@vincemakes/kiso-code 0.40.3 → 0.40.5

package/dist/auth/adapter-options.d.ts

@@ -18,5 +18,11 @@ export interface AdapterOptions {
         readonly accountId: string;
     }>;
     readonly promptCacheKey?: string;
+    readonly headers?: Readonly<Record<string, string>>;
 }
+/** The profile's headers with `{session}` replaced by the session id. A
+ *  header that names `{session}` when there is no session (`kiso sessions`,
+ *  which streams nothing) is left out, never sent with the placeholder in
+ *  it. Undefined when nothing is left. */
+export declare function expandProfileHeaders(headers: Readonly<Record<string, string>> | undefined, sessionId: string | undefined): Readonly<Record<string, string>> | undefined;
 export declare function adapterOptionsFor(profile: ModelProfile, auth: AdapterAuth, sessionId?: string): AdapterOptions;

package/dist/auth/adapter-options.js

@@ -33,6 +33,25 @@
  */
 import { effectiveBaseUrl } from "./credentials.js";
 import { oauthTokenThunk } from "./token.js";
+/** The profile's headers with `{session}` replaced by the session id. A
+ *  header that names `{session}` when there is no session (`kiso sessions`,
+ *  which streams nothing) is left out, never sent with the placeholder in
+ *  it. Undefined when nothing is left. */
+export function expandProfileHeaders(headers, sessionId) {
+    if (headers === undefined)
+        return undefined;
+    const out = {};
+    for (const [name, value] of Object.entries(headers)) {
+        if (value.includes("{session}")) {
+            if (sessionId === undefined)
+                continue;
+            out[name] = value.split("{session}").join(sessionId);
+        }
+        else
+            out[name] = value;
+    }
+    return Object.keys(out).length === 0 ? undefined : out;
+}
 export function adapterOptionsFor(profile, auth, sessionId) {
     // OR-1: exactly one sign-in shape reaches the adapter. An OAuth profile
     // has no key to pass — it passes the thunk the adapter re-resolves per
@@ -43,6 +62,7 @@ export function adapterOptionsFor(profile, auth, sessionId) {
     // own environment variable, and a profile with no baseUrl then sent the
     // stored vendor key wherever that variable pointed.
     const url = effectiveBaseUrl(profile.kind, profile.baseUrl);
+    const headers = expandProfileHeaders(profile.headers, sessionId);
     return {
         ...credential,
         ...(url !== undefined ? { baseUrl: url } : {}),
@@ -53,5 +73,9 @@ export function adapterOptionsFor(profile, auth, sessionId) {
         // cache.
         ...(sessionId !== undefined ? { promptCacheKey: sessionId } : {}),
         ...(profile.promptCaching !== undefined ? { promptCaching: profile.promptCaching } : {}),
+        // The endpoint's own headers (a gateway's session header, say), with
+        // the session id where the profile wrote `{session}` — the same id
+        // as the cache key above, so one conversation is one lane end to end.
+        ...(headers !== undefined ? { headers } : {}),
     };
 }

package/dist/chat.js

@@ -14,8 +14,9 @@ import { canonicalizeUsage } from "@vincemakes/kiso-runtime";
 import { canonicalizeUsageForModel, requestBudget } from "@vincemakes/kiso-runtime/internal";
 import { dispatch, abortBangCommand } from "./dispatch.js";
 import { paintWindowTitle } from "./window-title.js";
-import { agentBaseUrl, agentModel, body, bodyLog, configuredWindow, dock, retryOnRow, retryShown, setRetryShown, floorOn, protectedFiles, upstreamOf } from "./state.js";
+import { agentBaseUrl, agentModel, body, bodyLog, configuredWindow, dock, retryOnRow, retryShown, setRetryShown, floorOn, protectedFiles, upstreamOf, VERSION } from "./state.js";
 import { attachImages } from "./attachments.js";
+import { installedVersion, staleVersionNotice } from "./stale-version.js";
 import { learnedWindowFor } from "./learned-windows.js";
 import { lookupContextWindow, lookupModelMetadata } from "@vincemakes/kiso-runtime/internal";
 import { addDontAskAgainRule, askPanel, fixHintFor, pendingAsk, resolveUncertains } from "./trust-ui.js";
@@ -1365,6 +1366,12 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
                 stopSpinner();
                 paintIdle();
                 currentRun = null;
+                // 0.40.5: the kiso on disk may no longer be the one this
+                // session runs (an upgrade since it started) — said once per
+                // installed version (stale-version.ts).
+                const stale = staleVersionNotice(installedVersion(), VERSION, session.id);
+                if (stale !== null)
+                    body.notice(stale);
                 // round 8: a faux script that ran out of declared turns exits
                 // loudly with a non-zero status — never a silent status 0.
                 // round 4 (adversarial): the exhaustion is a CONTROLLED rejection of

package/dist/config.d.ts

@@ -75,6 +75,16 @@ export interface ModelProfile {
      * the registry looks for this model's window when `baseUrl` has no row.
      */
     readonly upstream?: string;
+    /**
+     * Headers the endpoint needs on every request — a gateway that routes a
+     * conversation by a session header, say. `{session}` in a value becomes
+     * the kiso session's id, so one conversation keeps one id across /model
+     * and /resume, and two conversations never share one. Names are
+     * lower-cased. A credential header is refused by name: a key never lives
+     * in this file (`apiKeyEnv` and `kiso login` are the doors), and the
+     * framing headers belong to the adapter.
+     */
+    readonly headers?: Readonly<Record<string, string>>;
 }
 export interface AutoCompactConfig {
     readonly thresholdRatio: number;

package/dist/config.js

@@ -34,6 +34,27 @@ import { join } from "node:path";
 import { kisoHome } from "./state.js";
 import { AuthError, getCredential, providerIdOf } from "./auth/credentials.js";
 import { BUILTIN_MANIFESTS } from "@vincemakes/kiso-runtime/internal";
+/** Header names a profile may not set: credentials (a key never lives in the
+ *  config file) and the framing the adapter owns. */
+const REFUSED_HEADERS = new Set(["authorization", "proxy-authorization", "x-api-key", "api-key", "cookie", "host", "content-length", "content-type", "transfer-encoding", "connection"]);
+function parseHeaders(field, raw, fail) {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        fail(field, "expected an object of header names to string values");
+    const out = {};
+    for (const [name, value] of Object.entries(raw)) {
+        if (!/^[A-Za-z0-9-]+$/.test(name))
+            fail(`${field}.${name}`, "expected a header name of letters, digits and dashes");
+        const lower = name.toLowerCase();
+        if (REFUSED_HEADERS.has(lower))
+            fail(`${field}.${name}`, "a credential or framing header cannot be set here — the key comes from apiKeyEnv or kiso login");
+        if (lower in out)
+            fail(`${field}.${name}`, "named twice (header names are case-insensitive)");
+        if (typeof value !== "string" || /[\r\n\0]/.test(value))
+            fail(`${field}.${name}`, "expected a one-line string value");
+        out[lower] = value;
+    }
+    return out;
+}
 const KINDS = ["openai-compat", "anthropic", "openai-responses"];
 const MODES_LIST = ["manual", "default", "accept-edits", "plan", "bypass", "dontAsk"];
 export class ConfigError extends Error {
@@ -149,6 +170,7 @@ export function parseConfig(text, source) {
                 fail(`models.${name}.contextWindow`, "expected a positive token count");
             if (p.upstream !== undefined && (typeof p.upstream !== "string" || p.upstream.trim() === ""))
                 fail(`models.${name}.upstream`, "expected the URL or name of what this endpoint forwards to");
+            const headers = p.headers === undefined ? undefined : parseHeaders(`models.${name}.headers`, p.headers, fail);
             models[name] = {
                 kind: p.kind,
                 model: p.model,
@@ -158,6 +180,7 @@ export function parseConfig(text, source) {
                 ...(typeof p.streamIdleMs === "number" ? { streamIdleMs: p.streamIdleMs } : {}),
                 ...(typeof p.contextWindow === "number" ? { contextWindow: p.contextWindow } : {}),
                 ...(typeof p.upstream === "string" ? { upstream: p.upstream.trim() } : {}),
+                ...(headers !== undefined ? { headers } : {}),
             };
         }
         out.models = models;

package/dist/dispatch.js

@@ -9,9 +9,10 @@ import { buildAdapter, lookupModelMetadata, resolveContinuationScope, resolveRea
 import { MODES, MODE_NOTE, OFFERED_MODES, getMode, setMode } from "./mode.js";
 import { clipboardWrite, lastAnswer } from "./clipboard.js";
 import { protectedBangReason, protectedShellVerdict } from "./protected-shell.js";
-import { agentBaseUrl, currentProfileName, setCurrentProfileName, currentModelName, agentModel, body, bodyLog, codingToolOptions, protectedFiles, kisoHome, configModels, dock, lastBinding, loadedSkillsCatalog, mergedConfig, readContextLedger, retryOnRow, sessionsDir, setAgentModel, setConfiguredWindow, setCurrentModelName, setModelChoice, setRetryShown, upstreamOf, setLastBinding } from "./state.js";
+import { agentBaseUrl, currentProfileName, setCurrentProfileName, currentModelName, agentModel, body, bodyLog, codingToolOptions, protectedFiles, kisoHome, configModels, dock, lastBinding, loadedSkillsCatalog, mergedConfig, readContextLedger, retryOnRow, sessionsDir, setAgentModel, setConfiguredWindow, setCurrentModelName, setModelChoice, setRetryShown, upstreamOf, VERSION, setLastBinding } from "./state.js";
 import { adapterOptionsFor } from "./auth/adapter-options.js";
 import { profileProviderLabel, providerLabel } from "./provider-label.js";
+import { installedVersion, versionStatusLine } from "./stale-version.js";
 import { queuedSwitchLines } from "./state.js";
 import { contextWindowTokens, microcompactThresholdFor, startStatusSpinner, statedContextWindow, windowSourceNote } from "./chat.js";
 import { authForProfile, directWriteProfile, profileAvailable, resolveContextWindow, unavailableReason } from "./config.js";
@@ -514,6 +515,9 @@ export function dispatch(line, ctx) {
             // variable; until then, a label that cannot lie.)
             const profileOf = currentProfileName === null ? "" : ` · profile ${currentProfileName}`;
             bodyLog(`model ${agentModel}${providerLabel(agentBaseUrl, upstreamOf(agentBaseUrl))}${profileOf}`);
+            // 0.40.5: the version this session RUNS, and the installed one when
+            // an upgrade (or a rollback) since start-up made them differ.
+            bodyLog(versionStatusLine(installedVersion(), VERSION));
             ctx.input.prompt();
         });
         return;

package/dist/stale-version.d.ts

@@ -0,0 +1,14 @@
+/** The version of the kiso installed where this one was loaded from, read
+ *  now — null on any failure, never a guess. KISO_INSTALLED_PACKAGE_JSON
+ *  names another file: the test rigs' knob (like KISO_FAUX_SCRIPT), so an
+ *  end-to-end run can "upgrade" underneath a live session without touching
+ *  the checkout's own package.json. */
+export declare function installedVersion(pkgPath?: string): string | null;
+/** The transcript notice, once per installed version that differs from the
+ *  running one (a newer install, or a rollback); null otherwise. */
+export declare function staleVersionNotice(installed: string | null, running: string, sessionId: string): string | null;
+/** /status's version line: the running version, and the installed one when
+ *  they differ. */
+export declare function versionStatusLine(installed: string | null, running: string): string;
+/** Tests: forget which version was noticed. */
+export declare function resetStaleVersionNotice(): void;

package/dist/stale-version.js

@@ -0,0 +1,52 @@
+/**
+ * 0.40.5 — a session says when the kiso on disk is not the kiso it runs.
+ *
+ * The owner, 2026-09-23: "I am on 0.40.3 — why does edit_file still fail?"
+ * The session's process had started at 13:03 on 0.40.2; 0.40.3 was
+ * installed at ~14:05. The process kept the code it loaded, so its
+ * edit_file still refused overlapping hunks, while `kiso --version` in
+ * another shell printed the version ON DISK. Nothing in the session said
+ * otherwise. A process that loads a module lazily after an upgrade (a
+ * provider on its first /model switch) would also mix the new version with
+ * the old — the notice is the cue to restart before that.
+ *
+ * `VERSION` (state.ts) is read once at start-up from the package.json next
+ * to the build; a global install replaces that file, so reading it AGAIN
+ * sees what a new start would run. One small read per turn and per
+ * /status; no timer, no watcher, no network.
+ */
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+/** The version of the kiso installed where this one was loaded from, read
+ *  now — null on any failure, never a guess. KISO_INSTALLED_PACKAGE_JSON
+ *  names another file: the test rigs' knob (like KISO_FAUX_SCRIPT), so an
+ *  end-to-end run can "upgrade" underneath a live session without touching
+ *  the checkout's own package.json. */
+export function installedVersion(pkgPath = process.env.KISO_INSTALLED_PACKAGE_JSON ?? join(dirname(fileURLToPath(import.meta.url)), "..", "package.json")) {
+    try {
+        const v = JSON.parse(readFileSync(pkgPath, "utf8")).version;
+        return typeof v === "string" && v !== "" ? v : null;
+    }
+    catch {
+        return null;
+    }
+}
+let lastNoticed = null;
+/** The transcript notice, once per installed version that differs from the
+ *  running one (a newer install, or a rollback); null otherwise. */
+export function staleVersionNotice(installed, running, sessionId) {
+    if (installed === null || installed === running || running === "?" || installed === lastNoticed)
+        return null;
+    lastNoticed = installed;
+    return `✦ kiso ${installed} is installed — this session runs ${running}; exit and resume it (kiso resume ${sessionId}) to use it`;
+}
+/** /status's version line: the running version, and the installed one when
+ *  they differ. */
+export function versionStatusLine(installed, running) {
+    return installed === null || installed === running ? `version ${running}` : `version ${running} (running) · ${installed} installed — restart to use it`;
+}
+/** Tests: forget which version was noticed. */
+export function resetStaleVersionNotice() {
+    lastNoticed = null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@vincemakes/kiso-code",
-	"version": "0.40.3",
+	"version": "0.40.5",
 	"description": "kiso-code \u2014 the coding agent on kiso, the durable runtime for AI agents: kiso chat / kiso resume / kiso sessions.",
 	"type": "module",
 	"license": "MIT",
@@ -18,20 +18,20 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@vincemakes/kiso-ask-ext": "0.40.3",
-		"@vincemakes/kiso-core": "0.40.3",
-		"@vincemakes/kiso-evals": "0.40.3",
-		"@vincemakes/kiso-mcp-ext": "0.40.3",
-		"@vincemakes/kiso-provider-anthropic": "0.40.3",
-		"@vincemakes/kiso-provider-openai": "0.40.3",
-		"@vincemakes/kiso-provider-openai-responses": "0.40.3",
-		"@vincemakes/kiso-runtime": "0.40.3",
-		"@vincemakes/kiso-skills-ext": "0.40.3",
-		"@vincemakes/kiso-subagent-ext": "0.40.3",
-		"@vincemakes/kiso-task-ext": "0.40.3",
-		"@vincemakes/kiso-tools-node": "0.40.3",
-		"@vincemakes/kiso-tui": "0.40.3",
-		"@vincemakes/kiso-tui-cells": "0.40.3"
+		"@vincemakes/kiso-ask-ext": "0.40.5",
+		"@vincemakes/kiso-core": "0.40.5",
+		"@vincemakes/kiso-evals": "0.40.5",
+		"@vincemakes/kiso-mcp-ext": "0.40.5",
+		"@vincemakes/kiso-provider-anthropic": "0.40.5",
+		"@vincemakes/kiso-provider-openai": "0.40.5",
+		"@vincemakes/kiso-provider-openai-responses": "0.40.5",
+		"@vincemakes/kiso-runtime": "0.40.5",
+		"@vincemakes/kiso-skills-ext": "0.40.5",
+		"@vincemakes/kiso-subagent-ext": "0.40.5",
+		"@vincemakes/kiso-task-ext": "0.40.5",
+		"@vincemakes/kiso-tools-node": "0.40.5",
+		"@vincemakes/kiso-tui": "0.40.5",
+		"@vincemakes/kiso-tui-cells": "0.40.5"
 	},
 	"devDependencies": {
 		"@types/node": "^26.1.2",