@vincemakes/kiso-code 0.47.3 → 0.49.0

package/dist/apply-patch.d.ts

@@ -0,0 +1,42 @@
+/**
+ * 0.49.0 B6.2 / I4 — `kiso apply-patch <taskDir> [--allow-partial]
+ * [--with-markers]`: adopt an implementer's collected patch into the
+ * workspace. A writer owns an isolated workspace; adoption is a separate,
+ * crash-honest effect.
+ *
+ * The collection (the subagent extension's collectWriter) left in the task
+ * directory: `patch.json` (the files, their modes, whether the patch is
+ * complete), `versions/<n>.base` and `versions/<n>.child` (each changed
+ * file before and after the child), and the child's `acceptance.json`.
+ *
+ * PREPARE writes nothing: each file is merged three ways — base (the
+ * snapshot the child started from), ours (the workspace now), theirs (the
+ * child's) — with `git merge-file`'s algorithm, which never reads or writes
+ * the index. Any conflict, or an entry this release does not adopt
+ * (symlinks, submodules, a mode change on an existing file, a file and a
+ * directory trading places, two names differing only in case), stops here
+ * with nothing written.
+ *
+ * PUBLISH is per file and journaled (`<taskDir>/apply.jsonl`): each target
+ * is revalidated against what PREPARE saw; a creation is no-clobber (link
+ * or refuse, WR-1A ②'s rule); a modification is revalidated right before
+ * its rename (WR-1A ③); a deletion is revalidated, then unlinked — the
+ * same narrow check-to-effect window WR-1's conditional write has, never
+ * called a compare-and-swap. A filesystem has no multi-file transaction,
+ * so the promise is all-or-none PREPARE, never an atomic write: a late
+ * revalidation failure ends `partial`, naming what was and was not
+ * published, and nothing retries it.
+ *
+ * VERIFY: after a clean publication the patch's acceptance always runs
+ * again in the workspace (the child's ran against the snapshot; the
+ * workspace has what the snapshot never held — ignored files, a build
+ * cache). It is re-resolved from the configuration by its NAME, never run
+ * from the record; it touches no git state. Both verdicts are printed.
+ * There is no automatic rollback. An interrupted verification is reported
+ * as not completed (before it started) or unknown (while it ran), and never
+ * retried by itself.
+ *
+ * Exit codes: 0 clean (whatever the acceptance said — two facts, printed),
+ * 3 conflicted, 4 partial, 5 refused or unsupported, 1 failed.
+ */
+export declare function applyPatch(args: readonly string[], cwd?: string): Promise<number>;

package/dist/apply-patch.js

@@ -0,0 +1,381 @@
+/**
+ * 0.49.0 B6.2 / I4 — `kiso apply-patch <taskDir> [--allow-partial]
+ * [--with-markers]`: adopt an implementer's collected patch into the
+ * workspace. A writer owns an isolated workspace; adoption is a separate,
+ * crash-honest effect.
+ *
+ * The collection (the subagent extension's collectWriter) left in the task
+ * directory: `patch.json` (the files, their modes, whether the patch is
+ * complete), `versions/<n>.base` and `versions/<n>.child` (each changed
+ * file before and after the child), and the child's `acceptance.json`.
+ *
+ * PREPARE writes nothing: each file is merged three ways — base (the
+ * snapshot the child started from), ours (the workspace now), theirs (the
+ * child's) — with `git merge-file`'s algorithm, which never reads or writes
+ * the index. Any conflict, or an entry this release does not adopt
+ * (symlinks, submodules, a mode change on an existing file, a file and a
+ * directory trading places, two names differing only in case), stops here
+ * with nothing written.
+ *
+ * PUBLISH is per file and journaled (`<taskDir>/apply.jsonl`): each target
+ * is revalidated against what PREPARE saw; a creation is no-clobber (link
+ * or refuse, WR-1A ②'s rule); a modification is revalidated right before
+ * its rename (WR-1A ③); a deletion is revalidated, then unlinked — the
+ * same narrow check-to-effect window WR-1's conditional write has, never
+ * called a compare-and-swap. A filesystem has no multi-file transaction,
+ * so the promise is all-or-none PREPARE, never an atomic write: a late
+ * revalidation failure ends `partial`, naming what was and was not
+ * published, and nothing retries it.
+ *
+ * VERIFY: after a clean publication the patch's acceptance always runs
+ * again in the workspace (the child's ran against the snapshot; the
+ * workspace has what the snapshot never held — ignored files, a build
+ * cache). It is re-resolved from the configuration by its NAME, never run
+ * from the record; it touches no git state. Both verdicts are printed.
+ * There is no automatic rollback. An interrupted verification is reported
+ * as not completed (before it started) or unknown (while it ran), and never
+ * retried by itself.
+ *
+ * Exit codes: 0 clean (whatever the acceptance said — two facts, printed),
+ * 3 conflicted, 4 partial, 5 refused or unsupported, 1 failed.
+ */
+import { spawn, spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { appendFileSync, chmodSync, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, dirname, join } from "node:path";
+import { projectArtifacts, trustFor } from "@vincemakes/kiso-runtime";
+import { loadProjectConfig, loadUserConfig, mergeConfigs, resolveProjectTrustPolicy } from "./config.js";
+const ABSENT = "absent";
+const sha = (b) => createHash("sha256").update(b).digest("hex");
+export async function applyPatch(args, cwd = process.cwd()) {
+    const taskDir = args.find((a) => !a.startsWith("--"));
+    const allowPartial = args.includes("--allow-partial");
+    const withMarkers = args.includes("--with-markers");
+    if (taskDir === undefined) {
+        console.error("usage: kiso apply-patch <task directory> [--allow-partial] [--with-markers]");
+        return 5;
+    }
+    let patch;
+    try {
+        patch = JSON.parse(readFileSync(join(taskDir, "patch.json"), "utf8"));
+    }
+    catch (err) {
+        console.error(`apply-patch: no collected patch in ${taskDir} (${err.message})`);
+        return 1;
+    }
+    const journal = join(taskDir, "apply.jsonl");
+    const prior = readJournal(journal);
+    if (prior.length > 0) {
+        const ended = prior.find((r) => r.type === "apply_terminal");
+        if (ended !== undefined) {
+            console.error(`apply-patch: this patch was already adopted (${String(ended.outcome)}); nothing was done`);
+            return 5;
+        }
+        console.error(interruptedReport(prior));
+        return 1;
+    }
+    if (!patch.applyable && !allowPartial) {
+        console.error("apply-patch: the child was stopped, so this patch is partial; adopt it only with --allow-partial");
+        return 5;
+    }
+    let root;
+    try {
+        root = git(cwd, ["rev-parse", "--show-toplevel"]).trim();
+    }
+    catch {
+        console.error("apply-patch: run it inside the workspace's git repository");
+        return 5;
+    }
+    const unsupported = unsupportedOf(patch, root);
+    if (unsupported.length > 0) {
+        console.error(`apply-patch: not adopted — this release adopts regular files only:\n${unsupported.map((u) => `  ${u}`).join("\n")}\nIntegrate it by hand, or delegate again.`);
+        return 5;
+    }
+    // ── PREPARE: nothing in the workspace changes ──────────────────────────
+    const planned = [];
+    const conflicts = [];
+    const scratch = mkdtempSync(join(tmpdir(), "kiso-apply-"));
+    try {
+        patch.files.forEach((f, n) => {
+            const target = join(root, f.path);
+            const ours = readOrNull(target);
+            const expected = ours === null ? ABSENT : sha(ours);
+            const base = f.status === "A" ? null : readFileSync(join(taskDir, "versions", `${n}.base`));
+            const theirs = f.status === "D" ? null : readFileSync(join(taskDir, "versions", `${n}.child`));
+            const exec = f.mode === "100755";
+            if (f.status === "A") {
+                if (ours === null)
+                    planned.push({ path: f.path, action: "create", expected, content: theirs, exec });
+                else if (!ours.equals(theirs))
+                    conflicts.push(`${f.path}: created by the child, and it exists in the workspace with other content`);
+                return;
+            }
+            if (f.status === "D") {
+                if (ours === null)
+                    return; // already gone
+                if (ours.equals(base))
+                    planned.push({ path: f.path, action: "delete", expected });
+                else
+                    conflicts.push(`${f.path}: deleted by the child, and changed in the workspace since`);
+                return;
+            }
+            // a modification
+            if (ours === null) {
+                conflicts.push(`${f.path}: changed by the child, and deleted in the workspace since`);
+                return;
+            }
+            if (ours.equals(base))
+                planned.push({ path: f.path, action: "modify", expected, content: theirs });
+            else if (ours.equals(theirs))
+                return; // the workspace already has it
+            else {
+                const merged = mergeThree(scratch, ours, base, theirs);
+                if (merged.conflicts === 0)
+                    planned.push({ path: f.path, action: "modify", expected, content: merged.content });
+                else if (withMarkers)
+                    planned.push({ path: f.path, action: "modify", expected, content: merged.content });
+                else
+                    conflicts.push(`${f.path}: ${merged.conflicts} conflicting ${merged.conflicts === 1 ? "hunk" : "hunks"}\n${hunks(merged.content)}`);
+            }
+        });
+    }
+    finally {
+        rmSync(scratch, { recursive: true, force: true });
+    }
+    if (conflicts.length > 0) {
+        console.error(`apply-patch: nothing was written — the patch conflicts with the workspace:\n${conflicts.map((c) => `  ${c}`).join("\n")}\nResolve by hand, apply with --with-markers and fix the markers with edit_file, or delegate again on the current tree.`);
+        return 3;
+    }
+    // test-only: KISO_TEST_APPLY_HOOK names a module whose afterPrepare() /
+    // afterPublish(path) run between the steps — the races a gate needs on cue
+    const hook = process.env.KISO_TEST_APPLY_HOOK === undefined ? undefined : (await import(process.env.KISO_TEST_APPLY_HOOK));
+    hook?.afterPrepare?.();
+    // ── PUBLISH: per file, revalidated, journaled ───────────────────────────
+    const record = (r) => appendFileSync(journal, `${JSON.stringify({ ...r, ts: Date.now() })}\n`);
+    record({ type: "apply_planned", patchSha256: sha(readFileSync(join(taskDir, "patch.diff"))), files: planned.map((p) => ({ path: p.path, action: p.action, expected: p.expected })) });
+    const published = [];
+    for (const p of planned) {
+        const target = join(root, p.path);
+        const why = publish(target, p);
+        if (why !== null) {
+            record({ type: "apply_terminal", outcome: "partial", published, stoppedAt: p.path, reason: why });
+            const rest = planned.map((q) => q.path).filter((q) => !published.includes(q));
+            console.error(`apply-patch: PARTIAL — ${p.path}: ${why}\n  published: ${published.length > 0 ? published.join(", ") : "none"}\n  not published: ${rest.join(", ")}\nNothing is retried or rolled back; read the files and decide.`);
+            return 4;
+        }
+        published.push(p.path);
+        record({ type: "apply_file_published", path: p.path, action: p.action });
+        hook?.afterPublish?.(p.path);
+    }
+    record({ type: "publication_complete", files: published.length });
+    console.log(`apply-patch: adopted ${published.length} ${published.length === 1 ? "file" : "files"}: ${published.join(", ") || "(the workspace already had every change)"}`);
+    // ── VERIFY: the acceptance again, in the workspace ──────────────────────
+    const child = readOrNull(join(taskDir, "acceptance.json"));
+    const childVerdict = child === null ? "none" : JSON.parse(child.toString("utf8")).passed === true ? "PASSED" : "FAILED";
+    if (patch.acceptance === undefined) {
+        record({ type: "apply_terminal", outcome: "clean" });
+        console.log(`child acceptance: ${childVerdict} · workspace acceptance: none named — the merge was textual only`);
+        return 0;
+    }
+    const resolved = await resolveAcceptance(patch.acceptance, root);
+    if (typeof resolved === "string") {
+        record({ type: "apply_terminal", outcome: "clean", acceptance: "unresolved", reason: resolved });
+        console.log(`child acceptance: ${childVerdict} · workspace acceptance: not run — ${resolved}`);
+        return 0;
+    }
+    record({ type: "acceptance_started", ...resolved.label });
+    const v = await runInWorkspace(resolved, root);
+    record({ type: "acceptance_result", passed: v.passed, exitCode: v.exitCode });
+    record({ type: "apply_terminal", outcome: "clean" });
+    console.log(`child acceptance: ${childVerdict} · workspace acceptance: ${v.passed ? "PASSED" : "FAILED"} (exit ${v.exitCode ?? "killed"})${v.passed ? "" : `\n${v.tail}`}`);
+    return 0;
+}
+/** What an interrupted adoption left — the journal's facts, nothing guessed. */
+function interruptedReport(records) {
+    const files = records.filter((r) => r.type === "apply_file_published").map((r) => String(r.path));
+    const planned = records.find((r) => r.type === "apply_planned")?.files?.map((f) => f.path) ?? [];
+    if (records.some((r) => r.type === "acceptance_started")) {
+        return `apply-patch: an earlier adoption was interrupted — every file was published (${files.join(", ")}); its workspace acceptance started and its outcome is UNKNOWN. Nothing is retried: run the check yourself.`;
+    }
+    if (records.some((r) => r.type === "publication_complete")) {
+        return `apply-patch: an earlier adoption was interrupted — every file was published (${files.join(", ")}); its workspace acceptance was NOT COMPLETED. Nothing is retried: run the check yourself.`;
+    }
+    const rest = planned.filter((p) => !files.includes(p));
+    return `apply-patch: an earlier adoption was interrupted mid-publication — published: ${files.join(", ") || "none"}; not published: ${rest.join(", ") || "none"}. Nothing is retried or rolled back; read the files and decide.`;
+}
+/** B6.2's scope for 0.49: regular files created, modified or deleted. */
+function unsupportedOf(patch, root) {
+    const out = [];
+    const lower = new Map();
+    for (const f of patch.files) {
+        const key = f.path.toLowerCase();
+        const seen = lower.get(key);
+        if (seen !== undefined && seen !== f.path)
+            out.push(`${f.path}: differs from ${seen} only in case`);
+        lower.set(key, f.path);
+        if (!["A", "M", "D"].includes(f.status))
+            out.push(`${f.path}: a type change (${f.status})`);
+        if ([f.mode, f.baseMode].some((m) => m === "120000"))
+            out.push(`${f.path}: a symlink`);
+        if ([f.mode, f.baseMode].some((m) => m === "160000"))
+            out.push(`${f.path}: a submodule`);
+        if (f.status === "M" && f.mode !== f.baseMode)
+            out.push(`${f.path}: a mode change (${f.baseMode} → ${f.mode})`);
+        const target = join(root, f.path);
+        try {
+            if (lstatSync(target).isDirectory())
+                out.push(`${f.path}: a directory in the workspace`);
+        }
+        catch {
+            // absent — a creation, or already deleted
+        }
+        if (f.status === "A") {
+            // a new name whose case-folded twin already exists (macOS, Windows)
+            try {
+                const twin = readdirSync(dirname(target)).find((e) => e.toLowerCase() === basename(target).toLowerCase() && e !== basename(target));
+                if (twin !== undefined)
+                    out.push(`${f.path}: the workspace has ${twin}, differing only in case`);
+            }
+            catch {
+                // the directory does not exist yet
+            }
+        }
+    }
+    return out;
+}
+/** git merge-file's algorithm on scratch copies — the index never read. */
+function mergeThree(scratch, ours, base, theirs) {
+    const [o, b, t] = ["ours", "base", "theirs"].map((n) => join(scratch, n));
+    writeFileSync(o, ours);
+    writeFileSync(b, base);
+    writeFileSync(t, theirs);
+    const r = spawnSync("git", ["merge-file", "-p", "-L", "workspace", "-L", "base", "-L", "child", o, b, t], { maxBuffer: 256 * 1024 * 1024 });
+    if (r.status === null || r.status < 0)
+        throw new Error(`git merge-file failed: ${String(r.stderr)}`);
+    return { content: r.stdout, conflicts: r.status };
+}
+/** The conflicting hunks of a merged text, to name them. */
+function hunks(merged) {
+    const lines = merged.toString("utf8").split("\n");
+    const out = [];
+    let inside = false;
+    for (const l of lines) {
+        if (l.startsWith("<<<<<<< "))
+            inside = true;
+        if (inside)
+            out.push(`    ${l}`);
+        if (l.startsWith(">>>>>>> "))
+            inside = false;
+        if (out.length > 60) {
+            out.push("    …");
+            break;
+        }
+    }
+    return out.join("\n");
+}
+/** One file, revalidated against PREPARE; null when published. */
+function publish(target, p) {
+    const now = () => {
+        const b = readOrNull(target);
+        return b === null ? ABSENT : sha(b);
+    };
+    if (now() !== p.expected)
+        return "it changed after the merge was prepared";
+    if (p.action === "delete") {
+        unlinkSync(target);
+        return null;
+    }
+    mkdirSync(dirname(target), { recursive: true });
+    const tmp = join(dirname(target), `.${basename(target)}.kiso-apply-${process.pid}`);
+    writeFileSync(tmp, p.content);
+    if (p.action === "create") {
+        chmodSync(tmp, p.exec === true ? 0o755 : 0o644);
+        // WR-1A ②: link(2) or refusal — no-clobber, fail closed
+        try {
+            linkSync(tmp, target);
+            return null;
+        }
+        catch (err) {
+            return err.code === "EEXIST" ? "it was created in the workspace after the merge was prepared" : `it could not be created atomically (${err.code ?? "link failed"})`;
+        }
+        finally {
+            rmSync(tmp, { force: true });
+        }
+    }
+    chmodSync(tmp, statSync(target).mode & 0o7777);
+    // WR-1A ③: still what the merge was prepared against, right before the rename
+    if (now() !== p.expected) {
+        rmSync(tmp, { force: true });
+        return "it changed while the adoption was writing";
+    }
+    renameSync(tmp, target);
+    return null;
+}
+/** The acceptance by its NAME, from the configuration (a trusted project's
+ *  too, never asked here) — or why it cannot run. */
+async function resolveAcceptance(acceptance, root) {
+    const user = loadUserConfig();
+    let project = null;
+    if (resolveProjectTrustPolicy(user ?? {}) !== "never") {
+        const artifacts = await projectArtifacts(root);
+        if (artifacts !== null && trustFor(artifacts.root, artifacts.digest)?.decision === "granted")
+            project = loadProjectConfig(root, true);
+    }
+    const merged = mergeConfigs(user, project);
+    if (acceptance.check !== undefined) {
+        const command = merged.checks?.[acceptance.check];
+        if (command === undefined)
+            return `the check "${acceptance.check}" is no longer configured`;
+        return { command: process.platform === "win32" ? "bash" : "/bin/sh", args: ["-c", command], label: { check: acceptance.check } };
+    }
+    if (acceptance.evaluator !== undefined) {
+        if (!(merged.evaluators ?? []).includes(acceptance.evaluator))
+            return `the evaluator ${acceptance.evaluator} is no longer listed`;
+        return { command: acceptance.evaluator, args: [root], label: { evaluator: acceptance.evaluator } };
+    }
+    return "the patch names no acceptance";
+}
+/** The check in the workspace — no git state touched, its tail kept. */
+function runInWorkspace(r, root) {
+    return new Promise((resolve) => {
+        let out = "";
+        const child = spawn(r.command, [...r.args], { cwd: root, stdio: ["ignore", "pipe", "pipe"] });
+        const keep = (d) => {
+            out = (out + d.toString("utf8")).slice(-2_048);
+        };
+        child.stdout.on("data", keep);
+        child.stderr.on("data", keep);
+        child.on("error", (err) => resolve({ passed: false, exitCode: null, tail: err.message }));
+        child.on("exit", (code) => resolve({ passed: code === 0, exitCode: code, tail: out }));
+    });
+}
+function readOrNull(path) {
+    try {
+        return readFileSync(path);
+    }
+    catch {
+        return null;
+    }
+}
+function readJournal(path) {
+    if (!existsSync(path))
+        return [];
+    return readFileSync(path, "utf8")
+        .split("\n")
+        .filter((l) => l.trim() !== "")
+        .flatMap((l) => {
+        try {
+            return [JSON.parse(l)];
+        }
+        catch {
+            return [];
+        }
+    });
+}
+function git(cwd, args) {
+    const r = spawnSync("git", ["-C", cwd, ...args], { encoding: "utf8" });
+    if (r.status !== 0)
+        throw new Error(r.stderr);
+    return r.stdout;
+}

package/dist/builtin.js

@@ -25,7 +25,7 @@ import createSkills from "@vincemakes/kiso-skills-ext";
 import createSubagent from "@vincemakes/kiso-subagent-ext";
 import createAsk, {} from "@vincemakes/kiso-ask-ext";
 import { getDontAsk } from "./mode.js";
-import { tasksFor } from "./state.js";
+import { bindingFor, codingToolOptions, tasksFor } from "./state.js";
 /**
  * 0.40.0 (the owner's dogfood): dontAsk never asks, so its tool table never
  * offers ask_user — a model once put four questions to a dontAsk session
@@ -60,8 +60,9 @@ ask,
 secretEnvNames = []) {
     // ADR-0058 3d: the session's task manager makes `delegate` offer
     // background children (explorer/reviewer; the cap and the turn budget
-    // are the extension's defaults)
-    const all = await Promise.all([createMcp({ secretEnvNames }), createSkills(), createSubagent({ tasks: tasksFor }), ...(ask === undefined ? [] : [createAsk(ask).then(offInDontAsk)])]);
+    // are the extension's defaults). 0.49.0 C1: the session's live binding
+    // is the model a child runs on when its task names none.
+    const all = await Promise.all([createMcp({ secretEnvNames }), createSkills(), createSubagent({ tasks: tasksFor, currentBinding: bindingFor, ...joinOption() }), ...(ask === undefined ? [] : [createAsk(ask).then(offInDontAsk)])]);
     const shadowed = all.filter((b) => user.some((u) => u.name === b.name));
     for (const s of shadowed) {
         console.error(`[extensions] user extension "${s.name}" shadows the built-in — the built-in is not loaded`);
@@ -73,3 +74,9 @@ secretEnvNames = []) {
     }
     return all.filter((b) => !shadowed.includes(b));
 }
+/** 0.49.0 A: a reader delegation waits as long as a shell command does —
+ *  one knob for "the foreground wait" (KISO_MIN_FOREGROUND_MS reaches both). */
+function joinOption() {
+    const floor = codingToolOptions().limits?.minForegroundMs;
+    return floor !== undefined ? { joinMs: floor } : {};
+}

package/dist/chat.d.ts

@@ -134,8 +134,8 @@ export declare function statusModelLabel(session: {
     };
 }): string;
 /** ADR-0055 Amendment 2 (decision 5): with no stated window the status row
- *  shows `ctx ?`, yet the compaction tiers still assume the fallback (128K
- *  since CW-1 batch 2)
+ *  shows `ctx ?`, yet the compaction tiers still assume the fallback (200K;
+ *  128K from CW-1 batch 2 until the owner's 2026-10-09 ruling)
  *  — the assumption is said out loud once, at agent build. */
 export declare function unknownWindowNotice(model: string): string;
 /** CW-1 batch 2: said once, when an endpoint's refusal states its cap — the

package/dist/chat.js

@@ -9,7 +9,7 @@ import { escapeTerminal, cacheHitPct, decodeRate, palette, renderEvent, renderRe
 import { askView, coldResumeLine, coldResumeView, deletionRiskHint, editFileHunksDiff, hunksOf, writeFileDiff } from "@vincemakes/kiso-tui";
 import { canonicalTargetPath, isProtectedPath, protectedIdentity, shellProgressPath } from "@vincemakes/kiso-tools-node";
 import { deliveryLines, liveTasks, lostToldOf, mergedConfig, queuedSwitchLines, setExitTasks, tasksFor, taskWhatOf } from "./state.js";
-import { taskCounts, taskNoticeLines, taskNoticeRows, tasksForDisplay } from "./task-notice.js";
+import { budgetSpentLine, taskCounts, taskNoticeLines, taskNoticeRows, tasksForDisplay } from "./task-notice.js";
 import { current as inRunCompaction, takeKept as takeKeptCompaction } from "./in-run-compaction.js";
 import { echoText } from "@vincemakes/kiso-tui-cells/render";
 import { canonicalizeUsage, RunClosedError } from "@vincemakes/kiso-runtime";
@@ -27,11 +27,18 @@ import { addDontAskAgainRule, askPanel, fixHintFor, pendingAsk, resolveUncertain
 import { FauxExhaustionError, failOnFauxExhaustion } from "./faux-glue.js";
 import { MODE_LABEL, OFFERED_MODES, getDontAsk, getMode, modeDisplay, setMode } from "./mode.js";
 /** B area: default context window for the ~ctx estimate (config overridable).
- *  CW-1 batch 2: 128,000, down from 200,000 — the figure a model nobody
- *  states a window for is assumed to hold (the reference implementation's
- *  default too). Too small costs an early compaction; too large costs a
- *  refused request on a 128K model. Registered models never reach it. */
-const DEFAULT_CONTEXT_WINDOW = 128_000;
+ *  The figure a model nobody states a window for is assumed to hold.
+ *  Registered models never reach it.
+ *
+ *  200,000 again since the owner's ruling of 2026-10-09, which reverses CW-1
+ *  batch 2's 128,000. The same batch made an endpoint's refusal teach its
+ *  real cap, kept across sessions and only ever lowered. So a figure too
+ *  large costs one refused request per endpoint and model, once, while a
+ *  figure too small compacts every session early and never corrects
+ *  itself (gpt-6.1-sol, 272K and unregistered in 0.47.3, compacted from
+ *  64K). 200K, not more: a 128K model's soft tier (100K) still usually
+ *  compacts it before its wall. */
+const DEFAULT_CONTEXT_WINDOW = 200_000;
 /** The in-process fake provider's id, and the window we declare for it.
  *  Ours to state: faux is not a vendor's model, so "nobody published a
  *  window" — the reason a real model's capacity is unknown — cannot apply.
@@ -236,8 +243,8 @@ export function statusModelLabel(session) {
     return effort !== undefined && effort !== "default" ? `${name} · ${effort}` : name;
 }
 /** ADR-0055 Amendment 2 (decision 5): with no stated window the status row
- *  shows `ctx ?`, yet the compaction tiers still assume the fallback (128K
- *  since CW-1 batch 2)
+ *  shows `ctx ?`, yet the compaction tiers still assume the fallback (200K;
+ *  128K from CW-1 batch 2 until the owner's 2026-10-09 ruling)
  *  — the assumption is said out loud once, at agent build. */
 export function unknownWindowNotice(model) {
     return `[kiso] context window unknown for ${model} at this endpoint — compaction assumes ${DEFAULT_CONTEXT_WINDOW / 1000}K; set contextWindow on the profile to state it`;
@@ -1771,6 +1778,11 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
     // the same chain a person's turn takes (taskWake: false keeps it for
     // the next message). Released when this chat ends.
     const taskManager = tasksFor(session.id);
+    // 0.49.0 B: writers that ended while nobody listened are collected
+    // BEFORE the delivery is built — so they arrive as anything that ended
+    // meanwhile does, as a notify, never a wake
+    if (taskManager !== undefined)
+        await taskManager.collectPending();
     // KISO_AUTO_DETACH_MS — the test rigs' knob (like KISO_STREAM_IDLE_MS):
     // how old a command must be before a steer detaches it (3e D1). The
     // rigs that hold a steer pending behind a long command raise it.
@@ -1779,6 +1791,7 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
         ? () => { }
         : session.useTasks(taskManager, {
             wake: mergedConfig.taskWake !== false,
+            ...(mergedConfig.maxWakes !== undefined ? { maxWakes: mergedConfig.maxWakes } : {}),
             onWake: (w) => queueTurn(w.content, w.via),
             // Amendment 8: a loss is said when kiso concludes it — the
             // model's notice still rides the next run, and is not said again
@@ -1789,6 +1802,8 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
                 for (const line of taskNoticeLines(ids.map((taskId) => ({ taskId, transition: "unknown" })), taskWhatOf(session.id)))
                     body.notice(line);
             },
+            // 0480-F9: the chain went quiet on its budget — say so, once
+            onBudgetSpent: (info) => body.notice(budgetSpentLine(info)),
             ...(Number.isFinite(autoDetachFromEnv) && autoDetachFromEnv >= 0 ? { autoDetachMinAgeMs: autoDetachFromEnv } : {}),
         });
     // 3e: a task's change repaints the row it is counted on

package/dist/child-result.d.ts

@@ -11,8 +11,16 @@
  *
  * The answer is the child's own — the last assistant text in its session's
  * projection, never its printed output — written atomically to `<r>`
- * (result.md) with `{ outcome, requests, budget }` beside it (result.json),
- * before the process exits: the runner records the exit after both exist.
+ * (result.md), then the result record beside it (result.json), before the
+ * process exits: the runner records the exit after both exist.
+ *
+ * 0.49.0 (I5, I6): the record COMMITS the result — result.md is read only
+ * beside it — and it says everything the parent shows: how the run ended
+ * (`endedBy`, the main run's terminal: a wrap-up is a second run, and the
+ * parent never counts runs to learn it), the requests, the tool calls and
+ * usage over the committed events, the model it ran on, and a failure's
+ * error. Foreground children carry a result file too, so both ways of
+ * waiting read the same record.
  */
 import type { AgentSession } from "@vincemakes/kiso-runtime";
 export interface ChildEnd {

package/dist/child-result.js

@@ -11,17 +11,27 @@
  *
  * The answer is the child's own — the last assistant text in its session's
  * projection, never its printed output — written atomically to `<r>`
- * (result.md) with `{ outcome, requests, budget }` beside it (result.json),
- * before the process exits: the runner records the exit after both exist.
+ * (result.md), then the result record beside it (result.json), before the
+ * process exits: the runner records the exit after both exist.
+ *
+ * 0.49.0 (I5, I6): the record COMMITS the result — result.md is read only
+ * beside it — and it says everything the parent shows: how the run ended
+ * (`endedBy`, the main run's terminal: a wrap-up is a second run, and the
+ * parent never counts runs to learn it), the requests, the tool calls and
+ * usage over the committed events, the model it ran on, and a failure's
+ * error. Foreground children carry a result file too, so both ways of
+ * waiting read the same record.
  */
 import { renameSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 export const wrapUpInput = (budget) => `Your turn budget of ${budget} model requests is spent. Answer now from what you have found, without further tool calls. End with the UNRESOLVED section, naming what you did not get to.`;
 export async function finishChild(session, end) {
-    const lastOutcome = () => {
+    const lastTerminal = () => {
         const t = [...session.log.all].reverse().find((e) => e.type === "terminal");
-        return t === undefined ? undefined : t.outcome.kind;
+        return t === undefined ? undefined : t.outcome;
     };
+    const lastOutcome = () => lastTerminal()?.kind;
+    const main = lastTerminal();
     let outcome = lastOutcome() === "completed" ? "completed" : "failed";
     if (end.maxTurns !== undefined && lastOutcome() === "max_turns") {
         for await (const _ of session.run(wrapUpInput(end.maxTurns), { source: "system", maxTurns: 1 })) {
@@ -33,12 +43,49 @@ export async function finishChild(session, end) {
         return;
     const answer = lastAnswer(session);
     const requests = session.log.all.filter((e) => e.type === "stop").length;
+    const events = committed(session.log.all);
+    const usages = events.filter((e) => e.type === "usage");
+    const sum = (k) => usages.reduce((n, e) => n + (typeof e[k] === "number" ? e[k] : 0), 0);
+    const error = outcome === "failed" ? errorOf(lastTerminal()) : undefined;
+    const record = {
+        outcome,
+        endedBy: main?.kind ?? "none",
+        requests,
+        ...(end.maxTurns !== undefined ? { budget: end.maxTurns } : {}),
+        toolCalls: events.filter((e) => e.type === "tool_call_end").length,
+        usage: {
+            completedResponses: usages.length,
+            abandonedAttempts: session.log.all.filter((e) => e.type === "model_output_abandoned").length,
+            inputTokens: sum("inputTokens"),
+            outputTokens: sum("outputTokens"),
+            cacheRead: sum("cacheRead"),
+        },
+        model: session.model,
+        profile: session.profileName,
+        ...(error !== undefined ? { error } : {}),
+    };
     writeAtomic(end.resultFile, answer === "" ? "" : `${answer}\n`);
-    writeAtomic(join(dirname(end.resultFile), "result.json"), `${JSON.stringify({ outcome, requests, ...(end.maxTurns !== undefined ? { budget: end.maxTurns } : {}) })}\n`);
+    // I5: the record last — it commits the answer written above
+    writeAtomic(join(dirname(end.resultFile), "result.json"), `${JSON.stringify(record)}\n`);
     // the runner's terminal is the exit: a failed child must not read as a clean one
     if (outcome === "failed")
         process.exitCode = 1;
 }
+/** The kernel's void scope (core `project.ts`): a `model_output_abandoned`
+ *  marker voids (voidFromSeq, seq], an abandoned draft's events. A voided
+ *  tool call never ran and a voided usage was never billed as an answer. */
+function committed(events) {
+    const voids = events.filter((e) => e.type === "model_output_abandoned").map((e) => ({ from: e.voidFromSeq ?? -1, to: e.seq ?? -1 }));
+    return events.filter((e) => !voids.some((r) => (e.seq ?? -1) > r.from && (e.seq ?? -1) <= r.to));
+}
+/** A failed run's reason, one line: the kernel's error, or how it ended. */
+function errorOf(t) {
+    if (t === undefined)
+        return "the run left no terminal";
+    if (t.kind === "error" && t.error !== undefined)
+        return [t.error.code, t.error.message].filter((s) => s !== undefined && s !== "").join(": ") || "error";
+    return `the run ended with ${t.kind}`;
+}
 /** The last assistant message's text in the session's projection. */
 function lastAnswer(session) {
     const messages = session.projected();

package/dist/coding-prompt.d.ts

@@ -9,7 +9,7 @@
  */
 /** The built-in prompt. Exported for scripts/request-surface.mjs — the
  *  model-side token-rent counter measures the REAL bytes, never a copy. */
-export declare const SYSTEM_PROMPT = "You are kiso, a coding agent. You work in a workspace\ndirectory and change code with tools. Be concise: answer in a few lines\nunless the task genuinely needs more. Never claim a file was changed\nunless a tool confirmed it.\n\nWhat you can reach:\n- The workspace: read_file, list_dir, search_text, write_file, edit_file.\n- This machine and the network: shell \u2014 builds, tests, git, package\n  managers, curl for HTTP, system queries. A request one command can\n  answer is answered by running it.\n- The human: ask_user, for a decision that is theirs.\n\nTool discipline:\n- READ BEFORE YOU EDIT. For any file you are about to change, read it\n  first \u2014 never guess its content.\n- Use edit_file for targeted changes and write_file for full rewrites.\n  Prefer many small edits over one large write.\n- Be careful \u2014 shell has side effects and may take time.\n- search_text and list_dir are cheap \u2014 locate first, then read ranges\n  with read_file offset/limit; never read a whole large file in one call.\n- Do not re-read a file you already read unchanged, or one you changed\n  yourself through a confirmed edit \u2014 rely on the earlier result and\n  on the change you just made.\n- When a tool fails, read the error and adjust; do not repeat the same\n  call blindly.\n\nAn authorization covers what it NAMES: when the scope is not named \u2014\nwhich files, which branches, whether to push \u2014 ask before acting.\nDelivering, sharing or handing over changes means committing locally and\nstopping; pushing, publishing or sending happens only when the human\nnames it.\n\nWorkflow: understand the request, find the relevant code, make the\nsmallest change that works, then verify with a command (tests/build).\nReport what you did in one or two lines per change.";
+export declare const SYSTEM_PROMPT = "You are kiso, a coding agent. You work in a workspace\ndirectory and change code with tools. Be concise: answer in a few lines\nunless the task genuinely needs more. Never claim a file was changed\nunless a tool confirmed it.\n\nWhat you can reach:\n- The workspace: read_file, list_dir, search_text, write_file, edit_file.\n- This machine and the network: shell \u2014 builds, tests, git, package\n  managers, curl for HTTP, system queries. A request one command can\n  answer is answered by running it.\n- The human: ask_user, for a decision that is theirs.\n\nTool discipline:\n- READ BEFORE YOU EDIT. For any file you are about to change, read it\n  first \u2014 never guess its content.\n- Use edit_file for targeted changes and write_file for new files or\n  full rewrites.\n- Be careful \u2014 shell has side effects and may take time.\n- search_text and list_dir are cheap \u2014 locate first, then read ranges\n  with read_file offset/limit; never read a whole large file in one call.\n- Do not re-read a file you already read unchanged, or one you changed\n  yourself through a confirmed edit \u2014 rely on the earlier result and\n  on the change you just made.\n- When a tool fails, read the error and adjust; do not repeat the same\n  call blindly.\n\nAn authorization covers what it NAMES: when the scope is not named \u2014\nwhich files, which branches, whether to push \u2014 ask before acting.\nDelivering, sharing or handing over changes means committing locally and\nstopping; pushing, publishing or sending happens only when the human\nnames it.\n\nWorkflow: understand the request, find the relevant code, make the\nsmallest change that works, then verify with a command (tests/build).\nReport what you did in one or two lines per change.";
 /** Hard cap for injected instructions — truncate and say so. */
 /**
  * A area: read the FIRST present instruction file (AGENTS.md preferred) and

package/dist/coding-prompt.js

@@ -28,8 +28,8 @@ What you can reach:
 Tool discipline:
 - READ BEFORE YOU EDIT. For any file you are about to change, read it
   first — never guess its content.
-- Use edit_file for targeted changes and write_file for full rewrites.
-  Prefer many small edits over one large write.
+- Use edit_file for targeted changes and write_file for new files or
+  full rewrites.
 - Be careful — shell has side effects and may take time.
 - search_text and list_dir are cheap — locate first, then read ranges
   with read_file offset/limit; never read a whole large file in one call.

package/dist/config.d.ts

@@ -105,6 +105,9 @@ export interface KisoConfig {
     /** ADR-0058 §8.4: false turns every task wake into a notice that waits
      *  for your next message. Default on. */
     readonly taskWake?: boolean;
+    /** ADR-0058 Amendment 9: autonomous wakes allowed after one message of yours
+     *  before a task's end only notifies. Default 20. */
+    readonly maxWakes?: number;
     readonly projectTrust?: "ask" | "never";
     /** DC-3 §3 rung 1, persisted. The terminal's light/dark, for terminals
      *  that answer neither `CSI ? 996 n` nor OSC 11. USER-LEVEL ONLY: a
@@ -135,6 +138,14 @@ export interface KisoConfig {
      *  unlisted path could be an interpreter running code the child wrote.
      *  Same layers as `checks`. */
     readonly evaluators?: readonly string[];
+    /** 0.49.0 C1: which profile a delegated child runs on when its task
+     *  names none — `{ "model": "<a profile in models>" }`. Unset, a child
+     *  runs on the conversation's own profile. USER-LEVEL ONLY, like
+     *  `models`: a project must never choose where your children's
+     *  requests go. */
+    readonly subagents?: {
+        readonly model?: string;
+    };
 }
 /** The resolved, merged config — project wins over user, both validated. */
 export interface ResolvedConfig {

package/dist/config.js

@@ -235,11 +235,32 @@ export function parseConfig(text, source) {
             fail("taskWake", "expected true or false");
         out.taskWake = obj.taskWake;
     }
+    if (obj.maxWakes !== undefined) {
+        if (typeof obj.maxWakes !== "number" || !Number.isInteger(obj.maxWakes) || obj.maxWakes < 0)
+            fail("maxWakes", "expected a whole number, 0 or more");
+        out.maxWakes = obj.maxWakes;
+    }
     if (obj.projectTrust !== undefined) {
         if (obj.projectTrust !== "ask" && obj.projectTrust !== "never")
             fail("projectTrust", 'expected "ask" or "never" (there is deliberately no "always")');
         out.projectTrust = obj.projectTrust;
     }
+    if (obj.subagents !== undefined) {
+        if (source.startsWith("<cwd>"))
+            fail("subagents", "belongs in the USER config — a project must never choose which model your delegated children run on");
+        if (obj.subagents === null || typeof obj.subagents !== "object" || Array.isArray(obj.subagents))
+            fail("subagents", 'expected an object, e.g. { "model": "<profile>" }');
+        const sub = obj.subagents;
+        if (sub.model !== undefined) {
+            if (typeof sub.model !== "string" || sub.model === "")
+                fail("subagents.model", "expected the name of a profile in models");
+            // both keys are user-level only, so the profile is in this file or nowhere
+            const names = Object.keys(out.models ?? {});
+            if (!names.includes(sub.model))
+                fail("subagents.model", `"${sub.model}" names no profile in models (configured: ${names.length > 0 ? names.join(", ") : "none"})`);
+        }
+        out.subagents = sub.model !== undefined ? { model: sub.model } : {};
+    }
     return out;
 }
 function readConfigFile(path, source) {
@@ -312,12 +333,16 @@ export function mergeConfigs(user, project) {
         ...(p.autoCompact !== undefined ? { autoCompact: p.autoCompact } : {}),
         ...(u.taskWake !== undefined ? { taskWake: u.taskWake } : {}),
         ...(p.taskWake !== undefined ? { taskWake: p.taskWake } : {}),
+        ...(u.maxWakes !== undefined ? { maxWakes: u.maxWakes } : {}),
+        ...(p.maxWakes !== undefined ? { maxWakes: p.maxWakes } : {}),
         ...(u.projectTrust !== undefined ? { projectTrust: u.projectTrust } : {}),
         ...(p.projectTrust !== undefined ? { projectTrust: p.projectTrust } : {}),
         // DT-1a: checks merge per name — a (trusted) project's check wins over the user's
         ...(u.checks !== undefined || p.checks !== undefined ? { checks: { ...(u.checks ?? {}), ...(p.checks ?? {}) } } : {}),
         // CS-1: the evaluator lists join — either layer's script may be named
         ...(u.evaluators !== undefined || p.evaluators !== undefined ? { evaluators: [...(u.evaluators ?? []), ...(p.evaluators ?? [])] } : {}),
+        // 0.49.0 C1: user-level only — parseConfig refuses a project's
+        ...(u.subagents !== undefined ? { subagents: u.subagents } : {}),
     };
 }
 /** Where a profile's sign-in comes from, or why it has none. The sign-in

package/dist/create-coding-agent.js

@@ -168,14 +168,11 @@ export async function createCodingAgent(sessionId, input, modelFlag) {
     settingsLayers.project = projectCfg;
     settingsLayers.modelFlag = modelFlag;
     const secretEnvNames = secretEnvNamesOf(merged.models ?? {});
-    const builtIn = await builtInLayer(user, proj, input !== undefined && process.stdin.isTTY ? askUi(input) : undefined, secretEnvNames);
-    setExtensionLists(builtIn, user, proj, [...builtIn, ...user, ...proj]);
-    // merge round B — the config surface: user config + (trusted) project config,
-    // resolved with flags > env > project > user > default. The CLI never
-    // imports provider SDKs directly — the runtime's lazy provider
-    // resolution owns them (a config profile only ever NAMES an env var for
-    // its key; the key itself never sits in a config file).
-    setMergedConfig(merged);
+    // SA-F1: set BEFORE the built-in layer loads. The subagent extension reads
+    // it once, at load, to build the delegate schema and its executor's
+    // snapshot; assigned after, it read an empty config (no `acceptance` or
+    // `model` field, a configured check refused, `subagents.model` ignored,
+    // project-layout children in the legacy sessions folder).
     // DT-1a: what a delegated task may NAME — the configured checks and the
     // model profiles — handed to the (in-process) subagent extension through
     // the environment. A model never supplies a command; it names a check.
@@ -184,7 +181,22 @@ export async function createCodingAgent(sessionId, input, modelFlag) {
     // channel and not an exported KISO_SESSIONS_DIR: a variable in
     // process.env would reach every shell child, and a kiso started from a
     // shell tool would then write into this project's folder.
-    process.env.KISO_DELEGATION_CONFIG_JSON = JSON.stringify({ checks: merged.checks ?? {}, evaluators: merged.evaluators ?? [], profiles: Object.keys(merged.models ?? {}), sessionsDir: sessionsDir() });
+    process.env.KISO_DELEGATION_CONFIG_JSON = JSON.stringify({
+        checks: merged.checks ?? {},
+        evaluators: merged.evaluators ?? [],
+        profiles: Object.keys(merged.models ?? {}),
+        sessionsDir: sessionsDir(),
+        // 0.49.0 C1: the profile a child runs on when its task names none
+        ...(merged.subagents?.model !== undefined ? { subagentsModel: merged.subagents.model } : {}),
+    });
+    const builtIn = await builtInLayer(user, proj, input !== undefined && process.stdin.isTTY ? askUi(input) : undefined, secretEnvNames);
+    setExtensionLists(builtIn, user, proj, [...builtIn, ...user, ...proj]);
+    // merge round B — the config surface: user config + (trusted) project config,
+    // resolved with flags > env > project > user > default. The CLI never
+    // imports provider SDKs directly — the runtime's lazy provider
+    // resolution owns them (a config profile only ever NAMES an env var for
+    // its key; the key itself never sits in a config file).
+    setMergedConfig(merged);
     setConfigModels(merged.models ?? {});
     // CW-1 batch 2: the windows endpoints stated by refusing — read before the
     // first window is asked for (the unknown-window notice below).
@@ -277,6 +289,11 @@ export async function createCodingAgent(sessionId, input, modelFlag) {
         // picked for it (the picker's fallback applied); the runtime reads it
         // for a new session only — a resumed one keeps its own
         ...(() => {
+            // 0.49.0 C1: a delegated child on its conversation's profile runs at
+            // the conversation's effort, not at the one remembered for the profile
+            const inherited = childReasoning();
+            if (inherited !== null)
+                return { reasoning: inherited };
             if (resolved === null || merged.models?.[resolved.name] !== resolved.profile)
                 return {};
             const effort = startingEffort(resolved.profile, preferences().effort?.[resolved.name]);
@@ -370,3 +387,20 @@ export async function createCodingAgent(sessionId, input, modelFlag) {
     };
     return createAgent(definition);
 }
+/** 0.49.0 C1: the effort the subagent extension hands a child running on its
+ *  conversation's profile (KISO_CHILD_REASONING). Read only in a child — a
+ *  top-level kiso ignores a stray variable — and only in its known shape. */
+function childReasoning() {
+    if ((Number.parseInt(process.env.KISO_SUBAGENT_DEPTH ?? "0", 10) || 0) < 1)
+        return null;
+    const raw = process.env.KISO_CHILD_REASONING;
+    if (raw === undefined || raw === "")
+        return null;
+    try {
+        const r = JSON.parse(raw);
+        return typeof r.thinking === "string" && typeof r.effort === "string" ? { thinking: r.thinking, effort: r.effort } : null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/index.d.ts

@@ -25,7 +25,7 @@
  */
 import { type SessionRoute } from "./projects.js";
 export { contextPolicyFromEnv } from "./create-coding-agent.js";
-export { SYSTEM_PROMPT, composeSystemPrompt, readProjectInstructions } from "./coding-prompt.js";
+export { SYSTEM_PROMPT, CODING_TOOL_RULES, composeSystemPrompt, readProjectInstructions } from "./coding-prompt.js";
 export { applyProjectMerges } from "./trust-ui.js";
 export { workspaceRoot } from "./state.js";
 /**

package/dist/index.js

@@ -41,7 +41,7 @@ import { browserCommand, launchCommand } from "./launch.js";
 import { createFauxProvider } from "@vincemakes/kiso-evals";
 import { isProtectedPath, protectedIdentity, PROTECTED_REFUSAL } from "@vincemakes/kiso-tools-node";
 import { OFFERED_MODES, applyModeState, envModeLayer, getDontAsk, modeDisplay, parseMode, resolveModeLayers } from "./mode.js";
-import { activeStoreDir, setActiveStoreDir, agentModel, atFiles, body, bodyLog, kisoHome, workspaceRoot, projectRoot, ownSessionsDir, setOpenSessionFolder, builtInExtensions, currentFaux, dock, loadedExtensions, mergedConfig, mergedTempPaths, modelChoice, projectExtensions, configModels, configuredWindow, agentBaseUrl, currentModelName, currentAgentExtensions, sessionStoreRef, sessionsDir, setAgentModel, setBody, setConfigModels, setConfiguredWindow, setCurrentAgentExtensions, setCurrentFaux, setCurrentModelName, setCurrentProfileName, setExtensionLists, protectedFiles, setMergedConfig, setModelChoice, setSessionStore, userExtensions, VERSION, lastBinding, acceptDrift, setAcceptDrift, loadedSkillsCatalog, queuedSwitchLines } from "./state.js";
+import { activeStoreDir, setActiveStoreDir, agentModel, atFiles, body, bodyLog, kisoHome, workspaceRoot, projectRoot, ownSessionsDir, setOpenSessionFolder, builtInExtensions, currentFaux, dock, loadedExtensions, mergedConfig, mergedTempPaths, modelChoice, projectExtensions, configModels, configuredWindow, agentBaseUrl, currentModelName, currentAgentExtensions, sessionStoreRef, sessionsDir, setAgentModel, setBody, setConfigModels, setConfiguredWindow, setCurrentAgentExtensions, setCurrentFaux, setCurrentModelName, setCurrentProfileName, setExtensionLists, setLiveSession, protectedFiles, setMergedConfig, setModelChoice, setSessionStore, userExtensions, VERSION, lastBinding, acceptDrift, setAcceptDrift, loadedSkillsCatalog, queuedSwitchLines } from "./state.js";
 import { fauxSkip, readFauxScript } from "./faux-glue.js";
 import { barFor, chat, contextWindowTokens, displayCtxRatio, microcompactThresholdFor, statusModelLabel } from "./chat.js";
 import { preferences, usePreferences } from "./preferences.js";
@@ -63,7 +63,7 @@ import { clipboardImage } from "./clipboard.js";
 import { cardsFromListings } from "./session-cards.js";
 import { createCodingAgent } from "./create-coding-agent.js";
 export { contextPolicyFromEnv } from "./create-coding-agent.js";
-export { SYSTEM_PROMPT, composeSystemPrompt, readProjectInstructions } from "./coding-prompt.js";
+export { SYSTEM_PROMPT, CODING_TOOL_RULES, composeSystemPrompt, readProjectInstructions } from "./coding-prompt.js";
 // The moved exports stay reachable from this entry — the test imports
 // (project-trust, coding-agent) never change (B4: zero assertion changes).
 export { applyProjectMerges } from "./trust-ui.js";
@@ -841,6 +841,8 @@ function bindRestoredSession(session) {
         bodyLog(`binding changed — now on ${session.model}: ${ack.reasons.join("; ")}; reasoning reset to defaults${prior === "" ? "" : ` (was ${prior})`}`);
     }
     setAgentModel(session.model, session.baseUrl);
+    // 0.49.0 C1: the session a delegation reads its conversation's binding from
+    setLiveSession(session);
     session.setMicrocompactThreshold(microcompactThresholdFor({
         model: session.model,
         ...(session.baseUrl !== undefined ? { baseUrl: session.baseUrl } : {}),
@@ -1257,6 +1259,13 @@ async function main() {
     // first createCodingAgent (the tier extensions read `current` live). The flag
     // is stripped from the positional args, so it works in any position.
     const args = process.argv.slice(2);
+    // 0.49.0 B6.2: `kiso apply-patch <taskDir>` adopts a writer's collected
+    // patch into the workspace — a one-shot effect, no session, no model
+    if (args[0] === "apply-patch") {
+        const { applyPatch } = await import("./apply-patch.js");
+        process.exitCode = await applyPatch(args.slice(1));
+        return;
+    }
     // XP-1: --accept-drift (a flag, never an env var) authorizes opening a
     // session whose recorded profile materially drifted — the
     // acknowledgement is recorded as a new revision by the runtime.
@@ -1847,6 +1856,7 @@ async function main() {
                     "  kiso resume              pick a session to continue (TTY picker)\n" +
                     "  kiso resume <id> [prompt]   continue a session (one-shot)\n" +
                     "  kiso sessions [--all|--current]   list durable sessions (a terminal shows this workspace's by default)\n" +
+                    "  kiso apply-patch <dir>   adopt a subagent's collected patch (its handoff prints the command)\n" +
                     "  kiso login <provider>    anthropic|openai|deepseek|zai: store an API key (hidden prompt, or stdin when piped);\n" +
                     "                           chatgpt: sign in with a ChatGPT subscription (browser; unofficial third-party flow)\n" +
                     "  kiso login --endpoint <url>    a gateway: store its API key for that URL's origin only\n" +

package/dist/state.d.ts

@@ -8,6 +8,7 @@
 import { Dock, type AtItem, type Body, type PanelVerdict, type PanelView, type SaferAnswer, type SessionCardView } from "@vincemakes/kiso-tui";
 import type { TaskDeliveryItem } from "@vincemakes/kiso-core";
 import type { KisoExtension, StoreRecord } from "@vincemakes/kiso-runtime";
+import type { ReasoningSetting } from "@vincemakes/kiso-runtime/internal";
 import { TaskManager } from "@vincemakes/kiso-runtime/internal";
 import { type ShellTasks } from "@vincemakes/kiso-tools-node";
 /** finding #11: KISO_HOME is the ONE root — every default path derives from
@@ -34,6 +35,9 @@ export declare function codingToolOptions(): {
     readonly secretEnvNames: readonly string[];
     readonly protectedFiles: readonly string[];
     readonly tasks: (sessionId: string | undefined) => ShellTasks | undefined;
+    readonly limits?: {
+        readonly minForegroundMs: number;
+    };
 };
 /** Amendment 8: what a session's task ran — a lost task's transcript row
  *  names it. Undefined when the task or its journal cannot be read. */
@@ -41,6 +45,30 @@ export declare function taskWhatOf(sessionId: string | undefined): (taskId: stri
 export declare function lostToldOf(sessionId: string): Set<string>;
 /** The transcript lines a delivery shows: a loss already told is left out. */
 export declare function deliveryLines(sessionId: string, items: readonly TaskDeliveryItem[]): string[];
+/** 0.49.0 C1: the live sessions by id — what a delegation reads its
+ *  conversation's binding from. Every entry registers its session
+ *  (index.ts bindRestoredSession: fresh, resumed, switched, -p). */
+interface LiveSession {
+    readonly id: string;
+    readonly model: string;
+    readonly baseUrl: string | undefined;
+    readonly profileName: string | null;
+    readonly reasoning: ReasoningSetting;
+}
+export declare function setLiveSession(session: LiveSession): void;
+/** 0.49.0 C1: the conversation's live binding, for a child that names no
+ *  model — the profile its session is bound to (the session's own record,
+ *  never the display mark, which /reload and /resume clear), else the one
+ *  configured profile with the session's (model, baseUrl), else none — and
+ *  the effort the session runs at. */
+export declare function bindingFor(sessionId: string | undefined): {
+    readonly profile: string | null;
+    readonly model: string;
+    readonly reasoning: ReasoningSetting;
+} | null;
+/** The one configured profile whose model and endpoint are these — null
+ *  when none matches, or several do (a guess is never a binding). */
+export declare function profileByIdentity(model: string, baseUrl: string | undefined): string | null;
 export declare function tasksFor(sessionId: string | undefined): TaskManager | undefined;
 export declare function setExitTasks(choice: "stop" | "leave"): void;
 /** 3e: the live tasks of every session this process opened — a runner's
@@ -413,3 +441,4 @@ export declare function setLastBinding(b: LastBinding): void;
 export declare function lastBinding(): LastBinding | null;
 export declare function setAcceptDrift(v: boolean): void;
 export declare function acceptDrift(): boolean;
+export {};

package/dist/state.js

@@ -13,6 +13,7 @@ import { fileURLToPath } from "node:url";
 import { AT_CAP, AT_SKIP, Dock } from "@vincemakes/kiso-tui";
 import { TaskManager } from "@vincemakes/kiso-runtime/internal";
 import { processTaskBackend } from "@vincemakes/kiso-tools-node";
+import { collectWriter } from "@vincemakes/kiso-subagent-ext";
 import { canonicalPath, LEGACY_SESSIONS_DIR, projectDirFor, projectLayoutActive } from "./projects.js";
 import { taskNoticeLines, taskWhat } from "./task-notice.js";
 /** finding #11: KISO_HOME is the ONE root — every default path derives from
@@ -42,7 +43,18 @@ export function secretEnvNamesOf(models) {
     ];
 }
 export function codingToolOptions() {
-    return { workspaceRoot: process.cwd(), excludeRoots: [kisoHome()], secretEnvNames: secretEnvNamesOf(configModels), protectedFiles: protectedFiles(), tasks: tasksFor };
+    // KISO_MIN_FOREGROUND_MS — the test rigs' knob (like KISO_AUTO_DETACH_MS):
+    // the least foreground wait (ADR-0058 Amendment 10, default 60 s). The
+    // rigs that promote a command by a short wait lower it; nothing else does.
+    const minForeground = Number.parseInt(process.env.KISO_MIN_FOREGROUND_MS ?? "", 10);
+    return {
+        workspaceRoot: process.cwd(),
+        excludeRoots: [kisoHome()],
+        secretEnvNames: secretEnvNamesOf(configModels),
+        protectedFiles: protectedFiles(),
+        tasks: tasksFor,
+        ...(Number.isFinite(minForeground) && minForeground >= 0 ? { limits: { minForegroundMs: minForeground } } : {}),
+    };
 }
 /** ADR-0058 (3b): one TaskManager per session, its directory beside the
  *  session's log (`<store dir>/<session>.tasks/`). A call without a session
@@ -77,13 +89,38 @@ export function deliveryLines(sessionId, items) {
     const told = lostToldOf(sessionId);
     return taskNoticeLines(items.filter((i) => !(i.transition === "unknown" && told.has(i.taskId))), taskWhatOf(sessionId));
 }
+const liveSessions = new Map();
+export function setLiveSession(session) {
+    liveSessions.set(session.id, session);
+}
+/** 0.49.0 C1: the conversation's live binding, for a child that names no
+ *  model — the profile its session is bound to (the session's own record,
+ *  never the display mark, which /reload and /resume clear), else the one
+ *  configured profile with the session's (model, baseUrl), else none — and
+ *  the effort the session runs at. */
+export function bindingFor(sessionId) {
+    const s = sessionId === undefined ? undefined : liveSessions.get(sessionId);
+    if (s === undefined)
+        return null;
+    const profile = s.profileName !== null && configModels[s.profileName] !== undefined ? s.profileName : profileByIdentity(s.model, s.baseUrl);
+    return { profile, model: s.model, reasoning: s.reasoning };
+}
+/** The one configured profile whose model and endpoint are these — null
+ *  when none matches, or several do (a guess is never a binding). */
+export function profileByIdentity(model, baseUrl) {
+    const hits = Object.entries(configModels).filter(([, p]) => p.model === model && p.baseUrl === baseUrl);
+    return hits.length === 1 ? hits[0][0] : null;
+}
 export function tasksFor(sessionId) {
     if (sessionId === undefined || activeStoreDir === "")
         return undefined;
     let manager = taskManagers.get(sessionId);
     if (manager === undefined) {
         taskBackend ??= processTaskBackend();
-        manager = new TaskManager({ root: join(activeStoreDir, `${sessionId}.tasks`), backend: taskBackend });
+        // 0.49.0 B: a writer's end is its collection — the subagent
+        // extension's collector, called once its process has ended
+        const created = new TaskManager({ root: join(activeStoreDir, `${sessionId}.tasks`), backend: taskBackend, collect: (info) => collectWriter(info, created) });
+        manager = created;
         manager.observe();
         taskManagers.set(sessionId, manager);
     }
@@ -268,7 +305,10 @@ export function readContextLedger(sessionId, window) {
     const turnSegments = manifest.filter((s) => s.role === "turn" || s.role === "current_turn");
     return {
         window,
-        systemPrompt: sum((s) => s === "system:base" || (s.startsWith("system:ext:") && !isSkills(s))),
+        // RG-F2: the generated tool table (system:tools) is system-prompt
+        // text the model reads on every request; it had no ledger line, so
+        // this row was short by it
+        systemPrompt: sum((s) => s === "system:base" || s === "system:tools" || (s.startsWith("system:ext:") && !isSkills(s))),
         systemBase: sum((s) => s === "system:base"),
         appends: count((s) => s.startsWith("system:ext:") && !isSkills(s)),
         toolTable: sum((s) => s.startsWith("tool:")),

package/dist/task-notice.d.ts

@@ -7,6 +7,11 @@ import type { NoticeMark } from "@vincemakes/kiso-tui";
  *  (<what>) — ` — the parenthesis only when the command is known — and the
  *  LAST ` — ` part opening with "it may still be running". One line each. */
 export declare function taskNoticeLines(items: readonly TaskDeliveryItem[], what?: (taskId: string) => string | undefined): string[];
+/** Finding 0480-F9: the chain budget is spent — said to the person once,
+ *  so a chain that went quiet on its budget does not look idle. */
+export declare function budgetSpentLine(info: {
+    readonly wakes: number;
+}): string;
 /** A task's state in the person's words. A stop that was asked for and is
  *  not yet confirmed reads `stopping` — never `stopped` before the journal
  *  says so; a task kiso lost track of says so (Amendment 8). */

package/dist/task-notice.js

@@ -36,6 +36,11 @@ export function taskNoticeLines(items, what) {
     }
     return rows;
 }
+/** Finding 0480-F9: the chain budget is spent — said to the person once,
+ *  so a chain that went quiet on its budget does not look idle. */
+export function budgetSpentLine(info) {
+    return `✦ chain budget spent — ${info.wakes} autonomous wake${info.wakes === 1 ? "" : "s"} since your last message · finished tasks wait for you`;
+}
 /** A task's state in the person's words. A stop that was asked for and is
  *  not yet confirmed reads `stopping` — never `stopped` before the journal
  *  says so; a task kiso lost track of says so (Amendment 8). */

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@vincemakes/kiso-code",
-	"version": "0.47.3",
+	"version": "0.49.0",
 	"description": "kiso-code \u2014 the coding agent on kiso, the durable runtime for AI agents: kiso chat / kiso resume / kiso sessions.",
 	"type": "module",
 	"license": "MIT",
@@ -18,19 +18,19 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@vincemakes/kiso-ask-ext": "0.47.3",
-		"@vincemakes/kiso-core": "0.47.3",
-		"@vincemakes/kiso-evals": "0.47.3",
-		"@vincemakes/kiso-mcp-ext": "0.47.3",
-		"@vincemakes/kiso-provider-anthropic": "0.47.3",
-		"@vincemakes/kiso-provider-openai": "0.47.3",
-		"@vincemakes/kiso-provider-openai-responses": "0.47.3",
-		"@vincemakes/kiso-runtime": "0.47.3",
-		"@vincemakes/kiso-skills-ext": "0.47.3",
-		"@vincemakes/kiso-subagent-ext": "0.47.3",
-		"@vincemakes/kiso-tools-node": "0.47.3",
-		"@vincemakes/kiso-tui": "0.47.3",
-		"@vincemakes/kiso-tui-cells": "0.47.3"
+		"@vincemakes/kiso-ask-ext": "0.49.0",
+		"@vincemakes/kiso-core": "0.49.0",
+		"@vincemakes/kiso-evals": "0.49.0",
+		"@vincemakes/kiso-mcp-ext": "0.49.0",
+		"@vincemakes/kiso-provider-anthropic": "0.49.0",
+		"@vincemakes/kiso-provider-openai": "0.49.0",
+		"@vincemakes/kiso-provider-openai-responses": "0.49.0",
+		"@vincemakes/kiso-runtime": "0.49.0",
+		"@vincemakes/kiso-skills-ext": "0.49.0",
+		"@vincemakes/kiso-subagent-ext": "0.49.0",
+		"@vincemakes/kiso-tools-node": "0.49.0",
+		"@vincemakes/kiso-tui": "0.49.0",
+		"@vincemakes/kiso-tui-cells": "0.49.0"
 	},
 	"devDependencies": {
 		"@types/node": "^26.1.2",