@vincemakes/kiso-code 0.45.3 → 0.46.1

package/dist/floor.js

@@ -42,8 +42,8 @@
  */
 import { existsSync, statSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
-import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
-import { HOME_SUBTREES, looseCommands, parseShellLooseChecked, resolveShellPath } from "./shell-words.js";
+import { basename, resolve, win32 } from "node:path";
+import { homeSubtrees, hostDialect, looseCommands, msysPath, parseShellLooseChecked, resolveShellPath } from "./shell-words.js";
 /** R8 (the lead's ruling): a system root AND everything inside it. */
 const SYSTEM_ROOTS = [
     "/bin", "/boot", "/dev", "/etc", "/lib", "/lib64", "/opt", "/proc", "/root", "/run", "/sbin", "/srv", "/sys", "/usr", "/var",
@@ -59,28 +59,46 @@ const TEMP_ROOTS = ["/tmp", "/private/tmp", "/var/tmp", "/private/var/tmp", "/va
  *  only the prefix itself; what is inside runs (`brew` put it there and can
  *  again). */
 const SOFTWARE_PREFIXES = ["/opt/homebrew", "/usr/local", "/home/linuxbrew/.linuxbrew"];
+/** Windows P2: the same tables from the environment, never a hard-coded
+ *  user name. System roots: SystemRoot and the program and data roots;
+ *  the users root works as a mount root (it and each home in it refused);
+ *  the temp family is TEMP/TMP. Every drive root is refused in
+ *  `unrecoverable`. */
+function windowsRoots(home) {
+    const env = process.env;
+    const set = (values) => values.filter((v) => v !== undefined && v !== "");
+    return {
+        sys: set([env.SystemRoot, env.ProgramFiles, env["ProgramFiles(x86)"], env.ProgramData]),
+        mounts: [win32.dirname(home)],
+        temps: set([env.TEMP, env.TMP]),
+        prefixes: [],
+    };
+}
 /** Memoized per (workspace, home): the roots do not move within a session,
  *  and resolving forty of them cost every shell call ~4 ms. */
 const WHERE = new Map();
 function where(root, home) {
-    const key = `${root}\0${home}`;
+    const dialect = hostDialect();
+    const key = `${dialect.msys ? "msys" : "posix"}\0${root}\0${home}`;
     const hit = WHERE.get(key);
     if (hit !== undefined)
         return hit;
-    const real = (p) => resolveShellPath(root, "/", p).canonical;
+    const { join } = dialect.path;
+    const real = (p) => resolveShellPath(root, dialect.msys ? root : "/", p, dialect).canonical;
     const named = (names) => names.map((name) => ({ name, real: real(name) }));
     const rootReal = real(root);
+    const roots = dialect.msys ? windowsRoots(home) : { sys: SYSTEM_ROOTS, mounts: MOUNT_ROOTS, temps: [...TEMP_ROOTS, tmpdir()], prefixes: SOFTWARE_PREFIXES };
     const w = {
         root,
         home,
         rootReal,
         homeReal: real(home),
         gitReal: join(rootReal, ".git"),
-        sys: named(SYSTEM_ROOTS),
-        mounts: named(MOUNT_ROOTS),
-        temps: [...new Set([...TEMP_ROOTS, tmpdir()].map(real))],
-        prefixes: named(SOFTWARE_PREFIXES),
-        subtrees: HOME_SUBTREES.map((name) => ({ name, real: real(join(home, name)) })),
+        sys: named(roots.sys),
+        mounts: named(roots.mounts),
+        temps: [...new Set(roots.temps.map(real))],
+        prefixes: named(roots.prefixes),
+        subtrees: homeSubtrees().map((name) => ({ name, real: real(join(home, name)) })),
     };
     WHERE.set(key, w);
     return w;
@@ -97,27 +115,35 @@ function capCwds(w, list) {
 }
 const canon = (w, cwd, p) => resolveShellPath(w.root, cwd, p).canonical;
 const within = (parent, p) => {
+    const { relative, isAbsolute } = hostDialect().path;
     const rel = relative(parent, p);
     return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
 };
+/** The same path: case-insensitive on Windows (Windows P2). */
+const same = (a, b) => (hostDialect().msys ? a.toLowerCase() === b.toLowerCase() : a === b);
 /** Why `p` (canonical) is unrecoverable, or null. `over` is true for a
  *  wildcard over `p` rather than `p` itself — the same set, since
  *  emptying a directory is removing everything it held. */
 function unrecoverable(w, p, over) {
     const what = (s) => (over ? `a wildcard over ${s}` : s);
+    const msys = hostDialect().msys;
     if (p === "/")
         return what("/");
-    if (p === w.homeReal)
+    if (msys && win32.parse(p).root === p)
+        return what(`a drive root (${p})`);
+    if (same(p, w.homeReal))
         return what("the home directory");
-    if (p === w.rootReal)
+    if (same(p, w.rootReal))
         return what("the workspace root");
     if (within(p, w.rootReal))
         return what(`a directory above the workspace (${p})`);
     // R7: the workspace's history — without a remote, gone
     if (within(w.gitReal, p))
         return what("the workspace's .git");
+    // on Windows the temp root sits inside AppData: what is inside a temp
+    // root that lies inside the subtree runs
     for (const sub of w.subtrees)
-        if (within(sub.real, p))
+        if (within(sub.real, p) && !(msys && w.temps.some((t) => within(sub.real, t) && !same(p, t) && within(t, p))))
             return what(`~/${sub.name}`);
     // Inside the workspace or the home directory is the project's and the
     // person's, never a system root's — or a workspace in /opt, or a root
@@ -125,21 +151,21 @@ function unrecoverable(w, p, over) {
     if ((w.rootReal !== "/" && within(w.rootReal, p)) || within(w.homeReal, p))
         return null;
     for (const t of w.temps) {
-        if (p === t)
+        if (same(p, t))
             return what(`a temp root (${t})`);
         if (within(t, p))
             return null;
     }
     for (const x of w.prefixes) {
-        if (p === x.real)
+        if (same(p, x.real))
             return what(`a software prefix (${x.name})`);
         if (within(x.real, p))
             return null;
     }
     for (const m of w.mounts) {
-        if (p === m.real)
+        if (same(p, m.real))
             return what(`a system root (${m.name})`);
-        if (dirname(p) === m.real)
+        if (same(hostDialect().path.dirname(p), m.real))
             return what(`a mount or home root (${p})`);
         // deeper runs — by RESOLVED path: macOS's /home is
         // /System/Volumes/Data/home, which the /System rule would refuse
@@ -147,7 +173,7 @@ function unrecoverable(w, p, over) {
             return null;
     }
     for (const s of w.sys) {
-        if (p === s.real)
+        if (same(p, s.real))
             return what(`a system root (${s.name})`);
         if (within(s.real, p))
             return what(`a path inside a system root (${s.name})`);
@@ -169,7 +195,9 @@ function reUnknown(text, from) {
 /** One target word, from each directory the command might run in. */
 function targetWhy(w, cwds, word) {
     for (const cwd of cwds) {
-        let text = word.text;
+        // Windows P2: either separator separates (the same length, so the
+        // unknown positions hold)
+        let text = hostDialect().msys ? word.text.replace(/\\/g, "/") : word.text;
         let at = word.unknownAt;
         let glob = word.unknownIsGlob;
         let variableOnly = word.variableOnly;
@@ -189,7 +217,10 @@ function targetWhy(w, cwds, word) {
         if (variableOnly)
             return `a target that is only a variable (${word.text})`;
         if (at < 0) {
-            const why = unrecoverable(w, canon(w, cwd, text), false);
+            const target = resolveShellPath(w.root, cwd, text);
+            if (target.opaque !== undefined)
+                return `${word.text}, ${target.opaque}`;
+            const why = unrecoverable(w, target.canonical, false);
             if (why !== null)
                 return why;
             continue;
@@ -200,7 +231,10 @@ function targetWhy(w, cwds, word) {
             continue;
         const prefix = text.slice(0, at);
         const lastSlash = prefix.lastIndexOf("/");
-        const dir = canon(w, cwd, lastSlash < 0 ? "." : prefix.slice(0, lastSlash + 1) || "/");
+        const over = resolveShellPath(w.root, cwd, lastSlash < 0 ? "." : prefix.slice(0, lastSlash + 1) || "/");
+        if (over.opaque !== undefined)
+            return `a wildcard in ${word.text}, ${over.opaque}`;
+        const dir = over.canonical;
         const head = prefix.slice(lastSlash + 1); // the literal start of the unknown component
         const nextSlash = text.indexOf("/", at);
         const component = text.slice(lastSlash + 1, nextSlash < 0 ? text.length : nextSlash);
@@ -210,7 +244,7 @@ function targetWhy(w, cwds, word) {
         for (const sub of w.subtrees) {
             if (within(sub.real, dir))
                 return `a wildcard inside ~/${sub.name}`;
-            if (glob && dir === w.homeReal && head !== "" && sub.name.toLowerCase().startsWith(head.toLowerCase()))
+            if (glob && same(dir, w.homeReal) && head !== "" && sub.name.toLowerCase().startsWith(head.toLowerCase()))
                 return `a wildcard that reaches ~/${sub.name}`;
         }
         // B9: over the directory ONLY when the unknown component is nothing
@@ -318,7 +352,7 @@ const SELECTING = new Set([
 ]);
 /** R5: a checkout/restore operand is a path only when path-shaped — a
  *  branch name is never refused. */
-const pathShaped = (t) => t === "." || t === "./" || t.startsWith("/") || t.startsWith("~") || t.includes("/") || t.startsWith(":");
+const pathShaped = (t) => t === "." || t === "./" || t.startsWith("/") || t.startsWith("~") || t.includes("/") || t.startsWith(":") || (hostDialect().msys && (t.includes("\\") || /^[A-Za-z]:/.test(t)));
 /** B7: pathspec magic from the top of the repository */
 const topMagic = (t) => t.startsWith(":/") || t.startsWith(":(top");
 /** The destructive command's targets, or null when it is not destructive. */
@@ -447,7 +481,7 @@ function destructiveTargets(argv) {
 function isGitDir(p) {
     try {
         const st = statSync(p);
-        return st.isFile() || (st.isDirectory() && existsSync(join(p, "HEAD")));
+        return st.isFile() || (st.isDirectory() && existsSync(hostDialect().path.join(p, "HEAD")));
     }
     catch {
         return false;
@@ -458,6 +492,7 @@ function isGitDir(p) {
  *  inside the workspace, the workspace root; outside it, the directory
  *  itself — git would refuse to run there, and the floor does not bet on it. */
 function repoRoot(w, cwd) {
+    const { dirname, join } = hostDialect().path;
     const start = canon(w, cwd, ".");
     for (let d = start;; d = dirname(d)) {
         if (isGitDir(join(d, ".git")))
@@ -467,6 +502,16 @@ function repoRoot(w, cwd) {
     }
     return within(w.rootReal, start) ? w.rootReal : start;
 }
+/** Windows P2: where a cd to an unreadable path lands — every relative
+ *  path from it is unreadable too. */
+const UNREADABLE_DIR = "//?/unreadable";
+/** Where `cd text` from `c` lands, as the shell spells it (lexically). */
+function cdTo(c, text) {
+    if (!hostDialect().msys)
+        return resolve(c, text);
+    const read = msysPath(text);
+    return "opaque" in read || c === UNREADABLE_DIR ? UNREADABLE_DIR : win32.resolve(c, read.native);
+}
 /** A child shell starts where this node runs — the node's joiner has
  *  already been applied — and nothing it does comes back. */
 const child = (s) => ({ cwds: [...s.cwds], lastCd: null, prev: s.prev });
@@ -544,7 +589,7 @@ export function floorCheck(commandLine, workspaceRoot, home = homedir()) {
                 else if (to === undefined || to.unknownAt >= 0 || to.variableOnly)
                     dest = capCwds(w, [w.home, ...state.cwds]);
                 else
-                    dest = capCwds(w, state.cwds.map((c) => resolve(c, tilde(to))));
+                    dest = capCwds(w, state.cwds.map((c) => cdTo(c, tilde(to))));
                 state.prev = state.cwds;
                 state.lastCd = { to: dest, from };
                 continue;
@@ -554,12 +599,12 @@ export function floorCheck(commandLine, workspaceRoot, home = homedir()) {
                 continue;
             let here = state.cwds;
             for (const cd of d.cds ?? [])
-                here = cd.unknownAt >= 0 ? capCwds(w, [...here, w.home]) : here.map((c) => resolve(c, tilde(cd)));
+                here = cd.unknownAt >= 0 ? capCwds(w, [...here, w.home]) : here.map((c) => cdTo(c, tilde(cd)));
             for (const t of d.targets) {
                 let why = null;
                 if (t === "repo") {
                     for (const c of here)
-                        if ((why = unrecoverable(w, repoRoot(w, c), false)) !== null)
+                        if ((why = c === UNREADABLE_DIR ? "a repository in a directory that cannot be read" : unrecoverable(w, repoRoot(w, c), false)) !== null)
                             break;
                 }
                 else

package/dist/index.js

@@ -37,14 +37,16 @@ import { skillMenuItems } from "./skill-invoke.js";
 import { canonicalPath, hasSession, locateSession, projectLayoutActive, sessionFolders } from "./projects.js";
 import { reverseMigration } from "./session-migration.js";
 import { defaultTrashRoot, findEmptySessions, moveToTrash } from "./empty-sessions.js";
+import { browserCommand, launchCommand } from "./launch.js";
 import { createFauxProvider } from "@vincemakes/kiso-evals";
 import { isProtectedPath, protectedIdentity, PROTECTED_REFUSAL } from "@vincemakes/kiso-tools-node";
-import { MODES, OFFERED_MODES, getMode, modeFromEnv, setMode } from "./mode.js";
+import { OFFERED_MODES, applyModeState, envModeLayer, getDontAsk, modeDisplay, parseMode, resolveModeLayers } from "./mode.js";
 import { activeStoreDir, setActiveStoreDir, agentModel, atFiles, body, bodyLog, kisoHome, workspaceRoot, projectRoot, ownSessionsDir, setOpenSessionFolder, builtInExtensions, currentFaux, dock, loadedExtensions, mergedConfig, mergedTempPaths, modelChoice, projectExtensions, configModels, configuredWindow, agentBaseUrl, currentModelName, currentAgentExtensions, sessionStoreRef, sessionsDir, setAgentModel, setBody, setConfigModels, setConfiguredWindow, setCurrentAgentExtensions, setCurrentFaux, setCurrentModelName, setCurrentProfileName, setExtensionLists, protectedFiles, setMergedConfig, setModelChoice, setSessionStore, userExtensions, VERSION, lastBinding, acceptDrift, setAcceptDrift, loadedSkillsCatalog, queuedSwitchLines } from "./state.js";
 import { fauxSkip, readFauxScript } from "./faux-glue.js";
 import { chat, contextWindowTokens, displayCtxRatio, microcompactThresholdFor, statusModelLabel } from "./chat.js";
 import { preferences, usePreferences } from "./preferences.js";
-import { settingsLayers } from "./state.js";
+import { settingsLayers, setChildTurnBudget, stopAllTasks } from "./state.js";
+import { finishChild } from "./child-result.js";
 import { loadUserConfig, resolveAutoCompact } from "./config.js";
 import { checkForUpdate, knownUpdate, updateCardLines } from "./update-check.js";
 import { tmuxMouseHint } from "./tmux-hint.js";
@@ -74,14 +76,14 @@ export { applyProjectMerges } from "./trust-ui.js";
  *  path's exact semantics (auto-denied asks, no chips, no pops). */
 /** OR-4: hand a URL to the platform's opener, detached, and never let a
  *  missing or failing opener touch the sign-in — the printed URL is the
- *  path that always works. macOS `open`, Linux `xdg-open`; elsewhere the
- *  URL stays printed (Windows is unsupported by the CLI as a whole). */
+ *  path that always works. macOS `open`, Linux `xdg-open`, Windows
+ *  rundll32's URL handler (launch.ts); elsewhere the URL stays printed. */
 function openInBrowser(url) {
-    const opener = process.platform === "darwin" ? "open" : process.platform === "linux" ? "xdg-open" : null;
+    const opener = browserCommand(url);
     if (opener === null)
         return;
     try {
-        spawn(opener, [url], { detached: true, stdio: "ignore" }).unref();
+        spawn(opener[0], [...opener[1]], { detached: true, stdio: "ignore" }).unref();
     }
     catch {
         // the URL is on screen; opening it is the person's fallback
@@ -180,6 +182,9 @@ function readlineInput(rl) {
             /* §2.3: same as ctrl+o above — readline has no binding, and a
              * dock-less session has no committed rows to reprint. */
         },
+        onBackground() {
+            /* 3e: readline has no ctrl+b — /tasks and a steer still work. */
+        },
         onEditor() {
             /* §2.4: readline has no ctrl+g, and a piped session has no
              * composer to hand over. */
@@ -274,6 +279,9 @@ function editorInput(editor) {
         onThink(cb) {
             editor.onThink(cb);
         },
+        onBackground(cb) {
+            editor.onBackground(cb);
+        },
         onEditor(cb) {
             editor.onEditor(cb);
         },
@@ -488,10 +496,10 @@ function bannerExtensionText() {
     // terminal layer (extensionsBannerText — a pure function of the three
     // name lists, including the "(connecting…)" in-flight label). Which
     // lists exist is the CLI's fact and stays here.
-    // 0.40.0: in dontAsk the ask extension is loaded but offers no tool
-    // (builtin.ts offInDontAsk) — the banner says so beside the tier that
-    // turns it off, rather than listing it as if it could ask.
-    const builtIn = builtInExtensions.map((e) => (e.name === "ask" && getMode() === "dontAsk" ? { name: e.name, note: "off in dontAsk" } : e));
+    // 0.40.0: with the don't-ask switch on the ask extension is loaded but
+    // offers no tool (builtin.ts offInDontAsk) — the banner says so, rather
+    // than listing it as if it could ask.
+    const builtIn = builtInExtensions.map((e) => (e.name === "ask" && getDontAsk() ? { name: e.name, note: "off in dontAsk" } : e));
     return extensionsBannerText(builtIn, userExtensions, projectExtensions);
 }
 /** E1: the startup banner line(s) — TTY: logo + merged extensions + the
@@ -569,7 +577,7 @@ function extensionsBanner(resume = []) {
     };
     body.banner(VERSION, text.replace(/^ · /, ""), resume, {
         model: agentModel,
-        mode: getMode() === "plan" ? "plan (read-only)" : getMode(),
+        mode: modeDisplay(),
         cwd: cwd.startsWith(home) ? `~${cwd.slice(home.length)}` : cwd,
         // DC-49 — REALPATH on both sides. A symlinked HOME (or a symlinked
         // cwd) compares unequal as raw strings while being the same
@@ -808,7 +816,7 @@ function paintBootStatus(session) {
         return;
     // DF-0330-F1: the BOOT row gets the budget too — it is the same row, and
     // the opening screen is where a long model id is first seen.
-    dock.setStatus(idleStatus(getMode() === "plan" ? "plan (read-only)" : getMode(), statusModelLabel(session), displayCtxRatio(session), undefined, process.stdout.columns > 0 ? process.stdout.columns : 80));
+    dock.setStatus(idleStatus(modeDisplay(), statusModelLabel(session), displayCtxRatio(session), undefined, process.stdout.columns > 0 ? process.stdout.columns : 80));
 }
 /** PH-1a (finding PH-F12): a usage error raised from inside the TUI —
  *  main's finally still runs (dock teardown, agent close, temp cleanup)
@@ -816,6 +824,9 @@ function paintBootStatus(session) {
 class CliUsageError extends Error {
     exitCode = 2;
 }
+/** ADR-0058 3d: set when this process is a background child (its budget
+ *  and where its answer goes) — finished once its turn is done. */
+let childEnd = null;
 /** The /resume+/clear mini-spec — the chat LOOP: chat() ends with a
  *  directive; a switch re-enters it on another session with the SAME
  *  editor. First entry paints the banner; a switch paints one notice
@@ -1103,8 +1114,11 @@ async function chatLoop(first, firstId, input, autoCompact) {
             ...(process.stdin.isTTY ? { pick: () => pickSession(agent, input) } : {}),
         };
         const end = await chat(session, currentFaux, input, autoCompact, nav, seed);
-        if (end.next === "exit")
+        if (end.next === "exit") {
+            if (childEnd !== null)
+                await finishChild(session, childEnd);
             return;
+        }
         // DC-57: the lines that arrived with the switch command ride INTO the
         // next entry — they were aimed at the session being asked for.
         seed = end.lines ?? [];
@@ -1250,23 +1264,30 @@ async function main() {
         }
         args.splice(modelArgIdx, 2);
     }
-    // Modes: --mode wins over KISO_MODE, which wins over the USER config's
-    // mode (the project config's mode applies later — after the trust gate,
-    // inside createCodingAgent — unless a higher layer already decided).
+    // Modes: flag > env > project config > user config > default, for the
+    // tier and the don't-ask switch each (mode.ts resolveModeLayers). The
+    // project config exists only once the trust gate has passed, so it joins
+    // later (applyConfigMode); until then the other three decide.
+    const flagLayer = {};
     const modeFlag = args.indexOf("--mode");
     if (modeFlag !== -1) {
-        const m = MODES.find((x) => x === args[modeFlag + 1]);
-        if (m === undefined) {
-            console.error(`unknown mode: ${args[modeFlag + 1]} (tiers: ${OFFERED_MODES.join(", ")})`);
+        const raw = args[modeFlag + 1];
+        if (raw === undefined || parseMode(raw) === undefined) {
+            console.error(`unknown mode: ${raw} (tiers: ${OFFERED_MODES.join(", ")})`);
             process.exit(2);
         }
-        setMode(m);
-        settingsLayers.modeFlag = m;
+        flagLayer.mode = raw;
+        settingsLayers.modeFlag = raw;
         args.splice(modeFlag, 2);
     }
-    else {
-        setMode(modeFromEnv() ?? loadUserConfig()?.mode ?? "default");
+    const dontAskFlag = args.indexOf("--dont-ask");
+    if (dontAskFlag !== -1) {
+        flagLayer.dontAsk = true;
+        settingsLayers.dontAskFlag = true;
+        args.splice(dontAskFlag, 1);
     }
+    const modeLayers = (project) => ({ flag: flagLayer, env: envModeLayer(), project, user: loadUserConfig() });
+    applyModeState(resolveModeLayers(modeLayers(null)));
     // CX-1 F5: --task-file <path> — the file is the ONE user turn (the
     // structured child entry). Read BEFORE any session exists: an
     // unreadable file is a usage error with nothing executed.
@@ -1291,6 +1312,35 @@ async function main() {
             args.splice(i, 2);
         }
     }
+    // ADR-0058 3d: a background child's --max-turns N (its budget, D6) and
+    // --result-file <path> (where its answer goes). Child-only: without
+    // --task-file they are refused — the interactive door has no turn
+    // limit (R3e).
+    {
+        const end = {};
+        for (const flag of ["--max-turns", "--result-file"]) {
+            const i = args.indexOf(flag);
+            if (i === -1)
+                continue;
+            const value = args[i + 1];
+            if (taskFile === undefined)
+                throw new CliUsageError(`${flag} needs --task-file — it is for a delegated child only`);
+            if (value === undefined || value.startsWith("--"))
+                throw new CliUsageError(`${flag} needs a value`);
+            if (flag === "--max-turns") {
+                const n = Number(value);
+                if (!Number.isInteger(n) || n < 1)
+                    throw new CliUsageError(`--max-turns: expected a whole number of at least 1, got ${value}`);
+                end.maxTurns = n;
+            }
+            else
+                end.resultFile = value;
+            args.splice(i, 2);
+        }
+        if (end.maxTurns !== undefined || end.resultFile !== undefined)
+            childEnd = end;
+        setChildTurnBudget(end.maxTurns);
+    }
     // 0.40.0: `kiso sessions --all | --current` — the one command that takes
     // them. Parsed only there, so neither ever becomes a session id. Absent
     // = each form's default (TTY: current; pipe: all, today's bytes).
@@ -1433,10 +1483,9 @@ async function main() {
     try {
         // merge round B: the project config's mode applies AFTER the trust gate
         // (its verdict decides whether the project config exists at all) —
-        // unless a higher layer (--mode flag / KISO_MODE) already decided.
+        // under whatever a higher layer (the flags, the env) already decided.
         const applyConfigMode = () => {
-            if (modeFlag === -1 && process.env.KISO_MODE === undefined && mergedConfig.mode !== undefined)
-                setMode(mergedConfig.mode);
+            applyModeState(resolveModeLayers(modeLayers(settingsLayers.project)));
         };
         if (printPrompt !== undefined) {
             // the -p flow: recovery-first one-shot, the resume() machinery
@@ -1553,7 +1602,7 @@ async function main() {
                         console.log("kiso sessions --prune-empty --yes moves them to the Trash");
                     }
                     else
-                        console.log(`moved ${n(empty.length, "empty session")} to ${moveToTrash(empty, defaultTrashRoot())}`);
+                        console.log(`moved ${n(empty.length, "empty session")} to ${moveToTrash(empty, defaultTrashRoot(kisoHome()))}`);
                     if (inUse > 0)
                         console.log(`skipped ${n(inUse, "empty session")} in use — a live process holds the lock`);
                     break;
@@ -1719,7 +1768,9 @@ async function main() {
                 // npm's to explain; the message names the manual command so
                 // the person can run it with whatever their setup needs.
                 const [bin, ...installArgs] = INSTALL_COMMAND;
-                const r = spawnSync(bin, installArgs, { stdio: "inherit" });
+                // Windows: npm is npm.cmd — through cmd.exe (launch.ts)
+                const l = launchCommand(bin, installArgs);
+                const r = spawnSync(l.file, [...l.args], { stdio: "inherit", ...(l.windowsVerbatimArguments === true ? { windowsVerbatimArguments: true } : {}) });
                 if (r.error !== undefined || r.status !== 0) {
                     const why = r.error !== undefined ? `could not run npm (${r.error.message})` : `npm exited ${r.status ?? "on a signal"}`;
                     process.stderr.write(`kiso update: ${why} — run it yourself: ${INSTALL_COMMAND.join(" ")}\n`);
@@ -1751,7 +1802,8 @@ async function main() {
                     "  kiso help               this help\n\n" +
                     "flags (any position):\n" +
                     "  --model <profile|provider/model>   pick the model (also /model in-session)\n" +
-                    "  --mode <tier>            approval tier: default|accept-edits|plan|dontAsk|bypass\n" +
+                    "  --mode <tier>            approval tier: default|accept-edits|plan|full-access\n" +
+                    "  --dont-ask               never stop for a person: what would ask is refused\n" +
                     "  --version                print the version\n\n" +
                     "configuration:\n" +
                     "  no key                   keyless faux demo (a scripted four-round session)\n" +
@@ -1795,11 +1847,19 @@ async function main() {
         // variable now). A signal death skips this and leaves the dead-pid
         // residue — the dead-holder takeover recovers it by design
         // (ADR-0050); the lock never outlives a live writer either way.
+        // ADR-0058: a clean exit stops the session's tasks first — or, when
+        // the person chose to leave them (3e), only the moved commands. What
+        // could not be confirmed is said, never called stopped.
+        const tasksAtExit = await stopAllTasks();
         agent?.close();
         // v2b: the dock tears down on EVERY exit path — CSI r resets the
         // scroll region, the cursor lands at the input line, no broken
         // terminal (kill -9 excepted; `reset` saves it).
         dock.exit();
+        for (const id of tasksAtExit.unconfirmed)
+            console.error(`${id}: stop unconfirmed — outcome unknown`);
+        if (tasksAtExit.left.length > 0)
+            console.error(`left running: ${tasksAtExit.left.join(", ")} — reopen this session to hear how ${tasksAtExit.left.length === 1 ? "it ends" : "they end"}`);
         // finding #8 (P1): extension dispose runs on the same exit path — a
         // dispose failure prints one line and NEVER changes the exit code.
         await disposeExtensions(loadedExtensions);

package/dist/launch.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Windows P3 — how the CLI's small spawns start: `kiso update` (npm), the
+ * external editor, and the sign-in page.
+ *
+ * npm is npm.cmd and an editor is often code.cmd: a .cmd/.bat shim needs
+ * cmd.exe to start, and Node will not start one without a shell. Rather
+ * than `shell: true`, the call goes to cmd.exe itself — `/d /s /c "<line>"`
+ * — with every word quoted by `viaCmd`, the one function here (the
+ * cross-spawn rules: CommandLineToArgvW quoting, then a caret before each
+ * cmd.exe metacharacter). The shell tool never comes this way: it only
+ * ever starts bash (P1).
+ *
+ * Pure — no process is started here, so importing it moves no test into
+ * the pty pool.
+ */
+export interface Launch {
+    readonly file: string;
+    readonly args: readonly string[];
+    /** Windows: the line is cmd.exe's to parse, not Node's to requote */
+    readonly windowsVerbatimArguments?: true;
+}
+/** `bin args` as cmd.exe starts it. */
+export declare function viaCmd(bin: string, args: readonly string[], env?: NodeJS.ProcessEnv): Launch;
+/** `bin args` as this platform starts it: directly, or through cmd.exe on Windows. */
+export declare function launchCommand(bin: string, args: readonly string[]): Launch;
+/** The platform's URL opener — `rundll32`'s URL handler on Windows (cmd's
+ *  `start` would cut a sign-in URL at its first `&`) — or null, and the
+ *  URL stays printed. */
+export declare function browserCommand(url: string): readonly [string, readonly string[]] | null;

package/dist/launch.js

@@ -0,0 +1,43 @@
+/**
+ * Windows P3 — how the CLI's small spawns start: `kiso update` (npm), the
+ * external editor, and the sign-in page.
+ *
+ * npm is npm.cmd and an editor is often code.cmd: a .cmd/.bat shim needs
+ * cmd.exe to start, and Node will not start one without a shell. Rather
+ * than `shell: true`, the call goes to cmd.exe itself — `/d /s /c "<line>"`
+ * — with every word quoted by `viaCmd`, the one function here (the
+ * cross-spawn rules: CommandLineToArgvW quoting, then a caret before each
+ * cmd.exe metacharacter). The shell tool never comes this way: it only
+ * ever starts bash (P1).
+ *
+ * Pure — no process is started here, so importing it moves no test into
+ * the pty pool.
+ */
+/** cmd.exe's metacharacters: each is escaped with a caret. */
+const CMD_META = /([()\][%!^"`<>&|;, *?])/g;
+/** One argument, quoted as CommandLineToArgvW reads it, then escaped for cmd.exe. */
+function cmdArgument(arg) {
+    const quoted = `"${arg.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\*)$/, "$1$1")}"`;
+    return quoted.replace(CMD_META, "^$1");
+}
+/** `bin args` as cmd.exe starts it. */
+export function viaCmd(bin, args, env = process.env) {
+    const line = [bin.replace(CMD_META, "^$1"), ...args.map(cmdArgument)].join(" ");
+    return { file: env.ComSpec ?? "cmd.exe", args: ["/d", "/s", "/c", `"${line}"`], windowsVerbatimArguments: true };
+}
+/** `bin args` as this platform starts it: directly, or through cmd.exe on Windows. */
+export function launchCommand(bin, args) {
+    return process.platform === "win32" ? viaCmd(bin, args) : { file: bin, args };
+}
+/** The platform's URL opener — `rundll32`'s URL handler on Windows (cmd's
+ *  `start` would cut a sign-in URL at its first `&`) — or null, and the
+ *  URL stays printed. */
+export function browserCommand(url) {
+    if (process.platform === "darwin")
+        return ["open", [url]];
+    if (process.platform === "linux")
+        return ["xdg-open", [url]];
+    if (process.platform === "win32")
+        return ["rundll32", ["url.dll,FileProtocolHandler", url]];
+    return null;
+}