@vincemakes/kiso-code 0.34.0 → 0.37.0

package/dist/chat.js

@@ -20,6 +20,15 @@ import { FauxExhaustionError, failOnFauxExhaustion } from "./faux-glue.js";
 import { MODES, getMode, setMode } from "./mode.js";
 /** B area: default context window for the ~ctx estimate (config overridable). */
 const DEFAULT_CONTEXT_WINDOW = 200_000;
+/** The in-process fake provider's id, and the window we declare for it.
+ *  Ours to state: faux is not a vendor's model, so "nobody published a
+ *  window" — the reason a real model's capacity is unknown — cannot apply.
+ *  200,000 is the figure every faux transcript has been measured against
+ *  since the fallback existed, so declaring it changes no behaviour; it
+ *  only stops an honest `ctx ?` from firing where the honest answer is a
+ *  number we own. */
+const FAUX_MODEL = "faux";
+const FAUX_CONTEXT_WINDOW = 200_000;
 /** Parse KISO_AUTO_COMPACT — an invalid value is OFF, never a crash. */
 export function autoCompactFromEnv() {
     const raw = process.env.KISO_AUTO_COMPACT;
@@ -35,8 +44,51 @@ export function autoCompactFromEnv() {
  * config window (merge round B), both beat the 200k default. The microcompact
  * threshold is derived from it (50%), and the status line's ~ctx estimate
  * is measured against it — one source of truth for the window.
+ *
+ * CTX-1: with no argument this reads the LIVE binding, which is what every
+ * display caller wants. `/model` needs the window of the model it is
+ * switching TO, before that binding is live, so it passes the pair
+ * explicitly. Reading module state a caller is about to change is how the
+ * threshold got stuck in the first place.
+ *
+ * The argument is a PAIR, never two optional halves: a profile with no
+ * `baseUrl` is endpoint-less, and a half-given argument would have it
+ * inherit the OUTGOING model's endpoint — the same bug one field over.
+ */
+/**
+ * THE WINDOW SOMEBODY STATED, or null when nobody has.
+ *
+ * Three sources, in order: the config/profile window, KISO_CONTEXT_WINDOW,
+ * and the metadata registry. Each is a claim someone made and dated. When
+ * none of them speaks, this returns NULL rather than a number — because
+ * the question "how much of the window is left" has no answer without a
+ * window, and every display that shows a percentage needs this one, not
+ * the policy value below.
+ *
+ * DeepSeek is the live case: its /models endpoint returns ids only, the
+ * responses carry no window, and the registry records null on purpose. The
+ * display used to divide by a hardcoded 200,000 anyway and print a
+ * confident `ctx left ~82%` against a figure nobody had measured.
  */
-export function contextWindowTokens() {
+export function knownContextWindow(of) {
+    if (configuredWindow !== undefined)
+        return configuredWindow;
+    const env = Number.parseInt(process.env.KISO_CONTEXT_WINDOW ?? "", 10);
+    if (Number.isFinite(env) && env > 0)
+        return env;
+    const model = of?.model ?? agentModel;
+    // `faux` is OURS. The registry carries no row for it because it is not a
+    // vendor's model, but the reason the window is unknown elsewhere — nobody
+    // published one — does not apply to a model we wrote. Declaring it is a
+    // statement about our own artifact, with ourselves as the source, and it
+    // keeps faux mode showing a real percentage instead of the `ctx ?` that
+    // belongs to models whose capacity genuinely nobody states.
+    if (model === FAUX_MODEL)
+        return FAUX_CONTEXT_WINDOW;
+    const known = lookupModelMetadata(model, of !== undefined ? of.baseUrl : agentBaseUrl)?.capabilities.contextWindow;
+    return known ?? null;
+}
+export function contextWindowTokens(of) {
     const windowOverride = configuredWindow;
     if (windowOverride !== undefined)
         return windowOverride;
@@ -45,17 +97,41 @@ export function contextWindowTokens() {
         return window;
     // PH-1c (finding PH-F15): the window follows the LIVE model when the
     // metadata registry knows it — /model to a known model moves the
-    // window (and the microcompact threshold derived from it) without an
-    // env var. agentModel is the same live binding the status row shows;
-    // an unknown model keeps the 200k default — the registry never
-    // guesses, so neither do we. OR-1: the ENDPOINT narrows the row —
-    // gpt-5.5 is 1,050,000 at the first-party API and 272,000 at the
-    // subscription backend; the two are set together (setAgentModel).
-    const known = lookupModelMetadata(agentModel, agentBaseUrl)?.capabilities.contextWindow;
+    // window without an env var. The default argument is the same live
+    // binding the status row shows; an unknown model keeps the 200k
+    // default — the registry never guesses, so neither do we. OR-1: the
+    // ENDPOINT narrows the row — gpt-5.5 is 1,050,000 at the first-party
+    // API and 272,000 at the subscription backend; the two are set
+    // together (setAgentModel).
+    //
+    // CTX-1 erratum: this comment used to add "(and the microcompact
+    // threshold derived from it)". The window moved; the threshold did
+    // not — it was computed once at startup and the switch path never
+    // asked again. The claim is true now because the switch path calls
+    // `microcompactThresholdFor` below, not because deriving a number
+    // from this function makes anything follow it.
+    const known = lookupModelMetadata(of?.model ?? agentModel, of !== undefined ? of.baseUrl : agentBaseUrl)?.capabilities.contextWindow;
     if (known !== undefined && known !== null)
         return known;
     return DEFAULT_CONTEXT_WINDOW;
 }
+/**
+ * CTX-1: THE ONE derivation of the compaction threshold from the window.
+ *
+ * Startup (`index.ts`) and the `/model` switch (`dispatch.ts`) both need
+ * this number, and two call sites computing the same thing is how
+ * `promptCacheKey` drifted before `adapterOptionsFor` collected it. The
+ * policy — half the window — lives here and nowhere else.
+ *
+ * CAPACITY is not POLICY. The window is what the model can hold; this is
+ * when we choose to clear old tool results. They are 2:1 today because
+ * that ratio has never been measured, not because it is derived from
+ * anything. Moving the policy means changing this line, and the whole
+ * product moves with it.
+ */
+export function microcompactThresholdFor(of) {
+    return contextWindowTokens(of) / 2;
+}
 /**
  * B area: approximate context ratio — chars/4 of the projected messages vs
  * the model window. Marked ~ everywhere it is shown; no counting API.
@@ -79,7 +155,15 @@ export function statusModelLabel(session) {
     return effort !== undefined && effort !== "default" ? `${agentModel} · ${effort}` : agentModel;
 }
 export function displayCtxRatio(session) {
-    return requestBudget(session.requestParts(), contextWindowTokens()).ratio;
+    // CAPACITY is not POLICY. `contextWindowTokens` falls back to 200,000 so
+    // that the compaction threshold always HAS a value — a policy needs a
+    // number. A percentage on screen is a different kind of thing: it is a
+    // claim about the model, and an unstated window makes it unanswerable.
+    // NaN reaches the status row as `ctx ?`.
+    const window = knownContextWindow();
+    if (window === null)
+        return Number.NaN;
+    return requestBudget(session.requestParts(), window).ratio;
 }
 /** A1a: the number the auto-compact decision reads — the pre-A1a estimate,
  *  unchanged this round, named so a gate can pin that it did not move. */
@@ -165,6 +249,84 @@ endpoint) {
         costUsd: c.costUsd,
     };
 }
+/** The accumulator's zero value — nothing measured yet. One shared
+ *  literal: RunUsage's fields are readonly, and the old code repeated this
+ *  object at every reset. */
+const UNKNOWN_USAGE = { in: null, out: null, cache: null, known: false };
+/** W22 (owner, 2026-09-14) — the TURN's usage, summed across its calls.
+ *
+ *  EXISTING-BEHAVIOR CHANGE — declared, never a silent side-fix:
+ *  the recap and the running row carried the LAST call's figures
+ *  (`usage = delta.usage`), and read as the turn's by everyone who saw
+ *  them: the owner's own dogfood, a nine-call turn that had spent 120,358
+ *  prompt tokens and 4,608 output tokens, reported `in 412 out 924 ·
+ *  cache 98%` — the ninth call's fresh input and the ninth call's output.
+ *  The variables are the same and the definitions are unchanged; the SCOPE
+ *  is the turn's.
+ *
+ *  Two rules, inherited rather than invented:
+ *  - `in` stays the canonical FRESH count (E2, R2a-1): the turn's sum is
+ *    the input the turn actually bought at full price. `cache` is summed
+ *    too, but only the recap's ratio reads it (cache/(in+cache)) — the raw
+ *    total is the ledger's business, never the row's, because a sum over
+ *    calls counts the same prefix once per call.
+ *  - an unmeasured term makes the sum unmeasured (OR-10's rule, applied to
+ *    the sum): `null` propagates, and one call with `known: false` makes
+ *    the turn's figure unknown rather than a lower bound dressed as a
+ *    total. The row then says nothing, as it always did for an unknown
+ *    call.
+ *
+ *  The miss estimate and the decode rate stay PER CALL: `missed` is the
+ *  overlap of consecutive prompts (a total-side quantity), and the rate is
+ *  the call that just settled timing itself. */
+export function accumulateUsage(prev, delta) {
+    const sum = (a, b) => (a === null || b === null ? null : a + b);
+    return {
+        in: sum(prev.in, delta.in),
+        out: sum(prev.out, delta.out),
+        cache: sum(prev.cache, delta.cache),
+        known: prev.known && delta.known,
+    };
+}
+/**
+ * W22-R1 (Astra): the turn's usage ledger, as ONE definition.
+ *
+ * A TURN is the sum over its CALLS; a CALL is its LATEST report. Both
+ * halves are load-bearing: the openai-compat adapter yields a usage event
+ * from either of two stream shapes and its `usageSent` flag only decides
+ * whether to append a trailing unknown — it does not stop both from
+ * firing. W22 substituted, so a second report silently replaced the first
+ * and no screen changed; summing without the call boundary turned the same
+ * stream into a WRONG NUMBER (a ledger of fresh 80 / out 10 shown as
+ * 160 / 15).
+ *
+ * It is a function rather than three variables in the loop because the rule
+ * then has one place to be right — the same reason `microcompactThresholdFor`
+ * exists, and the drift `promptCacheKey` demonstrated when it did not.
+ */
+export function turnUsageLedger() {
+    let settled = null;
+    let inFlight = null;
+    const fold = (a, b) => a === null ? b : b === null ? a : accumulateUsage(a, b);
+    return {
+        // every event of the run passes through here: a stop ENDS a call, so
+        // the report in flight settles and the next call starts its own.
+        observe(ev) {
+            if (ev.type !== "stop")
+                return;
+            settled = fold(settled, inFlight);
+            inFlight = null;
+        },
+        // this call's latest report REPLACES its earlier one.
+        report(u) {
+            inFlight = u;
+        },
+        // the turn so far: the settled calls plus the one in flight.
+        total() {
+            return fold(settled, inFlight);
+        },
+    };
+}
 /** v2b: the spinner merged into the STATUS BAR (the v2a standalone glyph
  *  is gone) — docked only, 200ms rotation between the request and the
  *  first event. */
@@ -553,44 +715,24 @@ function toRenderInput(ev) {
  * echo is UI, the chip is the record; the momentary double-render is
  * the design's explicit point).
  */
-/** LT-2b — the turn checkpoint (kiso-doc/kiso-lt1-mini-spec-2026-09-09.md,
- *  part two). R3e stands: no hard turn limit on an interactive session. What
- *  a long run gets instead is a QUESTION every CHECKPOINT_TURNS model turns —
- *  the run is paused between two model turns (the generator is simply not
- *  pulled while the panel is up; the kernel does nothing meanwhile) and the
- *  human answers. "Keep going" resumes it, the next question one checkpoint
- *  later; "Stop here" aborts the run — `aborted by user`, resumable, never
- *  silent. A decline (esc) is "keep going": the run was already running, and
- *  esc on a panel is the panel's decline, not the run's abort. Headless
- *  entries never see it: the panel needs the dock, and a pipe, `-p` or a
- *  task file has none. 50 is named here; a finding moves it, never a stray
- *  edit. */
-export const CHECKPOINT_TURNS = 50;
-async function checkpointAsk(input, turns) {
-    const verdict = await askPanel(input, askView({
-        questions: [
-            {
-                question: `${turns} turns and still working — keep going?`,
-                header: "checkpoint",
-                options: [
-                    { label: "Keep going", description: `the next question at ${turns + CHECKPOINT_TURNS}` },
-                    { label: "Stop here", description: "the run ends as aborted by you; kiso resume continues it later" },
-                ],
-            },
-        ],
-    }));
-    if (verdict.action !== "answers" || !("answers" in verdict.result))
-        return true; // declined: nothing changes
-    const first = verdict.result.answers[0];
-    return !(first !== undefined && "choice" in first && first.choice === "Stop here");
-}
 export async function consumeRun(session, run, input, turnNo, faux, statusCb, 
 /** W21: the amend words ("Yes + feedback") ride the NEXT user turn —
  *  threaded from chat's submitTurn; absent in the recovery flow
  *  (resume) where a dropped amend is noticed instead. */
 submitTurn) {
     let last;
-    let usage = { in: null, out: null, cache: null, known: false };
+    // W22: the TURN's usage — null until a call settles, then the sum of
+    // every call in this turn (accumulateUsage). Null rather than an empty
+    // accumulator, so the first call is the sum rather than an addition to
+    // nothing.
+    //
+    // W22-R1 (Astra): one call can report TWICE, so the turn is a sum over
+    // CALLS and a call is its LATEST report — see `turnUsageLedger`, which
+    // holds that rule. Every event passes through `observe` (a stop ends a
+    // call); the usage case reports; the status line and the recap read
+    // `total()`.
+    const ledger = turnUsageLedger();
+    const turnUsage = () => ledger.total();
     // TPS-1: the decode clock, armed by the FIRST streamed event of a call
     // and read at that call's usage event. Per CALL, not per turn — a turn
     // with three model calls reports the third, and each one times itself.
@@ -618,16 +760,13 @@ submitTurn) {
         tailers.delete(callId);
     };
     try {
-        let modelTurns = 0;
         for await (const ev of run) {
             last = ev;
-            // LT-2b: a model turn ends with its stop; every CHECKPOINT_TURNS of them
-            // the human is asked before the run is pulled any further
-            if (ev.type === "stop" && dock.active) {
-                modelTurns += 1;
-                if (modelTurns % CHECKPOINT_TURNS === 0 && !(await checkpointAsk(input, modelTurns)))
-                    run.abort();
-            }
+            // LT2B-F1: a turn count is not evidence of a loop. Keep consuming
+            // healthy runs without a periodic presence check; explicit cancellation,
+            // the stream watchdog and the repeated-failure breaker remain active.
+            // W22-R1: the ledger sees every event; a stop is what ends a call.
+            ledger.observe(ev);
             if (ev.type !== "thinking") {
                 if (thinkingSince !== null) {
                     thoughtSeconds += (Date.now() - thinkingSince) / 1000;
@@ -726,7 +865,9 @@ submitTurn) {
                     break;
                 case "usage": {
                     const delta = usageFromEvent(session.provider, ev, prevTotal, agentModel, session.baseUrl);
-                    usage = delta.usage;
+                    // W22-R1: this call's LATEST report replaces its earlier one;
+                    // the turn's figure is the settled calls plus this one.
+                    ledger.report(delta.usage);
                     prevTotal = delta.total;
                     missed = delta.missed;
                     // TUI2-R1 (E): the request's canonical cost rides the same
@@ -736,7 +877,7 @@ submitTurn) {
                     // second call is timed from ITS own first event.
                     const tokPerSec = callFirstEventAt === null ? null : decodeRate(ev.outputTokens, Date.now() - callFirstEventAt);
                     callFirstEventAt = null;
-                    statusCb?.(usage, displayCtxRatio(session), delta.costUsd, tokPerSec);
+                    statusCb?.(turnUsage() ?? UNKNOWN_USAGE, displayCtxRatio(session), delta.costUsd, tokPerSec);
                     break;
                 }
                 case "uncertain_pending":
@@ -843,7 +984,7 @@ submitTurn) {
                     // v3 §02: the run's recap line REPLACES the old "done" label
                     // + status line — one local line, derived from this run's
                     // events (zero tokens). The dock's status bar still paints.
-                    statusCb?.(usage, displayCtxRatio(session));
+                    statusCb?.(turnUsage() ?? UNKNOWN_USAGE, displayCtxRatio(session));
                     const ratio = displayCtxRatio(session);
                     // TV-1B: the settle verdict — the checklist stops lying. When
                     // every item is CLAIMED done, the settled block's tail says
@@ -901,7 +1042,7 @@ submitTurn) {
                         // the recap cut itself down to one character. A width
                         // that is not a positive number is not a width.
                         width: process.stdout.columns > 0 ? process.stdout.columns : 80,
-                        usage,
+                        usage: turnUsage() ?? UNKNOWN_USAGE,
                         // R-C item 4: only an above-floor miss is surfaced —
                         // the recap gains "· miss N" on the cache segment.
                         ...(missed !== null ? { missed } : {}),

package/dist/config.d.ts

@@ -49,6 +49,21 @@ export interface ModelProfile {
     /** LT-1: milliseconds the model stream may go silent before the request
      *  is aborted and retried. Default 120,000; 0 disables the watchdog. */
     readonly streamIdleMs?: number;
+    /**
+     * The model's context window, in tokens, when YOU know it and nobody
+     * else publishes it.
+     *
+     * The registry carries a window only where a vendor states one, dated
+     * and sourced. DeepSeek states none: its /models endpoint returns ids
+     * only and its responses carry no window. Without a window the status
+     * row has no denominator and shows `ctx ?` rather than a percentage of
+     * a number nobody measured.
+     *
+     * Setting this makes the percentage real FOR YOU, and it is your claim,
+     * not ours — which is why it lives in your profile rather than in the
+     * registry, where every figure has to carry a source.
+     */
+    readonly contextWindow?: number;
 }
 export interface AutoCompactConfig {
     readonly thresholdRatio: number;
@@ -145,7 +160,7 @@ export declare function resolveModel(modelFlag: string | undefined, merged: Kiso
 export declare function resolveModeFromConfig(merged: KisoConfig): Mode | undefined;
 /** Context window: env (KISO_CONTEXT_WINDOW) > config.contextWindow >
  *  default (200k — the caller's default). */
-export declare function resolveContextWindow(merged: KisoConfig): number | undefined;
+export declare function resolveContextWindow(merged: KisoConfig, profile?: ModelProfile): number | undefined;
 /** Auto-compact: env (KISO_AUTO_COMPACT) > config.autoCompact > off. An
  *  invalid env value is OFF (it set the env → it wins, and it is invalid). */
 export declare function resolveAutoCompact(merged: KisoConfig): AutoCompactConfig | undefined;

package/dist/config.js

@@ -296,31 +296,53 @@ export function resolveModel(modelFlag, merged) {
         return resolveProfile(modelFlag, p);
     }
     // env beats config: a key in the environment names the provider.
+    //
+    // Astra F2: the credential goes through authForProfile like every other
+    // route. This returned process.env.OPENAI_API_KEY directly, so the two
+    // ways into the same adapter disagreed about which key a profile uses.
+    // The safety property held by accident — the env key is not the stored
+    // one — and an accident is not a rule. Now: the stored key at the
+    // vendor's origin, the env key at a custom one, and a stored vendor key
+    // is never forwarded to a custom environment URL.
+    //
+    // The env var is folded into the profile EXPLICITLY, so the resolved
+    // endpoint is the profile's and the SDK never reads it again (F1).
     if (process.env.OPENAI_API_KEY !== undefined) {
-        return {
-            name: process.env.OPENAI_MODEL ?? "gpt-4o",
-            profile: {
-                kind: "openai-compat",
-                model: process.env.OPENAI_MODEL ?? "gpt-4o",
-                ...(process.env.OPENAI_BASE_URL !== undefined ? { baseUrl: process.env.OPENAI_BASE_URL } : {}),
-                apiKeyEnv: "OPENAI_API_KEY",
-            },
-            apiKey: process.env.OPENAI_API_KEY,
+        const profile = {
+            kind: "openai-compat",
+            model: process.env.OPENAI_MODEL ?? "gpt-4o",
+            ...(process.env.OPENAI_BASE_URL !== undefined ? { baseUrl: process.env.OPENAI_BASE_URL } : {}),
+            apiKeyEnv: "OPENAI_API_KEY",
         };
+        const auth = authForProfile(process.env.OPENAI_MODEL ?? "gpt-4o", profile);
+        // The same total shape the config route returns (resolveProfile).
+        // The `oauth` arm is unreachable from HERE — authForProfile returns
+        // oauth only for an openai-responses profile and this route builds
+        // an openai-compat one — but writing the union out beats a fallback
+        // to the raw env var, which is the very disagreement F2 removes.
+        return auth.type === "oauth"
+            ? { name: process.env.OPENAI_MODEL ?? "gpt-4o", profile, oauthProviderId: auth.providerId }
+            : { name: process.env.OPENAI_MODEL ?? "gpt-4o", profile, apiKey: auth.apiKey };
     }
     if (process.env.ANTHROPIC_API_KEY !== undefined) {
-        return {
-            name: process.env.ANTHROPIC_MODEL ?? "claude-sonnet-5",
-            profile: {
-                kind: "anthropic",
-                model: process.env.ANTHROPIC_MODEL ?? "claude-sonnet-5",
-                apiKeyEnv: "ANTHROPIC_API_KEY",
-                // PH-1c (finding PH-F19): symmetric with OPENAI_BASE_URL —
-                // proxies and compat gateways serve the anthropic dialect too.
-                ...(process.env.ANTHROPIC_BASE_URL !== undefined ? { baseUrl: process.env.ANTHROPIC_BASE_URL } : {}),
-            },
-            apiKey: process.env.ANTHROPIC_API_KEY,
+        // Astra F2, the sibling. Same rule, same reason.
+        const profile = {
+            kind: "anthropic",
+            model: process.env.ANTHROPIC_MODEL ?? "claude-sonnet-5",
+            apiKeyEnv: "ANTHROPIC_API_KEY",
+            // PH-1c (finding PH-F19): symmetric with OPENAI_BASE_URL —
+            // proxies and compat gateways serve the anthropic dialect too.
+            ...(process.env.ANTHROPIC_BASE_URL !== undefined ? { baseUrl: process.env.ANTHROPIC_BASE_URL } : {}),
         };
+        const auth = authForProfile(process.env.ANTHROPIC_MODEL ?? "claude-sonnet-5", profile);
+        // The same total shape the config route returns (resolveProfile).
+        // The `oauth` arm is unreachable from HERE — authForProfile returns
+        // oauth only for an openai-responses profile and this route builds
+        // an anthropic one — but writing the union out beats a fallback
+        // to the raw env var, which is the very disagreement F2 removes.
+        return auth.type === "oauth"
+            ? { name: process.env.ANTHROPIC_MODEL ?? "claude-sonnet-5", profile, oauthProviderId: auth.providerId }
+            : { name: process.env.ANTHROPIC_MODEL ?? "claude-sonnet-5", profile, apiKey: auth.apiKey };
     }
     // config (project wins over user) names a model; default is faux.
     const configured = merged.model;
@@ -351,10 +373,15 @@ export function resolveModeFromConfig(merged) {
 }
 /** Context window: env (KISO_CONTEXT_WINDOW) > config.contextWindow >
  *  default (200k — the caller's default). */
-export function resolveContextWindow(merged) {
+export function resolveContextWindow(merged, profile) {
     const fromEnv = Number.parseInt(process.env.KISO_CONTEXT_WINDOW ?? "", 10);
     if (Number.isFinite(fromEnv) && fromEnv > 0)
         return fromEnv;
+    // The PROFILE's window beats the global one: it is stated about a
+    // specific model, and the global figure is a default for whatever is
+    // selected. Env still beats both — someone who set it meant it.
+    if (profile?.contextWindow !== undefined && profile.contextWindow > 0)
+        return profile.contextWindow;
     return merged.contextWindow;
 }
 /** Auto-compact: env (KISO_AUTO_COMPACT) > config.autoCompact > off. An

package/dist/dispatch.js

@@ -8,8 +8,10 @@ import { newSessionId } from "./session-id.js";
 import { buildAdapter, lookupModelMetadata, resolveContinuationScope, resolveReasoning } from "@vincemakes/kiso-runtime/internal";
 import { MODES, MODE_NOTE, getMode, setMode } from "./mode.js";
 import { clipboardWrite, lastAnswer } from "./clipboard.js";
-import { agentModel, body, bodyLog, codingToolOptions, kisoHome, configModels, dock, lastBinding, readContextLedger, sessionsDir, setAgentModel, setCurrentModelName, setModelChoice, setLastBinding } from "./state.js";
-import { authForProfile, directWriteProfile, profileAvailable, unavailableReason } from "./config.js";
+import { agentModel, body, bodyLog, codingToolOptions, kisoHome, configModels, dock, lastBinding, mergedConfig, readContextLedger, sessionsDir, setAgentModel, setConfiguredWindow, setCurrentModelName, setModelChoice, setLastBinding } from "./state.js";
+import { adapterOptionsFor } from "./auth/adapter-options.js";
+import { microcompactThresholdFor } from "./chat.js";
+import { authForProfile, directWriteProfile, profileAvailable, resolveContextWindow, unavailableReason } from "./config.js";
 import { shellTool } from "@vincemakes/kiso-tools-node";
 import { join } from "node:path";
 /** The picker's CLI half (owner 2026-09-08): a profile's LEGAL effort levels
@@ -74,7 +76,6 @@ function signInNote(p) {
     }
     return p.apiKeyEnv ?? "no key";
 }
-import { oauthTokenThunk } from "./auth/token.js";
 /** The ONE dispatcher — slash commands, exit, and turns. The recovery
  *  replay routes through it too — a queued "/last" must never become a
  *  user turn (v2c: the rl lives in main, so lines arrive earlier and the
@@ -601,18 +602,11 @@ export function dispatch(line, ctx) {
                     }
                     else {
                         const auth = authForProfile(profName, profile);
-                        const adapter = await buildAdapter(profile.kind, {
-                            // PH-1c (PH-F19): a keyless profile = an unauthenticated
-                            // endpoint — the placeholder satisfies the SDK's ctor.
-                            // OR-1: an OAuth profile passes a token thunk instead
-                            // — there is no key, and the adapter re-resolves the
-                            // token per request.
-                            ...(auth.type === "oauth"
-                                ? { oauth: oauthTokenThunk(auth.providerId), ...(ctx.session.id !== undefined ? { promptCacheKey: ctx.session.id } : {}) }
-                                : { apiKey: auth.apiKey }),
-                            ...(profile.baseUrl !== undefined ? { baseUrl: profile.baseUrl } : {}),
-                            ...(profile.promptCaching !== undefined ? { promptCaching: profile.promptCaching } : {}),
-                        });
+                        // Astra F1 (P0): the wire config is built in ONE place
+                        // (auth/adapter-options.ts) — this site and the startup
+                        // site were the same spread written twice, which is the
+                        // finding's own defect class.
+                        const adapter = await buildAdapter(profile.kind, adapterOptionsFor(profile, auth, ctx.session.id));
                         // PH-1a (finding PH-F8, P0): the switch is ATOMIC —
                         // adapter, model id, and provider route move together.
                         // setAdapter alone left the session's frozen config
@@ -644,6 +638,23 @@ export function dispatch(line, ctx) {
                                 adapter,
                                 model: profile.model,
                                 provider: profile.kind,
+                                // CTX-1: the compaction threshold is derived from the
+                                // LIVE model's window, so it moves with the binding.
+                                // It used to be computed once at startup: switching
+                                // from a 200k model to a 1M one showed 1,000,000 on
+                                // the status row while still clearing tool results at
+                                // 100,000, and switching the other way waited for
+                                // 500,000 in a window that cannot hold it.
+                                //
+                                // PH-F8 fixed this class for the model id, the
+                                // provider, the endpoint and the scope. This is the
+                                // field one over that was never asked.
+                                microcompact: {
+                                    thresholdTokens: microcompactThresholdFor({
+                                        model: profile.model,
+                                        ...(profile.baseUrl !== undefined ? { baseUrl: profile.baseUrl } : {}),
+                                    }),
+                                },
                                 // OR-1: the endpoint is the fourth passenger — the cost
                                 // path and the window lookup key on (model, endpoint).
                                 ...(profile.baseUrl !== undefined ? { baseUrl: profile.baseUrl } : {}),
@@ -657,6 +668,13 @@ export function dispatch(line, ctx) {
                             // §2.5: the ONE source a reload reads for the model — a
                             // switch made here must survive the rebuild.
                             setModelChoice(arg);
+                            // The window a PROFILE states travels with the switch,
+                            // like the model id and the endpoint. Leaving it behind
+                            // is CTX-1 one field over: the row would show a
+                            // percentage of the OUTGOING model's window. An
+                            // explicit env still wins, which resolveContextWindow
+                            // decides.
+                            setConfiguredWindow(resolveContextWindow(mergedConfig, profile));
                             // OR-7 (owner, 2026-09-09): the status row is repainted BY the
                             // switch — it used to keep the old model until the next
                             // recap repainted it, so "takes effect on the next turn"

package/dist/index.d.ts

@@ -31,7 +31,7 @@ export { applyProjectMerges } from "./trust-ui.js";
  */
 /** The built-in prompt. Exported for scripts/request-surface.mjs — the
  *  model-side token-rent counter measures the REAL bytes, never a copy. */
-export declare const SYSTEM_PROMPT = "You are kiso, a coding agent. You work in a workspace\ndirectory and change code with tools. Be concise: answer in a few lines\nunless the task genuinely needs more. Never claim a file was changed\nunless a tool confirmed it.\n\nTool discipline:\n- READ BEFORE YOU EDIT. For any file you are about to change, read it\n  first \u2014 never guess its content.\n- Use edit_file for targeted changes and write_file for full rewrites.\n  Prefer many small edits over one large write.\n- shell is for commands: builds, tests, git, grep. Be careful \u2014 shell has\n  side effects and may take time. Run one command at a time and inspect\n  the output before continuing.\n- Batch independent tool calls into one reply \u2014 they run in parallel.\n- search_text and list_dir are cheap \u2014 locate first, then read ranges\n  with read_file offset/limit; never read a whole large file in one call.\n- Do not re-read a file you already read unchanged \u2014 rely on the earlier\n  result.\n- When a tool fails, read the error and adjust; do not repeat the same\n  call blindly.\n\nWorkflow: understand the request, find the relevant code, make the\nsmallest change that works, then verify with a command (tests/build).\nReport what you did in one or two lines per change.";
+export declare const SYSTEM_PROMPT = "You are kiso, a coding agent. You work in a workspace\ndirectory and change code with tools. Be concise: answer in a few lines\nunless the task genuinely needs more. Never claim a file was changed\nunless a tool confirmed it.\n\nWhat you can reach:\n- The workspace: read_file, list_dir, search_text, write_file, edit_file.\n- This machine and the network: shell \u2014 builds, tests, git, package\n  managers, curl for HTTP, system queries. A request one command can\n  answer is answered by running it.\n- The human: ask_user, for a decision that is theirs.\n\nTool discipline:\n- READ BEFORE YOU EDIT. For any file you are about to change, read it\n  first \u2014 never guess its content.\n- Use edit_file for targeted changes and write_file for full rewrites.\n  Prefer many small edits over one large write.\n- shell is for commands: builds, tests, git, grep. Be careful \u2014 shell has\n  side effects and may take time. Run one command at a time and inspect\n  the output before continuing.\n- Batch independent tool calls into one reply \u2014 they run in parallel.\n- search_text and list_dir are cheap \u2014 locate first, then read ranges\n  with read_file offset/limit; never read a whole large file in one call.\n- Do not re-read a file you already read unchanged, or one you changed\n  yourself through a confirmed edit \u2014 rely on the earlier result and\n  on the change you just made.\n- When a tool fails, read the error and adjust; do not repeat the same\n  call blindly.\n\nAn authorization covers what it NAMES: when the scope is not named \u2014\nwhich files, which branches, whether to push \u2014 ask before acting.\nDelivering, sharing or handing over changes means committing locally and\nstopping; pushing, publishing or sending happens only when the human\nnames it.\n\nWorkflow: understand the request, find the relevant code, make the\nsmallest change that works, then verify with a command (tests/build).\nReport what you did in one or two lines per change.";
 /** Hard cap for injected instructions — truncate and say so. */
 /**
  * A area: read the FIRST present instruction file (AGENTS.md preferred) and