@vincemakes/kiso-code 0.15.1 → 0.15.2

package/dist/dispatch.js

@@ -4,9 +4,10 @@
  * the context (the chain, the run state, the prompt arming).
  */
 import { contextRows, contextUnavailableRows, displayVerb, escapeTerminal, helpRows, kUnit, modelPickView, palette } from "@vincemakes/kiso-tui";
+import { newSessionId } from "./session-id.js";
 import { buildAdapter } from "@vincemakes/kiso-runtime/internal";
 import { MODES, getMode, setMode } from "./mode.js";
-import { agentModel, body, bodyLog, configModels, dock, readContextLedger, setAgentModel, setCurrentModelName } from "./state.js";
+import { agentModel, body, bodyLog, configModels, dock, readContextLedger, sessionsDir, setAgentModel, setCurrentModelName } from "./state.js";
 import { directWriteProfile, profileAvailable } from "./config.js";
 /** The ONE dispatcher — slash commands, exit, and turns. The recovery
  *  replay routes through it too — a queued "/last" must never become a
@@ -383,7 +384,7 @@ export function dispatch(line, ctx) {
             ctx.input.prompt();
             return;
         }
-        ctx.requestSwitch(new Date().toISOString().replace(/[:.]/g, "-").slice(0, 16));
+        ctx.requestSwitch(newSessionId(sessionsDir()));
         return;
     }
     if (trimmed === "/resume" || trimmed.startsWith("/resume ")) {

package/dist/index.js

@@ -24,6 +24,7 @@
  * makeAgent, and main.
  */
 import { appendFileSync, mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { newSessionId } from "./session-id.js";
 import { createInterface } from "node:readline";
 import { fileURLToPath } from "node:url";
 import { join } from "node:path";
@@ -755,7 +756,7 @@ async function main() {
         if (printPrompt !== undefined) {
             // the -p flow: recovery-first one-shot, the resume() machinery
             // verbatim (a fresh id makes the recovery a no-op)
-            const id = command ?? new Date().toISOString().replace(/[:.]/g, "-").slice(0, 16);
+            const id = command ?? newSessionId(sessionsDir());
             agent = await makeAgent(id, input, modelFlag);
             applyConfigMode();
             const session = await agent.session({ id });
@@ -767,7 +768,7 @@ async function main() {
         }
         switch (command) {
             case "chat": {
-                const id = arg ?? new Date().toISOString().replace(/[:.]/g, "-").slice(0, 16);
+                const id = arg ?? newSessionId(sessionsDir());
                 // v2b: the dock (TTY only) wraps the whole session — the
                 // trust question, the banner, the body, and the input line.
                 dock.enter();
@@ -884,7 +885,7 @@ async function main() {
             default: {
                 // A area: no subcommand (or any non-command first argument) IS
                 // chat — the first argument is the session id.
-                const id = command ?? new Date().toISOString().replace(/[:.]/g, "-").slice(0, 16);
+                const id = command ?? newSessionId(sessionsDir());
                 dock.enter();
                 // R-I-p2 (finding R-I-p-2): the bare command passes the SAME
                 // input source and model flag as chat/resume — the pre-patch

package/dist/session-id.d.ts

@@ -0,0 +1,54 @@
+/**
+ * RD1B-F9 — the auto-generated session id, in ONE place.
+ *
+ * It used to be this expression, copied at four call sites:
+ *
+ *     new Date().toISOString().replace(/[:.]/g, "-").slice(0, 16)
+ *
+ * which stops at the MINUTE and carries no entropy. `SessionStore` is one
+ * file per id, so two sessions started in the same minute were the same
+ * session: the second launch presented as fresh and transparently appended
+ * to the first one's durable log (`tests/session-id-identity.test.ts`).
+ *
+ * WHAT THE GUARANTEE IS, precisely — because the first version of this
+ * comment claimed "collision-safe at any launch rate a human or a script
+ * produces" and that was an unmeasured claim that is false. A 16-bit
+ * suffix collides at script rates: 100 launches inside one second carry a
+ * 7.3% chance of at least one collision, and 1,000 produce a handful every
+ * time. Measured, not modelled.
+ *
+ * So the id does not rest on entropy at all:
+ *
+ *   - SEQUENTIAL collision is eliminated BY CONSTRUCTION. `newSessionId`
+ *     is handed the sessions directory and will not return an id whose
+ *     durable log or lock already exists; it draws again. Entropy only
+ *     decides how often it has to draw.
+ *   - CONCURRENT collision — two processes drawing the same id before
+ *     either has written — remains possible and is already handled
+ *     correctly one layer down: the store's single-writer link lock
+ *     (ADR-0050) fails the second writer loudly, and `storage.test.ts`
+ *     pins that. Loud failure is the right outcome there; silent sharing
+ *     was the defect.
+ *
+ * The id keeps the one property anything depends on: **lexicographic order
+ * is time order**, because `listSessions` sorts with `id.localeCompare`
+ * and nothing anywhere parses an id back into a date. Seconds extend the
+ * stamp monotonically; the suffix only breaks ties inside one second.
+ *
+ * It also stays 24 characters — exactly the session picker's id column cap
+ * (`packages/tui/src/session-picker.ts:112`). Widening the suffix instead
+ * of checking for collisions would have pushed the distinguishing tail out
+ * of the column, hiding the very bytes that make two ids different.
+ *
+ * Old ids are untouched — no rename, no migration. They still resume by id
+ * and still sort before same-minute new ids.
+ */
+/**
+ * A fresh session id: `YYYY-MM-DDTHH-MM-SS-xxxx`, sortable, and — when
+ * `dir` is given — guaranteed not to name a session that already exists
+ * there.
+ *
+ * `rand` is injectable so the collision path can be tested; production
+ * never passes it.
+ */
+export declare function newSessionId(dir?: string, now?: Date, rand?: () => string): string;

package/dist/session-id.js

@@ -0,0 +1,74 @@
+/**
+ * RD1B-F9 — the auto-generated session id, in ONE place.
+ *
+ * It used to be this expression, copied at four call sites:
+ *
+ *     new Date().toISOString().replace(/[:.]/g, "-").slice(0, 16)
+ *
+ * which stops at the MINUTE and carries no entropy. `SessionStore` is one
+ * file per id, so two sessions started in the same minute were the same
+ * session: the second launch presented as fresh and transparently appended
+ * to the first one's durable log (`tests/session-id-identity.test.ts`).
+ *
+ * WHAT THE GUARANTEE IS, precisely — because the first version of this
+ * comment claimed "collision-safe at any launch rate a human or a script
+ * produces" and that was an unmeasured claim that is false. A 16-bit
+ * suffix collides at script rates: 100 launches inside one second carry a
+ * 7.3% chance of at least one collision, and 1,000 produce a handful every
+ * time. Measured, not modelled.
+ *
+ * So the id does not rest on entropy at all:
+ *
+ *   - SEQUENTIAL collision is eliminated BY CONSTRUCTION. `newSessionId`
+ *     is handed the sessions directory and will not return an id whose
+ *     durable log or lock already exists; it draws again. Entropy only
+ *     decides how often it has to draw.
+ *   - CONCURRENT collision — two processes drawing the same id before
+ *     either has written — remains possible and is already handled
+ *     correctly one layer down: the store's single-writer link lock
+ *     (ADR-0050) fails the second writer loudly, and `storage.test.ts`
+ *     pins that. Loud failure is the right outcome there; silent sharing
+ *     was the defect.
+ *
+ * The id keeps the one property anything depends on: **lexicographic order
+ * is time order**, because `listSessions` sorts with `id.localeCompare`
+ * and nothing anywhere parses an id back into a date. Seconds extend the
+ * stamp monotonically; the suffix only breaks ties inside one second.
+ *
+ * It also stays 24 characters — exactly the session picker's id column cap
+ * (`packages/tui/src/session-picker.ts:112`). Widening the suffix instead
+ * of checking for collisions would have pushed the distinguishing tail out
+ * of the column, hiding the very bytes that make two ids different.
+ *
+ * Old ids are untouched — no rename, no migration. They still resume by id
+ * and still sort before same-minute new ids.
+ */
+import { randomBytes } from "node:crypto";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+/** How many draws before giving up. Reaching this means either the clock
+ *  is frozen or the directory holds ~every suffix for this second; both
+ *  are worth failing loudly over rather than returning a colliding id. */
+const MAX_DRAWS = 50;
+const stampOf = (now, suffix) => `${now.toISOString().replace(/[:.]/g, "-").slice(0, 19)}-${suffix}`;
+/**
+ * A fresh session id: `YYYY-MM-DDTHH-MM-SS-xxxx`, sortable, and — when
+ * `dir` is given — guaranteed not to name a session that already exists
+ * there.
+ *
+ * `rand` is injectable so the collision path can be tested; production
+ * never passes it.
+ */
+export function newSessionId(dir, now = new Date(), rand = () => randomBytes(2).toString("hex")) {
+    if (dir === undefined)
+        return stampOf(now, rand());
+    for (let draw = 0; draw < MAX_DRAWS; draw += 1) {
+        const id = stampOf(now, rand());
+        // The store writes `<id>.jsonl` and takes `<id>.lock`; either one
+        // present means the id is spoken for, including by a session that
+        // has locked but not yet appended.
+        if (!existsSync(join(dir, `${id}.jsonl`)) && !existsSync(join(dir, `${id}.lock`)))
+            return id;
+    }
+    throw new Error(`could not draw an unused session id in ${dir} after ${MAX_DRAWS} attempts`);
+}

package/dist/trust-ui.js

@@ -70,6 +70,28 @@ opts) {
                 resolve(verdict);
             }, opts);
         }
+        else if (view.ask) {
+            // RD1B-F6: a multiple-choice ask has NO dock-less form. The
+            // fallback said so — "the question is declined" — and then
+            // waited for a line anyway, forever, on input nothing in the
+            // environment knows to send: the surface has just announced
+            // the interaction is over. An unattended run did not fail
+            // there, it stopped, silently (RD-1B c9-r2).
+            //
+            // So the sentence becomes true. There is no panel, therefore
+            // no answer is obtainable, therefore the ask declines NOW and
+            // the model gets an honest refusal to act on. Waiting could
+            // only ever have produced the same decline, later, and every
+            // line typed at it was discarded anyway.
+            //
+            // The y/n fallback below still serves the views that really
+            // do take a yes or no — the uncertainty gate, the trust
+            // prompt, the verify offer. Those have a dock-less form.
+            settled = true;
+            pendingAsk = null;
+            bodyLog(view.fallbackQuestion);
+            resolve({ action: "deny", reason: "no option panel in this terminal" });
+        }
         else {
             // v2c: a TTY without a dock (rows < 4) — the fallback question
             // in the body; the y/n line answer maps to the verdicts.

package/package.json

@@ -1,56 +1,56 @@
 {
-  "name": "@vincemakes/kiso-code",
-  "version": "0.15.1",
-  "description": "kiso CLI — the durable coding agent that survives kill -9: kiso chat / kiso resume / kiso sessions.",
-  "type": "module",
-  "license": "MIT",
-  "bin": {
-    "kiso": "dist/index.js"
-  },
-  "files": [
-    "dist",
-    "README.md",
-    "LICENSE"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json",
-    "typecheck": "tsc -p tsconfig.json",
-    "test": "vitest run"
-  },
-  "dependencies": {
-    "@vincemakes/kiso-ask-ext": "0.15.1",
-    "@vincemakes/kiso-core": "0.15.1",
-    "@vincemakes/kiso-evals": "0.15.1",
-    "@vincemakes/kiso-mcp-ext": "0.15.1",
-    "@vincemakes/kiso-provider-anthropic": "0.15.1",
-    "@vincemakes/kiso-provider-openai": "0.15.1",
-    "@vincemakes/kiso-runtime": "0.15.1",
-    "@vincemakes/kiso-skills-ext": "0.15.1",
-    "@vincemakes/kiso-subagent-ext": "0.15.1",
-    "@vincemakes/kiso-task-ext": "0.15.1",
-    "@vincemakes/kiso-tools-node": "0.15.1",
-    "@vincemakes/kiso-tui": "0.15.1",
-    "@vincemakes/kiso-tui-cells": "0.15.1"
-  },
-  "devDependencies": {
-    "@types/node": "^26.1.2",
-    "typescript": "^5.7.2",
-    "vitest": "^3.0.0"
-  },
-  "engines": {
-    "node": ">=22"
-  },
-  "os": [
-    "darwin",
-    "linux"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/vincemakes/kiso.git",
-    "directory": "apps/cli"
-  },
-  "bugs": {
-    "url": "https://github.com/vincemakes/kiso/issues"
-  },
-  "homepage": "https://github.com/vincemakes/kiso/tree/main/apps/cli#readme"
+	"name": "@vincemakes/kiso-code",
+	"version": "0.15.2",
+	"description": "kiso CLI \u2014 the durable coding agent that survives kill -9: kiso chat / kiso resume / kiso sessions.",
+	"type": "module",
+	"license": "MIT",
+	"bin": {
+		"kiso": "dist/index.js"
+	},
+	"files": [
+		"dist",
+		"README.md",
+		"LICENSE"
+	],
+	"scripts": {
+		"build": "tsc -p tsconfig.build.json",
+		"typecheck": "tsc -p tsconfig.json",
+		"test": "vitest run"
+	},
+	"dependencies": {
+		"@vincemakes/kiso-ask-ext": "0.15.2",
+		"@vincemakes/kiso-core": "0.15.2",
+		"@vincemakes/kiso-evals": "0.15.2",
+		"@vincemakes/kiso-mcp-ext": "0.15.2",
+		"@vincemakes/kiso-provider-anthropic": "0.15.2",
+		"@vincemakes/kiso-provider-openai": "0.15.2",
+		"@vincemakes/kiso-runtime": "0.15.2",
+		"@vincemakes/kiso-skills-ext": "0.15.2",
+		"@vincemakes/kiso-subagent-ext": "0.15.2",
+		"@vincemakes/kiso-task-ext": "0.15.2",
+		"@vincemakes/kiso-tools-node": "0.15.2",
+		"@vincemakes/kiso-tui": "0.15.2",
+		"@vincemakes/kiso-tui-cells": "0.15.2"
+	},
+	"devDependencies": {
+		"@types/node": "^26.1.2",
+		"typescript": "^5.7.2",
+		"vitest": "^3.0.0"
+	},
+	"engines": {
+		"node": ">=22"
+	},
+	"os": [
+		"darwin",
+		"linux"
+	],
+	"repository": {
+		"type": "git",
+		"url": "https://github.com/vincemakes/kiso.git",
+		"directory": "apps/cli"
+	},
+	"bugs": {
+		"url": "https://github.com/vincemakes/kiso/issues"
+	},
+	"homepage": "https://github.com/vincemakes/kiso/tree/main/apps/cli#readme"
 }