@vincemakes/kiso-runtime 0.1.20 → 0.1.23

package/dist/trust.d.ts

@@ -6,8 +6,10 @@
  * dies the moment the files change.
  *
  * projectArtifacts(cwd) discovers <cwd>/.kiso/{extensions/*.mjs, mcp.json,
- * skills/<name>/SKILL.md} — the exact three artifact kinds — and returns a
- * manifest (one sha256 per file) plus a BUNDLE digest: sha256 over the
+ * skills/<name>/SKILL.md, config.json} — the four artifact kinds (config
+ * since 0.1.23, ADR-0045: the project config rides the trust package) —
+ * and returns a manifest (one sha256 per file) plus a BUNDLE digest:
+ * sha256 over the
  * sorted relative paths and their contents. Any file change changes the
  * bundle digest, which invalidates every prior trust record.
  *
@@ -32,7 +34,7 @@ export interface TrustRecord {
 export interface ProjectArtifact {
     /** path relative to the .kiso dir, e.g. "extensions/lint-rules.mjs". */
     readonly path: string;
-    readonly kind: "extension" | "mcp" | "skill";
+    readonly kind: "extension" | "mcp" | "skill" | "config";
     /** sha256 (hex) of this file's content — the listing shows a short prefix. */
     readonly digest: string;
 }

package/dist/trust.js

@@ -6,8 +6,10 @@
  * dies the moment the files change.
  *
  * projectArtifacts(cwd) discovers <cwd>/.kiso/{extensions/*.mjs, mcp.json,
- * skills/<name>/SKILL.md} — the exact three artifact kinds — and returns a
- * manifest (one sha256 per file) plus a BUNDLE digest: sha256 over the
+ * skills/<name>/SKILL.md, config.json} — the four artifact kinds (config
+ * since 0.1.23, ADR-0045: the project config rides the trust package) —
+ * and returns a manifest (one sha256 per file) plus a BUNDLE digest:
+ * sha256 over the
  * sorted relative paths and their contents. Any file change changes the
  * bundle digest, which invalidates every prior trust record.
  *
@@ -81,6 +83,16 @@ export async function projectArtifacts(cwd) {
                 throw err; // a file named like a dir → ENOTDIR: inert, skip
         }
     }
+    // 合并轮 B: the project's config.json is an artifact of the trust
+    // package — trusting the package trusts its config, and a CHANGED
+    // config is a changed digest (the trust decision re-evaluates).
+    try {
+        entries.push({ path: "config.json", buf: await readFile(join(root, "config.json")) });
+    }
+    catch (err) {
+        if (!isMissing(err))
+            throw err;
+    }
     if (entries.length === 0)
         return null;
     entries.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
@@ -105,6 +117,8 @@ function kindOf(path) {
         return "extension";
     if (path === "mcp.json")
         return "mcp";
+    if (path === "config.json")
+        return "config";
     return "skill";
 }
 async function readdirOrEmpty(dir) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vincemakes/kiso-runtime",
-  "version": "0.1.20",
-  "description": "kiso runtime — durable multi-turn agent sessions: AgentDefinition, AgentRuntime, AgentSession, Run, append-only JSONL store.",
+  "version": "0.1.23",
+  "description": "kiso runtime \u2014 durable multi-turn agent sessions: AgentDefinition, AgentRuntime, AgentSession, Run, append-only JSONL store.",
   "type": "module",
   "license": "MIT",
   "exports": {
@@ -21,11 +21,11 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@vincemakes/kiso-core": "0.1.20"
+    "@vincemakes/kiso-core": "0.1.23"
   },
   "peerDependencies": {
-    "@vincemakes/kiso-provider-anthropic": "0.1.20",
-    "@vincemakes/kiso-provider-openai": "0.1.20"
+    "@vincemakes/kiso-provider-anthropic": "0.1.23",
+    "@vincemakes/kiso-provider-openai": "0.1.23"
   },
   "peerDependenciesMeta": {
     "@vincemakes/kiso-provider-anthropic": {
@@ -36,7 +36,7 @@
     }
   },
   "devDependencies": {
-    "@vincemakes/kiso-evals": "0.1.20",
+    "@vincemakes/kiso-evals": "0.1.23",
     "@types/node": "^26.1.2",
     "typescript": "^5.7.2",
     "vitest": "^3.0.0"