@vincemakes/kiso-code 0.45.3 → 0.46.0

package/dist/mode.js

@@ -1,5 +1,5 @@
 /**
- * Modes — the six built-in approval tiers, built ON the E1 policy chain
+ * Modes — the built-in approval tiers, built ON the E1 policy chain
  * (the kernel is untouched). Each tier is an in-process "mode:<name>"
  * extension whose decide() is live — it only speaks when it is the
  * CURRENT tier (otherwise abstain = no opinion, ADR-0042), so /mode
@@ -7,18 +7,52 @@
  * field: an automated denial records decidedBy: "mode:<name>" — the
  * audit sell. User-level extensions stay on the chain AFTER the mode
  * tiers; a user deny always wins (the chain's deny>allow>ask
- * monotonicity — bypass cannot override an extension deny).
+ * monotonicity — full-access cannot override an extension deny).
+ *
+ * Two questions, two settings (the modes round, 2026-09-30). The TIER
+ * answers what the agent may do. The DON'T-ASK SWITCH answers whether
+ * kiso may stop for a person, and it composes with every tier: it never
+ * grants anything — what would ask is refused, a model's question is not
+ * offered, an uncertain execution stays uncertain. The old `dontAsk` tier
+ * was that switch welded to default's authority; it is still accepted,
+ * and means exactly that.
  */
 import { isProtectedWrite } from "./protected-writes.js";
-/** Every tier kiso ACCEPTS — from a config, KISO_MODE, --mode, or
- *  `/mode <name>`. */
-export const MODES = ["manual", "default", "accept-edits", "plan", "bypass", "dontAsk"];
-/** The tiers kiso OFFERS a person (launch-weekend plan §2): the picker,
- *  shift+tab, the printed list, the help. `manual` left the offer — a
- *  saved allow outranks its ask, so "asks for every tool" was never
- *  quite what it did — and stays accepted, so no config that names it
- *  breaks. `dontAsk` joined: the unattended tier. */
-export const OFFERED_MODES = ["default", "accept-edits", "plan", "dontAsk", "bypass"];
+/** Every tier kiso decides with. */
+export const MODES = ["manual", "default", "accept-edits", "plan", "full-access"];
+/** The tiers kiso OFFERS a person: the picker, shift+tab, the printed
+ *  list, the help. `manual` left the offer at 0.40.0 — a saved allow
+ *  outranks its ask, so "asks for every tool" was never quite what it
+ *  did — and stays accepted, so no config that names it breaks. */
+export const OFFERED_MODES = ["default", "accept-edits", "plan", "full-access"];
+/** What a person reads for each tier — the status row, the picker, the
+ *  notices. The typed value (config, --mode, KISO_MODE) keeps its hyphen. */
+export const MODE_LABEL = {
+    manual: "manual",
+    default: "default",
+    "accept-edits": "accept edits",
+    plan: "plan",
+    "full-access": "full access",
+};
+/** Every spelling kiso ever accepted keeps its meaning. `bypass` is
+ *  full-access's old name. `dontAsk` was a tier: default's decisions with
+ *  the switch on — so it still means that, and never full-access with the
+ *  switch on (read that way, an old config would gain authority nobody
+ *  gave it). */
+const OLD_NAMES = new Map([
+    ["bypass", { mode: "full-access" }],
+    ["dontAsk", { mode: "default", dontAsk: true }],
+]);
+/** Every value a config, KISO_MODE, --mode or `/mode <name>` accepts. */
+export const MODE_VALUES = [...MODES, ...OLD_NAMES.keys()];
+/** A typed tier: its value, its label ("full access"), or an old name. */
+export function parseMode(raw) {
+    const s = raw.trim();
+    const m = MODES.find((x) => x === s || MODE_LABEL[x] === s);
+    if (m !== undefined)
+        return { mode: m };
+    return OLD_NAMES.get(s);
+}
 /** DC-36 — one line per tier, for the picker, TRANSCRIBED FROM decide()
  *  below rather than written fresh. A description that drifts from the
  *  behaviour is worse than none: this is the row a human reads before
@@ -41,25 +75,95 @@ export const MODE_NOTE = {
     default: "read-only runs; the rest asks — a saved allow still allows",
     "accept-edits": "read-only, edits run; rest asks — a saved allow still allows",
     plan: "reads run; all else is denied — read-only, and a deny wins",
-    bypass: "everything runs, nothing asks — a user deny still wins",
-    dontAsk: "asks nothing: an ask is denied — a saved allow still allows",
+    "full-access": "runs without asking — a user deny and the floor still win",
 };
+/** The switch in one line, for a surface that describes it, under the
+ *  same 60-column rule. The /mode panel does not offer it: don't ask is
+ *  not a tier, so it never sits beside them (owner, 2026-09-30) — the
+ *  panel's header names it when it is on. */
+export const DONT_ASK_NOTE = "never asks: what would ask is refused and the run goes on";
 /** The read-only tool set (plan): reading is allowed, everything else
  *  denied with the guiding reason. */
 const READ_TOOLS = new Set(["read_file", "list_dir", "search_text", "read_skill"]);
+/** ADR-0058 (3b, D2): stopping a task this session started asks no one —
+ *  stopping is the safe direction — in every tier but manual. */
+const STOP_TOOLS = new Set(["task_stop"]);
 let current = "default";
+let dontAsk = "off";
 export function getMode() {
     return current;
 }
+/** A tier switch. The switch stays as it is — unless it came with the
+ *  old dontAsk tier, which this switch leaves. */
 export function setMode(m) {
     current = m;
+    if (dontAsk === "old-name")
+        dontAsk = "off";
+}
+/** A typed tier, old names included: `/mode dontAsk` is default with the
+ *  switch on, exactly the tier it used to be. */
+export function applyModeSetting(s) {
+    setMode(s.mode);
+    if (s.dontAsk === true && dontAsk === "off")
+        dontAsk = "old-name";
+}
+/** Whether kiso may stop for a person — every ask endpoint reads this. */
+export function getDontAsk() {
+    return dontAsk !== "off";
+}
+export function setDontAsk(on) {
+    dontAsk = on ? "on" : "off";
+}
+/** The tier as the status row and the notices name it, with the switch
+ *  beside it when it is on. */
+export function modeDisplay() {
+    return `${current === "plan" ? "plan (read-only)" : MODE_LABEL[current]}${dontAsk !== "off" ? " · don't ask" : ""}`;
+}
+/** KISO_MODE and KISO_DONT_ASK. A value kiso cannot read is no value —
+ *  the next layer decides, as an unknown KISO_MODE always did. */
+export function envModeLayer(env = process.env) {
+    const raw = env.KISO_DONT_ASK?.trim().toLowerCase();
+    const on = raw === "1" || raw === "true" || raw === "on" ? true : raw === "0" || raw === "false" || raw === "off" ? false : undefined;
+    return { ...(env.KISO_MODE !== undefined ? { mode: env.KISO_MODE } : {}), ...(on !== undefined ? { dontAsk: on } : {}) };
+}
+/**
+ * Precedence: flag > env > project config > user config > default, for
+ * each answer on its own. The tier comes from the highest layer that
+ * names a readable one. The switch comes from the highest layer that
+ * either sets it (`--dont-ask`, KISO_DONT_ASK, "dontAsk": true|false) or
+ * WON THE TIER with the old name `dontAsk` — an old name's switch counts
+ * only where that old name decided the tier. So every combination of old
+ * spellings resolves as it did when dontAsk was a tier: a user config
+ * saying "dontAsk" under `--mode bypass` still asks, because --mode won.
+ */
+export function resolveModeLayers(layers) {
+    const order = [
+        ["flag", layers.flag],
+        ["env", layers.env],
+        ["project", layers.project],
+        ["user", layers.user],
+    ];
+    let tier = { setting: { mode: "default" }, from: "default" };
+    for (const [from, layer] of order) {
+        const setting = layer?.mode === undefined ? undefined : parseMode(layer.mode);
+        if (setting !== undefined) {
+            tier = { setting, from };
+            break;
+        }
+    }
+    for (const [from, layer] of order) {
+        if (layer?.dontAsk !== undefined)
+            return { mode: tier.setting.mode, dontAsk: layer.dontAsk ? "on" : "off", from: { mode: tier.from, dontAsk: from } };
+        if (from === tier.from && tier.setting.dontAsk === true)
+            return { mode: tier.setting.mode, dontAsk: "old-name", from: { mode: tier.from, dontAsk: from } };
+    }
+    return { mode: tier.setting.mode, dontAsk: "off", from: { mode: tier.from, dontAsk: "default" } };
 }
-/** The startup mode from env: KISO_MODE, or undefined when unset (the
- *  config layer's mode then applies — merge round B; the --mode flag is
- *  applied by main before the first createCodingAgent and wins over everything). */
-export function modeFromEnv() {
-    const raw = process.env.KISO_MODE;
-    return MODES.find((x) => x === raw);
+/** Put a resolved state in force — startup, and again once the project
+ *  config is known. */
+export function applyModeState(s) {
+    current = s.mode;
+    dontAsk = s.dontAsk;
 }
 /** The per-tier verdict for a tool call — only when this tier is current. */
 function tierVerdict(tier, call, workspaceRoot) {
@@ -68,14 +172,13 @@ function tierVerdict(tier, call, workspaceRoot) {
     switch (tier) {
         case "manual":
             return { action: "ask" }; // every tool asks
-        // dontAsk decides exactly as default does. What makes it dontAsk is
-        // what happens to the chain's final ASK: the CLI denies it at the
-        // ask endpoint instead of asking (chat.ts). Not a tier deny — that
-        // would outrank every allow, and a saved allow and the read-only
-        // shell allow must still allow.
+        // The don't-ask switch changes no tier's decision. What it changes is
+        // what happens to the chain's final ASK: the CLI denies it at the ask
+        // endpoint instead of asking (chat.ts). Not a tier deny — that would
+        // outrank every allow, and a saved allow and the read-only shell allow
+        // must still allow.
         case "default":
-        case "dontAsk":
-            if (READ_TOOLS.has(call.name))
+            if (READ_TOOLS.has(call.name) || STOP_TOOLS.has(call.name))
                 return { action: "allow" };
             if (call.name === "write_file" || call.name === "edit_file" || call.name === "shell")
                 return { action: "ask" };
@@ -86,7 +189,7 @@ function tierVerdict(tier, call, workspaceRoot) {
             // finding: "allow"-as-no-opinion auto-approved it).
             return { action: "abstain" };
         case "accept-edits":
-            if (READ_TOOLS.has(call.name))
+            if (READ_TOOLS.has(call.name) || STOP_TOOLS.has(call.name))
                 return { action: "allow" };
             // 0.40.0: a write into .git/ or .kiso/ asks even here — both hold
             // configuration that runs (protected-writes.ts)
@@ -96,22 +199,22 @@ function tierVerdict(tier, call, workspaceRoot) {
                 return { action: "ask" };
             return { action: "abstain" }; // see "default"
         case "plan":
-            if (READ_TOOLS.has(call.name))
+            if (READ_TOOLS.has(call.name) || STOP_TOOLS.has(call.name))
                 return { action: "allow" };
             return { action: "deny", reason: "plan mode: read-only" };
-        case "bypass":
+        case "full-access":
             return { action: "allow" }; // everything — a REAL allow, never an abstain
     }
 }
-/** The six built-in mode tiers as chain extensions — named "mode:<tier>"
+/** The built-in mode tiers as chain extensions — named "mode:<tier>"
  *  so the runtime's decidedBy records exactly that (the runtime derives
  *  approvalPolicies from extensions[].approvals, tagging each with the
  *  extension name). The CURRENT tier is first: an all-allow chain records
  *  decidedBy = the FIRST SPEAKER, so an auto-allow under the startup mode
  *  names that mode honestly. Order never affects verdicts — the chain is
  *  deny>allow>ask over the SPEAKING verdicts (abstain = no opinion), so a
- *  user extension's deny wins over any mode tier, bypass included (the
- *  monotonicity e2e pins it). */
+ *  user extension's deny wins over any mode tier, full-access included
+ *  (the monotonicity e2e pins it). */
 export function modeExtensions(workspaceRoot = () => process.cwd()) {
     return [...MODES.filter((m) => m === current), ...MODES.filter((m) => m !== current)].map((m) => ({
         name: `mode:${m}`,

package/dist/protected-shell.js

@@ -35,10 +35,10 @@
  * guarantee is the sandbox, which stays post-launch.
  */
 import { readdirSync, realpathSync, statSync } from "node:fs";
-import { basename, dirname, resolve } from "node:path";
+import { basename } from "node:path";
 import { protectedIdentity, PROTECTED_REFUSAL } from "@vincemakes/kiso-tools-node";
 import { innerLines, unwrap } from "./floor.js";
-import { parseShellLooseChecked } from "./shell-words.js";
+import { hostDialect, msysPath, parseShellLooseChecked, resolveShellPath } from "./shell-words.js";
 const ABSTAIN = { action: "abstain" };
 /** How deep `sh -c`/`eval` lines are followed, and how many are read. */
 const MAX_INNER_DEPTH = 16;
@@ -104,7 +104,8 @@ function globRegex(glob) {
     // case-folded: on a disk that folds case, `.KISO/*` is the same directory
     return new RegExp(`^${re}$`, "i");
 }
-function probeFor(id) {
+function probeFor(id, { msys, path }) {
+    const { basename, dirname, join } = path;
     const files = new Set();
     const dirs = new Set();
     const targets = [];
@@ -115,7 +116,7 @@ function probeFor(id) {
         try {
             for (const name of readdirSync(dir))
                 if (name.startsWith(`${base}.`))
-                    targets.push(`${dir}/${name}`);
+                    targets.push(msys ? join(dir, name) : `${dir}/${name}`);
         }
         catch {
             // no directory yet — nothing in it to serve
@@ -139,8 +140,10 @@ function probeFor(id) {
 export function protectedShellCheck(line, workspaceRoot, id, env) {
     if (id.paths.length === 0)
         return { hit: false };
-    const probe = probeFor(id);
-    const names = id.paths.map((p) => basename(p).toLowerCase());
+    const dialect = hostDialect();
+    const P = dialect.path;
+    const probe = probeFor(id, dialect);
+    const names = id.paths.map((p) => P.basename(p).toLowerCase());
     const paths = id.paths.map((p) => p.toLowerCase());
     const namesProtected = (t) => {
         const low = t.toLowerCase();
@@ -168,7 +171,17 @@ export function protectedShellCheck(line, workspaceRoot, id, env) {
         seenStat.set(p, st);
         return st;
     };
-    const at = (cwd, t) => (t.startsWith("/") ? t : `${cwd}/${t}`);
+    // on Windows the system normalizes a path lexically before it opens it,
+    // so the lexical resolution is what a command opens there
+    const at = (cwd, t) => (dialect.msys ? P.resolve(cwd, t) : t.startsWith("/") ? t : `${cwd}/${t}`);
+    /** Windows P2: a word as Git Bash's command sees the path — or null
+     *  when it cannot be read (only its spelling can be checked). */
+    const native = (t) => {
+        if (!dialect.msys)
+            return t;
+        const read = msysPath(t);
+        return "opaque" in read ? null : read.native;
+    };
     const regexes = new Map();
     const realOf = new Map();
     /** Whether a word's last component is a protected file's name, or one
@@ -183,12 +196,15 @@ export function protectedShellCheck(line, workspaceRoot, id, env) {
         return out.replace(/\$\{KISO_HOME\}|\$KISO_HOME(?![A-Za-z0-9_])/g, env.kisoHome);
     };
     /** One literal-or-glob path text, read from each candidate directory. */
-    const pathHits = (t, s) => {
-        if (t === "")
+    const pathHits = (word, s) => {
+        if (word === "")
             return false;
-        if (/[$`]/.test(t))
-            return namesProtected(t);
-        if (s.lossy && !t.startsWith("/") && namesProtected(t))
+        if (/[$`]/.test(word))
+            return namesProtected(word);
+        const t = native(word);
+        if (t === null)
+            return namesProtected(word);
+        if (s.lossy && !P.isAbsolute(t) && namesProtected(t))
             return true;
         const glob = /[*?[]/.test(t);
         for (const cwd of s.cwds) {
@@ -198,13 +214,31 @@ export function protectedShellCheck(line, workspaceRoot, id, env) {
                 // not exist yet) — only when the last component could be the
                 // file's name — then by inode
                 if (named(t)) {
-                    const spelled = resolve(cwd, t).toLowerCase();
+                    const spelled = P.resolve(cwd, t).toLowerCase();
                     if (paths.some((pf) => spelled === pf || spelled.startsWith(`${pf}.`)))
                         return true;
                 }
                 const st = statAt(at(cwd, t));
                 if (st?.isFile() === true && probe.files.has(inode(st)))
                     return true;
+                if (dialect.msys && t.split("/").includes("..")) {
+                    // Windows: the lexical reading above, and — for a `..`, where
+                    // they can differ — the real-path one; a `..` after a link the
+                    // two read apart falls back to names. One more reading charged.
+                    charge();
+                    const real = resolveShellPath(cwd, cwd, t, dialect);
+                    if (real.opaque !== undefined) {
+                        if (namesProtected(t))
+                            return true;
+                        continue;
+                    }
+                    const low = real.canonical.toLowerCase();
+                    if (paths.some((pf) => low === pf || low.startsWith(`${pf}.`)))
+                        return true;
+                    const rst = statAt(real.canonical);
+                    if (rst?.isFile() === true && probe.files.has(inode(rst)))
+                        return true;
+                }
                 continue;
             }
             const g = t.search(/[*?[]/);
@@ -232,11 +266,14 @@ export function protectedShellCheck(line, workspaceRoot, id, env) {
                 }
                 realOf.set(dirText, real);
             }
-            const pattern = `${real.endsWith("/") ? real : `${real}/`}${rest}`;
+            // Windows: one separator, one case, on both sides of the match
+            const fold = (p) => (dialect.msys ? p.replace(/\\/g, "/").toLowerCase() : p);
+            const dirReal = fold(real);
+            const pattern = `${dirReal.endsWith("/") ? dirReal : `${dirReal}/`}${dialect.msys ? rest.toLowerCase() : rest}`;
             let re = regexes.get(pattern);
             if (re === undefined)
                 regexes.set(pattern, (re = globRegex(pattern)));
-            if (probe.targets.some((p) => re.test(p)))
+            if (probe.targets.some((p) => re.test(fold(p))))
                 return true;
         }
         return false;
@@ -255,8 +292,11 @@ export function protectedShellCheck(line, workspaceRoot, id, env) {
     /** A directory holding a protected file — the file's own, or any
      *  directory above it — by inode. */
     const holds = (w, s) => {
-        const t = expand(w.text, w.tilde);
-        if (t === "" || /[$`*?[]/.test(t) || (w.tilde && /^~[^/]/.test(w.text)))
+        const spelled = expand(w.text, w.tilde);
+        if (spelled === "" || /[$`*?[]/.test(spelled) || (w.tilde && /^~[^/]/.test(w.text)))
+            return false;
+        const t = native(spelled);
+        if (t === null)
             return false;
         return s.cwds.some((cwd) => {
             charge();
@@ -334,8 +374,9 @@ export function protectedShellCheck(line, workspaceRoot, id, env) {
                 else if (to === undefined)
                     s.pending = [env.home];
                 else {
-                    const t = expand(to.text, to.tilde);
-                    if (/[$`*?[]/.test(t) || (to.tilde && /^~[^/]/.test(to.text))) {
+                    const spelled = expand(to.text, to.tilde);
+                    const t = native(spelled);
+                    if (t === null || /[$`*?[]/.test(spelled) || (to.tilde && /^~[^/]/.test(to.text))) {
                         s.lossy = true;
                         s.pending = cap(s, [env.home, ...s.cwds]);
                     }

package/dist/protected-writes.d.ts

@@ -12,8 +12,8 @@
  * So a write_file or edit_file whose path — as written, or once symlinks
  * are followed — passes through a `.git` or `.kiso` directory asks in
  * every asking tier: accept-edits' allow does not cover it, and neither
- * does a saved allow. dontAsk therefore denies it; plan denies it anyway;
- * bypass runs it, as bypass's shell could.
+ * does a saved allow. With the don't-ask switch on it is therefore denied;
+ * plan denies it anyway; full-access runs it, as full-access's shell could.
  */
 import type { PolicyCall } from "@vincemakes/kiso-core";
 import type { KisoExtension } from "@vincemakes/kiso-runtime";

package/dist/protected-writes.js

@@ -12,8 +12,8 @@
  * So a write_file or edit_file whose path — as written, or once symlinks
  * are followed — passes through a `.git` or `.kiso` directory asks in
  * every asking tier: accept-edits' allow does not cover it, and neither
- * does a saved allow. dontAsk therefore denies it; plan denies it anyway;
- * bypass runs it, as bypass's shell could.
+ * does a saved allow. With the don't-ask switch on it is therefore denied;
+ * plan denies it anyway; full-access runs it, as full-access's shell could.
  */
 import { relative, sep } from "node:path";
 import { resolveShellPath } from "./shell-words.js";

package/dist/readonly-shell.js

@@ -32,24 +32,26 @@
  */
 import { statSync } from "node:fs";
 import { homedir } from "node:os";
-import { basename, isAbsolute, join, relative } from "node:path";
+import { join } from "node:path";
 import { isCredentialName, isCredentialPath } from "@vincemakes/kiso-tools-node";
 import { getMode } from "./mode.js";
-import { HOME_SUBTREES, parseShell, realCase, resolveShellPath } from "./shell-words.js";
+import { homeSubtrees, hostDialect, parseShell, realCase, resolveShellPath } from "./shell-words.js";
 // ── the predicates ──────────────────────────────────────────────────────
 function scope(ctx, word) {
     if (word === "-")
         return null; // stdin
     for (const cwd of ctx.cwds) {
-        const { canonical, inside } = resolveShellPath(ctx.root, cwd, word);
+        const { canonical, inside, opaque } = resolveShellPath(ctx.root, cwd, word);
+        if (opaque !== undefined)
+            return `${word} is ${opaque}`;
         if (!inside)
             return `${word} is outside the workspace`;
         // B4: under a protected directory NOTHING is read or listed unasked —
         // kiso's own home, and ~/.ssh ~/.config ~/.aws ~/.gnupg ~/.kiso when
         // the workspace is the home directory. Over-asking is an ask.
         for (const p of ctx.protectedRoots) {
-            const rel = relative(p, canonical);
-            if (rel === "" || (!rel.startsWith("..") && !isAbsolute(rel)))
+            const rel = hostDialect().path.relative(p, canonical);
+            if (rel === "" || (!rel.startsWith("..") && !hostDialect().path.isAbsolute(rel)))
                 return `${word} is inside a protected directory (${p})`;
         }
     }
@@ -59,7 +61,7 @@ function scope(ctx, word) {
  *  the file tools ask ONE rule — names (`isCredentialName`) and the
  *  directory-scoped paths (`isCredentialPath`) — on the canonical path. */
 function shellCredential(canonical) {
-    return isCredentialName(basename(canonical).toLowerCase()) || isCredentialPath(canonical);
+    return isCredentialName(hostDialect().path.basename(canonical).toLowerCase()) || isCredentialPath(canonical);
 }
 function content(ctx, word) {
     const s = scope(ctx, word);
@@ -69,11 +71,11 @@ function content(ctx, word) {
         return null;
     // B2: the disk is case-insensitive and the names are not — `.ENV` and
     // `ID_RSA` are `.env` and `id_rsa` to the file system, so to the rule
-    if (isCredentialName(basename(word).toLowerCase()))
+    if (isCredentialName(hostDialect().path.basename(word).toLowerCase()))
         return `${word} is a credential file`;
     for (const cwd of ctx.cwds) {
         const { canonical } = resolveShellPath(ctx.root, cwd, word);
-        if (isCredentialName(basename(canonical).toLowerCase()) || shellCredential(canonical))
+        if (isCredentialName(hostDialect().path.basename(canonical).toLowerCase()) || shellCredential(canonical))
             return `${word} leads to a credential file`;
     }
     return null;
@@ -552,11 +554,11 @@ export function classifyReadOnly(commandLine, workspaceRoot, protectedRoots = []
     }
     return { allow: true };
 }
-/** The modes in which a provable read runs unasked. dontAsk is one: an
- *  allow is what it still honours. Manual promises that every tool asks;
- *  plan denies shell outright; bypass allows everything already — this
- *  member has nothing to add to any of them. */
-const ALLOWING_MODES = new Set(["default", "accept-edits", "dontAsk"]);
+/** The modes in which a provable read runs unasked — with the don't-ask
+ *  switch on too: an allow is what it still honours. Manual promises that
+ *  every tool asks; plan denies shell outright; full-access allows
+ *  everything already — this member has nothing to add to any of them. */
+const ALLOWING_MODES = new Set(["default", "accept-edits"]);
 const ABSTAIN = { action: "abstain" };
 /**
  * The chain member. ALLOW or ABSTAIN, never anything else: an allow here
@@ -577,7 +579,7 @@ export function readOnlyShellExtension(roots) {
                     if (typeof command !== "string")
                         return ABSTAIN;
                     const { workspaceRoot, excludeRoots } = roots();
-                    const protectedRoots = [...excludeRoots, ...HOME_SUBTREES.map((s) => join(homedir(), s))];
+                    const protectedRoots = [...excludeRoots, ...homeSubtrees().map((s) => join(homedir(), s))];
                     return classifyReadOnly(command, workspaceRoot, protectedRoots).allow ? { action: "allow" } : ABSTAIN;
                 },
             },

package/dist/replay.js

@@ -20,6 +20,7 @@
  *     the viewer — then any uncovered earlier turns folded as above.
  */
 import { echoText } from "@vincemakes/kiso-tui-cells/render";
+import { taskNoticeRow } from "./task-notice.js";
 /** How many turns stay on screen in full. */
 const FULL_TURNS = 2;
 /** A user turn's opening line, or null when this input does not open one
@@ -61,6 +62,8 @@ function replayTurn(body, turn) {
                 const ask = askOf(e);
                 if (ask !== null)
                     body.userLine(ask);
+                else if (e.via?.kind === "tasks")
+                    body.notice(taskNoticeRow(e.via.items));
                 else if (e.source === "system") {
                     body.notice("verification pass");
                     body.notice(`  ${typeof e.content === "string" ? e.content : ""}`);

package/dist/resume.js

@@ -3,7 +3,7 @@
  * moved verbatim from index.ts.
  */
 import { idleStatus, runningStatus } from "@vincemakes/kiso-tui";
-import { getMode } from "./mode.js";
+import { modeDisplay } from "./mode.js";
 import { agentModel, dock, retryOnRow, floorOn } from "./state.js";
 import { pendingAsk, resolveUncertains } from "./trust-ui.js";
 import { failOnFauxExhaustion } from "./faux-glue.js";
@@ -37,7 +37,7 @@ export async function resume(session, prompt, faux, input) {
         // same budget. It has no meter, so nothing here can be dropped that
         // was not already at risk of being cut.
         if (dock.active)
-            dock.setStatus(idleStatus(getMode(), agentModel, estimateCtxRatio(session), undefined, process.stdout.columns > 0 ? process.stdout.columns : 80, !floorOn));
+            dock.setStatus(idleStatus(modeDisplay(), agentModel, estimateCtxRatio(session), undefined, process.stdout.columns > 0 ? process.stdout.columns : 80, !floorOn));
     };
     const withRun = async (run) => {
         currentRun = run;

package/dist/settings.d.ts

@@ -20,8 +20,11 @@ export interface SettingsInput {
     /** the --mode / --model values on the command line, when given */
     readonly modeFlag?: string;
     readonly modelFlag?: string;
+    /** whether --dont-ask was on the command line */
+    readonly dontAskFlag?: boolean;
     /** what is live now */
     readonly mode: string;
+    readonly dontAsk?: boolean;
     readonly model: {
         readonly label: string;
         readonly profile: string | null;

package/dist/settings.js

@@ -1,18 +1,47 @@
+import { envModeLayer, parseMode, resolveModeLayers } from "./mode.js";
+const MODE_LAYER = { flag: "--mode", env: "env KISO_MODE", project: "project config", user: "user config", default: "default" };
+/** What a layer wrote for the tier — an old name is named, so a person
+ *  learns the new one from the row that shows it. */
+function writtenMode(i, source) {
+    return source === "flag" ? i.modeFlag : source === "env" ? i.env.KISO_MODE : source === "project" ? i.project?.mode : source === "user" ? i.user?.mode : undefined;
+}
+function modeFrom(i, source) {
+    const w = writtenMode(i, source);
+    return w === "bypass" || w === "dontAsk" ? `${MODE_LAYER[source]} (written "${w}")` : MODE_LAYER[source];
+}
+/** The switch's layer: its own key there, or — the resolution's other
+ *  way in — that layer's tier written as the old name dontAsk. */
+function dontAskFrom(i, source) {
+    if (source === "default")
+        return "default";
+    const own = source === "flag" ? i.dontAskFlag === true : source === "env" ? envModeLayer(i.env).dontAsk !== undefined : source === "project" ? i.project?.dontAsk !== undefined : i.user?.dontAsk !== undefined;
+    if (own)
+        return source === "flag" ? "--dont-ask" : source === "env" ? "env KISO_DONT_ASK" : MODE_LAYER[source];
+    return `${MODE_LAYER[source]} (written "dontAsk")`;
+}
+function modeLayers(i) {
+    return {
+        flag: { ...(i.modeFlag !== undefined ? { mode: i.modeFlag } : {}), ...(i.dontAskFlag === true ? { dontAsk: true } : {}) },
+        env: envModeLayer(i.env),
+        project: i.project,
+        user: i.user,
+    };
+}
 function modeRow(i) {
     const change = "/mode or shift+tab; \"mode\" in ~/.kiso/config.json";
-    const from = i.modeFlag === i.mode
-        ? "--mode"
-        : i.env.KISO_MODE === i.mode
-            ? "env KISO_MODE"
-            : i.project?.mode === i.mode
-                ? "project config"
-                : i.user?.mode === i.mode
-                    ? "user config"
-                    : i.mode === "default"
-                        ? "default"
-                        : "set in this session";
+    // the layers decided at start-up; a live tier they do not explain was
+    // set in this session
+    const resolved = resolveModeLayers(modeLayers(i));
+    const from = parseMode(i.mode)?.mode === resolved.mode ? modeFrom(i, resolved.from.mode) : "set in this session";
     return { name: "mode", value: i.mode, from, change };
 }
+function dontAskRow(i) {
+    const change = "/dont-ask; --dont-ask; \"dontAsk\": true in ~/.kiso/config.json";
+    const on = i.dontAsk === true;
+    const resolved = resolveModeLayers(modeLayers(i));
+    const from = (resolved.dontAsk !== "off") === on ? dontAskFrom(i, resolved.from.dontAsk) : "set in this session";
+    return { name: "don't ask", value: on ? "on — what would ask is refused" : "off", from, change };
+}
 function modelRow(i) {
     const change = "/model; \"model\" in ~/.kiso/config.json";
     const p = i.model.profile;
@@ -50,6 +79,7 @@ export function settingsRows(i) {
     const rows = [
         modelRow(i),
         modeRow(i),
+        dontAskRow(i),
         themeRow(i),
         {
             name: "floor",