@vincemakes/kiso-code 0.39.2 → 0.40.1

package/dist/skill-invoke.js

@@ -0,0 +1,139 @@
+/**
+ * 0.40.0 — a PERSON invokes a skill.
+ *
+ * `/skill <name> [args…]`, or `/<name> [args…]` when no built-in command
+ * has that name — built-ins win, always, so installing a skill can never
+ * take a command away. The invocation is a USER TURN: the SKILL.md body,
+ * then the person's args after a blank line, submitted through the same
+ * path as typed input. The durable record says the turn came from the
+ * person (`source` stays "user") and says HOW it was composed in `via`,
+ * which carries the line they typed — so the chip, the resume tail and the
+ * session's name show what the person wrote, not a body they never saw.
+ *
+ * Pure: the catalog comes from the skills extension's own scan (one scan,
+ * one answer — the model's index and this door are one list), and every
+ * outcome is data. The dispatcher does the printing and the submitting.
+ */
+/**
+ * What a submitted line asks of the skills, if anything. `null` means the
+ * line is not a skill request, and the dispatcher goes on as before — which
+ * is how a typo stays "unknown command" rather than becoming a skill error.
+ */
+export function resolveSkillLine(trimmed, catalog, builtins) {
+    if (trimmed.includes("\n") || !trimmed.startsWith("/"))
+        return null;
+    const [word = "", ...rest] = trimmed.split(/\s+/);
+    if (word === "/skills")
+        return rest.length === 0 ? { kind: "list" } : { kind: "error", message: "usage: /skills (no arguments) — /skill <name> [args] runs one" };
+    if (word === "/skill") {
+        const [name = ""] = rest;
+        if (name === "")
+            return { kind: "error", message: "usage: /skill <name> [args…] — /skills lists them" };
+        return invoke(name, argsOf(trimmed, 2), trimmed, catalog);
+    }
+    // `/<name>`: only a word no built-in claims, and only a skill that
+    // exists — anything else is the dispatcher's own "unknown command".
+    if (builtins.includes(word))
+        return null;
+    const name = word.slice(1);
+    if (catalog === null || (!catalog.entries.some((e) => e.name === name) && !catalog.broken.some((b) => b.dir === name)))
+        return null;
+    return invoke(name, argsOf(trimmed, 1), trimmed, catalog);
+}
+/** The args as typed — everything after the first `words` words, with its
+ *  own spacing kept. A skill that asks for a path wants the path, not a
+ *  re-joined approximation of it. */
+function argsOf(trimmed, words) {
+    let rest = trimmed;
+    for (let i = 0; i < words; i += 1)
+        rest = rest.replace(/^\S+\s*/, "");
+    return rest;
+}
+function invoke(name, args, line, catalog) {
+    const entry = catalog?.entries.find((e) => e.name === name);
+    if (entry === undefined) {
+        const broken = catalog?.broken.find((b) => b.dir === name);
+        if (broken !== undefined)
+            return { kind: "error", message: `skill "${name}" cannot load: ${broken.reason}` };
+        const near = nearest(name, catalog?.entries.map((e) => e.name) ?? []);
+        const hint = near.length > 0 ? ` — nearest: ${near.join(", ")}` : "";
+        return { kind: "error", message: `no skill named "${name}"${hint} (/skills lists them)` };
+    }
+    if (!entry.userInvocable)
+        return { kind: "error", message: `skill "${name}" is for the model only (user-invocable: false)` };
+    const read = catalog.body(name);
+    if ("error" in read)
+        return { kind: "error", message: `skill "${name}" cannot load: ${read.error}` };
+    return {
+        kind: "submit",
+        content: args === "" ? read.body : `${read.body}\n\n${args}`,
+        via: { kind: "skill", name, line },
+    };
+}
+/** Up to three installed names close to the one typed: a shared prefix, or
+ *  within two edits. Closest first; nothing when nothing is close — a
+ *  suggestion that is not near is noise. */
+export function nearest(name, names) {
+    const scored = names
+        .map((n) => ({ n, d: n.startsWith(name) || name.startsWith(n) ? 0 : distance(name, n) }))
+        .filter((s) => s.d <= 2)
+        .sort((a, b) => a.d - b.d || (a.n < b.n ? -1 : 1));
+    return scored.slice(0, 3).map((s) => s.n);
+}
+function distance(a, b) {
+    const row = Array.from({ length: b.length + 1 }, (_, j) => j);
+    for (let i = 1; i <= a.length; i += 1) {
+        let prev = row[0];
+        row[0] = i;
+        for (let j = 1; j <= b.length; j += 1) {
+            const cur = row[j];
+            row[j] = Math.min(row[j] + 1, row[j - 1] + 1, prev + (a[i - 1] === b[j - 1] ? 0 : 1));
+            prev = cur;
+        }
+    }
+    return row[b.length];
+}
+/** `/skills` — the skills grouped by the directory they really live in,
+ *  each directory named ONCE as a header: project and user skills are
+ *  merged into one scan directory by symlink, so the scan root would name a
+ *  temp directory nobody can find — `sourceOf` resolves an entry's
+ *  directory to where it came from. Under each: `/name — description`, a
+ *  `model only` tag for `user-invocable: false`, then the broken entries
+ *  with the loader's own reason. */
+export function skillsRows(catalog, sourceOf, userDir) {
+    const entries = catalog?.entries ?? [];
+    const broken = catalog?.broken ?? [];
+    if (entries.length === 0 && broken.length === 0)
+        return [`no skills installed — add one as ${userDir}/<name>/SKILL.md`];
+    const groups = new Map();
+    const add = (dir, row) => {
+        const src = sourceOf(dir);
+        groups.set(src, [...(groups.get(src) ?? []), row]);
+    };
+    for (const e of entries)
+        add(e.dir, `  /${e.name} — ${e.description}${e.userInvocable ? "" : " (model only)"}`);
+    for (const b of broken)
+        add(b.dir, `  ${b.dir} — cannot load: ${b.reason}`);
+    const rows = [];
+    for (const [src, list] of groups)
+        rows.push(src, ...list);
+    rows.push("/<name> [args] or /skill <name> [args] runs one · a built-in command wins a shared name");
+    return rows;
+}
+/**
+ * 0.40.1 (owner's ruling, revoking the 0.41.0 deferral) — the installed
+ * skills as `/` menu entries. The same rule the dispatcher follows, so the
+ * menu never offers what `/<name>` would not run: invocable skills only
+ * (`user-invocable: false` stays the model's), a name a person can type
+ * after `/`, and never a name a built-in claims — the built-in wins. The
+ * description is cut so a long one cannot crowd the band.
+ */
+export function skillMenuItems(catalog, builtins) {
+    if (catalog === null)
+        return [];
+    const taken = new Set(builtins);
+    const cut = (text, n) => (text.length <= n ? text : `${text.slice(0, n - 1)}…`);
+    return catalog.entries
+        .filter((e) => e.userInvocable && /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(e.name) && !taken.has(`/${e.name}`))
+        .map((e) => ({ name: `/${e.name}`, desc: `${cut(e.description, 56)} · skill` }));
+}

package/dist/state.d.ts

@@ -29,7 +29,40 @@ export declare function codingToolOptions(): {
     readonly workspaceRoot: string;
     readonly excludeRoots: readonly string[];
     readonly secretEnvNames: readonly string[];
+    readonly protectedFiles: readonly string[];
 };
+export declare function setUserProtectedPaths(paths: readonly string[] | undefined): void;
+/** kiso never serves its own credential store to a model. The store is
+ *  `auth.json` under KISO_HOME — the path auth/credentials.ts writes (a
+ *  test holds the two together); its temp file and lock are covered by
+ *  the match rule (tools-node protected.ts). Then the user's own list.
+ *  ONE list for every reader: the file tools, the search, the shell
+ *  check and the `!` gesture. */
+export declare function protectedFiles(): readonly string[];
+/** 0.40.0 — the workspace a session records: the realpath of where kiso
+ *  runs, so `/a/link` and `/a/target` are one workspace (and one folder). */
+export declare function workspaceRoot(): string;
+/** 0.40.0 — the project a session folder belongs to: the cwd as the disk
+ *  spells it (projects.ts canonicalPath). Only the folder's identity uses
+ *  it; the tools keep workspaceRoot(). */
+export declare function projectRoot(): string;
+/**
+ * 0.40.0 (the owner's dogfood) — this project's session folder
+ * (projects.ts). `KISO_SESSIONS_DIR` pins it (tests, bench runners, a
+ * delegated child beside its parent), and a reversed migration restores
+ * the single legacy folder.
+ *
+ * A pure read — the folder is claimed (made, and its workspace recorded)
+ * only after the trust gate, where the store is built.
+ */
+export declare function ownSessionsDir(): string;
+/** 0.40.0 (the lead's ruling) — a session from `_unknown`, or placed in
+ *  another project's folder only by inference, resumes WHERE IT IS: a
+ *  resume never moves a session. The store is then built on that folder,
+ *  and null returns this process to its own. */
+export declare function setOpenSessionFolder(dir: string | null): void;
+/** The folder of the session this process has open: its own project's,
+ *  or the one an unknown or inferred session was resumed in. */
 export declare function sessionsDir(): string;
 /** E1: the extension scan directory — KISO_EXTENSIONS_DIR overrides. */
 export declare function extensionsDir(): string;
@@ -141,7 +174,7 @@ export interface LineInput {
      *  picked id, or null when the human leaves without picking.
      *  OPTIONAL: only the raw-mode editor has it, and the picker only
      *  ever opens on a TTY (a pipe has nobody to pick). */
-    pick?(cards: () => readonly SessionCardView[], onPick: (id: string | null) => void): void;
+    pick?(cards: () => readonly SessionCardView[], onPick: (id: string | null) => void, here?: string): void;
     /** W22: bind the pending-turn queue — the ↑ pop walks the CLI's
      *  live slots (each pop cancels the turn), esc ends the walk after
      *  one more pop. The chips are the compositor's own bindQueue. */
@@ -195,6 +228,23 @@ export declare function setCurrentFaux(value: boolean): void;
  *  LAST makeAgent — /model and autoCompact resolve against it. */
 export declare let mergedConfig: import("./config.js").KisoConfig;
 export declare function setMergedConfig(value: import("./config.js").KisoConfig): void;
+/** ADR-0005 Amendment 2: the retry the kernel announced and is waiting
+ *  on, for the running and compacting rows — `until` is the wall-clock
+ *  end of the wait. Null when no retry is pending. Cleared by the next
+ *  event from the run, which means the attempt got through, and wherever
+ *  a run or a compaction starts and ends. */
+export interface RetryShown {
+    readonly attempt: number;
+    readonly maxRetries: number;
+    readonly code: string;
+    readonly until: number;
+}
+export declare let retryShown: RetryShown | null;
+export declare function setRetryShown(value: RetryShown | null): void;
+/** The pending retry as a row shows it, with the time left computed NOW:
+ *  the rows repaint on their own timers, so the countdown moves between
+ *  the kernel's announcements. */
+export declare function retryOnRow(): import("@vincemakes/kiso-tui").RetryOnRow | null;
 /** merge round B: the resolved context window (env > config.contextWindow) —
  *  chat.ts's contextWindowTokens() consults it before the env. */
 export declare let configuredWindow: number | undefined;
@@ -225,7 +275,28 @@ export declare let modelChoice: string | undefined;
 export declare function setModelChoice(value: string | undefined): void;
 export declare let currentModelName: string;
 export declare function setCurrentModelName(value: string): void;
+/** REVIEW (2026-09-21): WHO the binding came from is a different fact from
+ *  WHICH model it names, and `currentModelName` carried both — a profile alias
+ *  after `/model`, a model id after a switch, a resume or a reload. Surfaces
+ *  that want to name the PROFILE ask this one; an unknown profile is null, and
+ *  nothing guesses a credential identity out of a model name and a host. */
+export declare let currentProfileName: string | null;
+export declare function setCurrentProfileName(value: string | null): void;
+/** DC-57 (the owner's ruling, 2026-09-21): lines that arrived with a switch
+ *  command — a paste, a pipe, a scripted driver — belong to the session the
+ *  person asked for. The departing entry queues them here and the next
+ *  `chat()` drains them into its own replay, so no line is answered by the
+ *  session being left and none is dropped. */
+export declare const queuedSwitchLines: string[];
 /** E1: the extensions loaded by makeAgent — their names feed the banner. */
+/** 0.40.0: whether the catastrophe floor is on (floor.ts) — the user
+ *  config's `floor`, read where the chain is assembled. */
+export declare let floorOn: boolean;
+export declare function setFloorOn(value: boolean): void;
+/** 0.40.0: the calls a saved allow never carries (protected-writes.ts) —
+ *  set where the chain is assembled, read where a first grant joins it. */
+export declare let neverInherited: (call: import("@vincemakes/kiso-core").PolicyCall) => boolean;
+export declare function setNeverInherited(value: (call: import("@vincemakes/kiso-core").PolicyCall) => boolean): void;
 export declare let loadedExtensions: readonly KisoExtension[];
 /** R-D 0.1.45: the BUILT-IN layer — the three default official extensions,
  *  shipped with the cli (module imports, never a disk scan; builtin.ts).
@@ -239,6 +310,11 @@ export declare let userExtensions: readonly KisoExtension[];
  *  banner distinguishes them from the user-level ones. */
 export declare let projectExtensions: readonly KisoExtension[];
 export declare function setExtensionLists(builtIn: readonly KisoExtension[], user: readonly KisoExtension[], project: readonly KisoExtension[], loaded: readonly KisoExtension[]): void;
+/** 0.40.0: the skills catalog of the loaded skills extension — the scan the
+ *  model's index came from, so `/skill` and `/skills` cannot list a
+ *  different set. Null when no skills extension is loaded (or a user
+ *  extension named "skills" shadows it and reports none). */
+export declare function loadedSkillsCatalog(): import("@vincemakes/kiso-skills-ext").SkillsCatalog | null;
 /** W21: the CURRENT agent's extensions array — set by makeAgent, the
  *  don't-ask-again writer pushes the generated extension into it so a
  *  first-time rule joins the chain at the NEXT run (the run's policies
@@ -266,6 +342,9 @@ export interface LastBinding {
     readonly baseUrl?: string;
     readonly scope?: import("@vincemakes/kiso-core").ContinuationScope;
     readonly reasoning?: import("@vincemakes/kiso-runtime/internal").ReasoningSetting;
+    /** 0.40.0: the config profile that named the binding (null for a direct
+     *  provider/model) — a /clear-fresh session records it too. */
+    readonly profileName?: string | null;
 }
 export declare function setLastBinding(b: LastBinding): void;
 export declare function lastBinding(): LastBinding | null;

package/dist/state.js

@@ -11,6 +11,7 @@ import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { AT_CAP, AT_SKIP, Dock } from "@vincemakes/kiso-tui";
+import { canonicalPath, LEGACY_SESSIONS_DIR, projectDirFor, projectLayoutActive } from "./projects.js";
 /** finding #11: KISO_HOME is the ONE root — every default path derives from
  *  it (sessions, trust, extensions, mcp config, skills). The dedicated
  *  env vars (KISO_EXTENSIONS_DIR / KISO_MCP_CONFIG / KISO_SKILLS_DIR)
@@ -38,10 +39,74 @@ export function secretEnvNamesOf(models) {
     ];
 }
 export function codingToolOptions() {
-    return { workspaceRoot: process.cwd(), excludeRoots: [kisoHome()], secretEnvNames: secretEnvNamesOf(configModels) };
+    return { workspaceRoot: process.cwd(), excludeRoots: [kisoHome()], secretEnvNames: secretEnvNamesOf(configModels), protectedFiles: protectedFiles() };
 }
+/** The user config's `protectedPaths`, as read at the agent's build (and
+ *  again at /reload) — `~/` taken against the home directory. */
+let userProtectedPaths = [];
+export function setUserProtectedPaths(paths) {
+    userProtectedPaths = (paths ?? []).map((p) => (p.startsWith("~/") ? join(homedir(), p.slice(2)) : p));
+}
+/** kiso never serves its own credential store to a model. The store is
+ *  `auth.json` under KISO_HOME — the path auth/credentials.ts writes (a
+ *  test holds the two together); its temp file and lock are covered by
+ *  the match rule (tools-node protected.ts). Then the user's own list.
+ *  ONE list for every reader: the file tools, the search, the shell
+ *  check and the `!` gesture. */
+export function protectedFiles() {
+    return [join(kisoHome(), "auth.json"), ...userProtectedPaths];
+}
+/** 0.40.0 — the workspace a session records: the realpath of where kiso
+ *  runs, so `/a/link` and `/a/target` are one workspace (and one folder). */
+export function workspaceRoot() {
+    try {
+        return realpathSync(process.cwd());
+    }
+    catch {
+        return process.cwd();
+    }
+}
+/** 0.40.0 — the project a session folder belongs to: the cwd as the disk
+ *  spells it (projects.ts canonicalPath). Only the folder's identity uses
+ *  it; the tools keep workspaceRoot(). */
+export function projectRoot() {
+    return canonicalPath(process.cwd());
+}
+let projectSessions = null;
+/**
+ * 0.40.0 (the owner's dogfood) — this project's session folder
+ * (projects.ts). `KISO_SESSIONS_DIR` pins it (tests, bench runners, a
+ * delegated child beside its parent), and a reversed migration restores
+ * the single legacy folder.
+ *
+ * A pure read — the folder is claimed (made, and its workspace recorded)
+ * only after the trust gate, where the store is built.
+ */
+export function ownSessionsDir() {
+    const pinned = process.env.KISO_SESSIONS_DIR;
+    if (pinned !== undefined && pinned !== "")
+        return pinned;
+    const home = kisoHome();
+    if (!projectLayoutActive(home))
+        return join(home, LEGACY_SESSIONS_DIR);
+    const workspace = projectRoot();
+    const key = `${home}\0${workspace}`;
+    if (projectSessions?.key !== key)
+        projectSessions = { key, dir: projectDirFor(home, workspace) };
+    return projectSessions.dir;
+}
+let openFolder = null;
+/** 0.40.0 (the lead's ruling) — a session from `_unknown`, or placed in
+ *  another project's folder only by inference, resumes WHERE IT IS: a
+ *  resume never moves a session. The store is then built on that folder,
+ *  and null returns this process to its own. */
+export function setOpenSessionFolder(dir) {
+    openFolder = dir;
+}
+/** The folder of the session this process has open: its own project's,
+ *  or the one an unknown or inferred session was resumed in. */
 export function sessionsDir() {
-    return join(kisoHome(), "sessions");
+    return openFolder ?? ownSessionsDir();
 }
 /** E1: the extension scan directory — KISO_EXTENSIONS_DIR overrides. */
 export function extensionsDir() {
@@ -254,6 +319,17 @@ export let mergedConfig = {};
 export function setMergedConfig(value) {
     mergedConfig = value;
 }
+export let retryShown = null;
+export function setRetryShown(value) {
+    retryShown = value;
+}
+/** The pending retry as a row shows it, with the time left computed NOW:
+ *  the rows repaint on their own timers, so the countdown moves between
+ *  the kernel's announcements. */
+export function retryOnRow() {
+    const r = retryShown;
+    return r === null ? null : { attempt: r.attempt, maxRetries: r.maxRetries, code: r.code, remainingMs: r.until - Date.now() };
+}
 /** merge round B: the resolved context window (env > config.contextWindow) —
  *  chat.ts's contextWindowTokens() consults it before the env. */
 export let configuredWindow;
@@ -292,7 +368,34 @@ export let currentModelName = "faux";
 export function setCurrentModelName(value) {
     currentModelName = value;
 }
+/** REVIEW (2026-09-21): WHO the binding came from is a different fact from
+ *  WHICH model it names, and `currentModelName` carried both — a profile alias
+ *  after `/model`, a model id after a switch, a resume or a reload. Surfaces
+ *  that want to name the PROFILE ask this one; an unknown profile is null, and
+ *  nothing guesses a credential identity out of a model name and a host. */
+export let currentProfileName = null;
+export function setCurrentProfileName(value) {
+    currentProfileName = value;
+}
+/** DC-57 (the owner's ruling, 2026-09-21): lines that arrived with a switch
+ *  command — a paste, a pipe, a scripted driver — belong to the session the
+ *  person asked for. The departing entry queues them here and the next
+ *  `chat()` drains them into its own replay, so no line is answered by the
+ *  session being left and none is dropped. */
+export const queuedSwitchLines = [];
 /** E1: the extensions loaded by makeAgent — their names feed the banner. */
+/** 0.40.0: whether the catastrophe floor is on (floor.ts) — the user
+ *  config's `floor`, read where the chain is assembled. */
+export let floorOn = true;
+export function setFloorOn(value) {
+    floorOn = value;
+}
+/** 0.40.0: the calls a saved allow never carries (protected-writes.ts) —
+ *  set where the chain is assembled, read where a first grant joins it. */
+export let neverInherited = () => false;
+export function setNeverInherited(value) {
+    neverInherited = value;
+}
 export let loadedExtensions = [];
 /** R-D 0.1.45: the BUILT-IN layer — the three default official extensions,
  *  shipped with the cli (module imports, never a disk scan; builtin.ts).
@@ -311,6 +414,14 @@ export function setExtensionLists(builtIn, user, project, loaded) {
     projectExtensions = project;
     loadedExtensions = loaded;
 }
+/** 0.40.0: the skills catalog of the loaded skills extension — the scan the
+ *  model's index came from, so `/skill` and `/skills` cannot list a
+ *  different set. Null when no skills extension is loaded (or a user
+ *  extension named "skills" shadows it and reports none). */
+export function loadedSkillsCatalog() {
+    const ext = loadedExtensions.find((e) => e.name === "skills");
+    return ext?.catalog ?? null;
+}
 /** W21: the CURRENT agent's extensions array — set by makeAgent, the
  *  don't-ask-again writer pushes the generated extension into it so a
  *  first-time rule joins the chain at the NEXT run (the run's policies

package/dist/trust-ui.js

@@ -11,7 +11,8 @@ import { join } from "node:path";
 import { pathToFileURL } from "node:url";
 import { askDeclineAll, askView, projectTrustRows, projectTrustView, projectUntrustedNote, uncertainView, unansweredAskView } from "@vincemakes/kiso-tui";
 import { projectArtifacts, recordTrust, trustFor } from "@vincemakes/kiso-runtime";
-import { bodyLog, currentAgentExtensions, dock, extensionsDir, kisoHome, mergedTempPaths } from "./state.js";
+import { bodyLog, currentAgentExtensions, dock, extensionsDir, kisoHome, mergedTempPaths, neverInherited } from "./state.js";
+import { guardSavedAllow } from "./protected-writes.js";
 import { loadUserConfig, resolveProjectTrustPolicy } from "./config.js";
 import { getMode } from "./mode.js";
 /**
@@ -145,6 +146,13 @@ export function parseFallbackAnswer(answer) {
 export function askUi(input) {
     return {
         ask: async (spec) => {
+            // Launch-weekend plan §2: dontAsk asks nobody anything — a
+            // question the model puts is declined, recorded as unanswered,
+            // exactly as a non-interactive session declines it.
+            if (getMode() === "dontAsk") {
+                bodyLog("[dontAsk] the model's question was declined — nothing asks in dontAsk");
+                return askDeclineAll(spec);
+            }
             const verdict = await askPanel(input, askView(spec));
             return verdict.action === "answers" ? verdict.result : askDeclineAll(spec);
         },
@@ -236,10 +244,13 @@ export async function addDontAskAgainRule(rule) {
     const mod = (await import(`${pathToFileURL(file).href}?grant=${(grantSerial += 1)}`));
     if (mod.default === undefined)
         return;
+    // 0.40.0: wrapped as at startup — a first grant must not carry what a
+    // saved allow never carries.
+    const joined = guardSavedAllow(mod.default, neverInherited);
     if (at >= 0)
-        currentAgentExtensions[at] = mod.default;
+        currentAgentExtensions[at] = joined;
     else
-        currentAgentExtensions.push(mod.default);
+        currentAgentExtensions.push(joined);
 }
 /** RL-F5 — the rules a generated file already holds. The `new Set([...])`
  *  literal is JSON, which is what makes reading it back honest rather than
@@ -307,8 +318,11 @@ export async function resolveProjectTrust(input) {
         return null; // refused is sticky — no re-ask
     // First discovery — list every artifact (file name + digest short
     // prefix) and ask the human ONCE.
-    if (!process.stdin.isTTY) {
-        console.error(projectUntrustedNote(artifacts.files.length, artifacts.root));
+    // The lead's review of #63, B5: dontAsk takes this same path — nothing
+    // asks, so the project is not loaded, the note says so, and no refusal
+    // is recorded (a later asking session can still decide).
+    if (!process.stdin.isTTY || getMode() === "dontAsk") {
+        console.error(`${getMode() === "dontAsk" ? "[dontAsk] " : ""}${projectUntrustedNote(artifacts.files.length, artifacts.root)}`);
         return null;
     }
     // v2c: the shared input (the editor on a TTY) reads the answer.
@@ -457,6 +471,16 @@ function readdirSyncSafe(dir) {
  *  fabricated, round 10). The resolution feedback lands in the body —
  *  the body is the single stdout writer, never a stray console.log. */
 export async function resolveUncertains(session, input, isCancelled) {
+    // The lead's review of #63, B5: under dontAsk nothing asks, so the
+    // uncertain executions are left exactly as a cancel leaves them —
+    // uncertain and durable, no rerun or abandon fabricated — and the one
+    // line says what to do. An unattended session must not sit on a panel.
+    if (getMode() === "dontAsk") {
+        const n = session.uncertainExecutions().length;
+        if (n > 0)
+            bodyLog(`[dontAsk] ${n} uncertain execution${n === 1 ? "" : "s"} left unresolved — resolve them in an asking mode`);
+        return;
+    }
     for (const uncertain of session.uncertainExecutions()) {
         // KC3.5 §4: an interrupted ask_user is not a side effect that may
         // have applied — it is a question nobody answered. The COPY says

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@vincemakes/kiso-code",
-	"version": "0.39.2",
+	"version": "0.40.1",
 	"description": "kiso-code \u2014 the coding agent on kiso, the durable runtime for AI agents: kiso chat / kiso resume / kiso sessions.",
 	"type": "module",
 	"license": "MIT",
@@ -18,20 +18,20 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@vincemakes/kiso-ask-ext": "0.39.2",
-		"@vincemakes/kiso-core": "0.39.2",
-		"@vincemakes/kiso-evals": "0.39.2",
-		"@vincemakes/kiso-mcp-ext": "0.39.2",
-		"@vincemakes/kiso-provider-anthropic": "0.39.2",
-		"@vincemakes/kiso-provider-openai": "0.39.2",
-		"@vincemakes/kiso-provider-openai-responses": "0.39.2",
-		"@vincemakes/kiso-runtime": "0.39.2",
-		"@vincemakes/kiso-skills-ext": "0.39.2",
-		"@vincemakes/kiso-subagent-ext": "0.39.2",
-		"@vincemakes/kiso-task-ext": "0.39.2",
-		"@vincemakes/kiso-tools-node": "0.39.2",
-		"@vincemakes/kiso-tui": "0.39.2",
-		"@vincemakes/kiso-tui-cells": "0.39.2"
+		"@vincemakes/kiso-ask-ext": "0.40.1",
+		"@vincemakes/kiso-core": "0.40.1",
+		"@vincemakes/kiso-evals": "0.40.1",
+		"@vincemakes/kiso-mcp-ext": "0.40.1",
+		"@vincemakes/kiso-provider-anthropic": "0.40.1",
+		"@vincemakes/kiso-provider-openai": "0.40.1",
+		"@vincemakes/kiso-provider-openai-responses": "0.40.1",
+		"@vincemakes/kiso-runtime": "0.40.1",
+		"@vincemakes/kiso-skills-ext": "0.40.1",
+		"@vincemakes/kiso-subagent-ext": "0.40.1",
+		"@vincemakes/kiso-task-ext": "0.40.1",
+		"@vincemakes/kiso-tools-node": "0.40.1",
+		"@vincemakes/kiso-tui": "0.40.1",
+		"@vincemakes/kiso-tui-cells": "0.40.1"
 	},
 	"devDependencies": {
 		"@types/node": "^26.1.2",