@vincemakes/kiso-code 0.45.2 → 0.46.0

package/README.md

@@ -32,7 +32,8 @@ kiso
 Named model profiles live in `~/.kiso/config.json` (the config stores
 the NAME of the env var holding each key, never the key itself); switch
 in-session with `/model`. Approval tiers: `--mode
-manual|default|accept-edits|plan|bypass` or `/mode` in-session.
+default|accept-edits|plan|full-access` or `/mode` in-session; `--dont-ask`
+(or `/dont-ask`) never stops for a person.
 
 ## The commands
 

package/dist/builtin.d.ts

@@ -6,10 +6,11 @@ import type { KisoExtension } from "@vincemakes/kiso-runtime";
  * that could only decline them. A LIVE gate, not a load-time one: the
  * registry reads an extension's tools on every request (registerLive) and
  * the run recomposes the tool table, snippet and guidelines included, so
- * entering dontAsk takes ask_user away from the next run and leaving it
- * brings ask_user back. In dontAsk the table is byte-identical to the pipe
- * path's; each switch in or out costs one prompt-cache break. The decline
- * path (trust-ui) stays for a turn already in flight when the mode changes.
+ * turning the switch on takes ask_user away from the next run and turning
+ * it off brings ask_user back — in every tier. With the switch on the
+ * table is byte-identical to the pipe path's; each flip costs one
+ * prompt-cache break. The decline path (trust-ui) stays for a turn already
+ * in flight when the switch flips.
  */
 export declare function offInDontAsk(ext: KisoExtension): KisoExtension;
 export declare function builtInLayer(user: readonly KisoExtension[], project: readonly KisoExtension[], 

package/dist/builtin.js

@@ -24,24 +24,26 @@ import createMcp from "@vincemakes/kiso-mcp-ext";
 import createSkills from "@vincemakes/kiso-skills-ext";
 import createSubagent from "@vincemakes/kiso-subagent-ext";
 import createAsk, {} from "@vincemakes/kiso-ask-ext";
-import { getMode } from "./mode.js";
+import { getDontAsk } from "./mode.js";
+import { tasksFor } from "./state.js";
 /**
  * 0.40.0 (the owner's dogfood): dontAsk never asks, so its tool table never
  * offers ask_user — a model once put four questions to a dontAsk session
  * that could only decline them. A LIVE gate, not a load-time one: the
  * registry reads an extension's tools on every request (registerLive) and
  * the run recomposes the tool table, snippet and guidelines included, so
- * entering dontAsk takes ask_user away from the next run and leaving it
- * brings ask_user back. In dontAsk the table is byte-identical to the pipe
- * path's; each switch in or out costs one prompt-cache break. The decline
- * path (trust-ui) stays for a turn already in flight when the mode changes.
+ * turning the switch on takes ask_user away from the next run and turning
+ * it off brings ask_user back — in every tier. With the switch on the
+ * table is byte-identical to the pipe path's; each flip costs one
+ * prompt-cache break. The decline path (trust-ui) stays for a turn already
+ * in flight when the switch flips.
  */
 export function offInDontAsk(ext) {
     const tools = ext.tools ?? [];
     return {
         ...ext,
         get tools() {
-            return getMode() === "dontAsk" ? [] : tools;
+            return getDontAsk() ? [] : tools;
         },
     };
 }
@@ -56,7 +58,10 @@ ask,
  *  constructed, so the names have to arrive here — after construction is
  *  too late. Only the config knows them; nothing else can. */
 secretEnvNames = []) {
-    const all = await Promise.all([createMcp({ secretEnvNames }), createSkills(), createSubagent(), ...(ask === undefined ? [] : [createAsk(ask).then(offInDontAsk)])]);
+    // ADR-0058 3d: the session's task manager makes `delegate` offer
+    // background children (explorer/reviewer; the cap and the turn budget
+    // are the extension's defaults)
+    const all = await Promise.all([createMcp({ secretEnvNames }), createSkills(), createSubagent({ tasks: tasksFor }), ...(ask === undefined ? [] : [createAsk(ask).then(offInDontAsk)])]);
     const shadowed = all.filter((b) => user.some((u) => u.name === b.name));
     for (const s of shadowed) {
         console.error(`[extensions] user extension "${s.name}" shadows the built-in — the built-in is not loaded`);

package/dist/chat.js

@@ -5,10 +5,11 @@
  * estimates. All bodies moved verbatim from index.ts.
  */
 import { readFileSync, statSync } from "node:fs";
-import { escapeTerminal, cacheHitPct, decodeRate, idleStatus, palette, renderEvent, renderRecap, runningStatus, toolTarget, STATUS_GLYPHS, kUnit, } from "@vincemakes/kiso-tui";
+import { escapeTerminal, cacheHitPct, decodeRate, idleStatus, palette, renderEvent, renderRecap, runningStatus, toolTarget, STATUS_GLYPHS, kUnit, namedPickView, } from "@vincemakes/kiso-tui";
 import { askView, coldResumeLine, coldResumeView, deletionRiskHint, editFileDiff, writeFileDiff } from "@vincemakes/kiso-tui";
 import { canonicalTargetPath, isProtectedPath, protectedIdentity, shellProgressPath } from "@vincemakes/kiso-tools-node";
-import { queuedSwitchLines } from "./state.js";
+import { liveTasks, mergedConfig, queuedSwitchLines, seenUnknownTasks, setExitTasks, tasksFor } from "./state.js";
+import { taskCounts, taskNoticeRow } from "./task-notice.js";
 import { echoText } from "@vincemakes/kiso-tui-cells/render";
 import { canonicalizeUsage, RunClosedError } from "@vincemakes/kiso-runtime";
 import { canonicalizeUsageForModel, requestBudget } from "@vincemakes/kiso-runtime/internal";
@@ -21,7 +22,7 @@ import { learnedWindowFor } from "./learned-windows.js";
 import { lookupContextWindow, lookupModelMetadata } from "@vincemakes/kiso-runtime/internal";
 import { addDontAskAgainRule, askPanel, fixHintFor, pendingAsk, resolveUncertains } from "./trust-ui.js";
 import { FauxExhaustionError, failOnFauxExhaustion } from "./faux-glue.js";
-import { OFFERED_MODES, getMode, setMode } from "./mode.js";
+import { MODE_LABEL, OFFERED_MODES, getDontAsk, getMode, modeDisplay, setMode } from "./mode.js";
 /** B area: default context window for the ~ctx estimate (config overridable).
  *  CW-1 batch 2: 128,000, down from 200,000 — the figure a model nobody
  *  states a window for is assumed to hold (the reference implementation's
@@ -950,6 +951,11 @@ onInputLanded) {
                     // the log. Since 0.44.0 (the verify offer retired) the CLI
                     // starts no such run itself; the branch keeps the rule for
                     // any run that carries one, as replay.ts does for old logs.
+                    // ADR-0058: a task notice is a row, never the person's chip
+                    if (ev.via?.kind === "tasks") {
+                        body.notice(taskNoticeRow(ev.via.items));
+                        break;
+                    }
                     if (ev.source === "system") {
                         // R2 (law 1.3): the ◆ said nothing the words did not. What
                         // makes this row honest is that it NAMES itself machinery.
@@ -959,7 +965,7 @@ onInputLanded) {
                     }
                     // 0.40.0: a skill turn's chip is the line the person TYPED — the
                     // SKILL.md body is what the model read, not what they said.
-                    if (ev.via !== undefined) {
+                    if (ev.via?.kind === "skill") {
                         body.userLine(ev.via.line);
                         break;
                     }
@@ -1072,7 +1078,7 @@ onInputLanded) {
                     // denied HERE, at the one place kiso asks, so every allow the
                     // chain gave still stands (a tier deny would outrank them). The
                     // reason is the tool result: the model sees why and goes on.
-                    if (getMode() === "dontAsk") {
+                    if (getDontAsk()) {
                         body.notice(`[dontAsk] ${escapeTerminal(name)} would ask — denied`);
                         await session.approve(decisionId, false, `dontAsk: ${name} needs a human's approval, and this session never asks — denied`);
                         break;
@@ -1267,9 +1273,39 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
     const exitAtEmptyPrompt = () => {
         if (pendingAsk !== null || input.line() !== "")
             return;
-        cancelled = true;
-        console.log("\n[exit requested]");
-        input.close();
+        void confirmExit().then((leave) => {
+            if (!leave) {
+                eotSeen = false; // stayed: a later run's end must not ask again
+                input.prompt();
+                return;
+            }
+            cancelled = true;
+            console.log("\n[exit requested]");
+            input.close();
+        });
+    };
+    /** ADR-0058 (3e): a clean exit with live tasks asks first — on a dock
+     *  only; a pipe or a task-file run stops them all, as before. The
+     *  question says beforehand what each answer does. True: exit. */
+    const confirmExit = async () => {
+        const live = liveTasks();
+        const total = live.durable + live.moved;
+        if (total === 0 || !dock.active)
+            return true;
+        const n = (k, what) => `${k} ${what}${k === 1 ? "" : "s"}`;
+        const options = [{ label: "stop all and exit" }];
+        if (live.durable > 0)
+            options.push({ label: live.moved > 0 ? `leave ${n(live.durable, "background task")} running; ${n(live.moved, "moved command")} will stop` : `leave ${n(live.durable, "background task")} running` });
+        options.push({ label: "stay" });
+        const picked = await new Promise((resolve) => {
+            input.panelAsk(namedPickView("exit", { header: `${n(total, "task")} ${total === 1 ? "is" : "are"} running`, options }, `▸ ${modeDisplay()}`, "stop the running tasks and exit? "), (v) => resolve(v.action === "picked" ? v.result : null));
+        });
+        paintIdle();
+        const label = picked !== null && "index" in picked ? options[picked.index]?.label : undefined;
+        if (label === undefined || label === "stay")
+            return false;
+        setExitTasks(label.startsWith("leave") ? "leave" : "stop");
+        return true;
     };
     const turn = (text, via) => new Promise((resolve, reject) => {
         queued = Math.max(0, queued - 1); // a queued turn starts
@@ -1284,7 +1320,8 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
         // SKILL.md body, and a body that mentions `diagram.png` must not
         // attach a file from the workspace the person never pointed at.
         const content = via !== undefined ? text : attachImages(text, input.attachments?.(), protectedFiles());
-        const run = via !== undefined ? session.run(content, { via }) : session.run(content);
+        // ADR-0058: a task notice is the runtime's input — source "system"
+        const run = via !== undefined ? session.run(content, { via, ...(via.kind === "tasks" ? { source: "system" } : {}) }) : session.run(content);
         currentRun = run;
         turnNo += 1;
         const myTurn = turnNo;
@@ -1362,9 +1399,15 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
             pendingAsk?.(); // a startup/trust question — cancel it
         }
         else if (input.line() === "") {
-            cancelled = true;
-            console.log("\n[exit requested]");
-            input.close();
+            void confirmExit().then((leave) => {
+                if (!leave) {
+                    input.prompt();
+                    return;
+                }
+                cancelled = true;
+                console.log("\n[exit requested]");
+                input.close();
+            });
         }
         else {
             input.clearLine(); // v2c: Ctrl+C on a non-empty line clears it
@@ -1483,6 +1526,29 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
     // nullish, so the guard is `> 0` rather than `??` (the same shape the
     // compositor's own width call uses).
     const rowWidth = () => (process.stdout.columns > 0 ? process.stdout.columns : 80);
+    // ADR-0058 (3e): the session's tasks on the rows. Each read walks the
+    // journals, so the running row (repainted many times a second) reads at
+    // most once a second; the idle row (repainted rarely) always reads —
+    // a task promoted or moved to the background makes no transition to
+    // hear, and the row the turn ends on must already count it
+    let taskRow = null;
+    const taskCountsNow = (fresh = false) => {
+        const manager = tasksFor(session.id);
+        if (manager === undefined)
+            return undefined;
+        if (fresh || taskRow === null || Date.now() - taskRow.at > 1_000 || taskRow.seen !== seenUnknownTasks.size) {
+            let list = [];
+            try {
+                list = manager.list();
+            }
+            catch {
+                // a corrupt journal is reported where it is read on purpose
+            }
+            taskRow = { at: Date.now(), seen: seenUnknownTasks.size, counts: taskCounts(list, seenUnknownTasks) };
+        }
+        return taskRow.counts;
+    };
+    const detachableNow = () => (tasksFor(session.id)?.detachable().length ?? 0) > 0;
     // KC2 §5: the STATE (the glyph, the run's start, the usage, the dock)
     // stays here; the ROW's text is the tui's status formatter.
     const paintRunning = () => {
@@ -1491,7 +1557,7 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
         // composed blind it would be cut from the END — the context figure,
         // a fact, going before the gesture hints.
         if (dock.active)
-            dock.setStatus(runningStatus(runGlyph, runStart, runUsage.out, displayCtxRatio(session), lastTokPerSec, rowWidth(), retryOnRow()));
+            dock.setStatus(runningStatus(runGlyph, runStart, runUsage.out, displayCtxRatio(session), lastTokPerSec, rowWidth(), retryOnRow(), taskCountsNow(), detachableNow()));
     };
     // W19: under plan the idle row makes the posture unmistakable — the W4
     // parentheses idiom names the read-only constraint. The tier is the
@@ -1502,7 +1568,7 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
         // TUI2-R1 (E): the meter rides the idle row — both fields omitted
         // when unknown, so a session that has not called the model paints
         // exactly the pre-round row.
-        dock.setStatus(idleStatus(getMode() === "plan" ? "plan (read-only)" : getMode(), statusModelLabel(session), displayCtxRatio(session), {
+        dock.setStatus(idleStatus(modeDisplay(), statusModelLabel(session), displayCtxRatio(session), {
             cacheHitPct: cacheHitPct(runUsage),
             costUsd: spentUsd,
             tokPerSec: lastTokPerSec,
@@ -1510,7 +1576,7 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
         // DF-0330-F1: the row's budget. Without it the row is composed
         // blind and invariant ① cuts whatever sits last — which is how
         // a measured rate went missing at 100 columns.
-        rowWidth(), !floorOn));
+        rowWidth(), !floorOn, taskCountsNow(true)));
     };
     // TUI2-R2 ⑥ — the BOOT status line. The row is the product's one
     // persistent claim about itself (the tier, how to change it, the model,
@@ -1555,7 +1621,7 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
         spentUsd = (spentUsd ?? 0) + usd;
     };
     const queueTurn = (line, via) => {
-        const slot = { line: via?.line ?? line, content: line, ...(via !== undefined ? { via } : {}), cancelled: false };
+        const slot = { line: via?.kind === "skill" ? via.line : via?.kind === "tasks" ? taskNoticeRow(via.items) : line, content: line, ...(via !== undefined ? { via } : {}), cancelled: false };
         pendingTurns.push(slot);
         queued += 1;
         chainRef.current = chainRef.current.then(async () => {
@@ -1619,13 +1685,41 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
                 return false; // the run is ending: this is the next turn
             throw err;
         }
-        steering.push({ line: via?.line ?? line, content: line, ...(via !== undefined ? { via } : {}) });
+        steering.push({ line: (via?.kind === "skill" ? via.line : undefined) ?? line, content: line, ...(via !== undefined ? { via } : {}) });
         return true;
     };
     const submitTurn = (line, via) => {
         if (!steer(line, via))
             queueTurn(line, via);
     };
+    // ADR-0058 (3c): the session's task transitions reach the model — into a
+    // live run at its next safe point, or, idle, as one wake turn through
+    // the same chain a person's turn takes (taskWake: false keeps it for
+    // the next message). Released when this chat ends.
+    const taskManager = tasksFor(session.id);
+    // KISO_AUTO_DETACH_MS — the test rigs' knob (like KISO_STREAM_IDLE_MS):
+    // how old a command must be before a steer detaches it (3e D1). The
+    // rigs that hold a steer pending behind a long command raise it.
+    const autoDetachFromEnv = Number.parseInt(process.env.KISO_AUTO_DETACH_MS ?? "", 10);
+    const stopDelivery = taskManager === undefined
+        ? () => { }
+        : session.useTasks(taskManager, {
+            wake: mergedConfig.taskWake !== false,
+            onWake: (w) => queueTurn(w.content, w.via),
+            ...(Number.isFinite(autoDetachFromEnv) && autoDetachFromEnv >= 0 ? { autoDetachMinAgeMs: autoDetachFromEnv } : {}),
+        });
+    // 3e: a task's change repaints the row it is counted on
+    const stopHearing = taskManager?.subscribe(() => {
+        taskRow = null;
+        if (currentRun !== null)
+            paintRunning();
+        else
+            paintIdle();
+    }) ?? (() => { });
+    const stopTasks = () => {
+        stopHearing();
+        stopDelivery();
+    };
     /** The mirror of the last `n` steers the run handed back; clears it. */
     const handed = (n) => {
         const out = n > 0 ? steering.slice(-n) : [];
@@ -1677,6 +1771,7 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
         session,
         input,
         chainRef,
+        confirmExit,
         isRunning: () => currentRun !== null,
         paintIdle,
         modelSwitched,
@@ -1741,6 +1836,8 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
     // "expand" turn is never intercepted).
     input.onExpand(() => dispatch("\x12expand", dispatchCtx));
     input.onThink?.(() => dispatch("\x14think", dispatchCtx));
+    // ADR-0058 (3e): ctrl+b — the running command to the background, now
+    input.onBackground?.(() => dispatch("\x02background", dispatchCtx));
     input.onEditor?.(() => dispatch("\x07editor", dispatchCtx));
     // E1 §3 — ctrl+x and `/copy` are the same action reached two ways, so
     // they are the same sentinel: one implementation, one behaviour.
@@ -1751,9 +1848,13 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
     // row repaints at once with a one-line notice.
     input.onModeCycle?.(() => {
         const next = OFFERED_MODES[(OFFERED_MODES.indexOf(getMode()) + 1) % OFFERED_MODES.length];
+        const wasOn = getDontAsk();
         setMode(next);
         paintIdle();
-        body.notice(`mode → ${next} (shift+tab cycles)`);
+        body.notice(`mode → ${MODE_LABEL[next]} (shift+tab cycles)`);
+        // the switch came with the old dontAsk tier, and left with it
+        if (getDontAsk() !== wasOn)
+            body.notice("don't ask → off");
     });
     // Recovery first: a session with a dangling pause or uncertain
     // executions must resolve them BEFORE the REPL accepts new turns —
@@ -1775,7 +1876,7 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
     // before the run resumes: the run continues on the compacted projection.
     const cold = !cancelled && process.stdin.isTTY ? coldResumeOffer(session) : null;
     if (cold !== null) {
-        if (getMode() === "dontAsk") {
+        if (getDontAsk()) {
             body.notice(`[dontAsk] ${coldResumeLine(cold.tokens, cold.minutes)} — compacting first`);
             dispatch("/compact", dispatchCtx);
         }
@@ -1835,6 +1936,7 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
     // runs before the exit or the chain is already settled. One level is
     // enough: the /compact segment appends nothing of its own.
     await chainRef.current;
+    stopTasks();
     if (switchTo !== null)
         return { next: "switch", id: switchTo, lines: queuedLines.slice() };
     // a switch beats a reload: /resume and /clear are going somewhere else,

package/dist/child-result.d.ts

@@ -0,0 +1,23 @@
+/**
+ * ADR-0058 3d — how a background child ends: `kiso chat <id> --task-file
+ * <f> --max-turns N --result-file <r>`.
+ *
+ * The budget (D6) is the session's `maxTurns`: the kernel stops the run at
+ * a model boundary, after the round's tool results, before the next
+ * request — nothing is killed. Such a run usually ends on a tool round with
+ * no answer, so the child gets ONE wrap-up request: a system input naming
+ * the spent budget, in a run limited to that one request. The outcome is
+ * then `incomplete`, never a plain failure.
+ *
+ * The answer is the child's own — the last assistant text in its session's
+ * projection, never its printed output — written atomically to `<r>`
+ * (result.md) with `{ outcome, requests, budget }` beside it (result.json),
+ * before the process exits: the runner records the exit after both exist.
+ */
+import type { AgentSession } from "@vincemakes/kiso-runtime";
+export interface ChildEnd {
+    readonly maxTurns?: number;
+    readonly resultFile?: string;
+}
+export declare const wrapUpInput: (budget: number) => string;
+export declare function finishChild(session: AgentSession, end: ChildEnd): Promise<void>;

package/dist/child-result.js

@@ -0,0 +1,59 @@
+/**
+ * ADR-0058 3d — how a background child ends: `kiso chat <id> --task-file
+ * <f> --max-turns N --result-file <r>`.
+ *
+ * The budget (D6) is the session's `maxTurns`: the kernel stops the run at
+ * a model boundary, after the round's tool results, before the next
+ * request — nothing is killed. Such a run usually ends on a tool round with
+ * no answer, so the child gets ONE wrap-up request: a system input naming
+ * the spent budget, in a run limited to that one request. The outcome is
+ * then `incomplete`, never a plain failure.
+ *
+ * The answer is the child's own — the last assistant text in its session's
+ * projection, never its printed output — written atomically to `<r>`
+ * (result.md) with `{ outcome, requests, budget }` beside it (result.json),
+ * before the process exits: the runner records the exit after both exist.
+ */
+import { renameSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+export const wrapUpInput = (budget) => `Your turn budget of ${budget} model requests is spent. Answer now from what you have found, without further tool calls. End with the UNRESOLVED section, naming what you did not get to.`;
+export async function finishChild(session, end) {
+    const lastOutcome = () => {
+        const t = [...session.log.all].reverse().find((e) => e.type === "terminal");
+        return t === undefined ? undefined : t.outcome.kind;
+    };
+    let outcome = lastOutcome() === "completed" ? "completed" : "failed";
+    if (end.maxTurns !== undefined && lastOutcome() === "max_turns") {
+        for await (const _ of session.run(wrapUpInput(end.maxTurns), { source: "system", maxTurns: 1 })) {
+            // drained: the wrap-up's events are durable in the session
+        }
+        outcome = "incomplete";
+    }
+    if (end.resultFile === undefined)
+        return;
+    const answer = lastAnswer(session);
+    const requests = session.log.all.filter((e) => e.type === "stop").length;
+    writeAtomic(end.resultFile, answer === "" ? "" : `${answer}\n`);
+    writeAtomic(join(dirname(end.resultFile), "result.json"), `${JSON.stringify({ outcome, requests, ...(end.maxTurns !== undefined ? { budget: end.maxTurns } : {}) })}\n`);
+    // the runner's terminal is the exit: a failed child must not read as a clean one
+    if (outcome === "failed")
+        process.exitCode = 1;
+}
+/** The last assistant message's text in the session's projection. */
+function lastAnswer(session) {
+    const messages = session.projected();
+    for (let i = messages.length - 1; i >= 0; i--) {
+        const m = messages[i];
+        if (m.role !== "assistant")
+            continue;
+        const text = m.blocks.flatMap((b) => (b.type === "text" ? [b.text] : [])).join("");
+        if (text.trim() !== "")
+            return text.trimEnd();
+    }
+    return "";
+}
+function writeAtomic(path, content) {
+    const tmp = `${path}.tmp`;
+    writeFileSync(tmp, content, "utf8");
+    renameSync(tmp, path);
+}

package/dist/config.d.ts

@@ -13,7 +13,10 @@
  *   models?: { [name]: { kind: "openai-compat"|"anthropic"|"openai-responses",
  *                        baseUrl?: string, model: string, apiKeyEnv: string,
  *                        upstream?: string } }   — upstream: never where requests go
- *   mode?: "manual"|"default"|"accept-edits"|"plan"|"bypass"|"dontAsk"
+ *   mode?: "default"|"accept-edits"|"plan"|"full-access" — and every older
+ *                    spelling: "manual", "bypass" (full-access's old name),
+ *                    "dontAsk" (default with the don't-ask switch on)
+ *   dontAsk?: boolean           — the don't-ask switch (mode.ts)
  *   contextWindow?: number      — tokens
  *   autoCompact?: { thresholdRatio: number }   — 0<r<1; default off
  *   projectTrust?: "ask" | "never"             — no "always" (the ruling)
@@ -28,7 +31,6 @@
  * with an invalid value is likewise loud; unknown top-level keys are
  * ignored (forward compatibility).
  */
-import type { Mode } from "./mode.js";
 /** OR-1: `openai-responses` is a DIALECT, not a vendor — the same kind
  *  drives the first-party Responses API and the ChatGPT subscription
  *  backend, and which one it is follows the profile's baseUrl (and so
@@ -92,9 +94,17 @@ export interface AutoCompactConfig {
 export interface KisoConfig {
     readonly model?: string;
     readonly models?: Readonly<Record<string, ModelProfile>>;
-    readonly mode?: Mode;
+    /** As written — an old name stays an old name here, and mode.ts
+     *  resolves it (resolveModeLayers), so /settings can say which. */
+    readonly mode?: string;
+    /** The don't-ask switch. Either config may set it: it only ever
+     *  refuses more, so a project turning it on lowers nothing. */
+    readonly dontAsk?: boolean;
     readonly contextWindow?: number;
     readonly autoCompact?: AutoCompactConfig;
+    /** ADR-0058 §8.4: false turns every task wake into a notice that waits
+     *  for your next message. Default on. */
+    readonly taskWake?: boolean;
     readonly projectTrust?: "ask" | "never";
     /** DC-3 §3 rung 1, persisted. The terminal's light/dark, for terminals
      *  that answer neither `CSI ? 996 n` nor OSC 11. USER-LEVEL ONLY: a
@@ -194,9 +204,6 @@ export declare function directWriteProfile(value: string): ModelProfile | null;
  * Returns null when nothing resolves (faux mode).
  */
 export declare function resolveModel(modelFlag: string | undefined, merged: KisoConfig): ResolvedModel | null;
-/** Mode: env (KISO_MODE) beats config.mode; the --mode flag is applied by
- *  main before this runs (flags are the top of the chain). */
-export declare function resolveModeFromConfig(merged: KisoConfig): Mode | undefined;
 /** Context window: env (KISO_CONTEXT_WINDOW) > config.contextWindow >
  *  default (200k — the caller's default). */
 export declare function resolveContextWindow(merged: KisoConfig, profile?: ModelProfile): number | undefined;

package/dist/config.js

@@ -13,7 +13,10 @@
  *   models?: { [name]: { kind: "openai-compat"|"anthropic"|"openai-responses",
  *                        baseUrl?: string, model: string, apiKeyEnv: string,
  *                        upstream?: string } }   — upstream: never where requests go
- *   mode?: "manual"|"default"|"accept-edits"|"plan"|"bypass"|"dontAsk"
+ *   mode?: "default"|"accept-edits"|"plan"|"full-access" — and every older
+ *                    spelling: "manual", "bypass" (full-access's old name),
+ *                    "dontAsk" (default with the don't-ask switch on)
+ *   dontAsk?: boolean           — the don't-ask switch (mode.ts)
  *   contextWindow?: number      — tokens
  *   autoCompact?: { thresholdRatio: number }   — 0<r<1; default off
  *   projectTrust?: "ask" | "never"             — no "always" (the ruling)
@@ -30,8 +33,9 @@
  */
 import { readFileSync, statSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { join, win32 } from "node:path";
 import { kisoHome } from "./state.js";
+import { MODE_VALUES, parseMode } from "./mode.js";
 import { AuthError, effectiveBaseUrl, endpointCredentialId, getCredential, providerIdOf } from "./auth/credentials.js";
 import { BUILTIN_MANIFESTS } from "@vincemakes/kiso-runtime/internal";
 /** Header names a profile may not set: credentials (a key never lives in the
@@ -56,7 +60,6 @@ function parseHeaders(field, raw, fail) {
     return out;
 }
 const KINDS = ["openai-compat", "anthropic", "openai-responses"];
-const MODES_LIST = ["manual", "default", "accept-edits", "plan", "bypass", "dontAsk"];
 export class ConfigError extends Error {
 }
 /** Parse + validate one config file. Broken JSON / invalid known values →
@@ -96,6 +99,11 @@ export function parseConfig(text, source) {
             fail("floor", "belongs in the USER config — a project must never be able to lower the floor");
         out.floor = obj.floor;
     }
+    // Windows P3: absolute for the host — on Windows a drive path with
+    // either separator (or a UNC share), never a drive-rooted `\x`, which
+    // would mean a different file on every drive
+    const windows = process.platform === "win32";
+    const absolute = (p) => (windows ? win32.isAbsolute(p) && !/^[\\/](?![\\/])/.test(p) : p.startsWith("/"));
     if (obj.protectedPaths !== undefined) {
         if (source.startsWith("<cwd>"))
             fail("protectedPaths", "belongs in the USER config — a project must never be able to change what kiso guards");
@@ -104,7 +112,7 @@ export function parseConfig(text, source) {
         for (const [i, p] of obj.protectedPaths.entries()) {
             // a relative path would be read against whatever directory kiso
             // runs in — a different file in every project
-            if (typeof p !== "string" || !(p.startsWith("/") || p.startsWith("~/")))
+            if (typeof p !== "string" || !(absolute(p) || p.startsWith("~/")))
                 fail(`protectedPaths[${i}]`, "expected an absolute path or one starting with ~/");
             // kiso protects FILES. A directory listed here would protect
             // nothing under it — a security setting that silently does
@@ -113,7 +121,7 @@ export function parseConfig(text, source) {
             // caught at the next start or /reload.)
             const path = p;
             const full = path.startsWith("~/") ? join(homedir(), path.slice(2)) : path;
-            if (path.endsWith("/") || statSync(full, { throwIfNoEntry: false })?.isDirectory() === true) {
+            if (path.endsWith("/") || (windows && path.endsWith("\\")) || statSync(full, { throwIfNoEntry: false })?.isDirectory() === true) {
                 fail(`protectedPaths[${i}]`, `${path} is a directory — kiso protects files, so list the files in it (for ~/.aws: "~/.aws/credentials", "~/.aws/config")`);
             }
         }
@@ -134,7 +142,7 @@ export function parseConfig(text, source) {
         if (!Array.isArray(obj.evaluators))
             fail("evaluators", "expected a list of absolute paths to evaluator scripts");
         for (const path of obj.evaluators) {
-            if (typeof path !== "string" || !path.startsWith("/"))
+            if (typeof path !== "string" || !absolute(path))
                 fail("evaluators", `expected an absolute path, got ${JSON.stringify(path)}`);
         }
         out.evaluators = obj.evaluators;
@@ -195,10 +203,15 @@ export function parseConfig(text, source) {
         out.models = models;
     }
     if (obj.mode !== undefined) {
-        if (typeof obj.mode !== "string" || !MODES_LIST.includes(obj.mode))
-            fail("mode", `expected one of ${MODES_LIST.join(", ")}`);
+        if (typeof obj.mode !== "string" || parseMode(obj.mode) === undefined)
+            fail("mode", `expected one of ${MODE_VALUES.join(", ")}`);
         out.mode = obj.mode;
     }
+    if (obj.dontAsk !== undefined) {
+        if (typeof obj.dontAsk !== "boolean")
+            fail("dontAsk", "expected true or false");
+        out.dontAsk = obj.dontAsk;
+    }
     if (obj.contextWindow !== undefined) {
         if (typeof obj.contextWindow !== "number" || !Number.isFinite(obj.contextWindow) || obj.contextWindow <= 0) {
             fail("contextWindow", "expected a positive token count");
@@ -213,6 +226,11 @@ export function parseConfig(text, source) {
             fail("autoCompact.thresholdRatio", "expected a number strictly between 0 and 1");
         out.autoCompact = { thresholdRatio: r };
     }
+    if (obj.taskWake !== undefined) {
+        if (typeof obj.taskWake !== "boolean")
+            fail("taskWake", "expected true or false");
+        out.taskWake = obj.taskWake;
+    }
     if (obj.projectTrust !== undefined) {
         if (obj.projectTrust !== "ask" && obj.projectTrust !== "never")
             fail("projectTrust", 'expected "ask" or "never" (there is deliberately no "always")');
@@ -254,10 +272,14 @@ export function mergeConfigs(user, project) {
         ...(p.models !== undefined ? { models: { ...u.models, ...p.models } } : u.models !== undefined ? { models: u.models } : {}),
         ...(u.mode !== undefined ? { mode: u.mode } : {}),
         ...(p.mode !== undefined ? { mode: p.mode } : {}),
+        ...(u.dontAsk !== undefined ? { dontAsk: u.dontAsk } : {}),
+        ...(p.dontAsk !== undefined ? { dontAsk: p.dontAsk } : {}),
         ...(u.contextWindow !== undefined ? { contextWindow: u.contextWindow } : {}),
         ...(p.contextWindow !== undefined ? { contextWindow: p.contextWindow } : {}),
         ...(u.autoCompact !== undefined ? { autoCompact: u.autoCompact } : {}),
         ...(p.autoCompact !== undefined ? { autoCompact: p.autoCompact } : {}),
+        ...(u.taskWake !== undefined ? { taskWake: u.taskWake } : {}),
+        ...(p.taskWake !== undefined ? { taskWake: p.taskWake } : {}),
         ...(u.projectTrust !== undefined ? { projectTrust: u.projectTrust } : {}),
         ...(p.projectTrust !== undefined ? { projectTrust: p.projectTrust } : {}),
         // DT-1a: checks merge per name — a (trusted) project's check wins over the user's
@@ -474,14 +496,6 @@ function resolveProfile(name, p) {
     const auth = authForProfile(name, p);
     return auth.type === "oauth" ? { name, profile: p, oauthProviderId: auth.providerId } : { name, profile: p, apiKey: auth.apiKey };
 }
-/** Mode: env (KISO_MODE) beats config.mode; the --mode flag is applied by
- *  main before this runs (flags are the top of the chain). */
-export function resolveModeFromConfig(merged) {
-    const fromEnv = process.env.KISO_MODE;
-    if (fromEnv !== undefined)
-        return fromEnv;
-    return merged.mode;
-}
 /** Context window: env (KISO_CONTEXT_WINDOW) > config.contextWindow >
  *  default (200k — the caller's default). */
 export function resolveContextWindow(merged, profile) {

package/dist/create-coding-agent.js

@@ -7,7 +7,7 @@
  * Moved verbatim from index.ts's makeAgent (R1, 2026-09-23) and renamed;
  * the body is not edited beyond the rename and activeStoreDir's setter.
  */
-import { activeStoreDir, setActiveStoreDir, body, bodyLog, codingToolOptions, extensionsDir, floorOn, kisoHome, loadedExtensions, ownSessionsDir, projectRoot, protectedFiles, secretEnvNamesOf, sessionsDir, setAgentModel, setConfigModels, setConfiguredWindow, setCurrentAgentExtensions, setCurrentFaux, setCurrentModelName, setCurrentProfileName, setExtensionLists, setFloorOn, setMergedConfig, setModelChoice, setNeverInherited, setRetryShown, setSessionStore, setUserProtectedPaths, settingsLayers, workspaceRoot } from "./state.js";
+import { activeStoreDir, childTurnBudget, setActiveStoreDir, body, bodyLog, codingToolOptions, extensionsDir, floorOn, kisoHome, loadedExtensions, ownSessionsDir, projectRoot, protectedFiles, secretEnvNamesOf, sessionsDir, setAgentModel, setConfigModels, setConfiguredWindow, setCurrentAgentExtensions, setCurrentFaux, setCurrentModelName, setCurrentProfileName, setExtensionLists, setFloorOn, setMergedConfig, setModelChoice, setNeverInherited, setRetryShown, setSessionStore, setUserProtectedPaths, settingsLayers, workspaceRoot } from "./state.js";
 import { claimProjectDir, projectLayoutActive } from "./projects.js";
 import { migrationNotice, pendingLegacyIds, planMigration, runMigration } from "./session-migration.js";
 import { askUi, resolveProjectTrust } from "./trust-ui.js";
@@ -314,6 +314,8 @@ export async function createCodingAgent(sessionId, input, modelFlag) {
         // Modes: the five tiers join at the CHAIN HEAD, before the user/
         // project extensions (the deny>allow>ask composition keeps a user
         // deny winning over any mode tier — bypass included).
+        // ADR-0058 3d (D6): a background child's budget, its only bound.
+        ...(childTurnBudget !== undefined ? { maxTurns: childTurnBudget } : {}),
         extensions,
         ...(resolved !== null
             ? {

package/dist/dispatch.d.ts

@@ -39,6 +39,8 @@ export interface DispatchCtx {
     readonly requestSwitch: (id: string) => void;
     /** DC-57: true once this entry has been asked to leave — the guard that keeps a departing session from answering a batch's later lines. */
     readonly leaving: () => boolean;
+    /** ADR-0058 (3e): with live tasks, ask before exiting; true = exit. */
+    readonly confirmExit: () => Promise<boolean>;
     /** §2.5: end this chat() with a REBUILD of the agent on the SAME
      *  session — extensions, skills and config are read again. */
     readonly requestReload: () => void;