@vincemakes/kiso-runtime 0.42.3 → 0.43.0

package/dist/recovery-plan.js

@@ -147,16 +147,25 @@ export function deriveRecoveryPlan(events, scope) {
     //    undecided → the pipeline must decide; decided-approved without an
     //    execution → execute the persisted call; decided-denied without a
     //    model-facing result → repair it from the denial.
-    const hasRequest = (callId, after) => events.some((e) => e.type === "permission_requested" && e.callId === callId && e.seq > after);
-    const hasExecution = (callId, after) => events.some((e) => e.type === "tool_execution_started" && e.callId === callId && e.seq > after);
-    const hasResult = (callId, after) => events.some((e) => e.type === "tool_result" && e.callId === callId && e.seq > after);
+    // 0430-F1: an event binds to an invocation by its OWN invocationSeq
+    // when both carry one (0.1.43+) — callId is a correlation key the model
+    // may re-use; an old log's event without one binds by callId after the
+    // call, as before.
+    const bound = (e, callId, after, invocationSeq) => e.invocationSeq !== undefined && invocationSeq !== undefined ? e.invocationSeq === invocationSeq : e.callId === callId && e.seq > after;
+    const hasRequest = (callId, after, invocationSeq) => events.some((e) => e.type === "permission_requested" && bound(e, callId, after, invocationSeq));
+    const hasExecution = (callId, after, invocationSeq) => events.some((e) => e.type === "tool_execution_started" && bound(e, callId, after, invocationSeq));
+    const hasResult = (callId, after, invocationSeq) => events.some((e) => e.type === "tool_result" && bound(e, callId, after, invocationSeq));
     const decidedForCall = (callId, after) => {
         for (const e of events) {
             if (e.type !== "permission_decided")
                 continue;
             // a durable POLICY verdict binds the call (E1); a human verdict
-            // binds its request, never the call (the requests pass owns it)
-            if (e.decidedBy !== undefined && e.callId === callId && e.seq > after)
+            // binds its request, never the call (the requests pass owns it).
+            // 0430-F1: a decision that names its invocation binds EXACTLY that
+            // one (callId repeats); only an old log's decision binds by callId.
+            if (e.decidedBy === undefined)
+                continue;
+            if (e.invocationSeq !== undefined ? e.invocationSeq === after : e.callId === callId && e.seq > after)
                 return e;
         }
         return undefined;
@@ -179,18 +188,24 @@ export function deriveRecoveryPlan(events, scope) {
         // a stored request owns the invocation (the requests pass below) —
         // "only a durable permission_decided authorizes an effect"; Gap A
         // must never re-decide over a stored request.
-        if (hasRequest(call.callId, call.seq))
+        if (hasRequest(call.callId, call.seq, call.seq))
             continue;
-        if (hasResult(call.callId, call.seq))
+        if (hasResult(call.callId, call.seq, call.seq))
             continue; // closed — nothing to fill
         const decided = decidedForCall(call.callId, call.seq);
+        // 0430-F1: a started execution proves the invocation crossed the
+        // permission gate on the fresh path (which records no decision for
+        // a default or hook allow) — it is never re-decided; step 6 owns its
+        // receipt.
+        if (decided === undefined && hasExecution(call.callId, call.seq, call.seq))
+            continue;
         if (decided === undefined)
             return { kind: "DECIDE_PERMISSION", invocationSeq: call.seq };
         if (decided.decision === "approved") {
-            if (!hasExecution(call.callId, call.seq))
+            if (!hasExecution(call.callId, call.seq, call.seq))
                 return { kind: "EXECUTE", invocationSeq: call.seq };
         }
-        else if (!hasResult(call.callId, call.seq)) {
+        else if (!hasResult(call.callId, call.seq, call.seq)) {
             return { kind: "REPAIR_RESULT", invocationSeq: call.seq };
         }
     }
@@ -213,10 +228,10 @@ export function deriveRecoveryPlan(events, scope) {
             return { kind: "WAIT_PERMISSION", invocationSeq: invocationSeq ?? pending.seq };
         }
         if (decided.decision === "approved") {
-            if (!hasExecution(pending.callId, pending.seq))
+            if (!hasExecution(pending.callId, pending.seq, invocationSeq))
                 return { kind: "EXECUTE", invocationSeq: invocationSeq ?? pending.seq };
         }
-        else if (!hasResult(pending.callId, pending.seq)) {
+        else if (!hasResult(pending.callId, pending.seq, invocationSeq)) {
             return { kind: "REPAIR_RESULT", invocationSeq: invocationSeq ?? pending.seq };
         }
     }
@@ -226,7 +241,7 @@ export function deriveRecoveryPlan(events, scope) {
     for (const ev of scope) {
         if (ev.type !== "tool_execution_succeeded" && ev.type !== "tool_execution_failed")
             continue;
-        if (!hasResult(ev.callId, ev.seq) && !events.some((e) => e.type === "tool_result" && e.executionId === ev.executionId)) {
+        if (!hasResult(ev.callId, ev.seq, ev.invocationSeq) && !events.some((e) => e.type === "tool_result" && e.executionId === ev.executionId)) {
             return { kind: "REPAIR_RESULT", executionId: ev.executionId };
         }
     }

package/dist/run.js

@@ -3,7 +3,7 @@
  * persistence, the loop drive, the durable recovery state machine), moved
  * verbatim from session.ts.
  */
-import { denialResult, loop } from "@vincemakes/kiso-core";
+import { denialResult, loop, validateArgs } from "@vincemakes/kiso-core";
 import { ABORTED, MergedSignal, abortable, openRunId } from "./recovery.js";
 import { resolveReasoning } from "./provider/metadata.js";
 import { deriveRecoveryPlan, invocationSeqOf } from "./recovery-plan.js";
@@ -494,6 +494,17 @@ export class Run {
             throw new Error(`the recovery plan derived a call outside the scope (seq ${invocationSeq})`);
         // The chain's PolicyCall carries name+input only — callId is the
         // framework's, the hook's is the provider-facing ToolCallPayload.
+        // 0430-F1: the fresh path's preflight, in the same order and with the
+        // same words — a call the kernel refuses before any policy (unknown
+        // tool, unparsable arguments, a schema failure) is refused here the
+        // same way: one invalid_input result, no decision, no execution.
+        const tool = this.#config.registry.get(call.name);
+        const schemaError = tool !== undefined && call.input !== null ? validateArgs(tool.parameters, call.input) : null;
+        const refusal = tool === undefined ? `Unknown tool: ${call.name}` : call.input === null ? "Arguments failed to parse as JSON" : schemaError !== null ? `Arguments failed schema validation:${schemaError}` : undefined;
+        if (refusal !== undefined) {
+            yield log.append({ type: "tool_result", callId: call.callId, invocationSeq: call.seq, content: refusal, isError: true, errorKind: "invalid_input" });
+            return;
+        }
         const payload = { callId: call.callId, name: call.name, input: call.input ?? {} };
         const policyCall = { name: payload.name, input: payload.input };
         let verdict;
@@ -525,13 +536,26 @@ export class Run {
         }
         if (verdict === undefined)
             verdict = { action: "allow" }; // no policies — the kernel's default allow
-        // The recovery's own decision is a POLICY verdict (the plan's E1
-        // rule: only a decidedBy-carrying decision binds the call — a human
-        // verdict binds its request, never the call). The driver's write
-        // must satisfy its own plan: no decidedBy → the re-derive would
-        // derive DECIDE_PERMISSION again forever (the plan cannot tell the
-        // driver's write from a human's). Stamped "mode:default" when the
-        // verdict carries none — the gates' seeded convention.
+        // 0430-F1: a verdict WITHOUT a speaker — the default allow, an
+        // onPreTool allow or deny — is not a durable fact on the fresh path
+        // and is not one here: allow goes straight to the execution (the
+        // plan no longer re-decides a started invocation), deny straight to
+        // the denial result. Only a speaking chain's verdict is recorded,
+        // exactly as the fresh path records it. (Before: a fabricated
+        // "mode:default" decision, written so the plan could make progress.)
+        if (!("decidedBy" in verdict)) {
+            if (verdict.action === "allow") {
+                yield* this.#executeInvocation(call.seq, scope, log, signal);
+                return;
+            }
+            if (verdict.action === "deny") {
+                yield* this.#denialResult(call.callId, ("reason" in verdict && verdict.reason !== undefined ? verdict.reason : undefined) ?? "denied", call.seq);
+                return;
+            }
+        }
+        // A speaking chain's decision binds the call (the plan's E1 rule: a
+        // decidedBy-carrying decision binds the call — a human verdict binds
+        // its request, never the call).
         const decisionId = `d-${log.all.length + 1}`;
         if (verdict.action === "allow") {
             yield log.append({
@@ -655,6 +679,9 @@ export class Run {
             ? {
                 type: "tool_result",
                 callId: ev.callId,
+                // 0430-F1: the receipt's invocation identity rides the fill, as
+                // a fresh result carries call.seq — bound exactly ever after.
+                ...(ev.invocationSeq !== undefined ? { invocationSeq: ev.invocationSeq } : {}),
                 content: ev.result.content,
                 isError: false,
                 // round 8: the repaired result reproduces the normal path
@@ -665,6 +692,7 @@ export class Run {
             : {
                 type: "tool_result",
                 callId: ev.callId,
+                ...(ev.invocationSeq !== undefined ? { invocationSeq: ev.invocationSeq } : {}),
                 content: ev.error,
                 isError: true,
                 ...(ev.errorKind !== undefined ? { errorKind: ev.errorKind } : {}),
@@ -687,7 +715,10 @@ export class Run {
         const decided = log.all.find((e) => e.type === "permission_decided" &&
             (request !== undefined
                 ? e.decisionId === request.decisionId
-                : call !== undefined && e.callId === call.callId && e.seq > call.seq && e.decidedBy !== undefined));
+                : call !== undefined &&
+                    e.decidedBy !== undefined &&
+                    // 0430-F1: exact invocation first; an old log's decision by callId
+                    (e.invocationSeq !== undefined ? e.invocationSeq === call.seq : e.callId === call.callId && e.seq > call.seq)));
         if (decided === undefined || (request?.callId ?? call?.callId) === undefined) {
             throw new Error(`the recovery plan derived a denial without its decision (seq ${invocationSeq})`);
         }
@@ -755,6 +786,12 @@ export class Run {
         const log = this.#session.log;
         const tool = this.#config.registry.get(name);
         const executionId = `ex-${log.lastSeq + 1}`;
+        // 0.43.0 (#13, 0420-F1): ToolContext is a function of the durable
+        // invocation and execution, never of fresh vs recovery — the same
+        // sessionId, callId, executionId and lexical arguments the fresh path
+        // hands the handler, the last derived from THIS invocation's deltas.
+        const rawInput = rawInputOf(log.all, callId, invocationSeq);
+        const ctx = { signal, sessionId: this.#session.id, callId, executionId, ...(rawInput !== undefined ? { rawInput } : {}) };
         // An abort that landed while the decision was being applied must
         // not start the side effect (finding 3).
         if (signal.aborted)
@@ -777,7 +814,7 @@ export class Run {
                     result = { content: "aborted before execution", isError: true, errorKind: "fatal" };
                 }
                 else {
-                    result = await tool.execute(input, { signal });
+                    result = await tool.execute(input, ctx);
                 }
             }
             catch (err) {
@@ -850,6 +887,7 @@ export class Run {
             content: denial.content,
             isError: true,
             errorKind: denial.errorKind,
+            tags: denial.tags, // 0430-F1: the fresh path's denial carries them
         });
     }
 }
@@ -861,3 +899,27 @@ function resolveReasoningOrThrow(model, setting, endpoint) {
         throw new Error(`the session's recorded reasoning setting cannot run here: ${r.reason}`);
     return Object.keys(r.wire).length > 0 ? { reasoning: r.wire } : {};
 }
+/** 0.43.0 (#13): the invocation's lexical arguments from the durable
+ *  log — the tool_call_input_delta events between ITS tool_call_start
+ *  and ITS tool_call_end (anchored by invocationSeq, never "the latest
+ *  same callId"), the window the kernel buffered on the fresh path.
+ *  Undefined when no delta was streamed, or when the invocation's seq is
+ *  unknown. */
+function rawInputOf(events, callId, invocationSeq) {
+    if (invocationSeq === undefined)
+        return undefined;
+    const end = events.findIndex((e) => e.seq === invocationSeq);
+    if (end < 0)
+        return undefined;
+    let text;
+    for (let i = end - 1; i >= 0; i -= 1) {
+        const e = events[i];
+        if (e.type === "tool_call_start" && e.callId === callId)
+            break;
+        if (e.type === "stop" || e.type === "user_input" || e.type === "terminal" || e.type === "assistant_start")
+            break;
+        if (e.type === "tool_call_input_delta" && e.callId === callId)
+            text = e.inputJsonDelta + (text ?? "");
+    }
+    return text;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@vincemakes/kiso-runtime",
-	"version": "0.42.3",
+	"version": "0.43.0",
 	"description": "kiso runtime \u2014 durable multi-turn agent sessions: AgentDefinition, AgentRuntime, AgentSession, Run, append-only JSONL store.",
 	"type": "module",
 	"license": "MIT",
@@ -25,12 +25,12 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@vincemakes/kiso-core": "0.42.3"
+		"@vincemakes/kiso-core": "0.43.0"
 	},
 	"peerDependencies": {
-		"@vincemakes/kiso-provider-anthropic": "0.42.3",
-		"@vincemakes/kiso-provider-openai": "0.42.3",
-		"@vincemakes/kiso-provider-openai-responses": "0.42.3"
+		"@vincemakes/kiso-provider-anthropic": "0.43.0",
+		"@vincemakes/kiso-provider-openai": "0.43.0",
+		"@vincemakes/kiso-provider-openai-responses": "0.43.0"
 	},
 	"peerDependenciesMeta": {
 		"@vincemakes/kiso-provider-anthropic": {
@@ -44,7 +44,7 @@
 		}
 	},
 	"devDependencies": {
-		"@vincemakes/kiso-evals": "0.42.3",
+		"@vincemakes/kiso-evals": "0.43.0",
 		"@types/node": "^26.1.2",
 		"typescript": "^5.7.2",
 		"vitest": "^3.0.0"