@vincemakes/kiso-code 0.40.4 → 0.40.6

package/dist/auth/credentials.d.ts

@@ -49,6 +49,18 @@ export declare function effectiveBaseUrl(kind: string, baseUrl?: string): string
 /** The provider identity a profile's credential is stored under, or null
  *  for an origin nobody recognizes (custom: env var only). */
 export declare function providerIdOf(kind: string, baseUrl?: string): string | null;
+/**
+ * 0.40.6 — the store id for a GATEWAY's own key: `endpoint:<origin>`.
+ *
+ * A vendor's credential is stored under the vendor and only ever reaches
+ * the vendor's origin (R1 above). A gateway has no vendor identity, so its
+ * key is stored under the one thing that names where it may go — its
+ * ORIGIN (scheme, host, port). `kiso login --endpoint <url>` writes it; a
+ * profile whose endpoint has exactly that origin reads it; no other origin
+ * ever does, a local forwarder in front of the gateway included. Null for
+ * anything that is not an http(s) URL — never a guess.
+ */
+export declare function endpointCredentialId(url: string | undefined): string | null;
 export declare function authPath(): string;
 export declare function readAuthFile(path?: string): AuthFile;
 export declare function getCredential(providerId: string, path?: string): Credential | undefined;

package/dist/auth/credentials.js

@@ -133,6 +133,31 @@ function originOf(baseUrl) {
         return null;
     }
 }
+/**
+ * 0.40.6 — the store id for a GATEWAY's own key: `endpoint:<origin>`.
+ *
+ * A vendor's credential is stored under the vendor and only ever reaches
+ * the vendor's origin (R1 above). A gateway has no vendor identity, so its
+ * key is stored under the one thing that names where it may go — its
+ * ORIGIN (scheme, host, port). `kiso login --endpoint <url>` writes it; a
+ * profile whose endpoint has exactly that origin reads it; no other origin
+ * ever does, a local forwarder in front of the gateway included. Null for
+ * anything that is not an http(s) URL — never a guess.
+ */
+export function endpointCredentialId(url) {
+    if (url === undefined)
+        return null;
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (u.protocol !== "https:" && u.protocol !== "http:")
+        return null;
+    return `endpoint:${u.origin}`;
+}
 export function authPath() {
     return join(kisoHome(), "auth.json");
 }

package/dist/chat.d.ts

@@ -87,10 +87,9 @@ export declare function statedContextWindow(of?: {
 /** CW-1: a window as the displays write it — `1M`, `1.05M`, `272K`,
  *  `1,048,576` (a figure that is not round is shown whole). */
 export declare function windowLabel(tokens: number): string;
-/** CW-1: the source, said. The short form rides a /model row; the long
- *  form is /status's. Only the model step is marked in the short form —
- *  it is the one figure no row states for this endpoint. */
-export declare function windowSourceNote(w: StatedWindow | null, form: "short" | "long"): string;
+/** CW-1: the window and its source, said — /status's line (0.40.6: the
+ *  short form that rode each /model row is gone with its caller). */
+export declare function windowSourceNote(w: StatedWindow | null): string;
 export declare function contextWindowTokens(of?: {
     readonly model: string;
     readonly baseUrl?: string;

package/dist/chat.js

@@ -14,8 +14,9 @@ import { canonicalizeUsage } from "@vincemakes/kiso-runtime";
 import { canonicalizeUsageForModel, requestBudget } from "@vincemakes/kiso-runtime/internal";
 import { dispatch, abortBangCommand } from "./dispatch.js";
 import { paintWindowTitle } from "./window-title.js";
-import { agentBaseUrl, agentModel, body, bodyLog, configuredWindow, dock, retryOnRow, retryShown, setRetryShown, floorOn, protectedFiles, upstreamOf } from "./state.js";
+import { agentBaseUrl, agentModel, body, bodyLog, configuredWindow, dock, retryOnRow, retryShown, setRetryShown, floorOn, protectedFiles, upstreamOf, VERSION } from "./state.js";
 import { attachImages } from "./attachments.js";
+import { installedVersion, staleVersionNotice } from "./stale-version.js";
 import { learnedWindowFor } from "./learned-windows.js";
 import { lookupContextWindow, lookupModelMetadata } from "@vincemakes/kiso-runtime/internal";
 import { addDontAskAgainRule, askPanel, fixHintFor, pendingAsk, resolveUncertains } from "./trust-ui.js";
@@ -121,15 +122,12 @@ export function windowLabel(tokens) {
         return `${tokens / 1000}K`;
     return tokens.toLocaleString("en-US");
 }
-/** CW-1: the source, said. The short form rides a /model row; the long
- *  form is /status's. Only the model step is marked in the short form —
- *  it is the one figure no row states for this endpoint. */
-export function windowSourceNote(w, form) {
+/** CW-1: the window and its source, said — /status's line (0.40.6: the
+ *  short form that rode each /model row is gone with its caller). */
+export function windowSourceNote(w) {
     if (w === null)
-        return form === "short" ? "ctx ?" : `window unknown — compaction assumes ${windowLabel(DEFAULT_CONTEXT_WINDOW)}; set contextWindow on the profile to state it`;
+        return `window unknown — compaction assumes ${windowLabel(DEFAULT_CONTEXT_WINDOW)}; set contextWindow on the profile to state it`;
     const size = windowLabel(w.tokens);
-    if (form === "short")
-        return w.source === "model" ? `ctx ${size} inferred` : `ctx ${size}`;
     switch (w.source) {
         case "set":
             return `window ${size}, as you set it`;
@@ -1365,6 +1363,12 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
                 stopSpinner();
                 paintIdle();
                 currentRun = null;
+                // 0.40.5: the kiso on disk may no longer be the one this
+                // session runs (an upgrade since it started) — said once per
+                // installed version (stale-version.ts).
+                const stale = staleVersionNotice(installedVersion(), VERSION, session.id);
+                if (stale !== null)
+                    body.notice(stale);
                 // round 8: a faux script that ran out of declared turns exits
                 // loudly with a non-zero status — never a silent status 0.
                 // round 4 (adversarial): the exhaustion is a CONTROLLED rejection of

package/dist/config.js

@@ -32,7 +32,7 @@ import { readFileSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { kisoHome } from "./state.js";
-import { AuthError, getCredential, providerIdOf } from "./auth/credentials.js";
+import { AuthError, effectiveBaseUrl, endpointCredentialId, getCredential, providerIdOf } from "./auth/credentials.js";
 import { BUILTIN_MANIFESTS } from "@vincemakes/kiso-runtime/internal";
 /** Header names a profile may not set: credentials (a key never lives in the
  *  config file) and the framing the adapter owns. */
@@ -294,12 +294,34 @@ export function authForProfile(name, p) {
     if (providerId !== null && !manifestTakesKey(providerId)) {
         throw new ConfigError(`model ${name}: unavailable — not signed in: run \`kiso login ${providerId}\` (this provider takes no API key)`);
     }
+    // 0.40.6: a GATEWAY's own key, stored for exactly this profile's origin
+    // (`kiso login --endpoint <url>`). The rule a vendor credential follows:
+    // stored first, the env var only when nothing is stored — and it goes to
+    // that origin alone (credentials.ts endpointCredentialId).
+    const endpointId = providerId === null ? endpointCredentialId(effectiveBaseUrl(p.kind, p.baseUrl)) : null;
+    if (endpointId !== null) {
+        let stored;
+        try {
+            stored = getCredential(endpointId);
+        }
+        catch (err) {
+            if (err instanceof AuthError)
+                throw new ConfigError(`model ${name}: ${err.message}`);
+            throw err;
+        }
+        if (stored?.type === "api-key")
+            return { type: "api-key", apiKey: stored.key, source: "store" };
+    }
     if (p.apiKeyEnv === undefined)
         return { type: "api-key", apiKey: "none", source: "none" };
     const fromEnv = process.env[p.apiKeyEnv];
     if (fromEnv !== undefined)
         return { type: "api-key", apiKey: fromEnv, source: "env" };
-    const hint = providerId !== null ? `run \`kiso login ${providerId}\` or set the env var ${p.apiKeyEnv}` : `set the env var ${p.apiKeyEnv}`;
+    const hint = providerId !== null
+        ? `run \`kiso login ${providerId}\` or set the env var ${p.apiKeyEnv}`
+        : endpointId !== null
+            ? `set the env var ${p.apiKeyEnv}, or run \`kiso login --endpoint ${endpointId.slice("endpoint:".length)}\``
+            : `set the env var ${p.apiKeyEnv}`;
     throw new ConfigError(`model ${name}: unavailable — no credential: ${hint} (configs never store keys, only the env-var name)`);
 }
 /** OR-2: does the provider's manifest admit an API key (or no auth at all)?

package/dist/dispatch.js

@@ -9,9 +9,14 @@ import { buildAdapter, lookupModelMetadata, resolveContinuationScope, resolveRea
 import { MODES, MODE_NOTE, OFFERED_MODES, getMode, setMode } from "./mode.js";
 import { clipboardWrite, lastAnswer } from "./clipboard.js";
 import { protectedBangReason, protectedShellVerdict } from "./protected-shell.js";
-import { agentBaseUrl, currentProfileName, setCurrentProfileName, currentModelName, agentModel, body, bodyLog, codingToolOptions, protectedFiles, kisoHome, configModels, dock, lastBinding, loadedSkillsCatalog, mergedConfig, readContextLedger, retryOnRow, sessionsDir, setAgentModel, setConfiguredWindow, setCurrentModelName, setModelChoice, setRetryShown, upstreamOf, setLastBinding } from "./state.js";
+import { agentBaseUrl, currentProfileName, setCurrentProfileName, currentModelName, agentModel, body, bodyLog, codingToolOptions, protectedFiles, kisoHome, configModels, dock, lastBinding, loadedSkillsCatalog, mergedConfig, readContextLedger, retryOnRow, sessionsDir, setAgentModel, setConfiguredWindow, setCurrentModelName, setModelChoice, setRetryShown, upstreamOf, VERSION, setLastBinding } from "./state.js";
 import { adapterOptionsFor } from "./auth/adapter-options.js";
 import { profileProviderLabel, providerLabel } from "./provider-label.js";
+import { installedVersion, versionStatusLine } from "./stale-version.js";
+import { preferences, setPreference } from "./preferences.js";
+import { settingsRows } from "./settings.js";
+import { floorOn, settingsLayers } from "./state.js";
+import { currentGround } from "@vincemakes/kiso-tui-cells/render";
 import { queuedSwitchLines } from "./state.js";
 import { contextWindowTokens, microcompactThresholdFor, startStatusSpinner, statedContextWindow, windowSourceNote } from "./chat.js";
 import { authForProfile, directWriteProfile, profileAvailable, resolveContextWindow, unavailableReason } from "./config.js";
@@ -109,14 +114,6 @@ function signInNote(p) {
     }
     return p.apiKeyEnv ?? "no key";
 }
-/** CW-1 (owner, 2026-09-23): a profile's window on its /model row — the
- *  profile's own stated figure first, then the registry's chain for its
- *  model, endpoint and upstream; `inferred` marks the one no row states
- *  for that endpoint. */
-function windowNoteOf(p) {
-    const w = statedContextWindow({ model: p.model, ...(p.baseUrl !== undefined ? { baseUrl: p.baseUrl } : {}), ...(p.upstream !== undefined ? { upstream: p.upstream } : {}) }, { configured: resolveContextWindow(mergedConfig, p) });
-    return windowSourceNote(w, "short");
-}
 /** The ONE dispatcher — slash commands, exit, and turns. The recovery
  *  replay routes through it too — a queued "/last" must never become a
  *  user turn (v2c: the rl lives in main, so lines arrive earlier and the
@@ -382,18 +379,15 @@ export function dispatch(line, ctx) {
         return;
     }
     if (trimmed === "\x14think") {
-        // §2.3 — ctrl+t folds the committed thinking blocks, and folds them
-        // back. DC-50's mechanism, not a second one: one boolean, then the
-        // session is reprinted, so the blocks already on screen obey the
-        // switch rather than only the next ones.
-        //
-        // The folded row is `foldThinking`'s, which is what the PIPE writes
-        // — so thinking has two renderings in the product and not three,
-        // and the pipe's byte-identity gate is this row's gate too.
-        //
-        // The live `thinking…` placeholder is NOT touched: it belongs to
-        // the live region, and this switch is about committed blocks.
+        // §2.3 / 0.40.6 — ctrl+t hides thinking (one italic line per block,
+        // the open one included) and shows it again. DC-50's mechanism: one
+        // boolean, then the session is reprinted, so the blocks already on
+        // screen obey the switch. The choice is REMEMBERED (preferences.json)
+        // — the owner, 2026-09-23, after the reference implementation's
+        // persisted toggle; shown stays the default. The pipe keeps its own
+        // one-line fold whatever the choice.
         body.toggleThinking();
+        setPreference("thinking", body.thinkingHidden() ? "hidden" : "shown");
         ctx.input.prompt();
         return;
     }
@@ -486,6 +480,31 @@ export function dispatch(line, ctx) {
         });
         return;
     }
+    if (trimmed === "/settings") {
+        // 0.40.6 — what kiso runs with, each value's layer, and how to change
+        // it (settings.ts). Read-only: the config file stays the human's.
+        ctx.chainRef.current = ctx.chainRef.current.then(async () => {
+            const w = statedContextWindow();
+            const profile = currentProfileName;
+            bodyLog(settingsRows({
+                user: settingsLayers.user,
+                project: settingsLayers.project,
+                env: process.env,
+                ...(settingsLayers.modeFlag !== undefined ? { modeFlag: settingsLayers.modeFlag } : {}),
+                ...(settingsLayers.modelFlag !== undefined ? { modelFlag: settingsLayers.modelFlag } : {}),
+                mode: getMode(),
+                model: { label: `${agentModel}${providerLabel(agentBaseUrl, upstreamOf(agentBaseUrl))}${profile === null ? "" : ` · profile ${profile}`}`, profile, switched: settingsLayers.modelSwitched },
+                ground: currentGround(),
+                floorOn,
+                window: windowSourceNote(w).replace(/^window /, ""),
+                thinkingHidden: body.thinkingHidden(),
+                thinkingRemembered: preferences().thinking !== undefined,
+                version: versionStatusLine(installedVersion(), VERSION).replace(/^version /, ""),
+            }).join("\n\n"), "words");
+            ctx.input.prompt();
+        });
+        return;
+    }
     if (trimmed === "/status") {
         // B area: session id, durable event count, and the ~ context
         // estimate — all read straight from the live session, nothing
@@ -498,7 +517,7 @@ export function dispatch(line, ctx) {
             // CW-1: the percentage names its denominator and who stated it — a
             // window inferred from the model reads differently from one the
             // registry states for this endpoint.
-            bodyLog(`ctx ${ctxPct} · ${windowSourceNote(statedContextWindow(), "long")}`);
+            bodyLog(`ctx ${ctxPct} · ${windowSourceNote(statedContextWindow())}`);
             // The owner, 2026-09-21: /status is where "what am I actually
             // running on" is answered, so the identity is spelled out HERE —
             // the model, the host the request goes to, the profile it came
@@ -514,6 +533,9 @@ export function dispatch(line, ctx) {
             // variable; until then, a label that cannot lie.)
             const profileOf = currentProfileName === null ? "" : ` · profile ${currentProfileName}`;
             bodyLog(`model ${agentModel}${providerLabel(agentBaseUrl, upstreamOf(agentBaseUrl))}${profileOf}`);
+            // 0.40.5: the version this session RUNS, and the installed one when
+            // an upgrade (or a rollback) since start-up made them differ.
+            bodyLog(versionStatusLine(installedVersion(), VERSION));
             ctx.input.prompt();
         });
         return;
@@ -618,9 +640,11 @@ export function dispatch(line, ctx) {
                             // profile key is what `/model <name>` takes, not what a chooser
                             // reading a list needs. What remains is what the chooser CANNOT
                             // infer: availability, and which one is live.
-                            // CW-1: the window rides LAST — availability and the live mark
-                            // are what a narrow row must keep.
-                            const marks = [...(profileAvailable(profile) ? [] : ["unavailable"]), ...(name === currentProfileName ? ["current"] : []), windowNoteOf(profile)];
+                            // 0.40.6 (the owner, 2026-09-23: "who told you to write ctx"):
+                            // the window rode here in 0.40.3–0.40.5 and cut `unavailable`
+                            // to `unavailabl…` on the owner's rows. It lives on /status and
+                            // /settings, where there is room to say it and its source.
+                            const marks = [...(profileAvailable(profile) ? [] : ["unavailable"]), ...(name === currentProfileName ? ["current"] : [])];
                             const host = profileProviderLabel(profile.kind, profile.baseUrl, profile.upstream);
                             return { label: `${profile.kind}/${profile.model}${host === "" ? "" : ` ${host}`}`, note: marks.join(" · "), ...effortAxis(profile) };
                         }),
@@ -672,7 +696,7 @@ export function dispatch(line, ctx) {
                     for (const name of names) {
                         const p = configModels[name];
                         const hostOf = profileProviderLabel(p.kind, p.baseUrl, p.upstream);
-                        bodyLog(`  ${name} → ${p.kind}/${p.model}${hostOf === "" ? "" : ` ${hostOf}`} · ${signInNote(p)} ${profileAvailable(p) ? "(available)" : "(unavailable)"} · ${effortNote(p)} · ${windowNoteOf(p)}`);
+                        bodyLog(`  ${name} → ${p.kind}/${p.model}${hostOf === "" ? "" : ` ${hostOf}`} · ${signInNote(p)} ${profileAvailable(p) ? "(available)" : "(unavailable)"} · ${effortNote(p)}`);
                     }
                 }
                 bodyLog("switch with /model <profile-name|provider/model>");
@@ -769,6 +793,7 @@ export function dispatch(line, ctx) {
                             setAgentModel(profile.model, profile.baseUrl);
                             setCurrentModelName(arg);
                             setCurrentProfileName(direct === null ? null : profName);
+                            settingsLayers.modelSwitched = true;
                             // §2.5: the ONE source a reload reads for the model — a
                             // switch made here must survive the rebuild.
                             setModelChoice(arg);

package/dist/index.js

@@ -53,6 +53,8 @@ import { isFirstRun, scaffoldFirstRun } from "./first-run.js";
 import { fauxSkip, readFauxScript } from "./faux-glue.js";
 import { chat, compactionDiscardedNotice, contextWindowTokens, displayCtxRatio, knownContextWindow, microcompactThresholdFor, statusModelLabel, unknownWindowNotice, windowLearnedNotice } from "./chat.js";
 import { recordLearnedWindow, useLearnedWindows } from "./learned-windows.js";
+import { preferences, usePreferences } from "./preferences.js";
+import { settingsLayers } from "./state.js";
 import { providerHost } from "./provider-label.js";
 import { adapterOptionsFor } from "./auth/adapter-options.js";
 import { loadProjectConfig, loadUserConfig, mergeConfigs, resolveAutoCompact, resolveContextWindow, resolveModel } from "./config.js";
@@ -759,6 +761,10 @@ async function makeAgent(sessionId, input, modelFlag) {
     const userCfg = loadUserConfig();
     const projectCfg = loadProjectConfig(process.cwd(), project !== null);
     const merged = mergeConfigs(userCfg, projectCfg);
+    // 0.40.6: /settings names each value's layer from these
+    settingsLayers.user = userCfg;
+    settingsLayers.project = projectCfg;
+    settingsLayers.modelFlag = modelFlag;
     const secretEnvNames = secretEnvNamesOf(merged.models ?? {});
     const builtIn = await builtInLayer(user, proj, input !== undefined && process.stdin.isTTY ? askUi(input) : undefined, secretEnvNames);
     setExtensionLists(builtIn, user, proj, [...builtIn, ...user, ...proj]);
@@ -1643,6 +1649,7 @@ async function main() {
             process.exit(2);
         }
         setMode(m);
+        settingsLayers.modeFlag = m;
         args.splice(modeFlag, 2);
     }
     else {
@@ -1790,6 +1797,10 @@ async function main() {
         editCol: () => dock.editCol(),
         onDock: () => dock.redraw(), // v2d-B: the freeze scrolls the dock up — re-pin it
     }));
+    // 0.40.6: the choices kiso remembers (preferences.json) — today ctrl+t's
+    // thinking display, restored before the first block can be drawn.
+    usePreferences();
+    body.setThinkingHidden(preferences().thinking === "hidden");
     // REL-0152-D11: pasting an image sends no bytes, so an empty paste is
     // the signal to go and look at the clipboard. What comes back is a
     // PATH, which the turn's attachment scan then picks up exactly as it
@@ -2001,8 +2012,33 @@ async function main() {
                 // `login <provider>` reads the key from a hidden prompt on a TTY
                 // or from stdin otherwise (never from an argument — shell history);
                 // `logout <provider>` deletes; `auth` lists, keys masked.
-                const { KNOWN_PROVIDERS, OAUTH_PROVIDERS, authPath, deleteCredential, maskSecret, readAuthFile, setCredential } = await import("./auth/credentials.js");
+                const { KNOWN_PROVIDERS, OAUTH_PROVIDERS, authPath, deleteCredential, endpointCredentialId, maskSecret, providerIdOf, readAuthFile, setCredential } = await import("./auth/credentials.js");
                 const provider = arg;
+                if (provider === "--endpoint" && command !== "auth") {
+                    // 0.40.6: a gateway's own key, stored for its ORIGIN and sent
+                    // there alone (credentials.ts endpointCredentialId) — so a
+                    // gateway profile starts from plain `kiso`, no env var on the
+                    // command line. The key still never comes from an argument.
+                    const url = args[2];
+                    const id = endpointCredentialId(url);
+                    if (id === null)
+                        throw new CliUsageError(`kiso ${command} --endpoint <url> — an http(s) URL, e.g. https://gateway.example/v1`);
+                    const origin = id.slice("endpoint:".length);
+                    const vendor = ["openai-compat", "anthropic", "openai-responses"].map((k) => providerIdOf(k, url)).find((v) => v !== null);
+                    if (vendor !== undefined && vendor !== null)
+                        throw new CliUsageError(`${origin} is ${vendor}'s own endpoint — run \`kiso ${command} ${vendor}\``);
+                    if (command === "logout") {
+                        const had = deleteCredential(id);
+                        process.stdout.write(had ? `removed the key for ${origin}\n` : `nothing stored for ${origin}\n`);
+                        break;
+                    }
+                    const key = (await readSecret(`API key for ${origin}: `)).trim();
+                    if (key === "")
+                        throw new CliUsageError(`kiso login --endpoint ${origin}: no key given`);
+                    setCredential(id, { type: "api-key", key, savedAt: Date.now() });
+                    process.stdout.write(`stored an API key for ${origin} (${maskSecret(key)}) in ${authPath()} — sent to that origin only; every profile whose baseUrl is on it uses this key before its env var\n`);
+                    break;
+                }
                 if (command === "auth") {
                     const file = readAuthFile();
                     const rows = Object.entries(file.credentials);
@@ -2019,7 +2055,7 @@ async function main() {
                     break;
                 }
                 if (provider === undefined || !KNOWN_PROVIDERS.includes(provider)) {
-                    throw new CliUsageError(`kiso ${command} <provider> — one of: ${KNOWN_PROVIDERS.join(", ")}`);
+                    throw new CliUsageError(`kiso ${command} <provider> — one of: ${KNOWN_PROVIDERS.join(", ")}; or kiso ${command} --endpoint <url> for a gateway`);
                 }
                 if (command === "logout") {
                     const had = deleteCredential(provider);
@@ -2096,7 +2132,8 @@ async function main() {
                     "  kiso sessions [--all|--current]   list durable sessions (a terminal shows this workspace's by default)\n" +
                     "  kiso login <provider>    anthropic|openai|deepseek|zai: store an API key (hidden prompt, or stdin when piped);\n" +
                     "                           chatgpt: sign in with a ChatGPT subscription (browser; unofficial third-party flow)\n" +
-                    "  kiso logout <provider>   remove the stored credential\n" +
+                    "  kiso login --endpoint <url>    a gateway: store its API key for that URL's origin only\n" +
+                    "  kiso logout <provider>   remove the stored credential (or --endpoint <url>)\n" +
                     "  kiso auth               list stored credentials (keys masked)\n" +
                     "  kiso update             install the latest release (npm i -g @vincemakes/kiso-code@latest)\n" +
                     "  kiso help               this help\n\n" +
@@ -2109,7 +2146,7 @@ async function main() {
                     "  OPENAI_API_KEY           OpenAI-compatible (OPENAI_MODEL, default gpt-4o;\n" +
                     "                           OPENAI_BASE_URL for DeepSeek/compat endpoints) — checked first\n" +
                     "  ANTHROPIC_API_KEY        Anthropic (ANTHROPIC_MODEL, default claude-sonnet-5)\n" +
-                    "  ~/.kiso/config.json      named model profiles (keys stay in env vars; see the README)\n");
+                    "  ~/.kiso/config.json      named model profiles (keys stay in env vars or kiso login; see the README)\n");
                 break;
             }
             case undefined:

package/dist/preferences.d.ts

@@ -0,0 +1,14 @@
+export interface Preferences {
+    /** ctrl+t: the thinking blocks as one italic line each. Absent = shown. */
+    readonly thinking?: "shown" | "hidden";
+}
+export declare function preferencesPath(home?: string): string;
+/** Startup: read the file, and keep choices made from here on in it. */
+export declare function usePreferences(path?: string): void;
+/** The remembered choices; empty before startup names the file. */
+export declare function preferences(): Preferences;
+/** Remember a choice. Returns false when no file was named. The file is
+ *  re-read before the write, so another process's choice is kept. */
+export declare function setPreference<K extends keyof Preferences>(key: K, value: NonNullable<Preferences[K]>): boolean;
+/** Tests: back to the state before startup. */
+export declare function resetPreferences(): void;

package/dist/preferences.js

@@ -0,0 +1,64 @@
+/**
+ * 0.40.6 — the choices kiso remembers for you, in
+ * `<KISO_HOME>/preferences.json`.
+ *
+ * `config.json` is the human's file: kiso reads it and never writes it. A
+ * choice made with a key — ctrl+t's thinking display, today the only one —
+ * has to survive a restart, so it lands here instead: kiso-owned, private
+ * (0600, tmp + rename), and read back at start-up. A missing or unreadable
+ * file is an empty one; an unknown value is ignored rather than guessed.
+ *
+ * Nothing is read until the CLI's startup names the file
+ * (`usePreferences`) — the same rule as learned-windows.ts, so in-process
+ * tests never read a home directory.
+ */
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { kisoHome } from "./state.js";
+let prefs = null;
+let prefsPath = null;
+export function preferencesPath(home = kisoHome()) {
+    return join(home, "preferences.json");
+}
+function read(path) {
+    try {
+        const raw = JSON.parse(readFileSync(path, "utf8"));
+        return raw.thinking === "shown" || raw.thinking === "hidden" ? { thinking: raw.thinking } : {};
+    }
+    catch {
+        return {};
+    }
+}
+/** Startup: read the file, and keep choices made from here on in it. */
+export function usePreferences(path = preferencesPath()) {
+    prefsPath = path;
+    prefs = read(path);
+}
+/** The remembered choices; empty before startup names the file. */
+export function preferences() {
+    return prefs ?? {};
+}
+/** Remember a choice. Returns false when no file was named. The file is
+ *  re-read before the write, so another process's choice is kept. */
+export function setPreference(key, value) {
+    const path = prefsPath;
+    if (path === null)
+        return false;
+    const next = { ...read(path), [key]: value };
+    prefs = next;
+    try {
+        mkdirSync(dirname(path), { recursive: true });
+        const tmp = `${path}.${process.pid}.tmp`;
+        writeFileSync(tmp, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
+        renameSync(tmp, path);
+    }
+    catch {
+        // an unwritable home: the choice still holds for this process
+    }
+    return true;
+}
+/** Tests: back to the state before startup. */
+export function resetPreferences() {
+    prefs = null;
+    prefsPath = null;
+}

package/dist/settings.d.ts

@@ -0,0 +1,37 @@
+/**
+ * 0.40.6 — `/settings`: what kiso is running with, where each value came
+ * from, and how to change it.
+ *
+ * The owner, 2026-09-23, asked whether kiso has a help for what can be
+ * configured. `/help` lists the commands and `?` the keys; the settings
+ * lived only in docs/configuration.md and in files the user had to open.
+ *
+ * READ-ONLY by design: the config file stays the human's. The layers are
+ * the documented precedence — flag > env > project config > user config >
+ * default — and a value that no layer explains was set in this session
+ * (`/mode`, `/model`). Pure: every input is passed in, so each row is
+ * testable without a session.
+ */
+import type { KisoConfig } from "./config.js";
+export interface SettingsInput {
+    readonly user: KisoConfig | null;
+    readonly project: KisoConfig | null;
+    readonly env: Readonly<Record<string, string | undefined>>;
+    /** the --mode / --model values on the command line, when given */
+    readonly modeFlag?: string;
+    readonly modelFlag?: string;
+    /** what is live now */
+    readonly mode: string;
+    readonly model: {
+        readonly label: string;
+        readonly profile: string | null;
+        readonly switched: boolean;
+    };
+    readonly ground: string;
+    readonly floorOn: boolean;
+    readonly window: string;
+    readonly thinkingHidden: boolean;
+    readonly thinkingRemembered: boolean;
+    readonly version: string;
+}
+export declare function settingsRows(i: SettingsInput): string[];

package/dist/settings.js

@@ -0,0 +1,79 @@
+function modeRow(i) {
+    const change = "/mode or shift+tab; \"mode\" in ~/.kiso/config.json";
+    const from = i.modeFlag === i.mode
+        ? "--mode"
+        : i.env.KISO_MODE === i.mode
+            ? "env KISO_MODE"
+            : i.project?.mode === i.mode
+                ? "project config"
+                : i.user?.mode === i.mode
+                    ? "user config"
+                    : i.mode === "default"
+                        ? "default"
+                        : "set in this session";
+    return { name: "mode", value: i.mode, from, change };
+}
+function modelRow(i) {
+    const change = "/model; \"model\" in ~/.kiso/config.json";
+    const p = i.model.profile;
+    const from = i.model.switched
+        ? "set in this session"
+        : i.modelFlag !== undefined
+            ? "--model"
+            : p !== null && i.project?.model === p
+                ? "project config"
+                : p !== null && i.user?.model === p
+                    ? "user config"
+                    : i.env.OPENAI_API_KEY !== undefined && p === null
+                        ? "env OPENAI_API_KEY"
+                        : "default";
+    return { name: "model", value: i.model.label, from, change };
+}
+function themeRow(i) {
+    const change = "\"theme\": \"dark\" | \"light\" in ~/.kiso/config.json; KISO_THEME for one run";
+    if (i.env.KISO_THEME !== undefined)
+        return { name: "theme", value: i.env.KISO_THEME, from: "env KISO_THEME", change };
+    if (i.user?.theme !== undefined)
+        return { name: "theme", value: i.user.theme, from: "user config", change };
+    return { name: "theme", value: i.ground, from: "the terminal (detected)", change };
+}
+function layered(i, key) {
+    if (i.project?.[key] !== undefined)
+        return { value: i.project[key], from: "project config" };
+    if (i.user?.[key] !== undefined)
+        return { value: i.user[key], from: "user config" };
+    return { value: undefined, from: "default" };
+}
+export function settingsRows(i) {
+    const trust = layered(i, "projectTrust");
+    const auto = i.env.KISO_AUTO_COMPACT !== undefined ? { value: i.env.KISO_AUTO_COMPACT, from: "env KISO_AUTO_COMPACT" } : layered(i, "autoCompact");
+    const rows = [
+        modelRow(i),
+        modeRow(i),
+        themeRow(i),
+        {
+            name: "floor",
+            value: i.floorOn ? "on — irrecoverable deletes are refused in every mode" : "off",
+            from: i.user?.floor !== undefined ? "user config" : "default",
+            change: "\"floor\": \"off\" in ~/.kiso/config.json (user config only)",
+        },
+        { name: "window", value: i.window, from: "the window chain (see /status)", change: "\"contextWindow\" on the profile; KISO_CONTEXT_WINDOW for one run" },
+        { name: "compaction", value: "in-run: past half the window at a phase end, past 80% at once", from: "built in", change: "/compact on demand" },
+        {
+            name: "auto-compact",
+            value: auto.value === undefined ? "off" : typeof auto.value === "object" ? `at ${auto.value.thresholdRatio} of the window, at a run's start` : String(auto.value),
+            from: auto.from,
+            change: "\"autoCompact\" in config; KISO_AUTO_COMPACT",
+        },
+        { name: "project trust", value: trust.value ?? "ask", from: trust.from, change: "\"projectTrust\": \"ask\" | \"never\" in config" },
+        {
+            name: "thinking",
+            value: i.thinkingHidden ? "hidden — one line per block" : "shown",
+            from: i.thinkingRemembered ? "ctrl+t (remembered)" : "default",
+            change: "ctrl+t",
+        },
+        { name: "version", value: i.version, from: "running", change: "kiso update" },
+    ];
+    const width = Math.max(...rows.map((r) => r.name.length)) + 2;
+    return rows.map((r) => `${r.name.padEnd(width)}${r.value}\n${" ".repeat(width)}from ${r.from} · change: ${r.change}`);
+}

package/dist/stale-version.d.ts

@@ -0,0 +1,14 @@
+/** The version of the kiso installed where this one was loaded from, read
+ *  now — null on any failure, never a guess. KISO_INSTALLED_PACKAGE_JSON
+ *  names another file: the test rigs' knob (like KISO_FAUX_SCRIPT), so an
+ *  end-to-end run can "upgrade" underneath a live session without touching
+ *  the checkout's own package.json. */
+export declare function installedVersion(pkgPath?: string): string | null;
+/** The transcript notice, once per installed version that differs from the
+ *  running one (a newer install, or a rollback); null otherwise. */
+export declare function staleVersionNotice(installed: string | null, running: string, sessionId: string): string | null;
+/** /status's version line: the running version, and the installed one when
+ *  they differ. */
+export declare function versionStatusLine(installed: string | null, running: string): string;
+/** Tests: forget which version was noticed. */
+export declare function resetStaleVersionNotice(): void;

package/dist/stale-version.js

@@ -0,0 +1,52 @@
+/**
+ * 0.40.5 — a session says when the kiso on disk is not the kiso it runs.
+ *
+ * The owner, 2026-09-23: "I am on 0.40.3 — why does edit_file still fail?"
+ * The session's process had started at 13:03 on 0.40.2; 0.40.3 was
+ * installed at ~14:05. The process kept the code it loaded, so its
+ * edit_file still refused overlapping hunks, while `kiso --version` in
+ * another shell printed the version ON DISK. Nothing in the session said
+ * otherwise. A process that loads a module lazily after an upgrade (a
+ * provider on its first /model switch) would also mix the new version with
+ * the old — the notice is the cue to restart before that.
+ *
+ * `VERSION` (state.ts) is read once at start-up from the package.json next
+ * to the build; a global install replaces that file, so reading it AGAIN
+ * sees what a new start would run. One small read per turn and per
+ * /status; no timer, no watcher, no network.
+ */
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+/** The version of the kiso installed where this one was loaded from, read
+ *  now — null on any failure, never a guess. KISO_INSTALLED_PACKAGE_JSON
+ *  names another file: the test rigs' knob (like KISO_FAUX_SCRIPT), so an
+ *  end-to-end run can "upgrade" underneath a live session without touching
+ *  the checkout's own package.json. */
+export function installedVersion(pkgPath = process.env.KISO_INSTALLED_PACKAGE_JSON ?? join(dirname(fileURLToPath(import.meta.url)), "..", "package.json")) {
+    try {
+        const v = JSON.parse(readFileSync(pkgPath, "utf8")).version;
+        return typeof v === "string" && v !== "" ? v : null;
+    }
+    catch {
+        return null;
+    }
+}
+let lastNoticed = null;
+/** The transcript notice, once per installed version that differs from the
+ *  running one (a newer install, or a rollback); null otherwise. */
+export function staleVersionNotice(installed, running, sessionId) {
+    if (installed === null || installed === running || running === "?" || installed === lastNoticed)
+        return null;
+    lastNoticed = installed;
+    return `✦ kiso ${installed} is installed — this session runs ${running}; exit and resume it (kiso resume ${sessionId}) to use it`;
+}
+/** /status's version line: the running version, and the installed one when
+ *  they differ. */
+export function versionStatusLine(installed, running) {
+    return installed === null || installed === running ? `version ${running}` : `version ${running} (running) · ${installed} installed — restart to use it`;
+}
+/** Tests: forget which version was noticed. */
+export function resetStaleVersionNotice() {
+    lastNoticed = null;
+}

package/dist/state.d.ts

@@ -295,6 +295,16 @@ export declare const queuedSwitchLines: string[];
 /** E1: the extensions loaded by makeAgent — their names feed the banner. */
 /** 0.40.0: whether the catastrophe floor is on (floor.ts) — the user
  *  config's `floor`, read where the chain is assembled. */
+/** 0.40.6: what /settings needs to name each value's layer — the two config
+ *  files as read, the command-line flags as given, and whether /model
+ *  changed the binding in this session. */
+export declare const settingsLayers: {
+    user: import("./config.js").KisoConfig | null;
+    project: import("./config.js").KisoConfig | null;
+    modeFlag: string | undefined;
+    modelFlag: string | undefined;
+    modelSwitched: boolean;
+};
 export declare let floorOn: boolean;
 export declare function setFloorOn(value: boolean): void;
 /** 0.40.0: the calls a saved allow never carries (protected-writes.ts) —

package/dist/state.js

@@ -397,6 +397,10 @@ export const queuedSwitchLines = [];
 /** E1: the extensions loaded by makeAgent — their names feed the banner. */
 /** 0.40.0: whether the catastrophe floor is on (floor.ts) — the user
  *  config's `floor`, read where the chain is assembled. */
+/** 0.40.6: what /settings needs to name each value's layer — the two config
+ *  files as read, the command-line flags as given, and whether /model
+ *  changed the binding in this session. */
+export const settingsLayers = { user: null, project: null, modeFlag: undefined, modelFlag: undefined, modelSwitched: false };
 export let floorOn = true;
 export function setFloorOn(value) {
     floorOn = value;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@vincemakes/kiso-code",
-	"version": "0.40.4",
+	"version": "0.40.6",
 	"description": "kiso-code \u2014 the coding agent on kiso, the durable runtime for AI agents: kiso chat / kiso resume / kiso sessions.",
 	"type": "module",
 	"license": "MIT",
@@ -18,20 +18,20 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@vincemakes/kiso-ask-ext": "0.40.4",
-		"@vincemakes/kiso-core": "0.40.4",
-		"@vincemakes/kiso-evals": "0.40.4",
-		"@vincemakes/kiso-mcp-ext": "0.40.4",
-		"@vincemakes/kiso-provider-anthropic": "0.40.4",
-		"@vincemakes/kiso-provider-openai": "0.40.4",
-		"@vincemakes/kiso-provider-openai-responses": "0.40.4",
-		"@vincemakes/kiso-runtime": "0.40.4",
-		"@vincemakes/kiso-skills-ext": "0.40.4",
-		"@vincemakes/kiso-subagent-ext": "0.40.4",
-		"@vincemakes/kiso-task-ext": "0.40.4",
-		"@vincemakes/kiso-tools-node": "0.40.4",
-		"@vincemakes/kiso-tui": "0.40.4",
-		"@vincemakes/kiso-tui-cells": "0.40.4"
+		"@vincemakes/kiso-ask-ext": "0.40.6",
+		"@vincemakes/kiso-core": "0.40.6",
+		"@vincemakes/kiso-evals": "0.40.6",
+		"@vincemakes/kiso-mcp-ext": "0.40.6",
+		"@vincemakes/kiso-provider-anthropic": "0.40.6",
+		"@vincemakes/kiso-provider-openai": "0.40.6",
+		"@vincemakes/kiso-provider-openai-responses": "0.40.6",
+		"@vincemakes/kiso-runtime": "0.40.6",
+		"@vincemakes/kiso-skills-ext": "0.40.6",
+		"@vincemakes/kiso-subagent-ext": "0.40.6",
+		"@vincemakes/kiso-task-ext": "0.40.6",
+		"@vincemakes/kiso-tools-node": "0.40.6",
+		"@vincemakes/kiso-tui": "0.40.6",
+		"@vincemakes/kiso-tui-cells": "0.40.6"
 	},
 	"devDependencies": {
 		"@types/node": "^26.1.2",