@vincemakes/kiso-core 0.1.5 → 0.1.7

package/dist/kernel/loop.d.ts

@@ -69,6 +69,7 @@ export interface LoopConfig {
      */
     readonly microcompact?: {
         readonly thresholdTokens: number;
+        readonly keepResults?: number;
     };
     readonly signal?: AbortSignalLike;
     readonly temperature?: number;

package/dist/kernel/loop.js

@@ -151,7 +151,7 @@ export async function* loop(config) {
         }
         // ── C 区: one-shot microcompact boundary when over the threshold ──
         if (config.microcompact !== undefined && estimateTokens(messages) > config.microcompact.thresholdTokens) {
-            const beforeSeq = microcompactBoundarySeq(log.all);
+            const beforeSeq = microcompactBoundarySeq(log.all, config.microcompact.keepResults ?? KEEP_COMPACTABLE_RESULTS);
             if (beforeSeq !== undefined) {
                 const full = log.append({ type: "microcompacted", beforeSeq });
                 if (hooks.onEvent)
@@ -588,6 +588,70 @@ async function* executeOne(call, registry, hooks, ctx, log, resolveApproval, res
     // all. Checked again here, after any permission path.
     if (signal?.aborted)
         throw ABORTED;
+    /**
+     * The human approval pause (Phase D / 裁决 A): register the resolver
+     * BEFORE announcing the request (a consumer that answers the moment it
+     * sees the event must find the resolver already waiting — no deadlock
+     * between yield and await), persist the request, yield it, await the
+     * human's decision — abortable (an abort during the wait ends the run;
+     * a verdict given in the same instant is still recorded exactly once) —
+     * then persist and yield the decision. Returns the human's verdict.
+     */
+    async function* awaitHumanApproval(decisionId) {
+        const pendingDecision = resolveApproval !== undefined
+            ? resolveApproval(decisionId)
+            : Promise.resolve({ action: "deny", reason: "no approval channel configured" });
+        const requested = log.append({
+            type: "permission_requested",
+            decisionId,
+            callId: call.callId,
+            name: call.name,
+            input: payload.input,
+        });
+        if (hooks.onPause)
+            await hooks.onPause("awaiting approval", {}).catch(() => { });
+        yield requested;
+        // Area 4: the pause is abortable — a cancel during the human's wait
+        // ends the run now; the request stays durable and pending.
+        let finalDecision;
+        try {
+            finalDecision = await raceAbort(pendingDecision, signal);
+        }
+        catch (err) {
+            if (err === ABORTED) {
+                // 第四轮(对抗): the human may have answered in the same instant
+                // the abort landed — a CONSUMED verdict must be recorded
+                // (exactly once), never lost; the abort then ends the run with
+                // its honest aborted terminal.
+                const verdict = resolveApprovalVerdict?.(decisionId);
+                if (verdict !== undefined) {
+                    yield log.append({
+                        type: "permission_decided",
+                        decisionId,
+                        callId: call.callId,
+                        decision: verdict ? "approved" : "denied",
+                        ...(verdict ? {} : { reason: "denied by user" }),
+                    });
+                }
+            }
+            throw err;
+        }
+        // The approval channel (session.approve) persists the decision
+        // write-ahead BEFORE waking the resolver (Area 2): if it already
+        // landed in the log, this is the same decision, not a duplicate.
+        const decided = log.all.find((e) => e.type === "permission_decided" && e.decisionId === decisionId) ??
+            log.append({
+                type: "permission_decided",
+                decisionId,
+                callId: call.callId, // binds the decision to the invocation (B 组)
+                decision: finalDecision.action === "allow" ? "approved" : "denied",
+                ...(finalDecision.action === "deny" && finalDecision.reason !== undefined
+                    ? { reason: finalDecision.reason }
+                    : {}),
+            });
+        yield decided;
+        return finalDecision;
+    }
     // ── E1: the extension policy chain, decided BEFORE the human flow ─────
     // A durable POLICY decision for THIS call takes effect on resume — the
     // chain never re-runs when its verdict is already in the log (同构
@@ -651,77 +715,37 @@ async function* executeOne(call, registry, hooks, ctx, log, resolveApproval, res
         yield emitResult(denialResult(durable.reason ?? "denied"));
         return;
     }
-    if (chainVerdict?.action === "ask" && hooks.onPreTool === undefined) {
-        // No human flow exists — the ask degrades to an honest denial, never
-        // an unasked execution (mirrors the defer-without-channel path).
-        yield emitResult(denialResult("a policy asked for a human decision, but no approval flow is configured"));
-        return;
+    if (chainVerdict?.action === "ask") {
+        // 裁决 A (E1 ask 语义修正): an ask means "a HUMAN must decide" — it
+        // routes DIRECTLY to the human approval pause, never through
+        // onPreTool: a static automated policy (e.g. the CLI's default deny
+        // for unknown tools) must not answer for the human. No approval
+        // channel configured → an honest denial (judged by resolveApproval,
+        // not by the hook's presence).
+        if (resolveApproval === undefined) {
+            yield emitResult(denialResult("a policy asked for a human decision, but no approval flow is configured"));
+            return;
+        }
+        const decisionId = `d-${log.lastSeq + 1}`;
+        const finalDecision = yield* awaitHumanApproval(decisionId);
+        if (finalDecision.action !== "allow") {
+            yield emitResult(denialResult(finalDecision.reason ?? "denied"));
+            return;
+        }
     }
     // Permission negotiation — defer is a REAL pause (Phase D). C 组: the
     // hook itself is cancelable (a slow policy query must not outlive an
-    // abort), and the signal is re-checked after it returns. Skipped when
-    // the policy chain already decided (durable or all-allow).
-    if (durable === undefined && chainVerdict?.action !== "allow" && hooks.onPreTool) {
+    // abort), and the signal is re-checked after it returns. Runs only when
+    // the policy chain did not run at all (裁决 A: an ask was already
+    // resolved by the human pause above — the static hook never speaks for
+    // it, and a durable decision already spoke for the call).
+    if (durable === undefined && chainVerdict === undefined && hooks.onPreTool) {
         const decision = await raceAbort(hooks.onPreTool(payload, ctx), signal);
         if (signal?.aborted)
             throw ABORTED;
         if (decision.action === "defer") {
             const decisionId = `d-${log.lastSeq + 1}`;
-            // Register the resolver BEFORE announcing the pause: a consumer
-            // that answers the request the moment it sees it must find the
-            // resolver already waiting (no deadlock between yield and await).
-            const pendingDecision = resolveApproval !== undefined
-                ? resolveApproval(decisionId)
-                : Promise.resolve({ action: "deny", reason: "no approval channel configured" });
-            const requested = log.append({
-                type: "permission_requested",
-                decisionId,
-                callId: call.callId,
-                name: call.name,
-                input: payload.input,
-            });
-            if (hooks.onPause)
-                await hooks.onPause("awaiting approval", {}).catch(() => { });
-            yield requested;
-            // Area 4: the pause is abortable — a cancel during the human's
-            // wait ends the run now; the request stays durable and pending.
-            let finalDecision;
-            try {
-                finalDecision = await raceAbort(pendingDecision, signal);
-            }
-            catch (err) {
-                if (err === ABORTED) {
-                    // 第四轮(对抗): the human may have answered in the same
-                    // instant the abort landed — a CONSUMED verdict must be
-                    // recorded (exactly once), never lost; the abort then
-                    // ends the run with its honest aborted terminal.
-                    const verdict = resolveApprovalVerdict?.(decisionId);
-                    if (verdict !== undefined) {
-                        yield log.append({
-                            type: "permission_decided",
-                            decisionId,
-                            callId: call.callId,
-                            decision: verdict ? "approved" : "denied",
-                            ...(verdict ? {} : { reason: "denied by user" }),
-                        });
-                    }
-                }
-                throw err;
-            }
-            // The approval channel (session.approve) persists the decision
-            // write-ahead BEFORE waking the resolver (Area 2): if it already
-            // landed in the log, this is the same decision, not a duplicate.
-            const decided = log.all.find((e) => e.type === "permission_decided" && e.decisionId === decisionId) ??
-                log.append({
-                    type: "permission_decided",
-                    decisionId,
-                    callId: call.callId, // binds the decision to the invocation (B 组)
-                    decision: finalDecision.action === "allow" ? "approved" : "denied",
-                    ...(finalDecision.action === "deny" && finalDecision.reason !== undefined
-                        ? { reason: finalDecision.reason }
-                        : {}),
-                });
-            yield decided;
+            const finalDecision = yield* awaitHumanApproval(decisionId);
             if (finalDecision.action !== "allow") {
                 yield emitResult(denialResult(finalDecision.reason ?? "denied"));
                 return;
@@ -867,23 +891,24 @@ function sleep(ms, signal) {
     });
 }
 /**
- * C 区 (自举 #3): how many of the NEWEST compactable tool results survive a
- * microcompact boundary — the model must keep reasoning over the recent
- * results, whatever turn they belong to.
+ * C 区 (自举 #3): the DEFAULT for how many of the NEWEST compactable tool
+ * results survive a microcompact boundary (overridable per config via
+ * microcompact.keepResults) — the model must keep reasoning over the
+ * recent results, whatever turn they belong to.
  */
 const KEEP_COMPACTABLE_RESULTS = 4;
 /**
  * C 区: the boundary seq for a microcompact — drawn by COMPACTABLE-RESULT
  * recentness, never user turns: a SINGLE user turn that reads several big
  * files (the coding agent's main overflow shape) crosses the threshold and
- * must trigger. The newest KEEP_COMPACTABLE_RESULTS still-visible
- * compactable tool results stay intact; the boundary points AT the
- * (K+1)th-newest of them, so it and everything older is cleared. Results
- * already cleared by an earlier boundary do not count toward the kept
- * window — each new boundary makes progress. Undefined when fewer than
- * K+1 compactable results remain (the kept window is the whole context).
+ * must trigger. The newest `keepResults` still-visible compactable tool
+ * results stay intact; the boundary points AT the (K+1)th-newest of them,
+ * so it and everything older is cleared. Results already cleared by an
+ * earlier boundary do not count toward the kept window — each new boundary
+ * makes progress. Undefined when fewer than keepResults+1 compactable
+ * results remain (the kept window is the whole context).
  */
-function microcompactBoundarySeq(events) {
+function microcompactBoundarySeq(events, keepResults) {
     const callName = new Map();
     let lastCleared = -1;
     for (const ev of events) {
@@ -900,9 +925,9 @@ function microcompactBoundarySeq(events) {
         if (name !== undefined && MICROCOMPACTABLE.has(name))
             visible.push(ev.seq);
     }
-    if (visible.length <= KEEP_COMPACTABLE_RESULTS)
+    if (visible.length <= keepResults)
         return undefined;
-    return visible[visible.length - KEEP_COMPACTABLE_RESULTS - 1];
+    return visible[visible.length - keepResults - 1];
 }
 /** A signal that never aborts — for executions outside any abort scope. */
 const NEVER_ABORT = {

package/dist/protocol/extension.d.ts

@@ -39,4 +39,24 @@ export interface KisoExtension {
     readonly hooks?: HookHost;
     readonly tools?: readonly Tool[];
     readonly approvals?: readonly ApprovalPolicy[];
+    /**
+     * E2: the extension's compaction config — supplies the loop's microcompact
+     * parameters (threshold + optional keepResults) when the session config
+     * does not set its own microcompact.
+     */
+    readonly compaction?: {
+        readonly thresholdTokens?: number;
+        readonly keepResults?: number;
+    };
+    /**
+     * E2: EXTEND the system prompt — append-only, never replace (a replace
+     * is a footgun; appends guarantee "adding an extension never removes
+     * existing guidance" — the monotonicity family of the approval chain's
+     * deny>ask>allow and the veto short-circuit). The session's own
+     * systemPrompt comes first, then each extension's append in load order,
+     * \n\n-joined.
+     */
+    readonly systemPrompt?: {
+        readonly append: string;
+    };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vincemakes/kiso-core",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "kiso(基礎) core — protocol, event log, loop, hooks, modes, permissions, compaction, delivery truth. The 2,000-line kernel at the bottom of the kiso framework.",
   "type": "module",
   "license": "MIT",
@@ -33,7 +33,7 @@
     "openai"
   ],
   "devDependencies": {
-    "@vincemakes/kiso-evals": "0.1.5",
+    "@vincemakes/kiso-evals": "0.1.7",
     "@types/node": "^26.1.2",
     "typescript": "^5.7.2",
     "vitest": "^3.0.0"