@jini-ai/agent-runtime 0.3.9 → 0.4.0

package/dist/defs/antigravity.d.ts

@@ -8,14 +8,16 @@ import type { RuntimeModelOption } from '../types.js';
  * already has an owner — `auth.ts`'s `classifyAgentAuthFailure` /
  * `isAntigravityAuthFailureText`, consumed by whatever surfaces a structured
  * auth error — and duplicating the decision here would mean this def silently
- * rewrites assistant text into instructions. See `source-map.md`.
+ * rewrites assistant text into instructions. See `archived provenance ledger`.
  *
  * @param fullText - The concatenation of every stdout chunk agy produced.
  * @returns The same text with every sign-in URL replaced by a placeholder.
  * @complexity O(n) in the buffered text length.
  * @overallScore 100/100
  */
-export declare function redactAntigravityAuthUrls(fullText: string): string;
+export declare function redactAntigravityAuthUrls({ fullText }: {
+    fullText: string;
+}): string;
 /**
  * Parses `agy models`' stdout into the shared `RuntimeModelOption[]` shape.
  *
@@ -33,7 +35,9 @@ export declare function redactAntigravityAuthUrls(fullText: string): string;
  * as an empty array: fall back to `fallbackModels`.
  * @complexity O(n) in the stdout length.
  */
-export declare function parseAgyModels(stdout: string): RuntimeModelOption[] | null;
+export declare function parseAgyModels({ stdout }: {
+    stdout: string;
+}): RuntimeModelOption[] | null;
 export declare const antigravityAgentDef: {
     id: string;
     name: string;
@@ -52,7 +56,14 @@ export declare const antigravityAgentDef: {
             label: string;
         }[];
     };
-    buildArgs: (prompt: string, _imagePaths: string[], _extra?: string[] | undefined, options?: import("../types.js").RuntimeBuildOptions | undefined, runtimeContext?: import("../types.js").RuntimeContext | undefined) => string[];
+    buildArgs: ({ prompt, imagePaths: _imagePaths }: {
+        prompt: string;
+        imagePaths: string[];
+    }, { extraAllowedDirs: _extra, options, runtimeContext }?: {
+        extraAllowedDirs?: string[];
+        options?: import("../types.js").RuntimeBuildOptions;
+        runtimeContext?: import("../types.js").RuntimeContext;
+    } | undefined) => string[];
     maxPromptArgBytes: number;
     streamFormat: string;
     needsAgentLogFile: true;

package/dist/defs/antigravity.js

@@ -1,4 +1,5 @@
-/** Ported verbatim from OD's `apps/daemon/src/runtimes/defs/antigravity.ts` (import path adjusted only). See `source-map.md`. */
+/** Ported verbatim from OD's `apps/daemon/src/runtimes/defs/antigravity.ts` (import path adjusted only). See `archived provenance ledger`. */
+import { redactOAuthUrls } from '@jini-ai/oauth';
 import { DEFAULT_MODEL_OPTION } from './shared.js';
 // `agy` v1.1.24 has a real `--model <id>` flag (`agy --help`: "Model for the current CLI
 // session") plus a machine-readable `agy models` subcommand that lists every selectable model as
@@ -68,15 +69,15 @@ const OAUTH_URL_PLACEHOLDER = '[redacted sign-in URL]';
  * already has an owner — `auth.ts`'s `classifyAgentAuthFailure` /
  * `isAntigravityAuthFailureText`, consumed by whatever surfaces a structured
  * auth error — and duplicating the decision here would mean this def silently
- * rewrites assistant text into instructions. See `source-map.md`.
+ * rewrites assistant text into instructions. See `archived provenance ledger`.
  *
  * @param fullText - The concatenation of every stdout chunk agy produced.
  * @returns The same text with every sign-in URL replaced by a placeholder.
  * @complexity O(n) in the buffered text length.
  * @overallScore 100/100
  */
-export function redactAntigravityAuthUrls(fullText) {
-    return fullText.replace(OAUTH_URL_PATTERN, OAUTH_URL_PLACEHOLDER);
+export function redactAntigravityAuthUrls({ fullText }) {
+    return redactOAuthUrls({ text: fullText, pattern: OAUTH_URL_PATTERN, replacement: OAUTH_URL_PLACEHOLDER });
 }
 /**
  * Parses `agy models`' stdout into the shared `RuntimeModelOption[]` shape.
@@ -95,7 +96,7 @@ export function redactAntigravityAuthUrls(fullText) {
  * as an empty array: fall back to `fallbackModels`.
  * @complexity O(n) in the stdout length.
  */
-export function parseAgyModels(stdout) {
+export function parseAgyModels({ stdout }) {
     const lines = String(stdout || '')
         .split('\n')
         .map((line) => line.trim())
@@ -184,7 +185,7 @@ export const antigravityAgentDef = {
     // apps/web/src/providers/daemon.ts). The stronger OVERRIDE block
     // composed in server.ts gives a second line of defense for weak
     // plain-stream models like Gemini 3.5 Flash.
-    buildArgs: (prompt, _imagePaths, _extra = [], options = {}, runtimeContext = {}) => {
+    buildArgs: ({ prompt, imagePaths: _imagePaths }, { extraAllowedDirs: _extra = [], options = {}, runtimeContext = {} } = {}) => {
         // `-p` is a Go `flag`-package flag that TAKES THE PROMPT AS ITS VALUE,
         // not a boolean switch followed by a positional prompt, and agy has no
         // stdin sentinel under the default `--input-format text`. Verified
@@ -251,12 +252,12 @@ export const antigravityAgentDef = {
     //
     //   - Proven with a probe MCP server registered under a relocated `HOME`'s
     //     `.gemini/config/mcp_config.json`: booted under `agy -p`, it read a marker variable
-    //     (`TOVU_ENV_PASSTHROUGH_PROBE`) straight out of its own `process.env` — no config field, no
+    //     straight out of its own `process.env` — no config field, no
     //     argv, nothing but inherited environment. Full MCP handshake observed on the same run:
     //     `server/discover` → `initialize` → `notifications/initialized` → `tools/list`
     //     (protocolVersion `2025-11-25`, clientInfo `antigravity-client`).
     //   - That makes the registration itself a STATIC, one-time operation — the operator adds one
-    //     `tovu` entry to their real `~/.gemini/config/mcp_config.json` (confirmed still the one real
+    //     bridge entry to their real `~/.gemini/config/mcp_config.json` (confirmed still the one real
     //     mechanism; see the probes below) with a bare, env-free `command` pointing at this package's
     //     own `jini-mcp` bin, resolving its credential from the environment at spawn time instead of
     //     a baked-in value. No per-spawn config mutation, no lock, no restore discipline — the exact

package/dist/defs/auggie.d.ts

@@ -3,7 +3,10 @@ export declare const auggieAgentDef: {
     name: string;
     bin: string;
     versionArgs: string[];
-    fetchModels: (resolvedBin: string, env: import("../types.js").RuntimeEnv) => Promise<import("../types.js").RuntimeModelOption[]>;
+    fetchModels: ({ resolvedBin, env }: {
+        resolvedBin: string;
+        env: import("../types.js").RuntimeEnv;
+    }) => Promise<import("../types.js").RuntimeModelOption[]>;
     fallbackModels: import("../types.js").RuntimeModelOption[];
     buildArgs: () => string[];
     streamFormat: string;

package/dist/defs/auggie.js

@@ -12,7 +12,7 @@ export const auggieAgentDef = {
     name: 'Auggie CLI',
     bin: 'auggie',
     versionArgs: ['--version'],
-    fetchModels: async (resolvedBin, env) => detectAcpModels({
+    fetchModels: async ({ resolvedBin, env }) => (({ bin, args, ...optionalArgs }) => detectAcpModels({ bin, args }, optionalArgs))({
         bin: resolvedBin,
         args: ['--acp'],
         env,

package/dist/defs/claude.d.ts

@@ -14,19 +14,33 @@ export declare const claudeAgentDef: {
         '--add-dir': string;
         '--effort': string;
         '--append-system-prompt': string;
+        '--setting-sources': string;
     };
     fallbackModels: import("../types.js").RuntimeModelOption[];
     fallbackModelsAssertedAt: string;
-    fetchModels: (resolvedBin: string, env: import("../types.js").RuntimeEnv) => Promise<import("../types.js").RuntimeModelOption[] | null>;
+    fetchModels: ({ resolvedBin, env }: {
+        resolvedBin: string;
+        env: import("../types.js").RuntimeEnv;
+    }) => Promise<import("../types.js").RuntimeModelOption[] | null>;
     reasoningOptions: {
         id: string;
         label: string;
     }[];
-    buildArgs: (_prompt: string, _imagePaths: string[], extraAllowedDirs?: string[] | undefined, options?: import("../types.js").RuntimeBuildOptions | undefined, runtimeContext?: import("../types.js").RuntimeContext | undefined) => string[];
+    buildArgs: ({ prompt: _prompt, imagePaths: _imagePaths }: {
+        prompt: string;
+        imagePaths: string[];
+    }, { extraAllowedDirs, options, runtimeContext }?: {
+        extraAllowedDirs?: string[];
+        options?: import("../types.js").RuntimeBuildOptions;
+        runtimeContext?: import("../types.js").RuntimeContext;
+    } | undefined) => string[];
     promptViaStdin: true;
     promptInputFormat: "stream-json";
     streamFormat: string;
     externalMcpInjection: "claude-mcp-json";
+    env: {
+        ENABLE_TOOL_SEARCH: string;
+    };
     systemPromptDelivery: {
         strategy: "append-flag";
         flag: string;

package/dist/defs/claude.js

@@ -1,6 +1,6 @@
 /**
  * Ported verbatim from OD's `apps/daemon/src/runtimes/defs/claude.ts` (import
- * path adjusted only). See `source-map.md`.
+ * path adjusted only). See `archived provenance ledger`.
  *
  * **Image delivery (added 2026-08-03):** `buildArgs` below takes an
  * `_imagePaths` parameter but never references it — the Claude Code CLI has
@@ -108,6 +108,7 @@ export const claudeAgentDef = {
         '--add-dir': 'addDir',
         '--effort': 'effort',
         '--append-system-prompt': 'appendSystemPrompt',
+        '--setting-sources': 'settingSources',
     },
     // `claude` has no list-models subcommand, so the model list is answered from the best source
     // available, in this order:
@@ -131,8 +132,8 @@ export const claudeAgentDef = {
     // `~/.claude.json`'s server-fetched `additionalModelOptionsCache`. See
     // `RuntimeAgentDef.fallbackModelsAssertedAt` and `scripts/check-model-fallback-freshness.ts`.
     fallbackModelsAssertedAt: '2026-09-05',
-    fetchModels: async (resolvedBin, env) => {
-        const routed = await loadMmdRouteModels(env, CLAUDE_FALLBACK_MODELS);
+    fetchModels: async ({ resolvedBin, env }) => {
+        const routed = await loadMmdRouteModels({ env: env, fallbackModels: CLAUDE_FALLBACK_MODELS });
         if (routed)
             return routed;
         const [fromCli, fromApi] = await Promise.all([
@@ -165,7 +166,7 @@ export const claudeAgentDef = {
     // prompt reads the prompt from stdin under `--input-format text` (the
     // default), which has no length cap. Mirrors the codex/gemini/opencode/
     // cursor/qwen entries below.
-    buildArgs: (_prompt, _imagePaths, extraAllowedDirs = [], options = {}, runtimeContext = {}) => {
+    buildArgs: ({ prompt: _prompt, imagePaths: _imagePaths }, { extraAllowedDirs = [], options = {}, runtimeContext = {} } = {}) => {
         const caps = agentCapabilities.get('claude') || {};
         // `--input-format stream-json` lets the daemon stream multiple JSONL
         // messages into stdin instead of closing it after the initial prompt,
@@ -238,6 +239,15 @@ export const claudeAgentDef = {
         if (options.allowedTools && options.allowedTools.length > 0) {
             args.push('--allowedTools', ...options.allowedTools);
         }
+        // See `RuntimeBuildOptions.settingSources`. Probe-gated like `--effort`: an older build
+        // rejects an unknown option with exit 1, which would kill the chat rather than degrade it.
+        if (options.settingSources !== undefined && caps.settingSources) {
+            args.push('--setting-sources', options.settingSources.join(','));
+        }
+        // See `RuntimeBuildOptions.settings`. Not probe-gated: `--settings` long predates `--setting-sources`.
+        if (options.settings) {
+            args.push('--settings', options.settings);
+        }
         return args;
     },
     promptViaStdin: true,
@@ -247,6 +257,14 @@ export const claudeAgentDef = {
     // so the daemon writes the user's external MCP servers there before
     // launching (server.ts handles the cwd guard).
     externalMcpInjection: 'claude-mcp-json',
+    // Load MCP tools up front instead of deferring them behind the CLI's ToolSearch tool.
+    // Deferral cost every run one extra model round (a `select:` ToolSearch call, ~3 s) before its
+    // first real tool call, while the run's MCP set is only what the daemon stages
+    // (`--strict-mcp-config`; 11 tools for the originating host), so loading it eagerly is cheap. Documented at
+    // code.claude.com/docs/en/mcp ("`false` — All MCP tools loaded upfront, no deferral"); verified
+    // in the installed 2.1.283 binary (a defined-falsy value selects the "standard" tool mode).
+    // A default only: a run's own env can still set ENABLE_TOOL_SEARCH (see agent-executor).
+    env: { ENABLE_TOOL_SEARCH: 'false' },
     // Formerly inline in `buildArgs` above (see the comment there) — moved to the declarative
     // shape every def now uses to receive `RuntimeBuildOptions.systemPromptOverlay`. Same flag,
     // same probe gate (`capabilityFlags['--append-system-prompt']` above), same "append, never

package/dist/defs/cline.d.ts

@@ -3,7 +3,10 @@ export declare const clineAgentDef: {
     name: string;
     bin: string;
     versionArgs: string[];
-    fetchModels: (resolvedBin: string, env: import("../types.js").RuntimeEnv) => Promise<import("../types.js").RuntimeModelOption[]>;
+    fetchModels: ({ resolvedBin, env }: {
+        resolvedBin: string;
+        env: import("../types.js").RuntimeEnv;
+    }) => Promise<import("../types.js").RuntimeModelOption[]>;
     fallbackModels: import("../types.js").RuntimeModelOption[];
     buildArgs: () => string[];
     streamFormat: string;

package/dist/defs/cline.js

@@ -14,7 +14,7 @@ export const clineAgentDef = {
     name: 'Cline',
     bin: 'cline',
     versionArgs: ['--version'],
-    fetchModels: async (resolvedBin, env) => detectAcpModels({
+    fetchModels: async ({ resolvedBin, env }) => (({ bin, args, ...optionalArgs }) => detectAcpModels({ bin, args }, optionalArgs))({
         bin: resolvedBin,
         args: ['--acp'],
         env,

package/dist/defs/codebuddy.d.ts

@@ -14,7 +14,14 @@ export declare const codebuddyAgentDef: {
         id: string;
         label: string;
     }[];
-    buildArgs: (_prompt: string, _imagePaths: string[], extraAllowedDirs?: string[] | undefined, options?: import("../types.js").RuntimeBuildOptions | undefined, runtimeContext?: import("../types.js").RuntimeContext | undefined) => string[];
+    buildArgs: ({ prompt: _prompt, imagePaths: _imagePaths }: {
+        prompt: string;
+        imagePaths: string[];
+    }, { extraAllowedDirs, options, runtimeContext }?: {
+        extraAllowedDirs?: string[];
+        options?: import("../types.js").RuntimeBuildOptions;
+        runtimeContext?: import("../types.js").RuntimeContext;
+    } | undefined) => string[];
     promptViaStdin: true;
     promptInputFormat: "stream-json";
     streamFormat: string;

package/dist/defs/codebuddy.js

@@ -1,4 +1,4 @@
-/** Ported verbatim from OD's `apps/daemon/src/runtimes/defs/codebuddy.ts` (import path adjusted only). See `source-map.md`. */
+/** Ported verbatim from OD's `apps/daemon/src/runtimes/defs/codebuddy.ts` (import path adjusted only). See `archived provenance ledger`. */
 import { agentCapabilities } from '../capabilities.js';
 import { buildClaudeMcpConfigArgs, DEFAULT_MODEL_OPTION } from './shared.js';
 // Codebuddy Code (https://www.codebuddy.cn) — a Claude Code–compatible CLI
@@ -76,7 +76,7 @@ export const codebuddyAgentDef = {
         { id: 'xhigh', label: 'XHigh' },
         { id: 'max', label: 'Max' },
     ],
-    buildArgs: (_prompt, _imagePaths, extraAllowedDirs = [], options = {}, runtimeContext = {}) => {
+    buildArgs: ({ prompt: _prompt, imagePaths: _imagePaths }, { extraAllowedDirs = [], options = {}, runtimeContext = {} } = {}) => {
         const caps = agentCapabilities.get('codebuddy') || {};
         // Same stdin strategy as Claude Code: `--input-format stream-json`
         // enables JSONL stdin so the daemon can answer AskUserQuestion tool

package/dist/defs/codex.d.ts

@@ -1,5 +1,7 @@
 import type { RuntimeModelOption, RuntimeReasoningOption } from '../types.js';
-export declare function parseCodexDebugModels(stdout: string): RuntimeModelOption[] | null;
+export declare function parseCodexDebugModels({ stdout }: {
+    stdout: string;
+}): RuntimeModelOption[] | null;
 /**
  * Collapses the per-model effort levels on a fetched model list into the single agent-level list a
  * picker renders, in first-seen catalog order, behind the `default` sentinel.
@@ -16,8 +18,13 @@ export declare function parseCodexDebugModels(stdout: string): RuntimeModelOptio
  * static list rather than replace it with an empty one.
  * @complexity O(n·m) over n models and their m levels.
  */
-export declare function unionModelReasoningOptions(models: readonly RuntimeModelOption[]): RuntimeReasoningOption[] | null;
-export declare function codexNeedsDangerFullAccessSandbox(platform?: NodeJS.Platform, env?: NodeJS.ProcessEnv): boolean;
+export declare function unionModelReasoningOptions({ models }: {
+    models: readonly RuntimeModelOption[];
+}): RuntimeReasoningOption[] | null;
+export declare function codexNeedsDangerFullAccessSandbox({}: {}, { platform, env }?: {
+    platform?: NodeJS.Platform;
+    env?: NodeJS.ProcessEnv;
+}): boolean;
 export declare const codexAgentDef: {
     id: string;
     name: string;
@@ -39,7 +46,14 @@ export declare const codexAgentDef: {
         label: string;
     }[];
     deriveReasoningOptions: typeof unionModelReasoningOptions;
-    buildArgs: (_prompt: string, imagePaths: string[], extraAllowedDirs?: string[] | undefined, options?: import("../types.js").RuntimeBuildOptions | undefined, runtimeContext?: import("../types.js").RuntimeContext | undefined) => string[];
+    buildArgs: ({ prompt: _prompt, imagePaths }: {
+        prompt: string;
+        imagePaths: string[];
+    }, { extraAllowedDirs, options, runtimeContext }?: {
+        extraAllowedDirs?: string[];
+        options?: import("../types.js").RuntimeBuildOptions;
+        runtimeContext?: import("../types.js").RuntimeContext;
+    } | undefined) => string[];
     promptViaStdin: true;
     resumesSessionViaCli: true;
     capturesSessionIdFromStream: true;

package/dist/defs/codex.js

@@ -4,7 +4,7 @@
  * product-prefixed) are renamed to `CODEX_SANDBOX_MODE` /
  * `CODEX_DISABLE_PLUGINS` — these are already codex-adapter-scoped
  * operator knobs, so no product namespacing is needed. See
- * `source-map.md` for the exact original names.
+ * `archived provenance ledger` for the exact original names.
  */
 import { DEFAULT_MODEL_OPTION, clampCodexReasoning } from './shared.js';
 /**
@@ -125,7 +125,7 @@ function codexCatalogRow(raw, takenIds) {
     const reasoning = parseCodexEntryReasoning(entry.supported_reasoning_levels);
     return { id, label: codexEntryLabel(entry, id), ...(reasoning ? { reasoning } : {}) };
 }
-export function parseCodexDebugModels(stdout) {
+export function parseCodexDebugModels({ stdout }) {
     const models = readCodexCatalogEntries(stdout);
     if (!models)
         return null;
@@ -156,7 +156,7 @@ export function parseCodexDebugModels(stdout) {
  * static list rather than replace it with an empty one.
  * @complexity O(n·m) over n models and their m levels.
  */
-export function unionModelReasoningOptions(models) {
+export function unionModelReasoningOptions({ models }) {
     const seen = new Set();
     const out = [];
     for (const model of models) {
@@ -169,7 +169,7 @@ export function unionModelReasoningOptions(models) {
     }
     return out.length > 0 ? [{ id: 'default', label: 'Default' }, ...out] : null;
 }
-export function codexNeedsDangerFullAccessSandbox(platform = process.platform, env = process.env) {
+export function codexNeedsDangerFullAccessSandbox({}, { platform = process.platform, env = process.env } = {}) {
     // Operator override for deployments where Codex cannot create its
     // workspace-write sandbox, for example unprivileged Linux containers.
     // Only danger-full-access is accepted; unknown values keep the default path.
@@ -251,14 +251,14 @@ export const codexAgentDef = {
     // `error: unexpected argument '-' found` and the agent exits with
     // code 2 before any prompt is read. The pipe alone is sufficient for
     // stdin delivery.
-    buildArgs: (_prompt, imagePaths, extraAllowedDirs = [], options = {}, runtimeContext = {}) => {
+    buildArgs: ({ prompt: _prompt, imagePaths }, { extraAllowedDirs = [], options = {}, runtimeContext = {} } = {}) => {
         // Codex CLI's `workspace-write` sandbox blocks shell invocations on
         // Windows ("powershell.exe ... rejected: blocked by policy"),
         // because Codex has no working OS-level sandbox on Windows and falls
         // back to a coarse policy that rejects any shell. macOS (Seatbelt)
         // and Linux (Landlock+seccomp) keep workspace-write because their
         // sandbox enforcement permits shell while restricting writes.
-        const needsDangerFullAccess = codexNeedsDangerFullAccessSandbox();
+        const needsDangerFullAccess = codexNeedsDangerFullAccessSandbox({});
         // Capture-style resume: when the caller has a stored Codex thread id
         // for this conversation it asks the CLI to continue that session
         // with `exec resume <thread_id>` instead of `exec` (a fresh
@@ -399,7 +399,7 @@ export const codexAgentDef = {
     //     that keeps the operator's real config untouched by routine daemon spawns.
     //
     // See `@jini-ai/daemon`'s `agent-executor.ts` (`prepareCodexHomeForRun`, `buildCodexHomeConfigToml`)
-    // for the staging/cleanup implementation and `source-map.md` for the full verification transcript.
+    // for the staging/cleanup implementation and `archived provenance ledger` for the full verification transcript.
     externalMcpInjection: 'codex-toml',
 };
 //# sourceMappingURL=codex.js.map

package/dist/defs/copilot.d.ts

@@ -4,7 +4,14 @@ export declare const copilotAgentDef: {
     bin: string;
     versionArgs: string[];
     fallbackModels: import("../types.js").RuntimeModelOption[];
-    buildArgs: (_prompt: string, _imagePaths: string[], extraAllowedDirs?: string[] | undefined, options?: import("../types.js").RuntimeBuildOptions | undefined) => string[];
+    buildArgs: ({ prompt: _prompt, imagePaths: _imagePaths }: {
+        prompt: string;
+        imagePaths: string[];
+    }, { extraAllowedDirs, options }?: {
+        extraAllowedDirs?: string[];
+        options?: import("../types.js").RuntimeBuildOptions;
+        runtimeContext?: import("../types.js").RuntimeContext;
+    } | undefined) => string[];
     promptViaStdin: true;
     streamFormat: string;
     inactivityTimeoutMs: number;

package/dist/defs/copilot.js

@@ -5,7 +5,7 @@
  * product-prefixed operator-override env var name replaced with generic
  * phrasing (this package's `types.ts` already documents
  * `inactivityTimeoutMs` as "callers may still allow an operator override
- * via their own env var"). See `source-map.md` for the exact original
+ * via their own env var"). See `archived provenance ledger` for the exact original
  * wording.
  */
 import { DEFAULT_MODEL_OPTION } from './shared.js';
@@ -57,7 +57,7 @@ export const copilotAgentDef = {
         { id: 'claude-sonnet-4.6', label: 'Claude Sonnet 4.6' },
         { id: 'gpt-5.2', label: 'GPT-5.2' },
     ],
-    buildArgs: (_prompt, _imagePaths, extraAllowedDirs = [], options = {}) => {
+    buildArgs: ({ prompt: _prompt, imagePaths: _imagePaths }, { extraAllowedDirs = [], options = {} } = {}) => {
         const args = [
             // See `RuntimeBuildOptions.permissionMode`'s doc: bypass is the default (unchanged
             // behavior) unless a caller explicitly opts into a restricted run, in which case

package/dist/defs/crush.d.ts

@@ -4,7 +4,14 @@ export declare const crushAgentDef: {
     bin: string;
     versionArgs: string[];
     fallbackModels: import("../types.js").RuntimeModelOption[];
-    buildArgs: (_prompt: string, _imagePaths: string[], _extra: string[] | undefined, options?: import("../types.js").RuntimeBuildOptions | undefined) => string[];
+    buildArgs: ({ prompt: _prompt, imagePaths: _imagePaths }: {
+        prompt: string;
+        imagePaths: string[];
+    }, { extraAllowedDirs: _extra, options }?: {
+        extraAllowedDirs?: string[];
+        options?: import("../types.js").RuntimeBuildOptions;
+        runtimeContext?: import("../types.js").RuntimeContext;
+    } | undefined) => string[];
     promptViaStdin: true;
     streamFormat: string;
 };

package/dist/defs/crush.js

@@ -19,7 +19,7 @@ export const crushAgentDef = {
     // Models come from the providers the user configured in Crush; there is no stable default
     // list to ship, so the picker offers the CLI default and accepts any typed id.
     fallbackModels: [DEFAULT_MODEL_OPTION],
-    buildArgs: (_prompt, _imagePaths, _extra, options = {}) => {
+    buildArgs: ({ prompt: _prompt, imagePaths: _imagePaths }, { extraAllowedDirs: _extra, options = {} } = {}) => {
         const args = ['run', '--quiet'];
         // See `RuntimeBuildOptions.permissionMode`'s doc: bypass is the default (unchanged
         // behavior) unless a caller explicitly opts into a restricted run.

package/dist/defs/cursor-agent.d.ts

@@ -1,5 +1,7 @@
 import type { RuntimeModelOption } from '../types.js';
-export declare function parseCursorAgentModels(stdout: string): RuntimeModelOption[] | null;
+export declare function parseCursorAgentModels({ stdout }: {
+    stdout: string;
+}): RuntimeModelOption[] | null;
 export declare const cursorAgentDef: {
     id: string;
     name: string;
@@ -12,10 +14,19 @@ export declare const cursorAgentDef: {
     listModels: {
         args: string[];
         timeoutMs: number;
-        parse: (stdout: string) => RuntimeModelOption[] | null;
+        parse: ({ stdout }: {
+            stdout: string;
+        }) => RuntimeModelOption[] | null;
     };
     fallbackModels: RuntimeModelOption[];
-    buildArgs: (_prompt: string, _imagePaths: string[], _extra: string[] | undefined, options?: import("../types.js").RuntimeBuildOptions | undefined, runtimeContext?: import("../types.js").RuntimeContext | undefined) => string[];
+    buildArgs: ({ prompt: _prompt, imagePaths: _imagePaths }: {
+        prompt: string;
+        imagePaths: string[];
+    }, { extraAllowedDirs: _extra, options, runtimeContext }?: {
+        extraAllowedDirs?: string[];
+        options?: import("../types.js").RuntimeBuildOptions;
+        runtimeContext?: import("../types.js").RuntimeContext;
+    } | undefined) => string[];
     promptViaStdin: true;
     streamFormat: string;
     eventParser: string;

package/dist/defs/cursor-agent.js

@@ -1,7 +1,7 @@
-/** Ported verbatim from OD's `apps/daemon/src/runtimes/defs/cursor-agent.ts` (import path adjusted only). See `source-map.md`. */
+/** Ported verbatim from OD's `apps/daemon/src/runtimes/defs/cursor-agent.ts` (import path adjusted only). See `archived provenance ledger`. */
 import { DEFAULT_MODEL_OPTION } from './shared.js';
 import { agentCapabilities } from '../capabilities.js';
-export function parseCursorAgentModels(stdout) {
+export function parseCursorAgentModels({ stdout }) {
     const lines = String(stdout || '')
         .split('\n')
         .map((line) => line.trim())
@@ -46,11 +46,11 @@ export const cursorAgentDef = {
     listModels: {
         args: ['models'],
         timeoutMs: 5000,
-        parse: (stdout) => {
+        parse: ({ stdout }) => {
             const trimmed = String(stdout || '').trim();
             if (!trimmed || /no models available/i.test(trimmed))
                 return null;
-            return parseCursorAgentModels(trimmed);
+            return parseCursorAgentModels({ stdout: trimmed });
         },
     },
     fallbackModels: [
@@ -64,7 +64,7 @@ export const cursorAgentDef = {
     // Passing it makes the CLI treat the dash as the literal user prompt,
     // which then surfaces as "your message only contains '-'". Keep stdin
     // piped for prompt delivery, but do not append a fake prompt arg.
-    buildArgs: (_prompt, _imagePaths, _extra, options = {}, runtimeContext = {}) => {
+    buildArgs: ({ prompt: _prompt, imagePaths: _imagePaths }, { extraAllowedDirs: _extra, options = {}, runtimeContext = {} } = {}) => {
         const caps = agentCapabilities.get('cursor-agent') || {};
         const args = [];
         args.push('--print', '--output-format', 'stream-json', '--stream-partial-output');

package/dist/defs/deepseek.d.ts

@@ -5,7 +5,14 @@ export declare const deepseekAgentDef: {
     fallbackBins: string[];
     versionArgs: string[];
     fallbackModels: import("../types.js").RuntimeModelOption[];
-    buildArgs: (prompt: string, _imagePaths: string[], _extra: string[] | undefined, options?: import("../types.js").RuntimeBuildOptions | undefined) => string[];
+    buildArgs: ({ prompt, imagePaths: _imagePaths }: {
+        prompt: string;
+        imagePaths: string[];
+    }, { extraAllowedDirs: _extra, options }?: {
+        extraAllowedDirs?: string[];
+        options?: import("../types.js").RuntimeBuildOptions;
+        runtimeContext?: import("../types.js").RuntimeContext;
+    } | undefined) => string[];
     maxPromptArgBytes: number;
     streamFormat: string;
 };

package/dist/defs/deepseek.js

@@ -1,4 +1,4 @@
-/** Ported verbatim from OD's `apps/daemon/src/runtimes/defs/deepseek.ts` (import path adjusted only). See `source-map.md`. */
+/** Ported verbatim from OD's `apps/daemon/src/runtimes/defs/deepseek.ts` (import path adjusted only). See `archived provenance ledger`. */
 import { DEFAULT_MODEL_OPTION } from './shared.js';
 export const deepseekAgentDef = {
     id: 'deepseek',
@@ -28,7 +28,7 @@ export const deepseekAgentDef = {
     // hang the run. Streaming is plain text on stdout (tool calls go to
     // stderr); skipping `--json` keeps deltas streaming live instead of
     // batched into one trailing summary object at end-of-turn.
-    buildArgs: (prompt, _imagePaths, _extra, options = {}) => {
+    buildArgs: ({ prompt, imagePaths: _imagePaths }, { extraAllowedDirs: _extra, options = {} } = {}) => {
         const args = ['exec', '--auto'];
         if (options.model && options.model !== 'default') {
             args.push('--model', options.model);

package/dist/defs/devin.d.ts

@@ -3,9 +3,19 @@ export declare const devinAgentDef: {
     name: string;
     bin: string;
     versionArgs: string[];
-    fetchModels: (resolvedBin: string, env: import("../types.js").RuntimeEnv) => Promise<import("../types.js").RuntimeModelOption[]>;
+    fetchModels: ({ resolvedBin, env }: {
+        resolvedBin: string;
+        env: import("../types.js").RuntimeEnv;
+    }) => Promise<import("../types.js").RuntimeModelOption[]>;
     fallbackModels: import("../types.js").RuntimeModelOption[];
-    buildArgs: (_prompt: string, _imagePaths: string[], _extra: string[] | undefined, options?: import("../types.js").RuntimeBuildOptions | undefined) => string[];
+    buildArgs: ({ prompt: _prompt, imagePaths: _imagePaths }: {
+        prompt: string;
+        imagePaths: string[];
+    }, { extraAllowedDirs: _extra, options }?: {
+        extraAllowedDirs?: string[];
+        options?: import("../types.js").RuntimeBuildOptions;
+        runtimeContext?: import("../types.js").RuntimeContext;
+    } | undefined) => string[];
     streamFormat: string;
     externalMcpInjection: "acp-merge";
     imageDelivery: "native";

package/dist/defs/devin.js

@@ -1,11 +1,11 @@
-/** Ported verbatim from OD's `apps/daemon/src/runtimes/defs/devin.ts` (import path adjusted only). See `source-map.md`. */
+/** Ported verbatim from OD's `apps/daemon/src/runtimes/defs/devin.ts` (import path adjusted only). See `archived provenance ledger`. */
 import { detectAcpModels, DEFAULT_MODEL_OPTION } from './shared.js';
 export const devinAgentDef = {
     id: 'devin',
     name: 'Devin for Terminal',
     bin: 'devin',
     versionArgs: ['--version'],
-    fetchModels: async (resolvedBin, env) => detectAcpModels({
+    fetchModels: async ({ resolvedBin, env }) => (({ bin, args, ...optionalArgs }) => detectAcpModels({ bin, args }, optionalArgs))({
         bin: resolvedBin,
         args: [
             '--permission-mode',
@@ -38,7 +38,7 @@ export const devinAgentDef = {
     // the CLI falls back to its own built-in default mode and to respecting workspace
     // trust — the conservative side of each flag, without this def having to name a
     // safe-mode string it cannot verify against the installed `devin` build.
-    buildArgs: (_prompt, _imagePaths, _extra, options = {}) => options.permissionMode === 'restricted'
+    buildArgs: ({ prompt: _prompt, imagePaths: _imagePaths }, { extraAllowedDirs: _extra, options = {} } = {}) => options.permissionMode === 'restricted'
         ? ['acp']
         : ['--permission-mode', 'dangerous', '--respect-workspace-trust', 'false', 'acp'],
     streamFormat: 'acp-json-rpc',

package/dist/defs/droid.d.ts

@@ -4,7 +4,14 @@ export declare const droidAgentDef: {
     bin: string;
     versionArgs: string[];
     fallbackModels: import("../types.js").RuntimeModelOption[];
-    buildArgs: (_prompt: string, _imagePaths: string[], _extra: string[] | undefined, options?: import("../types.js").RuntimeBuildOptions | undefined) => string[];
+    buildArgs: ({ prompt: _prompt, imagePaths: _imagePaths }: {
+        prompt: string;
+        imagePaths: string[];
+    }, { extraAllowedDirs: _extra, options }?: {
+        extraAllowedDirs?: string[];
+        options?: import("../types.js").RuntimeBuildOptions;
+        runtimeContext?: import("../types.js").RuntimeContext;
+    } | undefined) => string[];
     promptViaStdin: true;
     streamFormat: string;
 };

package/dist/defs/droid.js

@@ -20,7 +20,7 @@ export const droidAgentDef = {
     bin: 'droid',
     versionArgs: ['--version'],
     fallbackModels: [DEFAULT_MODEL_OPTION],
-    buildArgs: (_prompt, _imagePaths, _extra, options = {}) => {
+    buildArgs: ({ prompt: _prompt, imagePaths: _imagePaths }, { extraAllowedDirs: _extra, options = {} } = {}) => {
         const args = ['exec', '--output-format', 'text'];
         // See `RuntimeBuildOptions.permissionMode`'s doc: bypass is the default (unchanged
         // behavior); a restricted run keeps `droid exec`'s own read-only default.