@vincemakes/kiso-code 0.40.6 → 0.41.0

package/dist/auth/credentials.d.ts

@@ -10,6 +10,10 @@ export type Credential = {
     readonly expires: number;
     readonly accountId?: string;
     readonly savedAt: number;
+    /** 0.40.7: when the token endpoint REFUSED this credential's
+     *  refresh token. Set only by that refusal (never by a network
+     *  failure); a new login replaces the whole entry and so clears it. */
+    readonly refreshRejectedAt?: number;
 };
 export interface AuthFile {
     readonly version: 1;

package/dist/auth/oauth/chatgpt.d.ts

@@ -1,4 +1,4 @@
-import type { OAuthCredential, OAuthFlow } from "./index.js";
+import { type OAuthCredential, type OAuthFlow } from "./index.js";
 export declare const CHATGPT: {
     readonly providerId: "chatgpt";
     readonly clientId: "app_EMoamEEZ73f0CkXaXp7hrann";

package/dist/auth/oauth/chatgpt.js

@@ -17,6 +17,7 @@
  * endpoint — the Responses adapter is the second half of this step.
  */
 import { createServer } from "node:http";
+import { RefreshRejectedError } from "./index.js";
 import { generatePkce, randomState } from "./pkce.js";
 export const CHATGPT = {
     providerId: "chatgpt",
@@ -86,7 +87,11 @@ export function accountIdOf(accessToken) {
 async function readTokenResponse(response, operation) {
     if (!response.ok) {
         const text = await response.text().catch(() => "");
-        throw new Error(`ChatGPT sign-in: token ${operation} failed (${response.status})${text ? `: ${text.slice(0, 200)}` : ""}`);
+        const message = `ChatGPT sign-in: token ${operation} failed (${response.status})${text ? `: ${text.slice(0, 200)}` : ""}`;
+        // the endpoint's own refusal of the refresh token — the sign-in is over
+        if (operation === "refresh" && (response.status === 400 || response.status === 401))
+            throw new RefreshRejectedError(message);
+        throw new Error(message);
     }
     const json = (await response.json());
     if (typeof json.access_token !== "string" || typeof json.refresh_token !== "string" || typeof json.expires_in !== "number") {

package/dist/auth/oauth/index.d.ts

@@ -8,6 +8,14 @@ import type { Credential } from "../credentials.js";
 export type OAuthCredential = Extract<Credential, {
     type: "oauth";
 }>;
+/**
+ * 0.40.7 — a refresh the token endpoint REFUSED (400 / 401: the refresh
+ * token was revoked or has expired), as distinct from one that never got an
+ * answer. Only this marks a sign-in dead (`refreshRejectedAt`); a network
+ * failure leaves the credential as it was, to be tried again.
+ */
+export declare class RefreshRejectedError extends Error {
+}
 export interface LoginInteraction {
     /** Print a line for the person signing in (the URL to open, the paste prompt). */
     readonly notify: (line: string) => void;

package/dist/auth/oauth/index.js

@@ -1 +1,8 @@
-export {};
+/**
+ * 0.40.7 — a refresh the token endpoint REFUSED (400 / 401: the refresh
+ * token was revoked or has expired), as distinct from one that never got an
+ * answer. Only this marks a sign-in dead (`refreshRejectedAt`); a network
+ * failure leaves the credential as it was, to be tried again.
+ */
+export class RefreshRejectedError extends Error {
+}

package/dist/auth/refresh.d.ts

@@ -7,6 +7,6 @@
  * never a silent fall back to an API key or an env var.
  */
 import { type Credential } from "./credentials.js";
-import type { OAuthFlow } from "./oauth/index.js";
+import { type OAuthFlow } from "./oauth/index.js";
 export declare const FRESH_WINDOW_MS: number;
 export declare function ensureFresh(providerId: string, flow: OAuthFlow, path?: string, now?: number, tokenUrl?: string): Promise<Credential>;

package/dist/auth/refresh.js

@@ -7,6 +7,7 @@
  * never a silent fall back to an API key or an env var.
  */
 import { AuthError, modifyAuthFile, readAuthFile } from "./credentials.js";
+import { RefreshRejectedError } from "./oauth/index.js";
 export const FRESH_WINDOW_MS = 5 * 60_000;
 export async function ensureFresh(providerId, flow, path, now = Date.now(), tokenUrl) {
     const current = readAuthFile(path).credentials[providerId];
@@ -14,6 +15,10 @@ export async function ensureFresh(providerId, flow, path, now = Date.now(), toke
         throw new AuthError(`not signed in to ${providerId}: run \`kiso login ${providerId}\``);
     if (current.type !== "oauth" || current.expires - now > FRESH_WINDOW_MS)
         return current;
+    // 0.40.7: a refresh token the endpoint already refused is not sent again —
+    // the answer would be the same refusal, one round trip later
+    if (current.refreshRejectedAt !== undefined)
+        throw new AuthError(`signed out of ${providerId} (the sign-in was refused when kiso tried to renew it) — run \`kiso login ${providerId}\``);
     let refreshed;
     let error;
     // the double check: another process may have refreshed while we waited for the lock
@@ -26,8 +31,22 @@ export async function ensureFresh(providerId, flow, path, now = Date.now(), toke
     catch (err) {
         error = err instanceof Error ? err : new Error(String(err));
     }
-    if (refreshed === undefined)
+    if (refreshed === undefined) {
+        // 0.40.7: the endpoint's REFUSAL is remembered on the credential, so
+        // /model can say the sign-in is over before a turn finds out. The
+        // same generation rule as the write-back below (R2a): a logout or a
+        // new login while the refresh was on the wire is left alone.
+        if (error instanceof RefreshRejectedError) {
+            const began = current;
+            modifyAuthFile((file) => {
+                const latest = file.credentials[providerId];
+                if (latest === undefined || latest.type !== "oauth" || latest.refresh !== began.refresh || latest.expires !== began.expires)
+                    return file;
+                return { version: 1, credentials: { ...file.credentials, [providerId]: { ...latest, refreshRejectedAt: now } } };
+            }, path);
+        }
         throw new AuthError(`signed out of ${providerId} (the token could not be refreshed: ${error?.message ?? "unknown"}) — run \`kiso login ${providerId}\``);
+    }
     const written = refreshed;
     // R2a — THE WRITE-BACK MAY NOT RESURRECT WHAT THE HUMAN REMOVED.
     //

package/dist/coding-prompt.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The coding product's prompt policy — the base system prompt and the
+ * project-instruction injection. Moved verbatim from index.ts (R1,
+ * 2026-09-23): the entry module keeps no prompt text of its own.
+ */
+/**
+ * A area: the coding-agent system prompt — ONE constant, byte-stable for the
+ * session's lifetime (D area). Kept under ~80 lines; no template engine.
+ */
+/** The built-in prompt. Exported for scripts/request-surface.mjs — the
+ *  model-side token-rent counter measures the REAL bytes, never a copy. */
+export declare const SYSTEM_PROMPT = "You are kiso, a coding agent. You work in a workspace\ndirectory and change code with tools. Be concise: answer in a few lines\nunless the task genuinely needs more. Never claim a file was changed\nunless a tool confirmed it.\n\nWhat you can reach:\n- The workspace: read_file, list_dir, search_text, write_file, edit_file.\n- This machine and the network: shell \u2014 builds, tests, git, package\n  managers, curl for HTTP, system queries. A request one command can\n  answer is answered by running it.\n- The human: ask_user, for a decision that is theirs.\n\nTool discipline:\n- READ BEFORE YOU EDIT. For any file you are about to change, read it\n  first \u2014 never guess its content.\n- Use edit_file for targeted changes and write_file for full rewrites.\n  Prefer many small edits over one large write.\n- Be careful \u2014 shell has side effects and may take time.\n- search_text and list_dir are cheap \u2014 locate first, then read ranges\n  with read_file offset/limit; never read a whole large file in one call.\n- Do not re-read a file you already read unchanged, or one you changed\n  yourself through a confirmed edit \u2014 rely on the earlier result and\n  on the change you just made.\n- When a tool fails, read the error and adjust; do not repeat the same\n  call blindly.\n\nAn authorization covers what it NAMES: when the scope is not named \u2014\nwhich files, which branches, whether to push \u2014 ask before acting.\nDelivering, sharing or handing over changes means committing locally and\nstopping; pushing, publishing or sending happens only when the human\nnames it.\n\nWorkflow: understand the request, find the relevant code, make the\nsmallest change that works, then verify with a command (tests/build).\nReport what you did in one or two lines per change.";
+/** Hard cap for injected instructions — truncate and say so. */
+/**
+ * A area: read the FIRST present instruction file (AGENTS.md preferred) and
+ * return it as an injected section, or "" when none exists. Truncated at
+ * 8KB with an explicit note. Pure — read once per session, so the prompt
+ * is byte-stable for the session's lifetime.
+ *
+ * kiso never serves its own credential store to a model, and this read is
+ * the one that needs no model at all: a cloned repository whose AGENTS.md
+ * is a symlink to the store would put it in the SYSTEM PROMPT of every
+ * request, with no tool call and no trust prompt. A file that resolves to
+ * a protected one is skipped as though absent.
+ */
+export declare function readProjectInstructions(cwd: string, protectedFiles?: readonly string[]): string;
+/** A area: the session's system prompt — the constant plus any project
+ *  instructions found in the workspace. Deterministic per cwd. */
+export declare function composeSystemPrompt(cwd: string, protectedFiles?: readonly string[]): string;
+/**
+ * The coding agent's tool-table vocabulary — one routing line per tool, in
+ * the table only while that tool is active (0.1.40, R-C item 1: the
+ * reference implementation's content in kiso's voice). ACI-6 made this the
+ * ONE canonical statement of the routing policy; the base prompt above no
+ * longer restates it.
+ *
+ * R1 (2026-09-23): moved verbatim from the runtime's compose.ts, where it
+ * sat as a constant and reached every host whose tools shared these names.
+ * The rows, their order and their position in the table are unchanged —
+ * the byte fixture in tests/fixtures pins that.
+ */
+export declare const CODING_TOOL_RULES: ReadonlyArray<{
+    readonly tool: string;
+    readonly line: string;
+}>;

package/dist/coding-prompt.js

@@ -0,0 +1,105 @@
+/**
+ * The coding product's prompt policy — the base system prompt and the
+ * project-instruction injection. Moved verbatim from index.ts (R1,
+ * 2026-09-23): the entry module keeps no prompt text of its own.
+ */
+import { protectedFiles } from "./state.js";
+import { isProtectedPath, protectedIdentity } from "@vincemakes/kiso-tools-node";
+import { join } from "node:path";
+import { readFileSync } from "node:fs";
+/**
+ * A area: the coding-agent system prompt — ONE constant, byte-stable for the
+ * session's lifetime (D area). Kept under ~80 lines; no template engine.
+ */
+/** The built-in prompt. Exported for scripts/request-surface.mjs — the
+ *  model-side token-rent counter measures the REAL bytes, never a copy. */
+export const SYSTEM_PROMPT = `You are kiso, a coding agent. You work in a workspace
+directory and change code with tools. Be concise: answer in a few lines
+unless the task genuinely needs more. Never claim a file was changed
+unless a tool confirmed it.
+
+What you can reach:
+- The workspace: read_file, list_dir, search_text, write_file, edit_file.
+- This machine and the network: shell — builds, tests, git, package
+  managers, curl for HTTP, system queries. A request one command can
+  answer is answered by running it.
+- The human: ask_user, for a decision that is theirs.
+
+Tool discipline:
+- READ BEFORE YOU EDIT. For any file you are about to change, read it
+  first — never guess its content.
+- Use edit_file for targeted changes and write_file for full rewrites.
+  Prefer many small edits over one large write.
+- Be careful — shell has side effects and may take time.
+- search_text and list_dir are cheap — locate first, then read ranges
+  with read_file offset/limit; never read a whole large file in one call.
+- Do not re-read a file you already read unchanged, or one you changed
+  yourself through a confirmed edit — rely on the earlier result and
+  on the change you just made.
+- When a tool fails, read the error and adjust; do not repeat the same
+  call blindly.
+
+An authorization covers what it NAMES: when the scope is not named —
+which files, which branches, whether to push — ask before acting.
+Delivering, sharing or handing over changes means committing locally and
+stopping; pushing, publishing or sending happens only when the human
+names it.
+
+Workflow: understand the request, find the relevant code, make the
+smallest change that works, then verify with a command (tests/build).
+Report what you did in one or two lines per change.`;
+/** The project-instructions file names, in priority order (A area). */
+const INSTRUCTION_FILES = ["AGENTS.md", "CLAUDE.md"];
+/** Hard cap for injected instructions — truncate and say so. */
+/**
+ * A area: read the FIRST present instruction file (AGENTS.md preferred) and
+ * return it as an injected section, or "" when none exists. Truncated at
+ * 8KB with an explicit note. Pure — read once per session, so the prompt
+ * is byte-stable for the session's lifetime.
+ *
+ * kiso never serves its own credential store to a model, and this read is
+ * the one that needs no model at all: a cloned repository whose AGENTS.md
+ * is a symlink to the store would put it in the SYSTEM PROMPT of every
+ * request, with no tool call and no trust prompt. A file that resolves to
+ * a protected one is skipped as though absent.
+ */
+export function readProjectInstructions(cwd, protectedFiles = []) {
+    const id = protectedIdentity(protectedFiles);
+    for (const name of INSTRUCTION_FILES) {
+        if (isProtectedPath(join(cwd, name), id))
+            continue;
+        let text;
+        try {
+            text = readFileSync(join(cwd, name), "utf8");
+        }
+        catch {
+            continue; // not present — try the next
+        }
+        return `\n\n=== Project instructions (${name}) ===\n${text.length > 8 * 1024 ? text.slice(0, 8 * 1024) + `\n\n[truncated at ${8 * 1024} chars]` : text}`;
+    }
+    return "";
+}
+/** A area: the session's system prompt — the constant plus any project
+ *  instructions found in the workspace. Deterministic per cwd. */
+export function composeSystemPrompt(cwd, protectedFiles = []) {
+    const injected = readProjectInstructions(cwd, protectedFiles);
+    return injected === "" ? SYSTEM_PROMPT : `${SYSTEM_PROMPT}\n${injected}`;
+}
+/**
+ * The coding agent's tool-table vocabulary — one routing line per tool, in
+ * the table only while that tool is active (0.1.40, R-C item 1: the
+ * reference implementation's content in kiso's voice). ACI-6 made this the
+ * ONE canonical statement of the routing policy; the base prompt above no
+ * longer restates it.
+ *
+ * R1 (2026-09-23): moved verbatim from the runtime's compose.ts, where it
+ * sat as a constant and reached every host whose tools shared these names.
+ * The rows, their order and their position in the table are unchanged —
+ * the byte fixture in tests/fixtures pins that.
+ */
+export const CODING_TOOL_RULES = [
+    { tool: "read_file", line: "read files with read_file, never shell cat/head/tail" },
+    { tool: "search_text", line: "search with search_text, never shell grep/rg" },
+    { tool: "list_dir", line: "list with list_dir, never ls" },
+    { tool: "shell", line: "shell for what the file tools cannot do: commands, git, the network, the system" },
+];

package/dist/config.d.ts

@@ -118,6 +118,13 @@ export interface KisoConfig {
      *  in the child's worktree. A model never supplies a command; it names
      *  one of these. `{ "test": "npm test", "lint": "npm run lint" }`. */
     readonly checks?: Readonly<Record<string, string>>;
+    /** CS-1 (0.40.7): the evaluator scripts a delegated task may name —
+     *  absolute paths, `["/abs/path/to/evaluate.sh"]`. The PARENT runs the
+     *  one a task names with the child's worktree as its argument. A path
+     *  the user did not list is refused: the model chooses the task, so an
+     *  unlisted path could be an interpreter running code the child wrote.
+     *  Same layers as `checks`. */
+    readonly evaluators?: readonly string[];
 }
 /** The resolved, merged config — project wins over user, both validated. */
 export interface ResolvedConfig {
@@ -145,7 +152,8 @@ export type ProfileAuth = {
     readonly source: "store" | "env" | "none";
 } | {
     readonly type: "oauth";
-    readonly providerId: string;
+    readonly providerId: string; /** the access token's expiry (epoch ms) — past it, the next use renews */
+    readonly expires?: number;
 };
 /** Where a profile's sign-in comes from, or why it has none. The sign-in
  *  plan's resolve rule: a stored credential OWNS the provider (an

package/dist/config.js

@@ -130,6 +130,15 @@ export function parseConfig(text, source) {
         }
         out.checks = obj.checks;
     }
+    if (obj.evaluators !== undefined) {
+        if (!Array.isArray(obj.evaluators))
+            fail("evaluators", "expected a list of absolute paths to evaluator scripts");
+        for (const path of obj.evaluators) {
+            if (typeof path !== "string" || !path.startsWith("/"))
+                fail("evaluators", `expected an absolute path, got ${JSON.stringify(path)}`);
+        }
+        out.evaluators = obj.evaluators;
+    }
     if (obj.model !== undefined) {
         if (typeof obj.model !== "string" || obj.model === "")
             fail("model", "expected a profile name or provider/model string");
@@ -253,6 +262,8 @@ export function mergeConfigs(user, project) {
         ...(p.projectTrust !== undefined ? { projectTrust: p.projectTrust } : {}),
         // DT-1a: checks merge per name — a (trusted) project's check wins over the user's
         ...(u.checks !== undefined || p.checks !== undefined ? { checks: { ...(u.checks ?? {}), ...(p.checks ?? {}) } } : {}),
+        // CS-1: the evaluator lists join — either layer's script may be named
+        ...(u.evaluators !== undefined || p.evaluators !== undefined ? { evaluators: [...(u.evaluators ?? []), ...(p.evaluators ?? [])] } : {}),
     };
 }
 /** Where a profile's sign-in comes from, or why it has none. The sign-in
@@ -280,8 +291,14 @@ export function authForProfile(name, p) {
         if (stored !== undefined) {
             if (stored.type === "api-key")
                 return { type: "api-key", apiKey: stored.key, source: "store" };
-            if (p.kind === "openai-responses")
-                return { type: "oauth", providerId };
+            if (p.kind === "openai-responses") {
+                // 0.40.7: a sign-in whose renewal the endpoint REFUSED is over —
+                // unavailable here, where /model reads it, not first at a turn
+                if (stored.refreshRejectedAt !== undefined) {
+                    throw new ConfigError(`model ${name}: unavailable — the ${providerId} sign-in was refused when kiso tried to renew it: run \`kiso login ${providerId}\``);
+                }
+                return { type: "oauth", providerId, expires: stored.expires };
+            }
             throw new ConfigError(`model ${name}: signed in to ${providerId} with OAuth, but this profile's adapter needs an API key — run \`kiso login ${providerId}\` with a key, or \`kiso logout ${providerId}\` to use the env var ${p.apiKeyEnv ?? "(none configured)"}`);
         }
     }

package/dist/create-coding-agent.d.ts

@@ -0,0 +1,30 @@
+/**
+ * kiso-code's composition root — the product's choices (trust, config,
+ * credentials, the coding tools, the built-in and loaded extensions, the
+ * coding prompt, the mode tiers) bound into ONE AgentDefinition and handed
+ * to runtime.createAgent(): the one door every agent goes through.
+ *
+ * Moved verbatim from index.ts's makeAgent (R1, 2026-09-23) and renamed;
+ * the body is not edited beyond the rename and activeStoreDir's setter.
+ */
+import { type LineInput } from "./state.js";
+import { type ContextPolicy } from "@vincemakes/kiso-runtime";
+/**
+ * E6: the run-start context policy, OFF unless env-armed (invalid values
+ * are ABSENT, never a crash — the autoCompactFromEnv convention).
+ * The product arming is KISO_CONTEXT_WINDOW → window − POLICY_RESERVE
+ * (the window rides the config as windowTokens; the runtime owns the
+ * arithmetic — never a fixed low absolute). KISO_POLICY_SUMMARY_TRIGGER
+ * survives ONLY as the legacy absolute override when no window is set
+ * (bench back-compat); the window wins when both are set.
+ * KISO_POLICY_SUMMARY_KEEP (rounds) and KISO_POLICY_SUMMARY_KEEP_TOKENS
+ * override the runtime defaults (KEEP_RECENT_ROUNDS = 4,
+ * KEEP_TOKENS_DEFAULT = 20,000) — emitted only when set.
+ * KISO_POLICY_SUMMARY_MAX_FAILURES overrides the (h) circuit-breaker
+ * default (MAX_SUMMARY_FAILURES = 3).
+ * KISO_POLICY_DROP=1 switches the armed mode to the crux C arm
+ * (mechanical drop — same trigger/keep envs); KISO_POLICY_MICROCOMPACT
+ * arms the session-aware override (MIN_TURNS = the no-fire guard).
+ */
+export declare function contextPolicyFromEnv(): ContextPolicy | undefined;
+export declare function createCodingAgent(sessionId: string | undefined, input?: LineInput, modelFlag?: string): Promise<import("@vincemakes/kiso-runtime").AgentRuntime>;