@vincemakes/kiso-code 0.40.6 → 0.40.7

package/dist/auth/credentials.d.ts

@@ -10,6 +10,10 @@ export type Credential = {
     readonly expires: number;
     readonly accountId?: string;
     readonly savedAt: number;
+    /** 0.40.7: when the token endpoint REFUSED this credential's
+     *  refresh token. Set only by that refusal (never by a network
+     *  failure); a new login replaces the whole entry and so clears it. */
+    readonly refreshRejectedAt?: number;
 };
 export interface AuthFile {
     readonly version: 1;

package/dist/auth/oauth/chatgpt.d.ts

@@ -1,4 +1,4 @@
-import type { OAuthCredential, OAuthFlow } from "./index.js";
+import { type OAuthCredential, type OAuthFlow } from "./index.js";
 export declare const CHATGPT: {
     readonly providerId: "chatgpt";
     readonly clientId: "app_EMoamEEZ73f0CkXaXp7hrann";

package/dist/auth/oauth/chatgpt.js

@@ -17,6 +17,7 @@
  * endpoint — the Responses adapter is the second half of this step.
  */
 import { createServer } from "node:http";
+import { RefreshRejectedError } from "./index.js";
 import { generatePkce, randomState } from "./pkce.js";
 export const CHATGPT = {
     providerId: "chatgpt",
@@ -86,7 +87,11 @@ export function accountIdOf(accessToken) {
 async function readTokenResponse(response, operation) {
     if (!response.ok) {
         const text = await response.text().catch(() => "");
-        throw new Error(`ChatGPT sign-in: token ${operation} failed (${response.status})${text ? `: ${text.slice(0, 200)}` : ""}`);
+        const message = `ChatGPT sign-in: token ${operation} failed (${response.status})${text ? `: ${text.slice(0, 200)}` : ""}`;
+        // the endpoint's own refusal of the refresh token — the sign-in is over
+        if (operation === "refresh" && (response.status === 400 || response.status === 401))
+            throw new RefreshRejectedError(message);
+        throw new Error(message);
     }
     const json = (await response.json());
     if (typeof json.access_token !== "string" || typeof json.refresh_token !== "string" || typeof json.expires_in !== "number") {

package/dist/auth/oauth/index.d.ts

@@ -8,6 +8,14 @@ import type { Credential } from "../credentials.js";
 export type OAuthCredential = Extract<Credential, {
     type: "oauth";
 }>;
+/**
+ * 0.40.7 — a refresh the token endpoint REFUSED (400 / 401: the refresh
+ * token was revoked or has expired), as distinct from one that never got an
+ * answer. Only this marks a sign-in dead (`refreshRejectedAt`); a network
+ * failure leaves the credential as it was, to be tried again.
+ */
+export declare class RefreshRejectedError extends Error {
+}
 export interface LoginInteraction {
     /** Print a line for the person signing in (the URL to open, the paste prompt). */
     readonly notify: (line: string) => void;

package/dist/auth/oauth/index.js

@@ -1 +1,8 @@
-export {};
+/**
+ * 0.40.7 — a refresh the token endpoint REFUSED (400 / 401: the refresh
+ * token was revoked or has expired), as distinct from one that never got an
+ * answer. Only this marks a sign-in dead (`refreshRejectedAt`); a network
+ * failure leaves the credential as it was, to be tried again.
+ */
+export class RefreshRejectedError extends Error {
+}

package/dist/auth/refresh.d.ts

@@ -7,6 +7,6 @@
  * never a silent fall back to an API key or an env var.
  */
 import { type Credential } from "./credentials.js";
-import type { OAuthFlow } from "./oauth/index.js";
+import { type OAuthFlow } from "./oauth/index.js";
 export declare const FRESH_WINDOW_MS: number;
 export declare function ensureFresh(providerId: string, flow: OAuthFlow, path?: string, now?: number, tokenUrl?: string): Promise<Credential>;

package/dist/auth/refresh.js

@@ -7,6 +7,7 @@
  * never a silent fall back to an API key or an env var.
  */
 import { AuthError, modifyAuthFile, readAuthFile } from "./credentials.js";
+import { RefreshRejectedError } from "./oauth/index.js";
 export const FRESH_WINDOW_MS = 5 * 60_000;
 export async function ensureFresh(providerId, flow, path, now = Date.now(), tokenUrl) {
     const current = readAuthFile(path).credentials[providerId];
@@ -14,6 +15,10 @@ export async function ensureFresh(providerId, flow, path, now = Date.now(), toke
         throw new AuthError(`not signed in to ${providerId}: run \`kiso login ${providerId}\``);
     if (current.type !== "oauth" || current.expires - now > FRESH_WINDOW_MS)
         return current;
+    // 0.40.7: a refresh token the endpoint already refused is not sent again —
+    // the answer would be the same refusal, one round trip later
+    if (current.refreshRejectedAt !== undefined)
+        throw new AuthError(`signed out of ${providerId} (the sign-in was refused when kiso tried to renew it) — run \`kiso login ${providerId}\``);
     let refreshed;
     let error;
     // the double check: another process may have refreshed while we waited for the lock
@@ -26,8 +31,22 @@ export async function ensureFresh(providerId, flow, path, now = Date.now(), toke
     catch (err) {
         error = err instanceof Error ? err : new Error(String(err));
     }
-    if (refreshed === undefined)
+    if (refreshed === undefined) {
+        // 0.40.7: the endpoint's REFUSAL is remembered on the credential, so
+        // /model can say the sign-in is over before a turn finds out. The
+        // same generation rule as the write-back below (R2a): a logout or a
+        // new login while the refresh was on the wire is left alone.
+        if (error instanceof RefreshRejectedError) {
+            const began = current;
+            modifyAuthFile((file) => {
+                const latest = file.credentials[providerId];
+                if (latest === undefined || latest.type !== "oauth" || latest.refresh !== began.refresh || latest.expires !== began.expires)
+                    return file;
+                return { version: 1, credentials: { ...file.credentials, [providerId]: { ...latest, refreshRejectedAt: now } } };
+            }, path);
+        }
         throw new AuthError(`signed out of ${providerId} (the token could not be refreshed: ${error?.message ?? "unknown"}) — run \`kiso login ${providerId}\``);
+    }
     const written = refreshed;
     // R2a — THE WRITE-BACK MAY NOT RESURRECT WHAT THE HUMAN REMOVED.
     //

package/dist/config.d.ts

@@ -118,6 +118,13 @@ export interface KisoConfig {
      *  in the child's worktree. A model never supplies a command; it names
      *  one of these. `{ "test": "npm test", "lint": "npm run lint" }`. */
     readonly checks?: Readonly<Record<string, string>>;
+    /** CS-1 (0.40.7): the evaluator scripts a delegated task may name —
+     *  absolute paths, `["/abs/path/to/evaluate.sh"]`. The PARENT runs the
+     *  one a task names with the child's worktree as its argument. A path
+     *  the user did not list is refused: the model chooses the task, so an
+     *  unlisted path could be an interpreter running code the child wrote.
+     *  Same layers as `checks`. */
+    readonly evaluators?: readonly string[];
 }
 /** The resolved, merged config — project wins over user, both validated. */
 export interface ResolvedConfig {
@@ -145,7 +152,8 @@ export type ProfileAuth = {
     readonly source: "store" | "env" | "none";
 } | {
     readonly type: "oauth";
-    readonly providerId: string;
+    readonly providerId: string; /** the access token's expiry (epoch ms) — past it, the next use renews */
+    readonly expires?: number;
 };
 /** Where a profile's sign-in comes from, or why it has none. The sign-in
  *  plan's resolve rule: a stored credential OWNS the provider (an

package/dist/config.js

@@ -130,6 +130,15 @@ export function parseConfig(text, source) {
         }
         out.checks = obj.checks;
     }
+    if (obj.evaluators !== undefined) {
+        if (!Array.isArray(obj.evaluators))
+            fail("evaluators", "expected a list of absolute paths to evaluator scripts");
+        for (const path of obj.evaluators) {
+            if (typeof path !== "string" || !path.startsWith("/"))
+                fail("evaluators", `expected an absolute path, got ${JSON.stringify(path)}`);
+        }
+        out.evaluators = obj.evaluators;
+    }
     if (obj.model !== undefined) {
         if (typeof obj.model !== "string" || obj.model === "")
             fail("model", "expected a profile name or provider/model string");
@@ -253,6 +262,8 @@ export function mergeConfigs(user, project) {
         ...(p.projectTrust !== undefined ? { projectTrust: p.projectTrust } : {}),
         // DT-1a: checks merge per name — a (trusted) project's check wins over the user's
         ...(u.checks !== undefined || p.checks !== undefined ? { checks: { ...(u.checks ?? {}), ...(p.checks ?? {}) } } : {}),
+        // CS-1: the evaluator lists join — either layer's script may be named
+        ...(u.evaluators !== undefined || p.evaluators !== undefined ? { evaluators: [...(u.evaluators ?? []), ...(p.evaluators ?? [])] } : {}),
     };
 }
 /** Where a profile's sign-in comes from, or why it has none. The sign-in
@@ -280,8 +291,14 @@ export function authForProfile(name, p) {
         if (stored !== undefined) {
             if (stored.type === "api-key")
                 return { type: "api-key", apiKey: stored.key, source: "store" };
-            if (p.kind === "openai-responses")
-                return { type: "oauth", providerId };
+            if (p.kind === "openai-responses") {
+                // 0.40.7: a sign-in whose renewal the endpoint REFUSED is over —
+                // unavailable here, where /model reads it, not first at a turn
+                if (stored.refreshRejectedAt !== undefined) {
+                    throw new ConfigError(`model ${name}: unavailable — the ${providerId} sign-in was refused when kiso tried to renew it: run \`kiso login ${providerId}\``);
+                }
+                return { type: "oauth", providerId, expires: stored.expires };
+            }
             throw new ConfigError(`model ${name}: signed in to ${providerId} with OAuth, but this profile's adapter needs an API key — run \`kiso login ${providerId}\` with a key, or \`kiso logout ${providerId}\` to use the env var ${p.apiKeyEnv ?? "(none configured)"}`);
         }
     }

package/dist/dispatch.js

@@ -101,13 +101,31 @@ function effortAxis(p) {
             : {}),
     };
 }
-/** What signs a profile in, for the listing: the env var's name, `oauth`
- *  for a subscription sign-in, or `no key` for an unauthenticated endpoint. */
+/** What signs a profile in, for the listing: `stored key` when a key in
+ *  auth.json pays (a vendor's, or a gateway's `kiso login --endpoint`),
+ *  `oauth` for a subscription sign-in, else the env var's name, or `no key`
+ *  for an unauthenticated endpoint.
+ *
+ *  0406-F1: this named the env var whenever a profile had one, so a row
+ *  paid by the stored key read `DEEPSEEK_API_KEY (available)` with that
+ *  variable unset — and after 0.40.6's endpoint login every gateway row
+ *  would have named a variable nobody exports any more. */
+/** MP-1 (0.40.7): who a profile's requests are billed to — the endpoint
+ *  and the credential that pays there (`@api.deepseek.com · stored key`). */
+function payeeOf(p) {
+    const host = profileProviderLabel(p.kind, p.baseUrl, p.upstream);
+    const who = signInNote(p).replace(/, expired — renews on use$/, "");
+    return host === "" ? who : `${host} · ${who}`;
+}
 function signInNote(p) {
     try {
         const auth = authForProfile("?", p);
+        // 0.40.7: an access token past its expiry is not a dead sign-in — the
+        // next use renews it — but the row says so rather than nothing
         if (auth.type === "oauth")
-            return "oauth";
+            return auth.expires !== undefined && auth.expires < Date.now() ? "oauth, expired — renews on use" : "oauth";
+        if (auth.source === "store")
+            return "stored key";
     }
     catch {
         // unavailable — the availability mark says so; the env name still names what would sign it in
@@ -564,6 +582,8 @@ export function dispatch(line, ctx) {
                         ctx.input.panelAsk(modePickView({
                             header: `mode — current: ${current}`,
                             options: OFFERED_MODES.map((name) => ({ label: name, note: [MODE_NOTE[name], ...(name === current ? ["current"] : [])].join(" · ") })),
+                            // MP-1 (0.40.7): the cursor opens on the tier in force
+                            ...(OFFERED_MODES.indexOf(current) >= 0 ? { initial: OFFERED_MODES.indexOf(current) } : {}),
                         }, 
                         // DC-12 (design §4): a panel WAITING ON A HUMAN says ❯.
                         ctx.isRunning() ? "❯ run paused" : `▸ ${current}`), (v) => resolve(v.action === "picked" ? v.result : null));
@@ -653,6 +673,9 @@ export function dispatch(line, ctx) {
                         // "openai/…" hint failed with "no such model profile"
                         // on exactly the fresh-install path that shows it.
                         typeHint: names.length === 0 ? "type provider/model directly (e.g. openai-compat/deepseek-reasoner)" : "type provider/model directly",
+                        // MP-1 (0.40.7): the cursor opens on the session's own
+                        // profile — opening on row 0 plus one Enter changed who pays
+                        ...(currentProfileName !== null && names.indexOf(currentProfileName) >= 0 ? { initial: names.indexOf(currentProfileName) } : {}),
                         // the zero-profile copy is TODAY'S, verbatim: the
                         // user who sees it is exactly the user who needs
                         // the path spelled out
@@ -788,6 +811,10 @@ export function dispatch(line, ctx) {
                                 // display — a direct provider/model has none.
                                 profileName: direct === null ? profName : null,
                             };
+                            // MP-1 (0.40.7): who pays BEFORE the switch, read while the
+                            // session still names the outgoing profile
+                            const prevProfile = currentProfileName !== null ? configModels[currentProfileName] : undefined;
+                            const payeeBefore = prevProfile !== undefined ? payeeOf(prevProfile) : null;
                             ctx.session.setModelBinding(binding);
                             setLastBinding(binding);
                             setAgentModel(profile.model, profile.baseUrl);
@@ -814,6 +841,13 @@ export function dispatch(line, ctx) {
                             // model beside the previous model's figure.
                             ctx.modelSwitched();
                             body.notice(`model → ${profName} (${profile.model}${providerLabel(profile.baseUrl, profile.upstream) === "" ? "" : ` ${providerLabel(profile.baseUrl, profile.upstream)}`}${effortTok !== undefined ? ` · ${effortTok}` : ""}) — takes effect on the next turn`);
+                            // MP-1 (0.40.7): when the switch changes WHO PAYS — another
+                            // endpoint, or another credential for it — say so, once,
+                            // under the switch line. A switch between two models on the
+                            // same account says nothing more.
+                            const payeeAfter = payeeOf(profile);
+                            if (payeeBefore !== null && payeeBefore !== payeeAfter)
+                                body.notice(`paid by ${payeeAfter} from the next turn — was ${payeeBefore}`);
                         }
                     }
                 }

package/dist/index.js

@@ -54,6 +54,7 @@ import { fauxSkip, readFauxScript } from "./faux-glue.js";
 import { chat, compactionDiscardedNotice, contextWindowTokens, displayCtxRatio, knownContextWindow, microcompactThresholdFor, statusModelLabel, unknownWindowNotice, windowLearnedNotice } from "./chat.js";
 import { recordLearnedWindow, useLearnedWindows } from "./learned-windows.js";
 import { preferences, usePreferences } from "./preferences.js";
+import { sweepStaleMergeDirs } from "./temp-sweep.js";
 import { settingsLayers } from "./state.js";
 import { providerHost } from "./provider-label.js";
 import { adapterOptionsFor } from "./auth/adapter-options.js";
@@ -68,6 +69,8 @@ import { armByteTrace } from "./byte-trace.js";
 import { tmpdir, homedir } from "node:os";
 import { clipboardImage } from "./clipboard.js";
 import { cardsFromListings } from "./session-cards.js";
+/** 0.40.7: the stale-merge-directory sweep runs once per process. */
+let tempSwept = false;
 // The moved exports stay reachable from this entry — the test imports
 // (project-trust, coding-agent) never change (B4: zero assertion changes).
 export { applyProjectMerges } from "./trust-ui.js";
@@ -782,11 +785,17 @@ async function makeAgent(sessionId, input, modelFlag) {
     // channel and not an exported KISO_SESSIONS_DIR: a variable in
     // process.env would reach every shell child, and a kiso started from a
     // shell tool would then write into this project's folder.
-    process.env.KISO_DELEGATION_CONFIG_JSON = JSON.stringify({ checks: merged.checks ?? {}, profiles: Object.keys(merged.models ?? {}), sessionsDir: sessionsDir() });
+    process.env.KISO_DELEGATION_CONFIG_JSON = JSON.stringify({ checks: merged.checks ?? {}, evaluators: merged.evaluators ?? [], profiles: Object.keys(merged.models ?? {}), sessionsDir: sessionsDir() });
     setConfigModels(merged.models ?? {});
     // CW-1 batch 2: the windows endpoints stated by refusing — read before the
     // first window is asked for (the unknown-window notice below).
     useLearnedWindows();
+    // 0.40.7: the merge directories a killed kiso left in the temp dir —
+    // once per process, never this process's own (temp-sweep.ts)
+    if (!tempSwept) {
+        tempSwept = true;
+        sweepStaleMergeDirs();
+    }
     const resolved = resolveModel(modelFlag, merged);
     // AFTER the model resolves: the window a PROFILE states is about that
     // profile's model, so it cannot be read before we know which profile is
@@ -1292,7 +1301,7 @@ async function reloadAgent(old, id, input, announce = true) {
                 rmSync(p, { recursive: true, force: true });
             }
             catch {
-                // best-effort — the temp dir would be reaped by the OS
+                // best-effort — a survivor is removed by a later startup's sweep (temp-sweep.ts) once this process is gone
             }
         }
         mergedTempPaths.push(...oldTemps);
@@ -1321,7 +1330,7 @@ async function reloadAgent(old, id, input, announce = true) {
             rmSync(p, { recursive: true, force: true });
         }
         catch {
-            // best-effort — the temp dir would be reaped by the OS
+            // best-effort — a survivor is removed by a later startup's sweep (temp-sweep.ts) once this process is gone
         }
     }
     if (announce)
@@ -2047,7 +2056,7 @@ async function main() {
                         if (cred.type === "api-key")
                             lines.push(`  ${id.padEnd(10)} api-key ${maskSecret(cred.key)}  saved ${new Date(cred.savedAt).toISOString().slice(0, 10)}`);
                         else
-                            lines.push(`  ${id.padEnd(10)} oauth   ${cred.accountId ?? ""}  expires ${new Date(cred.expires).toISOString()}${cred.expires < Date.now() ? " (expired)" : ""}`);
+                            lines.push(`  ${id.padEnd(10)} oauth   ${cred.accountId ?? ""}  expires ${new Date(cred.expires).toISOString()}${cred.refreshRejectedAt !== undefined ? ` (renewal refused — run kiso login ${id})` : cred.expires < Date.now() ? " (expired — renews on use)" : ""}`);
                     }
                     const envs = ["ANTHROPIC_API_KEY", "OPENAI_API_KEY"].filter((k) => process.env[k] !== undefined);
                     lines.push(`env vars set: ${envs.length ? envs.join(", ") : "none"} (a stored credential owns its provider; env applies only when nothing is stored)`);
@@ -2198,7 +2207,7 @@ async function main() {
                 rmSync(p, { recursive: true, force: true });
             }
             catch {
-                // best-effort — the temp dir would be reaped by the OS
+                // best-effort — a survivor is removed by a later startup's sweep (temp-sweep.ts) once this process is gone
             }
         }
     }

package/dist/readonly-shell.js

@@ -33,7 +33,7 @@
 import { statSync } from "node:fs";
 import { homedir } from "node:os";
 import { basename, isAbsolute, join, relative } from "node:path";
-import { isCredentialName } from "@vincemakes/kiso-tools-node";
+import { isCredentialName, isCredentialPath } from "@vincemakes/kiso-tools-node";
 import { getMode } from "./mode.js";
 import { HOME_SUBTREES, parseShell, realCase, resolveShellPath } from "./shell-words.js";
 // ── the predicates ──────────────────────────────────────────────────────
@@ -55,15 +55,11 @@ function scope(ctx, word) {
     }
     return null;
 }
-/** B4: credentials by the shell's own list — names the search corpus's
- *  rule does not cover, on the canonical path. (The corpus rule itself,
- *  shared with read_file and search_text, is not moved before the freeze:
- *  finding RO-F4, 0.41.0.) */
-const SHELL_CREDENTIAL_NAMES = new Set([".npmrc", ".pypirc", ".git-credentials", ".htpasswd"]);
-const SHELL_CREDENTIAL_PATHS = ["/.aws/credentials", "/.config/gh/hosts.yml", "/.docker/config.json", "/.kube/config"];
+/** B4, and since RO-F4 (0.40.7) the search corpus's own set: the shell and
+ *  the file tools ask ONE rule — names (`isCredentialName`) and the
+ *  directory-scoped paths (`isCredentialPath`) — on the canonical path. */
 function shellCredential(canonical) {
-    const folded = canonical.toLowerCase();
-    return SHELL_CREDENTIAL_NAMES.has(basename(folded)) || SHELL_CREDENTIAL_PATHS.some((s) => folded.endsWith(s));
+    return isCredentialName(basename(canonical).toLowerCase()) || isCredentialPath(canonical);
 }
 function content(ctx, word) {
     const s = scope(ctx, word);

package/dist/temp-sweep.d.ts

@@ -0,0 +1,12 @@
+export declare const LEGACY_MAX_AGE_MS: number;
+/** One startup never spends long here, whatever the temp directory holds. */
+export declare const SWEEP_LIMIT = 200;
+/** The mkdtemp prefix for a merge directory: this process's pid in the name. */
+export declare function mergeDirPrefix(kind: "mcp" | "skills"): string;
+/** Is a process with this pid running? EPERM means it is, and belongs to
+ *  someone else; only ESRCH says it is gone. */
+export declare function pidAlive(pid: number): boolean;
+/** Remove the merge directories whose owner is gone (and legacy ones a week
+ *  old). Returns the names removed. Every failure is skipped — a sweep is
+ *  housekeeping, never a reason for a session not to start. */
+export declare function sweepStaleMergeDirs(dir?: string, now?: number, alive?: (pid: number) => boolean): string[];

package/dist/temp-sweep.js

@@ -0,0 +1,76 @@
+/**
+ * 0.40.7 — the merge directories a killed kiso left behind.
+ *
+ * A project with its own `.kiso/mcp.json` or skills gets a merged copy in
+ * the temp directory (`kiso-mcp-*`, `kiso-skills-*`, trust-ui.ts). A clean
+ * exit removes it; `kill -9` does not, and macOS's temp cleaner removes old
+ * FILES but leaves directories — so every killed session left one behind
+ * for good (the owner's machine once held 449,956 of the test suite's).
+ *
+ * The directory's name now carries its owner's pid
+ * (`kiso-mcp-<pid>-XXXXXX`). At startup kiso removes the ones whose owner
+ * is gone; a live session's directory is never touched. Names from before
+ * this version carry no pid: those are removed only when untouched for a
+ * week, which no live session's merge can be (it is read at every reload).
+ * Only directories this user owns are considered; nothing else in the
+ * temp directory is read.
+ */
+import { lstatSync, readdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+export const LEGACY_MAX_AGE_MS = 7 * 24 * 3600_000;
+/** One startup never spends long here, whatever the temp directory holds. */
+export const SWEEP_LIMIT = 200;
+const OWNED = /^kiso-(?:mcp|skills)-(\d+)-[A-Za-z0-9]{6}$/;
+const LEGACY = /^kiso-(?:mcp|skills)-[A-Za-z0-9]{6}$/;
+/** The mkdtemp prefix for a merge directory: this process's pid in the name. */
+export function mergeDirPrefix(kind) {
+    return join(tmpdir(), `kiso-${kind}-${process.pid}-`);
+}
+/** Is a process with this pid running? EPERM means it is, and belongs to
+ *  someone else; only ESRCH says it is gone. */
+export function pidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err.code === "EPERM";
+    }
+}
+/** Remove the merge directories whose owner is gone (and legacy ones a week
+ *  old). Returns the names removed. Every failure is skipped — a sweep is
+ *  housekeeping, never a reason for a session not to start. */
+export function sweepStaleMergeDirs(dir = tmpdir(), now = Date.now(), alive = pidAlive) {
+    let names;
+    try {
+        names = readdirSync(dir);
+    }
+    catch {
+        return [];
+    }
+    const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
+    const removed = [];
+    for (const name of names) {
+        if (removed.length >= SWEEP_LIMIT)
+            break;
+        const owned = OWNED.exec(name);
+        if (owned === null && !LEGACY.test(name))
+            continue;
+        const full = join(dir, name);
+        try {
+            const st = lstatSync(full);
+            if (!st.isDirectory() || (uid !== undefined && st.uid !== uid))
+                continue;
+            const stale = owned !== null ? Number(owned[1]) !== process.pid && !alive(Number(owned[1])) : now - st.mtimeMs > LEGACY_MAX_AGE_MS;
+            if (!stale)
+                continue;
+            rmSync(full, { recursive: true, force: true });
+            removed.push(name);
+        }
+        catch {
+            // gone already, or not ours to remove
+        }
+    }
+    return removed;
+}

package/dist/trust-ui.js

@@ -6,13 +6,14 @@
  * decisions. All bodies moved verbatim from index.ts.
  */
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, symlinkSync, writeFileSync } from "node:fs";
-import { homedir, tmpdir } from "node:os";
+import { homedir } from "node:os";
 import { join } from "node:path";
 import { pathToFileURL } from "node:url";
 import { askDeclineAll, askView, projectTrustRows, projectTrustView, projectUntrustedNote, uncertainView, unansweredAskView } from "@vincemakes/kiso-tui";
 import { projectArtifacts, recordTrust, trustFor } from "@vincemakes/kiso-runtime";
 import { bodyLog, currentAgentExtensions, dock, extensionsDir, kisoHome, mergedTempPaths, neverInherited } from "./state.js";
 import { guardSavedAllow } from "./protected-writes.js";
+import { mergeDirPrefix } from "./temp-sweep.js";
 import { loadUserConfig, resolveProjectTrustPolicy } from "./config.js";
 import { getMode } from "./mode.js";
 /**
@@ -415,7 +416,7 @@ function applyMcpMerge(root) {
     // the paths the previous set owned deleted the file the new set had just
     // been merged into. One directory per merge, and the directory is what is
     // recorded, so the cleanup removes exactly what that merge created.
-    const dir = mkdtempSync(join(tmpdir(), "kiso-mcp-"));
+    const dir = mkdtempSync(mergeDirPrefix("mcp")); // 0.40.7: the owner's pid in the name (temp-sweep.ts)
     const temp = join(dir, "mcp.json");
     writeFileSync(temp, `${JSON.stringify(merged, null, 2)}\n`, "utf8");
     process.env.KISO_MCP_CONFIG = temp;
@@ -442,7 +443,7 @@ function applySkillsMerge(root) {
     originalUserSkillsDir ??= process.env.KISO_SKILLS_DIR ?? join(kisoHome(), "skills");
     const userDir = originalUserSkillsDir;
     const projectDir = join(root, "skills");
-    const merged = mkdtempSync(join(tmpdir(), "kiso-skills-"));
+    const merged = mkdtempSync(mergeDirPrefix("skills"));
     mergedTempPaths.push(merged);
     for (const dir of readdirSyncSafe(projectDir)) {
         symlinkSync(join(projectDir, dir), join(merged, dir)); // project wins on collision

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@vincemakes/kiso-code",
-	"version": "0.40.6",
+	"version": "0.40.7",
 	"description": "kiso-code \u2014 the coding agent on kiso, the durable runtime for AI agents: kiso chat / kiso resume / kiso sessions.",
 	"type": "module",
 	"license": "MIT",
@@ -18,20 +18,20 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@vincemakes/kiso-ask-ext": "0.40.6",
-		"@vincemakes/kiso-core": "0.40.6",
-		"@vincemakes/kiso-evals": "0.40.6",
-		"@vincemakes/kiso-mcp-ext": "0.40.6",
-		"@vincemakes/kiso-provider-anthropic": "0.40.6",
-		"@vincemakes/kiso-provider-openai": "0.40.6",
-		"@vincemakes/kiso-provider-openai-responses": "0.40.6",
-		"@vincemakes/kiso-runtime": "0.40.6",
-		"@vincemakes/kiso-skills-ext": "0.40.6",
-		"@vincemakes/kiso-subagent-ext": "0.40.6",
-		"@vincemakes/kiso-task-ext": "0.40.6",
-		"@vincemakes/kiso-tools-node": "0.40.6",
-		"@vincemakes/kiso-tui": "0.40.6",
-		"@vincemakes/kiso-tui-cells": "0.40.6"
+		"@vincemakes/kiso-ask-ext": "0.40.7",
+		"@vincemakes/kiso-core": "0.40.7",
+		"@vincemakes/kiso-evals": "0.40.7",
+		"@vincemakes/kiso-mcp-ext": "0.40.7",
+		"@vincemakes/kiso-provider-anthropic": "0.40.7",
+		"@vincemakes/kiso-provider-openai": "0.40.7",
+		"@vincemakes/kiso-provider-openai-responses": "0.40.7",
+		"@vincemakes/kiso-runtime": "0.40.7",
+		"@vincemakes/kiso-skills-ext": "0.40.7",
+		"@vincemakes/kiso-subagent-ext": "0.40.7",
+		"@vincemakes/kiso-task-ext": "0.40.7",
+		"@vincemakes/kiso-tools-node": "0.40.7",
+		"@vincemakes/kiso-tui": "0.40.7",
+		"@vincemakes/kiso-tui-cells": "0.40.7"
 	},
 	"devDependencies": {
 		"@types/node": "^26.1.2",