diff --git a/packages/editor/src/renderer.scss b/packages/editor/src/renderer.scss
index a930673d..6e95e190 100644
--- a/packages/editor/src/renderer.scss
+++ b/packages/editor/src/renderer.scss
@@ -230,10 +230,13 @@ button.kite3d-status-chip {
   top: 0;
   user-select: none;
   z-index: 1;
-  background: var(--pt-app-background-color);
+  // The panel's own colour, so a collapsed header reads as a row and not as a selection.
+  // Both colours here are opaque, so rows scrolling under the sticky header stay hidden.
+  background: var(--main-app-background);
 }
 .resources-section-header:hover{
-  background: var(--pt-minimal-button-background-color-hover);
+  // One step lighter than the panel, the lift a hovered tree row shows.
+  background: var(--pt-app-background-color);
 }
 .resources-section-title{
   flex: 1 1 auto;
diff --git a/packages/kite3d/package.json b/packages/kite3d/package.json
index f63020c6..f84958e3 100644
--- a/packages/kite3d/package.json
+++ b/packages/kite3d/package.json
@@ -17,7 +17,7 @@
     "node": ">=20"
   },
   "scripts": {
-    "build": "rimraf dist && tsc -p tsconfig.build.json",
+    "build": "rimraf dist && tsc -p tsconfig.build.json && node -e \"require('fs').chmodSync('dist/cli.js', 0o755)\"",
     "typecheck": "tsc --noEmit",
     "lint": "eslint src test --ext ts --report-unused-disable-directives --max-warnings 0 && eslint template --ext js --report-unused-disable-directives --max-warnings 0",
     "test": "vitest run"
diff --git a/packages/kite3d/test/cli-bin.test.ts b/packages/kite3d/test/cli-bin.test.ts
new file mode 100644
index 00000000..4859093b
--- /dev/null
+++ b/packages/kite3d/test/cli-bin.test.ts
@@ -0,0 +1,13 @@
+import {stat} from 'node:fs/promises'
+import {resolve} from 'node:path'
+import {describe, expect, it} from 'vitest'
+
+describe('the built cli', () => {
+    // Guards the owner's report from the terminator project: tsc writes dist/cli.js without the
+    // execute bit, so a project that links this package by path fails on npx kite3d dev with
+    // "Permission denied". The build runs before the tests, in CI and in AGENTS.md.
+    it('keeps the execute bit that the bin link needs', async () => {
+        const {mode} = await stat(resolve('dist/cli.js'))
+        expect(mode & 0o111).toBe(0o111)
+    })
+})