@vincemakes/kiso-code 0.45.2 → 0.46.0

package/dist/index.js

@@ -37,14 +37,16 @@ import { skillMenuItems } from "./skill-invoke.js";
 import { canonicalPath, hasSession, locateSession, projectLayoutActive, sessionFolders } from "./projects.js";
 import { reverseMigration } from "./session-migration.js";
 import { defaultTrashRoot, findEmptySessions, moveToTrash } from "./empty-sessions.js";
+import { browserCommand, launchCommand } from "./launch.js";
 import { createFauxProvider } from "@vincemakes/kiso-evals";
 import { isProtectedPath, protectedIdentity, PROTECTED_REFUSAL } from "@vincemakes/kiso-tools-node";
-import { MODES, OFFERED_MODES, getMode, modeFromEnv, setMode } from "./mode.js";
+import { OFFERED_MODES, applyModeState, envModeLayer, getDontAsk, modeDisplay, parseMode, resolveModeLayers } from "./mode.js";
 import { activeStoreDir, setActiveStoreDir, agentModel, atFiles, body, bodyLog, kisoHome, workspaceRoot, projectRoot, ownSessionsDir, setOpenSessionFolder, builtInExtensions, currentFaux, dock, loadedExtensions, mergedConfig, mergedTempPaths, modelChoice, projectExtensions, configModels, configuredWindow, agentBaseUrl, currentModelName, currentAgentExtensions, sessionStoreRef, sessionsDir, setAgentModel, setBody, setConfigModels, setConfiguredWindow, setCurrentAgentExtensions, setCurrentFaux, setCurrentModelName, setCurrentProfileName, setExtensionLists, protectedFiles, setMergedConfig, setModelChoice, setSessionStore, userExtensions, VERSION, lastBinding, acceptDrift, setAcceptDrift, loadedSkillsCatalog, queuedSwitchLines } from "./state.js";
 import { fauxSkip, readFauxScript } from "./faux-glue.js";
 import { chat, contextWindowTokens, displayCtxRatio, microcompactThresholdFor, statusModelLabel } from "./chat.js";
 import { preferences, usePreferences } from "./preferences.js";
-import { settingsLayers } from "./state.js";
+import { settingsLayers, setChildTurnBudget, stopAllTasks } from "./state.js";
+import { finishChild } from "./child-result.js";
 import { loadUserConfig, resolveAutoCompact } from "./config.js";
 import { checkForUpdate, knownUpdate, updateCardLines } from "./update-check.js";
 import { tmuxMouseHint } from "./tmux-hint.js";
@@ -74,14 +76,14 @@ export { applyProjectMerges } from "./trust-ui.js";
  *  path's exact semantics (auto-denied asks, no chips, no pops). */
 /** OR-4: hand a URL to the platform's opener, detached, and never let a
  *  missing or failing opener touch the sign-in — the printed URL is the
- *  path that always works. macOS `open`, Linux `xdg-open`; elsewhere the
- *  URL stays printed (Windows is unsupported by the CLI as a whole). */
+ *  path that always works. macOS `open`, Linux `xdg-open`, Windows
+ *  rundll32's URL handler (launch.ts); elsewhere the URL stays printed. */
 function openInBrowser(url) {
-    const opener = process.platform === "darwin" ? "open" : process.platform === "linux" ? "xdg-open" : null;
+    const opener = browserCommand(url);
     if (opener === null)
         return;
     try {
-        spawn(opener, [url], { detached: true, stdio: "ignore" }).unref();
+        spawn(opener[0], [...opener[1]], { detached: true, stdio: "ignore" }).unref();
     }
     catch {
         // the URL is on screen; opening it is the person's fallback
@@ -180,6 +182,9 @@ function readlineInput(rl) {
             /* §2.3: same as ctrl+o above — readline has no binding, and a
              * dock-less session has no committed rows to reprint. */
         },
+        onBackground() {
+            /* 3e: readline has no ctrl+b — /tasks and a steer still work. */
+        },
         onEditor() {
             /* §2.4: readline has no ctrl+g, and a piped session has no
              * composer to hand over. */
@@ -274,6 +279,9 @@ function editorInput(editor) {
         onThink(cb) {
             editor.onThink(cb);
         },
+        onBackground(cb) {
+            editor.onBackground(cb);
+        },
         onEditor(cb) {
             editor.onEditor(cb);
         },
@@ -488,10 +496,10 @@ function bannerExtensionText() {
     // terminal layer (extensionsBannerText — a pure function of the three
     // name lists, including the "(connecting…)" in-flight label). Which
     // lists exist is the CLI's fact and stays here.
-    // 0.40.0: in dontAsk the ask extension is loaded but offers no tool
-    // (builtin.ts offInDontAsk) — the banner says so beside the tier that
-    // turns it off, rather than listing it as if it could ask.
-    const builtIn = builtInExtensions.map((e) => (e.name === "ask" && getMode() === "dontAsk" ? { name: e.name, note: "off in dontAsk" } : e));
+    // 0.40.0: with the don't-ask switch on the ask extension is loaded but
+    // offers no tool (builtin.ts offInDontAsk) — the banner says so, rather
+    // than listing it as if it could ask.
+    const builtIn = builtInExtensions.map((e) => (e.name === "ask" && getDontAsk() ? { name: e.name, note: "off in dontAsk" } : e));
     return extensionsBannerText(builtIn, userExtensions, projectExtensions);
 }
 /** E1: the startup banner line(s) — TTY: logo + merged extensions + the
@@ -569,7 +577,7 @@ function extensionsBanner(resume = []) {
     };
     body.banner(VERSION, text.replace(/^ · /, ""), resume, {
         model: agentModel,
-        mode: getMode() === "plan" ? "plan (read-only)" : getMode(),
+        mode: modeDisplay(),
         cwd: cwd.startsWith(home) ? `~${cwd.slice(home.length)}` : cwd,
         // DC-49 — REALPATH on both sides. A symlinked HOME (or a symlinked
         // cwd) compares unequal as raw strings while being the same
@@ -808,7 +816,7 @@ function paintBootStatus(session) {
         return;
     // DF-0330-F1: the BOOT row gets the budget too — it is the same row, and
     // the opening screen is where a long model id is first seen.
-    dock.setStatus(idleStatus(getMode() === "plan" ? "plan (read-only)" : getMode(), statusModelLabel(session), displayCtxRatio(session), undefined, process.stdout.columns > 0 ? process.stdout.columns : 80));
+    dock.setStatus(idleStatus(modeDisplay(), statusModelLabel(session), displayCtxRatio(session), undefined, process.stdout.columns > 0 ? process.stdout.columns : 80));
 }
 /** PH-1a (finding PH-F12): a usage error raised from inside the TUI —
  *  main's finally still runs (dock teardown, agent close, temp cleanup)
@@ -816,6 +824,9 @@ function paintBootStatus(session) {
 class CliUsageError extends Error {
     exitCode = 2;
 }
+/** ADR-0058 3d: set when this process is a background child (its budget
+ *  and where its answer goes) — finished once its turn is done. */
+let childEnd = null;
 /** The /resume+/clear mini-spec — the chat LOOP: chat() ends with a
  *  directive; a switch re-enters it on another session with the SAME
  *  editor. First entry paints the banner; a switch paints one notice
@@ -1103,8 +1114,11 @@ async function chatLoop(first, firstId, input, autoCompact) {
             ...(process.stdin.isTTY ? { pick: () => pickSession(agent, input) } : {}),
         };
         const end = await chat(session, currentFaux, input, autoCompact, nav, seed);
-        if (end.next === "exit")
+        if (end.next === "exit") {
+            if (childEnd !== null)
+                await finishChild(session, childEnd);
             return;
+        }
         // DC-57: the lines that arrived with the switch command ride INTO the
         // next entry — they were aimed at the session being asked for.
         seed = end.lines ?? [];
@@ -1250,23 +1264,30 @@ async function main() {
         }
         args.splice(modelArgIdx, 2);
     }
-    // Modes: --mode wins over KISO_MODE, which wins over the USER config's
-    // mode (the project config's mode applies later — after the trust gate,
-    // inside createCodingAgent — unless a higher layer already decided).
+    // Modes: flag > env > project config > user config > default, for the
+    // tier and the don't-ask switch each (mode.ts resolveModeLayers). The
+    // project config exists only once the trust gate has passed, so it joins
+    // later (applyConfigMode); until then the other three decide.
+    const flagLayer = {};
     const modeFlag = args.indexOf("--mode");
     if (modeFlag !== -1) {
-        const m = MODES.find((x) => x === args[modeFlag + 1]);
-        if (m === undefined) {
-            console.error(`unknown mode: ${args[modeFlag + 1]} (tiers: ${OFFERED_MODES.join(", ")})`);
+        const raw = args[modeFlag + 1];
+        if (raw === undefined || parseMode(raw) === undefined) {
+            console.error(`unknown mode: ${raw} (tiers: ${OFFERED_MODES.join(", ")})`);
             process.exit(2);
         }
-        setMode(m);
-        settingsLayers.modeFlag = m;
+        flagLayer.mode = raw;
+        settingsLayers.modeFlag = raw;
         args.splice(modeFlag, 2);
     }
-    else {
-        setMode(modeFromEnv() ?? loadUserConfig()?.mode ?? "default");
+    const dontAskFlag = args.indexOf("--dont-ask");
+    if (dontAskFlag !== -1) {
+        flagLayer.dontAsk = true;
+        settingsLayers.dontAskFlag = true;
+        args.splice(dontAskFlag, 1);
     }
+    const modeLayers = (project) => ({ flag: flagLayer, env: envModeLayer(), project, user: loadUserConfig() });
+    applyModeState(resolveModeLayers(modeLayers(null)));
     // CX-1 F5: --task-file <path> — the file is the ONE user turn (the
     // structured child entry). Read BEFORE any session exists: an
     // unreadable file is a usage error with nothing executed.
@@ -1291,6 +1312,35 @@ async function main() {
             args.splice(i, 2);
         }
     }
+    // ADR-0058 3d: a background child's --max-turns N (its budget, D6) and
+    // --result-file <path> (where its answer goes). Child-only: without
+    // --task-file they are refused — the interactive door has no turn
+    // limit (R3e).
+    {
+        const end = {};
+        for (const flag of ["--max-turns", "--result-file"]) {
+            const i = args.indexOf(flag);
+            if (i === -1)
+                continue;
+            const value = args[i + 1];
+            if (taskFile === undefined)
+                throw new CliUsageError(`${flag} needs --task-file — it is for a delegated child only`);
+            if (value === undefined || value.startsWith("--"))
+                throw new CliUsageError(`${flag} needs a value`);
+            if (flag === "--max-turns") {
+                const n = Number(value);
+                if (!Number.isInteger(n) || n < 1)
+                    throw new CliUsageError(`--max-turns: expected a whole number of at least 1, got ${value}`);
+                end.maxTurns = n;
+            }
+            else
+                end.resultFile = value;
+            args.splice(i, 2);
+        }
+        if (end.maxTurns !== undefined || end.resultFile !== undefined)
+            childEnd = end;
+        setChildTurnBudget(end.maxTurns);
+    }
     // 0.40.0: `kiso sessions --all | --current` — the one command that takes
     // them. Parsed only there, so neither ever becomes a session id. Absent
     // = each form's default (TTY: current; pipe: all, today's bytes).
@@ -1433,10 +1483,9 @@ async function main() {
     try {
         // merge round B: the project config's mode applies AFTER the trust gate
         // (its verdict decides whether the project config exists at all) —
-        // unless a higher layer (--mode flag / KISO_MODE) already decided.
+        // under whatever a higher layer (the flags, the env) already decided.
         const applyConfigMode = () => {
-            if (modeFlag === -1 && process.env.KISO_MODE === undefined && mergedConfig.mode !== undefined)
-                setMode(mergedConfig.mode);
+            applyModeState(resolveModeLayers(modeLayers(settingsLayers.project)));
         };
         if (printPrompt !== undefined) {
             // the -p flow: recovery-first one-shot, the resume() machinery
@@ -1553,7 +1602,7 @@ async function main() {
                         console.log("kiso sessions --prune-empty --yes moves them to the Trash");
                     }
                     else
-                        console.log(`moved ${n(empty.length, "empty session")} to ${moveToTrash(empty, defaultTrashRoot())}`);
+                        console.log(`moved ${n(empty.length, "empty session")} to ${moveToTrash(empty, defaultTrashRoot(kisoHome()))}`);
                     if (inUse > 0)
                         console.log(`skipped ${n(inUse, "empty session")} in use — a live process holds the lock`);
                     break;
@@ -1719,7 +1768,9 @@ async function main() {
                 // npm's to explain; the message names the manual command so
                 // the person can run it with whatever their setup needs.
                 const [bin, ...installArgs] = INSTALL_COMMAND;
-                const r = spawnSync(bin, installArgs, { stdio: "inherit" });
+                // Windows: npm is npm.cmd — through cmd.exe (launch.ts)
+                const l = launchCommand(bin, installArgs);
+                const r = spawnSync(l.file, [...l.args], { stdio: "inherit", ...(l.windowsVerbatimArguments === true ? { windowsVerbatimArguments: true } : {}) });
                 if (r.error !== undefined || r.status !== 0) {
                     const why = r.error !== undefined ? `could not run npm (${r.error.message})` : `npm exited ${r.status ?? "on a signal"}`;
                     process.stderr.write(`kiso update: ${why} — run it yourself: ${INSTALL_COMMAND.join(" ")}\n`);
@@ -1751,7 +1802,8 @@ async function main() {
                     "  kiso help               this help\n\n" +
                     "flags (any position):\n" +
                     "  --model <profile|provider/model>   pick the model (also /model in-session)\n" +
-                    "  --mode <tier>            approval tier: default|accept-edits|plan|dontAsk|bypass\n" +
+                    "  --mode <tier>            approval tier: default|accept-edits|plan|full-access\n" +
+                    "  --dont-ask               never stop for a person: what would ask is refused\n" +
                     "  --version                print the version\n\n" +
                     "configuration:\n" +
                     "  no key                   keyless faux demo (a scripted four-round session)\n" +
@@ -1795,11 +1847,19 @@ async function main() {
         // variable now). A signal death skips this and leaves the dead-pid
         // residue — the dead-holder takeover recovers it by design
         // (ADR-0050); the lock never outlives a live writer either way.
+        // ADR-0058: a clean exit stops the session's tasks first — or, when
+        // the person chose to leave them (3e), only the moved commands. What
+        // could not be confirmed is said, never called stopped.
+        const tasksAtExit = await stopAllTasks();
         agent?.close();
         // v2b: the dock tears down on EVERY exit path — CSI r resets the
         // scroll region, the cursor lands at the input line, no broken
         // terminal (kill -9 excepted; `reset` saves it).
         dock.exit();
+        for (const id of tasksAtExit.unconfirmed)
+            console.error(`${id}: stop unconfirmed — outcome unknown`);
+        if (tasksAtExit.left.length > 0)
+            console.error(`left running: ${tasksAtExit.left.join(", ")} — reopen this session to hear how ${tasksAtExit.left.length === 1 ? "it ends" : "they end"}`);
         // finding #8 (P1): extension dispose runs on the same exit path — a
         // dispose failure prints one line and NEVER changes the exit code.
         await disposeExtensions(loadedExtensions);

package/dist/launch.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Windows P3 — how the CLI's small spawns start: `kiso update` (npm), the
+ * external editor, and the sign-in page.
+ *
+ * npm is npm.cmd and an editor is often code.cmd: a .cmd/.bat shim needs
+ * cmd.exe to start, and Node will not start one without a shell. Rather
+ * than `shell: true`, the call goes to cmd.exe itself — `/d /s /c "<line>"`
+ * — with every word quoted by `viaCmd`, the one function here (the
+ * cross-spawn rules: CommandLineToArgvW quoting, then a caret before each
+ * cmd.exe metacharacter). The shell tool never comes this way: it only
+ * ever starts bash (P1).
+ *
+ * Pure — no process is started here, so importing it moves no test into
+ * the pty pool.
+ */
+export interface Launch {
+    readonly file: string;
+    readonly args: readonly string[];
+    /** Windows: the line is cmd.exe's to parse, not Node's to requote */
+    readonly windowsVerbatimArguments?: true;
+}
+/** `bin args` as cmd.exe starts it. */
+export declare function viaCmd(bin: string, args: readonly string[], env?: NodeJS.ProcessEnv): Launch;
+/** `bin args` as this platform starts it: directly, or through cmd.exe on Windows. */
+export declare function launchCommand(bin: string, args: readonly string[]): Launch;
+/** The platform's URL opener — `rundll32`'s URL handler on Windows (cmd's
+ *  `start` would cut a sign-in URL at its first `&`) — or null, and the
+ *  URL stays printed. */
+export declare function browserCommand(url: string): readonly [string, readonly string[]] | null;

package/dist/launch.js

@@ -0,0 +1,43 @@
+/**
+ * Windows P3 — how the CLI's small spawns start: `kiso update` (npm), the
+ * external editor, and the sign-in page.
+ *
+ * npm is npm.cmd and an editor is often code.cmd: a .cmd/.bat shim needs
+ * cmd.exe to start, and Node will not start one without a shell. Rather
+ * than `shell: true`, the call goes to cmd.exe itself — `/d /s /c "<line>"`
+ * — with every word quoted by `viaCmd`, the one function here (the
+ * cross-spawn rules: CommandLineToArgvW quoting, then a caret before each
+ * cmd.exe metacharacter). The shell tool never comes this way: it only
+ * ever starts bash (P1).
+ *
+ * Pure — no process is started here, so importing it moves no test into
+ * the pty pool.
+ */
+/** cmd.exe's metacharacters: each is escaped with a caret. */
+const CMD_META = /([()\][%!^"`<>&|;, *?])/g;
+/** One argument, quoted as CommandLineToArgvW reads it, then escaped for cmd.exe. */
+function cmdArgument(arg) {
+    const quoted = `"${arg.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\*)$/, "$1$1")}"`;
+    return quoted.replace(CMD_META, "^$1");
+}
+/** `bin args` as cmd.exe starts it. */
+export function viaCmd(bin, args, env = process.env) {
+    const line = [bin.replace(CMD_META, "^$1"), ...args.map(cmdArgument)].join(" ");
+    return { file: env.ComSpec ?? "cmd.exe", args: ["/d", "/s", "/c", `"${line}"`], windowsVerbatimArguments: true };
+}
+/** `bin args` as this platform starts it: directly, or through cmd.exe on Windows. */
+export function launchCommand(bin, args) {
+    return process.platform === "win32" ? viaCmd(bin, args) : { file: bin, args };
+}
+/** The platform's URL opener — `rundll32`'s URL handler on Windows (cmd's
+ *  `start` would cut a sign-in URL at its first `&`) — or null, and the
+ *  URL stays printed. */
+export function browserCommand(url) {
+    if (process.platform === "darwin")
+        return ["open", [url]];
+    if (process.platform === "linux")
+        return ["xdg-open", [url]];
+    if (process.platform === "win32")
+        return ["rundll32", ["url.dll,FileProtocolHandler", url]];
+    return null;
+}

package/dist/mode.d.ts

@@ -1,5 +1,5 @@
 /**
- * Modes — the six built-in approval tiers, built ON the E1 policy chain
+ * Modes — the built-in approval tiers, built ON the E1 policy chain
  * (the kernel is untouched). Each tier is an in-process "mode:<name>"
  * extension whose decide() is live — it only speaks when it is the
  * CURRENT tier (otherwise abstain = no opinion, ADR-0042), so /mode
@@ -7,19 +7,37 @@
  * field: an automated denial records decidedBy: "mode:<name>" — the
  * audit sell. User-level extensions stay on the chain AFTER the mode
  * tiers; a user deny always wins (the chain's deny>allow>ask
- * monotonicity — bypass cannot override an extension deny).
+ * monotonicity — full-access cannot override an extension deny).
+ *
+ * Two questions, two settings (the modes round, 2026-09-30). The TIER
+ * answers what the agent may do. The DON'T-ASK SWITCH answers whether
+ * kiso may stop for a person, and it composes with every tier: it never
+ * grants anything — what would ask is refused, a model's question is not
+ * offered, an uncertain execution stays uncertain. The old `dontAsk` tier
+ * was that switch welded to default's authority; it is still accepted,
+ * and means exactly that.
  */
 import type { KisoExtension } from "@vincemakes/kiso-runtime";
-export type Mode = "manual" | "default" | "accept-edits" | "plan" | "bypass" | "dontAsk";
-/** Every tier kiso ACCEPTS — from a config, KISO_MODE, --mode, or
- *  `/mode <name>`. */
+export type Mode = "manual" | "default" | "accept-edits" | "plan" | "full-access";
+/** Every tier kiso decides with. */
 export declare const MODES: readonly Mode[];
-/** The tiers kiso OFFERS a person (launch-weekend plan §2): the picker,
- *  shift+tab, the printed list, the help. `manual` left the offer — a
- *  saved allow outranks its ask, so "asks for every tool" was never
- *  quite what it did — and stays accepted, so no config that names it
- *  breaks. `dontAsk` joined: the unattended tier. */
+/** The tiers kiso OFFERS a person: the picker, shift+tab, the printed
+ *  list, the help. `manual` left the offer at 0.40.0 — a saved allow
+ *  outranks its ask, so "asks for every tool" was never quite what it
+ *  did — and stays accepted, so no config that names it breaks. */
 export declare const OFFERED_MODES: readonly Mode[];
+/** What a person reads for each tier — the status row, the picker, the
+ *  notices. The typed value (config, --mode, KISO_MODE) keeps its hyphen. */
+export declare const MODE_LABEL: Readonly<Record<Mode, string>>;
+/** One tier plus, for the one spelling that carried it, the switch. */
+export interface ModeSetting {
+    readonly mode: Mode;
+    readonly dontAsk?: true;
+}
+/** Every value a config, KISO_MODE, --mode or `/mode <name>` accepts. */
+export declare const MODE_VALUES: readonly string[];
+/** A typed tier: its value, its label ("full access"), or an old name. */
+export declare function parseMode(raw: string): ModeSetting | undefined;
 /** DC-36 — one line per tier, for the picker, TRANSCRIBED FROM decide()
  *  below rather than written fresh. A description that drifts from the
  *  behaviour is worse than none: this is the row a human reads before
@@ -34,21 +52,76 @@ export declare const OFFERED_MODES: readonly Mode[];
  *  is unchanged; the copy was the thing that was wrong. `plan` needs no
  *  qualification because it DENIES, and a deny is what nothing overrides. */
 export declare const MODE_NOTE: Readonly<Record<Mode, string>>;
+/** The switch in one line, for a surface that describes it, under the
+ *  same 60-column rule. The /mode panel does not offer it: don't ask is
+ *  not a tier, so it never sits beside them (owner, 2026-09-30) — the
+ *  panel's header names it when it is on. */
+export declare const DONT_ASK_NOTE = "never asks: what would ask is refused and the run goes on";
+/** The switch. "old-name" is a switch that arrived bundled with the old
+ *  `dontAsk` tier: it leaves with the tier, as leaving dontAsk always
+ *  gave the asks back. A switch set on its own ("on") outlives every tier
+ *  change. */
+export type DontAskState = "off" | "on" | "old-name";
 export declare function getMode(): Mode;
+/** A tier switch. The switch stays as it is — unless it came with the
+ *  old dontAsk tier, which this switch leaves. */
 export declare function setMode(m: Mode): void;
-/** The startup mode from env: KISO_MODE, or undefined when unset (the
- *  config layer's mode then applies — merge round B; the --mode flag is
- *  applied by main before the first createCodingAgent and wins over everything). */
-export declare function modeFromEnv(): Mode | undefined;
-/** The six built-in mode tiers as chain extensions — named "mode:<tier>"
+/** A typed tier, old names included: `/mode dontAsk` is default with the
+ *  switch on, exactly the tier it used to be. */
+export declare function applyModeSetting(s: ModeSetting): void;
+/** Whether kiso may stop for a person — every ask endpoint reads this. */
+export declare function getDontAsk(): boolean;
+export declare function setDontAsk(on: boolean): void;
+/** The tier as the status row and the notices name it, with the switch
+ *  beside it when it is on. */
+export declare function modeDisplay(): string;
+/** One layer's say: what a config file, the environment or the command
+ *  line wrote. KisoConfig is one of these. */
+export interface ModeLayer {
+    readonly mode?: string | undefined;
+    readonly dontAsk?: boolean | undefined;
+}
+export type ModeSource = "flag" | "env" | "project" | "user" | "default";
+export interface ModeState {
+    readonly mode: Mode;
+    readonly dontAsk: DontAskState;
+    /** the layer each answer came from — /settings names it */
+    readonly from: {
+        readonly mode: ModeSource;
+        readonly dontAsk: ModeSource;
+    };
+}
+/** KISO_MODE and KISO_DONT_ASK. A value kiso cannot read is no value —
+ *  the next layer decides, as an unknown KISO_MODE always did. */
+export declare function envModeLayer(env?: Readonly<Record<string, string | undefined>>): ModeLayer;
+/**
+ * Precedence: flag > env > project config > user config > default, for
+ * each answer on its own. The tier comes from the highest layer that
+ * names a readable one. The switch comes from the highest layer that
+ * either sets it (`--dont-ask`, KISO_DONT_ASK, "dontAsk": true|false) or
+ * WON THE TIER with the old name `dontAsk` — an old name's switch counts
+ * only where that old name decided the tier. So every combination of old
+ * spellings resolves as it did when dontAsk was a tier: a user config
+ * saying "dontAsk" under `--mode bypass` still asks, because --mode won.
+ */
+export declare function resolveModeLayers(layers: {
+    readonly flag?: ModeLayer | null | undefined;
+    readonly env?: ModeLayer | null | undefined;
+    readonly project?: ModeLayer | null | undefined;
+    readonly user?: ModeLayer | null | undefined;
+}): ModeState;
+/** Put a resolved state in force — startup, and again once the project
+ *  config is known. */
+export declare function applyModeState(s: ModeState): void;
+/** The built-in mode tiers as chain extensions — named "mode:<tier>"
  *  so the runtime's decidedBy records exactly that (the runtime derives
  *  approvalPolicies from extensions[].approvals, tagging each with the
  *  extension name). The CURRENT tier is first: an all-allow chain records
  *  decidedBy = the FIRST SPEAKER, so an auto-allow under the startup mode
  *  names that mode honestly. Order never affects verdicts — the chain is
  *  deny>allow>ask over the SPEAKING verdicts (abstain = no opinion), so a
- *  user extension's deny wins over any mode tier, bypass included (the
- *  monotonicity e2e pins it). */
+ *  user extension's deny wins over any mode tier, full-access included
+ *  (the monotonicity e2e pins it). */
 export declare function modeExtensions(workspaceRoot?: () => string): readonly KisoExtension[];
 /** The plan tier's system prompt addition — injected at startup when the
  *  initial mode is plan (the session prompt is fixed at creation; runtime