@vincemakes/kiso-code 0.45.3 → 0.46.1

package/dist/readonly-shell.js

@@ -32,24 +32,26 @@
  */
 import { statSync } from "node:fs";
 import { homedir } from "node:os";
-import { basename, isAbsolute, join, relative } from "node:path";
+import { join } from "node:path";
 import { isCredentialName, isCredentialPath } from "@vincemakes/kiso-tools-node";
 import { getMode } from "./mode.js";
-import { HOME_SUBTREES, parseShell, realCase, resolveShellPath } from "./shell-words.js";
+import { homeSubtrees, hostDialect, parseShell, realCase, resolveShellPath } from "./shell-words.js";
 // ── the predicates ──────────────────────────────────────────────────────
 function scope(ctx, word) {
     if (word === "-")
         return null; // stdin
     for (const cwd of ctx.cwds) {
-        const { canonical, inside } = resolveShellPath(ctx.root, cwd, word);
+        const { canonical, inside, opaque } = resolveShellPath(ctx.root, cwd, word);
+        if (opaque !== undefined)
+            return `${word} is ${opaque}`;
         if (!inside)
             return `${word} is outside the workspace`;
         // B4: under a protected directory NOTHING is read or listed unasked —
         // kiso's own home, and ~/.ssh ~/.config ~/.aws ~/.gnupg ~/.kiso when
         // the workspace is the home directory. Over-asking is an ask.
         for (const p of ctx.protectedRoots) {
-            const rel = relative(p, canonical);
-            if (rel === "" || (!rel.startsWith("..") && !isAbsolute(rel)))
+            const rel = hostDialect().path.relative(p, canonical);
+            if (rel === "" || (!rel.startsWith("..") && !hostDialect().path.isAbsolute(rel)))
                 return `${word} is inside a protected directory (${p})`;
         }
     }
@@ -59,7 +61,7 @@ function scope(ctx, word) {
  *  the file tools ask ONE rule — names (`isCredentialName`) and the
  *  directory-scoped paths (`isCredentialPath`) — on the canonical path. */
 function shellCredential(canonical) {
-    return isCredentialName(basename(canonical).toLowerCase()) || isCredentialPath(canonical);
+    return isCredentialName(hostDialect().path.basename(canonical).toLowerCase()) || isCredentialPath(canonical);
 }
 function content(ctx, word) {
     const s = scope(ctx, word);
@@ -69,11 +71,11 @@ function content(ctx, word) {
         return null;
     // B2: the disk is case-insensitive and the names are not — `.ENV` and
     // `ID_RSA` are `.env` and `id_rsa` to the file system, so to the rule
-    if (isCredentialName(basename(word).toLowerCase()))
+    if (isCredentialName(hostDialect().path.basename(word).toLowerCase()))
         return `${word} is a credential file`;
     for (const cwd of ctx.cwds) {
         const { canonical } = resolveShellPath(ctx.root, cwd, word);
-        if (isCredentialName(basename(canonical).toLowerCase()) || shellCredential(canonical))
+        if (isCredentialName(hostDialect().path.basename(canonical).toLowerCase()) || shellCredential(canonical))
             return `${word} leads to a credential file`;
     }
     return null;
@@ -552,11 +554,11 @@ export function classifyReadOnly(commandLine, workspaceRoot, protectedRoots = []
     }
     return { allow: true };
 }
-/** The modes in which a provable read runs unasked. dontAsk is one: an
- *  allow is what it still honours. Manual promises that every tool asks;
- *  plan denies shell outright; bypass allows everything already — this
- *  member has nothing to add to any of them. */
-const ALLOWING_MODES = new Set(["default", "accept-edits", "dontAsk"]);
+/** The modes in which a provable read runs unasked — with the don't-ask
+ *  switch on too: an allow is what it still honours. Manual promises that
+ *  every tool asks; plan denies shell outright; full-access allows
+ *  everything already — this member has nothing to add to any of them. */
+const ALLOWING_MODES = new Set(["default", "accept-edits"]);
 const ABSTAIN = { action: "abstain" };
 /**
  * The chain member. ALLOW or ABSTAIN, never anything else: an allow here
@@ -577,7 +579,7 @@ export function readOnlyShellExtension(roots) {
                     if (typeof command !== "string")
                         return ABSTAIN;
                     const { workspaceRoot, excludeRoots } = roots();
-                    const protectedRoots = [...excludeRoots, ...HOME_SUBTREES.map((s) => join(homedir(), s))];
+                    const protectedRoots = [...excludeRoots, ...homeSubtrees().map((s) => join(homedir(), s))];
                     return classifyReadOnly(command, workspaceRoot, protectedRoots).allow ? { action: "allow" } : ABSTAIN;
                 },
             },

package/dist/replay.js

@@ -20,6 +20,7 @@
  *     the viewer — then any uncovered earlier turns folded as above.
  */
 import { echoText } from "@vincemakes/kiso-tui-cells/render";
+import { taskNoticeRow } from "./task-notice.js";
 /** How many turns stay on screen in full. */
 const FULL_TURNS = 2;
 /** A user turn's opening line, or null when this input does not open one
@@ -61,6 +62,8 @@ function replayTurn(body, turn) {
                 const ask = askOf(e);
                 if (ask !== null)
                     body.userLine(ask);
+                else if (e.via?.kind === "tasks")
+                    body.notice(taskNoticeRow(e.via.items));
                 else if (e.source === "system") {
                     body.notice("verification pass");
                     body.notice(`  ${typeof e.content === "string" ? e.content : ""}`);

package/dist/resume.js

@@ -3,7 +3,7 @@
  * moved verbatim from index.ts.
  */
 import { idleStatus, runningStatus } from "@vincemakes/kiso-tui";
-import { getMode } from "./mode.js";
+import { modeDisplay } from "./mode.js";
 import { agentModel, dock, retryOnRow, floorOn } from "./state.js";
 import { pendingAsk, resolveUncertains } from "./trust-ui.js";
 import { failOnFauxExhaustion } from "./faux-glue.js";
@@ -37,7 +37,7 @@ export async function resume(session, prompt, faux, input) {
         // same budget. It has no meter, so nothing here can be dropped that
         // was not already at risk of being cut.
         if (dock.active)
-            dock.setStatus(idleStatus(getMode(), agentModel, estimateCtxRatio(session), undefined, process.stdout.columns > 0 ? process.stdout.columns : 80, !floorOn));
+            dock.setStatus(idleStatus(modeDisplay(), agentModel, estimateCtxRatio(session), undefined, process.stdout.columns > 0 ? process.stdout.columns : 80, !floorOn));
     };
     const withRun = async (run) => {
         currentRun = run;

package/dist/settings.d.ts

@@ -20,8 +20,11 @@ export interface SettingsInput {
     /** the --mode / --model values on the command line, when given */
     readonly modeFlag?: string;
     readonly modelFlag?: string;
+    /** whether --dont-ask was on the command line */
+    readonly dontAskFlag?: boolean;
     /** what is live now */
     readonly mode: string;
+    readonly dontAsk?: boolean;
     readonly model: {
         readonly label: string;
         readonly profile: string | null;

package/dist/settings.js

@@ -1,18 +1,47 @@
+import { envModeLayer, parseMode, resolveModeLayers } from "./mode.js";
+const MODE_LAYER = { flag: "--mode", env: "env KISO_MODE", project: "project config", user: "user config", default: "default" };
+/** What a layer wrote for the tier — an old name is named, so a person
+ *  learns the new one from the row that shows it. */
+function writtenMode(i, source) {
+    return source === "flag" ? i.modeFlag : source === "env" ? i.env.KISO_MODE : source === "project" ? i.project?.mode : source === "user" ? i.user?.mode : undefined;
+}
+function modeFrom(i, source) {
+    const w = writtenMode(i, source);
+    return w === "bypass" || w === "dontAsk" ? `${MODE_LAYER[source]} (written "${w}")` : MODE_LAYER[source];
+}
+/** The switch's layer: its own key there, or — the resolution's other
+ *  way in — that layer's tier written as the old name dontAsk. */
+function dontAskFrom(i, source) {
+    if (source === "default")
+        return "default";
+    const own = source === "flag" ? i.dontAskFlag === true : source === "env" ? envModeLayer(i.env).dontAsk !== undefined : source === "project" ? i.project?.dontAsk !== undefined : i.user?.dontAsk !== undefined;
+    if (own)
+        return source === "flag" ? "--dont-ask" : source === "env" ? "env KISO_DONT_ASK" : MODE_LAYER[source];
+    return `${MODE_LAYER[source]} (written "dontAsk")`;
+}
+function modeLayers(i) {
+    return {
+        flag: { ...(i.modeFlag !== undefined ? { mode: i.modeFlag } : {}), ...(i.dontAskFlag === true ? { dontAsk: true } : {}) },
+        env: envModeLayer(i.env),
+        project: i.project,
+        user: i.user,
+    };
+}
 function modeRow(i) {
     const change = "/mode or shift+tab; \"mode\" in ~/.kiso/config.json";
-    const from = i.modeFlag === i.mode
-        ? "--mode"
-        : i.env.KISO_MODE === i.mode
-            ? "env KISO_MODE"
-            : i.project?.mode === i.mode
-                ? "project config"
-                : i.user?.mode === i.mode
-                    ? "user config"
-                    : i.mode === "default"
-                        ? "default"
-                        : "set in this session";
+    // the layers decided at start-up; a live tier they do not explain was
+    // set in this session
+    const resolved = resolveModeLayers(modeLayers(i));
+    const from = parseMode(i.mode)?.mode === resolved.mode ? modeFrom(i, resolved.from.mode) : "set in this session";
     return { name: "mode", value: i.mode, from, change };
 }
+function dontAskRow(i) {
+    const change = "/dont-ask; --dont-ask; \"dontAsk\": true in ~/.kiso/config.json";
+    const on = i.dontAsk === true;
+    const resolved = resolveModeLayers(modeLayers(i));
+    const from = (resolved.dontAsk !== "off") === on ? dontAskFrom(i, resolved.from.dontAsk) : "set in this session";
+    return { name: "don't ask", value: on ? "on — what would ask is refused" : "off", from, change };
+}
 function modelRow(i) {
     const change = "/model; \"model\" in ~/.kiso/config.json";
     const p = i.model.profile;
@@ -50,6 +79,7 @@ export function settingsRows(i) {
     const rows = [
         modelRow(i),
         modeRow(i),
+        dontAskRow(i),
         themeRow(i),
         {
             name: "floor",

package/dist/shell-words.d.ts

@@ -15,6 +15,7 @@
  * newline counts as `;`), each pipeline a series of simple commands joined
  * by `|`, each command an argv plus its redirections.
  */
+import { posix } from "node:path";
 export interface Redirect {
     /** The descriptor written before the operator (`2>`), null when none
      *  was written, or "&" for `&>` (stdout and stderr together). */
@@ -55,16 +56,48 @@ export declare function parseShell(src: string): ParseResult;
 export interface ResolvedPath {
     readonly canonical: string;
     readonly inside: boolean;
+    /** Windows P2: why the word cannot be read as a path here — never
+     *  inside, and refused under a destructive verb */
+    readonly opaque?: string;
 }
+/**
+ * Windows P2 — how a path word reads. `posix` is every host but Windows,
+ * unchanged. `msys` is Git Bash on win32 (P1 runs commands through it):
+ * `C:\x`, `C:/x` and `/c/x` are `C:\x`, either separator separates, the
+ * disk is case-insensitive, and every form that cannot be read exactly is
+ * opaque (kiso-doc plan-windows-p2-design-2026-10-01.md).
+ */
+export interface PathDialect {
+    readonly msys: boolean;
+    readonly path: typeof posix;
+}
+/** The dialect of the shell that runs commands here — read per call. */
+export declare function hostDialect(): PathDialect;
+/**
+ * A Git Bash word as a Windows path, `/`-separated (`C:/x`, or relative),
+ * each component as Win32 reads it (trailing dots and spaces dropped) —
+ * or why it cannot be read: another machine, a device or namespace path,
+ * a drive-relative or drive-rooted path, an MSYS mount inside Git's own
+ * tree, a data stream, a device name. (An 8.3 short name needs no rule:
+ * Windows resolves an existing one, and the real path expands it.)
+ */
+export declare function msysPath(word: string): {
+    readonly native: string;
+} | {
+    readonly opaque: string;
+};
 /** The well-known home subtrees that hold credentials or configuration
  *  that runs — one list for both chain members: the read-only allow
  *  never reads or lists under them, the floor never deletes them. */
 export declare const HOME_SUBTREES: readonly string[];
+/** The home subtrees for this host: on Windows, AppData too — credentials
+ *  and configuration that runs live there (Windows P2). */
+export declare function homeSubtrees(): readonly string[];
 /** A real path in the case the DISK holds it. The JS realpath keeps the
  *  case it was given, so on a case-insensitive disk `.ENV` stayed `.ENV`
  *  and walked past every name-based predicate (the lead's review, B2). */
 export declare function realCase(p: string): string;
-export declare function resolveShellPath(workspaceRoot: string, cwd: string, word: string): ResolvedPath;
+export declare function resolveShellPath(workspaceRoot: string, cwd: string, word: string, dialect?: PathDialect): ResolvedPath;
 /**
  * The FLOOR's reading of a command line (0.40.0 item 4) — the opposite
  * contract to `parseShell`. The read-only allow must refuse whatever it

package/dist/shell-words.js

@@ -16,7 +16,7 @@
  * by `|`, each command an argv plus its redirections.
  */
 import { existsSync, realpathSync } from "node:fs";
-import { dirname, isAbsolute, join, relative } from "node:path";
+import { posix, win32 } from "node:path";
 const GLOB = new Set(["*", "?", "["]);
 /**
  * Parse a command line, or say why not. Pure: no filesystem, no
@@ -268,10 +268,72 @@ export function parseShell(src) {
         return fail(f);
     return { ok: true, list };
 }
+const POSIX_DIALECT = { msys: false, path: posix };
+const MSYS_DIALECT = { msys: true, path: win32 };
+/** The dialect of the shell that runs commands here — read per call. */
+export function hostDialect() {
+    return process.platform === "win32" ? MSYS_DIALECT : POSIX_DIALECT;
+}
+const DEVICE_NAME = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\..*)?$/i;
+/**
+ * A Git Bash word as a Windows path, `/`-separated (`C:/x`, or relative),
+ * each component as Win32 reads it (trailing dots and spaces dropped) —
+ * or why it cannot be read: another machine, a device or namespace path,
+ * a drive-relative or drive-rooted path, an MSYS mount inside Git's own
+ * tree, a data stream, a device name. (An 8.3 short name needs no rule:
+ * Windows resolves an existing one, and the real path expands it.)
+ */
+export function msysPath(word) {
+    const w = word.replace(/\\/g, "/");
+    if (/^\/\/[?.]\//.test(w))
+        return { opaque: w[2] === "?" ? "a namespaced path" : "a device path" };
+    if (w.startsWith("//"))
+        return { opaque: "a UNC path (another machine)" };
+    let rest;
+    let drive = "";
+    const lettered = /^([A-Za-z]):(.*)$/s.exec(w);
+    const mounted = /^\/([A-Za-z])(\/.*)?$/s.exec(w);
+    if (lettered !== null) {
+        if (!lettered[2].startsWith("/"))
+            return { opaque: "a drive-relative path" };
+        drive = `${lettered[1].toUpperCase()}:`;
+        rest = lettered[2];
+    }
+    else if (mounted !== null) {
+        drive = `${mounted[1].toUpperCase()}:`;
+        rest = mounted[2] ?? "/";
+    }
+    else if (w.startsWith("/")) {
+        return { opaque: word.startsWith("\\") ? "a drive-rooted path" : "an MSYS mount (Git's own tree)" };
+    }
+    else
+        rest = w;
+    const parts = [];
+    for (const part of rest.split("/")) {
+        if (part === "" || part === "." || part === "..") {
+            parts.push(part);
+            continue;
+        }
+        if (part.includes(":"))
+            return { opaque: "an alternate data stream" };
+        const name = part.replace(/[. ]+$/, "");
+        if (name === "")
+            return { opaque: "a name Win32 rewrites" };
+        if (DEVICE_NAME.test(name))
+            return { opaque: "a device name" };
+        parts.push(name);
+    }
+    return { native: drive + parts.join("/") };
+}
 /** The well-known home subtrees that hold credentials or configuration
  *  that runs — one list for both chain members: the read-only allow
  *  never reads or lists under them, the floor never deletes them. */
 export const HOME_SUBTREES = [".ssh", ".config", ".kiso", ".gnupg", ".aws"];
+/** The home subtrees for this host: on Windows, AppData too — credentials
+ *  and configuration that runs live there (Windows P2). */
+export function homeSubtrees() {
+    return hostDialect().msys ? [...HOME_SUBTREES, "AppData"] : HOME_SUBTREES;
+}
 /** A real path in the case the DISK holds it. The JS realpath keeps the
  *  case it was given, so on a case-insensitive disk `.ENV` stayed `.ENV`
  *  and walked past every name-based predicate (the lead's review, B2). */
@@ -283,16 +345,26 @@ export function realCase(p) {
         return p;
     }
 }
-export function resolveShellPath(workspaceRoot, cwd, word) {
+export function resolveShellPath(workspaceRoot, cwd, word, dialect = hostDialect()) {
+    const { dirname, isAbsolute, join, relative } = dialect.path;
+    if (dialect.msys) {
+        const read = msysPath(word);
+        if ("opaque" in read)
+            return { canonical: word, inside: false, opaque: read.opaque };
+        if (!isAbsolute(read.native) && "opaque" in msysPath(cwd))
+            return { canonical: word, inside: false, opaque: "relative to a directory that cannot be read" };
+        word = read.native;
+    }
     // B1 (the lead's review): `..` is taken on the REAL path, one component
     // at a time — never collapsed as text first. `link-out/..` is the parent
     // of where link-out POINTS, which is where the shell goes; collapsed as
     // text it was the workspace, and `cat link-out/../etc/hosts` printed.
-    let current = isAbsolute(word) ? "/" : realCase(cwd);
+    const top = isAbsolute(word) ? dialect.path.parse(word).root : "";
+    let current = top === "" ? realCase(cwd) : dialect.msys ? dialect.path.normalize(top) : top;
     // past the last component that exists, the rest is text: nothing on
     // disk can redirect a path that does not exist
     const missing = [];
-    for (const part of word.split("/")) {
+    for (const part of word.slice(top.length).split("/")) {
         if (part === "" || part === ".")
             continue;
         if (missing.length > 0) {
@@ -313,6 +385,14 @@ export function resolveShellPath(workspaceRoot, cwd, word) {
             missing.push(part);
     }
     const canonical = missing.length > 0 ? join(current, ...missing) : current;
+    // Windows: a `..` after a link — Win32 takes `..` as text, the POSIX
+    // walk above takes it on the real path. Where the two land apart, the
+    // word is not read at all.
+    if (dialect.msys && word.split("/").includes("..")) {
+        const lexical = resolveShellPath(workspaceRoot, cwd, dialect.path.resolve(realCase(cwd), word), dialect);
+        if (lexical.canonical.toLowerCase() !== canonical.toLowerCase())
+            return { canonical: word, inside: false, opaque: "a `..` after a link (Windows and Git Bash may read it apart)" };
+    }
     const rel = relative(realCase(workspaceRoot), canonical);
     return { canonical, inside: rel === "" || (!rel.startsWith("..") && !isAbsolute(rel)) };
 }

package/dist/state.d.ts

@@ -7,6 +7,8 @@
  */
 import { Dock, type AtItem, type Body, type PanelVerdict, type PanelView, type SaferAnswer, type SessionCardView } from "@vincemakes/kiso-tui";
 import type { KisoExtension, StoreRecord } from "@vincemakes/kiso-runtime";
+import { TaskManager } from "@vincemakes/kiso-runtime/internal";
+import { type ShellTasks } from "@vincemakes/kiso-tools-node";
 /** finding #11: KISO_HOME is the ONE root — every default path derives from
  *  it (sessions, trust, extensions, mcp config, skills). The dedicated
  *  env vars (KISO_EXTENSIONS_DIR / KISO_MCP_CONFIG / KISO_SKILLS_DIR)
@@ -30,7 +32,27 @@ export declare function codingToolOptions(): {
     readonly excludeRoots: readonly string[];
     readonly secretEnvNames: readonly string[];
     readonly protectedFiles: readonly string[];
+    readonly tasks: (sessionId: string | undefined) => ShellTasks | undefined;
 };
+export declare function tasksFor(sessionId: string | undefined): TaskManager | undefined;
+export declare function setExitTasks(choice: "stop" | "leave"): void;
+/** 3e: the unknown tasks the person has looked at in `/tasks` in this
+ *  process — the status row stops counting them. */
+export declare const seenUnknownTasks: Set<string>;
+/** 3e: the live tasks of every session this process opened — a runner's
+ *  (`durable`, it survives this process) and moved commands (`moved`). */
+export declare function liveTasks(): {
+    readonly durable: number;
+    readonly moved: number;
+};
+/** A clean exit stops the session's tasks — all of them, or (the exit
+ *  question's "leave") only the moved commands — and waits for their
+ *  terminals. It returns what it could NOT confirm stopped, and what it
+ *  left running: a stop requested is never reported as a stop (3e). */
+export declare function stopAllTasks(): Promise<{
+    readonly unconfirmed: readonly string[];
+    readonly left: readonly string[];
+}>;
 export declare function setUserProtectedPaths(paths: readonly string[] | undefined): void;
 /** kiso never serves its own credential store to a model. The store is
  *  `auth.json` under KISO_HOME — the path auth/credentials.ts writes (a
@@ -134,6 +156,9 @@ export interface LineInput {
     onThink?(cb: () => void): void;
     /** §2.4: the external-editor key (ctrl+g). */
     onEditor?(cb: () => void): void;
+    /** ADR-0058 (3e): the background key (ctrl+b). Optional: the readline
+     *  input has no such key — `/tasks` and a steer still reach the tasks. */
+    onBackground?(cb: () => void): void;
     /** §2.4: hand the terminal over, run `edit`, take it back. The editor
      *  owns the handover; the CLI owns the spawn. */
     externalEdit?(edit: (text: string) => string | null): void;
@@ -220,6 +245,11 @@ export declare function setSessionStore(value: {
 /** The folder createCodingAgent built the store on — written there and by
  *  the resume picker's folder switch, read by the listings. */
 export declare let activeStoreDir: string;
+/** ADR-0058 3d (D6): a background child's turn budget (`--max-turns`, with
+ *  `--task-file` only) — the agent's maxTurns. Unset everywhere else: the
+ *  interactive door has no turn limit (R3e). */
+export declare let childTurnBudget: number | undefined;
+export declare function setChildTurnBudget(n: number | undefined): void;
 export declare function setActiveStoreDir(value: string): void;
 /** The model name for the status bar — set by createCodingAgent. */
 export declare let agentModel: string;
@@ -309,6 +339,7 @@ export declare const settingsLayers: {
     user: import("./config.js").KisoConfig | null;
     project: import("./config.js").KisoConfig | null;
     modeFlag: string | undefined;
+    dontAskFlag: boolean;
     modelFlag: string | undefined;
     modelSwitched: boolean;
 };

package/dist/state.js

@@ -11,6 +11,8 @@ import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { AT_CAP, AT_SKIP, Dock } from "@vincemakes/kiso-tui";
+import { TaskManager } from "@vincemakes/kiso-runtime/internal";
+import { processTaskBackend } from "@vincemakes/kiso-tools-node";
 import { canonicalPath, LEGACY_SESSIONS_DIR, projectDirFor, projectLayoutActive } from "./projects.js";
 /** finding #11: KISO_HOME is the ONE root — every default path derives from
  *  it (sessions, trust, extensions, mcp config, skills). The dedicated
@@ -39,7 +41,84 @@ export function secretEnvNamesOf(models) {
     ];
 }
 export function codingToolOptions() {
-    return { workspaceRoot: process.cwd(), excludeRoots: [kisoHome()], secretEnvNames: secretEnvNamesOf(configModels), protectedFiles: protectedFiles() };
+    return { workspaceRoot: process.cwd(), excludeRoots: [kisoHome()], secretEnvNames: secretEnvNamesOf(configModels), protectedFiles: protectedFiles(), tasks: tasksFor };
+}
+/** ADR-0058 (3b): one TaskManager per session, its directory beside the
+ *  session's log (`<store dir>/<session>.tasks/`). A call without a session
+ *  — the `!` gesture — has none, and its shell is today's. */
+const taskManagers = new Map();
+let taskBackend;
+export function tasksFor(sessionId) {
+    if (sessionId === undefined || activeStoreDir === "")
+        return undefined;
+    let manager = taskManagers.get(sessionId);
+    if (manager === undefined) {
+        taskBackend ??= processTaskBackend();
+        manager = new TaskManager({ root: join(activeStoreDir, `${sessionId}.tasks`), backend: taskBackend });
+        manager.observe();
+        taskManagers.set(sessionId, manager);
+    }
+    return manager;
+}
+/** 3e: what the exit does with the tasks — the exit question's answer.
+ *  "leave": a runner's task keeps running (the reopened session hears how
+ *  it ends); a moved command is owned by this process and is stopped. */
+let exitTasks = "stop";
+export function setExitTasks(choice) {
+    exitTasks = choice;
+}
+/** 3e: the unknown tasks the person has looked at in `/tasks` in this
+ *  process — the status row stops counting them. */
+export const seenUnknownTasks = new Set();
+/** 3e: the live tasks of every session this process opened — a runner's
+ *  (`durable`, it survives this process) and moved commands (`moved`). */
+export function liveTasks() {
+    let durable = 0;
+    let moved = 0;
+    for (const manager of taskManagers.values()) {
+        let list = [];
+        try {
+            list = manager.list();
+        }
+        catch {
+            continue; // a corrupt journal is reported where it is read on purpose
+        }
+        for (const t of list) {
+            if (t.state.kind !== "running" && t.state.kind !== "starting")
+                continue;
+            if (t.backend === "foreground")
+                moved += 1;
+            else
+                durable += 1;
+        }
+    }
+    return { durable, moved };
+}
+/** A clean exit stops the session's tasks — all of them, or (the exit
+ *  question's "leave") only the moved commands — and waits for their
+ *  terminals. It returns what it could NOT confirm stopped, and what it
+ *  left running: a stop requested is never reported as a stop (3e). */
+export async function stopAllTasks() {
+    const unconfirmed = [];
+    const left = [];
+    const many = taskManagers.size > 1;
+    await Promise.all([...taskManagers].map(async ([sessionId, manager]) => {
+        const name = (id) => (many ? `${sessionId}/${id}` : id);
+        if (exitTasks === "leave") {
+            try {
+                for (const t of manager.list())
+                    if (t.backend === "process" && (t.state.kind === "running" || t.state.kind === "starting"))
+                        left.push(name(t.id));
+            }
+            catch {
+                // a corrupt journal: nothing to report as left
+            }
+        }
+        for (const id of await manager.stopAll("exit", 8_000, exitTasks === "leave" ? "moved" : "all"))
+            unconfirmed.push(name(id));
+        manager.close();
+    }));
+    return { unconfirmed, left };
 }
 /** The user config's `protectedPaths`, as read at the agent's build (and
  *  again at /reload) — `~/` taken against the home directory. */
@@ -301,6 +380,13 @@ export function setSessionStore(value) {
 /** The folder createCodingAgent built the store on — written there and by
  *  the resume picker's folder switch, read by the listings. */
 export let activeStoreDir = "";
+/** ADR-0058 3d (D6): a background child's turn budget (`--max-turns`, with
+ *  `--task-file` only) — the agent's maxTurns. Unset everywhere else: the
+ *  interactive door has no turn limit (R3e). */
+export let childTurnBudget;
+export function setChildTurnBudget(n) {
+    childTurnBudget = n;
+}
 export function setActiveStoreDir(value) {
     activeStoreDir = value;
 }
@@ -406,7 +492,7 @@ export const queuedSwitchLines = [];
 /** 0.40.6: what /settings needs to name each value's layer — the two config
  *  files as read, the command-line flags as given, and whether /model
  *  changed the binding in this session. */
-export const settingsLayers = { user: null, project: null, modeFlag: undefined, modelFlag: undefined, modelSwitched: false };
+export const settingsLayers = { user: null, project: null, modeFlag: undefined, dontAskFlag: false, modelFlag: undefined, modelSwitched: false };
 export let floorOn = true;
 export function setFloorOn(value) {
     floorOn = value;

package/dist/task-notice.d.ts

@@ -0,0 +1,22 @@
+import type { TaskDeliveryItem } from "@vincemakes/kiso-core";
+import type { TaskInfo } from "@vincemakes/kiso-runtime/internal";
+export declare function taskNoticeRow(items: readonly TaskDeliveryItem[]): string;
+/** A task's state in the person's words. A stop that was asked for and is
+ *  not yet confirmed reads `stopping` — never `stopped` before the journal
+ *  says so; an outcome nobody can know reads `◌ outcome unknown`. */
+export declare function taskStateLabel(task: TaskInfo): string;
+/** What the task is: the command, or the child's role and task. */
+export declare function taskWhat(task: TaskInfo): string;
+/** One `/tasks` row: `t3  running  1m 20s`, with the command beside it. */
+export declare function taskRow(task: TaskInfo, now?: number): {
+    readonly label: string;
+    readonly note: string;
+};
+/** A task's last `lines` lines of output — or, for a child, its answer. */
+export declare function taskOutput(task: TaskInfo, lines?: number): string[];
+/** The status row's counts: live tasks, and the unknown ones the person
+ *  has not looked at in `/tasks` in this process. */
+export declare function taskCounts(tasks: readonly TaskInfo[], seen: ReadonlySet<string>): {
+    readonly running: number;
+    readonly unknown: number;
+};