@jini-ai/daemon 0.3.8 → 0.5.0

package/CHANGELOG.md

@@ -0,0 +1,119 @@
+## Unreleased
+
+### Fixes
+
+- Keep packed session-store test fixtures within daemon's source root, use the SQLite driver's zero-argument close API, and declare PostgreSQL test types with `@types/pg`.
+
+- Align parser feeds, event sinks, run streams, attachment matchers and OAuth cache construction with current dependency APIs.
+- Omit absent optional arguments under strict TypeScript checking; restore lifecycle event input, terminal options and the delegated `tool_result` discriminant.
+- Compile tests alongside source and update test fixtures to current callback and argument contracts without removing assertions.
+
+## 0.5.0 — 2026-10-02
+
+### BREAKING
+
+- Daemon HTTP route packs and read-only tools now belong to this package. Run services use concept subpaths, optional HTTP peers and canonical core contracts.
+- Distribution includes runtime output, release documentation and required assets only. Process records and per-job neutrality checks are no longer part of the package surface.
+
+### BREAKING — HTTP and run coordination ownership
+
+- Add optional `./http` with route packs moved from HTTP kit, plus `./read-only-tools`.
+- Remove delegated policy facades; use real policy exports with host messages and core IDs.
+- Run coordination modules use concept paths. Surface exchanges take core Clock/IdGenerator;
+  the Node credential adapter uses core token comparison. Database-lane object APIs reconciled.
+- HTTP kit and Express are optional HTTP peers; chat is test-only.
+
+- BREAKING: All three session-store factories and SQLite event logs accept optional core `Clock` through `{ clock }` instead of `{ now }`, preserving system-time defaults.
+
+## 0.4.0 (unpublished release candidate)
+
+- Session-id adapters and the SQLite event log move to dedicated store subpaths; all database connections are injected.
+
+# @jini-ai/daemon
+
+## 0.2.1
+
+### Patch Changes
+
+- Add top-level `main`/`types` fields alongside the existing `exports` map. A consumer on
+  TypeScript's classic `moduleResolution: "node"` (node10) — which ignores `package.json#exports`
+  entirely — could not resolve this package's types at all (`TS2307: Cannot find module`) even
+  after the previous exports-map fix restored `require()` at runtime; type resolution and runtime
+  resolution are separate algorithms. Verified against a real external consumer (whose
+  tsconfig uses this legacy resolution mode): adding these two fields, with its tsconfig completely
+  unchanged, made the error disappear. Also fixes absolute-path `require()` (distinct from a bare
+  specifier, which already worked) for the same reason — `main` was previously absent.
+
+  Purely additive: every modern resolver (Node's own runtime `exports` resolution, TypeScript's
+  `bundler`/`node16`/`nodenext`) prefers `exports` over `main`/`types` when both are present, so
+  this changes nothing for a consumer already on a modern resolver.
+
+- Updated dependencies
+  - @jini-ai/protocol@0.1.2
+  - @jini-ai/core@0.1.2
+  - @jini-ai/agent-runtime@0.2.1
+  - @jini-ai/platform@0.1.2
+
+## 0.2.0
+
+### Minor Changes
+
+- Add a `"default"` export condition to every published package's `exports` map — every one of
+  them lacked it, which meant `require()` failed with `ERR_PACKAGE_PATH_NOT_EXPORTED` for any
+  CommonJS consumer (found via a real external integration attempt; Node needs `require(esm)`
+  support, i.e. Node >=22.12, for this to resolve).
+
+  `@jini-ai/agent-runtime`:
+
+  - **New**: `RuntimeBuildOptions.permissionMode` (`'bypass' | 'restricted'`) lets a caller opt a
+    run OUT of the auto-approve-every-permission-prompt flag every def with one
+    (`bypassPermissions` / `--yolo` / `--dangerously-skip-permissions`) previously pushed
+    unconditionally, with no way to turn it off. Omitting it keeps today's default (bypass)
+    behavior unchanged.
+  - **New**: `ClaudeStreamEvent`, `CopilotStreamEvent`, and `QoderEvent` are now real exported
+    discriminated unions instead of `Record<string, unknown>` — a real external consumer guessed a
+    nonexistent field name (`event.text` instead of the actual `event.delta`) against the old
+    untyped sink and silently lost every streamed token with no compile or runtime error.
+  - Fixed a doc/implementation mismatch in `claude-stream.ts`: the module doc claimed `tool_result`
+    events carry `{ tool_use_id, content, is_error }`; the actual emitted shape is
+    `{ toolUseId, content, isError }`.
+
+  `@jini-ai/daemon`: `AgentExecutorRunInput.permissionMode` forwards the new
+  `RuntimeBuildOptions.permissionMode` through to `buildArgs`, so a host can actually reach the new
+  opt-out from the daemon's real run-input surface, not just from `@jini-ai/agent-runtime` in
+  isolation.
+
+  `@jini-ai/agentic`: `setAtPointer` no longer throws on a malformed (e.g. missing leading `/`)
+  `updateDataModel` path — degrades to a no-op like its sibling `getAtPointer`, matching this
+  package's own "a bad binding must not crash the renderer" contract. That path is agent-authored
+  wire data with no error boundary above it in any host, so the uncaught throw could unmount an
+  entire chat UI from ~40 bytes of malformed input.
+
+  `@jini-ai/chat-react`: a local (client-resolved) A2UI button action is no longer a silent no-op —
+  `A2uiSurfaceCard` now surfaces the resolved value. New `ExtEventErrorBoundary` confines a
+  `kind: 'ext'` event group's renderer to its own card instead of letting a render/effect-phase
+  throw from agent-controlled content unmount the whole chat root (there was no error boundary
+  anywhere in this package or its hosts before this).
+
+- 0d15314: Add a neutral Composer footer slot for host-owned controls, forward an optional host-selected model through every AgentExecutor runtime transport, expose daemon-owned live agent/model discovery with an explicit rescan route, and recognize Claude Code's partial-stream `message_delta` turn boundary so successful stream-json runs close cleanly.
+
+### Patch Changes
+
+- e181b22: Enforce flat-package domain/runtime/admission metadata, invert optional capability dependencies,
+  inject failure-contained run-stream encoders, clean up provisional replay subscribers, and add a
+  neutral node-host HTTP-extension composition seam.
+- Updated dependencies
+- Updated dependencies [0d15314]
+  - @jini-ai/protocol@0.1.1
+  - @jini-ai/core@0.1.1
+  - @jini-ai/platform@0.1.1
+  - @jini-ai/agent-runtime@0.2.0
+
+## Unreleased — C2 concern ownership
+
+- Add audit, held surface-exchange, session-coordination, live-run credential and ownership subpaths; convert daemon calls to required/optional object arguments and inject host ports.
+- Make watchdog cancellation permanent and agent permission defaults restricted, with explicit bypass and invalid-mode rejection.
+
+- Added isolated SQLite event-log and rich legacy session entries with host injection.
+- Added neutral session-id port, in-memory store and shared-kernel SQLite/PGlite/Postgres adapters.
+- Preserved durable cursor validation, default cap 2000, dedupe/restart/media semantics.

package/README.md

@@ -9,6 +9,9 @@ running process: a `RunLifecycle` you can `start`/`emit`/`cancel`/`resume`/`stre
 `ToolExecutor` that is the *only* thing allowed to invoke a registered tool's handler, and an
 `AgentExecutor` that spawns and streams a real agent CLI into that lifecycle.
 
+Package `typecheck` and `build` compile source and tests together; runtime test execution remains a separate command.
+Packed-consumer fixtures are local to this package. PostgreSQL test declarations come from the development dependency `@types/pg`.
+
 ## Install
 
 ```sh
@@ -26,11 +29,11 @@ spawn — needs `node-pty` installed; everything else has no native-addon depend
   (`start`/`get`/`list`/`cancel`/`onCancelRequested`/`emit`/`finish`/`resume`/`waitForTerminal`/
   `stream`/`rehydrate`), keyed on an opaque `contextRef`, backed by an injected `EventLog`.
 - **Event log** — `createInMemoryEventLog`, the reference `EventLog` implementation (the port
-  types themselves live in `@jini-ai/protocol` so a storage adapter like `@jini-ai/sqlite` can
+  types themselves live in `@jini-ai/protocol` so a storage adapter like `@jini-ai/daemon/store/event-log/sqlite` can
   implement them without depending on this package).
 - **Tool-execution boundary** — `createToolExecutor`, the `ToolExecutor` interface
   (`execute`/`resumeConfirmation`/`cancel`/`getAuditRecord`). It is the sole caller of
-  `@jini-ai/core/internal`'s `authorizeToolInvocation` — routes and agents only ever see
+  `@jini-ai/core/composition`'s `authorizeToolInvocation` — routes and agents only ever see
   `ToolRegistry` descriptors, never a handler, and this is the one path that can run one, gated by
   an injected `ExecutionDelegate` (authorize/confirm) with a resumable confirmation flow.
 - **Agent executor** — `createAgentExecutor`, `AgentExecutorError` — wires
@@ -62,20 +65,20 @@ spawn — needs `node-pty` installed; everything else has no native-addon depend
 import { createToolRegistry } from '@jini-ai/core';
 import { createInMemoryEventLog, createRunLifecycle, createToolExecutor } from '@jini-ai/daemon';
 
-const eventLog = createInMemoryEventLog();
+const eventLog = createInMemoryEventLog({});
 const lifecycle = createRunLifecycle({ eventLog });
-const registry = createToolRegistry();
+const registry = createToolRegistry({});
 const executor = createToolExecutor({ registry });
 
 const { run } = await lifecycle.start({ contextRef: 'workspace-42' });
-await lifecycle.emit(run.id, { event: 'stdout', data: { chunk: 'hello' } });
-await lifecycle.finish({ runId: run.id, status: 'succeeded', code: 0, signal: null });
+await lifecycle.emit({ runId: run.id, input: { event: 'stdout', data: { chunk: 'hello' } } });
+await lifecycle.finish({ runId: run.id, status: 'succeeded', code: 0, signal: null, resumable: false });
 ```
 
 ## What's swappable
 
 `EventLog` and `RunLifecycle` are consumed as ports — this package ships the reference in-memory
-implementations, but a host wires `@jini-ai/sqlite`'s durable `EventLog` for persistence, or its
+implementations, but a host wires `@jini-ai/daemon/store/event-log/sqlite`'s durable `EventLog` for persistence, or its
 own `RunLifecycle`, as long as it satisfies the same `@jini-ai/protocol`/interface shapes.
 `ExecutionDelegate` (authorize/confirm UI) is a transport-supplied seam on `createToolExecutor` —
 omit it for a headless caller. `PtySpawn` (terminal sessions) and `RoutineStore` (routine
@@ -89,4 +92,43 @@ ESM only — ships `"type": "module"` with no CommonJS `require` build.
 
 ## Provenance
 
-See [source-map.md](./source-map.md) for per-file provenance and scope decisions. Apache-2.0.
+See the archived provenance ledger for per-file provenance and scope decisions. Apache-2.0.
+
+## Storage concern subpaths
+
+The root remains driver-free. `./store/event-log/sqlite` exports the unchanged cursor/dedupe/replay
+adapter. `createSqliteEventLog({ db }, { maxEntriesPerRun, clock })` borrows the host handle, ensures
+its dedicated schema idempotently, never changes pragmas, and has a harmless `close({})`.
+`openSqliteEventLog({ file, open }, options)` owns a host-acquired handle, sets WAL, cleans up failed
+setup, and closes once. Owned acquisition uses only `openSqliteEventLog`; borrowed creation takes `{ db }`. No ambient driver is loaded.
+
+`./store/agent-sessions` exports `AgentSessionStore`, `AgentSessionStoreError` and
+`createInMemoryAgentSessionStore`. `./store/agent-sessions/{sqlite,pglite,postgres}` export the named
+`createSqliteAgentSessionStore`, `createPgliteAgentSessionStore` and `createPostgresAgentSessionStore`
+factories with `{ kernel }` plus optional `{ clock }` (`Clock.nowMs()` from core, defaulting to system wall time). They borrow an already-migrated kernel, join its
+transactions, and use the unchanged `assistant_agent_sessions` mapping. PGlite supports embedded
+and owner-socket kernels. Extra host tables are accepted. No schema/bootstrap/pragma/close occurs
+at construction. SQL failures retain a cause under `AgentSessionStoreError({ code: 'unavailable' })`.
+
+The SQLite entry also preserves rich legacy `agent_sessions` functions and exports
+`LEGACY_AGENT_SESSIONS_DDL`. These records include hashes/model/cwd/message cursors and belong to
+the local legacy model; they are separate from the simple session-id port.
+
+Database/Kysely/drivers are optional peers and are needed only by the selected concern. Hosts import
+and inject their own drivers. Real Postgres session tests require `JINI_DAEMON_TEST_POSTGRES_URL`
+targeting a disposable `jini_daemon_test_*` database; `pnpm run test:postgres` fails when it is unavailable.
+
+## Design decisions
+
+- [Remote tool execution records into the owning run](docs/decisions/DR-001-remote-tool-event-recording.md).
+
+- [Agent subprocess environment is an explicit allowlist](docs/decisions/DR-002-explicit-subprocess-environment.md).
+
+## Optional HTTP surface
+
+`@jini-ai/daemon/http` exports daemon route packs, attachment storage, frontend control,
+workspace-root resolution and the live route manifest. Install `@jini-ai/http-kit` and
+`express` only when using this entry. `@jini-ai/daemon/read-only-tools` owns the fail-closed
+execution gate; compose it around the bare executor, beneath recovery decorators, since an
+outer wrapper cannot intercept references those decorators already hold.
+See [API.md](https://github.com/AINSEP/Jini/blob/main/packages/daemon/API.md) for route, credential, audit, surface and session contracts.