@vincemakes/kiso-core 0.42.3 → 0.44.0

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export * from "./protocol/index.js";
 export * from "./tools/tool.js";
 export * from "./tools/registry.js";
+export { validateArgs } from "./tools/validate.js";
 export * from "./errors.js";
 export * from "./kernel/event-log.js";
 export * from "./kernel/hooks.js";

package/dist/index.js

@@ -1,6 +1,7 @@
 export * from "./protocol/index.js";
 export * from "./tools/tool.js";
 export * from "./tools/registry.js";
+export { validateArgs } from "./tools/validate.js";
 export * from "./errors.js";
 export * from "./kernel/event-log.js";
 export * from "./kernel/hooks.js";

package/dist/kernel/hooks.d.ts

@@ -27,6 +27,13 @@ export interface ToolCallPayload {
     readonly callId: string;
     readonly name: string;
     readonly input: Readonly<Record<string, unknown>>;
+    /** 0.44.0 (#20): the invocation's arguments as the model streamed them —
+     *  the same lexical evidence the tool receives as `ctx.rawInput`, on
+     *  onPreTool and onPostTool alike, fresh or recovered; absent when no
+     *  delta was streamed. Evidence for the host, never a control input: the
+     *  approval chain never receives it, and validation, permission and
+     *  execution read the parsed input. */
+    readonly rawInput?: string;
 }
 export interface HookHost {
     /** Assemble: rewrite or veto the incoming user message. null = drop. */

package/dist/kernel/loop.js

@@ -33,6 +33,7 @@
  * re-stream that duplicates output or tool calls.
  */
 import { isAdapterEvent } from "../protocol/adapter.js";
+import { ERROR_CODES } from "../protocol/error-codes.js";
 import { EventLog } from "./event-log.js";
 import { ToolRegistry } from "../tools/registry.js";
 import { validateArgs } from "../tools/validate.js";
@@ -343,7 +344,7 @@ export async function* loop(config) {
         }
         return { wait, release };
     };
-    const launch = (call) => {
+    const launch = (call, rawInput) => {
         execActive += 1;
         const tool = table.get(call.name);
         const slot = reserve(tool);
@@ -356,7 +357,7 @@ export async function* loop(config) {
         launches.push((async () => {
             try {
                 decideChain = decideChain.then(async () => {
-                    const v = await decideCall(call, table, hooks, { signal: signal ?? NEVER_ABORT, ...(config.sessionId !== undefined ? { sessionId: config.sessionId } : {}) }, log, config.resolveApproval, config.approvalVerdict, signal, config.approvalPolicy, nextDecisionId, pushExec);
+                    const v = await decideCall(call, table, hooks, { signal: signal ?? NEVER_ABORT, ...(config.sessionId !== undefined ? { sessionId: config.sessionId } : {}) }, log, config.resolveApproval, config.approvalVerdict, signal, config.approvalPolicy, nextDecisionId, pushExec, rawInput);
                     askOrder.ahead = askGate;
                     if (v.action === "ask") {
                         askGate = new Promise((res) => {
@@ -455,7 +456,7 @@ export async function* loop(config) {
                     return;
                 await acquireWindow();
                 try {
-                    await runLedgered(call, table, hooks, { signal: signal ?? NEVER_ABORT, ...(config.sessionId !== undefined ? { sessionId: config.sessionId } : {}) }, signal, pushExec);
+                    await runLedgered(call, table, hooks, { signal: signal ?? NEVER_ABORT, ...(config.sessionId !== undefined ? { sessionId: config.sessionId } : {}), ...(rawInput !== undefined ? { rawInput } : {}) }, signal, pushExec);
                 }
                 finally {
                     releaseWindow();
@@ -588,6 +589,12 @@ export async function* loop(config) {
                 yield await terminal({ kind: "aborted", by: "user" });
                 return;
             }
+            // 0.43.0 (#13): the lexical arguments, buffered PER ATTEMPT — a new
+            // table for every stream, so a retry after an abandoned draft never
+            // pastes that draft's text onto a re-used callId; consumed at the
+            // call's end. callId is the attempt's correlation key only; the
+            // durable identity stays the tool_call_end's seq.
+            const raw = new Map();
             try {
                 const stream = config.adapter.stream({
                     model: config.model,
@@ -649,13 +656,16 @@ export async function* loop(config) {
                     // R-E 0.1.43: the append precedes the launch — the call's
                     // framework seq is assigned here; invocationSeq must never
                     // be the adapter's stream-local hint (ADR-0002).
+                    if (ev.type === "tool_call_input_delta")
+                        raw.set(ev.callId, (raw.get(ev.callId) ?? "") + ev.inputJsonDelta);
                     const full = log.append(ev);
                     if (full.type === "tool_call_end") {
                         pending.push(full);
                         // streaming execution: the call launches immediately — the decide
                         // and the ledgered run proceed in parallel with the
                         // model stream.
-                        launch(full);
+                        launch(full, raw.get(full.callId));
+                        raw.delete(full.callId);
                     }
                     if (hooks.onEvent)
                         await hooks.onEvent(full, {}).catch(() => { });
@@ -1010,7 +1020,7 @@ function resultEvent(call, result, executionId) {
  * caller runs it (conservative ordering: the calls after an ask wait for
  * its resolution).
  */
-async function decideCall(call, registry, hooks, ctx, log, resolveApproval, resolveApprovalVerdict, signal, approvalPolicy, nextDecisionId, push) {
+async function decideCall(call, registry, hooks, ctx, log, resolveApproval, resolveApprovalVerdict, signal, approvalPolicy, nextDecisionId, push, rawInput) {
     const payload = {
         callId: call.callId,
         name: call.name,
@@ -1147,7 +1157,9 @@ async function decideCall(call, registry, hooks, ctx, log, resolveApproval, reso
     // resolved by the human pause above — the static hook never speaks for
     // it, and a durable decision already spoke for the call).
     if (durable === undefined && chainVerdict === undefined && hooks.onPreTool) {
-        const decision = await raceAbort(hooks.onPreTool(payload, ctx), signal);
+        // #20: the hook gets the lexical evidence; the chain above never did —
+        // it decides on the parsed call, the object it has always received.
+        const decision = await raceAbort(hooks.onPreTool(rawInput !== undefined ? { ...payload, rawInput } : payload, ctx), signal);
         if (signal?.aborted)
             throw ABORTED;
         if (decision.action === "defer") {
@@ -1259,7 +1271,7 @@ async function runLedgered(call, registry, hooks, ctx, signal, push) {
         };
     }
     if (hooks.onPostTool) {
-        result = await hooks.onPostTool({ callId: call.callId, name: call.name, input: call.input ?? {} }, result, ctx);
+        result = await hooks.onPostTool({ callId: call.callId, name: call.name, input: call.input ?? {}, ...(ctx.rawInput !== undefined ? { rawInput: ctx.rawInput } : {}) }, result, ctx);
     }
     // ruling #12 correction one: a non-idempotent failure's side effects may have
     // partially applied — an honest note rides the RESULT (and the failed
@@ -1345,11 +1357,19 @@ export function toStructuredError(err) {
     if (typeof err === "object" && err !== null) {
         const e = err;
         if (typeof e.code === "string" && typeof e.retryable === "boolean") {
+            // 0.43.0 (#19): every value this returns satisfies the durable
+            // StructuredError schema the store reads back with — a host
+            // adapter's vendor code becomes "unknown" with the code kept in the
+            // message; a status outside the non-negative safe integers is
+            // dropped; retryable rides as given. The kernel never writes a
+            // terminal the store cannot read. The set is the protocol's own,
+            // internal — a host cannot see or change it.
+            const known = ERROR_CODES.has(e.code);
             return {
-                code: e.code,
-                ...(e.status !== undefined ? { status: e.status } : {}),
+                code: known ? e.code : "unknown",
+                ...(typeof e.status === "number" && Number.isSafeInteger(e.status) && e.status >= 0 ? { status: e.status } : {}),
                 retryable: e.retryable,
-                message: typeof e.message === "string" ? e.message : String(err),
+                message: `${known ? "" : `[${e.code}] `}${typeof e.message === "string" ? e.message : String(err)}`,
                 // CX-1 F8: the provider's Retry-After rides through to the kernel
                 ...(typeof e.retryAfterMs === "number" && Number.isFinite(e.retryAfterMs) && e.retryAfterMs >= 0 ? { retryAfterMs: e.retryAfterMs } : {}),
             };

package/dist/kernel/project.js

@@ -206,6 +206,9 @@ export function projectMessages(events) {
     let resultBuf = [];
     const callOrder = new Map();
     let callOrderNext = 0;
+    // 0.43.0 (#13): the lexical arguments per open call — set on the first
+    // delta (presence, even empty), taken at the call's end.
+    const raw = new Map();
     // R-E 0.1.44 (sentence 1): the declarations that PROJECTED (their
     // tool_use blocks were actually pushed) — the pair-atomicity signal a
     // tool_result consults. A declaration the void skipped is not here, so
@@ -366,8 +369,10 @@ export function projectMessages(events) {
             case "tool_call_start":
                 if (ev.source !== undefined)
                     assistantSource = ev.source;
+                raw.delete(ev.callId);
                 break;
             case "tool_call_input_delta":
+                raw.set(ev.callId, (raw.get(ev.callId) ?? "") + ev.inputJsonDelta);
                 break; // the parsed input arrives at tool_call_end
             case "tool_call_end":
                 // 0.1.26: a tool_call_end with BUFFERED RESULTS opens the
@@ -388,7 +393,9 @@ export function projectMessages(events) {
                     callId: ev.callId,
                     name: ev.name,
                     input: ev.input ?? {},
+                    ...(raw.has(ev.callId) ? { rawInput: raw.get(ev.callId) } : {}),
                 });
+                raw.delete(ev.callId); // consumed by THIS invocation — a later same-callId call inherits nothing
                 break;
             case "tool_result": {
                 // R-E 0.1.44 (sentence 1): PAIR ATOMICITY — a result whose
@@ -597,6 +604,9 @@ export function messagesToEvents(messages) {
                             name: block.name,
                             ...(msg.source !== undefined ? { source: msg.source } : {}),
                         });
+                        // 0.43.0 (#13): a block with rawInput encodes ONE delta (even ""), so Message → Events → Message is lossless
+                        if (block.rawInput !== undefined)
+                            out.push({ type: "tool_call_input_delta", callId: block.callId, inputJsonDelta: block.rawInput });
                         out.push({
                             type: "tool_call_end",
                             callId: block.callId,

package/dist/protocol/error-codes.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The durable protocol's error codes — ONE set, shared by the validator
+ * (isKisoEvent) and the kernel's normalizer (toStructuredError), so the
+ * kernel can never write a terminal the store will not read back.
+ *
+ * INTERNAL: not re-exported from `protocol/index.ts` or the package root,
+ * on purpose — a host must not be able to see, let alone mutate, the
+ * whitelist the two sides agree on. The public type is `ErrorCode`.
+ */
+import type { ErrorCode } from "./events.js";
+export declare const ERROR_CODES: ReadonlySet<ErrorCode>;

package/dist/protocol/error-codes.js

@@ -0,0 +1,11 @@
+export const ERROR_CODES = new Set([
+    "rate_limit",
+    "overloaded",
+    "network",
+    "timeout",
+    "quota",
+    "api_5xx",
+    "context_overflow",
+    "invalid_request",
+    "unknown",
+]);

package/dist/protocol/events.d.ts

@@ -22,13 +22,6 @@
  * This module is almost types-only: the only runtime value it emits is
  * `isKisoEvent`, the type guard the session store validates records with.
  */
-/**
- * Why the model stopped producing. Provider-specific reasons are mapped at
- * the ADAPTER boundary into this closed union (Area 6) — `refusal`,
- * `pause_turn`, `content_filter`, and `context_window` are never allowed
- * to degrade into a normal `end_turn`. A new SDK enum that lacks a mapping
- * is a compile error in the adapters' exhaustive switches.
- */
 export type StopReason = "end_turn" | "tool_use" | "max_tokens" | "stop_sequence" | "abort" | "error" | "refusal" | "pause_turn" | "content_filter" | "context_window" | "function_call";
 /**
  * Structured failure classification, layered ON TOP OF `isError: boolean`.

package/dist/protocol/events.js

@@ -22,6 +22,14 @@
  * This module is almost types-only: the only runtime value it emits is
  * `isKisoEvent`, the type guard the session store validates records with.
  */
+/**
+ * Why the model stopped producing. Provider-specific reasons are mapped at
+ * the ADAPTER boundary into this closed union (Area 6) — `refusal`,
+ * `pause_turn`, `content_filter`, and `context_window` are never allowed
+ * to degrade into a normal `end_turn`. A new SDK enum that lacks a mapping
+ * is a compile error in the adapters' exhaustive switches.
+ */
+import { ERROR_CODES } from "./error-codes.js";
 // ── deep-shape helpers (round 5): every variant is validated field by field —
 // legal enums, Terminal union members, Usage known/token combos, content
 // blocks, plain-object inputs, optional fields when present. A record that
@@ -45,17 +53,6 @@ const STOP_REASONS = new Set([
     "function_call",
 ]);
 const TOOL_ERROR_KINDS = new Set(["invalid_input", "precondition", "transient", "fatal"]);
-const ERROR_CODES = new Set([
-    "rate_limit",
-    "overloaded",
-    "network",
-    "timeout",
-    "quota",
-    "api_5xx",
-    "context_overflow",
-    "invalid_request",
-    "unknown",
-]);
 const MESSAGE_SOURCES = new Set([
     "user",
     "suggestion",

package/dist/protocol/messages.d.ts

@@ -70,6 +70,15 @@ export interface AssistantToolUseBlock {
     readonly callId: string;
     readonly name: string;
     readonly input: Readonly<Record<string, unknown>>;
+    /** 0.43.0 (#13): the arguments exactly as the model streamed them — the
+     *  LEXICAL companion of `input` (`5.0` stays `5.0`), present when the
+     *  provider streamed deltas, absent otherwise. Carried for the tool
+     *  and the host; NOT replayed to the provider (0430-B1: replaying it
+     *  changed every call's bytes and the paired bench read more requests
+     *  on that arm — the adapters replay the canonical form). Never a
+     *  second argument channel: `input` stays the semantic basis of
+     *  validation, permission and execution. */
+    readonly rawInput?: string;
 }
 export type AssistantBlock = AssistantTextBlock | AssistantToolUseBlock;
 export interface AssistantMessage {

package/dist/tools/tool.d.ts

@@ -38,6 +38,16 @@ export interface ToolContext {
      *  tool runs with the exact call, even among same-named parallel calls. */
     readonly callId?: string;
     readonly executionId?: string;
+    /** 0.43.0 (#13): the invocation's arguments exactly as the model
+     *  streamed them — the lexical companion of the parsed input the
+     *  handler receives; absent when no delta was streamed. It is NOT a
+     *  second argument channel: validation, permission and execution read
+     *  the parsed input. ToolContext is derived from the durable invocation
+     *  and execution, never from ephemeral process state: a fresh and a
+     *  recovered execution receive the same invocation context (sessionId,
+     *  callId, rawInput), and executionId is the id of the durable
+     *  execution each path writes. */
+    readonly rawInput?: string;
 }
 /**
  * round 5(P1-9): a DISCRIMINATED union — `errorKind` is structurally

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@vincemakes/kiso-core",
-	"version": "0.42.3",
+	"version": "0.44.0",
 	"description": "kiso core \u2014 protocol, event log, loop, hooks, modes, permissions, compaction, delivery truth. The 2,000-line kernel at the bottom of the kiso framework.",
 	"type": "module",
 	"license": "MIT",
@@ -33,7 +33,7 @@
 		"openai"
 	],
 	"devDependencies": {
-		"@vincemakes/kiso-evals": "0.42.3",
+		"@vincemakes/kiso-evals": "0.44.0",
 		"@types/node": "^26.1.2",
 		"typescript": "^5.7.2",
 		"vitest": "^3.0.0"