@vincemakes/kiso-code 0.34.0 → 0.37.0

package/dist/index.js

@@ -37,13 +37,13 @@ import { createCodingTools } from "@vincemakes/kiso-tools-node";
 import { MODES, getMode, modeExtensions, modeFromEnv, modeSystemPrompt, setMode } from "./mode.js";
 import { breakerExtension } from "./breaker.js";
 import { builtInLayer } from "./builtin.js";
-import { agentModel, atFiles, body, bodyLog, codingToolOptions, kisoHome, builtInExtensions, currentFaux, dock, extensionsDir, loadedExtensions, mergedConfig, mergedTempPaths, modelChoice, projectExtensions, configModels, configuredWindow, agentBaseUrl, currentModelName, currentAgentExtensions, sessionStoreRef, sessionsDir, setAgentModel, setBody, setConfigModels, setConfiguredWindow, setCurrentAgentExtensions, setCurrentFaux, setCurrentModelName, setExtensionLists, setMergedConfig, setModelChoice, setSessionStore, userExtensions, VERSION, lastBinding, acceptDrift, setAcceptDrift } from "./state.js";
+import { agentModel, atFiles, body, bodyLog, codingToolOptions, kisoHome, builtInExtensions, currentFaux, dock, extensionsDir, loadedExtensions, mergedConfig, mergedTempPaths, modelChoice, projectExtensions, configModels, configuredWindow, agentBaseUrl, currentModelName, currentAgentExtensions, sessionStoreRef, sessionsDir, setAgentModel, setBody, setConfigModels, setConfiguredWindow, setCurrentAgentExtensions, setCurrentFaux, setCurrentModelName, setExtensionLists, setMergedConfig, setModelChoice, setSessionStore, secretEnvNamesOf, userExtensions, VERSION, lastBinding, acceptDrift, setAcceptDrift } from "./state.js";
 import { askUi, resolveProjectTrust } from "./trust-ui.js";
 import { isFirstRun, scaffoldFirstRun } from "./first-run.js";
 import { fauxSkip, readFauxScript } from "./faux-glue.js";
-import { chat, contextWindowTokens, displayCtxRatio, statusModelLabel } from "./chat.js";
+import { chat, displayCtxRatio, microcompactThresholdFor, statusModelLabel } from "./chat.js";
+import { adapterOptionsFor } from "./auth/adapter-options.js";
 import { loadProjectConfig, loadUserConfig, mergeConfigs, resolveAutoCompact, resolveContextWindow, resolveModel } from "./config.js";
-import { oauthTokenThunk } from "./auth/token.js";
 import { checkForUpdate, knownUpdate, updateCardLines } from "./update-check.js";
 import { tmuxMouseHint } from "./tmux-hint.js";
 import { resume } from "./resume.js";
@@ -96,6 +96,47 @@ function streamIdleFromEnv() {
  *  OR-9 adds `update`: npm inherits the terminal for the install's own
  *  progress and prompts, so no editor may hold stdin while it runs. */
 const CREDENTIAL_COMMANDS = new Set(["login", "logout", "auth", "update"]);
+/**
+ * Astra F3 — A STORED CREDENTIAL IS NOT A SELECTED MODEL.
+ *
+ * `kiso login` exits 0, says the key is stored, and stops. With no profile
+ * the very next command still announces the demo and runs the scripted
+ * listing, so a person who has just signed in reasonably concludes that
+ * sign-in failed or is being ignored. Nothing was broken: a credential is
+ * stored under a PROVIDER, and a PROFILE is what selects the model that
+ * uses it. The gap was that nobody said so at the one moment it matters.
+ *
+ * These are onboarding EXAMPLES, not a resolution path — nothing here ever
+ * decides where a credential goes (that is `effectiveBaseUrl` and
+ * `providerIdOf`, and it stays there).
+ */
+const PROFILE_EXAMPLE = {
+    anthropic: '{"model":"claude","models":{"claude":{"kind":"anthropic","model":"claude-sonnet-5"}}}',
+    openai: '{"model":"gpt","models":{"gpt":{"kind":"openai-compat","model":"gpt-4o"}}}',
+    chatgpt: '{"model":"codex","models":{"codex":{"kind":"openai-responses","model":"gpt-5-codex","baseUrl":"https://chatgpt.com/backend-api/codex"}}}',
+    deepseek: '{"model":"deepseek","models":{"deepseek":{"kind":"openai-compat","model":"deepseek-flash","baseUrl":"https://api.deepseek.com"}}}',
+    zai: '{"model":"glm","models":{"glm":{"kind":"openai-compat","model":"glm-5.3-flash","baseUrl":"https://api.z.ai"}}}',
+};
+/** The line a fresh sign-in needs, or nothing when profiles already exist.
+ *  Read from the USER config alone: a credential command resolves no
+ *  project trust, and profiles live in the user's own file. */
+function nextStepAfterLogin(provider) {
+    let hasProfile = false;
+    try {
+        hasProfile = Object.keys(loadUserConfig()?.models ?? {}).length > 0;
+    }
+    catch {
+        // A config that cannot be read is its own loud error elsewhere; here
+        // it only means we cannot prove a profile exists, so we say the step.
+    }
+    if (hasProfile)
+        return "\nkiso already has profiles — `/model` in a session lists them and switches.\n";
+    const example = PROFILE_EXAMPLE[provider];
+    return (`\nThe key is stored, but nothing selects a model yet: a PROFILE does that,` +
+        ` and without one kiso stays in the keyless faux mode.\nPut one in ${join(kisoHome(), "config.json")}` +
+        (example === undefined ? ":\n" : `, for example:\n\n  ${example}\n`) +
+        `\nThen run kiso. \`/model\` lists your profiles and switches between them.\n`);
+}
 /** OR-9: the one install command the README gives, which `kiso update`
  *  runs and the failure message names. */
 const INSTALL_COMMAND = ["npm", "i", "-g", "@vincemakes/kiso-code@latest"];
@@ -539,6 +580,13 @@ directory and change code with tools. Be concise: answer in a few lines
 unless the task genuinely needs more. Never claim a file was changed
 unless a tool confirmed it.
 
+What you can reach:
+- The workspace: read_file, list_dir, search_text, write_file, edit_file.
+- This machine and the network: shell — builds, tests, git, package
+  managers, curl for HTTP, system queries. A request one command can
+  answer is answered by running it.
+- The human: ask_user, for a decision that is theirs.
+
 Tool discipline:
 - READ BEFORE YOU EDIT. For any file you are about to change, read it
   first — never guess its content.
@@ -550,11 +598,18 @@ Tool discipline:
 - Batch independent tool calls into one reply — they run in parallel.
 - search_text and list_dir are cheap — locate first, then read ranges
   with read_file offset/limit; never read a whole large file in one call.
-- Do not re-read a file you already read unchanged — rely on the earlier
-  result.
+- Do not re-read a file you already read unchanged, or one you changed
+  yourself through a confirmed edit — rely on the earlier result and
+  on the change you just made.
 - When a tool fails, read the error and adjust; do not repeat the same
   call blindly.
 
+An authorization covers what it NAMES: when the scope is not named —
+which files, which branches, whether to push — ask before acting.
+Delivering, sharing or handing over changes means committing locally and
+stopping; pushing, publishing or sending happens only when the human
+names it.
+
 Workflow: understand the request, find the relevant code, make the
 smallest change that works, then verify with a command (tests/build).
 Report what you did in one or two lines per change.`;
@@ -664,24 +719,33 @@ async function makeAgent(sessionId, input, modelFlag) {
     // the panel bridge is the argument, and a non-TTY session has none to
     // give. A piped run's composed tool table therefore cannot contain
     // ask_user (T-Q3: the bench's structural byte-identity proof).
-    const builtIn = await builtInLayer(user, proj, input !== undefined && process.stdin.isTTY ? askUi(input) : undefined);
+    // Astra F7: the config is READ here — a pure read, its setters still run
+    // below with the rest of merge round B — because the mcp extension spawns
+    // its stdio children while it is being constructed, and the strip needs
+    // the configured secret names by then.
+    const userCfg = loadUserConfig();
+    const projectCfg = loadProjectConfig(process.cwd(), project !== null);
+    const merged = mergeConfigs(userCfg, projectCfg);
+    const secretEnvNames = secretEnvNamesOf(merged.models ?? {});
+    const builtIn = await builtInLayer(user, proj, input !== undefined && process.stdin.isTTY ? askUi(input) : undefined, secretEnvNames);
     setExtensionLists(builtIn, user, proj, [...builtIn, ...user, ...proj]);
     // merge round B — the config surface: user config + (trusted) project config,
     // resolved with flags > env > project > user > default. The CLI never
     // imports provider SDKs directly — the runtime's lazy provider
     // resolution owns them (a config profile only ever NAMES an env var for
     // its key; the key itself never sits in a config file).
-    const userCfg = loadUserConfig();
-    const projectCfg = loadProjectConfig(process.cwd(), project !== null);
-    const merged = mergeConfigs(userCfg, projectCfg);
     setMergedConfig(merged);
     // DT-1a: what a delegated task may NAME — the configured checks and the
     // model profiles — handed to the (in-process) subagent extension through
     // the environment. A model never supplies a command; it names a check.
     process.env.KISO_DELEGATION_CONFIG_JSON = JSON.stringify({ checks: merged.checks ?? {}, profiles: Object.keys(merged.models ?? {}) });
     setConfigModels(merged.models ?? {});
-    setConfiguredWindow(resolveContextWindow(merged));
     const resolved = resolveModel(modelFlag, merged);
+    // AFTER the model resolves: the window a PROFILE states is about that
+    // profile's model, so it cannot be read before we know which profile is
+    // selected. Reading it a line too early is how the compaction threshold
+    // ended up frozen at the wrong model's value (CTX-1).
+    setConfiguredWindow(resolveContextWindow(merged, resolved?.profile));
     const model = resolved === null ? "faux" : resolved.profile.model;
     if (resolved === null) {
         console.log("[faux mode — set ANTHROPIC_API_KEY or OPENAI_API_KEY, or configure models in ~/.kiso/config.json]\n");
@@ -725,7 +789,9 @@ async function makeAgent(sessionId, input, modelFlag) {
         // half the model window (KISO_CONTEXT_WINDOW override included;
         // 200k window → 100k tokens). Long sessions compact old read/list/
         // search/shell outputs instead of silently growing past the window.
-        microcompact: { thresholdTokens: contextWindowTokens() / 2 },
+        // CTX-1: the startup value; `/model` recomputes it through the same
+        // function, so the two can never drift apart.
+        microcompact: { thresholdTokens: microcompactThresholdFor() },
         // E6: the run-start context policy — OFF unless env-armed (beats the microcompact default when both fire).
         ...(contextPolicy !== undefined ? { contextPolicy } : {}),
         // R3e (owner ruling, 2026-08-28): NO turn limit on an interactive
@@ -741,21 +807,18 @@ async function makeAgent(sessionId, input, modelFlag) {
         ...(resolved !== null
             ? {
                 provider: resolved.profile.kind,
-                // OR-1: exactly one sign-in shape reaches the adapter. An
-                // OAuth profile has no key to pass — it passes the thunk
-                // the adapter re-resolves per request instead.
-                ...(resolved.oauthProviderId !== undefined
-                    ? { oauth: oauthTokenThunk(resolved.oauthProviderId) }
-                    : { apiKey: resolved.apiKey ?? "none" }),
-                // OR-1: the ChatGPT backend's cache lane is the SESSION —
-                // one conversation's requests share a key, different
-                // conversations never do. The one entry point that hands
-                // no session id is `kiso sessions`, a read-only listing
-                // that streams nothing, so its absence costs no cache.
-                ...(sessionId !== undefined ? { promptCacheKey: sessionId } : {}),
-                ...(resolved.profile.baseUrl !== undefined ? { baseUrl: resolved.profile.baseUrl } : {}),
-                ...(resolved.profile.promptCaching !== undefined ? { promptCaching: resolved.profile.promptCaching } : {}),
-                // LT-1: the profile's stream watchdog bound, if it states one
+                // Astra F1 (P0): the wire config is built in ONE place
+                // (auth/adapter-options.ts) — credential shape, the ALWAYS
+                // EXPLICIT endpoint, the session's cache key and the
+                // profile's caching flag. This site and the `/model` site
+                // were the same spread written twice.
+                ...adapterOptionsFor(resolved.profile, resolved.oauthProviderId !== undefined
+                    ? { type: "oauth", providerId: resolved.oauthProviderId }
+                    : { type: "api-key", apiKey: resolved.apiKey ?? "none" }, sessionId),
+                // LT-1: the profile's stream watchdog bound, if it states one.
+                // NOT an adapter option — an agent-definition field the
+                // runtime reads — so it stays here rather than moving into
+                // adapterOptionsFor.
                 ...(resolved.profile.streamIdleMs !== undefined ? { streamIdleMs: resolved.profile.streamIdleMs } : {}),
             }
             : { adapter: createFauxProvider(readFauxScript().slice(fauxSkipTurns)) }),
@@ -831,6 +894,33 @@ async function pickSession(agent, input) {
  * formatter — never a boot-time copy, which would drift from the real
  * row the moment either changed.
  */
+/**
+ * CTX-1 (Astra F34-1): EVERY entry point that opens a session must bind the
+ * policy that follows the session's OWN model.
+ *
+ * `agent.session()` restores the model recorded in the durable profile —
+ * any model that session ever used, not necessarily the one this process
+ * started on. The display and the compaction threshold are both derived
+ * from it, so both belong here.
+ *
+ * The first fix put these two lines in chatLoop only. `kiso resume <id>`
+ * and `kiso -p <text> <id>` open through their own paths, restored the
+ * model, and kept the STARTUP threshold: a session recorded on a 1M model,
+ * resumed from a 200k start, cleared its tool results at 100,000 while the
+ * interactive entry point cleared at 500,000. Three doors, one of them
+ * fixed, is the same defect with a smaller blast radius.
+ *
+ * The pair is passed EXPLICITLY, never read back out of the display state
+ * set on the line above: depending on two lines staying in order is how the
+ * threshold got stuck in the first place.
+ */
+function bindRestoredSession(session) {
+    setAgentModel(session.model, session.baseUrl);
+    session.setMicrocompactThreshold(microcompactThresholdFor({
+        model: session.model,
+        ...(session.baseUrl !== undefined ? { baseUrl: session.baseUrl } : {}),
+    }));
+}
 function paintBootStatus(session) {
     if (!dock.active)
         return;
@@ -1033,7 +1123,9 @@ async function chatLoop(first, firstId, input, autoCompact) {
         // XP-1 §2.1: the switched-to session's OWN truth repaints the row —
         // the global display state never outlives the session it described
         // (pre-XP the row kept the previous session's /model selection).
-        setAgentModel(session.model, session.baseUrl);
+        // CTX-1: the restored session's own model decides the display AND
+        // the threshold. One step, shared by all three entry points.
+        bindRestoredSession(session);
         setCurrentModelName(session.model);
         paintBootStatus(session);
         const nav = {
@@ -1296,7 +1388,12 @@ async function main() {
     input.onClipboardPaste?.(() => {
         const shot = clipboardImage(tmpdir());
         if (shot === null) {
-            bodyLog("[no image on the clipboard — ctrl+V attaches one; a file dragged into the window works too]");
+            // Astra F8: on a platform with no clipboard reader kiso never
+            // LOOKED, so "no image on the clipboard" blamed the clipboard for
+            // a limit of the build. Say which of the two it is.
+            bodyLog(process.platform === "darwin"
+                ? "[no image on the clipboard — ctrl+V attaches one; a file dragged into the window works too]"
+                : "[clipboard images are macOS-only — put the image's path in your message instead; a file dragged into the window leaves one]");
             return null;
         }
         return shot;
@@ -1316,6 +1413,7 @@ async function main() {
             agent = await makeAgent(id, input, modelFlag);
             applyConfigMode();
             const session = await agent.session({ id, ...(acceptDrift() ? { acceptDrift: true } : {}) });
+            bindRestoredSession(session); // CTX-1 (F34-1): the -p door, too
             faux = currentFaux;
             await resume(session, printPrompt, faux, input);
             const last = [...session.log.all].reverse().find((e) => e.type === "terminal");
@@ -1370,6 +1468,7 @@ async function main() {
                     break;
                 }
                 const session = await agent.session({ id, ...(acceptDrift() ? { acceptDrift: true } : {}) });
+                bindRestoredSession(session); // CTX-1 (F34-1): the explicit-id door
                 faux = currentFaux;
                 // E area: the durable script position is computed from the
                 // session id, and on the picker path the id did not exist when
@@ -1465,6 +1564,7 @@ async function main() {
                         });
                         setCredential(provider, cred);
                         process.stdout.write(`signed in to ${provider} (${chatgptFlow.label}) — account ${cred.accountId ?? "?"}, expires ${new Date(cred.expires).toISOString()} — stored in ${authPath()}\n`);
+                        process.stdout.write(nextStepAfterLogin(provider));
                     }
                     finally {
                         rl.close();
@@ -1476,6 +1576,7 @@ async function main() {
                     throw new CliUsageError(`kiso login ${provider}: no key given`);
                 setCredential(provider, { type: "api-key", key, savedAt: Date.now() });
                 process.stdout.write(`signed in to ${provider} with an API key (${maskSecret(key)}) — stored in ${authPath()}\n`);
+                process.stdout.write(nextStepAfterLogin(provider));
                 break;
             }
             case "update": {

package/dist/mode.d.ts

@@ -15,7 +15,16 @@ export declare const MODES: readonly Mode[];
 /** DC-36 — one line per tier, for the picker, TRANSCRIBED FROM decide()
  *  below rather than written fresh. A description that drifts from the
  *  behaviour is worse than none: this is the row a human reads before
- *  handing over the approval gate. */
+ *  handing over the approval gate.
+ *
+ *  Astra F4: these describe THE TIER'S CONTRIBUTION TO THE CHAIN, not the
+ *  chain's verdict. "every tool asks" read as a promise that manual is a
+ *  revocation — pick it and you are asked about everything again — and it
+ *  is not. A tier that ASKS abstains in favour of anything that ALLOWS, so
+ *  a saved don't-ask-again rule still allows, and the side effect runs with
+ *  no new question. The composition (deny > allow > ask) is the ruling and
+ *  is unchanged; the copy was the thing that was wrong. `plan` needs no
+ *  qualification because it DENIES, and a deny is what nothing overrides. */
 export declare const MODE_NOTE: Readonly<Record<Mode, string>>;
 export declare function getMode(): Mode;
 export declare function setMode(m: Mode): void;

package/dist/mode.js

@@ -13,13 +13,22 @@ export const MODES = ["manual", "default", "accept-edits", "plan", "bypass"];
 /** DC-36 — one line per tier, for the picker, TRANSCRIBED FROM decide()
  *  below rather than written fresh. A description that drifts from the
  *  behaviour is worse than none: this is the row a human reads before
- *  handing over the approval gate. */
+ *  handing over the approval gate.
+ *
+ *  Astra F4: these describe THE TIER'S CONTRIBUTION TO THE CHAIN, not the
+ *  chain's verdict. "every tool asks" read as a promise that manual is a
+ *  revocation — pick it and you are asked about everything again — and it
+ *  is not. A tier that ASKS abstains in favour of anything that ALLOWS, so
+ *  a saved don't-ask-again rule still allows, and the side effect runs with
+ *  no new question. The composition (deny > allow > ask) is the ruling and
+ *  is unchanged; the copy was the thing that was wrong. `plan` needs no
+ *  qualification because it DENIES, and a deny is what nothing overrides. */
 export const MODE_NOTE = {
-    manual: "every tool asks",
-    default: "reads run; writes, edits and shell ask",
-    "accept-edits": "reads, writes and edits run; shell asks",
-    plan: "reads run; everything else is denied — read-only",
-    bypass: "everything runs, nothing asks",
+    manual: "asks for every tool — a saved allow still allows",
+    default: "reads run; writes, edits and shell ask — a saved allow still allows",
+    "accept-edits": "reads, writes and edits run; shell asks — a saved allow still allows",
+    plan: "reads run; everything else is denied — read-only, and a deny wins",
+    bypass: "everything runs, nothing asks — a user deny still wins",
 };
 /** The read-only tool set (plan): reading is allowed, everything else
  *  denied with the guiding reason. */

package/dist/state.d.ts

@@ -16,9 +16,19 @@ export declare function kisoHome(): string;
  *  is decided. The session's own tool set and the `!` command's runner both
  *  need it, and two copies of a ruling-bearing literal is how a later DC-49
  *  amendment reaches one caller and not the other. */
+/**
+ * Astra F7 — every configured profile's `apiKeyEnv` NAME is a secret name.
+ * The strip's suffix rules cannot see `REVIEW_PROVIDER_TOKEN`, and only the
+ * config knows which names are keys, so the config says so. ONE derivation:
+ * the shell tool reads it through codingToolOptions, and startup reads it
+ * directly for the mcp extension, which spawns its stdio children before
+ * these state setters have run.
+ */
+export declare function secretEnvNamesOf(models: Readonly<Record<string, unknown>>): readonly string[];
 export declare function codingToolOptions(): {
     readonly workspaceRoot: string;
     readonly excludeRoots: readonly string[];
+    readonly secretEnvNames: readonly string[];
 };
 export declare function sessionsDir(): string;
 /** E1: the extension scan directory — KISO_EXTENSIONS_DIR overrides. */

package/dist/state.js

@@ -22,8 +22,23 @@ export function kisoHome() {
  *  is decided. The session's own tool set and the `!` command's runner both
  *  need it, and two copies of a ruling-bearing literal is how a later DC-49
  *  amendment reaches one caller and not the other. */
+/**
+ * Astra F7 — every configured profile's `apiKeyEnv` NAME is a secret name.
+ * The strip's suffix rules cannot see `REVIEW_PROVIDER_TOKEN`, and only the
+ * config knows which names are keys, so the config says so. ONE derivation:
+ * the shell tool reads it through codingToolOptions, and startup reads it
+ * directly for the mcp extension, which spawns its stdio children before
+ * these state setters have run.
+ */
+export function secretEnvNamesOf(models) {
+    return [
+        ...new Set(Object.values(models)
+            .map((p) => p.apiKeyEnv)
+            .filter((n) => typeof n === "string" && n.length > 0)),
+    ];
+}
 export function codingToolOptions() {
-    return { workspaceRoot: process.cwd(), excludeRoots: [kisoHome()] };
+    return { workspaceRoot: process.cwd(), excludeRoots: [kisoHome()], secretEnvNames: secretEnvNamesOf(configModels) };
 }
 export function sessionsDir() {
     return join(kisoHome(), "sessions");

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@vincemakes/kiso-code",
-	"version": "0.34.0",
-	"description": "kiso-code — the coding agent on kiso, the durable runtime for AI agents: kiso chat / kiso resume / kiso sessions.",
+	"version": "0.37.0",
+	"description": "kiso-code \u2014 the coding agent on kiso, the durable runtime for AI agents: kiso chat / kiso resume / kiso sessions.",
 	"type": "module",
 	"license": "MIT",
 	"bin": {
@@ -18,20 +18,20 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@vincemakes/kiso-ask-ext": "0.34.0",
-		"@vincemakes/kiso-core": "0.34.0",
-		"@vincemakes/kiso-evals": "0.34.0",
-		"@vincemakes/kiso-mcp-ext": "0.34.0",
-		"@vincemakes/kiso-provider-anthropic": "0.34.0",
-		"@vincemakes/kiso-provider-openai": "0.34.0",
-		"@vincemakes/kiso-provider-openai-responses": "0.34.0",
-		"@vincemakes/kiso-runtime": "0.34.0",
-		"@vincemakes/kiso-skills-ext": "0.34.0",
-		"@vincemakes/kiso-subagent-ext": "0.34.0",
-		"@vincemakes/kiso-task-ext": "0.34.0",
-		"@vincemakes/kiso-tools-node": "0.34.0",
-		"@vincemakes/kiso-tui": "0.34.0",
-		"@vincemakes/kiso-tui-cells": "0.34.0"
+		"@vincemakes/kiso-ask-ext": "0.37.0",
+		"@vincemakes/kiso-core": "0.37.0",
+		"@vincemakes/kiso-evals": "0.37.0",
+		"@vincemakes/kiso-mcp-ext": "0.37.0",
+		"@vincemakes/kiso-provider-anthropic": "0.37.0",
+		"@vincemakes/kiso-provider-openai": "0.37.0",
+		"@vincemakes/kiso-provider-openai-responses": "0.37.0",
+		"@vincemakes/kiso-runtime": "0.37.0",
+		"@vincemakes/kiso-skills-ext": "0.37.0",
+		"@vincemakes/kiso-subagent-ext": "0.37.0",
+		"@vincemakes/kiso-task-ext": "0.37.0",
+		"@vincemakes/kiso-tools-node": "0.37.0",
+		"@vincemakes/kiso-tui": "0.37.0",
+		"@vincemakes/kiso-tui-cells": "0.37.0"
 	},
 	"devDependencies": {
 		"@types/node": "^26.1.2",