@vincemakes/kiso-code 0.15.0 → 0.15.2

package/dist/chat.d.ts

@@ -158,4 +158,20 @@ export declare function consumeRun(session: AgentSession, run: Run, input: LineI
  *  (resume) where a dropped amend is noticed instead. */
 submitTurn?: (line: string) => void): Promise<import("@vincemakes/kiso-core").Event | undefined>;
 /** Interactive REPL: stream events, pause for approvals, Ctrl+C aborts. */
-export declare function chat(session: AgentSession, faux: boolean, input: LineInput, autoCompact?: AutoCompact): Promise<void>;
+/** The chat loop's ENDING: exit closes the process's REPL for good; a
+ *  switch hands main another session id to re-enter chat with — the
+ *  editor survives, the durable law is untouched (the /resume+/clear
+ *  mini-spec). */
+export type ChatEnd = {
+    readonly next: "exit";
+} | {
+    readonly next: "switch";
+    readonly id: string;
+};
+/** The session-navigation seam main provides: the OTHER sessions'
+ *  ids, and (when a dock is up) the existing picker. */
+export interface ChatNav {
+    readonly sessions: () => readonly string[];
+    readonly pick?: () => Promise<string | null>;
+}
+export declare function chat(session: AgentSession, faux: boolean, input: LineInput, autoCompact?: AutoCompact, nav?: ChatNav): Promise<ChatEnd>;

package/dist/chat.js

@@ -793,8 +793,14 @@ submitTurn) {
     }
     return last;
 }
-/** Interactive REPL: stream events, pause for approvals, Ctrl+C aborts. */
-export async function chat(session, faux, input, autoCompact) {
+export async function chat(session, faux, input, autoCompact, nav) {
+    // the switch directive — set once by dispatch's /clear or /resume,
+    // resolved through the end signal so the final awaits still run
+    let switchTo = null;
+    let resolveEnd = () => { };
+    const endSignal = new Promise((r) => {
+        resolveEnd = r;
+    });
     let currentRun = null;
     let cancelled = false;
     // E group (the graceful-exit gate ③, R-G 0.1.48): the terminal can
@@ -1114,6 +1120,15 @@ export async function chat(session, faux, input, autoCompact) {
         submitTurn,
         estimateCtx: () => estimateCtxRatio(session),
         contextWindow: () => contextWindowTokens(),
+        // the /resume+/clear mini-spec: the switch directive and the
+        // session-navigation seam (absent nav = the commands degrade to
+        // an honest refusal in dispatch)
+        requestSwitch: (id) => {
+            switchTo = id;
+            resolveEnd();
+        },
+        sessions: () => nav?.sessions() ?? [],
+        ...(nav?.pick !== undefined ? { pickSession: nav.pick } : {}),
     };
     // the ergonomics batch C8: the auto-compact check — the /compact FULL path via the
     // shared dispatch (same notices, same chain ordering, same mid-run
@@ -1143,6 +1158,15 @@ export async function chat(session, faux, input, autoCompact) {
     // chain action (the sentinel's control char marks the key, so a typed
     // "expand" turn is never intercepted).
     input.onExpand(() => dispatch("\x12expand", dispatchCtx));
+    // R3a — Shift+Tab: the approval-tier cycle (the /mode ring, in the
+    // MODES order). The switch is the SAME live-extension flip /mode
+    // performs; the status row repaints at once with a one-line notice.
+    input.onModeCycle?.(() => {
+        const next = MODES[(MODES.indexOf(getMode()) + 1) % MODES.length];
+        setMode(next);
+        paintIdle();
+        body.notice(`mode → ${next} (shift+tab cycles)`);
+    });
     // Recovery first: a session with a dangling pause or uncertain
     // executions must resolve them BEFORE the REPL accepts new turns —
     // otherwise the interrupted run dangles while a new one starts.
@@ -1174,7 +1198,7 @@ export async function chat(session, faux, input, autoCompact) {
     if (cancelled) {
         input.close();
         await input.closed;
-        return;
+        return { next: "exit" };
     }
     // The REPL is ready: replay anything that arrived during recovery.
     replReady = true;
@@ -1188,7 +1212,9 @@ export async function chat(session, faux, input, autoCompact) {
     }
     queuedLines.length = 0;
     input.prompt();
-    await input.closed;
+    // the REPL ends by CLOSE (exit) or by SWITCH (/clear, /resume) — the
+    // switch leaves the editor alive for the next chat() entry
+    await Promise.race([input.closed, endSignal]);
     await chainRef.current; // never exit while a turn is in flight
     // the ergonomics batch C8: the auto-compact may have appended ITS segment inside the
     // turn (the check runs at the turn's end, after the exit-await above
@@ -1196,4 +1222,5 @@ export async function chat(session, faux, input, autoCompact) {
     // runs before the exit or the chain is already settled. One level is
     // enough: the /compact segment appends nothing of its own.
     await chainRef.current;
+    return switchTo === null ? { next: "exit" } : { next: "switch", id: switchTo };
 }

package/dist/dispatch.d.ts

@@ -25,6 +25,13 @@ export interface DispatchCtx {
     /** TUI2-R1 (E): the model's context window, as the session is
      *  configured — the /context ledger's denominator. */
     readonly contextWindow: () => number;
+    /** the /resume+/clear mini-spec: end this chat() with a switch to
+     *  another session — main re-enters chat there; the editor survives. */
+    readonly requestSwitch: (id: string) => void;
+    /** every durable session id (the /resume validation + listing). */
+    readonly sessions: () => readonly string[];
+    /** the dock's session picker, when one exists (bare /resume). */
+    readonly pickSession?: () => Promise<string | null>;
 }
 /** The ONE dispatcher — slash commands, exit, and turns. The recovery
  *  replay routes through it too — a queued "/last" must never become a

package/dist/dispatch.js

@@ -4,9 +4,10 @@
  * the context (the chain, the run state, the prompt arming).
  */
 import { contextRows, contextUnavailableRows, displayVerb, escapeTerminal, helpRows, kUnit, modelPickView, palette } from "@vincemakes/kiso-tui";
+import { newSessionId } from "./session-id.js";
 import { buildAdapter } from "@vincemakes/kiso-runtime/internal";
 import { MODES, getMode, setMode } from "./mode.js";
-import { agentModel, body, bodyLog, configModels, dock, readContextLedger, setAgentModel, setCurrentModelName } from "./state.js";
+import { agentModel, body, bodyLog, configModels, dock, readContextLedger, sessionsDir, setAgentModel, setCurrentModelName } from "./state.js";
 import { directWriteProfile, profileAvailable } from "./config.js";
 /** The ONE dispatcher — slash commands, exit, and turns. The recovery
  *  replay routes through it too — a queued "/last" must never become a
@@ -263,7 +264,7 @@ export function dispatch(line, ctx) {
         });
         return;
     }
-    if (trimmed === "/compact") {
+    if (trimmed === "/compact" || trimmed.startsWith("/compact ")) {
         // /compact (ADR-0044): the older conversation becomes one
         // model summary — an OFF-LOOP call through the session's own
         // adapter, so it must never race a running turn: refused
@@ -306,8 +307,13 @@ export function dispatch(line, ctx) {
                 }, 1000);
             };
             try {
+                // R3a: /compact <focus> — the words after the command steer
+                // the summary ("keep the auth details"); bare /compact is
+                // byte-identical to the pre-round call.
+                const focus = trimmed.slice(8).trim();
                 const result = await ctx.session.summarize({
                     signal: abort.signal,
+                    ...(focus !== "" ? { focus } : {}),
                     onStart: (info) => {
                         compactInfo = info;
                         compacting(info);
@@ -369,6 +375,68 @@ export function dispatch(line, ctx) {
         ctx.input.close();
         return;
     }
+    if (trimmed === "/clear") {
+        // the mini-spec: /clear = a FRESH conversation. The old session
+        // stays on disk, resumable — the append-only law does not move;
+        // what clears is the CONTEXT, never the history.
+        if (ctx.isRunning()) {
+            body.notice("[/clear] a run is in flight — let it finish (esc stops it), then clear");
+            ctx.input.prompt();
+            return;
+        }
+        ctx.requestSwitch(newSessionId(sessionsDir()));
+        return;
+    }
+    if (trimmed === "/resume" || trimmed.startsWith("/resume ")) {
+        // the mini-spec: the in-session door to the durable sessions —
+        // /resume <id> switches directly; bare /resume opens the SAME
+        // picker `kiso resume` owns (dock), or lists ids (no dock).
+        if (ctx.isRunning()) {
+            body.notice("[/resume] a run is in flight — let it finish (esc stops it), then switch");
+            ctx.input.prompt();
+            return;
+        }
+        const arg = trimmed.slice(7).trim();
+        if (arg !== "") {
+            // a switch never silently CREATES a session — agent.session()
+            // would; the validation is the difference
+            if (!ctx.sessions().includes(arg)) {
+                ctx.chainRef.current = ctx.chainRef.current.then(async () => {
+                    bodyLog(`no such session: ${escapeTerminal(arg)} — /resume lists them`);
+                    ctx.input.prompt();
+                });
+                return;
+            }
+            ctx.requestSwitch(arg);
+            return;
+        }
+        const others = ctx.sessions().filter((id) => id !== ctx.session.id);
+        if (others.length === 0) {
+            ctx.chainRef.current = ctx.chainRef.current.then(async () => {
+                bodyLog("no other sessions — /clear starts a fresh one");
+                ctx.input.prompt();
+            });
+            return;
+        }
+        if (ctx.pickSession !== undefined && dock.active) {
+            ctx.chainRef.current = ctx.chainRef.current.then(async () => {
+                const picked = await ctx.pickSession();
+                if (picked === null) {
+                    ctx.input.prompt(); // esc — nothing switched, nothing said
+                    return;
+                }
+                ctx.requestSwitch(picked);
+            });
+            return;
+        }
+        ctx.chainRef.current = ctx.chainRef.current.then(async () => {
+            for (const id of others)
+                bodyLog(`  ${escapeTerminal(id)}`);
+            bodyLog("switch with /resume <id>");
+            ctx.input.prompt();
+        });
+        return;
+    }
     // PH-1a (finding PH-F1): an unrecognized slash command is an ERROR,
     // never a turn — the fallthrough used to hand "/clear", "/exit", or a
     // typo to the model, burning a request on text the user meant as a

package/dist/index.js

@@ -23,7 +23,8 @@
  * index.ts keeps the entry: banner, input sources, the A area prompt,
  * makeAgent, and main.
  */
-import { readFileSync, realpathSync, rmSync } from "node:fs";
+import { appendFileSync, mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { newSessionId } from "./session-id.js";
 import { createInterface } from "node:readline";
 import { fileURLToPath } from "node:url";
 import { join } from "node:path";
@@ -33,7 +34,7 @@ import { createFauxProvider } from "@vincemakes/kiso-evals";
 import { createCodingTools } from "@vincemakes/kiso-tools-node";
 import { MODES, getMode, modeExtensions, modeFromEnv, modeSystemPrompt, setMode } from "./mode.js";
 import { builtInLayer } from "./builtin.js";
-import { agentModel, atFiles, body, bodyLog, builtInExtensions, currentFaux, dock, extensionsDir, loadedExtensions, mergedConfig, mergedTempPaths, projectExtensions, sessionStoreRef, sessionsDir, setAgentModel, setBody, setConfigModels, setConfiguredWindow, setCurrentAgentExtensions, setCurrentFaux, setCurrentModelName, setExtensionLists, setMergedConfig, setSessionStore, userExtensions, VERSION } from "./state.js";
+import { agentModel, atFiles, body, bodyLog, kisoHome, builtInExtensions, currentFaux, dock, extensionsDir, loadedExtensions, mergedConfig, mergedTempPaths, projectExtensions, sessionStoreRef, sessionsDir, setAgentModel, setBody, setConfigModels, setConfiguredWindow, setCurrentAgentExtensions, setCurrentFaux, setCurrentModelName, setExtensionLists, setMergedConfig, setSessionStore, userExtensions, VERSION } from "./state.js";
 import { askUi, resolveProjectTrust } from "./trust-ui.js";
 import { isFirstRun, scaffoldFirstRun } from "./first-run.js";
 import { fauxSkip, readFauxScript } from "./faux-glue.js";
@@ -188,6 +189,13 @@ function editorInput(editor) {
         bindQueue(state, pop) {
             editor.bindQueue(state, pop);
         },
+        // R3a: cross-session history — the CLI owns the file I/O.
+        bindHistory(seed, persist) {
+            editor.bindHistory(seed, persist);
+        },
+        onModeCycle(cb) {
+            editor.onModeCycle(cb);
+        },
         emitLine() {
             /* the editor's buffer survives a cancelled question — its text
              * becomes the next turn on Enter (the readline re-emit
@@ -570,6 +578,38 @@ function paintBootStatus(session) {
 class CliUsageError extends Error {
     exitCode = 2;
 }
+/** The /resume+/clear mini-spec — the chat LOOP: chat() ends with a
+ *  directive; a switch re-enters it on another session with the SAME
+ *  editor. First entry paints the banner; a switch paints one notice
+ *  line (the previous conversation stays resumable — clear/switch
+ *  never erase history). Faux sessions re-arm the scripted adapter at
+ *  the NEW session's durable position, exactly like the picker path. */
+async function chatLoop(agent, firstId, input, autoCompact) {
+    let id = firstId;
+    let prev = null;
+    for (;;) {
+        const session = await agent.session({ id });
+        if (prev === null) {
+            bodyLog(`session ${id}\n`);
+            extensionsBanner(await recentSessions(id, agent));
+        }
+        else {
+            bodyLog(`session ${id} (switched — previous: ${prev}, /resume ${prev} returns)\n`);
+            if (currentFaux)
+                session.setAdapter(createFauxProvider(readFauxScript().slice(fauxSkip(id))));
+        }
+        paintBootStatus(session);
+        const nav = {
+            sessions: () => agent.sessions().map((m) => m.id),
+            ...(process.stdin.isTTY ? { pick: () => pickSession(agent, input) } : {}),
+        };
+        const end = await chat(session, currentFaux, input, autoCompact, nav);
+        if (end.next === "exit")
+            return;
+        prev = id;
+        id = end.id;
+    }
+}
 async function main() {
     // E group (the graceful-exit gate ③, R-G 0.1.48): a terminal closing
     // turns the in-flight stdout/stderr writes into EIO, and node's
@@ -598,6 +638,22 @@ async function main() {
         console.log(VERSION);
         return;
     }
+    // R3a: -p/--print — the one-shot prompt mode (the F3 adjudication's
+    // forward path: a bare quoted argument stays a session id; the
+    // PROMPT is explicit). `kiso -p "fix the bug"` runs one turn on a
+    // fresh session and exits; an optional trailing session id continues
+    // that session one-shot instead. Exit code: 0 only when the turn's
+    // terminal is `completed` — scripts can trust it.
+    let printPrompt;
+    const printIdx = args.findIndex((a) => a === "-p" || a === "--print");
+    if (printIdx !== -1) {
+        printPrompt = args[printIdx + 1];
+        if (printPrompt === undefined) {
+            console.error('usage: kiso -p "prompt" [sessionId]');
+            process.exit(2);
+        }
+        args.splice(printIdx, 2);
+    }
     // merge round B: --model <profile|provider/model> — the top of the model
     // precedence chain; the value flows into makeAgent's config resolution.
     let modelFlag;
@@ -638,6 +694,33 @@ async function main() {
     // readline elsewhere. The trust question, chat, and resume all read
     // through it; main's finally closes it on every exit path.
     const input = makeLineInput();
+    // R3a — cross-session input history: ~/.kiso/history, one line per
+    // entry, appended on submit, tail-500 at load (truncated by REWRITE
+    // at startup so the file never grows unbounded). Unreadable file =
+    // an empty history, silently — recall is a convenience, never a
+    // startup risk. Control-character lines never enter the file (the
+    // editor's own recall excludes them by construction: a submitted
+    // line is printable input).
+    if (input.bindHistory !== undefined) {
+        const historyPath = join(kisoHome(), "history");
+        let seed = [];
+        try {
+            seed = readFileSync(historyPath, "utf8").split("\n").filter((l) => l !== "").slice(-500);
+            writeFileSync(historyPath, seed.length > 0 ? seed.join("\n") + "\n" : "");
+        }
+        catch {
+            // no file yet, or unreadable — start empty
+        }
+        input.bindHistory(seed, (line) => {
+            try {
+                mkdirSync(kisoHome(), { recursive: true });
+                appendFileSync(historyPath, line.replaceAll("\n", " ") + "\n");
+            }
+            catch {
+                // best-effort — a full disk never breaks a submit
+            }
+        });
+    }
     // PH-1a (finding PH-F6, RESOLVED AS WON'T-FIX-IN-JS — the tcsetattr
     // ruling): SIGTERM/SIGHUP deliberately keep their DEFAULT disposition.
     // A JS handler that restored the terminal was built and then reverted
@@ -670,9 +753,22 @@ async function main() {
             if (modeFlag === -1 && process.env.KISO_MODE === undefined && mergedConfig.mode !== undefined)
                 setMode(mergedConfig.mode);
         };
+        if (printPrompt !== undefined) {
+            // the -p flow: recovery-first one-shot, the resume() machinery
+            // verbatim (a fresh id makes the recovery a no-op)
+            const id = command ?? newSessionId(sessionsDir());
+            agent = await makeAgent(id, input, modelFlag);
+            applyConfigMode();
+            const session = await agent.session({ id });
+            faux = currentFaux;
+            await resume(session, printPrompt, faux, input);
+            const last = [...session.log.all].reverse().find((e) => e.type === "terminal");
+            process.exitCode = last !== undefined && last.outcome.kind === "completed" ? 0 : 1;
+            return;
+        }
         switch (command) {
             case "chat": {
-                const id = arg ?? new Date().toISOString().replace(/[:.]/g, "-").slice(0, 16);
+                const id = arg ?? newSessionId(sessionsDir());
                 // v2b: the dock (TTY only) wraps the whole session — the
                 // trust question, the banner, the body, and the input line.
                 dock.enter();
@@ -680,12 +776,8 @@ async function main() {
                 // position — never restarts it (fauxSkip).
                 agent = await makeAgent(id, input, modelFlag);
                 applyConfigMode();
-                const session = await agent.session({ id });
-                bodyLog(`session ${id}\n`);
-                extensionsBanner(await recentSessions(id, agent));
                 faux = currentFaux;
-                paintBootStatus(session); // TUI2-R2 ⑥: the idle-fresh screen says what it is
-                await chat(session, faux, input, resolveAutoCompact(mergedConfig));
+                await chatLoop(agent, id, input, resolveAutoCompact(mergedConfig));
                 break;
             }
             case "resume": {
@@ -712,7 +804,14 @@ async function main() {
                     // an error, never a session started behind their back.
                     if (picked === null)
                         break;
-                    id = picked;
+                    // the mini-spec (a DECLARED SUPERSESSION of the one-shot
+                    // picker flow): a PICKED session enters the full REPL —
+                    // "resume and keep working" no longer requires knowing to
+                    // type `kiso chat <id>`. The explicit-id one-shot form
+                    // (`kiso resume <id> ["prompt"]`) keeps its exact bytes.
+                    faux = currentFaux;
+                    await chatLoop(agent, picked, input, resolveAutoCompact(mergedConfig));
+                    break;
                 }
                 const session = await agent.session({ id });
                 faux = currentFaux;
@@ -786,7 +885,7 @@ async function main() {
             default: {
                 // A area: no subcommand (or any non-command first argument) IS
                 // chat — the first argument is the session id.
-                const id = command ?? new Date().toISOString().replace(/[:.]/g, "-").slice(0, 16);
+                const id = command ?? newSessionId(sessionsDir());
                 dock.enter();
                 // R-I-p2 (finding R-I-p-2): the bare command passes the SAME
                 // input source and model flag as chat/resume — the pre-patch
@@ -795,17 +894,9 @@ async function main() {
                 // undefined" at the ask (panelAsk with the dock, question on
                 // the dock-less fallback).
                 agent = await makeAgent(id, input, modelFlag);
-                const session = await agent.session({ id });
-                bodyLog(`session ${id}\n`);
-                extensionsBanner(await recentSessions(id, agent));
-                // finding E4-1: the same faux resolution the chat/resume cases
-                // carry (faux = currentFaux) — pre-patch the initial faux=true
-                // was passed here, so ANY provider failure in a bare-command
-                // session surfaced as "[faux mode] the scripted model failed:
-                // <real error>" (a false accusation of the keyless demo).
+                // finding E4-1's faux resolution rides chatLoop (currentFaux).
                 faux = currentFaux;
-                paintBootStatus(session); // TUI2-R2 ⑥: the same row on the bare command
-                await chat(session, faux, input, autoCompactFromEnv());
+                await chatLoop(agent, id, input, autoCompactFromEnv());
                 break;
             }
         }
@@ -869,7 +960,7 @@ function exitFlushed(code) {
 }
 if (process.argv[1] !== undefined && realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)) {
     main()
-        .then(() => exitFlushed(0))
+        .then(() => exitFlushed(typeof process.exitCode === "number" ? process.exitCode : 0))
         .catch((err) => {
         // round 10: top-level errors are terminal-escaped. v2a: the exit is EXPLICIT
         // — natural drain is racy on a TTY (readline leaves the stdio handles

package/dist/session-id.d.ts

@@ -0,0 +1,54 @@
+/**
+ * RD1B-F9 — the auto-generated session id, in ONE place.
+ *
+ * It used to be this expression, copied at four call sites:
+ *
+ *     new Date().toISOString().replace(/[:.]/g, "-").slice(0, 16)
+ *
+ * which stops at the MINUTE and carries no entropy. `SessionStore` is one
+ * file per id, so two sessions started in the same minute were the same
+ * session: the second launch presented as fresh and transparently appended
+ * to the first one's durable log (`tests/session-id-identity.test.ts`).
+ *
+ * WHAT THE GUARANTEE IS, precisely — because the first version of this
+ * comment claimed "collision-safe at any launch rate a human or a script
+ * produces" and that was an unmeasured claim that is false. A 16-bit
+ * suffix collides at script rates: 100 launches inside one second carry a
+ * 7.3% chance of at least one collision, and 1,000 produce a handful every
+ * time. Measured, not modelled.
+ *
+ * So the id does not rest on entropy at all:
+ *
+ *   - SEQUENTIAL collision is eliminated BY CONSTRUCTION. `newSessionId`
+ *     is handed the sessions directory and will not return an id whose
+ *     durable log or lock already exists; it draws again. Entropy only
+ *     decides how often it has to draw.
+ *   - CONCURRENT collision — two processes drawing the same id before
+ *     either has written — remains possible and is already handled
+ *     correctly one layer down: the store's single-writer link lock
+ *     (ADR-0050) fails the second writer loudly, and `storage.test.ts`
+ *     pins that. Loud failure is the right outcome there; silent sharing
+ *     was the defect.
+ *
+ * The id keeps the one property anything depends on: **lexicographic order
+ * is time order**, because `listSessions` sorts with `id.localeCompare`
+ * and nothing anywhere parses an id back into a date. Seconds extend the
+ * stamp monotonically; the suffix only breaks ties inside one second.
+ *
+ * It also stays 24 characters — exactly the session picker's id column cap
+ * (`packages/tui/src/session-picker.ts:112`). Widening the suffix instead
+ * of checking for collisions would have pushed the distinguishing tail out
+ * of the column, hiding the very bytes that make two ids different.
+ *
+ * Old ids are untouched — no rename, no migration. They still resume by id
+ * and still sort before same-minute new ids.
+ */
+/**
+ * A fresh session id: `YYYY-MM-DDTHH-MM-SS-xxxx`, sortable, and — when
+ * `dir` is given — guaranteed not to name a session that already exists
+ * there.
+ *
+ * `rand` is injectable so the collision path can be tested; production
+ * never passes it.
+ */
+export declare function newSessionId(dir?: string, now?: Date, rand?: () => string): string;

package/dist/session-id.js

@@ -0,0 +1,74 @@
+/**
+ * RD1B-F9 — the auto-generated session id, in ONE place.
+ *
+ * It used to be this expression, copied at four call sites:
+ *
+ *     new Date().toISOString().replace(/[:.]/g, "-").slice(0, 16)
+ *
+ * which stops at the MINUTE and carries no entropy. `SessionStore` is one
+ * file per id, so two sessions started in the same minute were the same
+ * session: the second launch presented as fresh and transparently appended
+ * to the first one's durable log (`tests/session-id-identity.test.ts`).
+ *
+ * WHAT THE GUARANTEE IS, precisely — because the first version of this
+ * comment claimed "collision-safe at any launch rate a human or a script
+ * produces" and that was an unmeasured claim that is false. A 16-bit
+ * suffix collides at script rates: 100 launches inside one second carry a
+ * 7.3% chance of at least one collision, and 1,000 produce a handful every
+ * time. Measured, not modelled.
+ *
+ * So the id does not rest on entropy at all:
+ *
+ *   - SEQUENTIAL collision is eliminated BY CONSTRUCTION. `newSessionId`
+ *     is handed the sessions directory and will not return an id whose
+ *     durable log or lock already exists; it draws again. Entropy only
+ *     decides how often it has to draw.
+ *   - CONCURRENT collision — two processes drawing the same id before
+ *     either has written — remains possible and is already handled
+ *     correctly one layer down: the store's single-writer link lock
+ *     (ADR-0050) fails the second writer loudly, and `storage.test.ts`
+ *     pins that. Loud failure is the right outcome there; silent sharing
+ *     was the defect.
+ *
+ * The id keeps the one property anything depends on: **lexicographic order
+ * is time order**, because `listSessions` sorts with `id.localeCompare`
+ * and nothing anywhere parses an id back into a date. Seconds extend the
+ * stamp monotonically; the suffix only breaks ties inside one second.
+ *
+ * It also stays 24 characters — exactly the session picker's id column cap
+ * (`packages/tui/src/session-picker.ts:112`). Widening the suffix instead
+ * of checking for collisions would have pushed the distinguishing tail out
+ * of the column, hiding the very bytes that make two ids different.
+ *
+ * Old ids are untouched — no rename, no migration. They still resume by id
+ * and still sort before same-minute new ids.
+ */
+import { randomBytes } from "node:crypto";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+/** How many draws before giving up. Reaching this means either the clock
+ *  is frozen or the directory holds ~every suffix for this second; both
+ *  are worth failing loudly over rather than returning a colliding id. */
+const MAX_DRAWS = 50;
+const stampOf = (now, suffix) => `${now.toISOString().replace(/[:.]/g, "-").slice(0, 19)}-${suffix}`;
+/**
+ * A fresh session id: `YYYY-MM-DDTHH-MM-SS-xxxx`, sortable, and — when
+ * `dir` is given — guaranteed not to name a session that already exists
+ * there.
+ *
+ * `rand` is injectable so the collision path can be tested; production
+ * never passes it.
+ */
+export function newSessionId(dir, now = new Date(), rand = () => randomBytes(2).toString("hex")) {
+    if (dir === undefined)
+        return stampOf(now, rand());
+    for (let draw = 0; draw < MAX_DRAWS; draw += 1) {
+        const id = stampOf(now, rand());
+        // The store writes `<id>.jsonl` and takes `<id>.lock`; either one
+        // present means the id is spoken for, including by a session that
+        // has locked but not yet appended.
+        if (!existsSync(join(dir, `${id}.jsonl`)) && !existsSync(join(dir, `${id}.lock`)))
+            return id;
+    }
+    throw new Error(`could not draw an unused session id in ${dir} after ${MAX_DRAWS} attempts`);
+}

package/dist/state.d.ts

@@ -100,6 +100,11 @@ export interface LineInput {
      *  live slots (each pop cancels the turn), esc ends the walk after
      *  one more pop. The chips are the compositor's own bindQueue. */
     bindQueue(state: () => readonly string[], pop: () => string | null): void;
+    /** R3a: cross-session history — seed the recall buffer, register the
+     *  append sink. The pipe path has no recall keys; optional. */
+    bindHistory?(seed: readonly string[], persist: (line: string) => void): void;
+    /** R3a: Shift+Tab cycles the approval tier (TTY editor only). */
+    onModeCycle?(cb: () => void): void;
     emitLine(line: string): void;
     line(): string;
     clearLine(): void;

package/dist/trust-ui.js

@@ -70,6 +70,28 @@ opts) {
                 resolve(verdict);
             }, opts);
         }
+        else if (view.ask) {
+            // RD1B-F6: a multiple-choice ask has NO dock-less form. The
+            // fallback said so — "the question is declined" — and then
+            // waited for a line anyway, forever, on input nothing in the
+            // environment knows to send: the surface has just announced
+            // the interaction is over. An unattended run did not fail
+            // there, it stopped, silently (RD-1B c9-r2).
+            //
+            // So the sentence becomes true. There is no panel, therefore
+            // no answer is obtainable, therefore the ask declines NOW and
+            // the model gets an honest refusal to act on. Waiting could
+            // only ever have produced the same decline, later, and every
+            // line typed at it was discarded anyway.
+            //
+            // The y/n fallback below still serves the views that really
+            // do take a yes or no — the uncertainty gate, the trust
+            // prompt, the verify offer. Those have a dock-less form.
+            settled = true;
+            pendingAsk = null;
+            bodyLog(view.fallbackQuestion);
+            resolve({ action: "deny", reason: "no option panel in this terminal" });
+        }
         else {
             // v2c: a TTY without a dock (rows < 4) — the fallback question
             // in the body; the y/n line answer maps to the verdicts.

package/package.json

@@ -1,56 +1,56 @@
 {
-  "name": "@vincemakes/kiso-code",
-  "version": "0.15.0",
-  "description": "kiso CLI — the durable coding agent that survives kill -9: kiso chat / kiso resume / kiso sessions.",
-  "type": "module",
-  "license": "MIT",
-  "bin": {
-    "kiso": "dist/index.js"
-  },
-  "files": [
-    "dist",
-    "README.md",
-    "LICENSE"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json",
-    "typecheck": "tsc -p tsconfig.json",
-    "test": "vitest run"
-  },
-  "dependencies": {
-    "@vincemakes/kiso-ask-ext": "0.15.0",
-    "@vincemakes/kiso-core": "0.15.0",
-    "@vincemakes/kiso-evals": "0.15.0",
-    "@vincemakes/kiso-mcp-ext": "0.15.0",
-    "@vincemakes/kiso-provider-anthropic": "0.15.0",
-    "@vincemakes/kiso-provider-openai": "0.15.0",
-    "@vincemakes/kiso-runtime": "0.15.0",
-    "@vincemakes/kiso-skills-ext": "0.15.0",
-    "@vincemakes/kiso-subagent-ext": "0.15.0",
-    "@vincemakes/kiso-task-ext": "0.15.0",
-    "@vincemakes/kiso-tools-node": "0.15.0",
-    "@vincemakes/kiso-tui": "0.15.0",
-    "@vincemakes/kiso-tui-cells": "0.15.0"
-  },
-  "devDependencies": {
-    "@types/node": "^26.1.2",
-    "typescript": "^5.7.2",
-    "vitest": "^3.0.0"
-  },
-  "engines": {
-    "node": ">=22"
-  },
-  "os": [
-    "darwin",
-    "linux"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/vincemakes/kiso.git",
-    "directory": "apps/cli"
-  },
-  "bugs": {
-    "url": "https://github.com/vincemakes/kiso/issues"
-  },
-  "homepage": "https://github.com/vincemakes/kiso/tree/main/apps/cli#readme"
+	"name": "@vincemakes/kiso-code",
+	"version": "0.15.2",
+	"description": "kiso CLI \u2014 the durable coding agent that survives kill -9: kiso chat / kiso resume / kiso sessions.",
+	"type": "module",
+	"license": "MIT",
+	"bin": {
+		"kiso": "dist/index.js"
+	},
+	"files": [
+		"dist",
+		"README.md",
+		"LICENSE"
+	],
+	"scripts": {
+		"build": "tsc -p tsconfig.build.json",
+		"typecheck": "tsc -p tsconfig.json",
+		"test": "vitest run"
+	},
+	"dependencies": {
+		"@vincemakes/kiso-ask-ext": "0.15.2",
+		"@vincemakes/kiso-core": "0.15.2",
+		"@vincemakes/kiso-evals": "0.15.2",
+		"@vincemakes/kiso-mcp-ext": "0.15.2",
+		"@vincemakes/kiso-provider-anthropic": "0.15.2",
+		"@vincemakes/kiso-provider-openai": "0.15.2",
+		"@vincemakes/kiso-runtime": "0.15.2",
+		"@vincemakes/kiso-skills-ext": "0.15.2",
+		"@vincemakes/kiso-subagent-ext": "0.15.2",
+		"@vincemakes/kiso-task-ext": "0.15.2",
+		"@vincemakes/kiso-tools-node": "0.15.2",
+		"@vincemakes/kiso-tui": "0.15.2",
+		"@vincemakes/kiso-tui-cells": "0.15.2"
+	},
+	"devDependencies": {
+		"@types/node": "^26.1.2",
+		"typescript": "^5.7.2",
+		"vitest": "^3.0.0"
+	},
+	"engines": {
+		"node": ">=22"
+	},
+	"os": [
+		"darwin",
+		"linux"
+	],
+	"repository": {
+		"type": "git",
+		"url": "https://github.com/vincemakes/kiso.git",
+		"directory": "apps/cli"
+	},
+	"bugs": {
+		"url": "https://github.com/vincemakes/kiso/issues"
+	},
+	"homepage": "https://github.com/vincemakes/kiso/tree/main/apps/cli#readme"
 }