@vincemakes/kiso-core 0.42.2 → 0.43.0

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export * from "./protocol/index.js";
 export * from "./tools/tool.js";
 export * from "./tools/registry.js";
+export { validateArgs } from "./tools/validate.js";
 export * from "./errors.js";
 export * from "./kernel/event-log.js";
 export * from "./kernel/hooks.js";

package/dist/index.js

@@ -1,6 +1,7 @@
 export * from "./protocol/index.js";
 export * from "./tools/tool.js";
 export * from "./tools/registry.js";
+export { validateArgs } from "./tools/validate.js";
 export * from "./errors.js";
 export * from "./kernel/event-log.js";
 export * from "./kernel/hooks.js";

package/dist/kernel/compaction.d.ts

@@ -2,7 +2,7 @@
  * L2 — context-economy primitives, the MECHANICAL half.
  *
  * The kernel's compaction policy is identity preservation, not summary
- * (mauri ADR-0007): keep the message SHELL (id, role, position), replace
+ * (the predecessor's ADR-0007): keep the message SHELL (id, role, position), replace
  * the content with a marker, zero LLM calls. A summary is a NEW message; it
  * never rewrites an old one. Messages are immutable (ADR-0002) — "clearing"
  * is append, not mutation.
@@ -21,7 +21,7 @@ import type { Message } from "../protocol/messages.js";
 /**
  * Rough token estimate (chars/4 + structural overhead). Calibration-free on
  * purpose: context economy only needs a stable MONOTONE proxy, not an exact
- * count — the threshold absorbs the error (mauri ADR-0007). The proxy's
+ * count — the threshold absorbs the error (the predecessor's ADR-0007). The proxy's
  * three-word contract, and the pins that hold it, are
  * packages/core/tests/sc1b-estimator.test.ts.
  */

package/dist/kernel/compaction.js

@@ -2,7 +2,7 @@
  * L2 — context-economy primitives, the MECHANICAL half.
  *
  * The kernel's compaction policy is identity preservation, not summary
- * (mauri ADR-0007): keep the message SHELL (id, role, position), replace
+ * (the predecessor's ADR-0007): keep the message SHELL (id, role, position), replace
  * the content with a marker, zero LLM calls. A summary is a NEW message; it
  * never rewrites an old one. Messages are immutable (ADR-0002) — "clearing"
  * is append, not mutation.
@@ -64,7 +64,7 @@ function textTokens(text) {
 /**
  * Rough token estimate (chars/4 + structural overhead). Calibration-free on
  * purpose: context economy only needs a stable MONOTONE proxy, not an exact
- * count — the threshold absorbs the error (mauri ADR-0007). The proxy's
+ * count — the threshold absorbs the error (the predecessor's ADR-0007). The proxy's
  * three-word contract, and the pins that hold it, are
  * packages/core/tests/sc1b-estimator.test.ts.
  */

package/dist/kernel/hooks.d.ts

@@ -1,5 +1,5 @@
 /**
- * L2 — the hook vocabulary: 3 phases + lifecycle (mauri ADR-0006).
+ * L2 — the hook vocabulary: 3 phases + lifecycle (the predecessor's ADR-0006).
  *
  * ReAct's loop has exactly three model↔world interfaces — assemble (feed the
  * model), model (the model speaks), execute (the model makes the world work)
@@ -9,7 +9,7 @@
  *
  * Payload types are SHARED between fire-site and read-site: a hook author
  * cannot drift a key name, because the keys do not exist — the payload is a
- * typed object (the mauri payload-contract discipline, ADR-0017, as a
+ * typed object (the predecessor's payload-contract discipline, ADR-0017, as a
  * compile-time fact instead of a written rule).
  */
 import type { Event } from "../protocol/events.js";

package/dist/kernel/hooks.js

@@ -1,5 +1,5 @@
 /**
- * L2 — the hook vocabulary: 3 phases + lifecycle (mauri ADR-0006).
+ * L2 — the hook vocabulary: 3 phases + lifecycle (the predecessor's ADR-0006).
  *
  * ReAct's loop has exactly three model↔world interfaces — assemble (feed the
  * model), model (the model speaks), execute (the model makes the world work)
@@ -9,7 +9,7 @@
  *
  * Payload types are SHARED between fire-site and read-site: a hook author
  * cannot drift a key name, because the keys do not exist — the payload is a
- * typed object (the mauri payload-contract discipline, ADR-0017, as a
+ * typed object (the predecessor's payload-contract discipline, ADR-0017, as a
  * compile-time fact instead of a written rule).
  */
 /** Every hook optional; unset = pass-through. The kernel runs with this. */

package/dist/kernel/loop.js

@@ -33,6 +33,7 @@
  * re-stream that duplicates output or tool calls.
  */
 import { isAdapterEvent } from "../protocol/adapter.js";
+import { ERROR_CODES } from "../protocol/error-codes.js";
 import { EventLog } from "./event-log.js";
 import { ToolRegistry } from "../tools/registry.js";
 import { validateArgs } from "../tools/validate.js";
@@ -343,7 +344,7 @@ export async function* loop(config) {
         }
         return { wait, release };
     };
-    const launch = (call) => {
+    const launch = (call, rawInput) => {
         execActive += 1;
         const tool = table.get(call.name);
         const slot = reserve(tool);
@@ -455,7 +456,7 @@ export async function* loop(config) {
                     return;
                 await acquireWindow();
                 try {
-                    await runLedgered(call, table, hooks, { signal: signal ?? NEVER_ABORT, ...(config.sessionId !== undefined ? { sessionId: config.sessionId } : {}) }, signal, pushExec);
+                    await runLedgered(call, table, hooks, { signal: signal ?? NEVER_ABORT, ...(config.sessionId !== undefined ? { sessionId: config.sessionId } : {}), ...(rawInput !== undefined ? { rawInput } : {}) }, signal, pushExec);
                 }
                 finally {
                     releaseWindow();
@@ -588,6 +589,12 @@ export async function* loop(config) {
                 yield await terminal({ kind: "aborted", by: "user" });
                 return;
             }
+            // 0.43.0 (#13): the lexical arguments, buffered PER ATTEMPT — a new
+            // table for every stream, so a retry after an abandoned draft never
+            // pastes that draft's text onto a re-used callId; consumed at the
+            // call's end. callId is the attempt's correlation key only; the
+            // durable identity stays the tool_call_end's seq.
+            const raw = new Map();
             try {
                 const stream = config.adapter.stream({
                     model: config.model,
@@ -649,13 +656,16 @@ export async function* loop(config) {
                     // R-E 0.1.43: the append precedes the launch — the call's
                     // framework seq is assigned here; invocationSeq must never
                     // be the adapter's stream-local hint (ADR-0002).
+                    if (ev.type === "tool_call_input_delta")
+                        raw.set(ev.callId, (raw.get(ev.callId) ?? "") + ev.inputJsonDelta);
                     const full = log.append(ev);
                     if (full.type === "tool_call_end") {
                         pending.push(full);
                         // streaming execution: the call launches immediately — the decide
                         // and the ledgered run proceed in parallel with the
                         // model stream.
-                        launch(full);
+                        launch(full, raw.get(full.callId));
+                        raw.delete(full.callId);
                     }
                     if (hooks.onEvent)
                         await hooks.onEvent(full, {}).catch(() => { });
@@ -1345,11 +1355,19 @@ export function toStructuredError(err) {
     if (typeof err === "object" && err !== null) {
         const e = err;
         if (typeof e.code === "string" && typeof e.retryable === "boolean") {
+            // 0.43.0 (#19): every value this returns satisfies the durable
+            // StructuredError schema the store reads back with — a host
+            // adapter's vendor code becomes "unknown" with the code kept in the
+            // message; a status outside the non-negative safe integers is
+            // dropped; retryable rides as given. The kernel never writes a
+            // terminal the store cannot read. The set is the protocol's own,
+            // internal — a host cannot see or change it.
+            const known = ERROR_CODES.has(e.code);
             return {
-                code: e.code,
-                ...(e.status !== undefined ? { status: e.status } : {}),
+                code: known ? e.code : "unknown",
+                ...(typeof e.status === "number" && Number.isSafeInteger(e.status) && e.status >= 0 ? { status: e.status } : {}),
                 retryable: e.retryable,
-                message: typeof e.message === "string" ? e.message : String(err),
+                message: `${known ? "" : `[${e.code}] `}${typeof e.message === "string" ? e.message : String(err)}`,
                 // CX-1 F8: the provider's Retry-After rides through to the kernel
                 ...(typeof e.retryAfterMs === "number" && Number.isFinite(e.retryAfterMs) && e.retryAfterMs >= 0 ? { retryAfterMs: e.retryAfterMs } : {}),
             };

package/dist/kernel/permission.d.ts

@@ -1,5 +1,5 @@
 /**
- * L2 — permission as a negotiation, not a gate (mauri ADR-0002).
+ * L2 — permission as a negotiation, not a gate (the predecessor's ADR-0002).
  *
  * A permission decision is a dialog step with state and an upgrade path:
  * allow one call, deny with a reason fed back to the model, or defer to a

package/dist/kernel/permission.js

@@ -1,5 +1,5 @@
 /**
- * L2 — permission as a negotiation, not a gate (mauri ADR-0002).
+ * L2 — permission as a negotiation, not a gate (the predecessor's ADR-0002).
  *
  * A permission decision is a dialog step with state and an upgrade path:
  * allow one call, deny with a reason fed back to the model, or defer to a

package/dist/kernel/project.js

@@ -206,6 +206,9 @@ export function projectMessages(events) {
     let resultBuf = [];
     const callOrder = new Map();
     let callOrderNext = 0;
+    // 0.43.0 (#13): the lexical arguments per open call — set on the first
+    // delta (presence, even empty), taken at the call's end.
+    const raw = new Map();
     // R-E 0.1.44 (sentence 1): the declarations that PROJECTED (their
     // tool_use blocks were actually pushed) — the pair-atomicity signal a
     // tool_result consults. A declaration the void skipped is not here, so
@@ -366,8 +369,10 @@ export function projectMessages(events) {
             case "tool_call_start":
                 if (ev.source !== undefined)
                     assistantSource = ev.source;
+                raw.delete(ev.callId);
                 break;
             case "tool_call_input_delta":
+                raw.set(ev.callId, (raw.get(ev.callId) ?? "") + ev.inputJsonDelta);
                 break; // the parsed input arrives at tool_call_end
             case "tool_call_end":
                 // 0.1.26: a tool_call_end with BUFFERED RESULTS opens the
@@ -388,7 +393,9 @@ export function projectMessages(events) {
                     callId: ev.callId,
                     name: ev.name,
                     input: ev.input ?? {},
+                    ...(raw.has(ev.callId) ? { rawInput: raw.get(ev.callId) } : {}),
                 });
+                raw.delete(ev.callId); // consumed by THIS invocation — a later same-callId call inherits nothing
                 break;
             case "tool_result": {
                 // R-E 0.1.44 (sentence 1): PAIR ATOMICITY — a result whose
@@ -597,6 +604,9 @@ export function messagesToEvents(messages) {
                             name: block.name,
                             ...(msg.source !== undefined ? { source: msg.source } : {}),
                         });
+                        // 0.43.0 (#13): a block with rawInput encodes ONE delta (even ""), so Message → Events → Message is lossless
+                        if (block.rawInput !== undefined)
+                            out.push({ type: "tool_call_input_delta", callId: block.callId, inputJsonDelta: block.rawInput });
                         out.push({
                             type: "tool_call_end",
                             callId: block.callId,

package/dist/protocol/error-codes.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The durable protocol's error codes — ONE set, shared by the validator
+ * (isKisoEvent) and the kernel's normalizer (toStructuredError), so the
+ * kernel can never write a terminal the store will not read back.
+ *
+ * INTERNAL: not re-exported from `protocol/index.ts` or the package root,
+ * on purpose — a host must not be able to see, let alone mutate, the
+ * whitelist the two sides agree on. The public type is `ErrorCode`.
+ */
+import type { ErrorCode } from "./events.js";
+export declare const ERROR_CODES: ReadonlySet<ErrorCode>;

package/dist/protocol/error-codes.js

@@ -0,0 +1,11 @@
+export const ERROR_CODES = new Set([
+    "rate_limit",
+    "overloaded",
+    "network",
+    "timeout",
+    "quota",
+    "api_5xx",
+    "context_overflow",
+    "invalid_request",
+    "unknown",
+]);

package/dist/protocol/events.d.ts

@@ -22,13 +22,6 @@
  * This module is almost types-only: the only runtime value it emits is
  * `isKisoEvent`, the type guard the session store validates records with.
  */
-/**
- * Why the model stopped producing. Provider-specific reasons are mapped at
- * the ADAPTER boundary into this closed union (Area 6) — `refusal`,
- * `pause_turn`, `content_filter`, and `context_window` are never allowed
- * to degrade into a normal `end_turn`. A new SDK enum that lacks a mapping
- * is a compile error in the adapters' exhaustive switches.
- */
 export type StopReason = "end_turn" | "tool_use" | "max_tokens" | "stop_sequence" | "abort" | "error" | "refusal" | "pause_turn" | "content_filter" | "context_window" | "function_call";
 /**
  * Structured failure classification, layered ON TOP OF `isError: boolean`.

package/dist/protocol/events.js

@@ -22,6 +22,14 @@
  * This module is almost types-only: the only runtime value it emits is
  * `isKisoEvent`, the type guard the session store validates records with.
  */
+/**
+ * Why the model stopped producing. Provider-specific reasons are mapped at
+ * the ADAPTER boundary into this closed union (Area 6) — `refusal`,
+ * `pause_turn`, `content_filter`, and `context_window` are never allowed
+ * to degrade into a normal `end_turn`. A new SDK enum that lacks a mapping
+ * is a compile error in the adapters' exhaustive switches.
+ */
+import { ERROR_CODES } from "./error-codes.js";
 // ── deep-shape helpers (round 5): every variant is validated field by field —
 // legal enums, Terminal union members, Usage known/token combos, content
 // blocks, plain-object inputs, optional fields when present. A record that
@@ -45,17 +53,6 @@ const STOP_REASONS = new Set([
     "function_call",
 ]);
 const TOOL_ERROR_KINDS = new Set(["invalid_input", "precondition", "transient", "fatal"]);
-const ERROR_CODES = new Set([
-    "rate_limit",
-    "overloaded",
-    "network",
-    "timeout",
-    "quota",
-    "api_5xx",
-    "context_overflow",
-    "invalid_request",
-    "unknown",
-]);
 const MESSAGE_SOURCES = new Set([
     "user",
     "suggestion",

package/dist/protocol/messages.d.ts

@@ -10,7 +10,7 @@
  * carries images. Forcing every caller into the array shape to serve the
  * 5% that need vision is a tax paid on every line of product code.
  *
- * See ADR-0003 (sum type). The tool contract's record is mauri ADR-0008 —
+ * See ADR-0003 (sum type). The tool contract's record is the predecessor's ADR-0008 —
  * the PREDECESSOR series, cited the same way in kernel/hooks.ts and
  * kernel/mode.ts: kiso's own numbers 0006-0019 were NEVER assigned
  * (docs/adrs/README.md), so an unprefixed "ADR-0008" sends a reader to a
@@ -70,6 +70,15 @@ export interface AssistantToolUseBlock {
     readonly callId: string;
     readonly name: string;
     readonly input: Readonly<Record<string, unknown>>;
+    /** 0.43.0 (#13): the arguments exactly as the model streamed them — the
+     *  LEXICAL companion of `input` (`5.0` stays `5.0`), present when the
+     *  provider streamed deltas, absent otherwise. Carried for the tool
+     *  and the host; NOT replayed to the provider (0430-B1: replaying it
+     *  changed every call's bytes and the paired bench read more requests
+     *  on that arm — the adapters replay the canonical form). Never a
+     *  second argument channel: `input` stays the semantic basis of
+     *  validation, permission and execution. */
+    readonly rawInput?: string;
 }
 export type AssistantBlock = AssistantTextBlock | AssistantToolUseBlock;
 export interface AssistantMessage {

package/dist/protocol/messages.js

@@ -10,7 +10,7 @@
  * carries images. Forcing every caller into the array shape to serve the
  * 5% that need vision is a tax paid on every line of product code.
  *
- * See ADR-0003 (sum type). The tool contract's record is mauri ADR-0008 —
+ * See ADR-0003 (sum type). The tool contract's record is the predecessor's ADR-0008 —
  * the PREDECESSOR series, cited the same way in kernel/hooks.ts and
  * kernel/mode.ts: kiso's own numbers 0006-0019 were NEVER assigned
  * (docs/adrs/README.md), so an unprefixed "ADR-0008" sends a reader to a

package/dist/tools/tool.d.ts

@@ -38,6 +38,16 @@ export interface ToolContext {
      *  tool runs with the exact call, even among same-named parallel calls. */
     readonly callId?: string;
     readonly executionId?: string;
+    /** 0.43.0 (#13): the invocation's arguments exactly as the model
+     *  streamed them — the lexical companion of the parsed input the
+     *  handler receives; absent when no delta was streamed. It is NOT a
+     *  second argument channel: validation, permission and execution read
+     *  the parsed input. ToolContext is derived from the durable invocation
+     *  and execution, never from ephemeral process state: a fresh and a
+     *  recovered execution receive the same invocation context (sessionId,
+     *  callId, rawInput), and executionId is the id of the durable
+     *  execution each path writes. */
+    readonly rawInput?: string;
 }
 /**
  * round 5(P1-9): a DISCRIMINATED union — `errorKind` is structurally

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@vincemakes/kiso-core",
-	"version": "0.42.2",
+	"version": "0.43.0",
 	"description": "kiso core \u2014 protocol, event log, loop, hooks, modes, permissions, compaction, delivery truth. The 2,000-line kernel at the bottom of the kiso framework.",
 	"type": "module",
 	"license": "MIT",
@@ -33,7 +33,7 @@
 		"openai"
 	],
 	"devDependencies": {
-		"@vincemakes/kiso-evals": "0.42.2",
+		"@vincemakes/kiso-evals": "0.43.0",
 		"@types/node": "^26.1.2",
 		"typescript": "^5.7.2",
 		"vitest": "^3.0.0"