@vincemakes/kiso-runtime 0.32.2 → 0.33.0

package/dist/profile.js

@@ -57,7 +57,11 @@ export function writeProfile(root, sessionId, profile) {
     const tmpDir = mkdtempSync(join(root, ".meta-"));
     const tmp = join(tmpDir, "meta.json");
     try {
-        writeFileSync(tmp, `${JSON.stringify({ profile }, null, "\t")}\n`);
+        // DF-0322-F1: 0600 on the file kiso CREATES. The mode rides the temp
+        // because rename preserves it, and rename is the only path by which
+        // this file comes into existence. Existing files are not migrated —
+        // R6's choice, kept.
+        writeFileSync(tmp, `${JSON.stringify({ profile }, null, "\t")}\n`, { mode: 0o600 });
         const fd = openSync(tmp, "r");
         try {
             fsyncSync(fd);

package/dist/session.js

@@ -485,8 +485,8 @@ export class AgentSession {
             try {
                 const canonical = canonicalizeUsageForModel(binding.model, binding.baseUrl, binding.provider ?? "adapter", usage);
                 const line = JSON.stringify({ kind: "summary", canonical }) + "\n";
-                mkdirSync(join(this.#store.root, "traces"), { recursive: true });
-                appendFileSync(join(this.#store.root, "traces", `${this.id}.jsonl`), line);
+                mkdirSync(join(this.#store.root, "traces"), { recursive: true, mode: 0o700 }); // DF-0322-F1
+                appendFileSync(join(this.#store.root, "traces", `${this.id}.jsonl`), line, { mode: 0o600 });
             }
             catch (err) {
                 console.error(`[kiso] summary usage ledger degraded (${err instanceof Error ? err.message : String(err)}); the summary call's cost is not recorded`);

package/dist/trace/writer.js

@@ -55,7 +55,7 @@ export class TraceWriter {
         if (this.#degraded)
             return;
         try {
-            mkdirSync(join(this.#root, "traces"), { recursive: true });
+            mkdirSync(join(this.#root, "traces"), { recursive: true, mode: 0o700 }); // DF-0322-F1
             const fresh = !existsSync(this.#path);
             if (this.#crashDetect()) {
                 this.#writeSync([
@@ -129,7 +129,11 @@ export class TraceWriter {
         if (lines.length === 0)
             return;
         try {
-            appendFileSync(this.#path, `${lines.map((l) => JSON.stringify(l)).join("\n")}\n`);
+            // DF-0322-F1: the mode applies when THIS call creates the file, and
+            // it is the only call that ever does — nothing truncates the ledger
+            // into existence first (the R6b trap, where an earlier writeFileSync
+            // made the append's mode a no-op).
+            appendFileSync(this.#path, `${lines.map((l) => JSON.stringify(l)).join("\n")}\n`, { mode: 0o600 });
         }
         catch (err) {
             this.#degrade(err);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@vincemakes/kiso-runtime",
-	"version": "0.32.2",
+	"version": "0.33.0",
 	"description": "kiso runtime — durable multi-turn agent sessions: AgentDefinition, AgentRuntime, AgentSession, Run, append-only JSONL store.",
 	"type": "module",
 	"license": "MIT",
@@ -25,12 +25,12 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@vincemakes/kiso-core": "0.32.2"
+		"@vincemakes/kiso-core": "0.33.0"
 	},
 	"peerDependencies": {
-		"@vincemakes/kiso-provider-anthropic": "0.32.2",
-		"@vincemakes/kiso-provider-openai": "0.32.2",
-		"@vincemakes/kiso-provider-openai-responses": "0.32.2"
+		"@vincemakes/kiso-provider-anthropic": "0.33.0",
+		"@vincemakes/kiso-provider-openai": "0.33.0",
+		"@vincemakes/kiso-provider-openai-responses": "0.33.0"
 	},
 	"peerDependenciesMeta": {
 		"@vincemakes/kiso-provider-anthropic": {
@@ -44,7 +44,7 @@
 		}
 	},
 	"devDependencies": {
-		"@vincemakes/kiso-evals": "0.32.2",
+		"@vincemakes/kiso-evals": "0.33.0",
 		"@types/node": "^26.1.2",
 		"typescript": "^5.7.2",
 		"vitest": "^3.0.0"