@vincemakes/kiso-code 0.1.40 → 0.1.42

package/dist/chat.d.ts

@@ -5,7 +5,7 @@
  * estimates. All bodies moved verbatim from index.ts.
  */
 import { type RunUsage } from "@vincemakes/kiso-tui";
-import type { AgentSession } from "@vincemakes/kiso-runtime";
+import type { AgentSession, Run } from "@vincemakes/kiso-runtime";
 import { type LineInput } from "./state.js";
 /**
  * The ergonomics batch C8 — the /compact auto-trigger, OPT-IN (default off: only an
@@ -38,12 +38,16 @@ export declare function estimateCtxRatio(session: AgentSession): number;
 export declare function startStatusSpinner(onTick: (glyph: string) => void): () => void;
 /**
  * Consume a run, answering approval pauses as they arrive. `resumeMode`
- * marks a session.resume() continuation. v2a: `faux` picks the status
- * line's form; `liveInput` (non-null only in interactive chat) carries the
- * last line THIS process's readline consumed — the double-echo filter.
+ * marks a session.resume() continuation. `faux` picks the status line's
+ * form. W22: EVERY user_input event renders its UserMessage chip in the
+ * body — the v2a double-echo filter is retired (the transient input-row
+ * echo is UI, the chip is the record; the momentary double-render is
+ * the design's explicit point).
  */
-export declare function consumeRun(session: AgentSession, run: AsyncIterable<import("@vincemakes/kiso-core").Event>, input: LineInput, turnNo: number, faux: boolean, liveInput: {
-    current: string | null;
-} | null, statusCb: ((usage: RunUsage, ctxRatio: number) => void) | null): Promise<import("@vincemakes/kiso-core").Event | undefined>;
+export declare function consumeRun(session: AgentSession, run: Run, input: LineInput, turnNo: number, faux: boolean, statusCb: ((usage: RunUsage, ctxRatio: number) => void) | null, 
+/** W21: the amend words ("Yes + feedback") ride the NEXT user turn —
+ *  threaded from chat's submitTurn; absent in the recovery flow
+ *  (resume) where a dropped amend is noticed instead. */
+submitTurn?: (line: string) => void): Promise<import("@vincemakes/kiso-core").Event | undefined>;
 /** Interactive REPL: stream events, pause for approvals, Ctrl+C aborts. */
 export declare function chat(session: AgentSession, faux: boolean, input: LineInput, autoCompact?: AutoCompact): Promise<void>;

package/dist/chat.js

@@ -5,12 +5,12 @@
  * estimates. All bodies moved verbatim from index.ts.
  */
 import { readFileSync } from "node:fs";
-import { escapeTerminal, kUnit, palette, renderEvent, renderRecap } from "@vincemakes/kiso-tui";
+import { escapeTerminal, kUnit, palette, renderEvent, renderRecap, toolTarget, } from "@vincemakes/kiso-tui";
 import { editFileDiff, writeFileDiff } from "@vincemakes/kiso-tui";
 import { canonicalTargetPath } from "@vincemakes/kiso-tools-node";
 import { dispatch } from "./dispatch.js";
-import { CANCELLED, agentModel, body, bodyLog, configuredWindow, dock } from "./state.js";
-import { ask, pendingAsk, resolveUncertains } from "./trust-ui.js";
+import { agentModel, body, bodyLog, configuredWindow, dock } from "./state.js";
+import { addDontAskAgainRule, askPanel, fixHintFor, pendingAsk, resolveUncertains } from "./trust-ui.js";
 import { FauxExhaustionError, failOnFauxExhaustion } from "./faux-glue.js";
 import { MODES, getMode, setMode } from "./mode.js";
 /** B area: default context window for the ~ctx estimate (config overridable). */
@@ -93,6 +93,40 @@ function approvalDiff(name, input) {
         return null; // never let the diff break the approval
     }
 }
+/** W21 — the panel view for a permission_requested: the rule line (the
+ *  why-asked speaker + the §3.5 fix hint), the toolTarget title, the
+ *  "▸ run paused" status, and the ALWAYS-verbose args. */
+function approvalView(name, ev) {
+    const speaker = ev.speaker ?? "kiso";
+    const input = ev.input ?? {};
+    // exactOptionalPropertyTypes: the hint is OMITTED when the speaker has
+    // no fix (mode:accept-edits, shell in default) — never `hint: undefined`.
+    const hint = fixHintFor(speaker, name);
+    return {
+        flavor: "approval",
+        name,
+        title: toolTarget(name, input),
+        speaker,
+        ...(hint !== undefined ? { hint } : {}),
+        statusText: "▸ run paused",
+        args: approvalArgs(name, input),
+        fallbackQuestion: `approve ${escapeTerminal(name)}? (y/n) `,
+    };
+}
+/** The panel's ALWAYS-verbose args: edit_file/write_file → the full ±
+ *  diff (the tool cell's capped copy never reaches the panel — the
+ *  human approves the WHOLE change), shell → the full command line,
+ *  anything else → the pretty-printed JSON. Nothing that is asked for
+ *  approval is ever truncated. */
+function approvalArgs(name, input) {
+    if (name === "edit_file" || name === "write_file") {
+        return { kind: "diff", diff: approvalDiff(name, input)?.lines ?? null };
+    }
+    if (name === "shell") {
+        return { kind: "text", lines: [String(input.command ?? "")] };
+    }
+    return { kind: "text", lines: JSON.stringify(input, null, 2).split("\n") };
+}
 /**
  * The ergonomics batch C5 — the translation layer: the tui renders its OWN data shape
  * (RenderInput, zero kiso-core imports); the CLI translates its Event
@@ -165,11 +199,17 @@ function toRenderInput(ev) {
 }
 /**
  * Consume a run, answering approval pauses as they arrive. `resumeMode`
- * marks a session.resume() continuation. v2a: `faux` picks the status
- * line's form; `liveInput` (non-null only in interactive chat) carries the
- * last line THIS process's readline consumed — the double-echo filter.
+ * marks a session.resume() continuation. `faux` picks the status line's
+ * form. W22: EVERY user_input event renders its UserMessage chip in the
+ * body — the v2a double-echo filter is retired (the transient input-row
+ * echo is UI, the chip is the record; the momentary double-render is
+ * the design's explicit point).
  */
-export async function consumeRun(session, run, input, turnNo, faux, liveInput, statusCb) {
+export async function consumeRun(session, run, input, turnNo, faux, statusCb, 
+/** W21: the amend words ("Yes + feedback") ride the NEXT user turn —
+ *  threaded from chat's submitTurn; absent in the recovery flow
+ *  (resume) where a dropped amend is noticed instead. */
+submitTurn) {
     let last;
     let usage = { in: null, out: null, cache: null, known: false };
     // R-C item 4: the per-turn cache miss — the overlap with the previous
@@ -201,17 +241,6 @@ export async function consumeRun(session, run, input, turnNo, faux, liveInput, s
             else if (thinkingSince === null) {
                 thinkingSince = Date.now();
             }
-            // v2a (the double echo): the interactive echo was already rendered by the
-            // input source — rendering the event again is the double echo.
-            // v2b: DOCKED — the echo lives in the input row (H), NOT the body;
-            // the body render is the ONLY visible copy of the sent line.
-            if (ev.type === "user_input" &&
-                liveInput !== null &&
-                liveInput.current === (typeof ev.content === "string" ? ev.content : "") &&
-                process.stdin.isTTY &&
-                !dock.active) {
-                continue;
-            }
             // v2d: EVERY event only mutates a cell — the Body is the single
             // writer of the scroll region, so interleaving is impossible by
             // construction (ADR-0040).
@@ -291,18 +320,71 @@ export async function consumeRun(session, run, input, turnNo, faux, liveInput, s
                     // v2e: the mini-diff for edit/write at the approval moment —
                     // the human sees the change BEFORE deciding (auto-allowed tools
                     // skip the diff: nobody is looking).
+                    // W21: the PANEL replaces the line question — the bounded block
+                    // with the ALWAYS-verbose args (the full diff / command / JSON,
+                    // nothing the human approves is ever cut) and the numbered
+                    // options. The verdict maps to the session approvals:
+                    //  - bare No   → approve(false) FIRST (the denial settles the
+                    //    request), THEN run.abort() — the run's aborted terminal
+                    //    closes the cell;
+                    //  - No+words  → approve(false, words) — the words become the
+                    //    tool_result, the run continues;
+                    //  - Yes+amend → approve(true), the words ride the NEXT turn;
+                    //  - esc       → cancel, the conservative denial.
                     const name = ev.name;
                     body.toolApproval(ev.callId, approvalDiff(name, ev.input ?? {}));
                     const decisionId = ev.decisionId;
-                    const answer = await ask(input, `approve ${escapeTerminal(name)}? (y/n) `);
-                    if (answer === CANCELLED) {
-                        // round 10: a cancellation is a CONSERVATIVE denial, explicitly
-                        // distinguished from the user typing "n".
-                        body.notice("[approval cancelled — treated as a denial]");
-                        await session.approve(decisionId, false);
-                        continue;
+                    const verdict = await askPanel(input, approvalView(name, ev));
+                    switch (verdict.action) {
+                        case "cancel": {
+                            // round 10: a cancellation is a CONSERVATIVE denial,
+                            // explicitly distinguished from the user typing "n".
+                            body.notice("[approval cancelled — treated as a denial]");
+                            await session.approve(decisionId, false);
+                            break;
+                        }
+                        case "allow": {
+                            await session.approve(decisionId, true);
+                            if (verdict.reason.trim() !== "") {
+                                if (submitTurn !== undefined)
+                                    submitTurn(verdict.reason);
+                                else
+                                    body.notice("[amend words dropped — the recovery flow has no live prompt]");
+                            }
+                            break;
+                        }
+                        case "allow-rule": {
+                            // R3: the don't-ask-again extension is ALLOW-ONLY (never
+                            // emits deny or ask — the mode and safe-defaults moats
+                            // keep their teeth); the generated file is human-editable
+                            // and human-deletable — that IS the revocation path.
+                            await session.approve(decisionId, true);
+                            await addDontAskAgainRule(verdict.rule);
+                            break;
+                        }
+                        case "deny": {
+                            if (verdict.reason.trim() !== "") {
+                                // No+words — the words become the tool_result; the
+                                // run continues with the model seeing the denial.
+                                await session.approve(decisionId, false, verdict.reason);
+                            }
+                            else {
+                                // bare No — the denial settles the pause FIRST, then
+                                // the run aborts.
+                                await session.approve(decisionId, false);
+                                run.abort();
+                            }
+                            break;
+                        }
                     }
-                    await session.approve(decisionId, answer.trim().toLowerCase().startsWith("y"));
+                    break;
+                }
+                case "permission_decided": {
+                    // A5: the verdict binds INTO the tool cell — the aggregated
+                    // head row (name + status + decidedBy in ONE row), never a
+                    // free-standing `  approved` orphan. The render.ts case stays
+                    // for the PIPE path (the transcript is the raw event stream).
+                    body.toolVerdict(ev.callId ?? "", ev.decision, ev.decidedBy, ev.reason);
                     break;
                 }
                 case "terminal": {
@@ -315,6 +397,13 @@ export async function consumeRun(session, run, input, turnNo, faux, liveInput, s
                     // the commit loop folds the quiet turn's held cells first (the
                     // fold line lands above the recap, natural cell order).
                     body.endTurn(Math.round(thoughtSeconds));
+                    // D4: the max_tokens truncation is named, never silent — the
+                    // honest notice rides after the partial answer, before the
+                    // recap (the truncation-guard philosophy: the cut is visible
+                    // in the scrollback, the model's own text intact).
+                    if (ev.outcome.kind === "max_tokens") {
+                        body.notice('┌ answer truncated at max_tokens — say "continue" to finish');
+                    }
                     bodyLog(renderRecap({
                         seconds: Math.round((Date.now() - turnStart) / 1000),
                         tools: toolCount,
@@ -356,10 +445,6 @@ export async function chat(session, faux, input, autoCompact) {
     let cancelled = false;
     const turn = (text) => new Promise((resolve, reject) => {
         queued = Math.max(0, queued - 1); // a queued turn starts
-        // v2a: the echo filter compares the user_input event against THIS
-        // turn's own input — lines that arrive ahead of their turn (piped
-        // bursts, queued replays) must not overwrite the reference.
-        liveInput.current = text;
         const run = session.run(text);
         currentRun = run;
         turnNo += 1;
@@ -375,7 +460,7 @@ export async function chat(session, faux, input, autoCompact) {
         (async () => {
             let last;
             try {
-                last = await consumeRun(session, run, input, myTurn, faux, liveInput, statusCb);
+                last = await consumeRun(session, run, input, myTurn, faux, statusCb, submitTurn);
                 stopSpinner();
                 paintIdle();
                 currentRun = null;
@@ -458,12 +543,14 @@ export async function chat(session, faux, input, autoCompact) {
     // B area: user-turn counter for the status line. /last and /think read
     // the body (the ToolCell / ThinkingCell final states).
     let turnNo = 0;
-    // v2a: the last line THIS process's readline consumed — the double-echo
-    // filter (see consumeRun). Only interactive chat sets it.
-    const liveInput = { current: null };
-    // v2c: turns submitted while another runs are QUEUED on the chain — the
-    // live count rides the status bar (+N queued).
+    // v2c: turns submitted while another runs are QUEUED on the chain —
+    // the live count rides the status bar (+N queued).
     let queued = 0;
+    // W22: the pending turns — the LIVE slots the chips + the ↑/esc pop
+    // read (the dock renders the lines, the editor pops the last one).
+    // A slot leaves the queue when its turn STARTS or when the user
+    // pops it (cancelled — the chain segment skips it).
+    const pendingTurns = [];
     // v2b: the live status bar (docked only). Modes: /mode switches repaint
     // it immediately through paintStatus (the last turn stats are kept).
     // v3 §03: the status bar has TWO states. Idle: the mode is ALWAYS
@@ -496,9 +583,35 @@ export async function chat(session, faux, input, autoCompact) {
         paintRunning();
     };
     const submitTurn = (line) => {
+        const slot = { line, cancelled: false };
+        pendingTurns.push(slot);
         queued += 1;
-        chainRef.current = chainRef.current.then(() => turn(line));
+        chainRef.current = chainRef.current.then(() => {
+            if (slot.cancelled)
+                return; // the pop already dropped it — no double count
+            const idx = pendingTurns.indexOf(slot);
+            if (idx >= 0)
+                pendingTurns.splice(idx, 1); // the chip leaves when the turn STARTS
+            return turn(line);
+        });
+    };
+    // W22: the ↑/esc pop — the LAST queued slot leaves the queue
+    // (cancelled + spliced + counted down); null when the queue is
+    // empty. The chain segment skips the cancelled slot, so the popped
+    // message NEVER runs — it returns to the editor instead.
+    const popQueue = () => {
+        const slot = pendingTurns[pendingTurns.length - 1];
+        if (slot === undefined)
+            return null;
+        slot.cancelled = true;
+        pendingTurns.pop();
+        queued = Math.max(0, queued - 1);
+        return slot.line;
     };
+    // W22: the visibility invariant's binds — the dock renders the
+    // pending chips (+N queued), the editor routes the pop keys.
+    dock.bindQueue(() => pendingTurns.map((s) => s.line));
+    input.bindQueue(() => pendingTurns.map((s) => s.line), popQueue);
     const dispatchCtx = {
         session,
         input,
@@ -546,7 +659,7 @@ export async function chat(session, faux, input, autoCompact) {
         const recoveryRun = session.resume();
         currentRun = recoveryRun;
         turnNo += 1;
-        const last = await consumeRun(session, recoveryRun, input, turnNo, faux, liveInput, statusCb);
+        const last = await consumeRun(session, recoveryRun, input, turnNo, faux, statusCb, submitTurn);
         currentRun = null;
         failOnFauxExhaustion(last, faux, input);
         maybeAutoCompact(); // the ergonomics batch C8: the recovery run ended too — same check (awaited by the exit re-await)

package/dist/index.js

@@ -31,7 +31,7 @@ import { createAgent, disposeExtensions, loadExtensions, loadProjectExtensions,
 import { createFauxProvider } from "@vincemakes/kiso-evals";
 import { createCodingTools } from "@vincemakes/kiso-tools-node";
 import { MODES, modeExtensions, modeFromEnv, modeSystemPrompt, setMode } from "./mode.js";
-import { body, bodyLog, currentFaux, dock, extensionsDir, loadedExtensions, mergedConfig, mergedTempPaths, projectExtensions, sessionsDir, setAgentModel, setBody, setConfigModels, setConfiguredWindow, setCurrentFaux, setCurrentModelName, setExtensionLists, setMergedConfig, userExtensions, VERSION } from "./state.js";
+import { body, bodyLog, currentFaux, dock, extensionsDir, loadedExtensions, mergedConfig, mergedTempPaths, projectExtensions, sessionsDir, setAgentModel, setBody, setConfigModels, setConfiguredWindow, setCurrentAgentExtensions, setCurrentFaux, setCurrentModelName, setExtensionLists, setMergedConfig, userExtensions, VERSION } from "./state.js";
 import { interactivePrompt, resolveProjectTrust } from "./trust-ui.js";
 import { fauxSkip, readFauxScript } from "./faux-glue.js";
 import { autoCompactFromEnv, chat, contextWindowTokens } from "./chat.js";
@@ -81,6 +81,19 @@ function readlineInput(rl) {
             /* the rl.question stays pending; the settled branch re-emits
              * the answer as a new line. */
         },
+        // W21: readline is never asked — askPanel's non-TTY branch
+        // auto-denies before any panel opens (the pipe path).
+        panelAsk() {
+            /* unreachable — non-TTY asks auto-deny in askPanel */
+        },
+        panelCancel() {
+            /* unreachable */
+        },
+        // W22: readline has no ↑/esc pop — the pipe path shows no chips
+        // and pops nothing (the queue drains on its own).
+        bindQueue() {
+            /* unreachable — no raw keys in the pipe path */
+        },
         emitLine(line) {
             rl.emit("line", line);
         },
@@ -125,6 +138,19 @@ function editorInput(editor) {
         cancelQuestion() {
             editor.cancelQuestion();
         },
+        // W21: the panel — the editor's own state machine takes the
+        // keys; the compositor renders it via the bound state.
+        panelAsk(view, onCommit) {
+            editor.beginPanel(view, onCommit);
+        },
+        panelCancel() {
+            editor.cancelPanel();
+        },
+        // W22: the pending-turn queue — the ↑ pop walk (the keys); the
+        // chips are the compositor's bindQueue (the dock side).
+        bindQueue(state, pop) {
+            editor.bindQueue(state, pop);
+        },
         emitLine() {
             /* the editor's buffer survives a cancelled question — its text
              * becomes the next turn on Enter (the readline re-emit
@@ -157,6 +183,7 @@ function makeLineInput() {
         // pipe bytes do not change)
         dock.bindInput(() => editor.dockState(), "› ");
         dock.bindMenu(() => editor.menuState()); // v3 §04: the slash-command menu
+        dock.bindApproval(() => editor.panelState()); // W21: the panel's bound state
         return editorInput(editor);
     }
     return readlineInput(createInterface({ input: process.stdin, output: process.stdout }));
@@ -302,6 +329,13 @@ async function makeAgent(fauxSkipTurns = 0, input, modelFlag) {
         setCurrentModelName(resolved.name);
     }
     setAgentModel(model); // v2b: the status bar shows it
+    // W21: the extensions array is built ONCE per agent and shared with
+    // the runtime by reference — the don't-ask-again writer pushes the
+    // generated extension into it so a first-time rule joins the chain
+    // at the NEXT run (the run's policies are fixed at its start; run.ts
+    // re-reads the config's extensions array per run).
+    const extensions = [...modeExtensions(), ...loadedExtensions];
+    setCurrentAgentExtensions(extensions);
     const definition = {
         model,
         store,
@@ -327,7 +361,7 @@ async function makeAgent(fauxSkipTurns = 0, input, modelFlag) {
         // Modes: the five tiers join at the CHAIN HEAD, before the user/
         // project extensions (the deny>ask>allow composition keeps a user
         // deny winning over any mode tier — bypass included).
-        extensions: [...modeExtensions(), ...loadedExtensions],
+        extensions,
         ...(resolved !== null
             ? {
                 provider: resolved.profile.kind,

package/dist/resume.js

@@ -48,7 +48,7 @@ export async function resume(session, prompt, faux, input) {
         });
         try {
             turnNo += 1;
-            const last = await consumeRun(session, run, input, turnNo, faux, null, statusCb);
+            const last = await consumeRun(session, run, input, turnNo, faux, statusCb);
             failOnFauxExhaustion(last, faux, input);
         }
         finally {

package/dist/state.d.ts

@@ -5,7 +5,7 @@
  * creates the mutable ones (setBody / setAgentModel / setExtensionLists);
  * the moved modules read and mutate at call time.
  */
-import { Dock, type Body } from "@vincemakes/kiso-tui";
+import { Dock, type Body, type PanelVerdict, type PanelView } from "@vincemakes/kiso-tui";
 import type { KisoExtension } from "@vincemakes/kiso-runtime";
 /** finding #11: KISO_HOME is the ONE root — every default path derives from
  *  it (sessions, trust, extensions, mcp config, skills). The dedicated
@@ -32,6 +32,16 @@ export interface LineInput {
     onExpand(cb: () => void): void;
     question(query: string, cb: (answer: string) => void): void;
     cancelQuestion(): void;
+    /** W21: open the approval panel — the editor's state machine takes
+     *  the keys (the digits/y/n/tab/esc/enter routing, the rule input,
+     *  the tab-amend), the compositor renders the block + the leads. */
+    panelAsk(view: PanelView, onCommit: (v: PanelVerdict) => void): void;
+    /** W21: cancel the panel — the SIGINT pair to panelAsk. */
+    panelCancel(): void;
+    /** W22: bind the pending-turn queue — the ↑ pop walks the CLI's
+     *  live slots (each pop cancels the turn), esc ends the walk after
+     *  one more pop. The chips are the compositor's own bindQueue. */
+    bindQueue(state: () => readonly string[], pop: () => string | null): void;
     emitLine(line: string): void;
     line(): string;
     clearLine(): void;
@@ -84,6 +94,13 @@ export declare let userExtensions: readonly KisoExtension[];
  *  banner distinguishes them from the user-level ones. */
 export declare let projectExtensions: readonly KisoExtension[];
 export declare function setExtensionLists(user: readonly KisoExtension[], project: readonly KisoExtension[], loaded: readonly KisoExtension[]): void;
+/** W21: the CURRENT agent's extensions array — set by makeAgent, the
+ *  don't-ask-again writer pushes the generated extension into it so a
+ *  first-time rule joins the chain at the NEXT run (the run's policies
+ *  are fixed at its start; the array is shared by reference with the
+ *  runtime's session config — run.ts re-reads it per run). */
+export declare let currentAgentExtensions: KisoExtension[];
+export declare function setCurrentAgentExtensions(value: KisoExtension[]): void;
 /** E3: temp artifacts of the mcp/skills merge — removed on exit. */
 export declare const mergedTempPaths: string[];
 /** The CLI's own version — read from the package.json next to the build. */

package/dist/state.js

@@ -89,6 +89,15 @@ export function setExtensionLists(user, project, loaded) {
     projectExtensions = project;
     loadedExtensions = loaded;
 }
+/** W21: the CURRENT agent's extensions array — set by makeAgent, the
+ *  don't-ask-again writer pushes the generated extension into it so a
+ *  first-time rule joins the chain at the NEXT run (the run's policies
+ *  are fixed at its start; the array is shared by reference with the
+ *  runtime's session config — run.ts re-reads it per run). */
+export let currentAgentExtensions = [];
+export function setCurrentAgentExtensions(value) {
+    currentAgentExtensions = value;
+}
 /** E3: temp artifacts of the mcp/skills merge — removed on exit. */
 export const mergedTempPaths = [];
 /** The CLI's own version — read from the package.json next to the build. */

package/dist/trust-ui.d.ts

@@ -1,31 +1,62 @@
 /**
  * The ergonomics batch B4 (pure move) — the human-facing question UI: the E3 project
- * trust gate (ADR-0037), the mcp/skills env merges, the generic ask()
- * (approvals, trust, uncertain resolutions), and the uncertain-execution
+ * trust gate (ADR-0037), the mcp/skills env merges, the W21 approval
+ * panel (askPanel — the bounded block, the verdict mapping lives in
+ * chat.ts), the don't-ask-again rule writer, and the uncertain-execution
  * decisions. All bodies moved verbatim from index.ts.
  */
+import { type PanelVerdict, type PanelView } from "@vincemakes/kiso-tui";
 import { type ProjectArtifacts } from "@vincemakes/kiso-runtime";
 import type { AgentSession } from "@vincemakes/kiso-runtime";
-import { CANCELLED, type LineInput } from "./state.js";
+import { type LineInput } from "./state.js";
 /** v2a: the interactive prompt — blue, the identity accent. readline owns
  *  the echo of what the user types; we own the prompt's color. (v2c: the
  *  readline prompt keeps "you> " — the brick ▌ is the dock's row only;
  *  pipe bytes must not change.) */
 export declare function interactivePrompt(): string;
 /**
- * Ask the human a question. Non-interactive stdin (piped, CI) cannot wait
- * forever: approvals auto-deny and uncertain executions auto-abandon, both
- * printed loudly — never silently ignored, never hung (Area 7).
+ * W21 — ask the human with the approval panel: the bounded block that
+ * replaces the running tool's live window while the approval is pending.
+ * The editor owns the keys (the digits/tab/esc/enter routing, the rule
+ * input, the tab-amend); the compositor renders the block + the leads;
+ * the CLI maps the verdict (the bare-No abort, the No+words tool_result,
+ * the allow-amend words riding the next turn — all live in chat.ts,
+ * never here).
  *
- * rounds 8/10: the question is ABORTABLE — a pending rl.question is registered in
- * `pendingAsk` and the SIGINT handler resolves it with the CANCELLED
- * sentinel. The rl.question callback is NOT left dangling: an input that
- * arrives after the cancellation is re-emitted as a fresh "line" — it
- * becomes the next user turn instead of being swallowed by the dead
- * question.
+ * Non-interactive stdin (piped, CI) cannot wait forever: the approval
+ * AUTO-DENIES, printed loudly — never silently ignored, never hung
+ * (Area 7). A TTY without a dock (rows < 4) falls back to the v2a line
+ * question (y/n → allow/deny) — the panel cannot render without the
+ * dock's live region.
+ *
+ * rounds 8/10: the ask is ABORTABLE — registered in `pendingAsk`, the
+ * SIGINT handler resolves it with { action: "cancel" } (the panel closes
+ * through the editor's panelCancel, the dock-less question through
+ * cancelQuestion). The dock-less question callback is NOT left dangling:
+ * an input that arrives after the cancellation is re-emitted as a fresh
+ * "line" — it becomes the next user turn instead of being swallowed by
+ * the dead question.
  */
 export declare let pendingAsk: (() => void) | null;
-export declare function ask(input: LineInput, question: string): Promise<string | typeof CANCELLED>;
+export declare function askPanel(input: LineInput, view: PanelView): Promise<PanelVerdict>;
+/**
+ * W21/R3 — the "2 Yes, don't ask again for <tool>" rule: a GENERATED
+ * extension, ALLOW-ONLY by construction (it never emits deny or ask —
+ * the mode moat and the safe-defaults moat keep their teeth). The file
+ * is HUMAN-EDITABLE and HUMAN-DELETABLE — that IS the revocation path.
+ * The loader sorts *.mjs alphabetically, so dont-ask-again.mjs binds
+ * BEFORE safe-defaults.mjs: the allow is the chain's first word, the
+ * safe-defaults deny moat still wins (deny > allow — the R3 order).
+ */
+export declare function addDontAskAgainRule(rule: string): Promise<void>;
+/**
+ * W21 — the §3.5 fix-hint table: per speaker, the ONE-line path to stop
+ * being asked. The hint names the FIX, never a bypass ("switch to
+ * bypass" would be an approval-hole nudge — the R3 ruling). The
+ * extension hint collapses the home prefix to ~ (the hint must stay
+ * short enough for the one-row rule line at narrow widths).
+ */
+export declare function fixHintFor(speaker: string, tool: string): string | undefined;
 /**
  * E3 — the project-level trust gate (ADR-0037): capability is trusted by
  * content digest, not by directory. Runs BEFORE any extension loads — the
@@ -46,5 +77,9 @@ export declare function resolveProjectTrust(input: LineInput): Promise<ProjectAr
  * with project-wins and a stderr note. Exported for tests.
  */
 export declare function applyProjectMerges(artifacts: ProjectArtifacts): void;
-/** Decide every uncertain execution with the human (r)erun/(a)bandon. */
+/** Decide every uncertain execution with the human — the panel's simple
+ *  flavor: 1 Yes = rerun, 3 No = abandon; a cancel records NOTHING (the
+ *  execution stays uncertain and durable — no rerun/abandoned is
+ *  fabricated, round 10). The resolution feedback lands in the body —
+ *  the body is the single stdout writer, never a stray console.log. */
 export declare function resolveUncertains(session: AgentSession, input: LineInput, isCancelled: () => boolean): Promise<void>;

package/dist/trust-ui.js

@@ -1,16 +1,19 @@
 /**
  * The ergonomics batch B4 (pure move) — the human-facing question UI: the E3 project
- * trust gate (ADR-0037), the mcp/skills env merges, the generic ask()
- * (approvals, trust, uncertain resolutions), and the uncertain-execution
+ * trust gate (ADR-0037), the mcp/skills env merges, the W21 approval
+ * panel (askPanel — the bounded block, the verdict mapping lives in
+ * chat.ts), the don't-ask-again rule writer, and the uncertain-execution
  * decisions. All bodies moved verbatim from index.ts.
  */
-import { existsSync, mkdtempSync, readFileSync, readdirSync, symlinkSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, symlinkSync, writeFileSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
+import { pathToFileURL } from "node:url";
 import { escapeTerminal, palette } from "@vincemakes/kiso-tui";
 import { projectArtifacts, recordTrust, trustFor } from "@vincemakes/kiso-runtime";
-import { CANCELLED, bodyLog, dock, kisoHome, mergedTempPaths } from "./state.js";
+import { bodyLog, currentAgentExtensions, dock, extensionsDir, kisoHome, mergedTempPaths } from "./state.js";
 import { loadUserConfig, resolveProjectTrustPolicy } from "./config.js";
+import { getMode } from "./mode.js";
 /** v2a: the interactive prompt — blue, the identity accent. readline owns
  *  the echo of what the user types; we own the prompt's color. (v2c: the
  *  readline prompt keeps "you> " — the brick ▌ is the dock's row only;
@@ -20,31 +23,33 @@ export function interactivePrompt() {
     return `${p.bold}you> ${p.reset}`;
 }
 /**
- * Ask the human a question. Non-interactive stdin (piped, CI) cannot wait
- * forever: approvals auto-deny and uncertain executions auto-abandon, both
- * printed loudly — never silently ignored, never hung (Area 7).
+ * W21 — ask the human with the approval panel: the bounded block that
+ * replaces the running tool's live window while the approval is pending.
+ * The editor owns the keys (the digits/tab/esc/enter routing, the rule
+ * input, the tab-amend); the compositor renders the block + the leads;
+ * the CLI maps the verdict (the bare-No abort, the No+words tool_result,
+ * the allow-amend words riding the next turn — all live in chat.ts,
+ * never here).
  *
- * rounds 8/10: the question is ABORTABLE — a pending rl.question is registered in
- * `pendingAsk` and the SIGINT handler resolves it with the CANCELLED
- * sentinel. The rl.question callback is NOT left dangling: an input that
- * arrives after the cancellation is re-emitted as a fresh "line" — it
- * becomes the next user turn instead of being swallowed by the dead
- * question.
+ * Non-interactive stdin (piped, CI) cannot wait forever: the approval
+ * AUTO-DENIES, printed loudly — never silently ignored, never hung
+ * (Area 7). A TTY without a dock (rows < 4) falls back to the v2a line
+ * question (y/n → allow/deny) — the panel cannot render without the
+ * dock's live region.
+ *
+ * rounds 8/10: the ask is ABORTABLE — registered in `pendingAsk`, the
+ * SIGINT handler resolves it with { action: "cancel" } (the panel closes
+ * through the editor's panelCancel, the dock-less question through
+ * cancelQuestion). The dock-less question callback is NOT left dangling:
+ * an input that arrives after the cancellation is re-emitted as a fresh
+ * "line" — it becomes the next user turn instead of being swallowed by
+ * the dead question.
  */
 export let pendingAsk = null;
-export function ask(input, question) {
+export function askPanel(input, view) {
     if (!process.stdin.isTTY) {
-        console.log(`[non-interactive — no human to ask: ${question}]`);
-        return Promise.resolve("");
-    }
-    // v2b: docked — the question takes over the status position, the
-    // answer lands at the input line. v2c: a TTY without a dock (rows < 4)
-    // prints the question into the body — the editor cannot show it.
-    if (dock.active) {
-        dock.showQuestion(question);
-    }
-    else {
-        bodyLog(question);
+        console.log(`[non-interactive — no human to ask: ${view.fallbackQuestion}]`);
+        return Promise.resolve({ action: "deny", reason: "no human to ask" });
     }
     return new Promise((resolve) => {
         let settled = false;
@@ -53,28 +58,108 @@ export function ask(input, question) {
                 return;
             settled = true;
             pendingAsk = null;
-            input.cancelQuestion();
-            resolve(CANCELLED); // the run is aborting — the question is dead
-        };
-        // v2b: docked — the question reads at the input line, whose prompt
-        // is the same blue you> (the editor's brick row; the readline path
-        // passes the plain question). An empty prompt would start readline
-        // at column 1 while the dock renders "you> " — the typed answer
-        // would land on the prompt and drift (probe-confirmed).
-        input.question(dock.active ? interactivePrompt() : question, (answer) => {
-            if (settled) {
-                // The question was cancelled; this line is a NEW user turn.
-                input.emitLine(answer);
-                return;
-            }
-            settled = true;
-            pendingAsk = null;
             if (dock.active)
-                dock.clearQuestion();
-            resolve(answer);
-        });
+                input.panelCancel();
+            else
+                input.cancelQuestion();
+            resolve({ action: "cancel" });
+        };
+        if (dock.active) {
+            input.panelAsk(view, (verdict) => {
+                if (settled)
+                    return; // a cancelled panel's late commit is dead
+                settled = true;
+                pendingAsk = null;
+                resolve(verdict);
+            });
+        }
+        else {
+            // v2c: a TTY without a dock (rows < 4) — the fallback question
+            // in the body; the y/n line answer maps to the verdicts.
+            bodyLog(view.fallbackQuestion);
+            input.question(view.fallbackQuestion, (answer) => {
+                if (settled) {
+                    // The question was cancelled; this line is a NEW user turn.
+                    input.emitLine(answer);
+                    return;
+                }
+                settled = true;
+                pendingAsk = null;
+                const yes = answer.trim().toLowerCase().startsWith("y");
+                resolve(yes ? { action: "allow", reason: "" } : { action: "deny", reason: "" });
+            });
+        }
     });
 }
+/**
+ * W21/R3 — the "2 Yes, don't ask again for <tool>" rule: a GENERATED
+ * extension, ALLOW-ONLY by construction (it never emits deny or ask —
+ * the mode moat and the safe-defaults moat keep their teeth). The file
+ * is HUMAN-EDITABLE and HUMAN-DELETABLE — that IS the revocation path.
+ * The loader sorts *.mjs alphabetically, so dont-ask-again.mjs binds
+ * BEFORE safe-defaults.mjs: the allow is the chain's first word, the
+ * safe-defaults deny moat still wins (deny > allow — the R3 order).
+ */
+export async function addDontAskAgainRule(rule) {
+    const dir = extensionsDir();
+    const file = join(dir, "dont-ask-again.mjs");
+    const existed = existsSync(file);
+    const module = [
+        "// generated by kiso — the \"2 Yes, don't ask again for <tool>\" rule.",
+        "// HUMAN-EDITABLE and HUMAN-DELETABLE — this file IS the revocation path:",
+        "// delete a rule from the set (or the whole file) to be asked again.",
+        "// ALLOW-ONLY by design (R3): never emits deny or ask — the mode moat",
+        "// and the safe-defaults moat keep their teeth.",
+        `export const RULES = new Set(${JSON.stringify([rule])});`,
+        "",
+        "export default {",
+        '  name: "dont-ask-again",',
+        "  approvals: [",
+        "    {",
+        "      decide(call) {",
+        '        return RULES.has(call.name) ? { action: "allow" } : { action: "abstain" };',
+        "      },",
+        "    },",
+        "  ],",
+        "};",
+        "",
+    ].join("\n");
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(file, module, "utf8");
+    // The live in-session effect: a file that existed at startup was
+    // imported by the loader — ONE namespace — so mutating the exported
+    // RULES Set is live NOW (the current run's chain reads the same Set).
+    const mod = (await import(pathToFileURL(file).href));
+    if (mod.RULES !== undefined && !mod.RULES.has(rule))
+        mod.RULES.add(rule);
+    // A FIRST-time rule (a file that did not exist at startup) is not yet
+    // in the current run's chain — the chain is fixed at a run's start —
+    // so the generated extension joins the NEXT run's policies (run.ts
+    // re-reads the session config's extensions array, shared by
+    // reference). The honest story: a new rule applies from the next run.
+    if (!existed && mod.default !== undefined) {
+        currentAgentExtensions.push(mod.default);
+    }
+}
+/**
+ * W21 — the §3.5 fix-hint table: per speaker, the ONE-line path to stop
+ * being asked. The hint names the FIX, never a bypass ("switch to
+ * bypass" would be an approval-hole nudge — the R3 ruling). The
+ * extension hint collapses the home prefix to ~ (the hint must stay
+ * short enough for the one-row rule line at narrow widths).
+ */
+export function fixHintFor(speaker, tool) {
+    if (speaker === "mode:default") {
+        if (tool === "shell")
+            return undefined;
+        return "/mode accept-edits auto-approves edits";
+    }
+    if (speaker === "mode:manual" || speaker === "mode:plan")
+        return "/mode default";
+    if (speaker === "mode:accept-edits" || speaker === "mode:bypass")
+        return undefined;
+    return `edit ${join(extensionsDir(), `${speaker}.mjs`).replace(homedir(), "~")}`;
+}
 /**
  * E3 — the project-level trust gate (ADR-0037): capability is trusted by
  * content digest, not by directory. Runs BEFORE any extension loads — the
@@ -110,14 +195,30 @@ export async function resolveProjectTrust(input) {
         console.error(`[project .kiso] found ${artifacts.files.length} artifact(s) in ${artifacts.root} — not trusted, not loaded (run kiso interactively once to decide)`);
         return null;
     }
-    // v2c: the shared input (the editor on a TTY) reads the answer; the
-    // dock shows the question at the status position.
+    // v2c: the shared input (the editor on a TTY) reads the answer.
+    // W21: the trust gate is the panel's SIMPLE flavor — the ruleOverride
+    // carries the question, the args the artifact listing (the same rows
+    // the bodyLog below records, verbatim — the listing still lands in
+    // the scrollback; the panel is a bounded block, the record is not).
     bodyLog(`[project .kiso] ${artifacts.root}`);
     for (const f of artifacts.files) {
         bodyLog(`  ${f.path}  (${f.digest.slice(0, 6)})`);
     }
-    const answer = await ask(input, `trust this project's .kiso? (y/n) `);
-    const granted = answer !== CANCELLED && answer.trim().toLowerCase().startsWith("y");
+    const verdict = await askPanel(input, {
+        flavor: "simple",
+        name: "project trust",
+        title: artifacts.root,
+        speaker: "kiso",
+        statusText: "▸ project trust",
+        args: { kind: "text", lines: artifacts.files.map((f) => `${f.path}  (${f.digest.slice(0, 6)})`) },
+        ruleOverride: "trust this project's .kiso?",
+        fallbackQuestion: `trust this project's .kiso? (y/n) `,
+    });
+    // A cancel is a "no" HERE — refused is sticky, the project does not
+    // load (re-evaluate by deleting the trust line or changing a file).
+    // The non-TTY branch above returned WITHOUT a record so an interactive
+    // run can still decide later.
+    const granted = verdict.action === "allow";
     recordTrust({ root: artifacts.root, digest: artifacts.digest, decision: granted ? "granted" : "refused" });
     if (!granted)
         return null;
@@ -209,17 +310,30 @@ function readdirSyncSafe(dir) {
         return []; // no skills dir on either level = nothing to merge
     }
 }
-/** Decide every uncertain execution with the human (r)erun/(a)bandon. */
+/** Decide every uncertain execution with the human — the panel's simple
+ *  flavor: 1 Yes = rerun, 3 No = abandon; a cancel records NOTHING (the
+ *  execution stays uncertain and durable — no rerun/abandoned is
+ *  fabricated, round 10). The resolution feedback lands in the body —
+ *  the body is the single stdout writer, never a stray console.log. */
 export async function resolveUncertains(session, input, isCancelled) {
     for (const uncertain of session.uncertainExecutions()) {
-        const answer = await ask(input, `⚠ interrupted execution: ${escapeTerminal(uncertain.name)} (${uncertain.executionId}) — did it apply? (r)erun / (a)bandon: `);
-        if (isCancelled() || answer === CANCELLED) {
+        const verdict = await askPanel(input, {
+            flavor: "simple",
+            name: "uncertain execution",
+            title: `${uncertain.name} (${uncertain.executionId})`,
+            speaker: "kiso",
+            statusText: "▸ uncertain execution",
+            args: { kind: "text", lines: [uncertain.executionId] },
+            ruleOverride: "did the interrupted execution apply? — 1 rerun · 3 abandon",
+            fallbackQuestion: `⚠ interrupted execution: ${escapeTerminal(uncertain.name)} (${uncertain.executionId}) — did it apply? (y)es / (n)o `,
+        });
+        if (isCancelled() || verdict.action === "cancel") {
             // round 10: a cancellation NEVER records a verdict — the execution
             // stays uncertain and durable; no rerun/abandoned is fabricated.
             return;
         }
-        const resolution = answer.trim().toLowerCase().startsWith("r") ? "rerun" : "abandoned";
+        const resolution = verdict.action === "allow" ? "rerun" : "abandoned";
         await session.resolveUncertain(uncertain.executionId, resolution);
-        console.log(`  ${resolution}\n`);
+        bodyLog(`  ${resolution}`);
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vincemakes/kiso-code",
-  "version": "0.1.40",
+  "version": "0.1.42",
   "description": "kiso CLI — the coding-agent reference product: kiso chat / kiso resume / kiso sessions.",
   "type": "module",
   "license": "MIT",
@@ -18,13 +18,14 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@vincemakes/kiso-core": "0.1.31",
-    "@vincemakes/kiso-evals": "0.1.32",
-    "@vincemakes/kiso-provider-anthropic": "0.1.32",
-    "@vincemakes/kiso-provider-openai": "0.1.32",
-    "@vincemakes/kiso-runtime": "0.1.32",
-    "@vincemakes/kiso-tools-node": "0.1.32",
-    "@vincemakes/kiso-tui": "0.1.40"
+    "@vincemakes/kiso-core": "0.1.33",
+    "@vincemakes/kiso-evals": "0.1.34",
+    "@vincemakes/kiso-provider-anthropic": "0.1.34",
+    "@vincemakes/kiso-provider-openai": "0.1.34",
+    "@vincemakes/kiso-runtime": "0.1.34",
+    "@vincemakes/kiso-tools-node": "0.1.34",
+    "@vincemakes/kiso-tui": "0.1.42",
+    "@vincemakes/kiso-tui-cells": "0.1.42"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",