the session"));
                 input.prompt();
             });
             return;
         }
         if (trimmed === "/think") {
-            // v2b: print the last COMPLETE thinking block — straight from the
-            // event stream, nothing stored separately (the /last pattern).
+            // v2b/v2d: print the last COMPLETE thinking block — the body holds
+            // it (the ThinkingCell's fold closes at the block's end).
             chain = chain.then(async () => {
-                const t = lastThinking.current;
+                const t = body.lastThinking();
                 if (t === null) {
                     bodyLog("[no thinking yet]");
                 }
@@ -991,11 +1031,11 @@ async function chat(session, faux, input) {
             return;
         }
         if (trimmed === "/last") {
-            // B 区: print the FULL input/output of the most recent tool call,
-            // straight from the event stream — nothing is stored separately.
-            // Runs on the chain: after any in-flight turn completes.
+            // B 区/v2d: print the FULL input/output of the most recent tool
+            // call — the body holds it (the ToolCell's final state). Runs on
+            // the chain: after any in-flight turn completes.
             chain = chain.then(async () => {
-                const tool = lastToolRef.current;
+                const tool = body.lastTool();
                 if (tool === null) {
                     bodyLog("[no tool call yet]");
                 }
@@ -1023,6 +1063,29 @@ async function chat(session, faux, input) {
             });
             return;
         }
+        if (trimmed === "/mode" || trimmed.startsWith("/mode ")) {
+            // Modes: /mode alone prints the current tier + the list;
+            // /mode <name> switches — the notice cell leaves the audit
+            // line in the body, the status bar repaints at once.
+            chain = chain.then(async () => {
+                const m = MODES.find((x) => x === trimmed.slice(5).trim());
+                if (trimmed.slice(5).trim() === "") {
+                    bodyLog(`mode ${getMode()}`);
+                    bodyLog(`tiers: ${MODES.join(" ")}`);
+                }
+                else if (m === undefined) {
+                    bodyLog(`no such mode: ${trimmed.slice(5).trim()}`);
+                    bodyLog(`tiers: ${MODES.join(" ")}`);
+                }
+                else {
+                    setMode(m);
+                    body.notice(`mode → ${m}`);
+                    paintStatus();
+                }
+                input.prompt();
+            });
+            return;
+        }
         if (trimmed === "exit" || trimmed === "") {
             input.close();
             return;
@@ -1049,7 +1112,7 @@ async function chat(session, faux, input) {
         const recoveryRun = session.resume();
         currentRun = recoveryRun;
         turnNo += 1;
-        const last = await consumeRun(session, recoveryRun, input, turnNo, lastToolRef, faux, liveInput, lastThinking, statusCb);
+        const last = await consumeRun(session, recoveryRun, input, turnNo, faux, liveInput, statusCb);
         currentRun = null;
         failOnFauxExhaustion(last, faux, input);
     }
@@ -1084,20 +1147,19 @@ async function resume(session, prompt, faux, input) {
     let currentRun = null;
     let cancelled = false;
     let turnNo = 0;
-    const lastToolRef = { current: null };
-    const lastThinking = { current: null };
     // v2b: the live status bar (docked only).
     const statusCb = (u, ctx) => {
         if (!dock.active)
             return;
         const st = renderStatusLine(turnNo, u, ctx, faux);
-        dock.setStatus(st === null ? `${session.id} · ${agentModel}` : `${session.id} · ${agentModel} · ${st}`);
+        const base = st === null ? `${session.id} · ${agentModel}` : `${session.id} · ${agentModel} · ${st}`;
+        dock.setStatus(statusWithMode(base));
     };
     const withRun = async (run) => {
         currentRun = run;
         try {
             turnNo += 1;
-            const last = await consumeRun(session, run, input, turnNo, lastToolRef, faux, null, lastThinking, statusCb);
+            const last = await consumeRun(session, run, input, turnNo, faux, null, statusCb);
             failOnFauxExhaustion(last, faux, input);
         }
         finally {
@@ -1150,7 +1212,24 @@ async function resume(session, prompt, faux, input) {
     }
 }
 async function main() {
-    const [command, arg] = process.argv.slice(2);
+    // Modes: --mode <name> wins over KISO_MODE — both applied before the
+    // first makeAgent (the tier extensions read `current` live). The flag
+    // is stripped from the positional args, so it works in any position.
+    const args = process.argv.slice(2);
+    const modeFlag = args.indexOf("--mode");
+    if (modeFlag !== -1) {
+        const m = MODES.find((x) => x === args[modeFlag + 1]);
+        if (m === undefined) {
+            console.error(`unknown mode: ${args[modeFlag + 1]} (tiers: ${MODES.join(", ")})`);
+            process.exit(2);
+        }
+        setMode(m);
+        args.splice(modeFlag, 2);
+    }
+    else {
+        setMode(modeFromEnv());
+    }
+    const [command, arg] = args;
     // 八: faux mode is the keyless demo script — an exhausted script must
     // exit non-zero, never masquerade as a successful provider run.
     const faux = process.env.ANTHROPIC_API_KEY === undefined && process.env.OPENAI_API_KEY === undefined;
@@ -1160,6 +1239,15 @@ async function main() {
     // readline elsewhere. The trust question, chat, and resume all read
     // through it; main's finally closes it on every exit path.
     const input = makeLineInput();
+    // v2d: the body renderer — active only where the dock is (a color
+    // TTY with a real size); pipes run it in passthrough, byte-for-byte.
+    body = new Body({
+        active: () => process.stdin.isTTY && palette().blue !== "" && (process.stdout.rows ?? 0) >= 4,
+        height: () => process.stdout.rows ?? 24,
+        width: () => process.stdout.columns ?? 80,
+        editCol: () => dock.editCol(),
+        onDock: () => dock.redraw(), // v2d-B: the freeze scrolls the dock up — re-pin it
+    });
     try {
         switch (command) {
             case "chat": {
@@ -1224,6 +1312,7 @@ async function main() {
         }
     }
     finally {
+        body.close(); // flush the pending frame, stop the heartbeat
         input.close();
         // E 组: every normal and abnormal exit releases the fds and writer
         // locks — no lock file is left behind.

package/dist/mode.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Modes — the five built-in approval tiers, built ON the E1 policy chain
+ * (the kernel is untouched). Each tier is an in-process "mode:<name>"
+ * extension whose decide() is live — it only speaks when it is the
+ * CURRENT tier (otherwise abstain = no opinion, ADR-0042), so /mode
+ * switches take effect immediately. The extension NAME rides the runtime's decidedBy
+ * field: an automated denial records decidedBy: "mode:<name>" — the
+ * audit sell. User-level extensions stay on the chain AFTER the mode
+ * tiers; a user deny always wins (the chain's deny>ask>allow
+ * monotonicity — bypass cannot override an extension deny).
+ */
+import type { KisoExtension } from "@vincemakes/kiso-runtime";
+export type Mode = "manual" | "default" | "accept-edits" | "plan" | "bypass";
+export declare const MODES: readonly Mode[];
+export declare function getMode(): Mode;
+export declare function setMode(m: Mode): void;
+/** The startup mode: KISO_MODE env (or the --mode flag — the CLI applies
+ *  it before the first makeAgent). */
+export declare function modeFromEnv(): Mode;
+/** The five built-in mode tiers as chain extensions — named "mode:<tier>"
+ *  so the runtime's decidedBy records exactly that (the runtime derives
+ *  approvalPolicies from extensions[].approvals, tagging each with the
+ *  extension name). The CURRENT tier is first: an all-allow chain records
+ *  decidedBy = the FIRST SPEAKER, so an auto-allow under the startup mode
+ *  names that mode honestly. Order never affects verdicts — the chain is
+ *  deny>ask>allow over the SPEAKING verdicts (abstain = no opinion), so a
+ *  user extension's deny wins over any mode tier, bypass included (the
+ *  monotonicity e2e pins it). */
+export declare function modeExtensions(): readonly KisoExtension[];
+/** The plan tier's system prompt addition — injected at startup when the
+ *  initial mode is plan (the session prompt is fixed at creation; runtime
+ *  switches are guided by the deny reason). */
+export declare function modeSystemPrompt(): string | undefined;