@vincemakes/kiso-code 0.39.2 → 0.40.1

package/dist/index.js

@@ -30,18 +30,27 @@ import { createInterface } from "node:readline";
 import { Readable } from "node:stream";
 import { fileURLToPath } from "node:url";
 import { join } from "node:path";
-import { Body, Editor, PROMPT, bannerLines, currentGround, resolveGround, setGround, escapeTerminal, extensionsBannerText, idColumn, idleStatus, interactivePrompt, palette, renderSessionLine, sessionListFooter, sessionListRow } from "@vincemakes/kiso-tui";
+import { Body, Editor, PROMPT, bannerLines, currentGround, resolveGround, setGround, escapeTerminal, extensionsBannerText, idColumn, idleStatus, interactivePrompt, palette, renderSessionLine, sessionListFooter, sessionListHeader, sessionListRow, sessionListUnknownLine, slashCommandNames } from "@vincemakes/kiso-tui";
 import { createAgent, disposeExtensions, loadExtensions, loadProjectExtensions, SessionStore, } from "@vincemakes/kiso-runtime";
+import { listSessionSidecars, migrateSummaries, readProfile, runsACheck, summaryMigrationPending } from "@vincemakes/kiso-runtime/internal";
+import { skillMenuItems } from "./skill-invoke.js";
+import { canonicalPath, claimProjectDir, hasSession, locateSession, projectLayoutActive, sessionFolders } from "./projects.js";
+import { migrationNotice, pendingLegacyIds, planMigration, reverseMigration, runMigration } from "./session-migration.js";
 import { createFauxProvider } from "@vincemakes/kiso-evals";
-import { createCodingTools } from "@vincemakes/kiso-tools-node";
-import { MODES, getMode, modeExtensions, modeFromEnv, modeSystemPrompt, setMode } from "./mode.js";
+import { createCodingTools, isProtectedPath, protectedIdentity, PROTECTED_REFUSAL } from "@vincemakes/kiso-tools-node";
+import { MODES, OFFERED_MODES, getMode, modeExtensions, modeFromEnv, modeSystemPrompt, setMode } from "./mode.js";
+import { readOnlyShellExtension } from "./readonly-shell.js";
+import { guardSavedAllow, isProtectedWrite } from "./protected-writes.js";
+import { floorExtension, isDestructiveCall } from "./floor.js";
+import { protectedShellExtension } from "./protected-shell.js";
 import { breakerExtension } from "./breaker.js";
 import { builtInLayer } from "./builtin.js";
-import { agentModel, atFiles, body, bodyLog, codingToolOptions, kisoHome, builtInExtensions, currentFaux, dock, extensionsDir, loadedExtensions, mergedConfig, mergedTempPaths, modelChoice, projectExtensions, configModels, configuredWindow, agentBaseUrl, currentModelName, currentAgentExtensions, sessionStoreRef, sessionsDir, setAgentModel, setBody, setConfigModels, setConfiguredWindow, setCurrentAgentExtensions, setCurrentFaux, setCurrentModelName, setExtensionLists, setMergedConfig, setModelChoice, setSessionStore, secretEnvNamesOf, userExtensions, VERSION, lastBinding, acceptDrift, setAcceptDrift } from "./state.js";
+import { agentModel, atFiles, body, bodyLog, codingToolOptions, kisoHome, workspaceRoot, projectRoot, ownSessionsDir, setOpenSessionFolder, builtInExtensions, currentFaux, dock, extensionsDir, loadedExtensions, mergedConfig, mergedTempPaths, modelChoice, projectExtensions, configModels, configuredWindow, agentBaseUrl, currentModelName, currentAgentExtensions, sessionStoreRef, sessionsDir, setAgentModel, setBody, setConfigModels, setConfiguredWindow, setCurrentAgentExtensions, setCurrentFaux, setCurrentModelName, setCurrentProfileName, setExtensionLists, setUserProtectedPaths, protectedFiles, setMergedConfig, setModelChoice, setSessionStore, setRetryShown, setNeverInherited, secretEnvNamesOf, userExtensions, VERSION, lastBinding, acceptDrift, setAcceptDrift, setFloorOn, floorOn, loadedSkillsCatalog, queuedSwitchLines } from "./state.js";
+import { maxRetriesFromEnv } from "./retries.js";
 import { askUi, resolveProjectTrust } from "./trust-ui.js";
 import { isFirstRun, scaffoldFirstRun } from "./first-run.js";
 import { fauxSkip, readFauxScript } from "./faux-glue.js";
-import { chat, displayCtxRatio, microcompactThresholdFor, statusModelLabel } from "./chat.js";
+import { chat, contextWindowTokens, displayCtxRatio, microcompactThresholdFor, statusModelLabel } from "./chat.js";
 import { adapterOptionsFor } from "./auth/adapter-options.js";
 import { loadProjectConfig, loadUserConfig, mergeConfigs, resolveAutoCompact, resolveContextWindow, resolveModel } from "./config.js";
 import { checkForUpdate, knownUpdate, updateCardLines } from "./update-check.js";
@@ -49,10 +58,11 @@ import { tmuxMouseHint } from "./tmux-hint.js";
 import { resume } from "./resume.js";
 import { paintWindowTitle } from "./window-title.js";
 import { resumeTail } from "./resume-tail.js";
+import { replayInto } from "./replay.js";
 import { armByteTrace } from "./byte-trace.js";
 import { tmpdir, homedir } from "node:os";
 import { clipboardImage } from "./clipboard.js";
-import { collectSessionCards, projectSessionCard } from "./session-cards.js";
+import { cardsFromListings } from "./session-cards.js";
 // The moved exports stay reachable from this entry — the test imports
 // (project-trust, coding-agent) never change (B4: zero assertion changes).
 export { applyProjectMerges } from "./trust-ui.js";
@@ -316,8 +326,8 @@ function editorInput(editor) {
         // TUI2-R2 ②: the session picker — the editor owns the keys (the
         // selection walk, the filter, enter/esc), the compositor draws the
         // band, and the id comes back here.
-        pick(cards, onPick) {
-            editor.beginPick(cards, onPick);
+        pick(cards, onPick, here) {
+            editor.beginPick(cards, onPick, here);
         },
         // W22: the pending-turn queue — the ↑ pop walk (the keys); the
         // chips are the compositor's bindQueue (the dock side).
@@ -372,7 +382,10 @@ function userThemeSetting() {
 function makeLineInput() {
     const userTheme = userThemeSetting();
     if (process.stdin.isTTY) {
-        const editor = new Editor(() => (dock.active ? dock.redraw() : editor.selfRender()));
+        const editor = new Editor((fromKey) => (dock.active ? dock.redraw(fromKey) : editor.selfRender()));
+        // 0.40.1: the installed skills join the `/` menu — read live, so a
+        // skill /reload adds is offered on the next keystroke
+        editor.bindMenuExtras(() => skillMenuItems(loadedSkillsCatalog(), slashCommandNames()));
         editor.enter();
         // DC-3: ask the terminal what its background is, and paint the
         // first frame without waiting for the answer.
@@ -455,6 +468,7 @@ function makeLineInput() {
         // the panel's option rows, so the compositor is what the editor asks
         // where they are. Neither side computes the other's geometry.
         editor.bindPanelRows(() => dock.panelOptionRows());
+        editor.bindPickWindow(() => dock.visiblePickWindow());
         dock.bindMenu(() => editor.menuState()); // v3 §04: the slash-command menu
         editor.bindAtItems(atFiles); // KC3 §5: the file source — listed per OPEN
         dock.bindAt(() => editor.atState()); // KC3 §4: the picker's band
@@ -484,7 +498,11 @@ function bannerExtensionText() {
     // terminal layer (extensionsBannerText — a pure function of the three
     // name lists, including the "(connecting…)" in-flight label). Which
     // lists exist is the CLI's fact and stays here.
-    return extensionsBannerText(builtInExtensions, userExtensions, projectExtensions);
+    // 0.40.0: in dontAsk the ask extension is loaded but offers no tool
+    // (builtin.ts offInDontAsk) — the banner says so beside the tier that
+    // turns it off, rather than listing it as if it could ask.
+    const builtIn = builtInExtensions.map((e) => (e.name === "ask" && getMode() === "dontAsk" ? { name: e.name, note: "off in dontAsk" } : e));
+    return extensionsBannerText(builtIn, userExtensions, projectExtensions);
 }
 /** E1: the startup banner line(s) — TTY: logo + merged extensions + the
  *  W5 resume list as a LIVE banner cell (W1: the tier re-derives on
@@ -619,9 +637,18 @@ const INSTRUCTION_FILES = ["AGENTS.md", "CLAUDE.md"];
  * return it as an injected section, or "" when none exists. Truncated at
  * 8KB with an explicit note. Pure — read once per session, so the prompt
  * is byte-stable for the session's lifetime.
+ *
+ * kiso never serves its own credential store to a model, and this read is
+ * the one that needs no model at all: a cloned repository whose AGENTS.md
+ * is a symlink to the store would put it in the SYSTEM PROMPT of every
+ * request, with no tool call and no trust prompt. A file that resolves to
+ * a protected one is skipped as though absent.
  */
-export function readProjectInstructions(cwd) {
+export function readProjectInstructions(cwd, protectedFiles = []) {
+    const id = protectedIdentity(protectedFiles);
     for (const name of INSTRUCTION_FILES) {
+        if (isProtectedPath(join(cwd, name), id))
+            continue;
         let text;
         try {
             text = readFileSync(join(cwd, name), "utf8");
@@ -635,8 +662,8 @@ export function readProjectInstructions(cwd) {
 }
 /** A area: the session's system prompt — the constant plus any project
  *  instructions found in the workspace. Deterministic per cwd. */
-export function composeSystemPrompt(cwd) {
-    const injected = readProjectInstructions(cwd);
+export function composeSystemPrompt(cwd, protectedFiles = []) {
+    const injected = readProjectInstructions(cwd, protectedFiles);
     return injected === "" ? SYSTEM_PROMPT : `${SYSTEM_PROMPT}\n${injected}`;
 }
 /**
@@ -700,7 +727,12 @@ async function makeAgent(sessionId, input, modelFlag) {
     // the trust record is the first home write, the scaffold the second.
     if (isFirstRun())
         scaffoldFirstRun();
-    const store = new SessionStore(sessionsDir());
+    // 0.40.0 — one folder per project: the one-time move of the legacy
+    // folder, then this project's folder claimed (made, its workspace
+    // recorded). Both write, so both sit behind the verdict, with the store.
+    prepareSessionFolders();
+    activeStoreDir = sessionsDir();
+    const store = new SessionStore(activeStoreDir);
     // TUI2-R2 ②/③: the navigation surfaces read through THIS store — one
     // store per process, and the picker/listing never write through it.
     setSessionStore(store);
@@ -736,7 +768,12 @@ async function makeAgent(sessionId, input, modelFlag) {
     // DT-1a: what a delegated task may NAME — the configured checks and the
     // model profiles — handed to the (in-process) subagent extension through
     // the environment. A model never supplies a command; it names a check.
-    process.env.KISO_DELEGATION_CONFIG_JSON = JSON.stringify({ checks: merged.checks ?? {}, profiles: Object.keys(merged.models ?? {}) });
+    // 0.40.0: and the folder this process keeps its sessions in — a child
+    // writes beside its parent, whatever directory it runs in. Through this
+    // channel and not an exported KISO_SESSIONS_DIR: a variable in
+    // process.env would reach every shell child, and a kiso started from a
+    // shell tool would then write into this project's folder.
+    process.env.KISO_DELEGATION_CONFIG_JSON = JSON.stringify({ checks: merged.checks ?? {}, profiles: Object.keys(merged.models ?? {}), sessionsDir: sessionsDir() });
     setConfigModels(merged.models ?? {});
     const resolved = resolveModel(modelFlag, merged);
     // AFTER the model resolves: the window a PROFILE states is about that
@@ -749,10 +786,12 @@ async function makeAgent(sessionId, input, modelFlag) {
         console.log("[faux mode — set ANTHROPIC_API_KEY or OPENAI_API_KEY, or configure models in ~/.kiso/config.json]\n");
         setCurrentFaux(true);
         setCurrentModelName("faux");
+        setCurrentProfileName(null);
     }
     else {
         setCurrentFaux(false);
         setCurrentModelName(resolved.name);
+        setCurrentProfileName(resolved.name);
     }
     setAgentModel(model, resolved?.profile.baseUrl); // v2b: the status bar shows it; OR-1: the endpoint rides along
     // W21: the extensions array is built ONCE per agent and shared with
@@ -762,14 +801,45 @@ async function makeAgent(sessionId, input, modelFlag) {
     // re-reads the config's extensions array per run).
     // LT-2: the loop breaker at the chain HEAD — it speaks first when it speaks,
     // so `decidedBy` names it; a deny there beats every tier, bypass included.
-    const extensions = [breakerExtension(), ...modeExtensions(), ...loadedExtensions];
+    // 0.40.0: the read-only shell allow sits after the tiers — an allow from
+    // it outranks a tier's ask and names itself in decidedBy.
+    // 0.40.0: a saved allow never carries a write into .git/ or .kiso/, nor
+    // a destructive shell command.
+    const workspaceRoot = () => codingToolOptions().workspaceRoot;
+    const neverInherited = (call) => isProtectedWrite(call, workspaceRoot()) || isDestructiveCall(call);
+    setNeverInherited(neverInherited);
+    // 0.40.0: the catastrophe floor, at the chain's HEAD — a deny there
+    // names itself in decidedBy and outranks every tier, bypass included.
+    // Read per agent, so /reload picks up an edited user config.
+    const userConfig = loadUserConfig();
+    setFloorOn(userConfig?.floor !== "off");
+    // kiso never serves its own credential store to a model: the file tools
+    // refuse it through codingToolOptions, and this member denies a shell
+    // line naming it — at the HEAD with the floor, in every mode, and NOT
+    // switched off with it (`floor: "off"` lowers the catastrophe floor,
+    // never this).
+    setUserProtectedPaths(userConfig?.protectedPaths);
+    const extensions = [
+        protectedShellExtension({ files: protectedFiles, workspaceRoot, env: () => ({ home: homedir(), kisoHome: kisoHome() }) }),
+        floorExtension(() => floorOn, workspaceRoot),
+        breakerExtension(),
+        ...modeExtensions(workspaceRoot),
+        readOnlyShellExtension(codingToolOptions),
+        ...loadedExtensions.map((e) => guardSavedAllow(e, neverInherited)),
+    ];
     setCurrentAgentExtensions(extensions);
     // E6: the run-start context policy (captured once — exactOptionalPropertyTypes).
     const contextPolicy = contextPolicyFromEnv();
     const idleFromEnv = streamIdleFromEnv(); // read once: a narrowed const, not a call per spread
+    const retriesFromEnv = maxRetriesFromEnv();
     const definition = {
         model,
         store,
+        // 0.40.0: a NEW session records where it started; the picker scopes by
+        // it. The profile name is recorded only when the model came from a
+        // config profile — a direct provider/model or an env key names none.
+        workspace: workspaceRoot(),
+        ...(resolved !== null && merged.models?.[resolved.name] === resolved.profile ? { profileName: resolved.name } : {}),
         // Area 5: the coding tools are bound to the workspace — every path
         // they touch is canonicalized inside cwd, escapes are refused.
         tools: [...createCodingTools(codingToolOptions())], // DC-49 — the options live in state.ts, shared with the `!` command's runner
@@ -779,19 +849,19 @@ async function makeAgent(sessionId, input, modelFlag) {
         // still counts loadedExtensions only — the modes are in-process,
         // never a file extension.
         systemPrompt: (() => {
-            const sp = composeSystemPrompt(process.cwd());
+            const sp = composeSystemPrompt(process.cwd(), protectedFiles());
             const extra = modeSystemPrompt();
             return extra === undefined ? sp : `${sp}\n\n${extra}`;
         })(),
-        // C area: microcompact is ON by default in the product — threshold =
-        // half the model window (KISO_CONTEXT_WINDOW override included;
-        // 200k window → 100k tokens). Long sessions compact old read/list/
-        // search/shell outputs instead of silently growing past the window.
-        // CTX-1: the startup value; `/model` recomputes it through the same
-        // function, so the two can never drift apart.
-        microcompact: { thresholdTokens: microcompactThresholdFor() },
-        // E6: the run-start context policy — OFF unless env-armed (beats the microcompact default when both fire).
-        ...(contextPolicy !== undefined ? { contextPolicy } : {}),
+        // ADR-0055 Amendment 1 (A1b): compaction is ON by default and runs
+        // INSIDE a run, by tiers drawn from the model's window (CTX-1: the
+        // binding step moves the window with /model and /resume). The
+        // standing microcompact at half the window is gone (A4). Phase rule
+        // 1 reads the user's configured checks first, then the runner table.
+        contextPolicy: {
+            ...(contextPolicy ?? {}),
+            tiers: { windowTokens: contextWindowTokens(), isCheck: (command) => runsACheck(command, Object.values(merged.checks ?? {})) },
+        },
         // R3e (owner ruling, 2026-08-28): NO turn limit on an interactive
         // session. This was `maxTurns: 20`, hardcoded on 2026-08-03 with no
         // stated reason and no way to change it — and it was the thing that
@@ -823,9 +893,19 @@ async function makeAgent(sessionId, input, modelFlag) {
         // LT-1: KISO_STREAM_IDLE_MS (the test rigs' knob) beats the profile —
         // the last spread wins, which is why it sits after the profile's.
         ...(idleFromEnv !== undefined ? { streamIdleMs: idleFromEnv } : {}),
+        ...(retriesFromEnv !== undefined ? { maxRetries: retriesFromEnv } : {}),
+        // ADR-0005 Amendment 2: the kernel announces each retry before its
+        // wait; the running row shows it. Composed with every extension's
+        // hooks by the runtime — an extension observing retries too is heard.
+        hooks: {
+            onRetry: async (info) => {
+                setRetryShown({ attempt: info.attempt, maxRetries: info.maxRetries, code: info.code, until: Date.now() + info.delayMs });
+            },
+        },
     };
     return createAgent(definition);
 }
+export { workspaceRoot } from "./state.js";
 /** TUI2-R2 ② — the picker's affordance row: the keys, said where the
  *  keys are useful. */
 const PICKER_HINT = "↑↓ pick · ⏎ resumes · type filters · esc";
@@ -834,11 +914,139 @@ const PICKER_HINT = "↑↓ pick · ⏎ resumes · type filters · esc";
  * runtime's own accessors (see session-cards.ts); this is only the
  * plumbing that hands it the store's read side.
  */
-async function sessionCards(agent) {
+async function sessionCards(_agent, announce = (l) => bodyLog(l)) {
     const store = sessionStoreRef;
     if (store === null)
         return []; // unreachable: makeAgent builds the store first
-    return collectSessionCards(agent, (id) => store.load(id));
+    const folders = listingFolders();
+    // 0.40.0 dogfood (item 2, lead's ruling A): the ONE-TIME migration — the
+    // first list after the upgrade reads each legacy log exactly once and
+    // writes its summary into the sidecar; announced with its count. Per
+    // folder: each carries its own marker.
+    const pending = folders.filter((f) => summaryMigrationPending(f.dir));
+    const count = pending.reduce((n, f) => n + listSessionSidecars(f.dir).filter((l) => l.summary === null).length, 0);
+    if (count > 0)
+        announce(`recording summaries for ${count} older session${count === 1 ? "" : "s"} — once`);
+    for (const f of pending) {
+        const reader = f.dir === activeStoreDir ? store : new SessionStore(f.dir);
+        migrateSummaries(f.dir, (id) => reader.load(id));
+    }
+    // …and from then on, the SIDECARS only: no log is opened to draw a row.
+    // A project folder's sessions are that project's; one without a recorded
+    // workspace was placed by inference and says so.
+    return cardsFromListings(folders.flatMap((f) => listSessionSidecars(f.dir).map((l) => f.kind === "project" ? { ...l, workspace: f.workspace ?? l.workspace, inferred: l.workspace === null } : f.kind === "unknown" ? { ...l, workspace: null } : l)));
+}
+/**
+ * 0.40.0 — the folders a listing reads: every project's under the
+ * per-project layout (the picker opens on this one, `tab` shows all), and
+ * the one folder otherwise. This process's folder is always first, even
+ * before its first session exists.
+ */
+function listingFolders() {
+    const here = ownSessionsDir();
+    const home = kisoHome();
+    if (!projectLayoutActive(home))
+        return [{ dir: here, workspace: null, kind: "legacy" }];
+    const all = sessionFolders(home);
+    const mine = all.find((f) => f.dir === here) ?? { dir: here, workspace: projectRoot(), kind: "project" };
+    return [mine, ...all.filter((f) => f.dir !== here)];
+}
+/**
+ * 0.40.0 — before any session opens: the one-time move of the legacy
+ * folder into project folders (announced once, with the undo), then this
+ * project's folder claimed. Nothing happens under a pinned folder or after
+ * a reversed migration.
+ */
+function prepareSessionFolders() {
+    const home = kisoHome();
+    if (!projectLayoutActive(home))
+        return;
+    if (pendingLegacyIds(home).length > 0) {
+        const result = runMigration(home, planMigration(home));
+        if (result !== null && result.moved > 0) {
+            const line = migrationNotice(result);
+            if (process.stdout.isTTY)
+                bodyLog(line);
+            else
+                process.stderr.write(`${line}\n`);
+        }
+    }
+    claimProjectDir(ownSessionsDir(), projectRoot());
+}
+/**
+ * 0.40.0 (the owner's dogfood: a uooki session resumed from flowpix2) —
+ * whether a session id may open in this project. Its own folder: yes. A
+ * session another project RECORDED: refused, with where to go. One whose
+ * project is unknown, or was only inferred, is never refused and never
+ * moved (the lead's ruling: a resume changes no placement) — it opens where
+ * it is, and the line says the tools work here. A pure read. `null` = not
+ * found anywhere (the caller's own rule applies: a new session, or "no
+ * such session").
+ */
+export function routeSession(id) {
+    const own = ownSessionsDir();
+    if (hasSession(own, id))
+        return { kind: "here" };
+    const home = kisoHome();
+    if (!projectLayoutActive(home))
+        return null;
+    const found = locateSession(home, id, own);
+    if (found === null)
+        return null;
+    const profile = readProfile(found.dir, id);
+    const recorded = profile.kind === "ok" && profile.profile.workspace !== null ? canonicalPath(profile.profile.workspace) : null;
+    const cwd = projectRoot();
+    const owner = found.kind === "project" ? (found.workspace ?? recorded) : recorded;
+    if (recorded !== null && owner !== null && owner !== cwd) {
+        return { kind: "refused", line: `this session belongs to ${tildeOf(owner)} — cd there to resume it` };
+    }
+    // recorded here, and still in the legacy folder (open elsewhere when the
+    // move ran): nothing to warn about
+    if (recorded !== null)
+        return { kind: "elsewhere", dir: found.dir, line: null };
+    const inferred = found.kind === "project" && owner !== null ? `workspace inferred as ${tildeOf(owner)}, never recorded` : "workspace unknown";
+    return { kind: "elsewhere", dir: found.dir, line: `${inferred} — tools work in ${tildeOf(workspaceRoot())}` };
+}
+/** The folder a session opens in: the one the store is on when it holds
+ *  it, else this project's, else where the route found it. A new id opens
+ *  in this project's folder. */
+function sessionFolderOf(id) {
+    if (hasSession(activeStoreDir, id))
+        return activeStoreDir;
+    const route = routeSession(id);
+    return route?.kind === "elsewhere" ? route.dir : ownSessionsDir();
+}
+/** The folder makeAgent built the store on. */
+let activeStoreDir = "";
+/** The workspace a listing is scoped to: a project folder's identity under
+ *  the per-project layout, the recorded realpath in one pinned folder. */
+function scopeRoot() {
+    return projectLayoutActive(kisoHome()) ? projectRoot() : workspaceRoot();
+}
+function tildeOf(path) {
+    const home = homedir();
+    return path === home || path.startsWith(`${home}/`) ? `~${path.slice(home.length)}` : path;
+}
+/** The explicit-id doors (`chat <id>`, `resume <id>`, `-p … <id>`), BEFORE
+ *  makeAgent builds the store: a refusal is the entry's error (the line on
+ *  stderr, exit 2); a session in another folder opens there. Returns the
+ *  line to say once the session is up. */
+function enterRouted(id) {
+    const route = routeSession(id);
+    if (route === null || route.kind === "here")
+        return null;
+    if (route.kind === "refused")
+        throw new CliUsageError(route.line);
+    setOpenSessionFolder(route.dir);
+    return route.line;
+}
+function sayRouteLine(line) {
+    if (line === null)
+        return;
+    if (process.stdout.isTTY)
+        bodyLog(line);
+    else
+        process.stderr.write(`${line}\n`);
 }
 /**
  * TUI2-R2 ② — the resume picker: the band, the keys, the id.
@@ -866,7 +1074,8 @@ async function pickSession(agent, input) {
     }
     dock.setStatus("", PICKER_HINT);
     const picked = await new Promise((resolve) => {
-        input.pick(() => cards, resolve);
+        // 0.40.0: scoped to the running workspace; tab flips to all
+        input.pick(() => cards, resolve, scopeRoot());
     });
     dock.setStatus("", null);
     return picked;
@@ -892,6 +1101,21 @@ async function pickSession(agent, input) {
  * formatter — never a boot-time copy, which would drift from the real
  * row the moment either changed.
  */
+/**
+ * ADR-0055 Amendment 1 (the owner, 2026-09-18): `autoCompact` — the
+ * between-turn ratio, from config or KISO_AUTO_COMPACT — is RETIRED. The
+ * in-run tiers compact inside a run and before its first request, which is
+ * everything it did and more. 0.40.0 accepts it, ignores it and says so
+ * once; 0.41.0 removes it.
+ */
+let autoCompactNoticed = false;
+function retiredAutoCompact(merged) {
+    if (!autoCompactNoticed && (process.env.KISO_AUTO_COMPACT !== undefined || resolveAutoCompact(merged) !== undefined)) {
+        autoCompactNoticed = true;
+        console.error("[autoCompact] retired in 0.40.0 — compaction now runs inside a run, by tiers; this setting is ignored and goes in 0.41.0");
+    }
+    return undefined;
+}
 /**
  * CTX-1 (Astra F34-1): EVERY entry point that opens a session must bind the
  * policy that follows the session's OWN model.
@@ -913,11 +1137,22 @@ async function pickSession(agent, input) {
  * threshold got stuck in the first place.
  */
 function bindRestoredSession(session) {
+    // 0.40.1 (the owner's ruling of 2026-09-21): a changed binding is neither
+    // blocked nor "acknowledged" — it is recorded as the next revision under
+    // the CURRENT configuration, and this ONE line says which binding and why
+    // (the owner-ruled reasoning reset rides with it, silently until 0.40.0).
+    const ack = session.driftAcknowledgement ?? null;
+    if (ack !== null) {
+        const was = ack.reasoningReset;
+        const prior = [was.effort !== "default" ? `effort ${was.effort}` : "", was.thinking !== "default" ? `thinking ${was.thinking}` : ""].filter((s) => s !== "").join(", ");
+        bodyLog(`binding changed — now on ${session.model}: ${ack.reasons.join("; ")}; reasoning reset to defaults${prior === "" ? "" : ` (was ${prior})`}`);
+    }
     setAgentModel(session.model, session.baseUrl);
     session.setMicrocompactThreshold(microcompactThresholdFor({
         model: session.model,
         ...(session.baseUrl !== undefined ? { baseUrl: session.baseUrl } : {}),
     }));
+    session.setContextWindow(contextWindowTokens({ model: session.model, ...(session.baseUrl !== undefined ? { baseUrl: session.baseUrl } : {}) }));
 }
 function paintBootStatus(session) {
     if (!dock.active)
@@ -971,7 +1206,7 @@ function skillCount() {
  * is the durable log on disk. The record never moves: a reload is
  * invisible in it, because nothing the model said or did changes.
  */
-async function reloadAgent(old, id, input) {
+async function reloadAgent(old, id, input, announce = true) {
     // Snapshot BEFORE makeAgent: it overwrites every one of these, so the
     // old set would be unreachable by the time we needed to dispose it.
     const oldLoaded = loadedExtensions;
@@ -1031,6 +1266,7 @@ async function reloadAgent(old, id, input) {
         setConfiguredWindow(oldCfg.window);
         setCurrentFaux(oldCfg.faux);
         setCurrentModelName(oldCfg.modelName);
+        setCurrentProfileName(null); // the reload snapshot carries no profile name: no mark beats a guessed one
         setModelChoice(oldCfg.choice);
         setAgentModel(oldCfg.agent, oldCfg.endpoint);
         if (oldCfg.delegation === undefined)
@@ -1051,7 +1287,8 @@ async function reloadAgent(old, id, input) {
             // best-effort — the temp dir would be reaped by the OS
         }
     }
-    bodyLog(`[reload] ${loadedExtensions.length} extensions, ${skillCount()} skills — the conversation is unchanged`);
+    if (announce)
+        bodyLog(`[reload] ${loadedExtensions.length} extensions, ${skillCount()} skills — the conversation is unchanged`);
     return next;
 }
 async function chatLoop(first, firstId, input, autoCompact) {
@@ -1063,11 +1300,83 @@ async function chatLoop(first, firstId, input, autoCompact) {
     // reload said what it did; repeating the session's opening would read
     // as a new session, which is the one thing it is not.
     let rebuilt = false;
+    // XP-1: the id of the session that IS open — null until the first open
+    // succeeds, and cleared by a refused switch, so one refusal can never
+    // recurse into another.
+    let opened = null;
+    // XP-1: the re-open that follows a refused switch. The session is the one
+    // already on screen, so this step prints neither banner nor tail.
+    let refused = false;
+    /** DC-57: lines that arrived with a switch command belong to the session being asked for. */
+    let seed = [];
     for (;;) {
-        const session = await agent.session({ id, ...(acceptDrift() ? { acceptDrift: true } : {}) });
+        // 0.40.0 (the lead's ruling): a session opens in the folder that holds
+        // it, never moved — a switch that crosses folders rebuilds the agent
+        // on the other folder's store, and one back rebuilds it on this
+        // project's. A failed rebuild switches nothing.
+        const folder = sessionFolderOf(id);
+        if (folder !== activeStoreDir) {
+            const was = { dir: activeStoreDir, store: sessionStoreRef };
+            setOpenSessionFolder(folder === ownSessionsDir() ? null : folder);
+            const next = await reloadAgent(agent, id, input, false);
+            if (next === agent) {
+                // makeAgent may have built the new store before it failed
+                activeStoreDir = was.dir;
+                if (was.store !== null)
+                    setSessionStore(was.store);
+                setOpenSessionFolder(was.dir === ownSessionsDir() ? null : was.dir);
+                if (prev === null)
+                    return;
+                id = prev;
+                rebuilt = true;
+                continue;
+            }
+            agent = next;
+        }
+        let session;
+        try {
+            session = await agent.session({ id, ...(acceptDrift() ? { acceptDrift: true } : {}) });
+        }
+        catch (err) {
+            // The profile contract's BLOCKED cases — a sidecar that cannot be
+            // read, an XP-era log without one — belong to the ENTRY: nothing is
+            // on screen yet, and the message says what to do. An in-session
+            // SWITCH is a LINE: it switches NOTHING and the session you were in
+            // stays open. The throw used to escape chatLoop, which killed the
+            // REPL and left the session that was open behind with no log at all
+            // (announced once, then empty and unopenable). Every refusal this
+            // open can throw is treated the same way — the message itself is
+            // what says what to do about it.
+            if (opened === null)
+                throw err;
+            bodyLog(escapeTerminal(err.message));
+            // DC-57's other half + DC-55 (the owner's ruling of 2026-09-21,
+            // option ①): the lines that arrived WITH the refused switch were aimed
+            // at a session that EXISTS and could not be opened. They are NOT run
+            // here — a departing session never answers lines meant for the target —
+            // and not dropped in silence either: what was held is printed, so
+            // nothing vanishes without the person seeing it. (Leaving them in the
+            // queue would hand them to the old session on its next entry, which is
+            // the thing this ruling forbids.)
+            seed = [];
+            const held = queuedSwitchLines.splice(0);
+            if (held.length > 0) {
+                bodyLog(`[${held.length} line${held.length === 1 ? "" : "s"} held back — the switch was refused, so nothing was run]`);
+                for (const line of held)
+                    bodyLog(`  ${escapeTerminal(line)}`);
+            }
+            id = opened; // the switch is undone
+            opened = null;
+            refused = true;
+            continue;
+        }
+        opened = id;
         if (rebuilt) {
             rebuilt = false;
         }
+        else if (refused) {
+            refused = false; // back in the session that was already on screen
+        }
         else if (prev === null) {
             bodyLog(`session ${id}\n`);
             // REL-0152-D5: a session with history says what that history WAS.
@@ -1075,7 +1384,7 @@ async function chatLoop(first, firstId, input, autoCompact) {
             // prompt inside a conversation with thousands of events — the
             // durable log was right there and none of it was shown. Empty for
             // a fresh session, so `kiso chat` is byte-identical.
-            bodyLog(resumeTail(session.log.all, process.stdout.columns ?? 80).join("\n")); // DC-51: one call, one cell
+            showResumeTail(session.log.all);
             // R2 (owner, 2026-08-27): the resume list is NOT on the opening
             // screen. `/resume` is where you go looking for a session; the
             // opening's job is to say what THIS one is.
@@ -1107,7 +1416,7 @@ async function chatLoop(first, firstId, input, autoCompact) {
         }
         else {
             bodyLog(`session ${id} (switched — previous: ${prev}, /resume ${prev} returns)\n`);
-            bodyLog(resumeTail(session.log.all, process.stdout.columns ?? 80).join("\n")); // DC-51: one call, one cell
+            showResumeTail(session.log.all);
             if (currentFaux)
                 session.setAdapter(createFauxProvider(readFauxScript().slice(fauxSkip(id))));
         }
@@ -1125,6 +1434,12 @@ async function chatLoop(first, firstId, input, autoCompact) {
         // the threshold. One step, shared by all three entry points.
         bindRestoredSession(session);
         setCurrentModelName(session.model);
+        // A SWITCH knows only a model id here — nothing that names the profile —
+        // so the mark is cleared rather than guessed. A FRESH start keeps what
+        // makeAgent resolved from `--model <profile>`, which is the one place
+        // the name is known (prev is null only on the first entry).
+        if (prev !== null)
+            setCurrentProfileName(null);
         paintBootStatus(session);
         // The terminal's window title, HERE for the same reason the three
         // lines above are here: this is the one step all three entry points
@@ -1132,12 +1447,18 @@ async function chatLoop(first, firstId, input, autoCompact) {
         // be left naming the session the user just left.
         paintWindowTitle(session.log.all);
         const nav = {
-            sessions: () => agent.sessions().map((m) => m.id),
+            // 0.40.0 dogfood: the ids only — agent.sessions() read every log whole
+            // (seconds on the owner's 118 sessions) before /resume could open
+            sessions: () => agent.sessionIds(),
+            route: (sessionId) => routeSession(sessionId),
             ...(process.stdin.isTTY ? { pick: () => pickSession(agent, input) } : {}),
         };
-        const end = await chat(session, currentFaux, input, autoCompact, nav);
+        const end = await chat(session, currentFaux, input, autoCompact, nav, seed);
         if (end.next === "exit")
             return;
+        // DC-57: the lines that arrived with the switch command ride INTO the
+        // next entry — they were aimed at the session being asked for.
+        seed = end.lines ?? [];
         if (end.next === "reload") {
             agent = await reloadAgent(agent, id, input);
             rebuilt = true;
@@ -1197,6 +1518,20 @@ async function readSecret(prompt) {
         process.stdin.on("data", onData);
     });
 }
+/**
+ * What a resumed session shows (REL-0152-D5, 4c). On the compositor: the
+ * durable events replayed into cells — the last two turns in full, the
+ * earlier ones in one fold row the ctrl+r viewer reads. Through a pipe
+ * there is no viewer and no cell renderer, so the plain text tail stays
+ * (DC-51: one call, one cell).
+ */
+function showResumeTail(events) {
+    const W = process.stdout.columns ?? 80;
+    if (dock.active)
+        replayInto(body, events, W);
+    else
+        bodyLog(resumeTail(events, W).join("\n"));
+}
 async function main() {
     // E group (the graceful-exit gate ③, R-G 0.1.48): a terminal closing
     // turns the in-flight stdout/stderr writes into EIO, and node's
@@ -1273,7 +1608,7 @@ async function main() {
     if (modeFlag !== -1) {
         const m = MODES.find((x) => x === args[modeFlag + 1]);
         if (m === undefined) {
-            console.error(`unknown mode: ${args[modeFlag + 1]} (tiers: ${MODES.join(", ")})`);
+            console.error(`unknown mode: ${args[modeFlag + 1]} (tiers: ${OFFERED_MODES.join(", ")})`);
             process.exit(2);
         }
         setMode(m);
@@ -1292,6 +1627,11 @@ async function main() {
             const path = args[i + 1];
             if (path === undefined)
                 throw new CliUsageError("--task-file needs a path");
+            // the file becomes the turn a model reads — never the credential
+            // store. The list here is the store's own path: the user config's
+            // protectedPaths is read later, with the agent
+            if (isProtectedPath(path, protectedIdentity(protectedFiles())))
+                throw new CliUsageError(`--task-file: ${path} — ${PROTECTED_REFUSAL}`);
             try {
                 taskFile = readFileSync(path, "utf8");
             }
@@ -1301,6 +1641,30 @@ async function main() {
             args.splice(i, 2);
         }
     }
+    // 0.40.0: `kiso sessions --all | --current` — the one command that takes
+    // them. Parsed only there, so neither ever becomes a session id. Absent
+    // = each form's default (TTY: current; pipe: all, today's bytes).
+    let listScope;
+    let reverseManifest;
+    if (args[0] === "sessions") {
+        // 0.40.0: the undo of the per-project move, named by its manifest
+        const r = args.indexOf("--reverse-migration");
+        if (r !== -1) {
+            reverseManifest = args[r + 1];
+            if (reverseManifest === undefined || reverseManifest.startsWith("--"))
+                throw new CliUsageError("kiso sessions --reverse-migration <manifest> — the path the move announced");
+            args.splice(r, 2);
+        }
+        for (const flag of ["--all", "--current"]) {
+            const i = args.indexOf(flag);
+            if (i === -1)
+                continue;
+            args.splice(i, 1);
+            if (listScope !== undefined && listScope !== flag.slice(2))
+                throw new CliUsageError("kiso sessions: --all and --current contradict each other");
+            listScope = flag.slice(2);
+        }
+    }
     const [command, arg] = args;
     // round 8: faux mode is the keyless demo script — an exhausted script must
     // exit non-zero, never masquerade as a successful provider run. The
@@ -1413,8 +1777,10 @@ async function main() {
             // the -p flow: recovery-first one-shot, the resume() machinery
             // verbatim (a fresh id makes the recovery a no-op)
             const id = command ?? newSessionId(sessionsDir());
+            const routeLine = command !== undefined ? enterRouted(id) : null;
             agent = await makeAgent(id, input, modelFlag);
             applyConfigMode();
+            sayRouteLine(routeLine);
             const session = await agent.session({ id, ...(acceptDrift() ? { acceptDrift: true } : {}) });
             bindRestoredSession(session); // CTX-1 (F34-1): the -p door, too
             faux = currentFaux;
@@ -1431,10 +1797,12 @@ async function main() {
                 dock.enter();
                 // E area: a resumed session continues the script at its durable
                 // position — never restarts it (fauxSkip).
+                const routeLine = arg !== undefined ? enterRouted(id) : null;
                 agent = await makeAgent(id, input, modelFlag);
                 applyConfigMode();
+                sayRouteLine(routeLine);
                 faux = currentFaux;
-                await chatLoop(agent, id, input, resolveAutoCompact(mergedConfig));
+                await chatLoop(agent, id, input, retiredAutoCompact(mergedConfig));
                 break;
             }
             case "resume": {
@@ -1451,6 +1819,7 @@ async function main() {
                 // (argv = [node, script, resume, id, prompt?]).
                 const prompt = process.argv[4];
                 dock.enter();
+                const routeLine = arg !== undefined ? enterRouted(arg) : null;
                 agent = await makeAgent(arg, input, modelFlag);
                 applyConfigMode();
                 let id = arg;
@@ -1461,15 +1830,25 @@ async function main() {
                     // an error, never a session started behind their back.
                     if (picked === null)
                         break;
+                    // 0.40.0: `tab` lists every project, and another project's
+                    // recorded session is refused here, with where to go
+                    const route = routeSession(picked);
+                    if (route?.kind === "refused") {
+                        bodyLog(route.line);
+                        break;
+                    }
+                    if (route?.kind === "elsewhere" && route.line !== null)
+                        bodyLog(route.line);
                     // the mini-spec (a DECLARED SUPERSESSION of the one-shot
                     // picker flow): a PICKED session enters the full REPL —
                     // "resume and keep working" no longer requires knowing to
                     // type `kiso chat <id>`. The explicit-id one-shot form
                     // (`kiso resume <id> ["prompt"]`) keeps its exact bytes.
                     faux = currentFaux;
-                    await chatLoop(agent, picked, input, resolveAutoCompact(mergedConfig));
+                    await chatLoop(agent, picked, input, retiredAutoCompact(mergedConfig));
                     break;
                 }
+                sayRouteLine(routeLine);
                 const session = await agent.session({ id, ...(acceptDrift() ? { acceptDrift: true } : {}) });
                 bindRestoredSession(session); // CTX-1 (F34-1): the explicit-id door
                 faux = currentFaux;
@@ -1482,7 +1861,7 @@ async function main() {
                     session.setAdapter(createFauxProvider(readFauxScript().slice(fauxSkip(id))));
                 // REL-0152-D5 — the same tail on the explicit-id form. NOT on
                 // the -p path above: that one's stdout is a machine's input.
-                bodyLog(resumeTail(session.log.all, process.stdout.columns ?? 80).join("\n")); // DC-51: one call, one cell
+                showResumeTail(session.log.all);
                 await resume(session, prompt, faux, input);
                 break;
             }
@@ -1495,22 +1874,60 @@ async function main() {
                 // "reading 'question'" on the dock-less branch). The input
                 // exists so the gate's ask can be answered; the listing
                 // itself never touches it.
+                if (reverseManifest !== undefined) {
+                    // before makeAgent: its folder preparation would otherwise run
+                    // the very move this undoes
+                    const { restored, left } = reverseMigration(kisoHome(), reverseManifest);
+                    console.log(`moved ${restored} session${restored === 1 ? "" : "s"} back to ${join(kisoHome(), "sessions")}; one folder per project is off until ${join(kisoHome(), "projects", ".migration-reversed")} is removed${left > 0 ? ` — ${left} created since the move stay in their project folders` : ""}`);
+                    break;
+                }
                 agent = await makeAgent(undefined, input, modelFlag);
                 // TUI2-R2 ③ — the same projection the picker renders, printed.
                 // The PIPE keeps today's bytes exactly: `kiso sessions` is
                 // something scripts read, and a badge column is a TTY-render
                 // concern, not a change to a machine interface.
+                // 0.40.0 (lead's ruling): the TTY defaults to THIS workspace and
+                // says so in a header line with both counts; the PIPE defaults to
+                // every session with today's bytes — scripts must not change
+                // under them. An explicit --all or --current applies to both.
+                const here = scopeRoot();
                 if (process.stdout.isTTY) {
-                    const cards = await sessionCards(agent);
+                    const every = await sessionCards(agent, (l) => console.log(l));
+                    const all = (listScope ?? "current") === "all";
+                    const inHere = every.filter((c) => c.workspace === here);
+                    const cards = all ? every : inHere;
                     const W = process.stdout.columns ?? 80;
                     const col = idColumn(cards);
                     const now = Date.now();
+                    console.log(sessionListHeader(inHere.length, every.length, all, W));
+                    // 0.40.1: the sessions with no workspace — one counted line, never
+                    // listed, unless --all
+                    if (!all) {
+                        const unknownLine = sessionListUnknownLine(every.filter((c) => c.workspace === null).length, W);
+                        if (unknownLine !== "")
+                            console.log(unknownLine);
+                    }
                     for (const card of cards)
-                        console.log(sessionListRow(card, W, now, col));
+                        console.log(sessionListRow(card, W, now, col, all ? here : null));
                     console.log(sessionListFooter(cards.length, W));
                 }
                 else {
-                    for (const meta of agent.sessions()) {
+                    // 0.40.0: every folder's sessions, merged in id order — today's
+                    // bytes; --current is this project's folder (in a single pinned
+                    // folder, the sessions that recorded this workspace)
+                    const folders = listingFolders();
+                    const single = folders.length === 1 && folders[0].kind === "legacy";
+                    const workspaceOf = (id) => {
+                        const r = readProfile(sessionsDir(), id);
+                        return r.kind === "ok" ? r.profile.workspace : null;
+                    };
+                    const metas = folders
+                        .filter((f) => listScope !== "current" || single || f.dir === sessionsDir())
+                        .flatMap((f) => (f.dir === sessionsDir() ? agent.sessions() : new SessionStore(f.dir).list()))
+                        .sort((a, b) => a.id.localeCompare(b.id));
+                    for (const meta of metas) {
+                        if (listScope === "current" && single && workspaceOf(meta.id) !== here)
+                            continue;
                         console.log(renderSessionLine(meta));
                     }
                 }
@@ -1615,7 +2032,7 @@ async function main() {
                     "  kiso chat [sessionId]    same as above\n" +
                     "  kiso resume              pick a session to continue (TTY picker)\n" +
                     "  kiso resume <id> [prompt]   continue a session (one-shot)\n" +
-                    "  kiso sessions           list durable sessions\n" +
+                    "  kiso sessions [--all|--current]   list durable sessions (a terminal shows this workspace's by default)\n" +
                     "  kiso login <provider>    anthropic|openai|deepseek|zai: store an API key (hidden prompt, or stdin when piped);\n" +
                     "                           chatgpt: sign in with a ChatGPT subscription (browser; unofficial third-party flow)\n" +
                     "  kiso logout <provider>   remove the stored credential\n" +
@@ -1624,7 +2041,7 @@ async function main() {
                     "  kiso help               this help\n\n" +
                     "flags (any position):\n" +
                     "  --model <profile|provider/model>   pick the model (also /model in-session)\n" +
-                    "  --mode <tier>            approval tier: manual|default|accept-edits|plan|bypass\n" +
+                    "  --mode <tier>            approval tier: default|accept-edits|plan|dontAsk|bypass\n" +
                     "  --version                print the version\n\n" +
                     "configuration:\n" +
                     "  no key                   keyless faux demo (a scripted four-round session)\n" +
@@ -1654,7 +2071,7 @@ async function main() {
                 // lives inside the resolver. It used to pass the env-only
                 // reader, so a user's config.json autoCompact worked on
                 // `kiso chat` and silently vanished on the default entry.
-                await chatLoop(agent, id, input, resolveAutoCompact(mergedConfig));
+                await chatLoop(agent, id, input, retiredAutoCompact(mergedConfig));
                 break;
             }
         }