@vincemakes/kiso-code 0.45.3 → 0.46.1

package/dist/mode.d.ts

@@ -1,5 +1,5 @@
 /**
- * Modes — the six built-in approval tiers, built ON the E1 policy chain
+ * Modes — the built-in approval tiers, built ON the E1 policy chain
  * (the kernel is untouched). Each tier is an in-process "mode:<name>"
  * extension whose decide() is live — it only speaks when it is the
  * CURRENT tier (otherwise abstain = no opinion, ADR-0042), so /mode
@@ -7,19 +7,37 @@
  * field: an automated denial records decidedBy: "mode:<name>" — the
  * audit sell. User-level extensions stay on the chain AFTER the mode
  * tiers; a user deny always wins (the chain's deny>allow>ask
- * monotonicity — bypass cannot override an extension deny).
+ * monotonicity — full-access cannot override an extension deny).
+ *
+ * Two questions, two settings (the modes round, 2026-09-30). The TIER
+ * answers what the agent may do. The DON'T-ASK SWITCH answers whether
+ * kiso may stop for a person, and it composes with every tier: it never
+ * grants anything — what would ask is refused, a model's question is not
+ * offered, an uncertain execution stays uncertain. The old `dontAsk` tier
+ * was that switch welded to default's authority; it is still accepted,
+ * and means exactly that.
  */
 import type { KisoExtension } from "@vincemakes/kiso-runtime";
-export type Mode = "manual" | "default" | "accept-edits" | "plan" | "bypass" | "dontAsk";
-/** Every tier kiso ACCEPTS — from a config, KISO_MODE, --mode, or
- *  `/mode <name>`. */
+export type Mode = "manual" | "default" | "accept-edits" | "plan" | "full-access";
+/** Every tier kiso decides with. */
 export declare const MODES: readonly Mode[];
-/** The tiers kiso OFFERS a person (launch-weekend plan §2): the picker,
- *  shift+tab, the printed list, the help. `manual` left the offer — a
- *  saved allow outranks its ask, so "asks for every tool" was never
- *  quite what it did — and stays accepted, so no config that names it
- *  breaks. `dontAsk` joined: the unattended tier. */
+/** The tiers kiso OFFERS a person: the picker, shift+tab, the printed
+ *  list, the help. `manual` left the offer at 0.40.0 — a saved allow
+ *  outranks its ask, so "asks for every tool" was never quite what it
+ *  did — and stays accepted, so no config that names it breaks. */
 export declare const OFFERED_MODES: readonly Mode[];
+/** What a person reads for each tier — the status row, the picker, the
+ *  notices. The typed value (config, --mode, KISO_MODE) keeps its hyphen. */
+export declare const MODE_LABEL: Readonly<Record<Mode, string>>;
+/** One tier plus, for the one spelling that carried it, the switch. */
+export interface ModeSetting {
+    readonly mode: Mode;
+    readonly dontAsk?: true;
+}
+/** Every value a config, KISO_MODE, --mode or `/mode <name>` accepts. */
+export declare const MODE_VALUES: readonly string[];
+/** A typed tier: its value, its label ("full access"), or an old name. */
+export declare function parseMode(raw: string): ModeSetting | undefined;
 /** DC-36 — one line per tier, for the picker, TRANSCRIBED FROM decide()
  *  below rather than written fresh. A description that drifts from the
  *  behaviour is worse than none: this is the row a human reads before
@@ -34,21 +52,76 @@ export declare const OFFERED_MODES: readonly Mode[];
  *  is unchanged; the copy was the thing that was wrong. `plan` needs no
  *  qualification because it DENIES, and a deny is what nothing overrides. */
 export declare const MODE_NOTE: Readonly<Record<Mode, string>>;
+/** The switch in one line, for a surface that describes it, under the
+ *  same 60-column rule. The /mode panel does not offer it: don't ask is
+ *  not a tier, so it never sits beside them (owner, 2026-09-30) — the
+ *  panel's header names it when it is on. */
+export declare const DONT_ASK_NOTE = "never asks: what would ask is refused and the run goes on";
+/** The switch. "old-name" is a switch that arrived bundled with the old
+ *  `dontAsk` tier: it leaves with the tier, as leaving dontAsk always
+ *  gave the asks back. A switch set on its own ("on") outlives every tier
+ *  change. */
+export type DontAskState = "off" | "on" | "old-name";
 export declare function getMode(): Mode;
+/** A tier switch. The switch stays as it is — unless it came with the
+ *  old dontAsk tier, which this switch leaves. */
 export declare function setMode(m: Mode): void;
-/** The startup mode from env: KISO_MODE, or undefined when unset (the
- *  config layer's mode then applies — merge round B; the --mode flag is
- *  applied by main before the first createCodingAgent and wins over everything). */
-export declare function modeFromEnv(): Mode | undefined;
-/** The six built-in mode tiers as chain extensions — named "mode:<tier>"
+/** A typed tier, old names included: `/mode dontAsk` is default with the
+ *  switch on, exactly the tier it used to be. */
+export declare function applyModeSetting(s: ModeSetting): void;
+/** Whether kiso may stop for a person — every ask endpoint reads this. */
+export declare function getDontAsk(): boolean;
+export declare function setDontAsk(on: boolean): void;
+/** The tier as the status row and the notices name it, with the switch
+ *  beside it when it is on. */
+export declare function modeDisplay(): string;
+/** One layer's say: what a config file, the environment or the command
+ *  line wrote. KisoConfig is one of these. */
+export interface ModeLayer {
+    readonly mode?: string | undefined;
+    readonly dontAsk?: boolean | undefined;
+}
+export type ModeSource = "flag" | "env" | "project" | "user" | "default";
+export interface ModeState {
+    readonly mode: Mode;
+    readonly dontAsk: DontAskState;
+    /** the layer each answer came from — /settings names it */
+    readonly from: {
+        readonly mode: ModeSource;
+        readonly dontAsk: ModeSource;
+    };
+}
+/** KISO_MODE and KISO_DONT_ASK. A value kiso cannot read is no value —
+ *  the next layer decides, as an unknown KISO_MODE always did. */
+export declare function envModeLayer(env?: Readonly<Record<string, string | undefined>>): ModeLayer;
+/**
+ * Precedence: flag > env > project config > user config > default, for
+ * each answer on its own. The tier comes from the highest layer that
+ * names a readable one. The switch comes from the highest layer that
+ * either sets it (`--dont-ask`, KISO_DONT_ASK, "dontAsk": true|false) or
+ * WON THE TIER with the old name `dontAsk` — an old name's switch counts
+ * only where that old name decided the tier. So every combination of old
+ * spellings resolves as it did when dontAsk was a tier: a user config
+ * saying "dontAsk" under `--mode bypass` still asks, because --mode won.
+ */
+export declare function resolveModeLayers(layers: {
+    readonly flag?: ModeLayer | null | undefined;
+    readonly env?: ModeLayer | null | undefined;
+    readonly project?: ModeLayer | null | undefined;
+    readonly user?: ModeLayer | null | undefined;
+}): ModeState;
+/** Put a resolved state in force — startup, and again once the project
+ *  config is known. */
+export declare function applyModeState(s: ModeState): void;
+/** The built-in mode tiers as chain extensions — named "mode:<tier>"
  *  so the runtime's decidedBy records exactly that (the runtime derives
  *  approvalPolicies from extensions[].approvals, tagging each with the
  *  extension name). The CURRENT tier is first: an all-allow chain records
  *  decidedBy = the FIRST SPEAKER, so an auto-allow under the startup mode
  *  names that mode honestly. Order never affects verdicts — the chain is
  *  deny>allow>ask over the SPEAKING verdicts (abstain = no opinion), so a
- *  user extension's deny wins over any mode tier, bypass included (the
- *  monotonicity e2e pins it). */
+ *  user extension's deny wins over any mode tier, full-access included
+ *  (the monotonicity e2e pins it). */
 export declare function modeExtensions(workspaceRoot?: () => string): readonly KisoExtension[];
 /** The plan tier's system prompt addition — injected at startup when the
  *  initial mode is plan (the session prompt is fixed at creation; runtime

package/dist/mode.js

@@ -1,5 +1,5 @@
 /**
- * Modes — the six built-in approval tiers, built ON the E1 policy chain
+ * Modes — the built-in approval tiers, built ON the E1 policy chain
  * (the kernel is untouched). Each tier is an in-process "mode:<name>"
  * extension whose decide() is live — it only speaks when it is the
  * CURRENT tier (otherwise abstain = no opinion, ADR-0042), so /mode
@@ -7,18 +7,52 @@
  * field: an automated denial records decidedBy: "mode:<name>" — the
  * audit sell. User-level extensions stay on the chain AFTER the mode
  * tiers; a user deny always wins (the chain's deny>allow>ask
- * monotonicity — bypass cannot override an extension deny).
+ * monotonicity — full-access cannot override an extension deny).
+ *
+ * Two questions, two settings (the modes round, 2026-09-30). The TIER
+ * answers what the agent may do. The DON'T-ASK SWITCH answers whether
+ * kiso may stop for a person, and it composes with every tier: it never
+ * grants anything — what would ask is refused, a model's question is not
+ * offered, an uncertain execution stays uncertain. The old `dontAsk` tier
+ * was that switch welded to default's authority; it is still accepted,
+ * and means exactly that.
  */
 import { isProtectedWrite } from "./protected-writes.js";
-/** Every tier kiso ACCEPTS — from a config, KISO_MODE, --mode, or
- *  `/mode <name>`. */
-export const MODES = ["manual", "default", "accept-edits", "plan", "bypass", "dontAsk"];
-/** The tiers kiso OFFERS a person (launch-weekend plan §2): the picker,
- *  shift+tab, the printed list, the help. `manual` left the offer — a
- *  saved allow outranks its ask, so "asks for every tool" was never
- *  quite what it did — and stays accepted, so no config that names it
- *  breaks. `dontAsk` joined: the unattended tier. */
-export const OFFERED_MODES = ["default", "accept-edits", "plan", "dontAsk", "bypass"];
+/** Every tier kiso decides with. */
+export const MODES = ["manual", "default", "accept-edits", "plan", "full-access"];
+/** The tiers kiso OFFERS a person: the picker, shift+tab, the printed
+ *  list, the help. `manual` left the offer at 0.40.0 — a saved allow
+ *  outranks its ask, so "asks for every tool" was never quite what it
+ *  did — and stays accepted, so no config that names it breaks. */
+export const OFFERED_MODES = ["default", "accept-edits", "plan", "full-access"];
+/** What a person reads for each tier — the status row, the picker, the
+ *  notices. The typed value (config, --mode, KISO_MODE) keeps its hyphen. */
+export const MODE_LABEL = {
+    manual: "manual",
+    default: "default",
+    "accept-edits": "accept edits",
+    plan: "plan",
+    "full-access": "full access",
+};
+/** Every spelling kiso ever accepted keeps its meaning. `bypass` is
+ *  full-access's old name. `dontAsk` was a tier: default's decisions with
+ *  the switch on — so it still means that, and never full-access with the
+ *  switch on (read that way, an old config would gain authority nobody
+ *  gave it). */
+const OLD_NAMES = new Map([
+    ["bypass", { mode: "full-access" }],
+    ["dontAsk", { mode: "default", dontAsk: true }],
+]);
+/** Every value a config, KISO_MODE, --mode or `/mode <name>` accepts. */
+export const MODE_VALUES = [...MODES, ...OLD_NAMES.keys()];
+/** A typed tier: its value, its label ("full access"), or an old name. */
+export function parseMode(raw) {
+    const s = raw.trim();
+    const m = MODES.find((x) => x === s || MODE_LABEL[x] === s);
+    if (m !== undefined)
+        return { mode: m };
+    return OLD_NAMES.get(s);
+}
 /** DC-36 — one line per tier, for the picker, TRANSCRIBED FROM decide()
  *  below rather than written fresh. A description that drifts from the
  *  behaviour is worse than none: this is the row a human reads before
@@ -41,25 +75,95 @@ export const MODE_NOTE = {
     default: "read-only runs; the rest asks — a saved allow still allows",
     "accept-edits": "read-only, edits run; rest asks — a saved allow still allows",
     plan: "reads run; all else is denied — read-only, and a deny wins",
-    bypass: "everything runs, nothing asks — a user deny still wins",
-    dontAsk: "asks nothing: an ask is denied — a saved allow still allows",
+    "full-access": "runs without asking — a user deny and the floor still win",
 };
+/** The switch in one line, for a surface that describes it, under the
+ *  same 60-column rule. The /mode panel does not offer it: don't ask is
+ *  not a tier, so it never sits beside them (owner, 2026-09-30) — the
+ *  panel's header names it when it is on. */
+export const DONT_ASK_NOTE = "never asks: what would ask is refused and the run goes on";
 /** The read-only tool set (plan): reading is allowed, everything else
  *  denied with the guiding reason. */
 const READ_TOOLS = new Set(["read_file", "list_dir", "search_text", "read_skill"]);
+/** ADR-0058 (3b, D2): stopping a task this session started asks no one —
+ *  stopping is the safe direction — in every tier but manual. */
+const STOP_TOOLS = new Set(["task_stop"]);
 let current = "default";
+let dontAsk = "off";
 export function getMode() {
     return current;
 }
+/** A tier switch. The switch stays as it is — unless it came with the
+ *  old dontAsk tier, which this switch leaves. */
 export function setMode(m) {
     current = m;
+    if (dontAsk === "old-name")
+        dontAsk = "off";
+}
+/** A typed tier, old names included: `/mode dontAsk` is default with the
+ *  switch on, exactly the tier it used to be. */
+export function applyModeSetting(s) {
+    setMode(s.mode);
+    if (s.dontAsk === true && dontAsk === "off")
+        dontAsk = "old-name";
+}
+/** Whether kiso may stop for a person — every ask endpoint reads this. */
+export function getDontAsk() {
+    return dontAsk !== "off";
+}
+export function setDontAsk(on) {
+    dontAsk = on ? "on" : "off";
+}
+/** The tier as the status row and the notices name it, with the switch
+ *  beside it when it is on. */
+export function modeDisplay() {
+    return `${current === "plan" ? "plan (read-only)" : MODE_LABEL[current]}${dontAsk !== "off" ? " · don't ask" : ""}`;
+}
+/** KISO_MODE and KISO_DONT_ASK. A value kiso cannot read is no value —
+ *  the next layer decides, as an unknown KISO_MODE always did. */
+export function envModeLayer(env = process.env) {
+    const raw = env.KISO_DONT_ASK?.trim().toLowerCase();
+    const on = raw === "1" || raw === "true" || raw === "on" ? true : raw === "0" || raw === "false" || raw === "off" ? false : undefined;
+    return { ...(env.KISO_MODE !== undefined ? { mode: env.KISO_MODE } : {}), ...(on !== undefined ? { dontAsk: on } : {}) };
+}
+/**
+ * Precedence: flag > env > project config > user config > default, for
+ * each answer on its own. The tier comes from the highest layer that
+ * names a readable one. The switch comes from the highest layer that
+ * either sets it (`--dont-ask`, KISO_DONT_ASK, "dontAsk": true|false) or
+ * WON THE TIER with the old name `dontAsk` — an old name's switch counts
+ * only where that old name decided the tier. So every combination of old
+ * spellings resolves as it did when dontAsk was a tier: a user config
+ * saying "dontAsk" under `--mode bypass` still asks, because --mode won.
+ */
+export function resolveModeLayers(layers) {
+    const order = [
+        ["flag", layers.flag],
+        ["env", layers.env],
+        ["project", layers.project],
+        ["user", layers.user],
+    ];
+    let tier = { setting: { mode: "default" }, from: "default" };
+    for (const [from, layer] of order) {
+        const setting = layer?.mode === undefined ? undefined : parseMode(layer.mode);
+        if (setting !== undefined) {
+            tier = { setting, from };
+            break;
+        }
+    }
+    for (const [from, layer] of order) {
+        if (layer?.dontAsk !== undefined)
+            return { mode: tier.setting.mode, dontAsk: layer.dontAsk ? "on" : "off", from: { mode: tier.from, dontAsk: from } };
+        if (from === tier.from && tier.setting.dontAsk === true)
+            return { mode: tier.setting.mode, dontAsk: "old-name", from: { mode: tier.from, dontAsk: from } };
+    }
+    return { mode: tier.setting.mode, dontAsk: "off", from: { mode: tier.from, dontAsk: "default" } };
 }
-/** The startup mode from env: KISO_MODE, or undefined when unset (the
- *  config layer's mode then applies — merge round B; the --mode flag is
- *  applied by main before the first createCodingAgent and wins over everything). */
-export function modeFromEnv() {
-    const raw = process.env.KISO_MODE;
-    return MODES.find((x) => x === raw);
+/** Put a resolved state in force — startup, and again once the project
+ *  config is known. */
+export function applyModeState(s) {
+    current = s.mode;
+    dontAsk = s.dontAsk;
 }
 /** The per-tier verdict for a tool call — only when this tier is current. */
 function tierVerdict(tier, call, workspaceRoot) {
@@ -68,14 +172,13 @@ function tierVerdict(tier, call, workspaceRoot) {
     switch (tier) {
         case "manual":
             return { action: "ask" }; // every tool asks
-        // dontAsk decides exactly as default does. What makes it dontAsk is
-        // what happens to the chain's final ASK: the CLI denies it at the
-        // ask endpoint instead of asking (chat.ts). Not a tier deny — that
-        // would outrank every allow, and a saved allow and the read-only
-        // shell allow must still allow.
+        // The don't-ask switch changes no tier's decision. What it changes is
+        // what happens to the chain's final ASK: the CLI denies it at the ask
+        // endpoint instead of asking (chat.ts). Not a tier deny — that would
+        // outrank every allow, and a saved allow and the read-only shell allow
+        // must still allow.
         case "default":
-        case "dontAsk":
-            if (READ_TOOLS.has(call.name))
+            if (READ_TOOLS.has(call.name) || STOP_TOOLS.has(call.name))
                 return { action: "allow" };
             if (call.name === "write_file" || call.name === "edit_file" || call.name === "shell")
                 return { action: "ask" };
@@ -86,7 +189,7 @@ function tierVerdict(tier, call, workspaceRoot) {
             // finding: "allow"-as-no-opinion auto-approved it).
             return { action: "abstain" };
         case "accept-edits":
-            if (READ_TOOLS.has(call.name))
+            if (READ_TOOLS.has(call.name) || STOP_TOOLS.has(call.name))
                 return { action: "allow" };
             // 0.40.0: a write into .git/ or .kiso/ asks even here — both hold
             // configuration that runs (protected-writes.ts)
@@ -96,22 +199,22 @@ function tierVerdict(tier, call, workspaceRoot) {
                 return { action: "ask" };
             return { action: "abstain" }; // see "default"
         case "plan":
-            if (READ_TOOLS.has(call.name))
+            if (READ_TOOLS.has(call.name) || STOP_TOOLS.has(call.name))
                 return { action: "allow" };
             return { action: "deny", reason: "plan mode: read-only" };
-        case "bypass":
+        case "full-access":
             return { action: "allow" }; // everything — a REAL allow, never an abstain
     }
 }
-/** The six built-in mode tiers as chain extensions — named "mode:<tier>"
+/** The built-in mode tiers as chain extensions — named "mode:<tier>"
  *  so the runtime's decidedBy records exactly that (the runtime derives
  *  approvalPolicies from extensions[].approvals, tagging each with the
  *  extension name). The CURRENT tier is first: an all-allow chain records
  *  decidedBy = the FIRST SPEAKER, so an auto-allow under the startup mode
  *  names that mode honestly. Order never affects verdicts — the chain is
  *  deny>allow>ask over the SPEAKING verdicts (abstain = no opinion), so a
- *  user extension's deny wins over any mode tier, bypass included (the
- *  monotonicity e2e pins it). */
+ *  user extension's deny wins over any mode tier, full-access included
+ *  (the monotonicity e2e pins it). */
 export function modeExtensions(workspaceRoot = () => process.cwd()) {
     return [...MODES.filter((m) => m === current), ...MODES.filter((m) => m !== current)].map((m) => ({
         name: `mode:${m}`,

package/dist/preferences.d.ts

@@ -1,6 +1,10 @@
+import type { ModelProfile } from "./config.js";
 export interface Preferences {
     /** ctrl+t: the thinking blocks as one italic line each. Absent = shown. */
     readonly thinking?: "shown" | "hidden";
+    /** B1: the effort last picked for each profile (`/model <p> <e>`, or the
+     *  panel with a level) — where a NEW session of that profile starts. */
+    readonly effort?: Readonly<Record<string, string>>;
 }
 export declare function preferencesPath(home?: string): string;
 /** Startup: read the file, and keep choices made from here on in it. */
@@ -10,5 +14,15 @@ export declare function preferences(): Preferences;
 /** Remember a choice. Returns false when no file was named. The file is
  *  re-read before the write, so another process's choice is kept. */
 export declare function setPreference<K extends keyof Preferences>(key: K, value: NonNullable<Preferences[K]>): boolean;
+/** B1: remember an explicit effort pick for a profile. */
+export declare function rememberEffort(profile: string, effort: string): boolean;
+/**
+ * B1: the effort a NEW session of `profile` starts at, from the one last
+ * picked — the picker's fallback: the level itself when the model has it,
+ * else the endpoint's registry default, else none (default/default, no
+ * reasoning key). Only a level that resolves for the model is returned, so
+ * the session never carries a setting its first request would refuse.
+ */
+export declare function startingEffort(profile: Pick<ModelProfile, "model" | "baseUrl">, remembered: string | undefined): string | null;
 /** Tests: back to the state before startup. */
 export declare function resetPreferences(): void;

package/dist/preferences.js

@@ -3,8 +3,8 @@
  * `<KISO_HOME>/preferences.json`.
  *
  * `config.json` is the human's file: kiso reads it and never writes it. A
- * choice made with a key — ctrl+t's thinking display, today the only one —
- * has to survive a restart, so it lands here instead: kiso-owned, private
+ * choice made with a key — ctrl+t's thinking display, and (B1) the effort
+ * last picked for each profile — has to survive a restart, so it lands here instead: kiso-owned, private
  * (0600, tmp + rename), and read back at start-up. A missing or unreadable
  * file is an empty one; an unknown value is ignored rather than guessed.
  *
@@ -14,6 +14,7 @@
  */
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
+import { lookupModelMetadata, resolveReasoning } from "@vincemakes/kiso-runtime/internal";
 import { kisoHome } from "./state.js";
 let prefs = null;
 let prefsPath = null;
@@ -23,7 +24,15 @@ export function preferencesPath(home = kisoHome()) {
 function read(path) {
     try {
         const raw = JSON.parse(readFileSync(path, "utf8"));
-        return raw.thinking === "shown" || raw.thinking === "hidden" ? { thinking: raw.thinking } : {};
+        const out = {};
+        if (raw.thinking === "shown" || raw.thinking === "hidden")
+            out.thinking = raw.thinking;
+        if (raw.effort !== null && typeof raw.effort === "object" && !Array.isArray(raw.effort)) {
+            const effort = Object.fromEntries(Object.entries(raw.effort).filter((e) => typeof e[1] === "string"));
+            if (Object.keys(effort).length > 0)
+                out.effort = effort;
+        }
+        return out;
     }
     catch {
         return {};
@@ -57,6 +66,28 @@ export function setPreference(key, value) {
     }
     return true;
 }
+/** B1: remember an explicit effort pick for a profile. */
+export function rememberEffort(profile, effort) {
+    return setPreference("effort", { ...(preferences().effort ?? {}), [profile]: effort });
+}
+/**
+ * B1: the effort a NEW session of `profile` starts at, from the one last
+ * picked — the picker's fallback: the level itself when the model has it,
+ * else the endpoint's registry default, else none (default/default, no
+ * reasoning key). Only a level that resolves for the model is returned, so
+ * the session never carries a setting its first request would refuse.
+ */
+export function startingEffort(profile, remembered) {
+    if (remembered === undefined || remembered === "default")
+        return null;
+    const effort = lookupModelMetadata(profile.model, profile.baseUrl)?.capabilities.reasoning?.effort ?? null;
+    if (effort === null)
+        return null;
+    const legal = (level) => resolveReasoning(profile.model, { thinking: "default", effort: level }, profile.baseUrl).ok;
+    if (effort.levels.includes(remembered) && legal(remembered))
+        return remembered;
+    return effort.default !== null && legal(effort.default) ? effort.default : null;
+}
 /** Tests: back to the state before startup. */
 export function resetPreferences() {
     prefs = null;

package/dist/protected-shell.js

@@ -35,10 +35,10 @@
  * guarantee is the sandbox, which stays post-launch.
  */
 import { readdirSync, realpathSync, statSync } from "node:fs";
-import { basename, dirname, resolve } from "node:path";
+import { basename } from "node:path";
 import { protectedIdentity, PROTECTED_REFUSAL } from "@vincemakes/kiso-tools-node";
 import { innerLines, unwrap } from "./floor.js";
-import { parseShellLooseChecked } from "./shell-words.js";
+import { hostDialect, msysPath, parseShellLooseChecked, resolveShellPath } from "./shell-words.js";
 const ABSTAIN = { action: "abstain" };
 /** How deep `sh -c`/`eval` lines are followed, and how many are read. */
 const MAX_INNER_DEPTH = 16;
@@ -104,7 +104,8 @@ function globRegex(glob) {
     // case-folded: on a disk that folds case, `.KISO/*` is the same directory
     return new RegExp(`^${re}$`, "i");
 }
-function probeFor(id) {
+function probeFor(id, { msys, path }) {
+    const { basename, dirname, join } = path;
     const files = new Set();
     const dirs = new Set();
     const targets = [];
@@ -115,7 +116,7 @@ function probeFor(id) {
         try {
             for (const name of readdirSync(dir))
                 if (name.startsWith(`${base}.`))
-                    targets.push(`${dir}/${name}`);
+                    targets.push(msys ? join(dir, name) : `${dir}/${name}`);
         }
         catch {
             // no directory yet — nothing in it to serve
@@ -139,8 +140,10 @@ function probeFor(id) {
 export function protectedShellCheck(line, workspaceRoot, id, env) {
     if (id.paths.length === 0)
         return { hit: false };
-    const probe = probeFor(id);
-    const names = id.paths.map((p) => basename(p).toLowerCase());
+    const dialect = hostDialect();
+    const P = dialect.path;
+    const probe = probeFor(id, dialect);
+    const names = id.paths.map((p) => P.basename(p).toLowerCase());
     const paths = id.paths.map((p) => p.toLowerCase());
     const namesProtected = (t) => {
         const low = t.toLowerCase();
@@ -168,7 +171,17 @@ export function protectedShellCheck(line, workspaceRoot, id, env) {
         seenStat.set(p, st);
         return st;
     };
-    const at = (cwd, t) => (t.startsWith("/") ? t : `${cwd}/${t}`);
+    // on Windows the system normalizes a path lexically before it opens it,
+    // so the lexical resolution is what a command opens there
+    const at = (cwd, t) => (dialect.msys ? P.resolve(cwd, t) : t.startsWith("/") ? t : `${cwd}/${t}`);
+    /** Windows P2: a word as Git Bash's command sees the path — or null
+     *  when it cannot be read (only its spelling can be checked). */
+    const native = (t) => {
+        if (!dialect.msys)
+            return t;
+        const read = msysPath(t);
+        return "opaque" in read ? null : read.native;
+    };
     const regexes = new Map();
     const realOf = new Map();
     /** Whether a word's last component is a protected file's name, or one
@@ -183,12 +196,15 @@ export function protectedShellCheck(line, workspaceRoot, id, env) {
         return out.replace(/\$\{KISO_HOME\}|\$KISO_HOME(?![A-Za-z0-9_])/g, env.kisoHome);
     };
     /** One literal-or-glob path text, read from each candidate directory. */
-    const pathHits = (t, s) => {
-        if (t === "")
+    const pathHits = (word, s) => {
+        if (word === "")
             return false;
-        if (/[$`]/.test(t))
-            return namesProtected(t);
-        if (s.lossy && !t.startsWith("/") && namesProtected(t))
+        if (/[$`]/.test(word))
+            return namesProtected(word);
+        const t = native(word);
+        if (t === null)
+            return namesProtected(word);
+        if (s.lossy && !P.isAbsolute(t) && namesProtected(t))
             return true;
         const glob = /[*?[]/.test(t);
         for (const cwd of s.cwds) {
@@ -198,13 +214,31 @@ export function protectedShellCheck(line, workspaceRoot, id, env) {
                 // not exist yet) — only when the last component could be the
                 // file's name — then by inode
                 if (named(t)) {
-                    const spelled = resolve(cwd, t).toLowerCase();
+                    const spelled = P.resolve(cwd, t).toLowerCase();
                     if (paths.some((pf) => spelled === pf || spelled.startsWith(`${pf}.`)))
                         return true;
                 }
                 const st = statAt(at(cwd, t));
                 if (st?.isFile() === true && probe.files.has(inode(st)))
                     return true;
+                if (dialect.msys && t.split("/").includes("..")) {
+                    // Windows: the lexical reading above, and — for a `..`, where
+                    // they can differ — the real-path one; a `..` after a link the
+                    // two read apart falls back to names. One more reading charged.
+                    charge();
+                    const real = resolveShellPath(cwd, cwd, t, dialect);
+                    if (real.opaque !== undefined) {
+                        if (namesProtected(t))
+                            return true;
+                        continue;
+                    }
+                    const low = real.canonical.toLowerCase();
+                    if (paths.some((pf) => low === pf || low.startsWith(`${pf}.`)))
+                        return true;
+                    const rst = statAt(real.canonical);
+                    if (rst?.isFile() === true && probe.files.has(inode(rst)))
+                        return true;
+                }
                 continue;
             }
             const g = t.search(/[*?[]/);
@@ -232,11 +266,14 @@ export function protectedShellCheck(line, workspaceRoot, id, env) {
                 }
                 realOf.set(dirText, real);
             }
-            const pattern = `${real.endsWith("/") ? real : `${real}/`}${rest}`;
+            // Windows: one separator, one case, on both sides of the match
+            const fold = (p) => (dialect.msys ? p.replace(/\\/g, "/").toLowerCase() : p);
+            const dirReal = fold(real);
+            const pattern = `${dirReal.endsWith("/") ? dirReal : `${dirReal}/`}${dialect.msys ? rest.toLowerCase() : rest}`;
             let re = regexes.get(pattern);
             if (re === undefined)
                 regexes.set(pattern, (re = globRegex(pattern)));
-            if (probe.targets.some((p) => re.test(p)))
+            if (probe.targets.some((p) => re.test(fold(p))))
                 return true;
         }
         return false;
@@ -255,8 +292,11 @@ export function protectedShellCheck(line, workspaceRoot, id, env) {
     /** A directory holding a protected file — the file's own, or any
      *  directory above it — by inode. */
     const holds = (w, s) => {
-        const t = expand(w.text, w.tilde);
-        if (t === "" || /[$`*?[]/.test(t) || (w.tilde && /^~[^/]/.test(w.text)))
+        const spelled = expand(w.text, w.tilde);
+        if (spelled === "" || /[$`*?[]/.test(spelled) || (w.tilde && /^~[^/]/.test(w.text)))
+            return false;
+        const t = native(spelled);
+        if (t === null)
             return false;
         return s.cwds.some((cwd) => {
             charge();
@@ -334,8 +374,9 @@ export function protectedShellCheck(line, workspaceRoot, id, env) {
                 else if (to === undefined)
                     s.pending = [env.home];
                 else {
-                    const t = expand(to.text, to.tilde);
-                    if (/[$`*?[]/.test(t) || (to.tilde && /^~[^/]/.test(to.text))) {
+                    const spelled = expand(to.text, to.tilde);
+                    const t = native(spelled);
+                    if (t === null || /[$`*?[]/.test(spelled) || (to.tilde && /^~[^/]/.test(to.text))) {
                         s.lossy = true;
                         s.pending = cap(s, [env.home, ...s.cwds]);
                     }

package/dist/protected-writes.d.ts

@@ -12,8 +12,8 @@
  * So a write_file or edit_file whose path — as written, or once symlinks
  * are followed — passes through a `.git` or `.kiso` directory asks in
  * every asking tier: accept-edits' allow does not cover it, and neither
- * does a saved allow. dontAsk therefore denies it; plan denies it anyway;
- * bypass runs it, as bypass's shell could.
+ * does a saved allow. With the don't-ask switch on it is therefore denied;
+ * plan denies it anyway; full-access runs it, as full-access's shell could.
  */
 import type { PolicyCall } from "@vincemakes/kiso-core";
 import type { KisoExtension } from "@vincemakes/kiso-runtime";

package/dist/protected-writes.js

@@ -12,8 +12,8 @@
  * So a write_file or edit_file whose path — as written, or once symlinks
  * are followed — passes through a `.git` or `.kiso` directory asks in
  * every asking tier: accept-edits' allow does not cover it, and neither
- * does a saved allow. dontAsk therefore denies it; plan denies it anyway;
- * bypass runs it, as bypass's shell could.
+ * does a saved allow. With the don't-ask switch on it is therefore denied;
+ * plan denies it anyway; full-access runs it, as full-access's shell could.
  */
 import { relative, sep } from "node:path";
 import { resolveShellPath } from "./shell-words.js";