@vincemakes/kiso-code 0.32.0 → 0.32.2

package/dist/auth/credentials.js

@@ -45,22 +45,52 @@ const ORIGIN_TO_PROVIDER = {
  *  openai-CHAT profiles, and the subscription backend serves only the
  *  Responses dialect. */
 const CHATGPT_ORIGIN = "https://chatgpt.com";
+/** R1 — the vendors' OWN origins. A profile whose baseUrl points anywhere
+ *  else authenticates with `apiKeyEnv` and nothing else, however familiar
+ *  the dialect it speaks. */
+const ANTHROPIC_ORIGIN = "https://api.anthropic.com";
+const OPENAI_ORIGIN = "https://api.openai.com";
 /** The provider identity a profile's credential is stored under, or null
  *  for an origin nobody recognizes (custom: env var only). */
 export function providerIdOf(kind, baseUrl) {
-    if (kind === "anthropic")
-        return "anthropic";
-    // OR-1: exactly two identities serve the Responses dialect — the
-    // ChatGPT subscription backend, and OpenAI. There is no `custom`
-    // bucket: a Responses endpoint that is neither is still OpenAI's API
-    // shape behind a proxy, and its credential is OpenAI's.
-    if (kind === "openai-responses")
-        return originOf(baseUrl) === CHATGPT_ORIGIN ? "chatgpt" : "openai";
+    // R1 — A STORED CREDENTIAL NEVER LEAVES THE VENDOR'S OWN ORIGIN.
+    //
+    // This returned `anthropic` for every anthropic-kind profile and
+    // `openai` for every non-ChatGPT Responses profile, whatever the
+    // baseUrl said. `authForProfile` takes the stored credential BEFORE
+    // the profile's `apiKeyEnv`, so a profile pointing at a proxy — with
+    // an explicit key named for that proxy — sent THE VENDOR'S STORED KEY
+    // to the proxy and never read the env var at all. Reproduced against a
+    // local capture in the 2026-09-10 external review.
+    //
+    // OR-1's reasoning is superseded for this question, and the sentence it
+    // turned on is where it went wrong: "a Responses endpoint that is
+    // neither is still OpenAI's API shape behind a proxy, and its
+    // credential is OpenAI's". The DIALECT is OpenAI's; the CREDENTIAL is
+    // not. Who speaks the protocol and who should be paid to answer are
+    // different questions, and only the second one decides where a secret
+    // may go.
+    //
+    // The compat kind was already right — an unrecognized origin resolves
+    // to null and the env var pays — so this makes the other two agree with
+    // the one that had the rule.
+    const origin = originOf(baseUrl);
+    if (kind === "anthropic") {
+        if (baseUrl === undefined)
+            return "anthropic"; // the vendor's own default endpoint
+        return origin === ANTHROPIC_ORIGIN ? "anthropic" : null;
+    }
+    if (kind === "openai-responses") {
+        if (baseUrl === undefined)
+            return "openai"; // the vendor's own default endpoint
+        if (origin === CHATGPT_ORIGIN)
+            return "chatgpt";
+        return origin === OPENAI_ORIGIN ? "openai" : null;
+    }
     if (kind !== "openai-compat")
         return null;
     if (baseUrl === undefined)
         return "openai";
-    const origin = originOf(baseUrl);
     return origin === null ? null : (ORIGIN_TO_PROVIDER[origin] ?? null);
 }
 function originOf(baseUrl) {

package/dist/auth/refresh.js

@@ -29,12 +29,39 @@ export async function ensureFresh(providerId, flow, path, now = Date.now(), toke
     if (refreshed === undefined)
         throw new AuthError(`signed out of ${providerId} (the token could not be refreshed: ${error?.message ?? "unknown"}) — run \`kiso login ${providerId}\``);
     const written = refreshed;
+    // R2a — THE WRITE-BACK MAY NOT RESURRECT WHAT THE HUMAN REMOVED.
+    //
+    // `flow.refresh` is awaited outside the store lock, so anything can
+    // happen to the file while it is on the wire. The old condition kept
+    // only a LATER-EXPIRING entry, which asks the wrong question: an entry
+    // deleted by `kiso logout` is not later-expiring, it is ABSENT, so the
+    // branch fell through and wrote the old credential back — a sign-out
+    // the human performed, undone by a network round trip they never saw.
+    // A new login of another type was overwritten the same way: an api-key
+    // entry is not an oauth entry with a later expiry either.
+    //
+    // The question that is actually being asked is "is this still the
+    // generation I began from?", so that is what is compared: the refresh
+    // token and the expiry captured BEFORE the await. Absent, a different
+    // type, or a different generation — including the concurrent refresh
+    // the old condition was written for — all leave the file alone.
+    const began = current;
     modifyAuthFile((file) => {
         const latest = file.credentials[providerId];
-        // if a concurrent refresh already wrote a fresher token, keep it
-        if (latest !== undefined && latest.type === "oauth" && latest.expires > written.expires)
-            return file;
+        if (latest === undefined)
+            return file; // logged out while we were on the wire
+        if (latest.type !== "oauth")
+            return file; // replaced by a login of another type
+        if (latest.refresh !== began.refresh || latest.expires !== began.expires)
+            return file; // a different generation
         return { version: 1, credentials: { ...file.credentials, [providerId]: written } };
     }, path);
-    return readAuthFile(path).credentials[providerId];
+    // What the FILE holds, not what this refresh produced: if the write was
+    // declined the caller must be told the truth on disk, and an absent
+    // entry is the not-signed-in error rather than an undefined cast to a
+    // Credential.
+    const after = readAuthFile(path).credentials[providerId];
+    if (after === undefined)
+        throw new AuthError(`not signed in to ${providerId}: run \`kiso login ${providerId}\``);
+    return after;
 }

package/dist/byte-trace.js

@@ -41,7 +41,13 @@ function line(dir, data) {
         return;
     const buf = typeof data === "string" ? Buffer.from(data, "utf8") : Buffer.from(data);
     try {
-        appendFileSync(path, `${JSON.stringify({ ms: Date.now() - start, dir, n: buf.length, b: buf.toString("base64") })}\n`);
+        // R6b: 0600 at CREATION. This file is every keystroke and every
+        // paste, base64 — the session log plus the things that never became
+        // a turn, including anything typed and deleted. It is opt-in
+        // debugging, which makes it easy to leave behind and easy to forget
+        // is there; it is the most sensitive file kiso writes and it was the
+        // least protected. An existing file keeps its mode (R6's rule).
+        appendFileSync(path, `${JSON.stringify({ ms: Date.now() - start, dir, n: buf.length, b: buf.toString("base64") })}\n`, { mode: 0o600 });
     }
     catch {
         // a trace that fails must never take the session with it
@@ -65,7 +71,12 @@ export function armByteTrace() {
     path = target;
     start = Date.now();
     try {
-        writeFileSync(path, "");
+        // R6b: the mode belongs HERE, where the file is created. The append
+        // below states it too, but `appendFileSync`'s mode only applies when
+        // it creates the file — and this truncating write always gets there
+        // first, so without this the trace was born 0644 and the append
+        // never had a chance to say otherwise.
+        writeFileSync(path, "", { mode: 0o600 });
     }
     catch {
         path = null;

package/dist/chat.js

@@ -8,6 +8,7 @@ import { readFileSync, statSync } from "node:fs";
 import { escapeTerminal, cacheHitPct, idleStatus, palette, renderEvent, renderRecap, runningStatus, toolTarget, verifyOfferView, STATUS_GLYPHS, } from "@vincemakes/kiso-tui";
 import { askView, deletionRiskHint, editFileDiff, writeFileDiff } from "@vincemakes/kiso-tui";
 import { canonicalTargetPath, shellProgressPath } from "@vincemakes/kiso-tools-node";
+import { echoText } from "@vincemakes/kiso-tui-cells/render";
 import { canonicalizeUsage } from "@vincemakes/kiso-runtime";
 import { canonicalizeUsageForModel, requestBudget } from "@vincemakes/kiso-runtime/internal";
 import { dispatch, abortBangCommand } from "./dispatch.js";
@@ -638,7 +639,9 @@ submitTurn) {
                         body.notice(`  ${typeof ev.content === "string" ? ev.content : ""}`);
                         break;
                     }
-                    body.userLine(typeof ev.content === "string" ? ev.content : "");
+                    // DC-60: a turn that carries an image is a content ARRAY — its words
+                    // still echo, the image as a mark; an empty chip was the bug.
+                    body.userLine(echoText(ev.content));
                     break;
                 case "thinking":
                     body.thinkingAppend(ev.text);

package/dist/dispatch.js

@@ -768,6 +768,17 @@ export function dispatch(line, ctx) {
         });
         return;
     }
+    if (trimmed === "" && dock.active) {
+        // DC-57 (owner ruling 2026-09-10): a bare Enter on the EMPTY composer
+        // does nothing. It used to fall through to the exit below — a rule
+        // from the readline era, where an empty line on a pipe means the
+        // input is over — and the docked editor inherited it, so a stray
+        // Enter at the idle prompt ended the session (measured on 0.32.0).
+        // The pipe path keeps its byte-pinned end; the dock keeps `exit`
+        // and ctrl+c as the ways out.
+        ctx.input.prompt();
+        return;
+    }
     if (trimmed === "exit" || trimmed === "") {
         // PH-1a (finding PH-F11): closing the input MID-RUN killed the very
         // surface a later approval would ask through ("readline was

package/dist/external-editor.js

@@ -33,11 +33,16 @@ import { join } from "node:path";
 export function runExternalEditor(bin, root, text, onFailure) {
     // per INVOCATION, not per run: a directory per call is how the tree
     // grew 400,000 of them once.
-    mkdirSync(root, { recursive: true });
+    // R6b: the draft is the human's own words on their way to an editor.
+    // `mkdtemp` already gives its own directory 0700, so the file was
+    // shielded by WHERE IT SITS rather than by what it is — and the root
+    // above it was created with no mode at all. Both stated now, so the
+    // shield is the file's own and does not depend on a neighbour's default.
+    mkdirSync(root, { recursive: true, mode: 0o700 });
     const dir = mkdtempSync(join(root, "compose-"));
     const file = join(dir, "message.md"); // .md so the editor lights it up
     try {
-        writeFileSync(file, text, "utf8");
+        writeFileSync(file, text, { encoding: "utf8", mode: 0o600 });
         const r = spawnSync(bin, [file], { stdio: "inherit", shell: false });
         if (r.error !== undefined || (r.status !== null && r.status !== 0)) {
             onFailure(`[ctrl+g] ${bin} exited ${r.status ?? "abnormally"} — the composer is unchanged`);

package/dist/first-run.js

@@ -29,9 +29,14 @@ export function isFirstRun() {
  *  first-run sequence is evidenced by the FILES, not an announcement. */
 export function scaffoldFirstRun() {
     const home = kisoHome();
-    mkdirSync(home, { recursive: true });
+    // R6: the home is PRIVATE from its first moment. This is usually the
+    // first thing that creates it, so the mode set here is the one every
+    // later writer inherits by finding the directory already there. The
+    // config may name an env var and the sentinel is empty, but the
+    // directory itself will hold session logs and the history.
+    mkdirSync(home, { recursive: true, mode: 0o700 });
     const config = join(home, "config.json");
     if (!existsSync(config))
-        writeFileSync(config, CONFIG_SCAFFOLD, "utf8");
-    writeFileSync(join(home, SENTINEL), "", "utf8");
+        writeFileSync(config, CONFIG_SCAFFOLD, { encoding: "utf8", mode: 0o600 });
+    writeFileSync(join(home, SENTINEL), "", { encoding: "utf8", mode: 0o600 });
 }

package/dist/index.js

@@ -45,6 +45,7 @@ import { chat, contextWindowTokens, displayCtxRatio, statusModelLabel } from "./
 import { loadProjectConfig, loadUserConfig, mergeConfigs, resolveAutoCompact, resolveContextWindow, resolveModel } from "./config.js";
 import { oauthTokenThunk } from "./auth/token.js";
 import { checkForUpdate, knownUpdate, updateCardLines } from "./update-check.js";
+import { tmuxMouseHint } from "./tmux-hint.js";
 import { resume } from "./resume.js";
 import { resumeTail } from "./resume-tail.js";
 import { armByteTrace } from "./byte-trace.js";
@@ -1004,6 +1005,14 @@ async function chatLoop(first, firstId, input, autoCompact) {
             const known = knownUpdate(updateDeps());
             if (known !== null)
                 paintUpdateCard(known);
+            // DC-59: under tmux without `mouse on`, say why a scroll walks the
+            // history — once, at start, only when it is knowable.
+            const tmuxHint = tmuxMouseHint(process.env, () => {
+                const r = spawnSync("tmux", ["show", "-gv", "mouse"], { encoding: "utf8", timeout: 500 });
+                return r.status === 0 ? r.stdout.trim() : null;
+            });
+            if (tmuxHint !== null)
+                body.notice(tmuxHint);
             void announceUpdate();
         }
         else {
@@ -1232,15 +1241,22 @@ async function main() {
         let seed = [];
         try {
             seed = readFileSync(historyPath, "utf8").split("\n").filter((l) => l !== "").slice(-500);
-            writeFileSync(historyPath, seed.length > 0 ? seed.join("\n") + "\n" : "");
+            // R6: the rewrite keeps the file private. It only runs when the
+            // file already existed, so this is a trim of the user's own
+            // history rather than a creation — the mode is stated so the trim
+            // cannot widen it.
+            writeFileSync(historyPath, seed.length > 0 ? seed.join("\n") + "\n" : "", { mode: 0o600 });
         }
         catch {
             // no file yet, or unreadable — start empty
         }
         input.bindHistory(seed, (line) => {
             try {
-                mkdirSync(kisoHome(), { recursive: true });
-                appendFileSync(historyPath, line.replaceAll("\n", " ") + "\n");
+                // R6: every submitted line lands here, so the history is as
+                // private as the session logs — 0700 home, 0600 file, at
+                // CREATION. An existing file keeps its mode (not migrated).
+                mkdirSync(kisoHome(), { recursive: true, mode: 0o700 });
+                appendFileSync(historyPath, line.replaceAll("\n", " ") + "\n", { mode: 0o600 });
             }
             catch {
                 // best-effort — a full disk never breaks a submit

package/dist/resume-tail.js

@@ -15,6 +15,7 @@
  * renders text. It writes nothing, decides nothing, and cannot disagree
  * with the session because it holds no state of its own.
  */
+import { echoText } from "@vincemakes/kiso-tui-cells/render";
 /** How much of the tail is worth showing. Two turns is enough to
  *  recognise a conversation and short enough that resuming does not
  *  bury the prompt. */
@@ -34,10 +35,24 @@ export function resumeTail(events, W = 80) {
     let reply = "";
     for (const ev of events) {
         const e = ev;
-        if (e.type === "user_input" && typeof e.content === "string") {
+        if (e.type === "user_input") {
+            // R7b: a turn carrying an IMAGE is a content ARRAY, and this kept
+            // only strings — so such a turn was skipped entirely. Skipping an
+            // ASK does not merely lose it: the reply that followed attached to
+            // the PREVIOUS ask, and the resumed tail showed an answer under a
+            // question it did not answer. Worse than showing nothing.
+            //
+            // Projected with the LIVE ECHO's own function, so the tail and the
+            // echo cannot drift: cli → tui-cells is the right direction. The
+            // RUNTIME keeps its own `contentText` (R7) because it cannot
+            // depend on tui-cells — two implementations, one per direction,
+            // agreeing on "(image)".
+            const text = echoText(e.content).trim();
+            if (text === "")
+                continue;
             if (ask !== null)
                 turns.push({ ask, reply });
-            ask = e.content;
+            ask = text;
             reply = "";
         }
         else if (e.type === "text_delta" && typeof e.text === "string" && ask !== null) {

package/dist/tmux-hint.d.ts

@@ -0,0 +1,22 @@
+/**
+ * DC-59 (0.32.2) — the one thing kiso can say about scrolling under tmux.
+ *
+ * Under tmux without `mouse on`, the terminal turns wheel and trackpad
+ * scrolling into arrow keys for tmux's alternate screen and tmux passes
+ * them to the pane: a scroll over the idle composer walks the history
+ * (TMUX-F1). The editor's burst guard collapses a wheel NOTCH — three or
+ * more identical arrows in one read — but a smooth trackpad stream arrives
+ * one arrow per read and is indistinguishable from a hand. With `mouse on`
+ * tmux owns the wheel and kiso receives nothing (measured). So kiso names
+ * the cause once at start when it is knowable, and never guesses: no
+ * `$TMUX`, no question asked; the option unreadable, no hint.
+ *
+ * PURE on purpose: the decision takes the env and a reader; the spawn that
+ * asks tmux lives with the CLI's other spawns (this module's tests are
+ * unit tests and must stay so — the pty-manifest gate classifies by import
+ * closure).
+ */
+export declare const TMUX_MOUSE_HINT = "under tmux without `mouse on`, trackpad and wheel scrolling arrive as arrow keys and walk the composer history \u2014 add `set -g mouse on` to ~/.tmux.conf";
+/** The hint, or null. `show` reads tmux's global `mouse` option ("on" /
+ *  "off"), or null when tmux cannot be asked. */
+export declare function tmuxMouseHint(env: Readonly<Record<string, string | undefined>>, show: () => string | null): string | null;

package/dist/tmux-hint.js

@@ -0,0 +1,26 @@
+/**
+ * DC-59 (0.32.2) — the one thing kiso can say about scrolling under tmux.
+ *
+ * Under tmux without `mouse on`, the terminal turns wheel and trackpad
+ * scrolling into arrow keys for tmux's alternate screen and tmux passes
+ * them to the pane: a scroll over the idle composer walks the history
+ * (TMUX-F1). The editor's burst guard collapses a wheel NOTCH — three or
+ * more identical arrows in one read — but a smooth trackpad stream arrives
+ * one arrow per read and is indistinguishable from a hand. With `mouse on`
+ * tmux owns the wheel and kiso receives nothing (measured). So kiso names
+ * the cause once at start when it is knowable, and never guesses: no
+ * `$TMUX`, no question asked; the option unreadable, no hint.
+ *
+ * PURE on purpose: the decision takes the env and a reader; the spawn that
+ * asks tmux lives with the CLI's other spawns (this module's tests are
+ * unit tests and must stay so — the pty-manifest gate classifies by import
+ * closure).
+ */
+export const TMUX_MOUSE_HINT = "under tmux without `mouse on`, trackpad and wheel scrolling arrive as arrow keys and walk the composer history — add `set -g mouse on` to ~/.tmux.conf";
+/** The hint, or null. `show` reads tmux's global `mouse` option ("on" /
+ *  "off"), or null when tmux cannot be asked. */
+export function tmuxMouseHint(env, show) {
+    if (env.TMUX === undefined || env.TMUX === "")
+        return null;
+    return show() === "off" ? TMUX_MOUSE_HINT : null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@vincemakes/kiso-code",
-	"version": "0.32.0",
+	"version": "0.32.2",
 	"description": "kiso-code — the coding agent on kiso, the durable runtime for AI agents: kiso chat / kiso resume / kiso sessions.",
 	"type": "module",
 	"license": "MIT",
@@ -18,20 +18,20 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@vincemakes/kiso-ask-ext": "0.32.0",
-		"@vincemakes/kiso-core": "0.32.0",
-		"@vincemakes/kiso-evals": "0.32.0",
-		"@vincemakes/kiso-mcp-ext": "0.32.0",
-		"@vincemakes/kiso-provider-anthropic": "0.32.0",
-		"@vincemakes/kiso-provider-openai": "0.32.0",
-		"@vincemakes/kiso-provider-openai-responses": "0.32.0",
-		"@vincemakes/kiso-runtime": "0.32.0",
-		"@vincemakes/kiso-skills-ext": "0.32.0",
-		"@vincemakes/kiso-subagent-ext": "0.32.0",
-		"@vincemakes/kiso-task-ext": "0.32.0",
-		"@vincemakes/kiso-tools-node": "0.32.0",
-		"@vincemakes/kiso-tui": "0.32.0",
-		"@vincemakes/kiso-tui-cells": "0.32.0"
+		"@vincemakes/kiso-ask-ext": "0.32.2",
+		"@vincemakes/kiso-core": "0.32.2",
+		"@vincemakes/kiso-evals": "0.32.2",
+		"@vincemakes/kiso-mcp-ext": "0.32.2",
+		"@vincemakes/kiso-provider-anthropic": "0.32.2",
+		"@vincemakes/kiso-provider-openai": "0.32.2",
+		"@vincemakes/kiso-provider-openai-responses": "0.32.2",
+		"@vincemakes/kiso-runtime": "0.32.2",
+		"@vincemakes/kiso-skills-ext": "0.32.2",
+		"@vincemakes/kiso-subagent-ext": "0.32.2",
+		"@vincemakes/kiso-task-ext": "0.32.2",
+		"@vincemakes/kiso-tools-node": "0.32.2",
+		"@vincemakes/kiso-tui": "0.32.2",
+		"@vincemakes/kiso-tui-cells": "0.32.2"
 	},
 	"devDependencies": {
 		"@types/node": "^26.1.2",