@vincemakes/kiso-code 0.39.2 → 0.40.0

package/README.md

@@ -44,7 +44,7 @@ kiso sessions                list durable sessions
 kiso help                    usage + configuration reference
 ```
 
-Sessions live under `~/.kiso/sessions`; kill the process — `kill -9`
+Sessions live under `~/.kiso/projects/<project>/`, one folder per project; kill the process — `kill -9`
 included — and `kiso resume` continues exactly where the log ends.
 
 **Platforms:** macOS / Linux (Node ≥ 22). Windows is unsupported.

package/dist/attachments.d.ts

@@ -38,4 +38,4 @@ export declare function sniff(buf: Buffer): "image/png" | "image/jpeg" | "image/
  * standing in the text. Silently dropping it would tell the model about
  * a file it cannot see, which is worse than telling it nothing.
  */
-export declare function attachImages(text: string, files?: ReadonlyMap<number, string>): string | ContentBlock[];
+export declare function attachImages(text: string, files?: ReadonlyMap<number, string>, protectedFiles?: readonly string[]): string | ContentBlock[];

package/dist/attachments.js

@@ -21,6 +21,7 @@
  * hand its temp file to when it lands.
  */
 import { readFileSync, statSync } from "node:fs";
+import { isProtectedPath, protectedIdentity } from "@vincemakes/kiso-tools-node";
 /**
  * The size a single image may reach before it is refused.
  *
@@ -55,7 +56,12 @@ const CANDIDATES = [
     /"([^"]*\.(?:png|jpe?g|gif|webp))"/gi,
     /(\S*\.(?:png|jpe?g|gif|webp))/gi,
 ];
-function look(path) {
+function look(path, id) {
+    // a protected file is never attached, image or not: a user may list a
+    // scan of a passport, and a path in a turn can come from a model's
+    // delegate task or a command's output, not only from the person
+    if (isProtectedPath(path, id))
+        return null;
     try {
         const st = statSync(path);
         if (!st.isFile() || st.size > MAX_IMAGE_BYTES || st.size === 0)
@@ -83,7 +89,8 @@ function look(path) {
  * standing in the text. Silently dropping it would tell the model about
  * a file it cannot see, which is worse than telling it nothing.
  */
-export function attachImages(text, files) {
+export function attachImages(text, files, protectedFiles = []) {
+    const id = protectedIdentity(protectedFiles);
     const found = [];
     const claimed = [];
     // REL-0152-D16: the `[Image #N]` capsules first. The buffer carries a
@@ -97,7 +104,7 @@ export function attachImages(text, files) {
             const path = files.get(Number(m[1]));
             if (path === undefined)
                 continue;
-            const hit = look(path);
+            const hit = look(path, id);
             if (hit === null)
                 continue;
             claimed.push({ start: m.index, end: m.index + m[0].length });
@@ -112,7 +119,7 @@ export function attachImages(text, files) {
             const end = start + m[0].length;
             if (claimed.some((c) => start < c.end && end > c.start))
                 continue;
-            const hit = look(path);
+            const hit = look(path, id);
             if (hit === null)
                 continue;
             claimed.push({ start, end });

package/dist/builtin.d.ts

@@ -1,5 +1,17 @@
 import { type AskUI } from "@vincemakes/kiso-ask-ext";
 import type { KisoExtension } from "@vincemakes/kiso-runtime";
+/**
+ * 0.40.0 (the owner's dogfood): dontAsk never asks, so its tool table never
+ * offers ask_user — a model once put four questions to a dontAsk session
+ * that could only decline them. A LIVE gate, not a load-time one: the
+ * registry reads an extension's tools on every request (registerLive) and
+ * the run recomposes the tool table, snippet and guidelines included, so
+ * entering dontAsk takes ask_user away from the next run and leaving it
+ * brings ask_user back. In dontAsk the table is byte-identical to the pipe
+ * path's; each switch in or out costs one prompt-cache break. The decline
+ * path (trust-ui) stays for a turn already in flight when the mode changes.
+ */
+export declare function offInDontAsk(ext: KisoExtension): KisoExtension;
 export declare function builtInLayer(user: readonly KisoExtension[], project: readonly KisoExtension[], 
 /** KC3.5: built-in #4 — the ask extension, loaded ONLY when a panel
  *  bridge exists (an interactive TTY). No bridge, no fourth built-in:

package/dist/builtin.js

@@ -25,6 +25,27 @@ import createMcp from "@vincemakes/kiso-mcp-ext";
 import createSkills from "@vincemakes/kiso-skills-ext";
 import createSubagent from "@vincemakes/kiso-subagent-ext";
 import createAsk, {} from "@vincemakes/kiso-ask-ext";
+import { getMode } from "./mode.js";
+/**
+ * 0.40.0 (the owner's dogfood): dontAsk never asks, so its tool table never
+ * offers ask_user — a model once put four questions to a dontAsk session
+ * that could only decline them. A LIVE gate, not a load-time one: the
+ * registry reads an extension's tools on every request (registerLive) and
+ * the run recomposes the tool table, snippet and guidelines included, so
+ * entering dontAsk takes ask_user away from the next run and leaving it
+ * brings ask_user back. In dontAsk the table is byte-identical to the pipe
+ * path's; each switch in or out costs one prompt-cache break. The decline
+ * path (trust-ui) stays for a turn already in flight when the mode changes.
+ */
+export function offInDontAsk(ext) {
+    const tools = ext.tools ?? [];
+    return {
+        ...ext,
+        get tools() {
+            return getMode() === "dontAsk" ? [] : tools;
+        },
+    };
+}
 export async function builtInLayer(user, project, 
 /** KC3.5: built-in #4 — the ask extension, loaded ONLY when a panel
  *  bridge exists (an interactive TTY). No bridge, no fourth built-in:
@@ -36,7 +57,7 @@ ask,
  *  constructed, so the names have to arrive here — after construction is
  *  too late. Only the config knows them; nothing else can. */
 secretEnvNames = []) {
-    const all = await Promise.all([createMcp({ secretEnvNames }), createSkills(), createSubagent(), ...(ask === undefined ? [] : [createAsk(ask)])]);
+    const all = await Promise.all([createMcp({ secretEnvNames }), createSkills(), createSubagent(), ...(ask === undefined ? [] : [createAsk(ask).then(offInDontAsk)])]);
     const shadowed = all.filter((b) => user.some((u) => u.name === b.name));
     for (const s of shadowed) {
         console.error(`[extensions] user extension "${s.name}" shadows the built-in — the built-in is not loaded`);

package/dist/chat.d.ts

@@ -4,6 +4,7 @@
  * approval-moment mini-diff, the status spinner, and the context
  * estimates. All bodies moved verbatim from index.ts.
  */
+import type { SessionRoute } from "./projects.js";
 import { type RunUsage } from "@vincemakes/kiso-tui";
 import { type SaferFailure, type SaferOption } from "@vincemakes/kiso-tui";
 import type { AgentSession, Run } from "@vincemakes/kiso-runtime";
@@ -79,8 +80,10 @@ export declare function microcompactThresholdFor(of?: {
     readonly baseUrl?: string;
 }): number;
 /**
- * B area: approximate context ratio — chars/4 of the projected messages vs
- * the model window. Marked ~ everywhere it is shown; no counting API.
+ * B area: approximate context ratio vs the model window. Marked ~
+ * everywhere it is shown. 0.40.0: the context as the last bill measured it
+ * (session.contextUsed — the estimate only when no bill describes it);
+ * chars/4 alone read the owner's 730k Chinese-heavy context as ~470k.
  */
 export declare function estimateCtxRatio(session: AgentSession): number;
 /** A1a: the ratio the STATUS LINE and the ctx displays show — the request
@@ -98,6 +101,27 @@ export declare function statusModelLabel(session: {
     };
 }): string;
 export declare function displayCtxRatio(session: AgentSession): number;
+/** 0.40.0 item 9: how long a prompt cache is assumed to live. PROVISIONAL:
+ *  DeepSeek does not publish its TTL (the owner's cache was gone after 27
+ *  minutes); Anthropic's default is 5 minutes. */
+export declare const COLD_AFTER_MS: number;
+/** 0.40.0 (the owner): the recap's cold-cache wording — only when the turn
+ *  began at least COLD_AFTER_MS after the last bill AND the cache really
+ *  missed (a surfaced miss, or under half the prompt from cache). */
+export declare function coldAfter(idleMs: number | undefined, missed: number | null, usage: RunUsage): {
+    coldAfterMinutes?: number;
+};
+/**
+ * 0.40.0 item 9 — the cold resume. When the last BILL put the context over
+ * the microcompact threshold and that bill is older than COLD_AFTER_MS, the
+ * next request re-sends the whole prefix uncached. Compacting first turns
+ * that one expensive request into a summary call. Anchored only: a session
+ * no bill describes has no known size, and no age to call cold.
+ */
+export declare function coldResumeOffer(session: AgentSession, now?: number): {
+    tokens: number;
+    minutes: number;
+} | null;
 /** A1a: the number the auto-compact decision reads — the pre-A1a estimate,
  *  unchanged this round, named so a gate can pin that it did not move. */
 export declare function autoCompactRatio(session: AgentSession): number;
@@ -298,6 +322,8 @@ export type ChatEnd = {
  *  ids, and (when a dock is up) the existing picker. */
 export interface ChatNav {
     readonly sessions: () => readonly string[];
+    /** 0.40.0: an id outside this project's folder — refused, or opened where it is */
+    readonly route?: (id: string) => SessionRoute | null;
     readonly pick?: () => Promise<string | null>;
 }
 export declare function chat(session: AgentSession, faux: boolean, input: LineInput, autoCompact?: AutoCompact, nav?: ChatNav): Promise<ChatEnd>;

package/dist/chat.js

@@ -6,19 +6,19 @@
  */
 import { readFileSync, statSync } from "node:fs";
 import { escapeTerminal, cacheHitPct, decodeRate, idleStatus, palette, renderEvent, renderRecap, runningStatus, toolTarget, verifyOfferView, STATUS_GLYPHS, } from "@vincemakes/kiso-tui";
-import { askView, deletionRiskHint, editFileDiff, writeFileDiff } from "@vincemakes/kiso-tui";
-import { canonicalTargetPath, shellProgressPath } from "@vincemakes/kiso-tools-node";
+import { askView, coldResumeLine, coldResumeView, deletionRiskHint, editFileDiff, writeFileDiff } from "@vincemakes/kiso-tui";
+import { canonicalTargetPath, isProtectedPath, protectedIdentity, shellProgressPath } from "@vincemakes/kiso-tools-node";
 import { echoText } from "@vincemakes/kiso-tui-cells/render";
 import { canonicalizeUsage } from "@vincemakes/kiso-runtime";
 import { canonicalizeUsageForModel, requestBudget } from "@vincemakes/kiso-runtime/internal";
 import { dispatch, abortBangCommand } from "./dispatch.js";
 import { paintWindowTitle } from "./window-title.js";
-import { agentBaseUrl, agentModel, body, bodyLog, configuredWindow, dock } from "./state.js";
+import { agentBaseUrl, agentModel, body, bodyLog, configuredWindow, dock, retryOnRow, retryShown, setRetryShown, floorOn, protectedFiles } from "./state.js";
 import { attachImages } from "./attachments.js";
 import { lookupModelMetadata } from "@vincemakes/kiso-runtime/internal";
 import { addDontAskAgainRule, askPanel, fixHintFor, pendingAsk, resolveUncertains } from "./trust-ui.js";
 import { FauxExhaustionError, failOnFauxExhaustion } from "./faux-glue.js";
-import { MODES, getMode, setMode } from "./mode.js";
+import { OFFERED_MODES, getMode, setMode } from "./mode.js";
 /** B area: default context window for the ~ctx estimate (config overridable). */
 const DEFAULT_CONTEXT_WINDOW = 200_000;
 /** The in-process fake provider's id, and the window we declare for it.
@@ -134,13 +134,13 @@ export function microcompactThresholdFor(of) {
     return contextWindowTokens(of) / 2;
 }
 /**
- * B area: approximate context ratio — chars/4 of the projected messages vs
- * the model window. Marked ~ everywhere it is shown; no counting API.
+ * B area: approximate context ratio vs the model window. Marked ~
+ * everywhere it is shown. 0.40.0: the context as the last bill measured it
+ * (session.contextUsed — the estimate only when no bill describes it);
+ * chars/4 alone read the owner's 730k Chinese-heavy context as ~470k.
  */
 export function estimateCtxRatio(session) {
-    const projected = session.projected();
-    const chars = JSON.stringify(projected).length;
-    return chars / 4 / contextWindowTokens();
+    return session.contextUsed() / contextWindowTokens();
 }
 /** A1a: the ratio the STATUS LINE and the ctx displays show — the request
  *  budget counting the parts (system prompt, tool table, messages with
@@ -164,8 +164,42 @@ export function displayCtxRatio(session) {
     const window = knownContextWindow();
     if (window === null)
         return Number.NaN;
+    // 0.40.0: the last bill is the truth when one describes the context;
+    // the parts estimate is for a session no bill describes yet.
+    const anchored = session.contextAnchor();
+    if (anchored !== undefined)
+        return anchored / window;
     return requestBudget(session.requestParts(), window).ratio;
 }
+/** 0.40.0 item 9: how long a prompt cache is assumed to live. PROVISIONAL:
+ *  DeepSeek does not publish its TTL (the owner's cache was gone after 27
+ *  minutes); Anthropic's default is 5 minutes. */
+export const COLD_AFTER_MS = 5 * 60_000;
+/** 0.40.0 (the owner): the recap's cold-cache wording — only when the turn
+ *  began at least COLD_AFTER_MS after the last bill AND the cache really
+ *  missed (a surfaced miss, or under half the prompt from cache). */
+export function coldAfter(idleMs, missed, usage) {
+    if (idleMs === undefined || idleMs < COLD_AFTER_MS)
+        return {};
+    const hit = cacheHitPct(usage);
+    return missed !== null || (hit !== null && hit < 50) ? { coldAfterMinutes: Math.round(idleMs / 60_000) } : {};
+}
+/**
+ * 0.40.0 item 9 — the cold resume. When the last BILL put the context over
+ * the microcompact threshold and that bill is older than COLD_AFTER_MS, the
+ * next request re-sends the whole prefix uncached. Compacting first turns
+ * that one expensive request into a summary call. Anchored only: a session
+ * no bill describes has no known size, and no age to call cold.
+ */
+export function coldResumeOffer(session, now = Date.now()) {
+    const tokens = session.contextAnchor();
+    const at = session.lastUsageAt;
+    if (tokens === undefined || at === undefined)
+        return null;
+    if (tokens <= microcompactThresholdFor() || now - at < COLD_AFTER_MS)
+        return null;
+    return { tokens, minutes: Math.floor((now - at) / 60_000) };
+}
 /** A1a: the number the auto-compact decision reads — the pre-A1a estimate,
  *  unchanged this round, named so a gate can pin that it did not move. */
 export function autoCompactRatio(session) {
@@ -332,6 +366,11 @@ export function turnUsageLedger() {
  *  is gone) — docked only, 200ms rotation between the request and the
  *  first event. */
 export function startStatusSpinner(onTick) {
+    // ADR-0005 Amendment 2: a retry belongs to the run that announced it.
+    // Cleared where every run starts and stops — the chat's and the
+    // recovery flow's alike — so a stale countdown can never survive into
+    // the idle row or the next turn.
+    setRetryShown(null);
     if (!dock.active)
         return () => { };
     // v3 §03/§05: the working glyph family ▖▘▝▗, 200ms rotation — the
@@ -340,7 +379,10 @@ export function startStatusSpinner(onTick) {
     let i = 0;
     const timer = setInterval(() => onTick(STATUS_GLYPHS[i++ % STATUS_GLYPHS.length]), 200);
     timer.unref();
-    return () => clearInterval(timer);
+    return () => {
+        clearInterval(timer);
+        setRetryShown(null);
+    };
 }
 /**
  * TUI2-R1 (C) — the shell tailer: the READER half of the progress
@@ -391,6 +433,10 @@ function approvalDiff(name, input) {
     const path = typeof input.path === "string" ? input.path : "";
     if (path === "")
         return null;
+    // the tool refuses a protected file whatever the answer; the panel
+    // must not print the store on the way there
+    if (isProtectedPath(path, protectedIdentity(protectedFiles())))
+        return null;
     let oldContent = null;
     try {
         oldContent = readFileSync(path, "utf8");
@@ -745,6 +791,9 @@ submitTurn) {
     // seconds, usage, ctx left. The turn's WORK is the fold line's, said
     // once, where the work happened.
     const turnStart = Date.now();
+    // 0.40.0 (the owner): how long the session had been idle when this turn
+    // began — the recap names a cold cache instead of a bare fresh figure.
+    const idleMs = session.lastUsageAt === undefined ? undefined : turnStart - session.lastUsageAt;
     // W14: the thinking event carries NO timestamp — the CLI wall-clocks
     // the thinking window: it opens at the first thinking event and closes
     // at the first non-thinking event (the fold needs the seconds).
@@ -763,11 +812,21 @@ submitTurn) {
     try {
         for await (const ev of run) {
             last = ev;
+            // ADR-0005 Amendment 2: an event from the run means the retried
+            // attempt got through — the row stops saying it is waiting.
+            if (retryShown !== null)
+                setRetryShown(null);
             // LT2B-F1: a turn count is not evidence of a loop. Keep consuming
             // healthy runs without a periodic presence check; explicit cancellation,
             // the stream watchdog and the repeated-failure breaker remain active.
             // W22-R1: the ledger sees every event; a stop is what ends a call.
             ledger.observe(ev);
+            // ADR-0055 Amendment 1 (A1b): a compaction inside the run says so, once.
+            if (ev.type === "summarized" || ev.type === "microcompacted") {
+                const r = displayCtxRatio(session);
+                const ctx = Number.isFinite(r) ? ` · ctx now ~${Math.round(r * 100)}% used` : "";
+                body.notice(ev.type === "summarized" ? `✦ compacted mid-run — the conversation before this point is a summary now${ctx}` : `✦ pruned old tool output mid-run${ctx}`);
+            }
             if (ev.type !== "thinking") {
                 if (thinkingSince !== null) {
                     thoughtSeconds += (Date.now() - thinkingSince) / 1000;
@@ -800,6 +859,12 @@ submitTurn) {
                         body.notice(`  ${typeof ev.content === "string" ? ev.content : ""}`);
                         break;
                     }
+                    // 0.40.0: a skill turn's chip is the line the person TYPED — the
+                    // SKILL.md body is what the model read, not what they said.
+                    if (ev.via !== undefined) {
+                        body.userLine(ev.via.line);
+                        break;
+                    }
                     // DC-60: a turn that carries an image is a content ARRAY — its words
                     // still echo, the image as a mark; an empty chip was the bug.
                     body.userLine(echoText(ev.content));
@@ -912,8 +977,17 @@ submitTurn) {
                     //  - Yes+amend → approve(true), the words ride the NEXT turn;
                     //  - esc       → cancel, the conservative denial.
                     const name = ev.name;
-                    body.toolApproval(ev.callId, approvalDiff(name, ev.input ?? {}));
                     const decisionId = ev.decisionId;
+                    // Launch-weekend plan §2 — dontAsk: the chain's final ASK is
+                    // denied HERE, at the one place kiso asks, so every allow the
+                    // chain gave still stands (a tier deny would outrank them). The
+                    // reason is the tool result: the model sees why and goes on.
+                    if (getMode() === "dontAsk") {
+                        body.notice(`[dontAsk] ${escapeTerminal(name)} would ask — denied`);
+                        await session.approve(decisionId, false, `dontAsk: ${name} needs a human's approval, and this session never asks — denied`);
+                        break;
+                    }
+                    body.toolApproval(ev.callId, approvalDiff(name, ev.input ?? {}));
                     // TUI2-R3v2 ③: the on-demand alternatives provider. It is built
                     // per approval and captured by the panel; it fires ONLY if the
                     // human presses option 3, which is the whole zero-ambient-rent
@@ -1054,6 +1128,10 @@ submitTurn) {
                         // R-C item 4: only an above-floor miss is surfaced —
                         // the recap gains "· miss N" on the cache segment.
                         ...(missed !== null ? { missed } : {}),
+                        // Cold: idle past the cache's assumed life (the #77
+                        // constant, provisional) AND the turn did re-send a
+                        // prefix uncached — the time alone is not evidence.
+                        ...(coldAfter(idleMs, missed, turnUsage() ?? UNKNOWN_USAGE)),
                         ctxLeftPct: Number.isFinite(ratio) ? (1 - ratio) * 100 : null,
                         // W19: under plan the recap becomes the way-forward row
                         // (the /mode hints are the mode's exits).
@@ -1116,7 +1194,7 @@ export async function chat(session, faux, input, autoCompact, nav) {
         console.log("\n[exit requested]");
         input.close();
     };
-    const turn = (text, seedSource) => new Promise((resolve, reject) => {
+    const turn = (text, seedSource, via) => new Promise((resolve, reject) => {
         queued = Math.max(0, queued - 1); // a queued turn starts
         // REL-0152-D11: a turn that names an image file carries it. The
         // scan returns the STRING unchanged when it finds nothing, so a
@@ -1126,8 +1204,12 @@ export async function chat(session, faux, input, autoCompact, nav) {
         // REL-0152-D16: the capsules' files come from the editor, which
         // is the only thing that knows which number stands for which
         // screenshot.
-        const content = seedSource !== undefined ? text : attachImages(text, input.attachments?.());
-        const run = seedSource !== undefined ? session.run(content, { source: seedSource }) : session.run(content);
+        //
+        // 0.40.0: a skill turn is not scanned either — its text is a
+        // SKILL.md body, and a body that mentions `diagram.png` must not
+        // attach a file from the workspace the person never pointed at.
+        const content = seedSource !== undefined || via !== undefined ? text : attachImages(text, input.attachments?.(), protectedFiles());
+        const run = seedSource !== undefined ? session.run(content, { source: seedSource }) : via !== undefined ? session.run(content, { via }) : session.run(content);
         currentRun = run;
         turnNo += 1;
         const myTurn = turnNo;
@@ -1278,11 +1360,15 @@ export async function chat(session, faux, input, autoCompact, nav) {
         // BEHIND the correction, in their original order. Ephemeral
         // reordering of ephemeral state; the durable log still just records
         // what ran, in the order it ran.
-        const jumped = pendingTurns.map((s) => s.line);
+        // A slot re-enters with its CONTENT and its `via`, never its display
+        // line: a queued skill re-submitted as `/review x` would reach the
+        // model as the literal text of the command.
+        const jumped = pendingTurns.map((s) => ({ content: s.content, via: s.via }));
         for (let i = jumped.length; i > 0; i -= 1)
             popQueue();
-        for (const text of [line, ...jumped])
-            submitTurn(text);
+        submitTurn(line);
+        for (const j of jumped)
+            submitTurn(j.content, j.via);
     });
     // round 5 (P1-11): the PERSISTENT line listener is installed BEFORE the
     // startup recovery — a cancelled question's re-emitted "line" needs a
@@ -1304,6 +1390,9 @@ export async function chat(session, faux, input, autoCompact, nav) {
     // read (the dock renders the lines, the editor pops the last one).
     // A slot leaves the queue when its turn STARTS or when the user
     // pops it (cancelled — the chain segment skips it).
+    // 0.40.0: `line` is what the chip shows and what a pop hands back to
+    // the editor — for a skill, the line the person TYPED; `content` is
+    // what the turn submits (the skill's body and args).
     const pendingTurns = [];
     // TV-1B — the offer memory: session-local BY DESIGN (a dead process's
     // "not now" should not silence a live one; resume re-offers once,
@@ -1344,8 +1433,12 @@ export async function chat(session, faux, input, autoCompact, nav) {
     // KC2 §5: the STATE (the glyph, the run's start, the usage, the dock)
     // stays here; the ROW's text is the tui's status formatter.
     const paintRunning = () => {
+        // ADR-0005 Amendment 2: the running row gets the idle row's budget
+        // (DF-0330-F1). A pending retry makes it thirty columns longer, and
+        // composed blind it would be cut from the END — the context figure,
+        // a fact, going before the gesture hints.
         if (dock.active)
-            dock.setStatus(runningStatus(runGlyph, runStart, runUsage.out, displayCtxRatio(session), lastTokPerSec));
+            dock.setStatus(runningStatus(runGlyph, runStart, runUsage.out, displayCtxRatio(session), lastTokPerSec, rowWidth(), retryOnRow()));
     };
     // W19: under plan the idle row makes the posture unmistakable — the W4
     // parentheses idiom names the read-only constraint. The tier is the
@@ -1364,7 +1457,7 @@ export async function chat(session, faux, input, autoCompact, nav) {
         // DF-0330-F1: the row's budget. Without it the row is composed
         // blind and invariant ① cuts whatever sits last — which is how
         // a measured rate went missing at 100 columns.
-        rowWidth()));
+        rowWidth(), !floorOn));
     };
     // TUI2-R2 ⑥ — the BOOT status line. The row is the product's one
     // persistent claim about itself (the tier, how to change it, the model,
@@ -1408,8 +1501,8 @@ export async function chat(session, faux, input, autoCompact, nav) {
             return;
         spentUsd = (spentUsd ?? 0) + usd;
     };
-    const submitTurn = (line) => {
-        const slot = { line, cancelled: false };
+    const submitTurn = (line, via) => {
+        const slot = { line: via?.line ?? line, content: line, ...(via !== undefined ? { via } : {}), cancelled: false };
         pendingTurns.push(slot);
         queued += 1;
         chainRef.current = chainRef.current.then(async () => {
@@ -1433,7 +1526,7 @@ export async function chat(session, faux, input, autoCompact, nav) {
             if (session.uncertainExecutions().length > 0)
                 await resolveUncertains(session, input, () => cancelled);
             if (session.uncertainExecutions().length === 0)
-                return turn(line);
+                return turn(line, undefined, via);
             // The human declined (round 10: a cancelled ask records NOTHING —
             // the execution stays uncertain and durable), so the turn does not
             // start. It is never swallowed in silence: the held text is
@@ -1481,6 +1574,7 @@ export async function chat(session, faux, input, autoCompact, nav) {
             resolveEnd();
         },
         sessions: () => nav?.sessions() ?? [],
+        ...(nav?.route !== undefined ? { route: nav.route } : {}),
         ...(nav?.pick !== undefined ? { pickSession: nav.pick } : {}),
     };
     // the ergonomics batch C8: the auto-compact check — the /compact FULL path via the
@@ -1525,10 +1619,11 @@ export async function chat(session, faux, input, autoCompact, nav) {
     // they are the same sentinel: one implementation, one behaviour.
     input.onCopy(() => dispatch("\x18copy", dispatchCtx));
     // R3a — Shift+Tab: the approval-tier cycle (the /mode ring, in the
-    // MODES order). The switch is the SAME live-extension flip /mode
-    // performs; the status row repaints at once with a one-line notice.
+    // OFFERED order — a session started in `manual` steps to the first).
+    // The switch is the SAME live-extension flip /mode performs; the status
+    // row repaints at once with a one-line notice.
     input.onModeCycle?.(() => {
-        const next = MODES[(MODES.indexOf(getMode()) + 1) % MODES.length];
+        const next = OFFERED_MODES[(OFFERED_MODES.indexOf(getMode()) + 1) % OFFERED_MODES.length];
         setMode(next);
         paintIdle();
         body.notice(`mode → ${next} (shift+tab cycles)`);
@@ -1539,6 +1634,29 @@ export async function chat(session, faux, input, autoCompact, nav) {
     // round 8: the startup resume is bound to currentRun — Ctrl+C during it
     // aborts the recovery, exactly like the interactive turns.
     await resolveUncertains(session, input, () => cancelled);
+    // 0.40.0 item 9: a big session whose cache has gone cold compacts BEFORE
+    // its first request, on the person's word — or without asking in
+    // dontAsk, where compacting is not an approval. A piped session is left
+    // to the auto policy, which fires above the hard tier on its own. Lines
+    // typed meanwhile queue behind the compaction.
+    //
+    // The owner's dogfood: asked BEFORE the recovery run. A session whose
+    // last run was cut resumes that run at once, and the resume's first
+    // request is the whole cold prefix — asked afterwards, the question is
+    // about a bill already paid (and the in-run tiers have usually shrunk the
+    // context by then, so it is never asked at all). The compaction settles
+    // before the run resumes: the run continues on the compacted projection.
+    const cold = !cancelled && process.stdin.isTTY ? coldResumeOffer(session) : null;
+    if (cold !== null) {
+        if (getMode() === "dontAsk") {
+            body.notice(`[dontAsk] ${coldResumeLine(cold.tokens, cold.minutes)} — compacting first`);
+            dispatch("/compact", dispatchCtx);
+        }
+        else if ((await askPanel(input, coldResumeView(cold.tokens, cold.minutes))).action === "allow") {
+            dispatch("/compact", dispatchCtx);
+        }
+        await chainRef.current;
+    }
     if (!cancelled) {
         const recoveryRun = session.resume();
         currentRun = recoveryRun;

package/dist/config.d.ts

@@ -12,7 +12,7 @@
  *                      "anthropic" | "openai-responses")
  *   models?: { [name]: { kind: "openai-compat"|"anthropic"|"openai-responses",
  *                        baseUrl?: string, model: string, apiKeyEnv: string } }
- *   mode?: "manual"|"default"|"accept-edits"|"plan"|"bypass"
+ *   mode?: "manual"|"default"|"accept-edits"|"plan"|"bypass"|"dontAsk"
  *   contextWindow?: number      — tokens
  *   autoCompact?: { thresholdRatio: number }   — 0<r<1; default off
  *   projectTrust?: "ask" | "never"             — no "always" (the ruling)
@@ -82,6 +82,16 @@ export interface KisoConfig {
      *  project file is a LOUD error rather than a silent win. `KISO_THEME`
      *  still outranks it — the environment is the more local answer. */
     readonly theme?: "dark" | "light";
+    /** 0.40.0: the catastrophe floor (floor.ts). Default on. USER-LEVEL
+     *  ONLY, and louder than theme about it: a repository that could lower
+     *  the floor would be the one thing the floor exists to stop. */
+    readonly floor?: "catastrophe" | "off";
+    /** kiso never serves its own credential store to a model, and these
+     *  files join it: no tool reads, writes or searches them, and no shell
+     *  line may name them (protected-shell.ts). Absolute, or `~/…`. USER-
+     *  LEVEL ONLY, as loud as floor: a project must never be able to change
+     *  what kiso guards. */
+    readonly protectedPaths?: readonly string[];
     /** DT-1a: named acceptance checks a delegated task may reference —
      *  user-authored (or trust-gated project) commands, run by the PARENT
      *  in the child's worktree. A model never supplies a command; it names

package/dist/config.js

@@ -12,7 +12,7 @@
  *                      "anthropic" | "openai-responses")
  *   models?: { [name]: { kind: "openai-compat"|"anthropic"|"openai-responses",
  *                        baseUrl?: string, model: string, apiKeyEnv: string } }
- *   mode?: "manual"|"default"|"accept-edits"|"plan"|"bypass"
+ *   mode?: "manual"|"default"|"accept-edits"|"plan"|"bypass"|"dontAsk"
  *   contextWindow?: number      — tokens
  *   autoCompact?: { thresholdRatio: number }   — 0<r<1; default off
  *   projectTrust?: "ask" | "never"             — no "always" (the ruling)
@@ -27,13 +27,14 @@
  * with an invalid value is likewise loud; unknown top-level keys are
  * ignored (forward compatibility).
  */
-import { readFileSync } from "node:fs";
+import { readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
 import { join } from "node:path";
 import { kisoHome } from "./state.js";
 import { AuthError, getCredential, providerIdOf } from "./auth/credentials.js";
 import { BUILTIN_MANIFESTS } from "@vincemakes/kiso-runtime/internal";
 const KINDS = ["openai-compat", "anthropic", "openai-responses"];
-const MODES_LIST = ["manual", "default", "accept-edits", "plan", "bypass"];
+const MODES_LIST = ["manual", "default", "accept-edits", "plan", "bypass", "dontAsk"];
 export class ConfigError extends Error {
 }
 /** Parse + validate one config file. Broken JSON / invalid known values →
@@ -66,6 +67,36 @@ export function parseConfig(text, source) {
             fail("theme", "belongs in the USER config — a terminal is a property of the person at it, not of the project");
         out.theme = obj.theme;
     }
+    if (obj.floor !== undefined) {
+        if (obj.floor !== "catastrophe" && obj.floor !== "off")
+            fail("floor", 'expected "catastrophe" or "off"');
+        if (source.startsWith("<cwd>"))
+            fail("floor", "belongs in the USER config — a project must never be able to lower the floor");
+        out.floor = obj.floor;
+    }
+    if (obj.protectedPaths !== undefined) {
+        if (source.startsWith("<cwd>"))
+            fail("protectedPaths", "belongs in the USER config — a project must never be able to change what kiso guards");
+        if (!Array.isArray(obj.protectedPaths))
+            fail("protectedPaths", "expected an array of paths");
+        for (const [i, p] of obj.protectedPaths.entries()) {
+            // a relative path would be read against whatever directory kiso
+            // runs in — a different file in every project
+            if (typeof p !== "string" || !(p.startsWith("/") || p.startsWith("~/")))
+                fail(`protectedPaths[${i}]`, "expected an absolute path or one starting with ~/");
+            // kiso protects FILES. A directory listed here would protect
+            // nothing under it — a security setting that silently does
+            // nothing — so it is refused where the person can see it.
+            // (Read at every agent build: a directory created later is
+            // caught at the next start or /reload.)
+            const path = p;
+            const full = path.startsWith("~/") ? join(homedir(), path.slice(2)) : path;
+            if (path.endsWith("/") || statSync(full, { throwIfNoEntry: false })?.isDirectory() === true) {
+                fail(`protectedPaths[${i}]`, `${path} is a directory — kiso protects files, so list the files in it (for ~/.aws: "~/.aws/credentials", "~/.aws/config")`);
+            }
+        }
+        out.protectedPaths = obj.protectedPaths;
+    }
     if (obj.checks !== undefined) {
         if (obj.checks === null || typeof obj.checks !== "object" || Array.isArray(obj.checks))
             fail("checks", "expected an object of name → command");

package/dist/dispatch.d.ts

@@ -3,8 +3,10 @@
  * turns. The bodies moved verbatim from chat()'s closure; chat provides
  * the context (the chain, the run state, the prompt arming).
  */
+import type { SessionRoute } from "./projects.js";
 import type { AgentSession } from "@vincemakes/kiso-runtime";
 import { type LineInput } from "./state.js";
+import type { UserInputVia } from "@vincemakes/kiso-core";
 /** Everything dispatch touches that chat() owns. */
 export interface DispatchCtx {
     readonly session: AgentSession;
@@ -23,8 +25,10 @@ export interface DispatchCtx {
      *  gone; a binding that has not run yet paints none — an unmeasured
      *  cache is not a 0% cache, and it is not the previous model's either. */
     readonly modelSwitched: () => void;
-    /** submit a real turn: queue + chain (the turn closure lives in chat). */
-    readonly submitTurn: (line: string) => void;
+    /** submit a real turn: queue + chain (the turn closure lives in chat).
+     *  0.40.0: `via` marks a skill turn — `line` is then the composed
+     *  content, and the chip shows `via.line`. */
+    readonly submitTurn: (line: string, via?: UserInputVia) => void;
     /** the /status context estimate. */
     readonly estimateCtx: () => number;
     /** TUI2-R1 (E): the model's context window, as the session is
@@ -38,6 +42,10 @@ export interface DispatchCtx {
     readonly requestReload: () => void;
     /** every durable session id (the /resume validation + listing). */
     readonly sessions: () => readonly string[];
+    /** 0.40.0: an id outside this project's folder — refused with where to
+     *  go, or opened where it is with a line (absent: every such id is "no
+     *  such"). */
+    readonly route?: (id: string) => SessionRoute | null;
     /** the dock's session picker, when one exists (bare /resume). */
     readonly pickSession?: () => Promise<string | null>;
 }