@vincemakes/kiso-code 0.46.1 → 0.47.0

package/dist/opening.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Graphite §7.10 — what the opening says loaded: the session, the
+ * project's rules, the skills, the MCP servers, and the extensions. The
+ * model, the mode and the folder are the status bar's (§8.9) and are not
+ * repeated here — except the faux model, which the bar names but cannot
+ * say how to leave.
+ *
+ * Pure over what the CLI already holds at startup; the banner lays the
+ * facts out and knows nothing of where they came from.
+ */
+import type { BannerFact } from "@vincemakes/kiso-tui";
+export interface OpeningInputs {
+    /** The session's id — the SESSION row names it (the last sweep: the
+     *  `session <id>` line above the opening retired on a dock). Null off a
+     *  dock, where that line still prints: the row keeps its old form. */
+    readonly sessionId: string | null;
+    /** The events a resumed session opened with; 0 for a new one. */
+    readonly resumedEvents: number;
+    /** No model resolved and on a dock: the scripted faux model answers
+     *  (off a dock the `[faux mode — …]` line still prints). */
+    readonly faux: boolean;
+    /** The instruction file the prompt reads (`projectInstructions`), or null. */
+    readonly rules: string | null;
+    /** The skills catalog's size, or null when no skills extension loaded. */
+    readonly skills: {
+        readonly count: number;
+        readonly broken: number;
+    } | null;
+    /** The MCP extension's tools as they stand, or null when it is not loaded. */
+    readonly mcp: {
+        readonly tools: readonly string[];
+        readonly connecting: boolean;
+    } | null;
+    /** The extensions — `extensionsFact`'s count and names, from the SAME
+     *  three lists the pipe's `[N extensions: …]` line is built from (so the
+     *  two still cannot disagree about what loaded, and the 0.40.0 `ask (off
+     *  in dontAsk)` note stays beside the tier that turns it off); null when
+     *  nothing loaded. The last sweep (owner, 2026-10-06): the row carried
+     *  the pipe's bracketed line verbatim — as it still does off a dock
+     *  (`{ value: <the line> }`). */
+    readonly extensions: {
+        readonly value: string;
+        readonly note?: string;
+    } | null;
+    /** DC-49 — the workspace is the home directory. */
+    readonly homeWorkspace: boolean;
+}
+export declare function openingFacts(o: OpeningInputs): BannerFact[];

package/dist/opening.js

@@ -0,0 +1,43 @@
+/**
+ * Graphite §7.10 — what the opening says loaded: the session, the
+ * project's rules, the skills, the MCP servers, and the extensions. The
+ * model, the mode and the folder are the status bar's (§8.9) and are not
+ * repeated here — except the faux model, which the bar names but cannot
+ * say how to leave.
+ *
+ * Pure over what the CLI already holds at startup; the banner lays the
+ * facts out and knows nothing of where they came from.
+ */
+const plural = (n, one) => `${n} ${one}${n === 1 ? "" : "s"}`;
+export function openingFacts(o) {
+    const facts = [];
+    if (o.sessionId === null)
+        facts.push(o.resumedEvents > 0 ? { label: "SESSION", value: "resumed", note: plural(o.resumedEvents, "event") } : { label: "SESSION", value: "new", note: "resumable after kill -9" });
+    else
+        facts.push({ label: "SESSION", value: o.sessionId, note: o.resumedEvents > 0 ? `resumed \u00b7 ${plural(o.resumedEvents, "event")}` : "new \u00b7 resumable after kill -9" });
+    // the last sweep: no model resolved — the bar says `faux`, and this row
+    // says how to leave it (the line that said so was painted over at once)
+    // (as short as the RULES note: beside the wordmark a longer note is cut)
+    if (o.faux)
+        facts.push({ label: "MODEL", value: "faux", note: "set an API key, or add a model to config.json" });
+    facts.push(o.rules !== null ? { label: "RULES", value: o.rules } : { label: "RULES", value: "none", note: "an AGENTS.md or CLAUDE.md here is read" });
+    if (o.skills !== null) {
+        facts.push({ label: "SKILLS", value: String(o.skills.count), note: o.skills.broken > 0 ? `${o.skills.broken} cannot load · /skills` : "/skills lists them" });
+    }
+    if (o.mcp !== null) {
+        // the status tool is the extension's own, not a server's
+        const served = o.mcp.tools.filter((t) => t.startsWith("mcp__") && t !== "mcp__status");
+        const servers = new Set(served.map((t) => /^mcp__(.+?)__/.exec(t)?.[1] ?? t)).size;
+        if (servers === 0)
+            facts.push({ label: "MCP", value: o.mcp.connecting ? "connecting…" : "none" });
+        else
+            facts.push({ label: "MCP", value: plural(servers, "server"), note: `${plural(served.length, "tool")}${o.mcp.connecting ? " · connecting…" : ""}` });
+    }
+    if (o.extensions !== null)
+        facts.push({ label: "EXTENSIONS", value: o.extensions.value, ...(o.extensions.note !== undefined ? { note: o.extensions.note } : {}) });
+    // DC-49: STATES the fact and names the remedy; it does not warn — the
+    // configuration is allowed (owner, 2026-09-06)
+    if (o.homeWorkspace)
+        facts.push({ label: "", value: "home directory as workspace — cd into a project to narrow it" });
+    return facts;
+}

package/dist/protected-writes.d.ts

@@ -18,6 +18,14 @@
 import type { PolicyCall } from "@vincemakes/kiso-core";
 import type { KisoExtension } from "@vincemakes/kiso-runtime";
 export declare function isProtectedWrite(call: PolicyCall, workspaceRoot: string): boolean;
+/**
+ * The calls a saved allow never carries — they reach a person every time
+ * in the asking tiers: a write into .git/ or .kiso/, a destructive
+ * command (floor.ts, which also answers yes for a line it cannot read),
+ * and a command across the remote boundary (remote-boundary.ts, 0.46.2).
+ * create-coding-agent.ts wires it into every guarded saved allow.
+ */
+export declare function neverInheritedCall(call: PolicyCall, workspaceRoot: string): boolean;
 /**
  * A saved allow ("yes, don't ask again for <tool>") allows by TOOL, so on
  * its own it would carry every later call of that tool — including the

package/dist/protected-writes.js

@@ -17,6 +17,8 @@
  */
 import { relative, sep } from "node:path";
 import { resolveShellPath } from "./shell-words.js";
+import { isDestructiveCall } from "./floor.js";
+import { isRemoteBoundaryCall } from "./remote-boundary.js";
 const PROTECTED = new Set([".git", ".kiso"]);
 const WRITERS = new Set(["write_file", "edit_file"]);
 export function isProtectedWrite(call, workspaceRoot) {
@@ -34,6 +36,16 @@ export function isProtectedWrite(call, workspaceRoot) {
         .some((seg) => PROTECTED.has(seg.toLowerCase()));
 }
 const ABSTAIN = { action: "abstain" };
+/**
+ * The calls a saved allow never carries — they reach a person every time
+ * in the asking tiers: a write into .git/ or .kiso/, a destructive
+ * command (floor.ts, which also answers yes for a line it cannot read),
+ * and a command across the remote boundary (remote-boundary.ts, 0.46.2).
+ * create-coding-agent.ts wires it into every guarded saved allow.
+ */
+export function neverInheritedCall(call, workspaceRoot) {
+    return isProtectedWrite(call, workspaceRoot) || isDestructiveCall(call) || isRemoteBoundaryCall(call);
+}
 /**
  * A saved allow ("yes, don't ask again for <tool>") allows by TOOL, so on
  * its own it would carry every later call of that tool — including the

package/dist/remote-boundary.d.ts

@@ -0,0 +1,55 @@
+/**
+ * 0.46.2 — the remote boundary (owner-ratified 2026-10-06, rev 2 with the
+ * review's amendments).
+ *
+ * Two families of shell command change state that other people share:
+ *
+ *  A. a destructive git push — history rewritten or refs removed:
+ *     --force / -f, --force-with-lease, --force-if-includes, a refspec
+ *     with a leading `+`, --mirror, --delete / -d, a deleting refspec
+ *     (`:branch`), --prune. A dry run is exempt, read as git reads it: the
+ *     last of -n / --dry-run / --no-dry-run wins, and git takes any
+ *     unambiguous prefix of a long option, so `--mirr` is --mirror and
+ *     `--no-dry` turns the dry run off. A prefix is read generously — a
+ *     prefix git would reject as ambiguous costs a question, not a pass.
+ *  B. a registry write — a package published, unpublished or deprecated,
+ *     or a dist-tag moved: npm or pnpm with `publish`, `unpublish`,
+ *     `deprecate`, or `dist-tag` / `dist-tags` with add (a, set, s) or rm
+ *     (r, del, d, remove) — pnpm hands the last three to npm; yarn with
+ *     `publish`, `npm publish`, or `tag` / `npm tag` with add, rm or
+ *     remove. Not as the script `npm run publish` names. A dry run is
+ *     exempt only where the command honours one, read as its parser reads
+ *     it (`--dry-run false` is a real publish): npm and pnpm publish and
+ *     unpublish take --dry-run, `yarn npm publish` takes -n / --dry-run;
+ *     deprecate, dist-tag and yarn classic's publish have none, so the
+ *     flag exempts nothing there. npm's abbreviations of a command
+ *     (`npm pub`) are read too, in the command's place — not after an
+ *     option that takes a value (`npm --registry x pub`). Listing tags
+ *     and `npm view` stay out.
+ *
+ * A saved "don't ask again for shell" never carries either
+ * (protected-writes.ts neverInheritedCall): permission remembered by TOOL
+ * NAME from some earlier call does not cross into a change other people
+ * share. Authority given now still does — every tier decides these as it
+ * decides any shell call, so full-access runs them, and an explicit user
+ * extension that allows them still allows them. That is the extension of
+ * launch-weekend plan §4 ("destructive commands never inherit a saved
+ * allow in the asking modes") to the remote; "bypass stays bypass" is
+ * untouched.
+ *
+ * The list is closed: a new family needs the owner's word. It reads
+ * direct invocations only, words as written — `npm run release`, a script
+ * file, a git alias, a `+` refspec in git config and a variable's value
+ * are not seen. A guardrail, not a sandbox. A line it cannot read is not
+ * its question: isDestructiveCall already answers yes for one, so a saved
+ * allow abstains either way, and the two readings never disagree on what
+ * "unreadable" means.
+ */
+import type { PolicyCall } from "@vincemakes/kiso-core";
+/** Whether a command line crosses the remote boundary — read as the floor
+ *  reads one: past wrappers (sudo, env, timeout), into `sh -c` and eval,
+ *  along every command of a chain. */
+export declare function isRemoteBoundary(commandLine: string): boolean;
+/** The policy-call form: a shell call whose command crosses. A throw is
+ *  not this reading's to answer — see the head comment. */
+export declare function isRemoteBoundaryCall(call: PolicyCall): boolean;

package/dist/remote-boundary.js

@@ -0,0 +1,217 @@
+/**
+ * 0.46.2 — the remote boundary (owner-ratified 2026-10-06, rev 2 with the
+ * review's amendments).
+ *
+ * Two families of shell command change state that other people share:
+ *
+ *  A. a destructive git push — history rewritten or refs removed:
+ *     --force / -f, --force-with-lease, --force-if-includes, a refspec
+ *     with a leading `+`, --mirror, --delete / -d, a deleting refspec
+ *     (`:branch`), --prune. A dry run is exempt, read as git reads it: the
+ *     last of -n / --dry-run / --no-dry-run wins, and git takes any
+ *     unambiguous prefix of a long option, so `--mirr` is --mirror and
+ *     `--no-dry` turns the dry run off. A prefix is read generously — a
+ *     prefix git would reject as ambiguous costs a question, not a pass.
+ *  B. a registry write — a package published, unpublished or deprecated,
+ *     or a dist-tag moved: npm or pnpm with `publish`, `unpublish`,
+ *     `deprecate`, or `dist-tag` / `dist-tags` with add (a, set, s) or rm
+ *     (r, del, d, remove) — pnpm hands the last three to npm; yarn with
+ *     `publish`, `npm publish`, or `tag` / `npm tag` with add, rm or
+ *     remove. Not as the script `npm run publish` names. A dry run is
+ *     exempt only where the command honours one, read as its parser reads
+ *     it (`--dry-run false` is a real publish): npm and pnpm publish and
+ *     unpublish take --dry-run, `yarn npm publish` takes -n / --dry-run;
+ *     deprecate, dist-tag and yarn classic's publish have none, so the
+ *     flag exempts nothing there. npm's abbreviations of a command
+ *     (`npm pub`) are read too, in the command's place — not after an
+ *     option that takes a value (`npm --registry x pub`). Listing tags
+ *     and `npm view` stay out.
+ *
+ * A saved "don't ask again for shell" never carries either
+ * (protected-writes.ts neverInheritedCall): permission remembered by TOOL
+ * NAME from some earlier call does not cross into a change other people
+ * share. Authority given now still does — every tier decides these as it
+ * decides any shell call, so full-access runs them, and an explicit user
+ * extension that allows them still allows them. That is the extension of
+ * launch-weekend plan §4 ("destructive commands never inherit a saved
+ * allow in the asking modes") to the remote; "bypass stays bypass" is
+ * untouched.
+ *
+ * The list is closed: a new family needs the owner's word. It reads
+ * direct invocations only, words as written — `npm run release`, a script
+ * file, a git alias, a `+` refspec in git config and a variable's value
+ * are not seen. A guardrail, not a sandbox. A line it cannot read is not
+ * its question: isDestructiveCall already answers yes for one, so a saved
+ * allow abstains either way, and the two readings never disagree on what
+ * "unreadable" means.
+ */
+import { homedir } from "node:os";
+import { basename } from "node:path";
+import { MAX_INNER_DEPTH, MAX_INNER_LINES, gitInvocation, innerLines, unwrap } from "./floor.js";
+import { looseCommands, parseShellLooseChecked } from "./shell-words.js";
+/** git push options that take the next word as their value. */
+const PUSH_VALUED = new Set(["-o", "--push-option", "--repo", "--receive-pack", "--exec"]);
+/** git push options that rewrite or remove remote refs. */
+const PUSH_REWRITES = new Set(["--force", "--force-with-lease", "--force-if-includes", "--mirror", "--delete", "--prune"]);
+function destructivePush(args) {
+    let crosses = false;
+    let dryRun = false;
+    let options = true;
+    const positionals = [];
+    for (let i = 0; i < args.length; i += 1) {
+        const t = args[i].text;
+        if (!options || !t.startsWith("-") || t === "-") {
+            positionals.push(t);
+            continue;
+        }
+        if (t === "--") {
+            options = false;
+            continue;
+        }
+        if (PUSH_VALUED.has(t)) {
+            i += 1;
+            continue;
+        }
+        if (t.startsWith("--")) {
+            const flag = t.split("=")[0];
+            if (flag === "--dry-run")
+                dryRun = true;
+            else if (flag.length >= "--no-d".length && "--no-dry-run".startsWith(flag))
+                dryRun = false;
+            else if (flag.length > 2 && [...PUSH_REWRITES].some((r) => r.startsWith(flag)))
+                crosses = true;
+            continue;
+        }
+        // a short cluster, `-uf`; `-o` takes the rest of the word, or the next
+        for (let k = 1; k < t.length; k += 1) {
+            const c = t[k];
+            if (c === "o") {
+                if (k === t.length - 1)
+                    i += 1;
+                break;
+            }
+            if (c === "n")
+                dryRun = true;
+            if (c === "f" || c === "d")
+                crosses = true;
+        }
+    }
+    // the first positional is the repository; the rest are refspecs
+    if (positionals.slice(1).some((r) => r.startsWith("+") || r.startsWith(":")))
+        crosses = true;
+    return crosses && !dryRun;
+}
+/** Whether a dry run is on, read as npm's option parser reads it: the last
+ *  setting wins, `--dry-run false` and `--dry-run=false` turn it off, and
+ *  only an explicit true counts. `-n` is a dry run where yarn says so. */
+function dryRun(words, short) {
+    let on = false;
+    for (let i = 0; i < words.length; i += 1) {
+        const w = words[i];
+        if (w === "--dry-run" || (short && w === "-n")) {
+            const next = words[i + 1];
+            on = next !== "false";
+            if (next === "true" || next === "false")
+                i += 1;
+        }
+        else if (w.startsWith("--dry-run="))
+            on = w === "--dry-run=true";
+        else if (w === "--no-dry-run")
+            on = false;
+    }
+    return on;
+}
+/** dist-tag (npm) and tag (yarn) write with these subcommands, and list
+ *  with the rest — a bare `npm dist-tag <pkg>` lists too. */
+const NPM_TAG_WRITES = new Set(["add", "a", "set", "s", "rm", "r", "del", "d", "remove"]);
+const NPM_TAG_READS = new Set(["ls", "l", "sl", "list"]);
+const YARN_TAG_WRITES = new Set(["add", "rm", "remove"]);
+const YARN_TAG_READS = new Set(["ls", "list"]);
+/** A tag command writes when a write subcommand follows it — unless the
+ *  first word after it names a listing (`npm dist-tag ls d` lists "d"). */
+function tagWrite(words, at, writes, reads) {
+    const after = words.slice(at + 1).filter((w) => !w.startsWith("-"));
+    if (after[0] !== undefined && reads.has(after[0]))
+        return false;
+    return after.some((w) => writes.has(w));
+}
+/** npm runs a unique prefix of a command name: `npm pub` is publish,
+ *  `npm unp` unpublish, `npm dep` deprecate (npm 10's own resolution).
+ *  Read generously, as git's options are — a prefix npm would reject as
+ *  ambiguous (`npm de`) costs a question. `un` is npm's alias for
+ *  uninstall; dist-tag has no abbreviation, every prefix of it being
+ *  ambiguous with dist-tags. */
+function npmCommand(first) {
+    if (first === undefined || first.length < 2 || first === "un")
+        return first;
+    return ["publish", "unpublish", "deprecate"].find((w) => w.startsWith(first)) ?? first;
+}
+function registryWrite(pm, args) {
+    const words = args.map((a) => a.text);
+    const first = words.find((w) => !w.startsWith("-"));
+    if (first === "run" || first === "run-script")
+        return false;
+    if (pm === "yarn") {
+        // berry spells the registry commands `yarn npm …`; classic has no
+        // unpublish or deprecate, and its publish takes no dry run
+        const berry = words.includes("npm");
+        if (words.includes("publish") && !(berry && dryRun(words, true)))
+            return true;
+        const tag = words.indexOf("tag");
+        return tag !== -1 && tagWrite(words, tag, YARN_TAG_WRITES, YARN_TAG_READS);
+    }
+    const command = pm === "npm" ? npmCommand(first) : first;
+    const publishes = words.includes("publish") || words.includes("unpublish") || command === "publish" || command === "unpublish";
+    if (publishes && !dryRun(words, false))
+        return true;
+    if (words.includes("deprecate") || command === "deprecate")
+        return true;
+    const tag = words.findIndex((w) => w === "dist-tag" || w === "dist-tags");
+    return tag !== -1 && tagWrite(words, tag, NPM_TAG_WRITES, NPM_TAG_READS);
+}
+function crossing(argv) {
+    const name = basename(argv[0]?.text ?? "");
+    if (name === "git") {
+        const inv = gitInvocation(argv.slice(1));
+        return inv.sub === "push" && destructivePush(inv.rest);
+    }
+    if (name === "npm" || name === "pnpm" || name === "yarn")
+        return registryWrite(name, argv.slice(1));
+    return false;
+}
+/** Whether a command line crosses the remote boundary — read as the floor
+ *  reads one: past wrappers (sudo, env, timeout), into `sh -c` and eval,
+ *  along every command of a chain. */
+export function isRemoteBoundary(commandLine) {
+    const seen = new Set();
+    const visit = (line, depth) => {
+        const read = parseShellLooseChecked(line);
+        return looseCommands(read.nodes).some(({ argv: raw }) => {
+            const argv = unwrap(raw);
+            const inner = innerLines(argv, homedir());
+            if (inner !== null) {
+                return (depth < MAX_INNER_DEPTH &&
+                    inner.lines.some((l) => {
+                        if (seen.has(l) || seen.size >= MAX_INNER_LINES)
+                            return false;
+                        seen.add(l);
+                        return visit(l, depth + 1);
+                    }));
+            }
+            return crossing(argv);
+        });
+    };
+    return visit(commandLine, 0);
+}
+/** The policy-call form: a shell call whose command crosses. A throw is
+ *  not this reading's to answer — see the head comment. */
+export function isRemoteBoundaryCall(call) {
+    if (call.name !== "shell" || typeof call.input.command !== "string")
+        return false;
+    try {
+        return isRemoteBoundary(call.input.command);
+    }
+    catch {
+        return false;
+    }
+}

package/dist/replay.d.ts

@@ -19,6 +19,8 @@
  *     summary (what the model sees next) and the turns it covers, read in
  *     the viewer — then any uncovered earlier turns folded as above.
  */
+import type { TaskInfo } from "@vincemakes/kiso-runtime/internal";
+import type { NoticeMark } from "@vincemakes/kiso-tui";
 /** The Body surface the replay drives — the live run's own mutations. */
 export interface ReplayBody {
     userLine(text: string): void;
@@ -34,6 +36,11 @@ export interface ReplayBody {
         untimed?: boolean;
     }): void;
     notice(text: string): void;
+    metaNotice(text: string, rows: readonly {
+        readonly label: string;
+        readonly sentence: string;
+        readonly mark?: NoticeMark;
+    }[]): void;
     endTurn(thoughtSeconds: number): void;
     fold(label: string, replay: () => void, summary?: string | null): void;
     raw(lines: string[]): void;
@@ -49,5 +56,5 @@ export declare function turnsOf(events: readonly Ev[]): Ev[][];
  * Replay a session's durable events into the body. Returns the number of
  * turns it found (0: a fresh session — nothing is drawn).
  */
-export declare function replayInto(body: ReplayBody, events: readonly Ev[], W?: number): number;
+export declare function replayInto(body: ReplayBody, events: readonly Ev[], W?: number, tasks?: readonly TaskInfo[]): number;
 export {};

package/dist/replay.js

@@ -20,7 +20,8 @@
  *     the viewer — then any uncovered earlier turns folded as above.
  */
 import { echoText } from "@vincemakes/kiso-tui-cells/render";
-import { taskNoticeRow } from "./task-notice.js";
+import { bandHeader } from "@vincemakes/kiso-tui-cells/strings";
+import { taskNoticeLines, taskNoticeRows, taskWhat } from "./task-notice.js";
 /** How many turns stay on screen in full. */
 const FULL_TURNS = 2;
 /** A user turn's opening line, or null when this input does not open one
@@ -48,7 +49,7 @@ export function turnsOf(events) {
 }
 /** One turn through the Body — consumeRun's mapping, minus everything that
  *  needs the live process (clocks, tailers, usage, the recap). */
-function replayTurn(body, turn) {
+function replayTurn(body, turn, tasks) {
     let thinking = false;
     let said = false;
     const results = new Set();
@@ -62,8 +63,17 @@ function replayTurn(body, turn) {
                 const ask = askOf(e);
                 if (ask !== null)
                     body.userLine(ask);
-                else if (e.via?.kind === "tasks")
-                    body.notice(taskNoticeRow(e.via.items));
+                else if (e.via?.kind === "tasks") {
+                    // the tasks round: the same rows a live session drew, from the
+                    // journal; the pipe's lines are taskNoticeLines' (Amendment 8: a
+                    // lost task's line names what it ran)
+                    const items = e.via.items;
+                    const what = (taskId) => {
+                        const t = tasks.find((x) => x.id === taskId);
+                        return t === undefined ? undefined : taskWhat(t);
+                    };
+                    body.metaNotice(taskNoticeLines(items, what).join("\n"), taskNoticeRows(items, tasks));
+                }
                 else if (e.source === "system") {
                     body.notice("verification pass");
                     body.notice(`  ${typeof e.content === "string" ? e.content : ""}`);
@@ -124,7 +134,7 @@ const plural = (n, one) => `${n} ${one}${n === 1 ? "" : "s"}`;
  * Replay a session's durable events into the body. Returns the number of
  * turns it found (0: a fresh session — nothing is drawn).
  */
-export function replayInto(body, events, W = 80) {
+export function replayInto(body, events, W = 80, tasks = []) {
     // The latest checkpoint: the turns it covers are what the model will
     // read as its summary, not as turns.
     let checkpoint = null;
@@ -140,22 +150,24 @@ export function replayInto(body, events, W = 80) {
     const shown = rest.slice(-FULL_TURNS);
     const earlier = rest.slice(0, rest.length - shown.length);
     const label = total > shown.length ? `resuming · ${plural(total, "turn")}, showing the last ${shown.length}` : `resuming · ${plural(total, "turn")}`;
-    const head = `─── ${label} `;
-    body.raw([`${head}${"─".repeat(Math.max(1, W - head.length))}`.slice(0, Math.max(1, W))]);
+    // Graphite §8.1 (R3b): the resumed history opens like every band — the
+    // hairline with its name, `resuming` bold gold, the counts dim (the same
+    // words the dim rule carried)
+    body.raw([bandHeader(label, Math.max(1, W))]);
     if (checkpoint !== null) {
         const summary = checkpoint.summary;
         body.fold(`checkpoint · summarizes ${plural(covered.length, "earlier turn")} · ctrl+r to read`, () => {
             for (const t of covered)
-                replayTurn(body, t);
+                replayTurn(body, t, tasks);
         }, summary);
     }
     if (earlier.length > 0) {
         body.fold(`${plural(earlier.length, "earlier turn")} · ctrl+r to read`, () => {
             for (const t of earlier)
-                replayTurn(body, t);
+                replayTurn(body, t, tasks);
         });
     }
     for (const t of shown)
-        replayTurn(body, t);
+        replayTurn(body, t, tasks);
     return total;
 }

package/dist/resume.js

@@ -2,12 +2,12 @@
  * The ergonomics batch B4 (pure move) — resume: the RECOVERY flow (Area 2/7). The body
  * moved verbatim from index.ts.
  */
-import { idleStatus, runningStatus } from "@vincemakes/kiso-tui";
-import { modeDisplay } from "./mode.js";
-import { agentModel, dock, retryOnRow, floorOn } from "./state.js";
+import { STATUS_GLYPHS, workingRow } from "@vincemakes/kiso-tui";
+import { dock, retryOnRow } from "./state.js";
 import { pendingAsk, resolveUncertains } from "./trust-ui.js";
 import { failOnFauxExhaustion } from "./faux-glue.js";
-import { consumeRun, estimateCtxRatio, startStatusSpinner } from "./chat.js";
+import { setTitleState } from "./window-title.js";
+import { barFor, consumeRun, estimateCtxRatio, startStatusSpinner } from "./chat.js";
 /**
  * Resume = the RECOVERY flow (Area 2/7): uncertain executions are decided,
  * the interrupted run is continued via session.resume() — never faked with
@@ -21,23 +21,26 @@ export async function resume(session, prompt, faux, input) {
     let turnNo = 0;
     // v3 §03: the two-state status bar (see chat — same shapes).
     let runUsage = { in: null, out: null, cache: null, known: false };
-    let runGlyph = "▖";
+    let runGlyph = STATUS_GLYPHS[0];
     let runStart = Date.now();
     // KC2 §5: the rows the REPL and this flow used to build separately are
-    // ONE formatter now — the running row was duplicated verbatim.
-    const statusCb = (u, ctx) => {
+    // ONE formatter now. Graphite §8.7 / §8.9: the running turn's facts ride
+    // the live row, the session's the status bar — the chat's own two
+    // (barFor), so the recovery flow now spells plan's posture the same way.
+    const width = () => (process.stdout.columns > 0 ? process.stdout.columns : 80);
+    const statusCb = (u, _ctx) => {
         runUsage = u;
-        if (dock.active)
-            dock.setStatus(runningStatus(runGlyph, runStart, u.out, ctx, null, process.stdout.columns > 0 ? process.stdout.columns : 80, retryOnRow()));
+        if (!dock.active)
+            return;
+        dock.setLive(workingRow(runGlyph, runStart, u.out, null, width(), retryOnRow()));
+        dock.setBar(barFor(session, { tokPerSec: null }));
     };
-    // the recovery flow prints the BARE mode (chat spells plan's posture) —
-    // the extraction keeps that difference, it was not asked to settle it.
     const paintIdle = () => {
-        // DF-0330-F1: the recovery flow paints the same row, so it gets the
-        // same budget. It has no meter, so nothing here can be dropped that
-        // was not already at risk of being cut.
-        if (dock.active)
-            dock.setStatus(idleStatus(modeDisplay(), agentModel, estimateCtxRatio(session), undefined, process.stdout.columns > 0 ? process.stdout.columns : 80, !floorOn));
+        setTitleState("ready");
+        if (!dock.active)
+            return;
+        dock.setLive(null);
+        dock.setBar(barFor(session, { tokPerSec: null }));
     };
     const withRun = async (run) => {
         currentRun = run;
@@ -47,6 +50,8 @@ export async function resume(session, prompt, faux, input) {
             runGlyph = g;
             statusCb(runUsage, estimateCtxRatio(session));
         });
+        statusCb(runUsage, estimateCtxRatio(session)); // the live row from the run's first frame
+        setTitleState("working");
         try {
             turnNo += 1;
             const last = await consumeRun(session, run, input, turnNo, faux, statusCb);

package/dist/session-cards.d.ts

@@ -88,6 +88,8 @@ export declare function projectSessionCard(input: {
     readonly asks: number;
     readonly workspace?: string | null;
     readonly profileName?: string | null;
+    /** Graphite R3d: the session's `/name`, which wins over the derived title */
+    readonly name?: string | null;
 }): SessionCard;
 /** The shapes this module needs from the agent — structural, so the
  *  projection is testable without standing up a provider. */

package/dist/session-cards.js

@@ -76,7 +76,7 @@ export function projectSessionCard(input) {
                         : "failed";
     return {
         id: input.id,
-        title: sessionTitle(input.records),
+        title: input.name ?? sessionTitle(input.records),
         badge,
         turns,
         updatedAt: input.updatedAt,
@@ -128,11 +128,11 @@ export function cardFromListing(l) {
     const s = l.summary;
     const base = { id: l.id, workspace: l.workspace, profileName: l.profileName, ...(l.inferred === true ? { inferred: true } : {}) };
     if (s === null)
-        return { ...base, title: l.id, badge: "unknown", turns: null, updatedAt: l.mtime, uncertain: 0, asks: 0, outcome: "no summary" };
+        return { ...base, title: l.name ?? l.id, badge: "unknown", turns: null, updatedAt: l.mtime, uncertain: 0, asks: 0, outcome: "no summary" };
     const badge = s.uncertain > 0 ? "uncertain" : s.asks > 0 ? "ask" : s.state === "open" ? "interrupted" : s.state === "completed" ? "completed" : s.state === null ? "unknown" : "failed";
     return {
         ...base,
-        title: s.title ?? l.id,
+        title: l.name ?? s.title ?? l.id,
         badge,
         turns: s.turns,
         updatedAt: s.updatedAt,

package/dist/settings.d.ts

@@ -37,4 +37,23 @@ export interface SettingsInput {
     readonly thinkingRemembered: boolean;
     readonly version: string;
 }
+export interface Row {
+    readonly name: string;
+    readonly value: string;
+    readonly from: string;
+    readonly change: string;
+    /** Graphite P3: the value as a table cell (`on`, `1M`) where `value` is
+     *  a sentence; absent, the value is already short */
+    readonly brief?: string;
+    /** Graphite P3: what the sentence said that the cell does not — the
+     *  panel's opened row carries it */
+    readonly means?: string;
+}
+/** Graphite R3e: the settings as data — the /settings panel's rows and
+ *  the printed form below read the same list. */
+export declare function settingsFacts(i: SettingsInput): Row[];
+/** The printed form: one block per setting — what it is, where it came
+ *  from and how to change it (a pipe, a dock-less TTY, and a panel row's
+ *  enter). */
+export declare function settingRow(r: Row, width?: number): string;
 export declare function settingsRows(i: SettingsInput): string[];