@vincemakes/kiso-code 0.48.0 → 0.50.0

package/README.md

@@ -1,4 +1,8 @@
-# @vincemakes/kiso-code
+<h1 align="center"><picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/vincemakes/kiso/main/assets/readme/lockup-dark.png"><img src="https://raw.githubusercontent.com/vincemakes/kiso/main/assets/readme/lockup-light.png" height="46" alt="kiso"></picture></h1>
+
+<p align="center"><picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/vincemakes/kiso/main/assets/readme/features-dark.png"><img src="https://raw.githubusercontent.com/vincemakes/kiso/main/assets/readme/features-light.png" width="830" alt="Built in, not bolted on: it asks before it guesses; subagents in parallel; background tasks; approval modes; it resumes after a crash; yours to extend."></picture></p>
+
+<p align="center"><img src="https://raw.githubusercontent.com/vincemakes/kiso/main/assets/readme/screenshot.png" width="830" alt="kiso in a dark terminal window: a green diff of new tests, then the test suite started as a background task, with 1 task running in the status row"></p>
 
 The coding agent that survives kill -9: durable sessions (append-only
 JSONL), pre-effect approvals, and honest recovery — an interrupted side

package/dist/apply-patch.d.ts

@@ -0,0 +1,42 @@
+/**
+ * 0.49.0 B6.2 / I4 — `kiso apply-patch <taskDir> [--allow-partial]
+ * [--with-markers]`: adopt an implementer's collected patch into the
+ * workspace. A writer owns an isolated workspace; adoption is a separate,
+ * crash-honest effect.
+ *
+ * The collection (the subagent extension's collectWriter) left in the task
+ * directory: `patch.json` (the files, their modes, whether the patch is
+ * complete), `versions/<n>.base` and `versions/<n>.child` (each changed
+ * file before and after the child), and the child's `acceptance.json`.
+ *
+ * PREPARE writes nothing: each file is merged three ways — base (the
+ * snapshot the child started from), ours (the workspace now), theirs (the
+ * child's) — with `git merge-file`'s algorithm, which never reads or writes
+ * the index. Any conflict, or an entry this release does not adopt
+ * (symlinks, submodules, a mode change on an existing file, a file and a
+ * directory trading places, two names differing only in case), stops here
+ * with nothing written.
+ *
+ * PUBLISH is per file and journaled (`<taskDir>/apply.jsonl`): each target
+ * is revalidated against what PREPARE saw; a creation is no-clobber (link
+ * or refuse, WR-1A ②'s rule); a modification is revalidated right before
+ * its rename (WR-1A ③); a deletion is revalidated, then unlinked — the
+ * same narrow check-to-effect window WR-1's conditional write has, never
+ * called a compare-and-swap. A filesystem has no multi-file transaction,
+ * so the promise is all-or-none PREPARE, never an atomic write: a late
+ * revalidation failure ends `partial`, naming what was and was not
+ * published, and nothing retries it.
+ *
+ * VERIFY: after a clean publication the patch's acceptance always runs
+ * again in the workspace (the child's ran against the snapshot; the
+ * workspace has what the snapshot never held — ignored files, a build
+ * cache). It is re-resolved from the configuration by its NAME, never run
+ * from the record; it touches no git state. Both verdicts are printed.
+ * There is no automatic rollback. An interrupted verification is reported
+ * as not completed (before it started) or unknown (while it ran), and never
+ * retried by itself.
+ *
+ * Exit codes: 0 clean (whatever the acceptance said — two facts, printed),
+ * 3 conflicted, 4 partial, 5 refused or unsupported, 1 failed.
+ */
+export declare function applyPatch(args: readonly string[], cwd?: string): Promise<number>;

package/dist/apply-patch.js

@@ -0,0 +1,381 @@
+/**
+ * 0.49.0 B6.2 / I4 — `kiso apply-patch <taskDir> [--allow-partial]
+ * [--with-markers]`: adopt an implementer's collected patch into the
+ * workspace. A writer owns an isolated workspace; adoption is a separate,
+ * crash-honest effect.
+ *
+ * The collection (the subagent extension's collectWriter) left in the task
+ * directory: `patch.json` (the files, their modes, whether the patch is
+ * complete), `versions/<n>.base` and `versions/<n>.child` (each changed
+ * file before and after the child), and the child's `acceptance.json`.
+ *
+ * PREPARE writes nothing: each file is merged three ways — base (the
+ * snapshot the child started from), ours (the workspace now), theirs (the
+ * child's) — with `git merge-file`'s algorithm, which never reads or writes
+ * the index. Any conflict, or an entry this release does not adopt
+ * (symlinks, submodules, a mode change on an existing file, a file and a
+ * directory trading places, two names differing only in case), stops here
+ * with nothing written.
+ *
+ * PUBLISH is per file and journaled (`<taskDir>/apply.jsonl`): each target
+ * is revalidated against what PREPARE saw; a creation is no-clobber (link
+ * or refuse, WR-1A ②'s rule); a modification is revalidated right before
+ * its rename (WR-1A ③); a deletion is revalidated, then unlinked — the
+ * same narrow check-to-effect window WR-1's conditional write has, never
+ * called a compare-and-swap. A filesystem has no multi-file transaction,
+ * so the promise is all-or-none PREPARE, never an atomic write: a late
+ * revalidation failure ends `partial`, naming what was and was not
+ * published, and nothing retries it.
+ *
+ * VERIFY: after a clean publication the patch's acceptance always runs
+ * again in the workspace (the child's ran against the snapshot; the
+ * workspace has what the snapshot never held — ignored files, a build
+ * cache). It is re-resolved from the configuration by its NAME, never run
+ * from the record; it touches no git state. Both verdicts are printed.
+ * There is no automatic rollback. An interrupted verification is reported
+ * as not completed (before it started) or unknown (while it ran), and never
+ * retried by itself.
+ *
+ * Exit codes: 0 clean (whatever the acceptance said — two facts, printed),
+ * 3 conflicted, 4 partial, 5 refused or unsupported, 1 failed.
+ */
+import { spawn, spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { appendFileSync, chmodSync, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, dirname, join } from "node:path";
+import { projectArtifacts, trustFor } from "@vincemakes/kiso-runtime";
+import { loadProjectConfig, loadUserConfig, mergeConfigs, resolveProjectTrustPolicy } from "./config.js";
+const ABSENT = "absent";
+const sha = (b) => createHash("sha256").update(b).digest("hex");
+export async function applyPatch(args, cwd = process.cwd()) {
+    const taskDir = args.find((a) => !a.startsWith("--"));
+    const allowPartial = args.includes("--allow-partial");
+    const withMarkers = args.includes("--with-markers");
+    if (taskDir === undefined) {
+        console.error("usage: kiso apply-patch <task directory> [--allow-partial] [--with-markers]");
+        return 5;
+    }
+    let patch;
+    try {
+        patch = JSON.parse(readFileSync(join(taskDir, "patch.json"), "utf8"));
+    }
+    catch (err) {
+        console.error(`apply-patch: no collected patch in ${taskDir} (${err.message})`);
+        return 1;
+    }
+    const journal = join(taskDir, "apply.jsonl");
+    const prior = readJournal(journal);
+    if (prior.length > 0) {
+        const ended = prior.find((r) => r.type === "apply_terminal");
+        if (ended !== undefined) {
+            console.error(`apply-patch: this patch was already adopted (${String(ended.outcome)}); nothing was done`);
+            return 5;
+        }
+        console.error(interruptedReport(prior));
+        return 1;
+    }
+    if (!patch.applyable && !allowPartial) {
+        console.error("apply-patch: the child was stopped, so this patch is partial; adopt it only with --allow-partial");
+        return 5;
+    }
+    let root;
+    try {
+        root = git(cwd, ["rev-parse", "--show-toplevel"]).trim();
+    }
+    catch {
+        console.error("apply-patch: run it inside the workspace's git repository");
+        return 5;
+    }
+    const unsupported = unsupportedOf(patch, root);
+    if (unsupported.length > 0) {
+        console.error(`apply-patch: not adopted — this release adopts regular files only:\n${unsupported.map((u) => `  ${u}`).join("\n")}\nIntegrate it by hand, or delegate again.`);
+        return 5;
+    }
+    // ── PREPARE: nothing in the workspace changes ──────────────────────────
+    const planned = [];
+    const conflicts = [];
+    const scratch = mkdtempSync(join(tmpdir(), "kiso-apply-"));
+    try {
+        patch.files.forEach((f, n) => {
+            const target = join(root, f.path);
+            const ours = readOrNull(target);
+            const expected = ours === null ? ABSENT : sha(ours);
+            const base = f.status === "A" ? null : readFileSync(join(taskDir, "versions", `${n}.base`));
+            const theirs = f.status === "D" ? null : readFileSync(join(taskDir, "versions", `${n}.child`));
+            const exec = f.mode === "100755";
+            if (f.status === "A") {
+                if (ours === null)
+                    planned.push({ path: f.path, action: "create", expected, content: theirs, exec });
+                else if (!ours.equals(theirs))
+                    conflicts.push(`${f.path}: created by the child, and it exists in the workspace with other content`);
+                return;
+            }
+            if (f.status === "D") {
+                if (ours === null)
+                    return; // already gone
+                if (ours.equals(base))
+                    planned.push({ path: f.path, action: "delete", expected });
+                else
+                    conflicts.push(`${f.path}: deleted by the child, and changed in the workspace since`);
+                return;
+            }
+            // a modification
+            if (ours === null) {
+                conflicts.push(`${f.path}: changed by the child, and deleted in the workspace since`);
+                return;
+            }
+            if (ours.equals(base))
+                planned.push({ path: f.path, action: "modify", expected, content: theirs });
+            else if (ours.equals(theirs))
+                return; // the workspace already has it
+            else {
+                const merged = mergeThree(scratch, ours, base, theirs);
+                if (merged.conflicts === 0)
+                    planned.push({ path: f.path, action: "modify", expected, content: merged.content });
+                else if (withMarkers)
+                    planned.push({ path: f.path, action: "modify", expected, content: merged.content });
+                else
+                    conflicts.push(`${f.path}: ${merged.conflicts} conflicting ${merged.conflicts === 1 ? "hunk" : "hunks"}\n${hunks(merged.content)}`);
+            }
+        });
+    }
+    finally {
+        rmSync(scratch, { recursive: true, force: true });
+    }
+    if (conflicts.length > 0) {
+        console.error(`apply-patch: nothing was written — the patch conflicts with the workspace:\n${conflicts.map((c) => `  ${c}`).join("\n")}\nResolve by hand, apply with --with-markers and fix the markers with edit_file, or delegate again on the current tree.`);
+        return 3;
+    }
+    // test-only: KISO_TEST_APPLY_HOOK names a module whose afterPrepare() /
+    // afterPublish(path) run between the steps — the races a gate needs on cue
+    const hook = process.env.KISO_TEST_APPLY_HOOK === undefined ? undefined : (await import(process.env.KISO_TEST_APPLY_HOOK));
+    hook?.afterPrepare?.();
+    // ── PUBLISH: per file, revalidated, journaled ───────────────────────────
+    const record = (r) => appendFileSync(journal, `${JSON.stringify({ ...r, ts: Date.now() })}\n`);
+    record({ type: "apply_planned", patchSha256: sha(readFileSync(join(taskDir, "patch.diff"))), files: planned.map((p) => ({ path: p.path, action: p.action, expected: p.expected })) });
+    const published = [];
+    for (const p of planned) {
+        const target = join(root, p.path);
+        const why = publish(target, p);
+        if (why !== null) {
+            record({ type: "apply_terminal", outcome: "partial", published, stoppedAt: p.path, reason: why });
+            const rest = planned.map((q) => q.path).filter((q) => !published.includes(q));
+            console.error(`apply-patch: PARTIAL — ${p.path}: ${why}\n  published: ${published.length > 0 ? published.join(", ") : "none"}\n  not published: ${rest.join(", ")}\nNothing is retried or rolled back; read the files and decide.`);
+            return 4;
+        }
+        published.push(p.path);
+        record({ type: "apply_file_published", path: p.path, action: p.action });
+        hook?.afterPublish?.(p.path);
+    }
+    record({ type: "publication_complete", files: published.length });
+    console.log(`apply-patch: adopted ${published.length} ${published.length === 1 ? "file" : "files"}: ${published.join(", ") || "(the workspace already had every change)"}`);
+    // ── VERIFY: the acceptance again, in the workspace ──────────────────────
+    const child = readOrNull(join(taskDir, "acceptance.json"));
+    const childVerdict = child === null ? "none" : JSON.parse(child.toString("utf8")).passed === true ? "PASSED" : "FAILED";
+    if (patch.acceptance === undefined) {
+        record({ type: "apply_terminal", outcome: "clean" });
+        console.log(`child acceptance: ${childVerdict} · workspace acceptance: none named — the merge was textual only`);
+        return 0;
+    }
+    const resolved = await resolveAcceptance(patch.acceptance, root);
+    if (typeof resolved === "string") {
+        record({ type: "apply_terminal", outcome: "clean", acceptance: "unresolved", reason: resolved });
+        console.log(`child acceptance: ${childVerdict} · workspace acceptance: not run — ${resolved}`);
+        return 0;
+    }
+    record({ type: "acceptance_started", ...resolved.label });
+    const v = await runInWorkspace(resolved, root);
+    record({ type: "acceptance_result", passed: v.passed, exitCode: v.exitCode });
+    record({ type: "apply_terminal", outcome: "clean" });
+    console.log(`child acceptance: ${childVerdict} · workspace acceptance: ${v.passed ? "PASSED" : "FAILED"} (exit ${v.exitCode ?? "killed"})${v.passed ? "" : `\n${v.tail}`}`);
+    return 0;
+}
+/** What an interrupted adoption left — the journal's facts, nothing guessed. */
+function interruptedReport(records) {
+    const files = records.filter((r) => r.type === "apply_file_published").map((r) => String(r.path));
+    const planned = records.find((r) => r.type === "apply_planned")?.files?.map((f) => f.path) ?? [];
+    if (records.some((r) => r.type === "acceptance_started")) {
+        return `apply-patch: an earlier adoption was interrupted — every file was published (${files.join(", ")}); its workspace acceptance started and its outcome is UNKNOWN. Nothing is retried: run the check yourself.`;
+    }
+    if (records.some((r) => r.type === "publication_complete")) {
+        return `apply-patch: an earlier adoption was interrupted — every file was published (${files.join(", ")}); its workspace acceptance was NOT COMPLETED. Nothing is retried: run the check yourself.`;
+    }
+    const rest = planned.filter((p) => !files.includes(p));
+    return `apply-patch: an earlier adoption was interrupted mid-publication — published: ${files.join(", ") || "none"}; not published: ${rest.join(", ") || "none"}. Nothing is retried or rolled back; read the files and decide.`;
+}
+/** B6.2's scope for 0.49: regular files created, modified or deleted. */
+function unsupportedOf(patch, root) {
+    const out = [];
+    const lower = new Map();
+    for (const f of patch.files) {
+        const key = f.path.toLowerCase();
+        const seen = lower.get(key);
+        if (seen !== undefined && seen !== f.path)
+            out.push(`${f.path}: differs from ${seen} only in case`);
+        lower.set(key, f.path);
+        if (!["A", "M", "D"].includes(f.status))
+            out.push(`${f.path}: a type change (${f.status})`);
+        if ([f.mode, f.baseMode].some((m) => m === "120000"))
+            out.push(`${f.path}: a symlink`);
+        if ([f.mode, f.baseMode].some((m) => m === "160000"))
+            out.push(`${f.path}: a submodule`);
+        if (f.status === "M" && f.mode !== f.baseMode)
+            out.push(`${f.path}: a mode change (${f.baseMode} → ${f.mode})`);
+        const target = join(root, f.path);
+        try {
+            if (lstatSync(target).isDirectory())
+                out.push(`${f.path}: a directory in the workspace`);
+        }
+        catch {
+            // absent — a creation, or already deleted
+        }
+        if (f.status === "A") {
+            // a new name whose case-folded twin already exists (macOS, Windows)
+            try {
+                const twin = readdirSync(dirname(target)).find((e) => e.toLowerCase() === basename(target).toLowerCase() && e !== basename(target));
+                if (twin !== undefined)
+                    out.push(`${f.path}: the workspace has ${twin}, differing only in case`);
+            }
+            catch {
+                // the directory does not exist yet
+            }
+        }
+    }
+    return out;
+}
+/** git merge-file's algorithm on scratch copies — the index never read. */
+function mergeThree(scratch, ours, base, theirs) {
+    const [o, b, t] = ["ours", "base", "theirs"].map((n) => join(scratch, n));
+    writeFileSync(o, ours);
+    writeFileSync(b, base);
+    writeFileSync(t, theirs);
+    const r = spawnSync("git", ["merge-file", "-p", "-L", "workspace", "-L", "base", "-L", "child", o, b, t], { maxBuffer: 256 * 1024 * 1024 });
+    if (r.status === null || r.status < 0)
+        throw new Error(`git merge-file failed: ${String(r.stderr)}`);
+    return { content: r.stdout, conflicts: r.status };
+}
+/** The conflicting hunks of a merged text, to name them. */
+function hunks(merged) {
+    const lines = merged.toString("utf8").split("\n");
+    const out = [];
+    let inside = false;
+    for (const l of lines) {
+        if (l.startsWith("<<<<<<< "))
+            inside = true;
+        if (inside)
+            out.push(`    ${l}`);
+        if (l.startsWith(">>>>>>> "))
+            inside = false;
+        if (out.length > 60) {
+            out.push("    …");
+            break;
+        }
+    }
+    return out.join("\n");
+}
+/** One file, revalidated against PREPARE; null when published. */
+function publish(target, p) {
+    const now = () => {
+        const b = readOrNull(target);
+        return b === null ? ABSENT : sha(b);
+    };
+    if (now() !== p.expected)
+        return "it changed after the merge was prepared";
+    if (p.action === "delete") {
+        unlinkSync(target);
+        return null;
+    }
+    mkdirSync(dirname(target), { recursive: true });
+    const tmp = join(dirname(target), `.${basename(target)}.kiso-apply-${process.pid}`);
+    writeFileSync(tmp, p.content);
+    if (p.action === "create") {
+        chmodSync(tmp, p.exec === true ? 0o755 : 0o644);
+        // WR-1A ②: link(2) or refusal — no-clobber, fail closed
+        try {
+            linkSync(tmp, target);
+            return null;
+        }
+        catch (err) {
+            return err.code === "EEXIST" ? "it was created in the workspace after the merge was prepared" : `it could not be created atomically (${err.code ?? "link failed"})`;
+        }
+        finally {
+            rmSync(tmp, { force: true });
+        }
+    }
+    chmodSync(tmp, statSync(target).mode & 0o7777);
+    // WR-1A ③: still what the merge was prepared against, right before the rename
+    if (now() !== p.expected) {
+        rmSync(tmp, { force: true });
+        return "it changed while the adoption was writing";
+    }
+    renameSync(tmp, target);
+    return null;
+}
+/** The acceptance by its NAME, from the configuration (a trusted project's
+ *  too, never asked here) — or why it cannot run. */
+async function resolveAcceptance(acceptance, root) {
+    const user = loadUserConfig();
+    let project = null;
+    if (resolveProjectTrustPolicy(user ?? {}) !== "never") {
+        const artifacts = await projectArtifacts(root);
+        if (artifacts !== null && trustFor(artifacts.root, artifacts.digest)?.decision === "granted")
+            project = loadProjectConfig(root, true);
+    }
+    const merged = mergeConfigs(user, project);
+    if (acceptance.check !== undefined) {
+        const command = merged.checks?.[acceptance.check];
+        if (command === undefined)
+            return `the check "${acceptance.check}" is no longer configured`;
+        return { command: process.platform === "win32" ? "bash" : "/bin/sh", args: ["-c", command], label: { check: acceptance.check } };
+    }
+    if (acceptance.evaluator !== undefined) {
+        if (!(merged.evaluators ?? []).includes(acceptance.evaluator))
+            return `the evaluator ${acceptance.evaluator} is no longer listed`;
+        return { command: acceptance.evaluator, args: [root], label: { evaluator: acceptance.evaluator } };
+    }
+    return "the patch names no acceptance";
+}
+/** The check in the workspace — no git state touched, its tail kept. */
+function runInWorkspace(r, root) {
+    return new Promise((resolve) => {
+        let out = "";
+        const child = spawn(r.command, [...r.args], { cwd: root, stdio: ["ignore", "pipe", "pipe"] });
+        const keep = (d) => {
+            out = (out + d.toString("utf8")).slice(-2_048);
+        };
+        child.stdout.on("data", keep);
+        child.stderr.on("data", keep);
+        child.on("error", (err) => resolve({ passed: false, exitCode: null, tail: err.message }));
+        child.on("exit", (code) => resolve({ passed: code === 0, exitCode: code, tail: out }));
+    });
+}
+function readOrNull(path) {
+    try {
+        return readFileSync(path);
+    }
+    catch {
+        return null;
+    }
+}
+function readJournal(path) {
+    if (!existsSync(path))
+        return [];
+    return readFileSync(path, "utf8")
+        .split("\n")
+        .filter((l) => l.trim() !== "")
+        .flatMap((l) => {
+        try {
+            return [JSON.parse(l)];
+        }
+        catch {
+            return [];
+        }
+    });
+}
+function git(cwd, args) {
+    const r = spawnSync("git", ["-C", cwd, ...args], { encoding: "utf8" });
+    if (r.status !== 0)
+        throw new Error(r.stderr);
+    return r.stdout;
+}

package/dist/builtin.js

@@ -25,7 +25,7 @@ import createSkills from "@vincemakes/kiso-skills-ext";
 import createSubagent from "@vincemakes/kiso-subagent-ext";
 import createAsk, {} from "@vincemakes/kiso-ask-ext";
 import { getDontAsk } from "./mode.js";
-import { tasksFor } from "./state.js";
+import { bindingFor, codingToolOptions, tasksFor } from "./state.js";
 /**
  * 0.40.0 (the owner's dogfood): dontAsk never asks, so its tool table never
  * offers ask_user — a model once put four questions to a dontAsk session
@@ -59,9 +59,11 @@ ask,
  *  too late. Only the config knows them; nothing else can. */
 secretEnvNames = []) {
     // ADR-0058 3d: the session's task manager makes `delegate` offer
-    // background children (explorer/reviewer; the cap and the turn budget
-    // are the extension's defaults)
-    const all = await Promise.all([createMcp({ secretEnvNames }), createSkills(), createSubagent({ tasks: tasksFor }), ...(ask === undefined ? [] : [createAsk(ask).then(offInDontAsk)])]);
+    // background children (any role; a writer works in its own snapshot and
+    // is collected; the caps and the turn budgets are the extension's
+    // defaults). 0.49.0 C1: the session's live binding
+    // is the model a child runs on when its task names none.
+    const all = await Promise.all([createMcp({ secretEnvNames }), createSkills(), createSubagent({ tasks: tasksFor, currentBinding: bindingFor, ...joinOption() }), ...(ask === undefined ? [] : [createAsk(ask).then(offInDontAsk)])]);
     const shadowed = all.filter((b) => user.some((u) => u.name === b.name));
     for (const s of shadowed) {
         console.error(`[extensions] user extension "${s.name}" shadows the built-in — the built-in is not loaded`);
@@ -73,3 +75,9 @@ secretEnvNames = []) {
     }
     return all.filter((b) => !shadowed.includes(b));
 }
+/** 0.49.0 A: a reader delegation waits as long as a shell command does —
+ *  one knob for "the foreground wait" (KISO_MIN_FOREGROUND_MS reaches both). */
+function joinOption() {
+    const floor = codingToolOptions().limits?.minForegroundMs;
+    return floor !== undefined ? { joinMs: floor } : {};
+}

package/dist/chat.d.ts

@@ -134,8 +134,8 @@ export declare function statusModelLabel(session: {
     };
 }): string;
 /** ADR-0055 Amendment 2 (decision 5): with no stated window the status row
- *  shows `ctx ?`, yet the compaction tiers still assume the fallback (128K
- *  since CW-1 batch 2)
+ *  shows `ctx ?`, yet the compaction tiers still assume the fallback (200K;
+ *  128K from CW-1 batch 2 until the owner's 2026-10-09 ruling)
  *  — the assumption is said out loud once, at agent build. */
 export declare function unknownWindowNotice(model: string): string;
 /** CW-1 batch 2: said once, when an endpoint's refusal states its cap — the

package/dist/chat.js

@@ -9,7 +9,7 @@ import { escapeTerminal, cacheHitPct, decodeRate, palette, renderEvent, renderRe
 import { askView, coldResumeLine, coldResumeView, deletionRiskHint, editFileHunksDiff, hunksOf, writeFileDiff } from "@vincemakes/kiso-tui";
 import { canonicalTargetPath, isProtectedPath, protectedIdentity, shellProgressPath } from "@vincemakes/kiso-tools-node";
 import { deliveryLines, liveTasks, lostToldOf, mergedConfig, queuedSwitchLines, setExitTasks, tasksFor, taskWhatOf } from "./state.js";
-import { taskCounts, taskNoticeLines, taskNoticeRows, tasksForDisplay } from "./task-notice.js";
+import { budgetSpentLine, taskCounts, taskNoticeLines, taskNoticeRows, tasksForDisplay } from "./task-notice.js";
 import { current as inRunCompaction, takeKept as takeKeptCompaction } from "./in-run-compaction.js";
 import { echoText } from "@vincemakes/kiso-tui-cells/render";
 import { canonicalizeUsage, RunClosedError } from "@vincemakes/kiso-runtime";
@@ -27,11 +27,18 @@ import { addDontAskAgainRule, askPanel, fixHintFor, pendingAsk, resolveUncertain
 import { FauxExhaustionError, failOnFauxExhaustion } from "./faux-glue.js";
 import { MODE_LABEL, OFFERED_MODES, getDontAsk, getMode, modeDisplay, setMode } from "./mode.js";
 /** B area: default context window for the ~ctx estimate (config overridable).
- *  CW-1 batch 2: 128,000, down from 200,000 — the figure a model nobody
- *  states a window for is assumed to hold (the reference implementation's
- *  default too). Too small costs an early compaction; too large costs a
- *  refused request on a 128K model. Registered models never reach it. */
-const DEFAULT_CONTEXT_WINDOW = 128_000;
+ *  The figure a model nobody states a window for is assumed to hold.
+ *  Registered models never reach it.
+ *
+ *  200,000 again since the owner's ruling of 2026-10-09, which reverses CW-1
+ *  batch 2's 128,000. The same batch made an endpoint's refusal teach its
+ *  real cap, kept across sessions and only ever lowered. So a figure too
+ *  large costs one refused request per endpoint and model, once, while a
+ *  figure too small compacts every session early and never corrects
+ *  itself (gpt-6.1-sol, 272K and unregistered in 0.47.3, compacted from
+ *  64K). 200K, not more: a 128K model's soft tier (100K) still usually
+ *  compacts it before its wall. */
+const DEFAULT_CONTEXT_WINDOW = 200_000;
 /** The in-process fake provider's id, and the window we declare for it.
  *  Ours to state: faux is not a vendor's model, so "nobody published a
  *  window" — the reason a real model's capacity is unknown — cannot apply.
@@ -236,8 +243,8 @@ export function statusModelLabel(session) {
     return effort !== undefined && effort !== "default" ? `${name} · ${effort}` : name;
 }
 /** ADR-0055 Amendment 2 (decision 5): with no stated window the status row
- *  shows `ctx ?`, yet the compaction tiers still assume the fallback (128K
- *  since CW-1 batch 2)
+ *  shows `ctx ?`, yet the compaction tiers still assume the fallback (200K;
+ *  128K from CW-1 batch 2 until the owner's 2026-10-09 ruling)
  *  — the assumption is said out loud once, at agent build. */
 export function unknownWindowNotice(model) {
     return `[kiso] context window unknown for ${model} at this endpoint — compaction assumes ${DEFAULT_CONTEXT_WINDOW / 1000}K; set contextWindow on the profile to state it`;
@@ -1055,7 +1062,7 @@ onInputLanded) {
                         if (m !== null)
                             reason = m[1];
                     }
-                    body.toolResult(ev.callId, { content: text, isError: ev.isError, reason });
+                    body.toolResult(ev.callId, { content: text, isError: ev.isError, reason, ...((ev.tags ?? []).includes("created") ? { created: true } : {}) });
                     break;
                 }
                 case "text_delta":
@@ -1771,6 +1778,11 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
     // the same chain a person's turn takes (taskWake: false keeps it for
     // the next message). Released when this chat ends.
     const taskManager = tasksFor(session.id);
+    // 0.49.0 B: writers that ended while nobody listened are collected
+    // BEFORE the delivery is built — so they arrive as anything that ended
+    // meanwhile does, as a notify, never a wake
+    if (taskManager !== undefined)
+        await taskManager.collectPending();
     // KISO_AUTO_DETACH_MS — the test rigs' knob (like KISO_STREAM_IDLE_MS):
     // how old a command must be before a steer detaches it (3e D1). The
     // rigs that hold a steer pending behind a long command raise it.
@@ -1790,6 +1802,8 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
                 for (const line of taskNoticeLines(ids.map((taskId) => ({ taskId, transition: "unknown" })), taskWhatOf(session.id)))
                     body.notice(line);
             },
+            // 0480-F9: the chain went quiet on its budget — say so, once
+            onBudgetSpent: (info) => body.notice(budgetSpentLine(info)),
             ...(Number.isFinite(autoDetachFromEnv) && autoDetachFromEnv >= 0 ? { autoDetachMinAgeMs: autoDetachFromEnv } : {}),
         });
     // 3e: a task's change repaints the row it is counted on

package/dist/child-result.d.ts

@@ -11,8 +11,16 @@
  *
  * The answer is the child's own — the last assistant text in its session's
  * projection, never its printed output — written atomically to `<r>`
- * (result.md) with `{ outcome, requests, budget }` beside it (result.json),
- * before the process exits: the runner records the exit after both exist.
+ * (result.md), then the result record beside it (result.json), before the
+ * process exits: the runner records the exit after both exist.
+ *
+ * 0.49.0 (I5, I6): the record COMMITS the result — result.md is read only
+ * beside it — and it says everything the parent shows: how the run ended
+ * (`endedBy`, the main run's terminal: a wrap-up is a second run, and the
+ * parent never counts runs to learn it), the requests, the tool calls and
+ * usage over the committed events, the model it ran on, and a failure's
+ * error. Foreground children carry a result file too, so both ways of
+ * waiting read the same record.
  */
 import type { AgentSession } from "@vincemakes/kiso-runtime";
 export interface ChildEnd {

package/dist/child-result.js

@@ -11,17 +11,27 @@
  *
  * The answer is the child's own — the last assistant text in its session's
  * projection, never its printed output — written atomically to `<r>`
- * (result.md) with `{ outcome, requests, budget }` beside it (result.json),
- * before the process exits: the runner records the exit after both exist.
+ * (result.md), then the result record beside it (result.json), before the
+ * process exits: the runner records the exit after both exist.
+ *
+ * 0.49.0 (I5, I6): the record COMMITS the result — result.md is read only
+ * beside it — and it says everything the parent shows: how the run ended
+ * (`endedBy`, the main run's terminal: a wrap-up is a second run, and the
+ * parent never counts runs to learn it), the requests, the tool calls and
+ * usage over the committed events, the model it ran on, and a failure's
+ * error. Foreground children carry a result file too, so both ways of
+ * waiting read the same record.
  */
 import { renameSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 export const wrapUpInput = (budget) => `Your turn budget of ${budget} model requests is spent. Answer now from what you have found, without further tool calls. End with the UNRESOLVED section, naming what you did not get to.`;
 export async function finishChild(session, end) {
-    const lastOutcome = () => {
+    const lastTerminal = () => {
         const t = [...session.log.all].reverse().find((e) => e.type === "terminal");
-        return t === undefined ? undefined : t.outcome.kind;
+        return t === undefined ? undefined : t.outcome;
     };
+    const lastOutcome = () => lastTerminal()?.kind;
+    const main = lastTerminal();
     let outcome = lastOutcome() === "completed" ? "completed" : "failed";
     if (end.maxTurns !== undefined && lastOutcome() === "max_turns") {
         for await (const _ of session.run(wrapUpInput(end.maxTurns), { source: "system", maxTurns: 1 })) {
@@ -33,12 +43,49 @@ export async function finishChild(session, end) {
         return;
     const answer = lastAnswer(session);
     const requests = session.log.all.filter((e) => e.type === "stop").length;
+    const events = committed(session.log.all);
+    const usages = events.filter((e) => e.type === "usage");
+    const sum = (k) => usages.reduce((n, e) => n + (typeof e[k] === "number" ? e[k] : 0), 0);
+    const error = outcome === "failed" ? errorOf(lastTerminal()) : undefined;
+    const record = {
+        outcome,
+        endedBy: main?.kind ?? "none",
+        requests,
+        ...(end.maxTurns !== undefined ? { budget: end.maxTurns } : {}),
+        toolCalls: events.filter((e) => e.type === "tool_call_end").length,
+        usage: {
+            completedResponses: usages.length,
+            abandonedAttempts: session.log.all.filter((e) => e.type === "model_output_abandoned").length,
+            inputTokens: sum("inputTokens"),
+            outputTokens: sum("outputTokens"),
+            cacheRead: sum("cacheRead"),
+        },
+        model: session.model,
+        profile: session.profileName,
+        ...(error !== undefined ? { error } : {}),
+    };
     writeAtomic(end.resultFile, answer === "" ? "" : `${answer}\n`);
-    writeAtomic(join(dirname(end.resultFile), "result.json"), `${JSON.stringify({ outcome, requests, ...(end.maxTurns !== undefined ? { budget: end.maxTurns } : {}) })}\n`);
+    // I5: the record last — it commits the answer written above
+    writeAtomic(join(dirname(end.resultFile), "result.json"), `${JSON.stringify(record)}\n`);
     // the runner's terminal is the exit: a failed child must not read as a clean one
     if (outcome === "failed")
         process.exitCode = 1;
 }
+/** The kernel's void scope (core `project.ts`): a `model_output_abandoned`
+ *  marker voids (voidFromSeq, seq], an abandoned draft's events. A voided
+ *  tool call never ran and a voided usage was never billed as an answer. */
+function committed(events) {
+    const voids = events.filter((e) => e.type === "model_output_abandoned").map((e) => ({ from: e.voidFromSeq ?? -1, to: e.seq ?? -1 }));
+    return events.filter((e) => !voids.some((r) => (e.seq ?? -1) > r.from && (e.seq ?? -1) <= r.to));
+}
+/** A failed run's reason, one line: the kernel's error, or how it ended. */
+function errorOf(t) {
+    if (t === undefined)
+        return "the run left no terminal";
+    if (t.kind === "error" && t.error !== undefined)
+        return [t.error.code, t.error.message].filter((s) => s !== undefined && s !== "").join(": ") || "error";
+    return `the run ended with ${t.kind}`;
+}
 /** The last assistant message's text in the session's projection. */
 function lastAnswer(session) {
     const messages = session.projected();

package/dist/coding-prompt.d.ts

@@ -9,7 +9,7 @@
  */
 /** The built-in prompt. Exported for scripts/request-surface.mjs — the
  *  model-side token-rent counter measures the REAL bytes, never a copy. */
-export declare const SYSTEM_PROMPT = "You are kiso, a coding agent. You work in a workspace\ndirectory and change code with tools. Be concise: answer in a few lines\nunless the task genuinely needs more. Never claim a file was changed\nunless a tool confirmed it.\n\nWhat you can reach:\n- The workspace: read_file, list_dir, search_text, write_file, edit_file.\n- This machine and the network: shell \u2014 builds, tests, git, package\n  managers, curl for HTTP, system queries. A request one command can\n  answer is answered by running it.\n- The human: ask_user, for a decision that is theirs.\n\nTool discipline:\n- READ BEFORE YOU EDIT. For any file you are about to change, read it\n  first \u2014 never guess its content.\n- Use edit_file for targeted changes and write_file for full rewrites.\n  Prefer many small edits over one large write.\n- Be careful \u2014 shell has side effects and may take time.\n- search_text and list_dir are cheap \u2014 locate first, then read ranges\n  with read_file offset/limit; never read a whole large file in one call.\n- Do not re-read a file you already read unchanged, or one you changed\n  yourself through a confirmed edit \u2014 rely on the earlier result and\n  on the change you just made.\n- When a tool fails, read the error and adjust; do not repeat the same\n  call blindly.\n\nAn authorization covers what it NAMES: when the scope is not named \u2014\nwhich files, which branches, whether to push \u2014 ask before acting.\nDelivering, sharing or handing over changes means committing locally and\nstopping; pushing, publishing or sending happens only when the human\nnames it.\n\nWorkflow: understand the request, find the relevant code, make the\nsmallest change that works, then verify with a command (tests/build).\nReport what you did in one or two lines per change.";
+export declare const SYSTEM_PROMPT = "You are an expert coding assistant running on Kiso, an agent runtime. Help the user complete software engineering tasks in the current workspace using the available tools.\n\nShell can access this machine and the network, including git, package managers, and HTTP. For factual questions the user asks, use existing valid tool evidence or an available tool rather than guessing or claiming the information is unavailable.\n\nWork directly toward the user's request. Make the smallest complete change that solves it, follow existing conventions, and do not expand the task into unrelated fixes, refactors, or features.\n\nInspect enough current context to act correctly. Reuse valid observations and tool results instead of repeating work. A confirmed tool result is evidence; do not re-read or re-check solely for reassurance. If a tool reports a failure or conflict, use that new evidence to decide the next action.\n\nAfter a successful edit or write, treat the change you made and the returned revision as the file's current observed state. Do not re-read it before a follow-up edit unless you need context you have not already observed or a tool reports a conflict or failure. When a conflict or refusal already provides the current relevant text and revision, use that result directly instead of reading the file again.\n\nFor behavior-changing work, use the narrowest relevant existing verification when needed. Broaden verification only when a failure, meaningful risk, or concrete unresolved concern gives a reason to do so. Do not create ad-hoc verification scripts when existing evidence is sufficient.\n\nWhen the requested work is complete and there is no concrete unresolved issue, stop. Continue investigating or checking only when new evidence gives a reason to continue.\n\nNecessary workspace changes are within the scope of the requested task. Ask the user only for decisions that require the user. Do not commit, push, publish, send, or perform other remote or irreversible actions unless explicitly requested.\n\nRequests to share, deliver, hand over, or get work ready do not by themselves authorize a commit, push, publish, or send. Perform those actions only when the user explicitly names the action; otherwise leave the changes in the workspace.\n\nBe concise.";
 /** Hard cap for injected instructions — truncate and say so. */
 /**
  * A area: read the FIRST present instruction file (AGENTS.md preferred) and

package/dist/coding-prompt.js

@@ -13,41 +13,25 @@ import { readFileSync } from "node:fs";
  */
 /** The built-in prompt. Exported for scripts/request-surface.mjs — the
  *  model-side token-rent counter measures the REAL bytes, never a copy. */
-export const SYSTEM_PROMPT = `You are kiso, a coding agent. You work in a workspace
-directory and change code with tools. Be concise: answer in a few lines
-unless the task genuinely needs more. Never claim a file was changed
-unless a tool confirmed it.
+export const SYSTEM_PROMPT = `You are an expert coding assistant running on Kiso, an agent runtime. Help the user complete software engineering tasks in the current workspace using the available tools.
 
-What you can reach:
-- The workspace: read_file, list_dir, search_text, write_file, edit_file.
-- This machine and the network: shell — builds, tests, git, package
-  managers, curl for HTTP, system queries. A request one command can
-  answer is answered by running it.
-- The human: ask_user, for a decision that is theirs.
+Shell can access this machine and the network, including git, package managers, and HTTP. For factual questions the user asks, use existing valid tool evidence or an available tool rather than guessing or claiming the information is unavailable.
 
-Tool discipline:
-- READ BEFORE YOU EDIT. For any file you are about to change, read it
-  first — never guess its content.
-- Use edit_file for targeted changes and write_file for full rewrites.
-  Prefer many small edits over one large write.
-- Be careful — shell has side effects and may take time.
-- search_text and list_dir are cheap — locate first, then read ranges
-  with read_file offset/limit; never read a whole large file in one call.
-- Do not re-read a file you already read unchanged, or one you changed
-  yourself through a confirmed edit — rely on the earlier result and
-  on the change you just made.
-- When a tool fails, read the error and adjust; do not repeat the same
-  call blindly.
+Work directly toward the user's request. Make the smallest complete change that solves it, follow existing conventions, and do not expand the task into unrelated fixes, refactors, or features.
 
-An authorization covers what it NAMES: when the scope is not named —
-which files, which branches, whether to push — ask before acting.
-Delivering, sharing or handing over changes means committing locally and
-stopping; pushing, publishing or sending happens only when the human
-names it.
+Inspect enough current context to act correctly. Reuse valid observations and tool results instead of repeating work. A confirmed tool result is evidence; do not re-read or re-check solely for reassurance. If a tool reports a failure or conflict, use that new evidence to decide the next action.
 
-Workflow: understand the request, find the relevant code, make the
-smallest change that works, then verify with a command (tests/build).
-Report what you did in one or two lines per change.`;
+After a successful edit or write, treat the change you made and the returned revision as the file's current observed state. Do not re-read it before a follow-up edit unless you need context you have not already observed or a tool reports a conflict or failure. When a conflict or refusal already provides the current relevant text and revision, use that result directly instead of reading the file again.
+
+For behavior-changing work, use the narrowest relevant existing verification when needed. Broaden verification only when a failure, meaningful risk, or concrete unresolved concern gives a reason to do so. Do not create ad-hoc verification scripts when existing evidence is sufficient.
+
+When the requested work is complete and there is no concrete unresolved issue, stop. Continue investigating or checking only when new evidence gives a reason to continue.
+
+Necessary workspace changes are within the scope of the requested task. Ask the user only for decisions that require the user. Do not commit, push, publish, send, or perform other remote or irreversible actions unless explicitly requested.
+
+Requests to share, deliver, hand over, or get work ready do not by themselves authorize a commit, push, publish, or send. Perform those actions only when the user explicitly names the action; otherwise leave the changes in the workspace.
+
+Be concise.`;
 /** The project-instructions file names, in priority order (A area). */
 const INSTRUCTION_FILES = ["AGENTS.md", "CLAUDE.md"];
 /** Hard cap for injected instructions — truncate and say so. */

package/dist/config.d.ts

@@ -138,6 +138,14 @@ export interface KisoConfig {
      *  unlisted path could be an interpreter running code the child wrote.
      *  Same layers as `checks`. */
     readonly evaluators?: readonly string[];
+    /** 0.49.0 C1: which profile a delegated child runs on when its task
+     *  names none — `{ "model": "<a profile in models>" }`. Unset, a child
+     *  runs on the conversation's own profile. USER-LEVEL ONLY, like
+     *  `models`: a project must never choose where your children's
+     *  requests go. */
+    readonly subagents?: {
+        readonly model?: string;
+    };
 }
 /** The resolved, merged config — project wins over user, both validated. */
 export interface ResolvedConfig {

package/dist/config.js

@@ -245,6 +245,22 @@ export function parseConfig(text, source) {
             fail("projectTrust", 'expected "ask" or "never" (there is deliberately no "always")');
         out.projectTrust = obj.projectTrust;
     }
+    if (obj.subagents !== undefined) {
+        if (source.startsWith("<cwd>"))
+            fail("subagents", "belongs in the USER config — a project must never choose which model your delegated children run on");
+        if (obj.subagents === null || typeof obj.subagents !== "object" || Array.isArray(obj.subagents))
+            fail("subagents", 'expected an object, e.g. { "model": "<profile>" }');
+        const sub = obj.subagents;
+        if (sub.model !== undefined) {
+            if (typeof sub.model !== "string" || sub.model === "")
+                fail("subagents.model", "expected the name of a profile in models");
+            // both keys are user-level only, so the profile is in this file or nowhere
+            const names = Object.keys(out.models ?? {});
+            if (!names.includes(sub.model))
+                fail("subagents.model", `"${sub.model}" names no profile in models (configured: ${names.length > 0 ? names.join(", ") : "none"})`);
+        }
+        out.subagents = sub.model !== undefined ? { model: sub.model } : {};
+    }
     return out;
 }
 function readConfigFile(path, source) {
@@ -325,6 +341,8 @@ export function mergeConfigs(user, project) {
         ...(u.checks !== undefined || p.checks !== undefined ? { checks: { ...(u.checks ?? {}), ...(p.checks ?? {}) } } : {}),
         // CS-1: the evaluator lists join — either layer's script may be named
         ...(u.evaluators !== undefined || p.evaluators !== undefined ? { evaluators: [...(u.evaluators ?? []), ...(p.evaluators ?? [])] } : {}),
+        // 0.49.0 C1: user-level only — parseConfig refuses a project's
+        ...(u.subagents !== undefined ? { subagents: u.subagents } : {}),
     };
 }
 /** Where a profile's sign-in comes from, or why it has none. The sign-in

package/dist/create-coding-agent.js

@@ -168,14 +168,11 @@ export async function createCodingAgent(sessionId, input, modelFlag) {
     settingsLayers.project = projectCfg;
     settingsLayers.modelFlag = modelFlag;
     const secretEnvNames = secretEnvNamesOf(merged.models ?? {});
-    const builtIn = await builtInLayer(user, proj, input !== undefined && process.stdin.isTTY ? askUi(input) : undefined, secretEnvNames);
-    setExtensionLists(builtIn, user, proj, [...builtIn, ...user, ...proj]);
-    // merge round B — the config surface: user config + (trusted) project config,
-    // resolved with flags > env > project > user > default. The CLI never
-    // imports provider SDKs directly — the runtime's lazy provider
-    // resolution owns them (a config profile only ever NAMES an env var for
-    // its key; the key itself never sits in a config file).
-    setMergedConfig(merged);
+    // SA-F1: set BEFORE the built-in layer loads. The subagent extension reads
+    // it once, at load, to build the delegate schema and its executor's
+    // snapshot; assigned after, it read an empty config (no `acceptance` or
+    // `model` field, a configured check refused, `subagents.model` ignored,
+    // project-layout children in the legacy sessions folder).
     // DT-1a: what a delegated task may NAME — the configured checks and the
     // model profiles — handed to the (in-process) subagent extension through
     // the environment. A model never supplies a command; it names a check.
@@ -184,7 +181,22 @@ export async function createCodingAgent(sessionId, input, modelFlag) {
     // channel and not an exported KISO_SESSIONS_DIR: a variable in
     // process.env would reach every shell child, and a kiso started from a
     // shell tool would then write into this project's folder.
-    process.env.KISO_DELEGATION_CONFIG_JSON = JSON.stringify({ checks: merged.checks ?? {}, evaluators: merged.evaluators ?? [], profiles: Object.keys(merged.models ?? {}), sessionsDir: sessionsDir() });
+    process.env.KISO_DELEGATION_CONFIG_JSON = JSON.stringify({
+        checks: merged.checks ?? {},
+        evaluators: merged.evaluators ?? [],
+        profiles: Object.keys(merged.models ?? {}),
+        sessionsDir: sessionsDir(),
+        // 0.49.0 C1: the profile a child runs on when its task names none
+        ...(merged.subagents?.model !== undefined ? { subagentsModel: merged.subagents.model } : {}),
+    });
+    const builtIn = await builtInLayer(user, proj, input !== undefined && process.stdin.isTTY ? askUi(input) : undefined, secretEnvNames);
+    setExtensionLists(builtIn, user, proj, [...builtIn, ...user, ...proj]);
+    // merge round B — the config surface: user config + (trusted) project config,
+    // resolved with flags > env > project > user > default. The CLI never
+    // imports provider SDKs directly — the runtime's lazy provider
+    // resolution owns them (a config profile only ever NAMES an env var for
+    // its key; the key itself never sits in a config file).
+    setMergedConfig(merged);
     setConfigModels(merged.models ?? {});
     // CW-1 batch 2: the windows endpoints stated by refusing — read before the
     // first window is asked for (the unknown-window notice below).
@@ -277,6 +289,11 @@ export async function createCodingAgent(sessionId, input, modelFlag) {
         // picked for it (the picker's fallback applied); the runtime reads it
         // for a new session only — a resumed one keeps its own
         ...(() => {
+            // 0.49.0 C1: a delegated child on its conversation's profile runs at
+            // the conversation's effort, not at the one remembered for the profile
+            const inherited = childReasoning();
+            if (inherited !== null)
+                return { reasoning: inherited };
             if (resolved === null || merged.models?.[resolved.name] !== resolved.profile)
                 return {};
             const effort = startingEffort(resolved.profile, preferences().effort?.[resolved.name]);
@@ -370,3 +387,20 @@ export async function createCodingAgent(sessionId, input, modelFlag) {
     };
     return createAgent(definition);
 }
+/** 0.49.0 C1: the effort the subagent extension hands a child running on its
+ *  conversation's profile (KISO_CHILD_REASONING). Read only in a child — a
+ *  top-level kiso ignores a stray variable — and only in its known shape. */
+function childReasoning() {
+    if ((Number.parseInt(process.env.KISO_SUBAGENT_DEPTH ?? "0", 10) || 0) < 1)
+        return null;
+    const raw = process.env.KISO_CHILD_REASONING;
+    if (raw === undefined || raw === "")
+        return null;
+    try {
+        const r = JSON.parse(raw);
+        return typeof r.thinking === "string" && typeof r.effort === "string" ? { thinking: r.thinking, effort: r.effort } : null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/dispatch.js

@@ -880,7 +880,7 @@ export function dispatch(line, ctx) {
                 if (want !== wasOn)
                     body.dontAskNotice(`don't ask → ${want ? "on" : "off"}`, want);
                 else
-                    body.notice(`don't ask → ${want ? "on" : "off"}`);
+                    body.dontAskNotice(`don't ask → ${want ? "on" : "off"}`, want, true);
                 ctx.paintIdle();
             }
             ctx.input.prompt();
@@ -1087,6 +1087,9 @@ export function dispatch(line, ctx) {
                             // session still names the outgoing profile
                             const prevProfile = currentProfileName !== null ? configModels[currentProfileName] : undefined;
                             const payeeBefore = prevProfile !== undefined ? payeeOf(prevProfile) : null;
+                            // the notices round (owner, 2026-10-14): the MODEL row says what it
+                            // switched FROM, read before the outgoing binding is replaced
+                            const fromName = currentProfileName ?? agentModel;
                             ctx.session.setModelBinding(binding);
                             setLastBinding(binding);
                             setAgentModel(profile.model, profile.baseUrl);
@@ -1117,14 +1120,15 @@ export function dispatch(line, ctx) {
                             // (and the owner's) read `gpt-6-astra · CH 92%`, the new
                             // model beside the previous model's figure.
                             ctx.modelSwitched();
-                            body.notice(`model → ${profName} (${profile.model}${providerLabel(profile.baseUrl, profile.upstream) === "" ? "" : ` ${providerLabel(profile.baseUrl, profile.upstream)}`}${effortTok !== undefined ? ` · ${effortTok}` : ""}) — takes effect on the next turn`);
+                            const hostLabel = providerLabel(profile.baseUrl, profile.upstream);
+                            body.modelNotice(`model → ${profName} (${profile.model}${hostLabel === "" ? "" : ` ${hostLabel}`}${effortTok !== undefined ? ` · ${effortTok}` : ""}) — takes effect on the next turn`, fromName, profName, `${profile.model}${hostLabel === "" ? "" : ` ${hostLabel}`}${effortTok !== undefined ? ` \u00b7 ${effortTok}` : ""} \u00b7 takes effect on the next turn`);
                             // MP-1 (0.40.7): when the switch changes WHO PAYS — another
                             // endpoint, or another credential for it — say so, once,
                             // under the switch line. A switch between two models on the
                             // same account says nothing more.
                             const payeeAfter = payeeOf(profile);
                             if (payeeBefore !== null && payeeBefore !== payeeAfter)
-                                body.notice(`paid by ${payeeAfter} from the next turn — was ${payeeBefore}`);
+                                body.metaNotice(`paid by ${payeeAfter} from the next turn — was ${payeeBefore}`, [{ label: "PAYER", sentence: `${payeeAfter} from the next turn \u00b7 was ${payeeBefore}` }]);
                         }
                     }
                 }

package/dist/index.js

@@ -41,7 +41,7 @@ import { browserCommand, launchCommand } from "./launch.js";
 import { createFauxProvider } from "@vincemakes/kiso-evals";
 import { isProtectedPath, protectedIdentity, PROTECTED_REFUSAL } from "@vincemakes/kiso-tools-node";
 import { OFFERED_MODES, applyModeState, envModeLayer, getDontAsk, modeDisplay, parseMode, resolveModeLayers } from "./mode.js";
-import { activeStoreDir, setActiveStoreDir, agentModel, atFiles, body, bodyLog, kisoHome, workspaceRoot, projectRoot, ownSessionsDir, setOpenSessionFolder, builtInExtensions, currentFaux, dock, loadedExtensions, mergedConfig, mergedTempPaths, modelChoice, projectExtensions, configModels, configuredWindow, agentBaseUrl, currentModelName, currentAgentExtensions, sessionStoreRef, sessionsDir, setAgentModel, setBody, setConfigModels, setConfiguredWindow, setCurrentAgentExtensions, setCurrentFaux, setCurrentModelName, setCurrentProfileName, setExtensionLists, protectedFiles, setMergedConfig, setModelChoice, setSessionStore, userExtensions, VERSION, lastBinding, acceptDrift, setAcceptDrift, loadedSkillsCatalog, queuedSwitchLines } from "./state.js";
+import { activeStoreDir, setActiveStoreDir, agentModel, atFiles, body, bodyLog, kisoHome, workspaceRoot, projectRoot, ownSessionsDir, setOpenSessionFolder, builtInExtensions, currentFaux, dock, loadedExtensions, mergedConfig, mergedTempPaths, modelChoice, projectExtensions, configModels, configuredWindow, agentBaseUrl, currentModelName, currentAgentExtensions, sessionStoreRef, sessionsDir, setAgentModel, setBody, setConfigModels, setConfiguredWindow, setCurrentAgentExtensions, setCurrentFaux, setCurrentModelName, setCurrentProfileName, setExtensionLists, setLiveSession, protectedFiles, setMergedConfig, setModelChoice, setSessionStore, userExtensions, VERSION, lastBinding, acceptDrift, setAcceptDrift, loadedSkillsCatalog, queuedSwitchLines } from "./state.js";
 import { fauxSkip, readFauxScript } from "./faux-glue.js";
 import { barFor, chat, contextWindowTokens, displayCtxRatio, microcompactThresholdFor, statusModelLabel } from "./chat.js";
 import { preferences, usePreferences } from "./preferences.js";
@@ -841,6 +841,8 @@ function bindRestoredSession(session) {
         bodyLog(`binding changed — now on ${session.model}: ${ack.reasons.join("; ")}; reasoning reset to defaults${prior === "" ? "" : ` (was ${prior})`}`);
     }
     setAgentModel(session.model, session.baseUrl);
+    // 0.49.0 C1: the session a delegation reads its conversation's binding from
+    setLiveSession(session);
     session.setMicrocompactThreshold(microcompactThresholdFor({
         model: session.model,
         ...(session.baseUrl !== undefined ? { baseUrl: session.baseUrl } : {}),
@@ -1112,7 +1114,7 @@ async function chatLoop(first, firstId, input, autoCompact) {
                 return r.status === 0 ? r.stdout.trim() : null;
             });
             if (tmuxHint !== null)
-                body.notice(tmuxHint);
+                body.metaNotice(tmuxHint, [{ label: "HINT", sentence: tmuxHint }]);
             void announceUpdate();
         }
         else {
@@ -1257,6 +1259,13 @@ async function main() {
     // first createCodingAgent (the tier extensions read `current` live). The flag
     // is stripped from the positional args, so it works in any position.
     const args = process.argv.slice(2);
+    // 0.49.0 B6.2: `kiso apply-patch <taskDir>` adopts a writer's collected
+    // patch into the workspace — a one-shot effect, no session, no model
+    if (args[0] === "apply-patch") {
+        const { applyPatch } = await import("./apply-patch.js");
+        process.exitCode = await applyPatch(args.slice(1));
+        return;
+    }
     // XP-1: --accept-drift (a flag, never an env var) authorizes opening a
     // session whose recorded profile materially drifted — the
     // acknowledgement is recorded as a new revision by the runtime.
@@ -1847,6 +1856,7 @@ async function main() {
                     "  kiso resume              pick a session to continue (TTY picker)\n" +
                     "  kiso resume <id> [prompt]   continue a session (one-shot)\n" +
                     "  kiso sessions [--all|--current]   list durable sessions (a terminal shows this workspace's by default)\n" +
+                    "  kiso apply-patch <dir>   adopt a subagent's collected patch (its handoff prints the command)\n" +
                     "  kiso login <provider>    anthropic|openai|deepseek|zai: store an API key (hidden prompt, or stdin when piped);\n" +
                     "                           chatgpt: sign in with a ChatGPT subscription (browser; unofficial third-party flow)\n" +
                     "  kiso login --endpoint <url>    a gateway: store its API key for that URL's origin only\n" +

package/dist/replay.d.ts

@@ -34,6 +34,7 @@ export interface ReplayBody {
         isError: boolean;
         reason?: string | null;
         untimed?: boolean;
+        created?: boolean;
     }): void;
     notice(text: string): void;
     metaNotice(text: string, rows: readonly {

package/dist/replay.js

@@ -98,7 +98,8 @@ function replayTurn(body, turn, tasks) {
                     if (m !== null)
                         reason = m[1];
                 }
-                body.toolResult(String(e.callId), { content: text, isError: e.isError === true, reason, untimed: true });
+                const created = (e.tags ?? []).includes("created");
+                body.toolResult(String(e.callId), { content: text, isError: e.isError === true, reason, untimed: true, ...(created ? { created: true } : {}) });
                 results.add(String(e.callId));
                 break;
             }

package/dist/state.d.ts

@@ -8,6 +8,7 @@
 import { Dock, type AtItem, type Body, type PanelVerdict, type PanelView, type SaferAnswer, type SessionCardView } from "@vincemakes/kiso-tui";
 import type { TaskDeliveryItem } from "@vincemakes/kiso-core";
 import type { KisoExtension, StoreRecord } from "@vincemakes/kiso-runtime";
+import type { ReasoningSetting } from "@vincemakes/kiso-runtime/internal";
 import { TaskManager } from "@vincemakes/kiso-runtime/internal";
 import { type ShellTasks } from "@vincemakes/kiso-tools-node";
 /** finding #11: KISO_HOME is the ONE root — every default path derives from
@@ -34,6 +35,7 @@ export declare function codingToolOptions(): {
     readonly secretEnvNames: readonly string[];
     readonly protectedFiles: readonly string[];
     readonly tasks: (sessionId: string | undefined) => ShellTasks | undefined;
+    readonly observedRevision: (sessionId: string | undefined, full: string, kind?: "edit" | "write") => string | undefined;
     readonly limits?: {
         readonly minForegroundMs: number;
     };
@@ -44,6 +46,30 @@ export declare function taskWhatOf(sessionId: string | undefined): (taskId: stri
 export declare function lostToldOf(sessionId: string): Set<string>;
 /** The transcript lines a delivery shows: a loss already told is left out. */
 export declare function deliveryLines(sessionId: string, items: readonly TaskDeliveryItem[]): string[];
+/** 0.49.0 C1: the live sessions by id — what a delegation reads its
+ *  conversation's binding from. Every entry registers its session
+ *  (index.ts bindRestoredSession: fresh, resumed, switched, -p). */
+interface LiveSession {
+    readonly id: string;
+    readonly model: string;
+    readonly baseUrl: string | undefined;
+    readonly profileName: string | null;
+    readonly reasoning: ReasoningSetting;
+}
+export declare function setLiveSession(session: LiveSession): void;
+/** 0.49.0 C1: the conversation's live binding, for a child that names no
+ *  model — the profile its session is bound to (the session's own record,
+ *  never the display mark, which /reload and /resume clear), else the one
+ *  configured profile with the session's (model, baseUrl), else none — and
+ *  the effort the session runs at. */
+export declare function bindingFor(sessionId: string | undefined): {
+    readonly profile: string | null;
+    readonly model: string;
+    readonly reasoning: ReasoningSetting;
+} | null;
+/** The one configured profile whose model and endpoint are these — null
+ *  when none matches, or several do (a guess is never a binding). */
+export declare function profileByIdentity(model: string, baseUrl: string | undefined): string | null;
 export declare function tasksFor(sessionId: string | undefined): TaskManager | undefined;
 export declare function setExitTasks(choice: "stop" | "leave"): void;
 /** 3e: the live tasks of every session this process opened — a runner's
@@ -416,3 +442,5 @@ export declare function setLastBinding(b: LastBinding): void;
 export declare function lastBinding(): LastBinding | null;
 export declare function setAcceptDrift(v: boolean): void;
 export declare function acceptDrift(): boolean;
+export declare function observedRevisionFromLog(sessionId: string | undefined, full: string, kind?: "edit" | "write"): string | undefined;
+export {};

package/dist/state.js

@@ -8,11 +8,13 @@
 import { execFileSync } from "node:child_process";
 import { readdirSync, readFileSync, realpathSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { AT_CAP, AT_SKIP, Dock } from "@vincemakes/kiso-tui";
+import { projectMessages } from "@vincemakes/kiso-core";
 import { TaskManager } from "@vincemakes/kiso-runtime/internal";
 import { processTaskBackend } from "@vincemakes/kiso-tools-node";
+import { collectWriter } from "@vincemakes/kiso-subagent-ext";
 import { canonicalPath, LEGACY_SESSIONS_DIR, projectDirFor, projectLayoutActive } from "./projects.js";
 import { taskNoticeLines, taskWhat } from "./task-notice.js";
 /** finding #11: KISO_HOME is the ONE root — every default path derives from
@@ -52,6 +54,7 @@ export function codingToolOptions() {
         secretEnvNames: secretEnvNamesOf(configModels),
         protectedFiles: protectedFiles(),
         tasks: tasksFor,
+        observedRevision: observedRevisionFromLog,
         ...(Number.isFinite(minForeground) && minForeground >= 0 ? { limits: { minForegroundMs: minForeground } } : {}),
     };
 }
@@ -88,13 +91,38 @@ export function deliveryLines(sessionId, items) {
     const told = lostToldOf(sessionId);
     return taskNoticeLines(items.filter((i) => !(i.transition === "unknown" && told.has(i.taskId))), taskWhatOf(sessionId));
 }
+const liveSessions = new Map();
+export function setLiveSession(session) {
+    liveSessions.set(session.id, session);
+}
+/** 0.49.0 C1: the conversation's live binding, for a child that names no
+ *  model — the profile its session is bound to (the session's own record,
+ *  never the display mark, which /reload and /resume clear), else the one
+ *  configured profile with the session's (model, baseUrl), else none — and
+ *  the effort the session runs at. */
+export function bindingFor(sessionId) {
+    const s = sessionId === undefined ? undefined : liveSessions.get(sessionId);
+    if (s === undefined)
+        return null;
+    const profile = s.profileName !== null && configModels[s.profileName] !== undefined ? s.profileName : profileByIdentity(s.model, s.baseUrl);
+    return { profile, model: s.model, reasoning: s.reasoning };
+}
+/** The one configured profile whose model and endpoint are these — null
+ *  when none matches, or several do (a guess is never a binding). */
+export function profileByIdentity(model, baseUrl) {
+    const hits = Object.entries(configModels).filter(([, p]) => p.model === model && p.baseUrl === baseUrl);
+    return hits.length === 1 ? hits[0][0] : null;
+}
 export function tasksFor(sessionId) {
     if (sessionId === undefined || activeStoreDir === "")
         return undefined;
     let manager = taskManagers.get(sessionId);
     if (manager === undefined) {
         taskBackend ??= processTaskBackend();
-        manager = new TaskManager({ root: join(activeStoreDir, `${sessionId}.tasks`), backend: taskBackend });
+        // 0.49.0 B: a writer's end is its collection — the subagent
+        // extension's collector, called once its process has ended
+        const created = new TaskManager({ root: join(activeStoreDir, `${sessionId}.tasks`), backend: taskBackend, collect: (info) => collectWriter(info, created) });
+        manager = created;
         manager.observe();
         taskManagers.set(sessionId, manager);
     }
@@ -612,3 +640,87 @@ export function setAcceptDrift(v) {
 export function acceptDrift() {
     return acceptDriftValue;
 }
+/** O1 — the hidden observed revision. The revision the model last
+ *  OBSERVED for a file, rebuilt from the session's MODEL-VISIBLE history
+ *  (`projectMessages` over the durable log, so a receipt cleared by
+ *  microcompaction or covered by a summary no longer counts): the last
+ *  [rev:…] of a successful read_file / edit_file / write_file on that
+ *  file, or of an edit_file stale refusal (it carries the current text).
+ *  Never the disk's current revision — a stale write stays refused.
+ *  `kind: "write"` (a whole-file replace) also needs visible whole-file
+ *  knowledge: an unranged, uncapped read or an own write, followed only
+ *  by own mutations. The log is per session, so a child session (a
+ *  subagent) inherits no observation. */
+function realOrResolved(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return p;
+    }
+}
+export function observedRevisionFromLog(sessionId, full, kind = "edit") {
+    if (sessionId === undefined || activeStoreDir === "")
+        return undefined;
+    let text;
+    try {
+        text = readFileSync(join(activeStoreDir, `${sessionId}.jsonl`), "utf8");
+    }
+    catch {
+        return undefined;
+    }
+    const events = [];
+    for (const line of text.split("\n")) {
+        if (line === "")
+            continue;
+        try {
+            const e = JSON.parse(line).event;
+            if (e !== undefined)
+                events.push(e);
+        }
+        catch { /* a torn tail line */ }
+    }
+    let messages;
+    try {
+        messages = projectMessages(events);
+    }
+    catch {
+        return undefined;
+    }
+    const target = realOrResolved(full);
+    const calls = new Map();
+    let rev;
+    let wholeKnown = false;
+    for (const m of messages) {
+        if (m.role === "assistant") {
+            for (const b of m.blocks) {
+                if (b.type === "tool_use" && typeof b.input.path === "string") {
+                    calls.set(b.callId, { name: b.name, full: realOrResolved(resolve(process.cwd(), b.input.path)), ranged: b.input.offset !== undefined || b.input.limit !== undefined });
+                }
+            }
+        }
+        else if (m.role === "tool") {
+            const c = calls.get(m.callId);
+            if (c === undefined || c.full !== target)
+                continue;
+            const body = typeof m.content === "string" ? m.content : m.content.map((x) => (x.type === "text" ? x.text : "")).join("");
+            const hit = [...body.matchAll(/\[(rev:[0-9a-f]{16})\]/g)].pop();
+            if (hit === undefined)
+                continue;
+            if (!m.isError && (c.name === "read_file" || c.name === "edit_file" || c.name === "write_file")) {
+                rev = hit[1];
+                if (c.name === "read_file")
+                    wholeKnown = !c.ranged && !body.includes("(call again with offset=") && !body.includes("[output capped at");
+                else if (c.name === "write_file")
+                    wholeKnown = true;
+            }
+            else if (m.isError && c.name === "edit_file" && body.includes(" changed since ")) {
+                rev = hit[1];
+                wholeKnown = false;
+            }
+        }
+    }
+    if (kind === "write" && !wholeKnown)
+        return undefined;
+    return rev;
+}

package/dist/task-notice.d.ts

@@ -7,6 +7,11 @@ import type { NoticeMark } from "@vincemakes/kiso-tui";
  *  (<what>) — ` — the parenthesis only when the command is known — and the
  *  LAST ` — ` part opening with "it may still be running". One line each. */
 export declare function taskNoticeLines(items: readonly TaskDeliveryItem[], what?: (taskId: string) => string | undefined): string[];
+/** Finding 0480-F9: the chain budget is spent — said to the person once,
+ *  so a chain that went quiet on its budget does not look idle. */
+export declare function budgetSpentLine(info: {
+    readonly wakes: number;
+}): string;
 /** A task's state in the person's words. A stop that was asked for and is
  *  not yet confirmed reads `stopping` — never `stopped` before the journal
  *  says so; a task kiso lost track of says so (Amendment 8). */

package/dist/task-notice.js

@@ -36,6 +36,11 @@ export function taskNoticeLines(items, what) {
     }
     return rows;
 }
+/** Finding 0480-F9: the chain budget is spent — said to the person once,
+ *  so a chain that went quiet on its budget does not look idle. */
+export function budgetSpentLine(info) {
+    return `✦ chain budget spent — ${info.wakes} autonomous wake${info.wakes === 1 ? "" : "s"} since your last message · finished tasks wait for you`;
+}
 /** A task's state in the person's words. A stop that was asked for and is
  *  not yet confirmed reads `stopping` — never `stopped` before the journal
  *  says so; a task kiso lost track of says so (Amendment 8). */

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@vincemakes/kiso-code",
-	"version": "0.48.0",
+	"version": "0.50.0",
 	"description": "kiso-code \u2014 the coding agent on kiso, the durable runtime for AI agents: kiso chat / kiso resume / kiso sessions.",
 	"type": "module",
 	"license": "MIT",
@@ -18,19 +18,19 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@vincemakes/kiso-ask-ext": "0.48.0",
-		"@vincemakes/kiso-core": "0.48.0",
-		"@vincemakes/kiso-evals": "0.48.0",
-		"@vincemakes/kiso-mcp-ext": "0.48.0",
-		"@vincemakes/kiso-provider-anthropic": "0.48.0",
-		"@vincemakes/kiso-provider-openai": "0.48.0",
-		"@vincemakes/kiso-provider-openai-responses": "0.48.0",
-		"@vincemakes/kiso-runtime": "0.48.0",
-		"@vincemakes/kiso-skills-ext": "0.48.0",
-		"@vincemakes/kiso-subagent-ext": "0.48.0",
-		"@vincemakes/kiso-tools-node": "0.48.0",
-		"@vincemakes/kiso-tui": "0.48.0",
-		"@vincemakes/kiso-tui-cells": "0.48.0"
+		"@vincemakes/kiso-ask-ext": "0.50.0",
+		"@vincemakes/kiso-core": "0.50.0",
+		"@vincemakes/kiso-evals": "0.50.0",
+		"@vincemakes/kiso-mcp-ext": "0.50.0",
+		"@vincemakes/kiso-provider-anthropic": "0.50.0",
+		"@vincemakes/kiso-provider-openai": "0.50.0",
+		"@vincemakes/kiso-provider-openai-responses": "0.50.0",
+		"@vincemakes/kiso-runtime": "0.50.0",
+		"@vincemakes/kiso-skills-ext": "0.50.0",
+		"@vincemakes/kiso-subagent-ext": "0.50.0",
+		"@vincemakes/kiso-tools-node": "0.50.0",
+		"@vincemakes/kiso-tui": "0.50.0",
+		"@vincemakes/kiso-tui-cells": "0.50.0"
 	},
 	"devDependencies": {
 		"@types/node": "^26.1.2",