@krimto-labs/krimto 0.2.21 → 0.2.26

package/bin/krimto.mjs

@@ -13,7 +13,9 @@ try {
   const cmd =
     rawCmd === "team" && typeof process.argv[3] === "string"
       ? `team ${process.argv[3]}`
-      : rawCmd;
+      : rawCmd === "set" && typeof process.argv[3] === "string"
+        ? `set ${process.argv[3]}`
+        : rawCmd;
 
   // Guard: `krimto team` alone (or with an unknown subverb) shouldn't fall through to the stdio
   // MCP server. Print usage and exit instead.
@@ -27,6 +29,16 @@ try {
     process.exit(2);
   }
 
+  // Same guard for `krimto set <subverb>`.
+  const knownSetCmds = ["set identity"];
+  if (rawCmd === "set" && !knownSetCmds.includes(cmd)) {
+    process.stderr.write(
+      "Usage: krimto set <identity> <value>\n" +
+        "  identity <email>   Change the identity used for new fact writes\n",
+    );
+    process.exit(2);
+  }
+
   if (cmd === "--help" || cmd === "-h" || cmd === "help") {
     // `krimto --help` — surface every subcommand so a user who didn't read the README can still
     // discover them. Version is read from the server module so it never drifts from KRIMTO_VERSION.
@@ -44,6 +56,21 @@ try {
     const minimal = flags.includes("--minimal");
     const yes = flags.includes("--yes");
     const isTty = process.stdin.isTTY === true;
+
+    // v0.2.24 — fix for the "AI agent runs krimto init and silently gets the legacy writer"
+    // gap. When invoked from a non-TTY context (e.g. Claude Code's Bash tool) with no flags,
+    // the interactive wizard CAN'T run; the legacy rule-only writer would proceed silently
+    // and the caller wouldn't realize MCP wiring + service install were skipped. Print a
+    // clear notice up front so the user (or AI relaying the result) knows what just happened.
+    if (!isTty && !all && !minimal && !yes) {
+      process.stderr.write(
+        "ℹ️  No interactive terminal detected — running lightweight init (rules only).\n" +
+          "   For the FULL setup (editor wiring + service install), either:\n" +
+          "     • Run from a real terminal:   $ npx @krimto-labs/krimto init\n" +
+          "     • Or pass --yes here:         $ npx @krimto-labs/krimto init --yes\n\n",
+      );
+    }
+
     const legacyMode = all || minimal || (!isTty && !yes);
 
     if (legacyMode) {
@@ -65,18 +92,51 @@ try {
           : !minimal
             ? `   Default: wrote all 4 supported rule files (safer than detecting one editor and\n   missing the actual one). Pass --minimal to write only matched editors next time.\n\n`
             : "";
+
+        // v0.2.25 — show both the files we wrote AND the files we skipped (already current).
+        // Before, "wrote 2 of 4" was opaque: the user couldn't tell whether the other 2 were
+        // intentionally skipped or silently failed. `res.considered` is the full target list
+        // for this invocation, so the skipped set is just considered \ written.
+        const writtenSet = new Set(res.written);
+        const skipped = res.considered.filter((f) => !writtenSet.has(f));
+        const skippedBlock = skipped.length > 0
+          ? "\n   Already current (no change):\n" + skipped.map((f) => `     • ${f}`).join("\n") + "\n"
+          : "";
+
+        // v0.2.25 — Gap 9. Rules-only init writes "always use krimto_*" instructions, but if
+        // no editor has Krimto wired into its MCP config, those instructions reference tools
+        // that won't exist in chat. Detect and warn so the user doesn't think the chat side
+        // is mysteriously broken later.
+        let mcpWarning = "";
+        try {
+          const { detectExistingSetup } = await tsImport("../src/cli/init.ts", import.meta.url);
+          const snap = await detectExistingSetup(process.cwd());
+          if (snap.registeredEditors.length === 0) {
+            mcpWarning =
+              "\n⚠️  Rule files written, but NO editor is wired to Krimto yet.\n" +
+              "   The rules tell your AI to use krimto_*, but those tools won't be available\n" +
+              "   until you register the MCP server. From a terminal:\n" +
+              "     $ npx @krimto-labs/krimto init        # full interactive wizard\n" +
+              "     $ npx @krimto-labs/krimto connect     # print copy-paste snippets\n";
+          }
+        } catch {
+          /* best-effort — don't block the success path if detection fails */
+        }
+
         process.stderr.write(
           "\n✅ AUTO MODE on — rule written to " + res.written.length + " file" +
             (res.written.length === 1 ? "" : "s") + "\n" +
             "\n" +
             res.written.map((f) => `   ${f}`).join("\n") + "\n" +
+            skippedBlock +
             "\n" +
             detectedLine +
             "━━ Next steps ━━\n" +
             "\n" +
-            "  1. Restart your editor (so it loads the new rule)\n" +
+            "  1. Restart your editor (so it loads the new rule + MCP tools)\n" +
             "  2. Test in chat: \"Remember that we use pnpm in this repo\"\n" +
             "  3. Verify it landed: $ npx @krimto-labs/krimto verify-connection\n" +
+            mcpWarning +
             "\n" +
             "To undo:  $ npx @krimto-labs/krimto uninit\n" +
             "Manual:   delete the block between <!-- krimto:start --> and <!-- krimto:end -->\n\n",
@@ -350,7 +410,37 @@ try {
     // `krimto connect` — print stdio connect snippets (the npx on-ramp shape), so a solo user
     // doesn't have to chase the README. Honors KRIMTO_IDENTITY when set.
     const { formatConnect } = await tsImport("../src/cli/connect.ts", import.meta.url);
-    process.stdout.write(formatConnect({ identity: process.env.KRIMTO_IDENTITY }));
+    process.stdout.write(await formatConnect({ identity: process.env.KRIMTO_IDENTITY }));
+  } else if (cmd === "whoami") {
+    // `krimto whoami` — show the active KRIMTO_IDENTITY and every place it's currently set
+    // (each editor's MCP config + the always-running service unit). Surfaces drift between
+    // sources so users notice before notes start splitting across two scopes.
+    const { runWhoami } = await tsImport("../src/cli/whoami.ts", import.meta.url);
+    const result = await runWhoami();
+    process.stdout.write(result.message);
+    if (result.mismatch) process.exitCode = 1;
+  } else if (cmd === "set identity") {
+    // `krimto set identity <email>` — update KRIMTO_IDENTITY across every registered editor
+    // and the always-running service. Preserves other env keys (KRIMTO_EMBED_*). Existing
+    // notes do NOT move — that's an intentional separate step.
+    const newIdentity = process.argv[4];
+    const flags = process.argv.slice(5);
+    const yes = flags.includes("--yes");
+    if (!newIdentity) {
+      process.stderr.write(
+        "Usage: krimto set identity <email> [--yes]\n  e.g. krimto set identity alice@acme.com\n",
+      );
+      process.exit(2);
+    }
+    const { runSetIdentity } = await tsImport("../src/cli/setIdentity.ts", import.meta.url);
+    const { resolveDataDir } = await tsImport("../src/server/index.ts", import.meta.url);
+    const result = await runSetIdentity({
+      identity: newIdentity,
+      dataDir: resolveDataDir(),
+      yes,
+    });
+    process.stdout.write(result.message);
+    if (result.status === "error") process.exitCode = 1;
   } else {
     const mod = await tsImport("../src/server/index.ts", import.meta.url);
     await mod.main();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@krimto-labs/krimto",
-  "version": "0.2.21",
+  "version": "0.2.26",
   "description": "Open-source team memory layer for AI agents — markdown files in git, user/team/org hierarchy, cross-vendor MCP server.",
   "license": "Apache-2.0",
   "type": "module",

package/src/cli/cliRuntime.ts

@@ -54,6 +54,7 @@ export async function getLockHolder(dataDir: string): Promise<LockInfo | null> {
         pid: parsed.pid,
         started: typeof parsed.started === "string" ? parsed.started : "unknown",
         mode: (parsed.mode as LockInfo["mode"]) ?? "stdio",
+        launchedBy: parsed.launchedBy === "service" ? "service" : "ad-hoc",
       };
     }
   } catch {

package/src/cli/connect.ts

@@ -5,13 +5,24 @@
 import { stdioConnectSnippets } from "../server/connect";
 
 export interface ConnectOpts {
-  /** Identity to embed in the Cursor env block. Defaults to a generic placeholder. */
+  /** Identity to embed in the Cursor env block. Defaults to git config user.email, falling back to a generic placeholder. */
   identity?: string;
 }
 
-/** Build the multi-line, copy-pasteable output `krimto connect` prints to stdout. */
-export function formatConnect(opts: ConnectOpts = {}): string {
-  const { claude, cursorJson } = stdioConnectSnippets(opts);
+/**
+ * Build the multi-line, copy-pasteable output `krimto connect` prints to stdout.
+ *
+ * v0.2.24 — identity falls back to {@link defaultIdentity} (git config user.email) when not
+ * supplied. Before this, the printed snippet always showed `you@acme.com`, so users
+ * pasting the snippet ended up with the placeholder as their literal KRIMTO_IDENTITY.
+ *
+ * v0.2.24 — the printed `claude mcp add` line is now preceded by `claude mcp remove krimto`
+ * so a copy-paste rerun doesn't fail with "MCP server krimto already exists in local config"
+ * (the same idempotency fix v0.2.19 made to the wizard's MCP writer).
+ */
+export async function formatConnect(opts: ConnectOpts = {}): Promise<string> {
+  const identity = opts.identity ?? (await defaultIdentityForConnect());
+  const { claude, cursorJson } = stdioConnectSnippets({ identity });
   const indentedJson = cursorJson.split("\n").map((line) => `     ${line}`).join("\n");
   return [
     "",
@@ -19,7 +30,8 @@ export function formatConnect(opts: ConnectOpts = {}): string {
     "",
     "━━ 1. Paste the config ━━",
     "",
-    "  Claude Code:",
+    "  Claude Code (the `remove` clears any prior entry so re-runs don't error):",
+    "     $ claude mcp remove krimto 2>/dev/null; true",
     `     $ ${claude}`,
     "",
     "  Cursor (add to ~/.cursor/mcp.json, then restart Cursor):",
@@ -61,3 +73,22 @@ export function formatConnect(opts: ConnectOpts = {}): string {
     "",
   ].join("\n");
 }
+
+/**
+ * Local copy of init.ts's git-config lookup, scoped to the connect command. We don't import
+ * `defaultIdentity` directly from init.ts to keep `connect` cheap (init.ts pulls in
+ * `applyRule`, service installer, MCP writer, etc.). Same regex; same fallback.
+ */
+async function defaultIdentityForConnect(): Promise<string> {
+  try {
+    const { execFile } = await import("node:child_process");
+    const { promisify } = await import("node:util");
+    const exec = promisify(execFile);
+    const { stdout } = await exec("git", ["config", "--global", "user.email"]);
+    const email = stdout.trim();
+    if (email && /^[^@\s]+@[^@\s]+$/.test(email)) return email;
+  } catch {
+    /* git missing or unconfigured — fall through to the legacy placeholder */
+  }
+  return "you@acme.com";
+}

package/src/cli/deleteFact.ts

@@ -35,6 +35,7 @@ async function checkLock(dataDir: string): Promise<LockInfo | null> {
         pid: parsed.pid,
         started: typeof parsed.started === "string" ? parsed.started : "unknown",
         mode: (parsed.mode as LockInfo["mode"]) ?? "stdio",
+        launchedBy: parsed.launchedBy === "service" ? "service" : "ad-hoc",
       };
     }
   } catch {

package/src/cli/help.ts

@@ -37,6 +37,10 @@ export function formatHelp(version: string): string {
     "    rm <id>            Delete a fact (file + index + git deletion commit)",
     "    reindex            Rebuild index.db from markdown (fixes manual-delete orphans)",
     "",
+    "  Identity:",
+    "    whoami             Show which email Krimto is using (and where it's set)",
+    "    set identity <e>   Change the identity used for new fact writes",
+    "",
     "  Diagnose:",
     "    verify-connection  Is my agent actually calling Krimto? (live status + last 5 calls)",
     "    setup-remote <url> Wire data dir to a git remote, verify the push works",

package/src/cli/init.ts

@@ -435,26 +435,40 @@ export async function detectExistingSetup(
   let searchProvider: SearchProvider = "keyword";
 
   for (const env of envs) {
-    if (env.mcpWire?.method !== "json") continue;
-    let text: string;
-    try {
-      text = await fs.readFile(env.mcpWire.path, "utf8");
-    } catch {
+    if (env.mcpWire === null) continue;
+
+    if (env.mcpWire.method === "json") {
+      let text: string;
+      try {
+        text = await fs.readFile(env.mcpWire.path, "utf8");
+      } catch {
+        continue;
+      }
+      let parsed: Record<string, unknown>;
+      try {
+        parsed = JSON.parse(text) as Record<string, unknown>;
+      } catch {
+        continue;
+      }
+      const servers = parsed[env.mcpWire.key] as Record<string, unknown> | undefined;
+      if (!servers || !("krimto" in servers)) continue;
+      registeredEditors.push(env.editor);
+      const krimto = servers.krimto as { env?: Record<string, string> };
+      if (krimto.env?.KRIMTO_EMBED_PROVIDER === "openai") {
+        searchProvider = "openai";
+      }
       continue;
     }
-    let parsed: Record<string, unknown>;
-    try {
-      parsed = JSON.parse(text) as Record<string, unknown>;
-    } catch {
+
+    // v0.2.26 — Gap-3 root-cause fix. Claude Code uses `claude mcp` CLI; the registration
+    // doesn't live in a JSON file we scan. Without this branch every read-side surface
+    // (reconfigure menu, status, reset, whoami) was invisibly mis-reporting "Cursor only"
+    // even after the wizard had successfully wired both Cursor AND Claude Code.
+    if (env.mcpWire.method === "cli") {
+      const present = await isClaudeMcpRegistered(env.mcpWire.command);
+      if (present) registeredEditors.push(env.editor);
       continue;
     }
-    const servers = parsed[env.mcpWire.key] as Record<string, unknown> | undefined;
-    if (!servers || !("krimto" in servers)) continue;
-    registeredEditors.push(env.editor);
-    const krimto = servers.krimto as { env?: Record<string, string> };
-    if (krimto.env?.KRIMTO_EMBED_PROVIDER === "openai") {
-      searchProvider = "openai";
-    }
   }
 
   const service = await isServiceInstalled(undefined, homeDir);
@@ -468,6 +482,21 @@ export async function detectExistingSetup(
   };
 }
 
+/**
+ * Check whether `claude mcp list` knows about krimto. Best-effort: any error (CLI missing,
+ * timeout, parse failure) returns false rather than blocking the caller. The output format
+ * is one server per line, "<name>:<space><url-or-spec>" — we just look for "krimto:" with a
+ * non-failing line, which covers both stdio (`krimto: npx -y ...`) and HTTP (`krimto: http://...`).
+ */
+async function isClaudeMcpRegistered(claudeBinary: string): Promise<boolean> {
+  try {
+    const { stdout } = await exec(claudeBinary, ["mcp", "list"], { timeout: 8000 });
+    return /^krimto:\s/m.test(stdout);
+  } catch {
+    return false;
+  }
+}
+
 // === Legacy runInit (v0.2.16, kept for --all / --minimal back-compat) ======
 
 export interface RunInitOptions {

package/src/cli/inspectRuntime.ts

@@ -0,0 +1,146 @@
+// v0.2.26 — single reconciled view of "what is Krimto doing right now". Replaces the prior
+// ad-hoc detection scattered across status.ts, verifyConnection.ts, whoami.ts, and the
+// wizard's reconfigure menu, which disagreed in the smoke-6 transcript audit:
+//   • Cursor mcp.json had krimto, Claude Code's `claude mcp` had krimto, launchctl showed
+//     the service loaded — but reconfigure menu said "Editors: Cursor", verify-connection
+//     said "Launched by: ad-hoc", and reset said "No changes made".
+//
+// `inspectRuntime` reads every source we care about and reconciles them. Downstream
+// commands consume one consistent view instead of running their own subset of checks.
+
+import { promises as fs } from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+
+import { isProcessAlive, type LaunchedBy, type LockInfo, type LockMode } from "../server/lock";
+import {
+  detectEditorEnvironments,
+  detectExistingSetup,
+  type EditorKind,
+  type RunMode,
+  type SearchProvider,
+  type SetupSnapshot,
+} from "./init";
+import { probeServiceState } from "./service";
+
+export interface RuntimeLock {
+  pid: number;
+  started: string;
+  mode: LockMode;
+  /**
+   * The lock file's own `launchedBy` value. Pre-v0.2.25 processes didn't write this field,
+   * so we default to "ad-hoc". The reconciled answer (correct even for pre-v0.2.25 runs)
+   * is in {@link RuntimeState.effectiveLaunchedBy}.
+   */
+  launchedBy: LaunchedBy;
+  alive: boolean;
+}
+
+export interface RuntimeService {
+  installed: boolean;
+  loaded: boolean;
+  runningPid: number | null;
+  unitPath: string | undefined;
+}
+
+export interface RuntimeState {
+  /** Lock file state (parsed + alive-check), or null when no readable lock. */
+  lock: RuntimeLock | null;
+  /** Cross-platform service probe (unit-on-disk + actually-loaded + running PID). */
+  service: RuntimeService;
+  /**
+   * Reconciled launch source. Trusts launchctl/systemctl over the lock file: if the
+   * running PID matches the service's `runningPid`, the process IS service-launched,
+   * even when the lock file lacks the `launchedBy` field (pre-v0.2.25 runs).
+   */
+  effectiveLaunchedBy: LaunchedBy | null;
+  /** Snapshot from detectExistingSetup (registered editors, run mode, search provider). */
+  snapshot: SetupSnapshot;
+  /** Detected editor environments (all 4, with present/installed flags). */
+  editors: Awaited<ReturnType<typeof detectEditorEnvironments>>;
+  /** Editors registered with Krimto right now. Same as snapshot.registeredEditors. */
+  registeredEditors: EditorKind[];
+  /** Convenience: the configured run mode (always-running iff a service unit exists). */
+  runMode: RunMode;
+  /** Convenience: the configured search provider. */
+  searchProvider: SearchProvider;
+}
+
+export interface InspectOptions {
+  cwd?: string;
+  homeDir?: string;
+}
+
+/**
+ * Build a single, reconciled {@link RuntimeState}. Cheap enough to call from every read-side
+ * command (one fs read for lock, one launchctl/systemctl print, one `claude mcp list`, one
+ * pass over editor MCP configs).
+ */
+export async function inspectRuntime(dataDir: string, opts: InspectOptions = {}): Promise<RuntimeState> {
+  const cwd = opts.cwd ?? process.cwd();
+  const homeDir = opts.homeDir ?? os.homedir();
+
+  const lock = await readLock(dataDir);
+  const snapshot = await detectExistingSetup(cwd, homeDir);
+  const editors = await detectEditorEnvironments(cwd, homeDir);
+  const service = await probeServiceState(undefined, homeDir);
+
+  // The reconciliation step. Two signals:
+  //   1. The lock file's self-reported launchedBy (pre-v0.2.25 runs default to "ad-hoc").
+  //   2. Whether the running PID matches launchd's program-PID.
+  // If (2) says yes, we know the process was service-launched regardless of what (1) claims.
+  let effectiveLaunchedBy: LaunchedBy | null = null;
+  if (lock && lock.alive) {
+    if (service.loaded && service.runningPid === lock.pid) {
+      effectiveLaunchedBy = "service";
+    } else {
+      effectiveLaunchedBy = lock.launchedBy;
+    }
+  }
+
+  return {
+    lock,
+    service: {
+      installed: service.unitPresent,
+      loaded: service.loaded,
+      runningPid: service.runningPid,
+      unitPath: undefined, // service.ts's isServiceInstalled returns this; we don't surface it in v0.2.26
+    },
+    effectiveLaunchedBy,
+    snapshot,
+    editors,
+    registeredEditors: snapshot.registeredEditors,
+    runMode: snapshot.runMode,
+    searchProvider: snapshot.searchProvider,
+  };
+}
+
+async function readLock(dataDir: string): Promise<RuntimeLock | null> {
+  const file = path.join(dataDir, ".krimto", "lock.json");
+  let raw: string;
+  try {
+    raw = await fs.readFile(file, "utf8");
+  } catch {
+    return null;
+  }
+  let parsed: Partial<LockInfo>;
+  try {
+    parsed = JSON.parse(raw) as Partial<LockInfo>;
+  } catch {
+    return null;
+  }
+  if (
+    typeof parsed.pid !== "number" ||
+    typeof parsed.started !== "string" ||
+    (parsed.mode !== "stdio" && parsed.mode !== "http")
+  ) {
+    return null;
+  }
+  return {
+    pid: parsed.pid,
+    started: parsed.started,
+    mode: parsed.mode,
+    launchedBy: parsed.launchedBy === "service" ? "service" : "ad-hoc",
+    alive: isProcessAlive(parsed.pid),
+  };
+}

package/src/cli/reindex.ts

@@ -32,6 +32,7 @@ async function checkLock(dataDir: string): Promise<LockInfo | null> {
         pid: parsed.pid,
         started: typeof parsed.started === "string" ? parsed.started : "unknown",
         mode: (parsed.mode as LockInfo["mode"]) ?? "stdio",
+        launchedBy: parsed.launchedBy === "service" ? "service" : "ad-hoc",
       };
     }
   } catch {

package/src/cli/reset.ts

@@ -20,17 +20,12 @@ import * as path from "node:path";
 import { removeRule } from "../agentRule";
 import {
   detectEditorEnvironments,
-  detectExistingSetup,
   type EditorEnvironment,
   type EditorKind,
 } from "./init";
 import { removeMcpConfig } from "./mcpConfig";
 import { defaultIO, isExitPrompt, type WizardIO } from "./promptHelpers";
-import {
-  detectPlatform,
-  isServiceInstalled,
-  uninstallService,
-} from "./service";
+import { detectPlatform, uninstallService } from "./service";
 
 const EDITOR_LABEL: Record<EditorKind, string> = {
   cursor: "Cursor",
@@ -65,33 +60,52 @@ export async function applyReset(opts: ResetOptions = {}): Promise<ResetResult>
   const homeDir = opts.homeDir;
   const dataDir = opts.dataDir ?? path.join(homeDir ?? "", ".krimto");
 
-  // 1. Disconnect every detected editor.
+  // v0.2.26 — reset is now "always sweep, never trust detection". The smoke-6 transcript
+  // caught reset reporting "No changes made" while a service was actually loaded and
+  // Cursor's mcp.json still had a krimto entry: detection was wrong (Claude Code was
+  // invisible to CLI-method scans), so reset's gated-by-detection cleanup ran nothing.
+  // Now every cleanup path runs best-effort regardless of what detection thinks. We can
+  // distinguish "ran but found nothing" from "intentionally skipped" by inspecting the
+  // result type — `editorsDisconnected` only includes editors whose removeMcpConfig
+  // returned removed=true, so an empty list still means "nothing to remove" cleanly.
+
   const envs = await detectEditorEnvironments(cwd, homeDir);
-  const snapshot = await detectExistingSetup(cwd, homeDir);
+
+  // 1. Try to disconnect every editor we know about, regardless of what detection says.
+  //    removeMcpConfig is already idempotent — it returns removed=false if there was nothing
+  //    to remove, so blanket-running it is safe.
   const editorsDisconnected: EditorKind[] = [];
   for (const env of envs) {
-    if (!snapshot.registeredEditors.includes(env.editor)) continue;
     const res = await removeMcpConfig(env);
     if (res.removed) editorsDisconnected.push(env.editor);
   }
 
-  // 2. Strip the standing rule from each detected rule file in CWD.
+  // 2. Strip the standing rule from each detected rule file in CWD (already idempotent).
   const rulesStripped: string[] = [];
   for (const env of envs) {
     const stripped = await stripRule(cwd, env);
     if (stripped) rulesStripped.push(env.rulesPath);
   }
 
-  // 3. Uninstall the background service if installed.
+  // 3. Uninstall the background service ALWAYS (even if isServiceInstalled said no). The
+  //    inner uninstall is best-effort: the platform CLI errors when nothing's loaded, but
+  //    we swallow them. This catches the case where a stale plist exists without an active
+  //    launchctl entry (or vice versa) — both halves get cleaned in one pass.
   const platform = detectPlatform();
-  const current = await isServiceInstalled(platform, homeDir);
   let serviceRemoved = false;
-  if (current.installed) {
+  try {
     const res = await uninstallService({ dryRun: opts.dryRun, platform, homeDir });
     serviceRemoved = res.removed;
+  } catch {
+    /* uninstall path can throw on unsupported platforms or missing CLIs — we're sweeping, not validating */
   }
 
-  // 4. Wipe the keys store (best-effort — file may not exist).
+  // 4. Kill any live ad-hoc Krimto process holding the lock — otherwise a `krimto serve`
+  //    that's still running keeps the data dir busy and the next init will conflict on the
+  //    lock. Best-effort: SIGTERM, give it 500ms, SIGKILL if still alive.
+  await terminateLockHolder(dataDir);
+
+  // 5. Wipe the keys store (best-effort — file may not exist).
   const keysPath = path.join(dataDir, ".krimto", "keys.json");
   let keysWiped = false;
   try {
@@ -101,6 +115,15 @@ export async function applyReset(opts: ResetOptions = {}): Promise<ResetResult>
     /* no keys file — fine */
   }
 
+  // 6. Wipe the lock file itself so the next init starts from a known-clean slate. Without
+  //    this, a stale lock from a process we just killed can confuse subsequent commands.
+  const lockPath = path.join(dataDir, ".krimto", "lock.json");
+  try {
+    await fs.unlink(lockPath);
+  } catch {
+    /* no lock — fine */
+  }
+
   // 5. Optionally move the data dir to a timestamped trash sibling.
   let notesTrashedTo: string | undefined;
   if (opts.wipeNotes) {
@@ -177,6 +200,37 @@ export async function runReset(opts: ResetOptions = {}): Promise<ResetResult | n
   }
 }
 
+/**
+ * If the lock file points at a live PID, send SIGTERM then SIGKILL (after 500ms). Best-effort;
+ * we don't return the outcome because reset's contract is "do the cleanup, don't validate".
+ * v0.2.26 — without this step, a leftover `krimto serve` PID survived `reset` and the next
+ * init would either reuse the dead lock OR conflict on the live port (whichever came first).
+ */
+async function terminateLockHolder(dataDir: string): Promise<void> {
+  const lockPath = path.join(dataDir, ".krimto", "lock.json");
+  let pid: number | null = null;
+  try {
+    const raw = await fs.readFile(lockPath, "utf8");
+    const parsed = JSON.parse(raw) as { pid?: unknown };
+    if (typeof parsed.pid === "number" && parsed.pid > 0) pid = parsed.pid;
+  } catch {
+    return; // no lock — nothing to terminate
+  }
+  if (pid === null) return;
+  try {
+    process.kill(pid, "SIGTERM");
+  } catch {
+    return; // already gone
+  }
+  await new Promise((resolve) => setTimeout(resolve, 500));
+  try {
+    process.kill(pid, 0); // existence probe
+    process.kill(pid, "SIGKILL");
+  } catch {
+    /* exited cleanly on SIGTERM */
+  }
+}
+
 async function stripRule(cwd: string, env: EditorEnvironment): Promise<boolean> {
   const rulePath = path.join(cwd, env.rulesPath);
   let existing: string;