@vincemakes/kiso-code 0.40.5 → 0.40.7

package/dist/auth/credentials.d.ts

@@ -10,6 +10,10 @@ export type Credential = {
     readonly expires: number;
     readonly accountId?: string;
     readonly savedAt: number;
+    /** 0.40.7: when the token endpoint REFUSED this credential's
+     *  refresh token. Set only by that refusal (never by a network
+     *  failure); a new login replaces the whole entry and so clears it. */
+    readonly refreshRejectedAt?: number;
 };
 export interface AuthFile {
     readonly version: 1;
@@ -49,6 +53,18 @@ export declare function effectiveBaseUrl(kind: string, baseUrl?: string): string
 /** The provider identity a profile's credential is stored under, or null
  *  for an origin nobody recognizes (custom: env var only). */
 export declare function providerIdOf(kind: string, baseUrl?: string): string | null;
+/**
+ * 0.40.6 — the store id for a GATEWAY's own key: `endpoint:<origin>`.
+ *
+ * A vendor's credential is stored under the vendor and only ever reaches
+ * the vendor's origin (R1 above). A gateway has no vendor identity, so its
+ * key is stored under the one thing that names where it may go — its
+ * ORIGIN (scheme, host, port). `kiso login --endpoint <url>` writes it; a
+ * profile whose endpoint has exactly that origin reads it; no other origin
+ * ever does, a local forwarder in front of the gateway included. Null for
+ * anything that is not an http(s) URL — never a guess.
+ */
+export declare function endpointCredentialId(url: string | undefined): string | null;
 export declare function authPath(): string;
 export declare function readAuthFile(path?: string): AuthFile;
 export declare function getCredential(providerId: string, path?: string): Credential | undefined;

package/dist/auth/credentials.js

@@ -133,6 +133,31 @@ function originOf(baseUrl) {
         return null;
     }
 }
+/**
+ * 0.40.6 — the store id for a GATEWAY's own key: `endpoint:<origin>`.
+ *
+ * A vendor's credential is stored under the vendor and only ever reaches
+ * the vendor's origin (R1 above). A gateway has no vendor identity, so its
+ * key is stored under the one thing that names where it may go — its
+ * ORIGIN (scheme, host, port). `kiso login --endpoint <url>` writes it; a
+ * profile whose endpoint has exactly that origin reads it; no other origin
+ * ever does, a local forwarder in front of the gateway included. Null for
+ * anything that is not an http(s) URL — never a guess.
+ */
+export function endpointCredentialId(url) {
+    if (url === undefined)
+        return null;
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (u.protocol !== "https:" && u.protocol !== "http:")
+        return null;
+    return `endpoint:${u.origin}`;
+}
 export function authPath() {
     return join(kisoHome(), "auth.json");
 }

package/dist/auth/oauth/chatgpt.d.ts

@@ -1,4 +1,4 @@
-import type { OAuthCredential, OAuthFlow } from "./index.js";
+import { type OAuthCredential, type OAuthFlow } from "./index.js";
 export declare const CHATGPT: {
     readonly providerId: "chatgpt";
     readonly clientId: "app_EMoamEEZ73f0CkXaXp7hrann";

package/dist/auth/oauth/chatgpt.js

@@ -17,6 +17,7 @@
  * endpoint — the Responses adapter is the second half of this step.
  */
 import { createServer } from "node:http";
+import { RefreshRejectedError } from "./index.js";
 import { generatePkce, randomState } from "./pkce.js";
 export const CHATGPT = {
     providerId: "chatgpt",
@@ -86,7 +87,11 @@ export function accountIdOf(accessToken) {
 async function readTokenResponse(response, operation) {
     if (!response.ok) {
         const text = await response.text().catch(() => "");
-        throw new Error(`ChatGPT sign-in: token ${operation} failed (${response.status})${text ? `: ${text.slice(0, 200)}` : ""}`);
+        const message = `ChatGPT sign-in: token ${operation} failed (${response.status})${text ? `: ${text.slice(0, 200)}` : ""}`;
+        // the endpoint's own refusal of the refresh token — the sign-in is over
+        if (operation === "refresh" && (response.status === 400 || response.status === 401))
+            throw new RefreshRejectedError(message);
+        throw new Error(message);
     }
     const json = (await response.json());
     if (typeof json.access_token !== "string" || typeof json.refresh_token !== "string" || typeof json.expires_in !== "number") {

package/dist/auth/oauth/index.d.ts

@@ -8,6 +8,14 @@ import type { Credential } from "../credentials.js";
 export type OAuthCredential = Extract<Credential, {
     type: "oauth";
 }>;
+/**
+ * 0.40.7 — a refresh the token endpoint REFUSED (400 / 401: the refresh
+ * token was revoked or has expired), as distinct from one that never got an
+ * answer. Only this marks a sign-in dead (`refreshRejectedAt`); a network
+ * failure leaves the credential as it was, to be tried again.
+ */
+export declare class RefreshRejectedError extends Error {
+}
 export interface LoginInteraction {
     /** Print a line for the person signing in (the URL to open, the paste prompt). */
     readonly notify: (line: string) => void;

package/dist/auth/oauth/index.js

@@ -1 +1,8 @@
-export {};
+/**
+ * 0.40.7 — a refresh the token endpoint REFUSED (400 / 401: the refresh
+ * token was revoked or has expired), as distinct from one that never got an
+ * answer. Only this marks a sign-in dead (`refreshRejectedAt`); a network
+ * failure leaves the credential as it was, to be tried again.
+ */
+export class RefreshRejectedError extends Error {
+}

package/dist/auth/refresh.d.ts

@@ -7,6 +7,6 @@
  * never a silent fall back to an API key or an env var.
  */
 import { type Credential } from "./credentials.js";
-import type { OAuthFlow } from "./oauth/index.js";
+import { type OAuthFlow } from "./oauth/index.js";
 export declare const FRESH_WINDOW_MS: number;
 export declare function ensureFresh(providerId: string, flow: OAuthFlow, path?: string, now?: number, tokenUrl?: string): Promise<Credential>;

package/dist/auth/refresh.js

@@ -7,6 +7,7 @@
  * never a silent fall back to an API key or an env var.
  */
 import { AuthError, modifyAuthFile, readAuthFile } from "./credentials.js";
+import { RefreshRejectedError } from "./oauth/index.js";
 export const FRESH_WINDOW_MS = 5 * 60_000;
 export async function ensureFresh(providerId, flow, path, now = Date.now(), tokenUrl) {
     const current = readAuthFile(path).credentials[providerId];
@@ -14,6 +15,10 @@ export async function ensureFresh(providerId, flow, path, now = Date.now(), toke
         throw new AuthError(`not signed in to ${providerId}: run \`kiso login ${providerId}\``);
     if (current.type !== "oauth" || current.expires - now > FRESH_WINDOW_MS)
         return current;
+    // 0.40.7: a refresh token the endpoint already refused is not sent again —
+    // the answer would be the same refusal, one round trip later
+    if (current.refreshRejectedAt !== undefined)
+        throw new AuthError(`signed out of ${providerId} (the sign-in was refused when kiso tried to renew it) — run \`kiso login ${providerId}\``);
     let refreshed;
     let error;
     // the double check: another process may have refreshed while we waited for the lock
@@ -26,8 +31,22 @@ export async function ensureFresh(providerId, flow, path, now = Date.now(), toke
     catch (err) {
         error = err instanceof Error ? err : new Error(String(err));
     }
-    if (refreshed === undefined)
+    if (refreshed === undefined) {
+        // 0.40.7: the endpoint's REFUSAL is remembered on the credential, so
+        // /model can say the sign-in is over before a turn finds out. The
+        // same generation rule as the write-back below (R2a): a logout or a
+        // new login while the refresh was on the wire is left alone.
+        if (error instanceof RefreshRejectedError) {
+            const began = current;
+            modifyAuthFile((file) => {
+                const latest = file.credentials[providerId];
+                if (latest === undefined || latest.type !== "oauth" || latest.refresh !== began.refresh || latest.expires !== began.expires)
+                    return file;
+                return { version: 1, credentials: { ...file.credentials, [providerId]: { ...latest, refreshRejectedAt: now } } };
+            }, path);
+        }
         throw new AuthError(`signed out of ${providerId} (the token could not be refreshed: ${error?.message ?? "unknown"}) — run \`kiso login ${providerId}\``);
+    }
     const written = refreshed;
     // R2a — THE WRITE-BACK MAY NOT RESURRECT WHAT THE HUMAN REMOVED.
     //

package/dist/chat.d.ts

@@ -87,10 +87,9 @@ export declare function statedContextWindow(of?: {
 /** CW-1: a window as the displays write it — `1M`, `1.05M`, `272K`,
  *  `1,048,576` (a figure that is not round is shown whole). */
 export declare function windowLabel(tokens: number): string;
-/** CW-1: the source, said. The short form rides a /model row; the long
- *  form is /status's. Only the model step is marked in the short form —
- *  it is the one figure no row states for this endpoint. */
-export declare function windowSourceNote(w: StatedWindow | null, form: "short" | "long"): string;
+/** CW-1: the window and its source, said — /status's line (0.40.6: the
+ *  short form that rode each /model row is gone with its caller). */
+export declare function windowSourceNote(w: StatedWindow | null): string;
 export declare function contextWindowTokens(of?: {
     readonly model: string;
     readonly baseUrl?: string;

package/dist/chat.js

@@ -122,15 +122,12 @@ export function windowLabel(tokens) {
         return `${tokens / 1000}K`;
     return tokens.toLocaleString("en-US");
 }
-/** CW-1: the source, said. The short form rides a /model row; the long
- *  form is /status's. Only the model step is marked in the short form —
- *  it is the one figure no row states for this endpoint. */
-export function windowSourceNote(w, form) {
+/** CW-1: the window and its source, said — /status's line (0.40.6: the
+ *  short form that rode each /model row is gone with its caller). */
+export function windowSourceNote(w) {
     if (w === null)
-        return form === "short" ? "ctx ?" : `window unknown — compaction assumes ${windowLabel(DEFAULT_CONTEXT_WINDOW)}; set contextWindow on the profile to state it`;
+        return `window unknown — compaction assumes ${windowLabel(DEFAULT_CONTEXT_WINDOW)}; set contextWindow on the profile to state it`;
     const size = windowLabel(w.tokens);
-    if (form === "short")
-        return w.source === "model" ? `ctx ${size} inferred` : `ctx ${size}`;
     switch (w.source) {
         case "set":
             return `window ${size}, as you set it`;

package/dist/config.d.ts

@@ -118,6 +118,13 @@ export interface KisoConfig {
      *  in the child's worktree. A model never supplies a command; it names
      *  one of these. `{ "test": "npm test", "lint": "npm run lint" }`. */
     readonly checks?: Readonly<Record<string, string>>;
+    /** CS-1 (0.40.7): the evaluator scripts a delegated task may name —
+     *  absolute paths, `["/abs/path/to/evaluate.sh"]`. The PARENT runs the
+     *  one a task names with the child's worktree as its argument. A path
+     *  the user did not list is refused: the model chooses the task, so an
+     *  unlisted path could be an interpreter running code the child wrote.
+     *  Same layers as `checks`. */
+    readonly evaluators?: readonly string[];
 }
 /** The resolved, merged config — project wins over user, both validated. */
 export interface ResolvedConfig {
@@ -145,7 +152,8 @@ export type ProfileAuth = {
     readonly source: "store" | "env" | "none";
 } | {
     readonly type: "oauth";
-    readonly providerId: string;
+    readonly providerId: string; /** the access token's expiry (epoch ms) — past it, the next use renews */
+    readonly expires?: number;
 };
 /** Where a profile's sign-in comes from, or why it has none. The sign-in
  *  plan's resolve rule: a stored credential OWNS the provider (an

package/dist/config.js

@@ -32,7 +32,7 @@ import { readFileSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { kisoHome } from "./state.js";
-import { AuthError, getCredential, providerIdOf } from "./auth/credentials.js";
+import { AuthError, effectiveBaseUrl, endpointCredentialId, getCredential, providerIdOf } from "./auth/credentials.js";
 import { BUILTIN_MANIFESTS } from "@vincemakes/kiso-runtime/internal";
 /** Header names a profile may not set: credentials (a key never lives in the
  *  config file) and the framing the adapter owns. */
@@ -130,6 +130,15 @@ export function parseConfig(text, source) {
         }
         out.checks = obj.checks;
     }
+    if (obj.evaluators !== undefined) {
+        if (!Array.isArray(obj.evaluators))
+            fail("evaluators", "expected a list of absolute paths to evaluator scripts");
+        for (const path of obj.evaluators) {
+            if (typeof path !== "string" || !path.startsWith("/"))
+                fail("evaluators", `expected an absolute path, got ${JSON.stringify(path)}`);
+        }
+        out.evaluators = obj.evaluators;
+    }
     if (obj.model !== undefined) {
         if (typeof obj.model !== "string" || obj.model === "")
             fail("model", "expected a profile name or provider/model string");
@@ -253,6 +262,8 @@ export function mergeConfigs(user, project) {
         ...(p.projectTrust !== undefined ? { projectTrust: p.projectTrust } : {}),
         // DT-1a: checks merge per name — a (trusted) project's check wins over the user's
         ...(u.checks !== undefined || p.checks !== undefined ? { checks: { ...(u.checks ?? {}), ...(p.checks ?? {}) } } : {}),
+        // CS-1: the evaluator lists join — either layer's script may be named
+        ...(u.evaluators !== undefined || p.evaluators !== undefined ? { evaluators: [...(u.evaluators ?? []), ...(p.evaluators ?? [])] } : {}),
     };
 }
 /** Where a profile's sign-in comes from, or why it has none. The sign-in
@@ -280,8 +291,14 @@ export function authForProfile(name, p) {
         if (stored !== undefined) {
             if (stored.type === "api-key")
                 return { type: "api-key", apiKey: stored.key, source: "store" };
-            if (p.kind === "openai-responses")
-                return { type: "oauth", providerId };
+            if (p.kind === "openai-responses") {
+                // 0.40.7: a sign-in whose renewal the endpoint REFUSED is over —
+                // unavailable here, where /model reads it, not first at a turn
+                if (stored.refreshRejectedAt !== undefined) {
+                    throw new ConfigError(`model ${name}: unavailable — the ${providerId} sign-in was refused when kiso tried to renew it: run \`kiso login ${providerId}\``);
+                }
+                return { type: "oauth", providerId, expires: stored.expires };
+            }
             throw new ConfigError(`model ${name}: signed in to ${providerId} with OAuth, but this profile's adapter needs an API key — run \`kiso login ${providerId}\` with a key, or \`kiso logout ${providerId}\` to use the env var ${p.apiKeyEnv ?? "(none configured)"}`);
         }
     }
@@ -294,12 +311,34 @@ export function authForProfile(name, p) {
     if (providerId !== null && !manifestTakesKey(providerId)) {
         throw new ConfigError(`model ${name}: unavailable — not signed in: run \`kiso login ${providerId}\` (this provider takes no API key)`);
     }
+    // 0.40.6: a GATEWAY's own key, stored for exactly this profile's origin
+    // (`kiso login --endpoint <url>`). The rule a vendor credential follows:
+    // stored first, the env var only when nothing is stored — and it goes to
+    // that origin alone (credentials.ts endpointCredentialId).
+    const endpointId = providerId === null ? endpointCredentialId(effectiveBaseUrl(p.kind, p.baseUrl)) : null;
+    if (endpointId !== null) {
+        let stored;
+        try {
+            stored = getCredential(endpointId);
+        }
+        catch (err) {
+            if (err instanceof AuthError)
+                throw new ConfigError(`model ${name}: ${err.message}`);
+            throw err;
+        }
+        if (stored?.type === "api-key")
+            return { type: "api-key", apiKey: stored.key, source: "store" };
+    }
     if (p.apiKeyEnv === undefined)
         return { type: "api-key", apiKey: "none", source: "none" };
     const fromEnv = process.env[p.apiKeyEnv];
     if (fromEnv !== undefined)
         return { type: "api-key", apiKey: fromEnv, source: "env" };
-    const hint = providerId !== null ? `run \`kiso login ${providerId}\` or set the env var ${p.apiKeyEnv}` : `set the env var ${p.apiKeyEnv}`;
+    const hint = providerId !== null
+        ? `run \`kiso login ${providerId}\` or set the env var ${p.apiKeyEnv}`
+        : endpointId !== null
+            ? `set the env var ${p.apiKeyEnv}, or run \`kiso login --endpoint ${endpointId.slice("endpoint:".length)}\``
+            : `set the env var ${p.apiKeyEnv}`;
     throw new ConfigError(`model ${name}: unavailable — no credential: ${hint} (configs never store keys, only the env-var name)`);
 }
 /** OR-2: does the provider's manifest admit an API key (or no auth at all)?

package/dist/dispatch.js

@@ -13,6 +13,10 @@ import { agentBaseUrl, currentProfileName, setCurrentProfileName, currentModelNa
 import { adapterOptionsFor } from "./auth/adapter-options.js";
 import { profileProviderLabel, providerLabel } from "./provider-label.js";
 import { installedVersion, versionStatusLine } from "./stale-version.js";
+import { preferences, setPreference } from "./preferences.js";
+import { settingsRows } from "./settings.js";
+import { floorOn, settingsLayers } from "./state.js";
+import { currentGround } from "@vincemakes/kiso-tui-cells/render";
 import { queuedSwitchLines } from "./state.js";
 import { contextWindowTokens, microcompactThresholdFor, startStatusSpinner, statedContextWindow, windowSourceNote } from "./chat.js";
 import { authForProfile, directWriteProfile, profileAvailable, resolveContextWindow, unavailableReason } from "./config.js";
@@ -97,27 +101,37 @@ function effortAxis(p) {
             : {}),
     };
 }
-/** What signs a profile in, for the listing: the env var's name, `oauth`
- *  for a subscription sign-in, or `no key` for an unauthenticated endpoint. */
+/** What signs a profile in, for the listing: `stored key` when a key in
+ *  auth.json pays (a vendor's, or a gateway's `kiso login --endpoint`),
+ *  `oauth` for a subscription sign-in, else the env var's name, or `no key`
+ *  for an unauthenticated endpoint.
+ *
+ *  0406-F1: this named the env var whenever a profile had one, so a row
+ *  paid by the stored key read `DEEPSEEK_API_KEY (available)` with that
+ *  variable unset — and after 0.40.6's endpoint login every gateway row
+ *  would have named a variable nobody exports any more. */
+/** MP-1 (0.40.7): who a profile's requests are billed to — the endpoint
+ *  and the credential that pays there (`@api.deepseek.com · stored key`). */
+function payeeOf(p) {
+    const host = profileProviderLabel(p.kind, p.baseUrl, p.upstream);
+    const who = signInNote(p).replace(/, expired — renews on use$/, "");
+    return host === "" ? who : `${host} · ${who}`;
+}
 function signInNote(p) {
     try {
         const auth = authForProfile("?", p);
+        // 0.40.7: an access token past its expiry is not a dead sign-in — the
+        // next use renews it — but the row says so rather than nothing
         if (auth.type === "oauth")
-            return "oauth";
+            return auth.expires !== undefined && auth.expires < Date.now() ? "oauth, expired — renews on use" : "oauth";
+        if (auth.source === "store")
+            return "stored key";
     }
     catch {
         // unavailable — the availability mark says so; the env name still names what would sign it in
     }
     return p.apiKeyEnv ?? "no key";
 }
-/** CW-1 (owner, 2026-09-23): a profile's window on its /model row — the
- *  profile's own stated figure first, then the registry's chain for its
- *  model, endpoint and upstream; `inferred` marks the one no row states
- *  for that endpoint. */
-function windowNoteOf(p) {
-    const w = statedContextWindow({ model: p.model, ...(p.baseUrl !== undefined ? { baseUrl: p.baseUrl } : {}), ...(p.upstream !== undefined ? { upstream: p.upstream } : {}) }, { configured: resolveContextWindow(mergedConfig, p) });
-    return windowSourceNote(w, "short");
-}
 /** The ONE dispatcher — slash commands, exit, and turns. The recovery
  *  replay routes through it too — a queued "/last" must never become a
  *  user turn (v2c: the rl lives in main, so lines arrive earlier and the
@@ -383,18 +397,15 @@ export function dispatch(line, ctx) {
         return;
     }
     if (trimmed === "\x14think") {
-        // §2.3 — ctrl+t folds the committed thinking blocks, and folds them
-        // back. DC-50's mechanism, not a second one: one boolean, then the
-        // session is reprinted, so the blocks already on screen obey the
-        // switch rather than only the next ones.
-        //
-        // The folded row is `foldThinking`'s, which is what the PIPE writes
-        // — so thinking has two renderings in the product and not three,
-        // and the pipe's byte-identity gate is this row's gate too.
-        //
-        // The live `thinking…` placeholder is NOT touched: it belongs to
-        // the live region, and this switch is about committed blocks.
+        // §2.3 / 0.40.6 — ctrl+t hides thinking (one italic line per block,
+        // the open one included) and shows it again. DC-50's mechanism: one
+        // boolean, then the session is reprinted, so the blocks already on
+        // screen obey the switch. The choice is REMEMBERED (preferences.json)
+        // — the owner, 2026-09-23, after the reference implementation's
+        // persisted toggle; shown stays the default. The pipe keeps its own
+        // one-line fold whatever the choice.
         body.toggleThinking();
+        setPreference("thinking", body.thinkingHidden() ? "hidden" : "shown");
         ctx.input.prompt();
         return;
     }
@@ -487,6 +498,31 @@ export function dispatch(line, ctx) {
         });
         return;
     }
+    if (trimmed === "/settings") {
+        // 0.40.6 — what kiso runs with, each value's layer, and how to change
+        // it (settings.ts). Read-only: the config file stays the human's.
+        ctx.chainRef.current = ctx.chainRef.current.then(async () => {
+            const w = statedContextWindow();
+            const profile = currentProfileName;
+            bodyLog(settingsRows({
+                user: settingsLayers.user,
+                project: settingsLayers.project,
+                env: process.env,
+                ...(settingsLayers.modeFlag !== undefined ? { modeFlag: settingsLayers.modeFlag } : {}),
+                ...(settingsLayers.modelFlag !== undefined ? { modelFlag: settingsLayers.modelFlag } : {}),
+                mode: getMode(),
+                model: { label: `${agentModel}${providerLabel(agentBaseUrl, upstreamOf(agentBaseUrl))}${profile === null ? "" : ` · profile ${profile}`}`, profile, switched: settingsLayers.modelSwitched },
+                ground: currentGround(),
+                floorOn,
+                window: windowSourceNote(w).replace(/^window /, ""),
+                thinkingHidden: body.thinkingHidden(),
+                thinkingRemembered: preferences().thinking !== undefined,
+                version: versionStatusLine(installedVersion(), VERSION).replace(/^version /, ""),
+            }).join("\n\n"), "words");
+            ctx.input.prompt();
+        });
+        return;
+    }
     if (trimmed === "/status") {
         // B area: session id, durable event count, and the ~ context
         // estimate — all read straight from the live session, nothing
@@ -499,7 +535,7 @@ export function dispatch(line, ctx) {
             // CW-1: the percentage names its denominator and who stated it — a
             // window inferred from the model reads differently from one the
             // registry states for this endpoint.
-            bodyLog(`ctx ${ctxPct} · ${windowSourceNote(statedContextWindow(), "long")}`);
+            bodyLog(`ctx ${ctxPct} · ${windowSourceNote(statedContextWindow())}`);
             // The owner, 2026-09-21: /status is where "what am I actually
             // running on" is answered, so the identity is spelled out HERE —
             // the model, the host the request goes to, the profile it came
@@ -546,6 +582,8 @@ export function dispatch(line, ctx) {
                         ctx.input.panelAsk(modePickView({
                             header: `mode — current: ${current}`,
                             options: OFFERED_MODES.map((name) => ({ label: name, note: [MODE_NOTE[name], ...(name === current ? ["current"] : [])].join(" · ") })),
+                            // MP-1 (0.40.7): the cursor opens on the tier in force
+                            ...(OFFERED_MODES.indexOf(current) >= 0 ? { initial: OFFERED_MODES.indexOf(current) } : {}),
                         }, 
                         // DC-12 (design §4): a panel WAITING ON A HUMAN says ❯.
                         ctx.isRunning() ? "❯ run paused" : `▸ ${current}`), (v) => resolve(v.action === "picked" ? v.result : null));
@@ -622,9 +660,11 @@ export function dispatch(line, ctx) {
                             // profile key is what `/model <name>` takes, not what a chooser
                             // reading a list needs. What remains is what the chooser CANNOT
                             // infer: availability, and which one is live.
-                            // CW-1: the window rides LAST — availability and the live mark
-                            // are what a narrow row must keep.
-                            const marks = [...(profileAvailable(profile) ? [] : ["unavailable"]), ...(name === currentProfileName ? ["current"] : []), windowNoteOf(profile)];
+                            // 0.40.6 (the owner, 2026-09-23: "who told you to write ctx"):
+                            // the window rode here in 0.40.3–0.40.5 and cut `unavailable`
+                            // to `unavailabl…` on the owner's rows. It lives on /status and
+                            // /settings, where there is room to say it and its source.
+                            const marks = [...(profileAvailable(profile) ? [] : ["unavailable"]), ...(name === currentProfileName ? ["current"] : [])];
                             const host = profileProviderLabel(profile.kind, profile.baseUrl, profile.upstream);
                             return { label: `${profile.kind}/${profile.model}${host === "" ? "" : ` ${host}`}`, note: marks.join(" · "), ...effortAxis(profile) };
                         }),
@@ -633,6 +673,9 @@ export function dispatch(line, ctx) {
                         // "openai/…" hint failed with "no such model profile"
                         // on exactly the fresh-install path that shows it.
                         typeHint: names.length === 0 ? "type provider/model directly (e.g. openai-compat/deepseek-reasoner)" : "type provider/model directly",
+                        // MP-1 (0.40.7): the cursor opens on the session's own
+                        // profile — opening on row 0 plus one Enter changed who pays
+                        ...(currentProfileName !== null && names.indexOf(currentProfileName) >= 0 ? { initial: names.indexOf(currentProfileName) } : {}),
                         // the zero-profile copy is TODAY'S, verbatim: the
                         // user who sees it is exactly the user who needs
                         // the path spelled out
@@ -676,7 +719,7 @@ export function dispatch(line, ctx) {
                     for (const name of names) {
                         const p = configModels[name];
                         const hostOf = profileProviderLabel(p.kind, p.baseUrl, p.upstream);
-                        bodyLog(`  ${name} → ${p.kind}/${p.model}${hostOf === "" ? "" : ` ${hostOf}`} · ${signInNote(p)} ${profileAvailable(p) ? "(available)" : "(unavailable)"} · ${effortNote(p)} · ${windowNoteOf(p)}`);
+                        bodyLog(`  ${name} → ${p.kind}/${p.model}${hostOf === "" ? "" : ` ${hostOf}`} · ${signInNote(p)} ${profileAvailable(p) ? "(available)" : "(unavailable)"} · ${effortNote(p)}`);
                     }
                 }
                 bodyLog("switch with /model <profile-name|provider/model>");
@@ -768,11 +811,16 @@ export function dispatch(line, ctx) {
                                 // display — a direct provider/model has none.
                                 profileName: direct === null ? profName : null,
                             };
+                            // MP-1 (0.40.7): who pays BEFORE the switch, read while the
+                            // session still names the outgoing profile
+                            const prevProfile = currentProfileName !== null ? configModels[currentProfileName] : undefined;
+                            const payeeBefore = prevProfile !== undefined ? payeeOf(prevProfile) : null;
                             ctx.session.setModelBinding(binding);
                             setLastBinding(binding);
                             setAgentModel(profile.model, profile.baseUrl);
                             setCurrentModelName(arg);
                             setCurrentProfileName(direct === null ? null : profName);
+                            settingsLayers.modelSwitched = true;
                             // §2.5: the ONE source a reload reads for the model — a
                             // switch made here must survive the rebuild.
                             setModelChoice(arg);
@@ -793,6 +841,13 @@ export function dispatch(line, ctx) {
                             // model beside the previous model's figure.
                             ctx.modelSwitched();
                             body.notice(`model → ${profName} (${profile.model}${providerLabel(profile.baseUrl, profile.upstream) === "" ? "" : ` ${providerLabel(profile.baseUrl, profile.upstream)}`}${effortTok !== undefined ? ` · ${effortTok}` : ""}) — takes effect on the next turn`);
+                            // MP-1 (0.40.7): when the switch changes WHO PAYS — another
+                            // endpoint, or another credential for it — say so, once,
+                            // under the switch line. A switch between two models on the
+                            // same account says nothing more.
+                            const payeeAfter = payeeOf(profile);
+                            if (payeeBefore !== null && payeeBefore !== payeeAfter)
+                                body.notice(`paid by ${payeeAfter} from the next turn — was ${payeeBefore}`);
                         }
                     }
                 }

package/dist/index.js

@@ -53,6 +53,9 @@ import { isFirstRun, scaffoldFirstRun } from "./first-run.js";
 import { fauxSkip, readFauxScript } from "./faux-glue.js";
 import { chat, compactionDiscardedNotice, contextWindowTokens, displayCtxRatio, knownContextWindow, microcompactThresholdFor, statusModelLabel, unknownWindowNotice, windowLearnedNotice } from "./chat.js";
 import { recordLearnedWindow, useLearnedWindows } from "./learned-windows.js";
+import { preferences, usePreferences } from "./preferences.js";
+import { sweepStaleMergeDirs } from "./temp-sweep.js";
+import { settingsLayers } from "./state.js";
 import { providerHost } from "./provider-label.js";
 import { adapterOptionsFor } from "./auth/adapter-options.js";
 import { loadProjectConfig, loadUserConfig, mergeConfigs, resolveAutoCompact, resolveContextWindow, resolveModel } from "./config.js";
@@ -66,6 +69,8 @@ import { armByteTrace } from "./byte-trace.js";
 import { tmpdir, homedir } from "node:os";
 import { clipboardImage } from "./clipboard.js";
 import { cardsFromListings } from "./session-cards.js";
+/** 0.40.7: the stale-merge-directory sweep runs once per process. */
+let tempSwept = false;
 // The moved exports stay reachable from this entry — the test imports
 // (project-trust, coding-agent) never change (B4: zero assertion changes).
 export { applyProjectMerges } from "./trust-ui.js";
@@ -759,6 +764,10 @@ async function makeAgent(sessionId, input, modelFlag) {
     const userCfg = loadUserConfig();
     const projectCfg = loadProjectConfig(process.cwd(), project !== null);
     const merged = mergeConfigs(userCfg, projectCfg);
+    // 0.40.6: /settings names each value's layer from these
+    settingsLayers.user = userCfg;
+    settingsLayers.project = projectCfg;
+    settingsLayers.modelFlag = modelFlag;
     const secretEnvNames = secretEnvNamesOf(merged.models ?? {});
     const builtIn = await builtInLayer(user, proj, input !== undefined && process.stdin.isTTY ? askUi(input) : undefined, secretEnvNames);
     setExtensionLists(builtIn, user, proj, [...builtIn, ...user, ...proj]);
@@ -776,11 +785,17 @@ async function makeAgent(sessionId, input, modelFlag) {
     // channel and not an exported KISO_SESSIONS_DIR: a variable in
     // process.env would reach every shell child, and a kiso started from a
     // shell tool would then write into this project's folder.
-    process.env.KISO_DELEGATION_CONFIG_JSON = JSON.stringify({ checks: merged.checks ?? {}, profiles: Object.keys(merged.models ?? {}), sessionsDir: sessionsDir() });
+    process.env.KISO_DELEGATION_CONFIG_JSON = JSON.stringify({ checks: merged.checks ?? {}, evaluators: merged.evaluators ?? [], profiles: Object.keys(merged.models ?? {}), sessionsDir: sessionsDir() });
     setConfigModels(merged.models ?? {});
     // CW-1 batch 2: the windows endpoints stated by refusing — read before the
     // first window is asked for (the unknown-window notice below).
     useLearnedWindows();
+    // 0.40.7: the merge directories a killed kiso left in the temp dir —
+    // once per process, never this process's own (temp-sweep.ts)
+    if (!tempSwept) {
+        tempSwept = true;
+        sweepStaleMergeDirs();
+    }
     const resolved = resolveModel(modelFlag, merged);
     // AFTER the model resolves: the window a PROFILE states is about that
     // profile's model, so it cannot be read before we know which profile is
@@ -1286,7 +1301,7 @@ async function reloadAgent(old, id, input, announce = true) {
                 rmSync(p, { recursive: true, force: true });
             }
             catch {
-                // best-effort — the temp dir would be reaped by the OS
+                // best-effort — a survivor is removed by a later startup's sweep (temp-sweep.ts) once this process is gone
             }
         }
         mergedTempPaths.push(...oldTemps);
@@ -1315,7 +1330,7 @@ async function reloadAgent(old, id, input, announce = true) {
             rmSync(p, { recursive: true, force: true });
         }
         catch {
-            // best-effort — the temp dir would be reaped by the OS
+            // best-effort — a survivor is removed by a later startup's sweep (temp-sweep.ts) once this process is gone
         }
     }
     if (announce)
@@ -1643,6 +1658,7 @@ async function main() {
             process.exit(2);
         }
         setMode(m);
+        settingsLayers.modeFlag = m;
         args.splice(modeFlag, 2);
     }
     else {
@@ -1790,6 +1806,10 @@ async function main() {
         editCol: () => dock.editCol(),
         onDock: () => dock.redraw(), // v2d-B: the freeze scrolls the dock up — re-pin it
     }));
+    // 0.40.6: the choices kiso remembers (preferences.json) — today ctrl+t's
+    // thinking display, restored before the first block can be drawn.
+    usePreferences();
+    body.setThinkingHidden(preferences().thinking === "hidden");
     // REL-0152-D11: pasting an image sends no bytes, so an empty paste is
     // the signal to go and look at the clipboard. What comes back is a
     // PATH, which the turn's attachment scan then picks up exactly as it
@@ -2001,8 +2021,33 @@ async function main() {
                 // `login <provider>` reads the key from a hidden prompt on a TTY
                 // or from stdin otherwise (never from an argument — shell history);
                 // `logout <provider>` deletes; `auth` lists, keys masked.
-                const { KNOWN_PROVIDERS, OAUTH_PROVIDERS, authPath, deleteCredential, maskSecret, readAuthFile, setCredential } = await import("./auth/credentials.js");
+                const { KNOWN_PROVIDERS, OAUTH_PROVIDERS, authPath, deleteCredential, endpointCredentialId, maskSecret, providerIdOf, readAuthFile, setCredential } = await import("./auth/credentials.js");
                 const provider = arg;
+                if (provider === "--endpoint" && command !== "auth") {
+                    // 0.40.6: a gateway's own key, stored for its ORIGIN and sent
+                    // there alone (credentials.ts endpointCredentialId) — so a
+                    // gateway profile starts from plain `kiso`, no env var on the
+                    // command line. The key still never comes from an argument.
+                    const url = args[2];
+                    const id = endpointCredentialId(url);
+                    if (id === null)
+                        throw new CliUsageError(`kiso ${command} --endpoint <url> — an http(s) URL, e.g. https://gateway.example/v1`);
+                    const origin = id.slice("endpoint:".length);
+                    const vendor = ["openai-compat", "anthropic", "openai-responses"].map((k) => providerIdOf(k, url)).find((v) => v !== null);
+                    if (vendor !== undefined && vendor !== null)
+                        throw new CliUsageError(`${origin} is ${vendor}'s own endpoint — run \`kiso ${command} ${vendor}\``);
+                    if (command === "logout") {
+                        const had = deleteCredential(id);
+                        process.stdout.write(had ? `removed the key for ${origin}\n` : `nothing stored for ${origin}\n`);
+                        break;
+                    }
+                    const key = (await readSecret(`API key for ${origin}: `)).trim();
+                    if (key === "")
+                        throw new CliUsageError(`kiso login --endpoint ${origin}: no key given`);
+                    setCredential(id, { type: "api-key", key, savedAt: Date.now() });
+                    process.stdout.write(`stored an API key for ${origin} (${maskSecret(key)}) in ${authPath()} — sent to that origin only; every profile whose baseUrl is on it uses this key before its env var\n`);
+                    break;
+                }
                 if (command === "auth") {
                     const file = readAuthFile();
                     const rows = Object.entries(file.credentials);
@@ -2011,7 +2056,7 @@ async function main() {
                         if (cred.type === "api-key")
                             lines.push(`  ${id.padEnd(10)} api-key ${maskSecret(cred.key)}  saved ${new Date(cred.savedAt).toISOString().slice(0, 10)}`);
                         else
-                            lines.push(`  ${id.padEnd(10)} oauth   ${cred.accountId ?? ""}  expires ${new Date(cred.expires).toISOString()}${cred.expires < Date.now() ? " (expired)" : ""}`);
+                            lines.push(`  ${id.padEnd(10)} oauth   ${cred.accountId ?? ""}  expires ${new Date(cred.expires).toISOString()}${cred.refreshRejectedAt !== undefined ? ` (renewal refused — run kiso login ${id})` : cred.expires < Date.now() ? " (expired — renews on use)" : ""}`);
                     }
                     const envs = ["ANTHROPIC_API_KEY", "OPENAI_API_KEY"].filter((k) => process.env[k] !== undefined);
                     lines.push(`env vars set: ${envs.length ? envs.join(", ") : "none"} (a stored credential owns its provider; env applies only when nothing is stored)`);
@@ -2019,7 +2064,7 @@ async function main() {
                     break;
                 }
                 if (provider === undefined || !KNOWN_PROVIDERS.includes(provider)) {
-                    throw new CliUsageError(`kiso ${command} <provider> — one of: ${KNOWN_PROVIDERS.join(", ")}`);
+                    throw new CliUsageError(`kiso ${command} <provider> — one of: ${KNOWN_PROVIDERS.join(", ")}; or kiso ${command} --endpoint <url> for a gateway`);
                 }
                 if (command === "logout") {
                     const had = deleteCredential(provider);
@@ -2096,7 +2141,8 @@ async function main() {
                     "  kiso sessions [--all|--current]   list durable sessions (a terminal shows this workspace's by default)\n" +
                     "  kiso login <provider>    anthropic|openai|deepseek|zai: store an API key (hidden prompt, or stdin when piped);\n" +
                     "                           chatgpt: sign in with a ChatGPT subscription (browser; unofficial third-party flow)\n" +
-                    "  kiso logout <provider>   remove the stored credential\n" +
+                    "  kiso login --endpoint <url>    a gateway: store its API key for that URL's origin only\n" +
+                    "  kiso logout <provider>   remove the stored credential (or --endpoint <url>)\n" +
                     "  kiso auth               list stored credentials (keys masked)\n" +
                     "  kiso update             install the latest release (npm i -g @vincemakes/kiso-code@latest)\n" +
                     "  kiso help               this help\n\n" +
@@ -2109,7 +2155,7 @@ async function main() {
                     "  OPENAI_API_KEY           OpenAI-compatible (OPENAI_MODEL, default gpt-4o;\n" +
                     "                           OPENAI_BASE_URL for DeepSeek/compat endpoints) — checked first\n" +
                     "  ANTHROPIC_API_KEY        Anthropic (ANTHROPIC_MODEL, default claude-sonnet-5)\n" +
-                    "  ~/.kiso/config.json      named model profiles (keys stay in env vars; see the README)\n");
+                    "  ~/.kiso/config.json      named model profiles (keys stay in env vars or kiso login; see the README)\n");
                 break;
             }
             case undefined:
@@ -2161,7 +2207,7 @@ async function main() {
                 rmSync(p, { recursive: true, force: true });
             }
             catch {
-                // best-effort — the temp dir would be reaped by the OS
+                // best-effort — a survivor is removed by a later startup's sweep (temp-sweep.ts) once this process is gone
             }
         }
     }

package/dist/preferences.d.ts

@@ -0,0 +1,14 @@
+export interface Preferences {
+    /** ctrl+t: the thinking blocks as one italic line each. Absent = shown. */
+    readonly thinking?: "shown" | "hidden";
+}
+export declare function preferencesPath(home?: string): string;
+/** Startup: read the file, and keep choices made from here on in it. */
+export declare function usePreferences(path?: string): void;
+/** The remembered choices; empty before startup names the file. */
+export declare function preferences(): Preferences;
+/** Remember a choice. Returns false when no file was named. The file is
+ *  re-read before the write, so another process's choice is kept. */
+export declare function setPreference<K extends keyof Preferences>(key: K, value: NonNullable<Preferences[K]>): boolean;
+/** Tests: back to the state before startup. */
+export declare function resetPreferences(): void;

package/dist/preferences.js

@@ -0,0 +1,64 @@
+/**
+ * 0.40.6 — the choices kiso remembers for you, in
+ * `<KISO_HOME>/preferences.json`.
+ *
+ * `config.json` is the human's file: kiso reads it and never writes it. A
+ * choice made with a key — ctrl+t's thinking display, today the only one —
+ * has to survive a restart, so it lands here instead: kiso-owned, private
+ * (0600, tmp + rename), and read back at start-up. A missing or unreadable
+ * file is an empty one; an unknown value is ignored rather than guessed.
+ *
+ * Nothing is read until the CLI's startup names the file
+ * (`usePreferences`) — the same rule as learned-windows.ts, so in-process
+ * tests never read a home directory.
+ */
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { kisoHome } from "./state.js";
+let prefs = null;
+let prefsPath = null;
+export function preferencesPath(home = kisoHome()) {
+    return join(home, "preferences.json");
+}
+function read(path) {
+    try {
+        const raw = JSON.parse(readFileSync(path, "utf8"));
+        return raw.thinking === "shown" || raw.thinking === "hidden" ? { thinking: raw.thinking } : {};
+    }
+    catch {
+        return {};
+    }
+}
+/** Startup: read the file, and keep choices made from here on in it. */
+export function usePreferences(path = preferencesPath()) {
+    prefsPath = path;
+    prefs = read(path);
+}
+/** The remembered choices; empty before startup names the file. */
+export function preferences() {
+    return prefs ?? {};
+}
+/** Remember a choice. Returns false when no file was named. The file is
+ *  re-read before the write, so another process's choice is kept. */
+export function setPreference(key, value) {
+    const path = prefsPath;
+    if (path === null)
+        return false;
+    const next = { ...read(path), [key]: value };
+    prefs = next;
+    try {
+        mkdirSync(dirname(path), { recursive: true });
+        const tmp = `${path}.${process.pid}.tmp`;
+        writeFileSync(tmp, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
+        renameSync(tmp, path);
+    }
+    catch {
+        // an unwritable home: the choice still holds for this process
+    }
+    return true;
+}
+/** Tests: back to the state before startup. */
+export function resetPreferences() {
+    prefs = null;
+    prefsPath = null;
+}

package/dist/readonly-shell.js

@@ -33,7 +33,7 @@
 import { statSync } from "node:fs";
 import { homedir } from "node:os";
 import { basename, isAbsolute, join, relative } from "node:path";
-import { isCredentialName } from "@vincemakes/kiso-tools-node";
+import { isCredentialName, isCredentialPath } from "@vincemakes/kiso-tools-node";
 import { getMode } from "./mode.js";
 import { HOME_SUBTREES, parseShell, realCase, resolveShellPath } from "./shell-words.js";
 // ── the predicates ──────────────────────────────────────────────────────
@@ -55,15 +55,11 @@ function scope(ctx, word) {
     }
     return null;
 }
-/** B4: credentials by the shell's own list — names the search corpus's
- *  rule does not cover, on the canonical path. (The corpus rule itself,
- *  shared with read_file and search_text, is not moved before the freeze:
- *  finding RO-F4, 0.41.0.) */
-const SHELL_CREDENTIAL_NAMES = new Set([".npmrc", ".pypirc", ".git-credentials", ".htpasswd"]);
-const SHELL_CREDENTIAL_PATHS = ["/.aws/credentials", "/.config/gh/hosts.yml", "/.docker/config.json", "/.kube/config"];
+/** B4, and since RO-F4 (0.40.7) the search corpus's own set: the shell and
+ *  the file tools ask ONE rule — names (`isCredentialName`) and the
+ *  directory-scoped paths (`isCredentialPath`) — on the canonical path. */
 function shellCredential(canonical) {
-    const folded = canonical.toLowerCase();
-    return SHELL_CREDENTIAL_NAMES.has(basename(folded)) || SHELL_CREDENTIAL_PATHS.some((s) => folded.endsWith(s));
+    return isCredentialName(basename(canonical).toLowerCase()) || isCredentialPath(canonical);
 }
 function content(ctx, word) {
     const s = scope(ctx, word);

package/dist/settings.d.ts

@@ -0,0 +1,37 @@
+/**
+ * 0.40.6 — `/settings`: what kiso is running with, where each value came
+ * from, and how to change it.
+ *
+ * The owner, 2026-09-23, asked whether kiso has a help for what can be
+ * configured. `/help` lists the commands and `?` the keys; the settings
+ * lived only in docs/configuration.md and in files the user had to open.
+ *
+ * READ-ONLY by design: the config file stays the human's. The layers are
+ * the documented precedence — flag > env > project config > user config >
+ * default — and a value that no layer explains was set in this session
+ * (`/mode`, `/model`). Pure: every input is passed in, so each row is
+ * testable without a session.
+ */
+import type { KisoConfig } from "./config.js";
+export interface SettingsInput {
+    readonly user: KisoConfig | null;
+    readonly project: KisoConfig | null;
+    readonly env: Readonly<Record<string, string | undefined>>;
+    /** the --mode / --model values on the command line, when given */
+    readonly modeFlag?: string;
+    readonly modelFlag?: string;
+    /** what is live now */
+    readonly mode: string;
+    readonly model: {
+        readonly label: string;
+        readonly profile: string | null;
+        readonly switched: boolean;
+    };
+    readonly ground: string;
+    readonly floorOn: boolean;
+    readonly window: string;
+    readonly thinkingHidden: boolean;
+    readonly thinkingRemembered: boolean;
+    readonly version: string;
+}
+export declare function settingsRows(i: SettingsInput): string[];

package/dist/settings.js

@@ -0,0 +1,79 @@
+function modeRow(i) {
+    const change = "/mode or shift+tab; \"mode\" in ~/.kiso/config.json";
+    const from = i.modeFlag === i.mode
+        ? "--mode"
+        : i.env.KISO_MODE === i.mode
+            ? "env KISO_MODE"
+            : i.project?.mode === i.mode
+                ? "project config"
+                : i.user?.mode === i.mode
+                    ? "user config"
+                    : i.mode === "default"
+                        ? "default"
+                        : "set in this session";
+    return { name: "mode", value: i.mode, from, change };
+}
+function modelRow(i) {
+    const change = "/model; \"model\" in ~/.kiso/config.json";
+    const p = i.model.profile;
+    const from = i.model.switched
+        ? "set in this session"
+        : i.modelFlag !== undefined
+            ? "--model"
+            : p !== null && i.project?.model === p
+                ? "project config"
+                : p !== null && i.user?.model === p
+                    ? "user config"
+                    : i.env.OPENAI_API_KEY !== undefined && p === null
+                        ? "env OPENAI_API_KEY"
+                        : "default";
+    return { name: "model", value: i.model.label, from, change };
+}
+function themeRow(i) {
+    const change = "\"theme\": \"dark\" | \"light\" in ~/.kiso/config.json; KISO_THEME for one run";
+    if (i.env.KISO_THEME !== undefined)
+        return { name: "theme", value: i.env.KISO_THEME, from: "env KISO_THEME", change };
+    if (i.user?.theme !== undefined)
+        return { name: "theme", value: i.user.theme, from: "user config", change };
+    return { name: "theme", value: i.ground, from: "the terminal (detected)", change };
+}
+function layered(i, key) {
+    if (i.project?.[key] !== undefined)
+        return { value: i.project[key], from: "project config" };
+    if (i.user?.[key] !== undefined)
+        return { value: i.user[key], from: "user config" };
+    return { value: undefined, from: "default" };
+}
+export function settingsRows(i) {
+    const trust = layered(i, "projectTrust");
+    const auto = i.env.KISO_AUTO_COMPACT !== undefined ? { value: i.env.KISO_AUTO_COMPACT, from: "env KISO_AUTO_COMPACT" } : layered(i, "autoCompact");
+    const rows = [
+        modelRow(i),
+        modeRow(i),
+        themeRow(i),
+        {
+            name: "floor",
+            value: i.floorOn ? "on — irrecoverable deletes are refused in every mode" : "off",
+            from: i.user?.floor !== undefined ? "user config" : "default",
+            change: "\"floor\": \"off\" in ~/.kiso/config.json (user config only)",
+        },
+        { name: "window", value: i.window, from: "the window chain (see /status)", change: "\"contextWindow\" on the profile; KISO_CONTEXT_WINDOW for one run" },
+        { name: "compaction", value: "in-run: past half the window at a phase end, past 80% at once", from: "built in", change: "/compact on demand" },
+        {
+            name: "auto-compact",
+            value: auto.value === undefined ? "off" : typeof auto.value === "object" ? `at ${auto.value.thresholdRatio} of the window, at a run's start` : String(auto.value),
+            from: auto.from,
+            change: "\"autoCompact\" in config; KISO_AUTO_COMPACT",
+        },
+        { name: "project trust", value: trust.value ?? "ask", from: trust.from, change: "\"projectTrust\": \"ask\" | \"never\" in config" },
+        {
+            name: "thinking",
+            value: i.thinkingHidden ? "hidden — one line per block" : "shown",
+            from: i.thinkingRemembered ? "ctrl+t (remembered)" : "default",
+            change: "ctrl+t",
+        },
+        { name: "version", value: i.version, from: "running", change: "kiso update" },
+    ];
+    const width = Math.max(...rows.map((r) => r.name.length)) + 2;
+    return rows.map((r) => `${r.name.padEnd(width)}${r.value}\n${" ".repeat(width)}from ${r.from} · change: ${r.change}`);
+}

package/dist/state.d.ts

@@ -295,6 +295,16 @@ export declare const queuedSwitchLines: string[];
 /** E1: the extensions loaded by makeAgent — their names feed the banner. */
 /** 0.40.0: whether the catastrophe floor is on (floor.ts) — the user
  *  config's `floor`, read where the chain is assembled. */
+/** 0.40.6: what /settings needs to name each value's layer — the two config
+ *  files as read, the command-line flags as given, and whether /model
+ *  changed the binding in this session. */
+export declare const settingsLayers: {
+    user: import("./config.js").KisoConfig | null;
+    project: import("./config.js").KisoConfig | null;
+    modeFlag: string | undefined;
+    modelFlag: string | undefined;
+    modelSwitched: boolean;
+};
 export declare let floorOn: boolean;
 export declare function setFloorOn(value: boolean): void;
 /** 0.40.0: the calls a saved allow never carries (protected-writes.ts) —

package/dist/state.js

@@ -397,6 +397,10 @@ export const queuedSwitchLines = [];
 /** E1: the extensions loaded by makeAgent — their names feed the banner. */
 /** 0.40.0: whether the catastrophe floor is on (floor.ts) — the user
  *  config's `floor`, read where the chain is assembled. */
+/** 0.40.6: what /settings needs to name each value's layer — the two config
+ *  files as read, the command-line flags as given, and whether /model
+ *  changed the binding in this session. */
+export const settingsLayers = { user: null, project: null, modeFlag: undefined, modelFlag: undefined, modelSwitched: false };
 export let floorOn = true;
 export function setFloorOn(value) {
     floorOn = value;

package/dist/temp-sweep.d.ts

@@ -0,0 +1,12 @@
+export declare const LEGACY_MAX_AGE_MS: number;
+/** One startup never spends long here, whatever the temp directory holds. */
+export declare const SWEEP_LIMIT = 200;
+/** The mkdtemp prefix for a merge directory: this process's pid in the name. */
+export declare function mergeDirPrefix(kind: "mcp" | "skills"): string;
+/** Is a process with this pid running? EPERM means it is, and belongs to
+ *  someone else; only ESRCH says it is gone. */
+export declare function pidAlive(pid: number): boolean;
+/** Remove the merge directories whose owner is gone (and legacy ones a week
+ *  old). Returns the names removed. Every failure is skipped — a sweep is
+ *  housekeeping, never a reason for a session not to start. */
+export declare function sweepStaleMergeDirs(dir?: string, now?: number, alive?: (pid: number) => boolean): string[];

package/dist/temp-sweep.js

@@ -0,0 +1,76 @@
+/**
+ * 0.40.7 — the merge directories a killed kiso left behind.
+ *
+ * A project with its own `.kiso/mcp.json` or skills gets a merged copy in
+ * the temp directory (`kiso-mcp-*`, `kiso-skills-*`, trust-ui.ts). A clean
+ * exit removes it; `kill -9` does not, and macOS's temp cleaner removes old
+ * FILES but leaves directories — so every killed session left one behind
+ * for good (the owner's machine once held 449,956 of the test suite's).
+ *
+ * The directory's name now carries its owner's pid
+ * (`kiso-mcp-<pid>-XXXXXX`). At startup kiso removes the ones whose owner
+ * is gone; a live session's directory is never touched. Names from before
+ * this version carry no pid: those are removed only when untouched for a
+ * week, which no live session's merge can be (it is read at every reload).
+ * Only directories this user owns are considered; nothing else in the
+ * temp directory is read.
+ */
+import { lstatSync, readdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+export const LEGACY_MAX_AGE_MS = 7 * 24 * 3600_000;
+/** One startup never spends long here, whatever the temp directory holds. */
+export const SWEEP_LIMIT = 200;
+const OWNED = /^kiso-(?:mcp|skills)-(\d+)-[A-Za-z0-9]{6}$/;
+const LEGACY = /^kiso-(?:mcp|skills)-[A-Za-z0-9]{6}$/;
+/** The mkdtemp prefix for a merge directory: this process's pid in the name. */
+export function mergeDirPrefix(kind) {
+    return join(tmpdir(), `kiso-${kind}-${process.pid}-`);
+}
+/** Is a process with this pid running? EPERM means it is, and belongs to
+ *  someone else; only ESRCH says it is gone. */
+export function pidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err.code === "EPERM";
+    }
+}
+/** Remove the merge directories whose owner is gone (and legacy ones a week
+ *  old). Returns the names removed. Every failure is skipped — a sweep is
+ *  housekeeping, never a reason for a session not to start. */
+export function sweepStaleMergeDirs(dir = tmpdir(), now = Date.now(), alive = pidAlive) {
+    let names;
+    try {
+        names = readdirSync(dir);
+    }
+    catch {
+        return [];
+    }
+    const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
+    const removed = [];
+    for (const name of names) {
+        if (removed.length >= SWEEP_LIMIT)
+            break;
+        const owned = OWNED.exec(name);
+        if (owned === null && !LEGACY.test(name))
+            continue;
+        const full = join(dir, name);
+        try {
+            const st = lstatSync(full);
+            if (!st.isDirectory() || (uid !== undefined && st.uid !== uid))
+                continue;
+            const stale = owned !== null ? Number(owned[1]) !== process.pid && !alive(Number(owned[1])) : now - st.mtimeMs > LEGACY_MAX_AGE_MS;
+            if (!stale)
+                continue;
+            rmSync(full, { recursive: true, force: true });
+            removed.push(name);
+        }
+        catch {
+            // gone already, or not ours to remove
+        }
+    }
+    return removed;
+}

package/dist/trust-ui.js

@@ -6,13 +6,14 @@
  * decisions. All bodies moved verbatim from index.ts.
  */
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, symlinkSync, writeFileSync } from "node:fs";
-import { homedir, tmpdir } from "node:os";
+import { homedir } from "node:os";
 import { join } from "node:path";
 import { pathToFileURL } from "node:url";
 import { askDeclineAll, askView, projectTrustRows, projectTrustView, projectUntrustedNote, uncertainView, unansweredAskView } from "@vincemakes/kiso-tui";
 import { projectArtifacts, recordTrust, trustFor } from "@vincemakes/kiso-runtime";
 import { bodyLog, currentAgentExtensions, dock, extensionsDir, kisoHome, mergedTempPaths, neverInherited } from "./state.js";
 import { guardSavedAllow } from "./protected-writes.js";
+import { mergeDirPrefix } from "./temp-sweep.js";
 import { loadUserConfig, resolveProjectTrustPolicy } from "./config.js";
 import { getMode } from "./mode.js";
 /**
@@ -415,7 +416,7 @@ function applyMcpMerge(root) {
     // the paths the previous set owned deleted the file the new set had just
     // been merged into. One directory per merge, and the directory is what is
     // recorded, so the cleanup removes exactly what that merge created.
-    const dir = mkdtempSync(join(tmpdir(), "kiso-mcp-"));
+    const dir = mkdtempSync(mergeDirPrefix("mcp")); // 0.40.7: the owner's pid in the name (temp-sweep.ts)
     const temp = join(dir, "mcp.json");
     writeFileSync(temp, `${JSON.stringify(merged, null, 2)}\n`, "utf8");
     process.env.KISO_MCP_CONFIG = temp;
@@ -442,7 +443,7 @@ function applySkillsMerge(root) {
     originalUserSkillsDir ??= process.env.KISO_SKILLS_DIR ?? join(kisoHome(), "skills");
     const userDir = originalUserSkillsDir;
     const projectDir = join(root, "skills");
-    const merged = mkdtempSync(join(tmpdir(), "kiso-skills-"));
+    const merged = mkdtempSync(mergeDirPrefix("skills"));
     mergedTempPaths.push(merged);
     for (const dir of readdirSyncSafe(projectDir)) {
         symlinkSync(join(projectDir, dir), join(merged, dir)); // project wins on collision

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@vincemakes/kiso-code",
-	"version": "0.40.5",
+	"version": "0.40.7",
 	"description": "kiso-code \u2014 the coding agent on kiso, the durable runtime for AI agents: kiso chat / kiso resume / kiso sessions.",
 	"type": "module",
 	"license": "MIT",
@@ -18,20 +18,20 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@vincemakes/kiso-ask-ext": "0.40.5",
-		"@vincemakes/kiso-core": "0.40.5",
-		"@vincemakes/kiso-evals": "0.40.5",
-		"@vincemakes/kiso-mcp-ext": "0.40.5",
-		"@vincemakes/kiso-provider-anthropic": "0.40.5",
-		"@vincemakes/kiso-provider-openai": "0.40.5",
-		"@vincemakes/kiso-provider-openai-responses": "0.40.5",
-		"@vincemakes/kiso-runtime": "0.40.5",
-		"@vincemakes/kiso-skills-ext": "0.40.5",
-		"@vincemakes/kiso-subagent-ext": "0.40.5",
-		"@vincemakes/kiso-task-ext": "0.40.5",
-		"@vincemakes/kiso-tools-node": "0.40.5",
-		"@vincemakes/kiso-tui": "0.40.5",
-		"@vincemakes/kiso-tui-cells": "0.40.5"
+		"@vincemakes/kiso-ask-ext": "0.40.7",
+		"@vincemakes/kiso-core": "0.40.7",
+		"@vincemakes/kiso-evals": "0.40.7",
+		"@vincemakes/kiso-mcp-ext": "0.40.7",
+		"@vincemakes/kiso-provider-anthropic": "0.40.7",
+		"@vincemakes/kiso-provider-openai": "0.40.7",
+		"@vincemakes/kiso-provider-openai-responses": "0.40.7",
+		"@vincemakes/kiso-runtime": "0.40.7",
+		"@vincemakes/kiso-skills-ext": "0.40.7",
+		"@vincemakes/kiso-subagent-ext": "0.40.7",
+		"@vincemakes/kiso-task-ext": "0.40.7",
+		"@vincemakes/kiso-tools-node": "0.40.7",
+		"@vincemakes/kiso-tui": "0.40.7",
+		"@vincemakes/kiso-tui-cells": "0.40.7"
 	},
 	"devDependencies": {
 		"@types/node": "^26.1.2",