@vincemakes/kiso-runtime 0.32.1 → 0.33.0

package/dist/profile.js

@@ -57,7 +57,11 @@ export function writeProfile(root, sessionId, profile) {
     const tmpDir = mkdtempSync(join(root, ".meta-"));
     const tmp = join(tmpDir, "meta.json");
     try {
-        writeFileSync(tmp, `${JSON.stringify({ profile }, null, "\t")}\n`);
+        // DF-0322-F1: 0600 on the file kiso CREATES. The mode rides the temp
+        // because rename preserves it, and rename is the only path by which
+        // this file comes into existence. Existing files are not migrated —
+        // R6's choice, kept.
+        writeFileSync(tmp, `${JSON.stringify({ profile }, null, "\t")}\n`, { mode: 0o600 });
         const fd = openSync(tmp, "r");
         try {
             fsyncSync(fd);

package/dist/recovery.d.ts

@@ -23,6 +23,8 @@ export declare class MergedSignal implements AbortSignalStub {
     #private;
     constructor(...sources: readonly AbortSignalLike[]);
     get aborted(): boolean;
-    addEventListener(_type: string, listener: (this: AbortSignalStub, ev: unknown) => void): void;
+    addEventListener(_type: string, listener: (this: AbortSignalStub, ev: unknown) => void, _options?: {
+        once?: boolean;
+    }): void;
     removeEventListener(_type: string, listener: (this: AbortSignalStub, ev: unknown) => void): void;
 }

package/dist/recovery.js

@@ -23,7 +23,7 @@ export const ABORTED = Symbol("kiso-resume-aborted");
 export async function abortable(promise, signal) {
     if (signal.aborted)
         return ABORTED;
-    return new Promise((resolve) => {
+    return new Promise((resolve, reject) => {
         const onAbort = () => {
             signal.removeEventListener("abort", onAbort);
             resolve(ABORTED);
@@ -33,8 +33,16 @@ export async function abortable(promise, signal) {
             signal.removeEventListener("abort", onAbort);
             resolve(value);
         }, (err) => {
+            // R3: REJECT, do not throw. Throwing here creates a new
+            // rejected promise that nobody holds, while the executor
+            // above never calls resolve or reject — so the outer promise
+            // NEVER SETTLES. Three recovery sites await this, so a
+            // decision hook that rejects hung the run and left an
+            // unhandled rejection behind it. A hook that throws is a host
+            // bug: it fails the run, the tool never runs, and there is no
+            // silent allow.
             signal.removeEventListener("abort", onAbort);
-            throw err;
+            reject(err);
         });
     });
 }
@@ -44,23 +52,54 @@ export async function abortable(promise, signal) {
  */
 export class MergedSignal {
     #sources;
+    /** R5: the ORIGINAL listeners, by identity. The previous Set held
+     *  WRAPPERS while `removeEventListener` deleted the original, so
+     *  removal never removed anything and every listener ever added fired
+     *  for the life of the run. */
     #listeners = new Set();
+    /** R5: `aborted` is a TRANSITION, not a stream. Two sources aborting
+     *  fired every listener twice. */
+    #fired = false;
+    /** R5: the source subscriptions, released on the transition — they
+     *  were never released at all. */
+    #cleanups = [];
     constructor(...sources) {
         this.#sources = sources;
         for (const source of sources) {
             if (source.aborted)
                 continue;
-            source.addEventListener("abort", () => {
-                for (const listener of this.#listeners)
-                    listener();
-            });
+            const onSource = () => this.#fire();
+            source.addEventListener("abort", onSource, { once: true });
+            this.#cleanups.push(() => source.removeEventListener("abort", onSource));
         }
     }
+    /** One transition: latch, release the sources, then call each listener
+     *  once. Clearing the set before the calls is what honours `once` for
+     *  every listener without tracking the flag per listener — after the
+     *  one transition there is nothing left to fire a second time. */
+    #fire() {
+        if (this.#fired)
+            return;
+        this.#fired = true;
+        for (const cleanup of this.#cleanups)
+            cleanup();
+        this.#cleanups = [];
+        const listeners = [...this.#listeners];
+        this.#listeners.clear();
+        for (const listener of listeners)
+            listener.call(this, undefined);
+    }
     get aborted() {
-        return this.#sources.some((s) => s.aborted);
+        return this.#fired || this.#sources.some((s) => s.aborted);
     }
-    addEventListener(_type, listener) {
-        this.#listeners.add(() => listener.call(this, undefined));
+    addEventListener(_type, listener, _options) {
+        // A listener added AFTER the transition never fires, which is what a
+        // real AbortSignal does — the event is the transition. Callers read
+        // `aborted` for the state; `abortable` checks it before it ever
+        // subscribes, which is the guard that makes this safe.
+        if (this.#fired)
+            return;
+        this.#listeners.add(listener);
     }
     removeEventListener(_type, listener) {
         this.#listeners.delete(listener);

package/dist/session.js

@@ -485,8 +485,8 @@ export class AgentSession {
             try {
                 const canonical = canonicalizeUsageForModel(binding.model, binding.baseUrl, binding.provider ?? "adapter", usage);
                 const line = JSON.stringify({ kind: "summary", canonical }) + "\n";
-                mkdirSync(join(this.#store.root, "traces"), { recursive: true });
-                appendFileSync(join(this.#store.root, "traces", `${this.id}.jsonl`), line);
+                mkdirSync(join(this.#store.root, "traces"), { recursive: true, mode: 0o700 }); // DF-0322-F1
+                appendFileSync(join(this.#store.root, "traces", `${this.id}.jsonl`), line, { mode: 0o600 });
             }
             catch (err) {
                 console.error(`[kiso] summary usage ledger degraded (${err instanceof Error ? err.message : String(err)}); the summary call's cost is not recorded`);

package/dist/store.d.ts

@@ -66,19 +66,6 @@ export interface SessionMeta {
     readonly createdAt: number;
     readonly updatedAt: number;
 }
-/**
- * The session's title — its first substantive prompt.
- *
- * Exported on the INTERNAL entry (never the public root: this is a
- * projection helper, not an API the runtime wants to support forever —
- * and adding it to the root surface is a ritual the api-surface gate
- * rightly refused). It has two consumers and may only have one
- * definition: `list()` below, which is what `kiso sessions` prints, and
- * the CLI's session-card projection, which is what the resume PICKER
- * shows. They were allowed to differ once — the listing got the title
- * and the picker kept showing bare ids, so the fix reached the surface
- * nobody uses and missed the one everybody does.
- */
 export declare function sessionTitle(records: readonly StoreRecord[]): string;
 export declare class SessionStore {
     #private;

package/dist/store.js

@@ -99,11 +99,44 @@ const isOpener = (t) => [...t].length < MIN_TITLE_CHARS || ASCII_OPENER.test(t);
  * and the picker kept showing bare ids, so the fix reached the surface
  * nobody uses and missed the one everybody does.
  */
+/**
+ * R7 — what a `user_input` SAYS, as one string.
+ *
+ * A turn carrying an image is a content ARRAY, and the title only ever
+ * read `typeof content === "string"` — so such a turn was filtered out
+ * entirely and the session was titled "(no prompt)". Worse where a
+ * greeting came first: the opener `isOpener` exists to skip became the
+ * title, because the substantive turn was not in the list to be found.
+ * Exactly the sessions a human recognises by what they showed it.
+ *
+ * Projected HERE, in the runtime, with no dependency on the TUI packages.
+ * The dependency runs one way; a store that reached into the renderer to
+ * name a session would invert it. Unknown block types contribute nothing
+ * rather than a guess — a title is a label, and a label that invents is
+ * worse than a label that is short.
+ */
+function contentText(content) {
+    if (typeof content === "string")
+        return content;
+    if (!Array.isArray(content))
+        return "";
+    const parts = [];
+    for (const block of content) {
+        if (block === null || typeof block !== "object")
+            continue;
+        const b = block;
+        if (b.type === "text" && typeof b.text === "string")
+            parts.push(b.text);
+        else if (b.type === "image")
+            parts.push("(image)");
+    }
+    return parts.join(" ");
+}
 export function sessionTitle(records) {
     const asked = records
         .map((r) => r.event)
-        .filter((e) => e.type === "user_input" && typeof e.content === "string")
-        .map((e) => e.content.trim())
+        .filter((e) => e.type === "user_input")
+        .map((e) => contentText(e.content).trim())
         .filter((t) => t !== "");
     if (asked.length === 0)
         return "(no prompt)";
@@ -135,7 +168,18 @@ export class SessionStore {
     constructor(root, opts) {
         this.root = root;
         this.#lockAdapter = opts?.lockAdapter ?? nativeLockAdapter;
-        mkdirSync(root, { recursive: true });
+        // R6: PRIVATE by default. Under the common umask 022 this came out
+        // 0755 and the logs 0644 — a session's full transcript, prompts and
+        // tool inputs and the contents of every file the model read, was
+        // world-readable on a shared machine. `auth.json` has been 0700/0600
+        // since the credential store shipped; the logs are no less sensitive
+        // and were never given the same treatment.
+        //
+        // EXISTING FILES ARE NOT MIGRATED. Changing modes under someone's
+        // feet is its own surprise, and a deliberate 0644 is a choice kiso
+        // should not silently reverse. A fresh home is private; an old one
+        // stays as its owner left it.
+        mkdirSync(root, { recursive: true, mode: 0o700 });
         fsyncDir(root);
     }
     // ── paths and the cross-process lock ─────────────────────────────────
@@ -282,7 +326,9 @@ export class SessionStore {
         if (existing !== undefined)
             return existing;
         const path = this.pathFor(sessionId);
-        const fd = openSync(path, "a+");
+        // R6: the mode applies at CREATION only — an existing log keeps
+        // whatever it has, which is the not-migrated rule above.
+        const fd = openSync(path, "a+", 0o600);
         repairTornTail(fd);
         fsyncDir(dirname(path));
         this.#fds.set(sessionId, fd);

package/dist/trace/writer.js

@@ -55,7 +55,7 @@ export class TraceWriter {
         if (this.#degraded)
             return;
         try {
-            mkdirSync(join(this.#root, "traces"), { recursive: true });
+            mkdirSync(join(this.#root, "traces"), { recursive: true, mode: 0o700 }); // DF-0322-F1
             const fresh = !existsSync(this.#path);
             if (this.#crashDetect()) {
                 this.#writeSync([
@@ -129,7 +129,11 @@ export class TraceWriter {
         if (lines.length === 0)
             return;
         try {
-            appendFileSync(this.#path, `${lines.map((l) => JSON.stringify(l)).join("\n")}\n`);
+            // DF-0322-F1: the mode applies when THIS call creates the file, and
+            // it is the only call that ever does — nothing truncates the ledger
+            // into existence first (the R6b trap, where an earlier writeFileSync
+            // made the append's mode a no-op).
+            appendFileSync(this.#path, `${lines.map((l) => JSON.stringify(l)).join("\n")}\n`, { mode: 0o600 });
         }
         catch (err) {
             this.#degrade(err);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@vincemakes/kiso-runtime",
-	"version": "0.32.1",
+	"version": "0.33.0",
 	"description": "kiso runtime — durable multi-turn agent sessions: AgentDefinition, AgentRuntime, AgentSession, Run, append-only JSONL store.",
 	"type": "module",
 	"license": "MIT",
@@ -25,12 +25,12 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@vincemakes/kiso-core": "0.32.1"
+		"@vincemakes/kiso-core": "0.33.0"
 	},
 	"peerDependencies": {
-		"@vincemakes/kiso-provider-anthropic": "0.32.1",
-		"@vincemakes/kiso-provider-openai": "0.32.1",
-		"@vincemakes/kiso-provider-openai-responses": "0.32.1"
+		"@vincemakes/kiso-provider-anthropic": "0.33.0",
+		"@vincemakes/kiso-provider-openai": "0.33.0",
+		"@vincemakes/kiso-provider-openai-responses": "0.33.0"
 	},
 	"peerDependenciesMeta": {
 		"@vincemakes/kiso-provider-anthropic": {
@@ -44,7 +44,7 @@
 		}
 	},
 	"devDependencies": {
-		"@vincemakes/kiso-evals": "0.32.1",
+		"@vincemakes/kiso-evals": "0.33.0",
 		"@types/node": "^26.1.2",
 		"typescript": "^5.7.2",
 		"vitest": "^3.0.0"