@vincemakes/kiso-code 0.33.0 → 0.36.0

package/dist/auth/adapter-options.d.ts

@@ -0,0 +1,22 @@
+import type { ModelProfile } from "../config.js";
+/** The credential shape both call sites can produce: `authForProfile`'s
+ *  return value, and the startup path's already-narrowed `resolved`. */
+export type AdapterAuth = {
+    readonly type: "oauth";
+    readonly providerId: string;
+} | {
+    readonly type: "api-key";
+    readonly apiKey: string;
+};
+/** Exactly the runtime `buildAdapter` option set. */
+export interface AdapterOptions {
+    readonly apiKey?: string;
+    readonly baseUrl?: string;
+    readonly promptCaching?: boolean;
+    readonly oauth?: () => Promise<{
+        readonly access: string;
+        readonly accountId: string;
+    }>;
+    readonly promptCacheKey?: string;
+}
+export declare function adapterOptionsFor(profile: ModelProfile, auth: AdapterAuth, sessionId?: string): AdapterOptions;

package/dist/auth/adapter-options.js

@@ -0,0 +1,52 @@
+/**
+ * Astra F1 (P0) — THE ONE PLACE THE ADAPTER'S WIRE CONFIG IS BUILT.
+ *
+ * The P0's mechanism is a single sentence: the CLI hands the adapter an
+ * EXPLICIT endpoint, so the provider SDKs never read `ANTHROPIC_BASE_URL` /
+ * `OPENAI_BASE_URL` for themselves while `authForProfile` has already
+ * chosen the STORED VENDOR KEY for the vendor's own origin.
+ *
+ * That sentence had no home. It was a spread written out twice — at startup
+ * in index.ts and on the `/model` switch in dispatch.ts — which is F1's own
+ * defect class: one rule, two copies, and the copies drift. The first fix
+ * for this finding edited both copies. This gives the rule somewhere to
+ * live, and a test somewhere to point.
+ *
+ * The extraction found the two sites had ALREADY drifted:
+ *
+ *   - `promptCacheKey` was passed at startup whenever the session had an
+ *     id, but on `/model` only for an OAuth profile. It reaches the wire in
+ *     the openai-responses adapter alone (runtime resolveAdapter), where it
+ *     becomes `prompt_cache_key`. So a first-party Responses profile got a
+ *     cache key when you started with it and none when you switched to it —
+ *     the same session, two cache lanes, decided by how you arrived. The
+ *     startup rule is the one kept: the cache lane is the SESSION (OR-1).
+ *   - `streamIdleMs` is set at startup and not on `/model`. It is NOT an
+ *     adapter option — it is an agent-definition field the runtime reads —
+ *     so it is out of this function's scope and stays where it is, noted
+ *     here so the next reader does not think it was missed.
+ */
+import { effectiveBaseUrl } from "./credentials.js";
+import { oauthTokenThunk } from "./token.js";
+export function adapterOptionsFor(profile, auth, sessionId) {
+    // OR-1: exactly one sign-in shape reaches the adapter. An OAuth profile
+    // has no key to pass — it passes the thunk the adapter re-resolves per
+    // request instead. PH-1c (PH-F19): a keyless profile is an
+    // unauthenticated endpoint and its placeholder satisfies the SDK's ctor.
+    const credential = auth.type === "oauth" ? { oauth: oauthTokenThunk(auth.providerId) } : { apiKey: auth.apiKey };
+    // Astra F1 (P0): ALWAYS EXPLICIT. Passing nothing let the SDK read its
+    // own environment variable, and a profile with no baseUrl then sent the
+    // stored vendor key wherever that variable pointed.
+    const url = effectiveBaseUrl(profile.kind, profile.baseUrl);
+    return {
+        ...credential,
+        ...(url !== undefined ? { baseUrl: url } : {}),
+        // OR-1: the ChatGPT backend's cache lane is the SESSION — one
+        // conversation's requests share a key, different conversations never
+        // do. The one entry point with no session id is `kiso sessions`, a
+        // read-only listing that streams nothing, so its absence costs no
+        // cache.
+        ...(sessionId !== undefined ? { promptCacheKey: sessionId } : {}),
+        ...(profile.promptCaching !== undefined ? { promptCaching: profile.promptCaching } : {}),
+    };
+}

package/dist/auth/credentials.d.ts

@@ -23,6 +23,29 @@ export declare class AuthError extends Error {
 export declare const KNOWN_PROVIDERS: readonly string[];
 /** The providers whose sign-in is an OAuth flow rather than a key. */
 export declare const OAUTH_PROVIDERS: readonly string[];
+/**
+ * Astra F1 (P0) — THE ONE RESOLVED EFFECTIVE ENDPOINT.
+ *
+ * `providerIdOf` read an ABSENT `baseUrl` as the vendor's own endpoint and
+ * returned the vendor id, so `authForProfile` handed back the STORED vendor
+ * key. Correct in isolation. But the adapter factories passed `baseURL` to the
+ * SDK only when the profile NAMED one, and with none named the Anthropic and
+ * OpenAI SDKs read `ANTHROPIC_BASE_URL` / `OPENAI_BASE_URL` from the
+ * environment themselves — so the saved official key went to whatever the
+ * environment named.
+ *
+ * Two sides disagreed about what "no baseUrl" meant. THE FIX IS TO RESOLVE IT
+ * ONCE, here, and give both sides the same answer: the credential resolver
+ * decides which key may go, the adapter is handed an EXPLICIT url so the SDK
+ * never consults its environment.
+ *
+ * 0.32.2's R1 bound the explicit-URL path. This is the absent-URL path, which
+ * is the common configuration.
+ */
+export declare const VENDOR_DEFAULT: Readonly<Record<string, string>>;
+/** The endpoint a profile ACTUALLY talks to: its own, or the vendor's
+ *  default for its kind. Never the environment's — that is the defect. */
+export declare function effectiveBaseUrl(kind: string, baseUrl?: string): string | undefined;
 /** The provider identity a profile's credential is stored under, or null
  *  for an origin nobody recognizes (custom: env var only). */
 export declare function providerIdOf(kind: string, baseUrl?: string): string | null;

package/dist/auth/credentials.js

@@ -50,6 +50,35 @@ const CHATGPT_ORIGIN = "https://chatgpt.com";
  *  the dialect it speaks. */
 const ANTHROPIC_ORIGIN = "https://api.anthropic.com";
 const OPENAI_ORIGIN = "https://api.openai.com";
+/**
+ * Astra F1 (P0) — THE ONE RESOLVED EFFECTIVE ENDPOINT.
+ *
+ * `providerIdOf` read an ABSENT `baseUrl` as the vendor's own endpoint and
+ * returned the vendor id, so `authForProfile` handed back the STORED vendor
+ * key. Correct in isolation. But the adapter factories passed `baseURL` to the
+ * SDK only when the profile NAMED one, and with none named the Anthropic and
+ * OpenAI SDKs read `ANTHROPIC_BASE_URL` / `OPENAI_BASE_URL` from the
+ * environment themselves — so the saved official key went to whatever the
+ * environment named.
+ *
+ * Two sides disagreed about what "no baseUrl" meant. THE FIX IS TO RESOLVE IT
+ * ONCE, here, and give both sides the same answer: the credential resolver
+ * decides which key may go, the adapter is handed an EXPLICIT url so the SDK
+ * never consults its environment.
+ *
+ * 0.32.2's R1 bound the explicit-URL path. This is the absent-URL path, which
+ * is the common configuration.
+ */
+export const VENDOR_DEFAULT = {
+    anthropic: ANTHROPIC_ORIGIN,
+    "openai-compat": `${OPENAI_ORIGIN}/v1`,
+    "openai-responses": `${OPENAI_ORIGIN}/v1`,
+};
+/** The endpoint a profile ACTUALLY talks to: its own, or the vendor's
+ *  default for its kind. Never the environment's — that is the defect. */
+export function effectiveBaseUrl(kind, baseUrl) {
+    return baseUrl ?? VENDOR_DEFAULT[kind];
+}
 /** The provider identity a profile's credential is stored under, or null
  *  for an origin nobody recognizes (custom: env var only). */
 export function providerIdOf(kind, baseUrl) {
@@ -74,23 +103,24 @@ export function providerIdOf(kind, baseUrl) {
     // The compat kind was already right — an unrecognized origin resolves
     // to null and the env var pays — so this makes the other two agree with
     // the one that had the rule.
-    const origin = originOf(baseUrl);
-    if (kind === "anthropic") {
-        if (baseUrl === undefined)
-            return "anthropic"; // the vendor's own default endpoint
+    //
+    // Astra F1: THE SAME RESOLVER THE ADAPTER USES. An absent baseUrl used to
+    // be a special case here — three `if (baseUrl === undefined) return "<the
+    // vendor>"` branches — and a DIFFERENT special case at the adapter, where
+    // it meant "let the SDK read the environment". Two copies of one rule is
+    // how the two sides came to disagree. Resolved once, this function is left
+    // with the single question it exists to ask: does that origin belong to
+    // the vendor?
+    const origin = originOf(effectiveBaseUrl(kind, baseUrl));
+    if (kind === "anthropic")
         return origin === ANTHROPIC_ORIGIN ? "anthropic" : null;
-    }
     if (kind === "openai-responses") {
-        if (baseUrl === undefined)
-            return "openai"; // the vendor's own default endpoint
         if (origin === CHATGPT_ORIGIN)
             return "chatgpt";
         return origin === OPENAI_ORIGIN ? "openai" : null;
     }
     if (kind !== "openai-compat")
         return null;
-    if (baseUrl === undefined)
-        return "openai";
     return origin === null ? null : (ORIGIN_TO_PROVIDER[origin] ?? null);
 }
 function originOf(baseUrl) {

package/dist/builtin.d.ts

@@ -5,4 +5,9 @@ export declare function builtInLayer(user: readonly KisoExtension[], project: re
  *  bridge exists (an interactive TTY). No bridge, no fourth built-in:
  *  a headless session never pays the rent for a question nobody could
  *  answer, and its tool table cannot mention ask_user. */
-ask?: AskUI): Promise<readonly KisoExtension[]>;
+ask?: AskUI, 
+/** Astra F7: the env-var NAMES the configured profiles authenticate with.
+ *  The mcp extension spawns its stdio children while it is being
+ *  constructed, so the names have to arrive here — after construction is
+ *  too late. Only the config knows them; nothing else can. */
+secretEnvNames?: readonly string[]): Promise<readonly KisoExtension[]>;

package/dist/builtin.js

@@ -30,8 +30,13 @@ export async function builtInLayer(user, project,
  *  bridge exists (an interactive TTY). No bridge, no fourth built-in:
  *  a headless session never pays the rent for a question nobody could
  *  answer, and its tool table cannot mention ask_user. */
-ask) {
-    const all = await Promise.all([createMcp(), createSkills(), createSubagent(), ...(ask === undefined ? [] : [createAsk(ask)])]);
+ask, 
+/** Astra F7: the env-var NAMES the configured profiles authenticate with.
+ *  The mcp extension spawns its stdio children while it is being
+ *  constructed, so the names have to arrive here — after construction is
+ *  too late. Only the config knows them; nothing else can. */
+secretEnvNames = []) {
+    const all = await Promise.all([createMcp({ secretEnvNames }), createSkills(), createSubagent(), ...(ask === undefined ? [] : [createAsk(ask)])]);
     const shadowed = all.filter((b) => user.some((u) => u.name === b.name));
     for (const s of shadowed) {
         console.error(`[extensions] user extension "${s.name}" shadows the built-in — the built-in is not loaded`);

package/dist/chat.js

@@ -148,8 +148,18 @@ endpoint) {
     // backend's own words and keeps its 0 — the display's rule, not the
     // record's.
     const unobservable = model !== undefined && lookupModelMetadata(model, endpoint)?.capabilities.promptCaching === "unobservable";
+    // DF-0322-F2: the DISPLAY is handed the provider's own word, not the
+    // canonical one. `canonicalizeUsage` sets `cacheRead ?? 0` because
+    // accounting has to sum numbers — correct there, and pinned that way by
+    // the gate — but it erases the difference between "the backend answered
+    // zero" and "the backend said nothing about caching". Handing the row the
+    // canonical zero made it claim a measurement that never happened, which
+    // is the family OR-10 and DF-0311-F1 belong to. OR-10's own comment drew
+    // this line first: the ledger keeps the backend's 0, the display's rule
+    // is not the record's.
+    const reportedCache = ev.cacheRead === null ? null : c.cacheRead;
     return {
-        usage: { in: c.input, out: c.output, cache: unobservable ? null : c.cacheRead, known: ev.known },
+        usage: { in: c.input, out: c.output, cache: unobservable ? null : reportedCache, known: ev.known },
         total,
         missed: unobservable ? null : missed,
         costUsd: c.costUsd,

package/dist/config.js

@@ -296,31 +296,53 @@ export function resolveModel(modelFlag, merged) {
         return resolveProfile(modelFlag, p);
     }
     // env beats config: a key in the environment names the provider.
+    //
+    // Astra F2: the credential goes through authForProfile like every other
+    // route. This returned process.env.OPENAI_API_KEY directly, so the two
+    // ways into the same adapter disagreed about which key a profile uses.
+    // The safety property held by accident — the env key is not the stored
+    // one — and an accident is not a rule. Now: the stored key at the
+    // vendor's origin, the env key at a custom one, and a stored vendor key
+    // is never forwarded to a custom environment URL.
+    //
+    // The env var is folded into the profile EXPLICITLY, so the resolved
+    // endpoint is the profile's and the SDK never reads it again (F1).
     if (process.env.OPENAI_API_KEY !== undefined) {
-        return {
-            name: process.env.OPENAI_MODEL ?? "gpt-4o",
-            profile: {
-                kind: "openai-compat",
-                model: process.env.OPENAI_MODEL ?? "gpt-4o",
-                ...(process.env.OPENAI_BASE_URL !== undefined ? { baseUrl: process.env.OPENAI_BASE_URL } : {}),
-                apiKeyEnv: "OPENAI_API_KEY",
-            },
-            apiKey: process.env.OPENAI_API_KEY,
+        const profile = {
+            kind: "openai-compat",
+            model: process.env.OPENAI_MODEL ?? "gpt-4o",
+            ...(process.env.OPENAI_BASE_URL !== undefined ? { baseUrl: process.env.OPENAI_BASE_URL } : {}),
+            apiKeyEnv: "OPENAI_API_KEY",
         };
+        const auth = authForProfile(process.env.OPENAI_MODEL ?? "gpt-4o", profile);
+        // The same total shape the config route returns (resolveProfile).
+        // The `oauth` arm is unreachable from HERE — authForProfile returns
+        // oauth only for an openai-responses profile and this route builds
+        // an openai-compat one — but writing the union out beats a fallback
+        // to the raw env var, which is the very disagreement F2 removes.
+        return auth.type === "oauth"
+            ? { name: process.env.OPENAI_MODEL ?? "gpt-4o", profile, oauthProviderId: auth.providerId }
+            : { name: process.env.OPENAI_MODEL ?? "gpt-4o", profile, apiKey: auth.apiKey };
     }
     if (process.env.ANTHROPIC_API_KEY !== undefined) {
-        return {
-            name: process.env.ANTHROPIC_MODEL ?? "claude-sonnet-5",
-            profile: {
-                kind: "anthropic",
-                model: process.env.ANTHROPIC_MODEL ?? "claude-sonnet-5",
-                apiKeyEnv: "ANTHROPIC_API_KEY",
-                // PH-1c (finding PH-F19): symmetric with OPENAI_BASE_URL —
-                // proxies and compat gateways serve the anthropic dialect too.
-                ...(process.env.ANTHROPIC_BASE_URL !== undefined ? { baseUrl: process.env.ANTHROPIC_BASE_URL } : {}),
-            },
-            apiKey: process.env.ANTHROPIC_API_KEY,
+        // Astra F2, the sibling. Same rule, same reason.
+        const profile = {
+            kind: "anthropic",
+            model: process.env.ANTHROPIC_MODEL ?? "claude-sonnet-5",
+            apiKeyEnv: "ANTHROPIC_API_KEY",
+            // PH-1c (finding PH-F19): symmetric with OPENAI_BASE_URL —
+            // proxies and compat gateways serve the anthropic dialect too.
+            ...(process.env.ANTHROPIC_BASE_URL !== undefined ? { baseUrl: process.env.ANTHROPIC_BASE_URL } : {}),
         };
+        const auth = authForProfile(process.env.ANTHROPIC_MODEL ?? "claude-sonnet-5", profile);
+        // The same total shape the config route returns (resolveProfile).
+        // The `oauth` arm is unreachable from HERE — authForProfile returns
+        // oauth only for an openai-responses profile and this route builds
+        // an anthropic one — but writing the union out beats a fallback
+        // to the raw env var, which is the very disagreement F2 removes.
+        return auth.type === "oauth"
+            ? { name: process.env.ANTHROPIC_MODEL ?? "claude-sonnet-5", profile, oauthProviderId: auth.providerId }
+            : { name: process.env.ANTHROPIC_MODEL ?? "claude-sonnet-5", profile, apiKey: auth.apiKey };
     }
     // config (project wins over user) names a model; default is faux.
     const configured = merged.model;

package/dist/dispatch.js

@@ -9,6 +9,7 @@ import { buildAdapter, lookupModelMetadata, resolveContinuationScope, resolveRea
 import { MODES, MODE_NOTE, getMode, setMode } from "./mode.js";
 import { clipboardWrite, lastAnswer } from "./clipboard.js";
 import { agentModel, body, bodyLog, codingToolOptions, kisoHome, configModels, dock, lastBinding, readContextLedger, sessionsDir, setAgentModel, setCurrentModelName, setModelChoice, setLastBinding } from "./state.js";
+import { adapterOptionsFor } from "./auth/adapter-options.js";
 import { authForProfile, directWriteProfile, profileAvailable, unavailableReason } from "./config.js";
 import { shellTool } from "@vincemakes/kiso-tools-node";
 import { join } from "node:path";
@@ -74,7 +75,6 @@ function signInNote(p) {
     }
     return p.apiKeyEnv ?? "no key";
 }
-import { oauthTokenThunk } from "./auth/token.js";
 /** The ONE dispatcher — slash commands, exit, and turns. The recovery
  *  replay routes through it too — a queued "/last" must never become a
  *  user turn (v2c: the rl lives in main, so lines arrive earlier and the
@@ -601,18 +601,11 @@ export function dispatch(line, ctx) {
                     }
                     else {
                         const auth = authForProfile(profName, profile);
-                        const adapter = await buildAdapter(profile.kind, {
-                            // PH-1c (PH-F19): a keyless profile = an unauthenticated
-                            // endpoint — the placeholder satisfies the SDK's ctor.
-                            // OR-1: an OAuth profile passes a token thunk instead
-                            // — there is no key, and the adapter re-resolves the
-                            // token per request.
-                            ...(auth.type === "oauth"
-                                ? { oauth: oauthTokenThunk(auth.providerId), ...(ctx.session.id !== undefined ? { promptCacheKey: ctx.session.id } : {}) }
-                                : { apiKey: auth.apiKey }),
-                            ...(profile.baseUrl !== undefined ? { baseUrl: profile.baseUrl } : {}),
-                            ...(profile.promptCaching !== undefined ? { promptCaching: profile.promptCaching } : {}),
-                        });
+                        // Astra F1 (P0): the wire config is built in ONE place
+                        // (auth/adapter-options.ts) — this site and the startup
+                        // site were the same spread written twice, which is the
+                        // finding's own defect class.
+                        const adapter = await buildAdapter(profile.kind, adapterOptionsFor(profile, auth, ctx.session.id));
                         // PH-1a (finding PH-F8, P0): the switch is ATOMIC —
                         // adapter, model id, and provider route move together.
                         // setAdapter alone left the session's frozen config

package/dist/index.d.ts

@@ -31,7 +31,7 @@ export { applyProjectMerges } from "./trust-ui.js";
  */
 /** The built-in prompt. Exported for scripts/request-surface.mjs — the
  *  model-side token-rent counter measures the REAL bytes, never a copy. */
-export declare const SYSTEM_PROMPT = "You are kiso, a coding agent. You work in a workspace\ndirectory and change code with tools. Be concise: answer in a few lines\nunless the task genuinely needs more. Never claim a file was changed\nunless a tool confirmed it.\n\nTool discipline:\n- READ BEFORE YOU EDIT. For any file you are about to change, read it\n  first \u2014 never guess its content.\n- Use edit_file for targeted changes and write_file for full rewrites.\n  Prefer many small edits over one large write.\n- shell is for commands: builds, tests, git, grep. Be careful \u2014 shell has\n  side effects and may take time. Run one command at a time and inspect\n  the output before continuing.\n- Batch independent tool calls into one reply \u2014 they run in parallel.\n- search_text and list_dir are cheap \u2014 locate first, then read ranges\n  with read_file offset/limit; never read a whole large file in one call.\n- Do not re-read a file you already read unchanged \u2014 rely on the earlier\n  result.\n- When a tool fails, read the error and adjust; do not repeat the same\n  call blindly.\n\nWorkflow: understand the request, find the relevant code, make the\nsmallest change that works, then verify with a command (tests/build).\nReport what you did in one or two lines per change.";
+export declare const SYSTEM_PROMPT = "You are kiso, a coding agent. You work in a workspace\ndirectory and change code with tools. Be concise: answer in a few lines\nunless the task genuinely needs more. Never claim a file was changed\nunless a tool confirmed it.\n\nWhat you can reach:\n- The workspace: read_file, list_dir, search_text, write_file, edit_file.\n- This machine and the network: shell \u2014 builds, tests, git, package\n  managers, curl for HTTP, system queries. A request one command can\n  answer is answered by running it.\n- The human: ask_user, for a decision that is theirs.\n\nTool discipline:\n- READ BEFORE YOU EDIT. For any file you are about to change, read it\n  first \u2014 never guess its content.\n- Use edit_file for targeted changes and write_file for full rewrites.\n  Prefer many small edits over one large write.\n- shell is for commands: builds, tests, git, grep. Be careful \u2014 shell has\n  side effects and may take time. Run one command at a time and inspect\n  the output before continuing.\n- Batch independent tool calls into one reply \u2014 they run in parallel.\n- search_text and list_dir are cheap \u2014 locate first, then read ranges\n  with read_file offset/limit; never read a whole large file in one call.\n- Do not re-read a file you already read unchanged \u2014 rely on the earlier\n  result.\n- When a tool fails, read the error and adjust; do not repeat the same\n  call blindly.\n\nAn authorization covers what it NAMES: when the scope is not named \u2014\nwhich files, which branches, whether to push \u2014 ask before acting.\nDelivering, sharing or handing over changes means committing locally and\nstopping; pushing, publishing or sending happens only when the human\nnames it.\n\nWorkflow: understand the request, find the relevant code, make the\nsmallest change that works, then verify with a command (tests/build).\nReport what you did in one or two lines per change.";
 /** Hard cap for injected instructions — truncate and say so. */
 /**
  * A area: read the FIRST present instruction file (AGENTS.md preferred) and

package/dist/index.js

@@ -37,13 +37,13 @@ import { createCodingTools } from "@vincemakes/kiso-tools-node";
 import { MODES, getMode, modeExtensions, modeFromEnv, modeSystemPrompt, setMode } from "./mode.js";
 import { breakerExtension } from "./breaker.js";
 import { builtInLayer } from "./builtin.js";
-import { agentModel, atFiles, body, bodyLog, codingToolOptions, kisoHome, builtInExtensions, currentFaux, dock, extensionsDir, loadedExtensions, mergedConfig, mergedTempPaths, modelChoice, projectExtensions, configModels, configuredWindow, agentBaseUrl, currentModelName, currentAgentExtensions, sessionStoreRef, sessionsDir, setAgentModel, setBody, setConfigModels, setConfiguredWindow, setCurrentAgentExtensions, setCurrentFaux, setCurrentModelName, setExtensionLists, setMergedConfig, setModelChoice, setSessionStore, userExtensions, VERSION, lastBinding, acceptDrift, setAcceptDrift } from "./state.js";
+import { agentModel, atFiles, body, bodyLog, codingToolOptions, kisoHome, builtInExtensions, currentFaux, dock, extensionsDir, loadedExtensions, mergedConfig, mergedTempPaths, modelChoice, projectExtensions, configModels, configuredWindow, agentBaseUrl, currentModelName, currentAgentExtensions, sessionStoreRef, sessionsDir, setAgentModel, setBody, setConfigModels, setConfiguredWindow, setCurrentAgentExtensions, setCurrentFaux, setCurrentModelName, setExtensionLists, setMergedConfig, setModelChoice, setSessionStore, secretEnvNamesOf, userExtensions, VERSION, lastBinding, acceptDrift, setAcceptDrift } from "./state.js";
 import { askUi, resolveProjectTrust } from "./trust-ui.js";
 import { isFirstRun, scaffoldFirstRun } from "./first-run.js";
 import { fauxSkip, readFauxScript } from "./faux-glue.js";
 import { chat, contextWindowTokens, displayCtxRatio, statusModelLabel } from "./chat.js";
+import { adapterOptionsFor } from "./auth/adapter-options.js";
 import { loadProjectConfig, loadUserConfig, mergeConfigs, resolveAutoCompact, resolveContextWindow, resolveModel } from "./config.js";
-import { oauthTokenThunk } from "./auth/token.js";
 import { checkForUpdate, knownUpdate, updateCardLines } from "./update-check.js";
 import { tmuxMouseHint } from "./tmux-hint.js";
 import { resume } from "./resume.js";
@@ -96,6 +96,47 @@ function streamIdleFromEnv() {
  *  OR-9 adds `update`: npm inherits the terminal for the install's own
  *  progress and prompts, so no editor may hold stdin while it runs. */
 const CREDENTIAL_COMMANDS = new Set(["login", "logout", "auth", "update"]);
+/**
+ * Astra F3 — A STORED CREDENTIAL IS NOT A SELECTED MODEL.
+ *
+ * `kiso login` exits 0, says the key is stored, and stops. With no profile
+ * the very next command still announces the demo and runs the scripted
+ * listing, so a person who has just signed in reasonably concludes that
+ * sign-in failed or is being ignored. Nothing was broken: a credential is
+ * stored under a PROVIDER, and a PROFILE is what selects the model that
+ * uses it. The gap was that nobody said so at the one moment it matters.
+ *
+ * These are onboarding EXAMPLES, not a resolution path — nothing here ever
+ * decides where a credential goes (that is `effectiveBaseUrl` and
+ * `providerIdOf`, and it stays there).
+ */
+const PROFILE_EXAMPLE = {
+    anthropic: '{"model":"claude","models":{"claude":{"kind":"anthropic","model":"claude-sonnet-5"}}}',
+    openai: '{"model":"gpt","models":{"gpt":{"kind":"openai-compat","model":"gpt-4o"}}}',
+    chatgpt: '{"model":"codex","models":{"codex":{"kind":"openai-responses","model":"gpt-5-codex","baseUrl":"https://chatgpt.com/backend-api/codex"}}}',
+    deepseek: '{"model":"deepseek","models":{"deepseek":{"kind":"openai-compat","model":"deepseek-flash","baseUrl":"https://api.deepseek.com"}}}',
+    zai: '{"model":"glm","models":{"glm":{"kind":"openai-compat","model":"glm-5.3-flash","baseUrl":"https://api.z.ai"}}}',
+};
+/** The line a fresh sign-in needs, or nothing when profiles already exist.
+ *  Read from the USER config alone: a credential command resolves no
+ *  project trust, and profiles live in the user's own file. */
+function nextStepAfterLogin(provider) {
+    let hasProfile = false;
+    try {
+        hasProfile = Object.keys(loadUserConfig()?.models ?? {}).length > 0;
+    }
+    catch {
+        // A config that cannot be read is its own loud error elsewhere; here
+        // it only means we cannot prove a profile exists, so we say the step.
+    }
+    if (hasProfile)
+        return "\nkiso already has profiles — `/model` in a session lists them and switches.\n";
+    const example = PROFILE_EXAMPLE[provider];
+    return (`\nThe key is stored, but nothing selects a model yet: a PROFILE does that,` +
+        ` and without one kiso stays in the keyless faux mode.\nPut one in ${join(kisoHome(), "config.json")}` +
+        (example === undefined ? ":\n" : `, for example:\n\n  ${example}\n`) +
+        `\nThen run kiso. \`/model\` lists your profiles and switches between them.\n`);
+}
 /** OR-9: the one install command the README gives, which `kiso update`
  *  runs and the failure message names. */
 const INSTALL_COMMAND = ["npm", "i", "-g", "@vincemakes/kiso-code@latest"];
@@ -539,6 +580,13 @@ directory and change code with tools. Be concise: answer in a few lines
 unless the task genuinely needs more. Never claim a file was changed
 unless a tool confirmed it.
 
+What you can reach:
+- The workspace: read_file, list_dir, search_text, write_file, edit_file.
+- This machine and the network: shell — builds, tests, git, package
+  managers, curl for HTTP, system queries. A request one command can
+  answer is answered by running it.
+- The human: ask_user, for a decision that is theirs.
+
 Tool discipline:
 - READ BEFORE YOU EDIT. For any file you are about to change, read it
   first — never guess its content.
@@ -555,6 +603,12 @@ Tool discipline:
 - When a tool fails, read the error and adjust; do not repeat the same
   call blindly.
 
+An authorization covers what it NAMES: when the scope is not named —
+which files, which branches, whether to push — ask before acting.
+Delivering, sharing or handing over changes means committing locally and
+stopping; pushing, publishing or sending happens only when the human
+names it.
+
 Workflow: understand the request, find the relevant code, make the
 smallest change that works, then verify with a command (tests/build).
 Report what you did in one or two lines per change.`;
@@ -664,16 +718,21 @@ async function makeAgent(sessionId, input, modelFlag) {
     // the panel bridge is the argument, and a non-TTY session has none to
     // give. A piped run's composed tool table therefore cannot contain
     // ask_user (T-Q3: the bench's structural byte-identity proof).
-    const builtIn = await builtInLayer(user, proj, input !== undefined && process.stdin.isTTY ? askUi(input) : undefined);
+    // Astra F7: the config is READ here — a pure read, its setters still run
+    // below with the rest of merge round B — because the mcp extension spawns
+    // its stdio children while it is being constructed, and the strip needs
+    // the configured secret names by then.
+    const userCfg = loadUserConfig();
+    const projectCfg = loadProjectConfig(process.cwd(), project !== null);
+    const merged = mergeConfigs(userCfg, projectCfg);
+    const secretEnvNames = secretEnvNamesOf(merged.models ?? {});
+    const builtIn = await builtInLayer(user, proj, input !== undefined && process.stdin.isTTY ? askUi(input) : undefined, secretEnvNames);
     setExtensionLists(builtIn, user, proj, [...builtIn, ...user, ...proj]);
     // merge round B — the config surface: user config + (trusted) project config,
     // resolved with flags > env > project > user > default. The CLI never
     // imports provider SDKs directly — the runtime's lazy provider
     // resolution owns them (a config profile only ever NAMES an env var for
     // its key; the key itself never sits in a config file).
-    const userCfg = loadUserConfig();
-    const projectCfg = loadProjectConfig(process.cwd(), project !== null);
-    const merged = mergeConfigs(userCfg, projectCfg);
     setMergedConfig(merged);
     // DT-1a: what a delegated task may NAME — the configured checks and the
     // model profiles — handed to the (in-process) subagent extension through
@@ -741,21 +800,18 @@ async function makeAgent(sessionId, input, modelFlag) {
         ...(resolved !== null
             ? {
                 provider: resolved.profile.kind,
-                // OR-1: exactly one sign-in shape reaches the adapter. An
-                // OAuth profile has no key to pass — it passes the thunk
-                // the adapter re-resolves per request instead.
-                ...(resolved.oauthProviderId !== undefined
-                    ? { oauth: oauthTokenThunk(resolved.oauthProviderId) }
-                    : { apiKey: resolved.apiKey ?? "none" }),
-                // OR-1: the ChatGPT backend's cache lane is the SESSION —
-                // one conversation's requests share a key, different
-                // conversations never do. The one entry point that hands
-                // no session id is `kiso sessions`, a read-only listing
-                // that streams nothing, so its absence costs no cache.
-                ...(sessionId !== undefined ? { promptCacheKey: sessionId } : {}),
-                ...(resolved.profile.baseUrl !== undefined ? { baseUrl: resolved.profile.baseUrl } : {}),
-                ...(resolved.profile.promptCaching !== undefined ? { promptCaching: resolved.profile.promptCaching } : {}),
-                // LT-1: the profile's stream watchdog bound, if it states one
+                // Astra F1 (P0): the wire config is built in ONE place
+                // (auth/adapter-options.ts) — credential shape, the ALWAYS
+                // EXPLICIT endpoint, the session's cache key and the
+                // profile's caching flag. This site and the `/model` site
+                // were the same spread written twice.
+                ...adapterOptionsFor(resolved.profile, resolved.oauthProviderId !== undefined
+                    ? { type: "oauth", providerId: resolved.oauthProviderId }
+                    : { type: "api-key", apiKey: resolved.apiKey ?? "none" }, sessionId),
+                // LT-1: the profile's stream watchdog bound, if it states one.
+                // NOT an adapter option — an agent-definition field the
+                // runtime reads — so it stays here rather than moving into
+                // adapterOptionsFor.
                 ...(resolved.profile.streamIdleMs !== undefined ? { streamIdleMs: resolved.profile.streamIdleMs } : {}),
             }
             : { adapter: createFauxProvider(readFauxScript().slice(fauxSkipTurns)) }),
@@ -1296,7 +1352,12 @@ async function main() {
     input.onClipboardPaste?.(() => {
         const shot = clipboardImage(tmpdir());
         if (shot === null) {
-            bodyLog("[no image on the clipboard — ctrl+V attaches one; a file dragged into the window works too]");
+            // Astra F8: on a platform with no clipboard reader kiso never
+            // LOOKED, so "no image on the clipboard" blamed the clipboard for
+            // a limit of the build. Say which of the two it is.
+            bodyLog(process.platform === "darwin"
+                ? "[no image on the clipboard — ctrl+V attaches one; a file dragged into the window works too]"
+                : "[clipboard images are macOS-only — put the image's path in your message instead; a file dragged into the window leaves one]");
             return null;
         }
         return shot;
@@ -1465,6 +1526,7 @@ async function main() {
                         });
                         setCredential(provider, cred);
                         process.stdout.write(`signed in to ${provider} (${chatgptFlow.label}) — account ${cred.accountId ?? "?"}, expires ${new Date(cred.expires).toISOString()} — stored in ${authPath()}\n`);
+                        process.stdout.write(nextStepAfterLogin(provider));
                     }
                     finally {
                         rl.close();
@@ -1476,6 +1538,7 @@ async function main() {
                     throw new CliUsageError(`kiso login ${provider}: no key given`);
                 setCredential(provider, { type: "api-key", key, savedAt: Date.now() });
                 process.stdout.write(`signed in to ${provider} with an API key (${maskSecret(key)}) — stored in ${authPath()}\n`);
+                process.stdout.write(nextStepAfterLogin(provider));
                 break;
             }
             case "update": {

package/dist/mode.d.ts

@@ -15,7 +15,16 @@ export declare const MODES: readonly Mode[];
 /** DC-36 — one line per tier, for the picker, TRANSCRIBED FROM decide()
  *  below rather than written fresh. A description that drifts from the
  *  behaviour is worse than none: this is the row a human reads before
- *  handing over the approval gate. */
+ *  handing over the approval gate.
+ *
+ *  Astra F4: these describe THE TIER'S CONTRIBUTION TO THE CHAIN, not the
+ *  chain's verdict. "every tool asks" read as a promise that manual is a
+ *  revocation — pick it and you are asked about everything again — and it
+ *  is not. A tier that ASKS abstains in favour of anything that ALLOWS, so
+ *  a saved don't-ask-again rule still allows, and the side effect runs with
+ *  no new question. The composition (deny > allow > ask) is the ruling and
+ *  is unchanged; the copy was the thing that was wrong. `plan` needs no
+ *  qualification because it DENIES, and a deny is what nothing overrides. */
 export declare const MODE_NOTE: Readonly<Record<Mode, string>>;
 export declare function getMode(): Mode;
 export declare function setMode(m: Mode): void;

package/dist/mode.js

@@ -13,13 +13,22 @@ export const MODES = ["manual", "default", "accept-edits", "plan", "bypass"];
 /** DC-36 — one line per tier, for the picker, TRANSCRIBED FROM decide()
  *  below rather than written fresh. A description that drifts from the
  *  behaviour is worse than none: this is the row a human reads before
- *  handing over the approval gate. */
+ *  handing over the approval gate.
+ *
+ *  Astra F4: these describe THE TIER'S CONTRIBUTION TO THE CHAIN, not the
+ *  chain's verdict. "every tool asks" read as a promise that manual is a
+ *  revocation — pick it and you are asked about everything again — and it
+ *  is not. A tier that ASKS abstains in favour of anything that ALLOWS, so
+ *  a saved don't-ask-again rule still allows, and the side effect runs with
+ *  no new question. The composition (deny > allow > ask) is the ruling and
+ *  is unchanged; the copy was the thing that was wrong. `plan` needs no
+ *  qualification because it DENIES, and a deny is what nothing overrides. */
 export const MODE_NOTE = {
-    manual: "every tool asks",
-    default: "reads run; writes, edits and shell ask",
-    "accept-edits": "reads, writes and edits run; shell asks",
-    plan: "reads run; everything else is denied — read-only",
-    bypass: "everything runs, nothing asks",
+    manual: "asks for every tool — a saved allow still allows",
+    default: "reads run; writes, edits and shell ask — a saved allow still allows",
+    "accept-edits": "reads, writes and edits run; shell asks — a saved allow still allows",
+    plan: "reads run; everything else is denied — read-only, and a deny wins",
+    bypass: "everything runs, nothing asks — a user deny still wins",
 };
 /** The read-only tool set (plan): reading is allowed, everything else
  *  denied with the guiding reason. */

package/dist/state.d.ts

@@ -16,9 +16,19 @@ export declare function kisoHome(): string;
  *  is decided. The session's own tool set and the `!` command's runner both
  *  need it, and two copies of a ruling-bearing literal is how a later DC-49
  *  amendment reaches one caller and not the other. */
+/**
+ * Astra F7 — every configured profile's `apiKeyEnv` NAME is a secret name.
+ * The strip's suffix rules cannot see `REVIEW_PROVIDER_TOKEN`, and only the
+ * config knows which names are keys, so the config says so. ONE derivation:
+ * the shell tool reads it through codingToolOptions, and startup reads it
+ * directly for the mcp extension, which spawns its stdio children before
+ * these state setters have run.
+ */
+export declare function secretEnvNamesOf(models: Readonly<Record<string, unknown>>): readonly string[];
 export declare function codingToolOptions(): {
     readonly workspaceRoot: string;
     readonly excludeRoots: readonly string[];
+    readonly secretEnvNames: readonly string[];
 };
 export declare function sessionsDir(): string;
 /** E1: the extension scan directory — KISO_EXTENSIONS_DIR overrides. */

package/dist/state.js

@@ -22,8 +22,23 @@ export function kisoHome() {
  *  is decided. The session's own tool set and the `!` command's runner both
  *  need it, and two copies of a ruling-bearing literal is how a later DC-49
  *  amendment reaches one caller and not the other. */
+/**
+ * Astra F7 — every configured profile's `apiKeyEnv` NAME is a secret name.
+ * The strip's suffix rules cannot see `REVIEW_PROVIDER_TOKEN`, and only the
+ * config knows which names are keys, so the config says so. ONE derivation:
+ * the shell tool reads it through codingToolOptions, and startup reads it
+ * directly for the mcp extension, which spawns its stdio children before
+ * these state setters have run.
+ */
+export function secretEnvNamesOf(models) {
+    return [
+        ...new Set(Object.values(models)
+            .map((p) => p.apiKeyEnv)
+            .filter((n) => typeof n === "string" && n.length > 0)),
+    ];
+}
 export function codingToolOptions() {
-    return { workspaceRoot: process.cwd(), excludeRoots: [kisoHome()] };
+    return { workspaceRoot: process.cwd(), excludeRoots: [kisoHome()], secretEnvNames: secretEnvNamesOf(configModels) };
 }
 export function sessionsDir() {
     return join(kisoHome(), "sessions");

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@vincemakes/kiso-code",
-	"version": "0.33.0",
-	"description": "kiso-code — the coding agent on kiso, the durable runtime for AI agents: kiso chat / kiso resume / kiso sessions.",
+	"version": "0.36.0",
+	"description": "kiso-code \u2014 the coding agent on kiso, the durable runtime for AI agents: kiso chat / kiso resume / kiso sessions.",
 	"type": "module",
 	"license": "MIT",
 	"bin": {
@@ -18,20 +18,20 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@vincemakes/kiso-ask-ext": "0.33.0",
-		"@vincemakes/kiso-core": "0.33.0",
-		"@vincemakes/kiso-evals": "0.33.0",
-		"@vincemakes/kiso-mcp-ext": "0.33.0",
-		"@vincemakes/kiso-provider-anthropic": "0.33.0",
-		"@vincemakes/kiso-provider-openai": "0.33.0",
-		"@vincemakes/kiso-provider-openai-responses": "0.33.0",
-		"@vincemakes/kiso-runtime": "0.33.0",
-		"@vincemakes/kiso-skills-ext": "0.33.0",
-		"@vincemakes/kiso-subagent-ext": "0.33.0",
-		"@vincemakes/kiso-task-ext": "0.33.0",
-		"@vincemakes/kiso-tools-node": "0.33.0",
-		"@vincemakes/kiso-tui": "0.33.0",
-		"@vincemakes/kiso-tui-cells": "0.33.0"
+		"@vincemakes/kiso-ask-ext": "0.36.0",
+		"@vincemakes/kiso-core": "0.36.0",
+		"@vincemakes/kiso-evals": "0.36.0",
+		"@vincemakes/kiso-mcp-ext": "0.36.0",
+		"@vincemakes/kiso-provider-anthropic": "0.36.0",
+		"@vincemakes/kiso-provider-openai": "0.36.0",
+		"@vincemakes/kiso-provider-openai-responses": "0.36.0",
+		"@vincemakes/kiso-runtime": "0.36.0",
+		"@vincemakes/kiso-skills-ext": "0.36.0",
+		"@vincemakes/kiso-subagent-ext": "0.36.0",
+		"@vincemakes/kiso-task-ext": "0.36.0",
+		"@vincemakes/kiso-tools-node": "0.36.0",
+		"@vincemakes/kiso-tui": "0.36.0",
+		"@vincemakes/kiso-tui-cells": "0.36.0"
 	},
 	"devDependencies": {
 		"@types/node": "^26.1.2",