@jini-ai/daemon 0.5.1 → 0.5.3

package/CHANGELOG.md

@@ -1,3 +1,14 @@
+## 0.5.3 — 2026-10-06
+
+- Message attachments reach every runtime: new `prepareMessageAttachments` / `messageContentWithImages` (+ `MessageAttachmentImage`, `MessageAttachmentSource`, `MessageAttachmentReader`) turn claimed refs into image pixels for providers and a file notice for non-images.
+- `AttachmentStore.listPendingForOwner({ ownerId }, { runId })`: with the claiming `runId`, that run's own claimed attachments stay discoverable (owner match still required); without it, behavior is unchanged.
+- The agent executor reports the CLI session id on an early `status` event so hosts can checkpoint a run before it ends; run lifecycle carries it through.
+- Requires `@jini-ai/protocol` ^0.4.1 and `@jini-ai/agent-runtime` ^0.4.1.
+
+## 0.5.2 — 2026-10-06
+
+- No slow-run notice while a delegated tool waits on a surface: the first `emitSurface` of a call suspends the notice and the call's end resumes it. Suspensions are counted, so with two calls in flight the first to finish does not re-arm the notice over the other's open form; `resume()` drops suspensions left by an ended run.
+
 ## 0.5.1 — 2026-10-05
 
 - The `@jini-ai/db` peer range is `^0.2.0 || ^0.3.0` (daemon uses only db's kernel and store entries, which 0.3.0 leaves unchanged), so a host on db 0.3.0 installs without a peer conflict.

package/dist/agent-executor/contracts.d.ts

@@ -1,3 +1,4 @@
+import type { MessageAttachmentImage } from '../attachment-content.js';
 import { type spawn as nodeSpawn, type ChildProcess } from 'node:child_process';
 import { type Principal } from '@jini-ai/core';
 import { type RunAgentPayload, type RunErrorPayload } from '@jini-ai/protocol';
@@ -55,15 +56,13 @@ export type AgentExecutorCompatibility = {
  * produce plus defensively malformed/non-record input.
  *
  * `'agent'`'s optional `sessionId` (gap 5, session resume — see
- * `RunEndPayload.sessionRef`'s doc in `@jini-ai/protocol`) is a daemon-internal
- * side channel, not part of the `RunAgentPayload` wire payload itself:
- * OpenCode's `sessionID`/Codex's `thread_id`/Qoder's and Claude's
- * `session_id` all arrive on a `'status'` event alongside fields
- * `RunAgentPayload`'s `'status'` variant already models (`label`/`model`/
- * `ttftMs`/`detail`) but has no room for a session id itself — surfacing it
- * here lets a lifecycle-wiring function capture it into a local variable and
- * thread it into its own terminal `finish()` call, without widening the
- * public wire protocol just to carry a value that only this module reads.
+ * `RunEndPayload.sessionRef`'s doc in `@jini-ai/protocol`) remains a daemon-internal
+ * side channel for lifecycle wiring to capture the locator and thread it into
+ * its terminal `finish()` call. The `'status'` wire payload also carries
+ * `sessionId` so durable hosts can persist it immediately, before a process
+ * crash can prevent the terminal `end` event from arriving. OpenCode's
+ * `sessionID`/Codex's `thread_id`/Qoder's and Claude's `session_id` are normalized
+ * by their stream parsers into this shared locator.
  *
  * `'turn-end'`'s optional `stopReason` (gap 3, capability-routed
  * continuation transport) is the same kind of internal side channel: the
@@ -129,6 +128,8 @@ export interface AgentExecutorRunInput {
      * the top of `run()` in `launch.ts`.
      */
     readonly imagePaths?: readonly string[];
+    /** Host-prepared pixels from the shared attachment reader, for structured message delivery. */
+    readonly imageContents?: readonly MessageAttachmentImage[];
     /** Additional host-validated directories the runtime may read. */
     readonly extraAllowedDirs?: readonly string[];
     /** Trusted root that must contain pi-rpc image paths after realpath resolution. */
@@ -192,7 +193,7 @@ export interface AgentExecutor {
      * underlying run is always already transitioned to `'failed'` via
      * `lifecycle.finish()` before this rejects (see index.ts module doc's Invariant).
      */
-    run(requiredArgs: Pick<AgentExecutorRunInput, "runId" | "agentId" | "prompt" | "cwd">, optionalArgs?: Pick<AgentExecutorRunInput, "model" | "reasoning" | "permissionMode" | "imagePaths" | "extraAllowedDirs" | "uploadRoot" | "credentialEnv" | "env" | "resumeSessionId" | "newSessionId" | "disallowedTools" | "allowedTools" | "settingSources" | "settings">): Promise<void>;
+    run(requiredArgs: Pick<AgentExecutorRunInput, "runId" | "agentId" | "prompt" | "cwd">, optionalArgs?: Pick<AgentExecutorRunInput, "model" | "reasoning" | "permissionMode" | "imagePaths" | "imageContents" | "extraAllowedDirs" | "uploadRoot" | "credentialEnv" | "env" | "resumeSessionId" | "newSessionId" | "disallowedTools" | "allowedTools" | "settingSources" | "settings">): Promise<void>;
 }
 /** Process discovery is a getter; process collection and stopping accept explicit host inputs. */
 export type CollectProcessTreePidsPort = (args: {
@@ -230,6 +231,9 @@ export interface AgentCleanupFailureContext {
 }
 /** A small handle `writePromptToStdin` uses to close stdin exactly once, shared with the `turn_end`-triggered close inside {@link wireChildLifecycle}. */
 export interface StdinCloseHandle {
+    /** Prepared pixels ride on the initial stdin message without reopening filesystem tools or
+     * serializing base64 into text. Native argv/ACP/pi transports keep their existing image path. */
+    imageContents?: readonly MessageAttachmentImage[];
     closeStdinOnce(): void;
     /** Journals a sent-to-stdin byte chunk, queued through the same FIFO {@link wireChildLifecycle} already uses for emitted events. No-op when no journal was configured (see `CreateAgentExecutorOptions.journal`). */
     recordSentBytes(content: string): void;

package/dist/agent-executor/event-translation.js

@@ -62,6 +62,7 @@ export function translateStatusEvent({ rawEvent }) {
             ...(model !== undefined ? { model } : {}),
             ...(ttftMs !== undefined ? { ttftMs } : {}),
             ...(detail !== undefined ? { detail } : {}),
+            ...(sessionId !== undefined ? { sessionId } : {}),
         },
         ...(sessionId !== undefined ? { sessionId } : {}),
     };

package/dist/agent-executor/events.js

@@ -1,3 +1,4 @@
+import { messageContentWithImages } from '../attachment-content.js';
 import {} from 'node:child_process';
 import { redactSecrets, } from '@jini-ai/core';
 import {} from '@jini-ai/protocol';
@@ -13,6 +14,11 @@ import {} from './contracts.js';
 import { translateAgentRuntimeEvent, translateAcpError, applyAgentTranslationSideEffects, } from './event-translation.js';
 import { errorMessage, } from './values.js';
 import { MCP_BRIDGE_UNAVAILABLE, unavailableJiniBridgeStatus, bridgeUnavailableMessage, } from './mcp-bridge.js';
+/** Carry PID only on structured status so the host can record its OS start identity early.
+ * A PID alone is never proof of death; hosts verify PID reuse before native continuation. */
+function statusWithChildIdentity({ payload, childPid }, _optional = {}) {
+    return { ...payload, ...(payload.type === 'status' && childPid !== undefined ? { childPid } : {}) };
+}
 /**
  * Selects and constructs the real stream-parser handler for a supported
  * `streamFormat`. `json-event-stream` additionally dispatches on
@@ -411,7 +417,7 @@ export function wireChildLifecycle(ctx) {
                     translation.payload.delta.length > 0) {
                     userVisibleOutputSeen = true;
                 }
-                enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'agent', data: translation.payload } }));
+                enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'agent', data: statusWithChildIdentity({ payload: translation.payload, childPid: ctx.child.pid }, {}) } }));
             }
             else if (translation.kind === 'error') {
                 enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'error', data: translation.payload } }));
@@ -769,7 +775,7 @@ export function writePromptToStdin(def, child, prompt, handle) {
     if (!stdin)
         return;
     if (def.promptInputFormat === 'stream-json') {
-        const line = JSON.stringify({ type: 'user', message: { role: 'user', content: [{ type: 'text', text: prompt }] } });
+        const line = JSON.stringify({ type: 'user', message: { role: 'user', content: messageContentWithImages({ prompt, images: handle.imageContents ?? [] }, {}) } });
         stdin.write(`${line}\n`, 'utf8');
         handle.recordSentBytes(prompt);
         return;

package/dist/agent-executor/launch.js

@@ -994,6 +994,8 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         // fallback strategy, so their prefix is genuinely non-empty; what makes stdin the wrong
         // channel for them is the def's declared transport, not the strategy.
         const stdinPrompt = def.promptViaStdin === true ? overlayDelivery.prompt : imageDelivery.prompt;
+        if (input.imageContents !== undefined)
+            stdinHandle.imageContents = input.imageContents;
         writePromptToStdin(def, child, stdinPrompt, stdinHandle);
     }
     return { run };

package/dist/agent-executor.d.ts

@@ -1,3 +1,4 @@
+import type { MessageAttachmentImage } from './attachment-content.js';
 /**
  * `AgentExecutor` — the driver `RunLifecycle`'s own module doc names as the
  * missing piece: *"It does not spawn or signal a subprocess... A driver...
@@ -312,6 +313,8 @@ export interface AgentExecutorRunInput {
      * the top of `run()` below.
      */
     readonly imagePaths?: readonly string[];
+    /** Host-prepared pixels from the shared attachment reader, for structured message delivery. */
+    readonly imageContents?: readonly MessageAttachmentImage[];
     /** Additional host-validated directories the runtime may read. */
     readonly extraAllowedDirs?: readonly string[];
     /** Trusted root that must contain pi-rpc image paths after realpath resolution. */
@@ -375,7 +378,7 @@ export interface AgentExecutor {
      * underlying run is always already transitioned to `'failed'` via
      * `lifecycle.finish()` before this rejects (see module doc's Invariant).
      */
-    run(requiredArgs: Pick<AgentExecutorRunInput, "runId" | "agentId" | "prompt" | "cwd">, optionalArgs?: Pick<AgentExecutorRunInput, "model" | "reasoning" | "permissionMode" | "imagePaths" | "extraAllowedDirs" | "uploadRoot" | "credentialEnv" | "env" | "resumeSessionId" | "newSessionId" | "disallowedTools" | "allowedTools" | "settingSources" | "settings">): Promise<void>;
+    run(requiredArgs: Pick<AgentExecutorRunInput, "runId" | "agentId" | "prompt" | "cwd">, optionalArgs?: Pick<AgentExecutorRunInput, "model" | "reasoning" | "permissionMode" | "imagePaths" | "imageContents" | "extraAllowedDirs" | "uploadRoot" | "credentialEnv" | "env" | "resumeSessionId" | "newSessionId" | "disallowedTools" | "allowedTools" | "settingSources" | "settings">): Promise<void>;
 }
 /** Process discovery is a getter; process collection and stopping accept explicit host inputs. */
 export type CollectProcessTreePidsPort = (args: {

package/dist/agent-executor.js

@@ -1,3 +1,4 @@
+import { messageContentWithImages } from './attachment-content.js';
 /**
  * `AgentExecutor` — the driver `RunLifecycle`'s own module doc names as the
  * missing piece: *"It does not spawn or signal a subprocess... A driver...
@@ -1985,7 +1986,7 @@ function writePromptToStdin(def, child, prompt, handle) {
     if (!stdin)
         return;
     if (def.promptInputFormat === 'stream-json') {
-        const line = JSON.stringify({ type: 'user', message: { role: 'user', content: [{ type: 'text', text: prompt }] } });
+        const line = JSON.stringify({ type: 'user', message: { role: 'user', content: messageContentWithImages({ prompt, images: handle.imageContents ?? [] }, {}) } });
         stdin.write(`${line}\n`, 'utf8');
         handle.recordSentBytes(prompt);
         return;
@@ -3000,6 +3001,8 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         // fallback strategy, so their prefix is genuinely non-empty; what makes stdin the wrong
         // channel for them is the def's declared transport, not the strategy.
         const stdinPrompt = def.promptViaStdin === true ? overlayDelivery.prompt : imageDelivery.prompt;
+        if (input.imageContents !== undefined)
+            stdinHandle.imageContents = input.imageContents;
         writePromptToStdin(def, child, stdinPrompt, stdinHandle);
     }
     return { run };

package/dist/attachment-content.d.ts

@@ -0,0 +1,45 @@
+export interface MessageAttachmentImage {
+    readonly mimeType: string;
+    readonly data: string;
+}
+export interface MessageAttachmentSource {
+    readonly name: string;
+    readonly mimeType: string;
+    readonly bytes: Uint8Array;
+    readonly path?: string;
+}
+export interface MessageAttachmentReader {
+    (required: {
+        ref: string;
+    }, optional: Record<string, never>): Promise<MessageAttachmentSource>;
+}
+/** One byte-bearing message path for CLI and API consumers. The host reader owns authorization,
+ * integrity and MIME sniffing; this module never opens a caller-selected path itself. Unsupported
+ * files are explicit so the model cannot mistake a filename for content it has received. */
+export declare function prepareMessageAttachments({ refs, read }: {
+    refs: readonly string[];
+    read: MessageAttachmentReader;
+}, { fileAccess, imageAccess }?: {
+    fileAccess?: boolean;
+    imageAccess?: boolean;
+}): Promise<{
+    images: MessageAttachmentImage[];
+    imagePaths: string[];
+    notice: string;
+}>;
+/** Stream-JSON runtimes use the same normalized pixels as provider APIs. */
+export declare function messageContentWithImages({ prompt, images }: {
+    prompt: string;
+    images: readonly MessageAttachmentImage[];
+}, _optional?: {}): ({
+    type: "image";
+    source: {
+        type: "base64";
+        media_type: string;
+        data: string;
+    };
+} | {
+    type: "text";
+    text: string;
+})[];
+//# sourceMappingURL=attachment-content.d.ts.map

package/dist/attachment-content.js

@@ -0,0 +1,40 @@
+import { Buffer } from 'node:buffer';
+/** One byte-bearing message path for CLI and API consumers. The host reader owns authorization,
+ * integrity and MIME sniffing; this module never opens a caller-selected path itself. Unsupported
+ * files are explicit so the model cannot mistake a filename for content it has received. */
+export async function prepareMessageAttachments({ refs, read }, { fileAccess = false, imageAccess = true } = {}) {
+    const images = [];
+    const notices = [];
+    const imagePaths = [];
+    for (const ref of refs) {
+        const source = await read({ ref }, {});
+        if (['image/png', 'image/jpeg', 'image/gif', 'image/webp'].includes(source.mimeType)) {
+            if (!imageAccess) {
+                notices.push(`${source.name}: image attachments are unsupported by this runtime.`);
+                continue;
+            }
+            if (source.path)
+                imagePaths.push(source.path);
+            images.push({ mimeType: source.mimeType, data: Buffer.from(source.bytes).toString('base64') });
+            continue;
+        }
+        const video = source.mimeType.startsWith('video/');
+        if (fileAccess && source.path) {
+            notices.push(video
+                ? `${source.name}: video attachments are unsupported by this runtime; the file is available at ${source.path}.`
+                : `${source.name}: read the attached file at ${source.path}.`);
+        }
+        else {
+            notices.push(`${source.name}: ${video ? 'video' : 'file'} attachments are unsupported by this runtime.`);
+        }
+    }
+    return { images, imagePaths, notice: notices.length ? `\n\nAttachments to this message:\n${notices.join('\n')}` : '' };
+}
+/** Stream-JSON runtimes use the same normalized pixels as provider APIs. */
+export function messageContentWithImages({ prompt, images }, _optional = {}) {
+    return [
+        { type: 'text', text: prompt },
+        ...images.map(image => ({ type: 'image', source: { type: 'base64', media_type: image.mimeType, data: image.data } })),
+    ];
+}
+//# sourceMappingURL=attachment-content.js.map

package/dist/delegated-tool-bridge.js

@@ -109,9 +109,19 @@ export function createDelegatedToolBridge(options) {
          * screen, with no call left to answer it.
          */
         let settled = false;
+        // A handler emits a surface mid-call because it is about to WAIT on the human (a form, a card).
+        // Nothing reaches the run's event stream while they answer, so the slow-run watchdog would read
+        // that silence as a stall and post "Still working…" over an open form — which then reappears
+        // once the form is answered. Suspended from the first surface until the call settles (the
+        // `finally` below); the watchdog re-arms then, so a genuine stall afterwards is still caught.
+        let slowRunSuspended = false;
         const emitSurface = async (emission) => {
             if (settled)
                 throw new Error(`emitSurface: tool call ${toolUseId} has already completed`);
+            if (!slowRunSuspended) {
+                slowRunSuspended = true;
+                lifecycle.suspendSlowRunNotice({ runId: runId });
+            }
             // Cast because `RunAgentPayload` is a closed union and `channel` is deliberately an open
             // string — a seam that only accepts channels this file already knows about is not a
             // channel-neutral seam. This mirrors `@jini-ai/protocol`'s own posture of typing each
@@ -202,6 +212,8 @@ export function createDelegatedToolBridge(options) {
         finally {
             unsubscribeCancel();
             invocation.signal?.removeEventListener('abort', abortFromTransport);
+            if (slowRunSuspended)
+                lifecycle.resumeSlowRunNotice({ runId: runId });
         }
     }
     return { execute };

package/dist/http/attachments.d.ts

@@ -147,7 +147,8 @@ export interface AttachmentStore {
         readonly runId: string;
     }, _optional?: Record<string, never>) => Promise<StoredAttachment | undefined>;
     /**
-     * Lists every still-unclaimed attachment registered with `ownerId` — the discovery counterpart to
+     * Lists unclaimed attachments registered with `ownerId`, plus attachments claimed by optional
+     * `runId` when supplied — the discovery counterpart to
      * `resolveForRun`'s single-lookup: a caller that does not yet hold a specific ref at all (an
      * attachment uploaded in an earlier turn, never named in this run's prompt) has no id to look up
      * with `resolveForRun` in the first place. This is what makes that attachment findable.
@@ -164,12 +165,18 @@ export interface AttachmentStore {
      *   attachment from before this method existed) is excluded from every caller's results, never
      *   just "unscoped" — this method is not callable with `ownerId: undefined`, so there is no input
      *   that could accidentally match an ownerless record;
-     * - a claimed attachment is excluded outright, whether or not this caller's own `runId` claimed
-     *   it, so this method can never be used to re-discover something already handed to a run — the
-     *   same "runs, not listings, are the reach here" boundary `resolveForRun` draws for a single ref.
+     * - a claimed attachment is excluded unless the host supplies that exact claiming `runId` in
+     *   the optional argument. Hosts must derive ownerId/runId from authenticated execution context,
+     *   never tool input. Run startup claims ALL message attachments before tools execute; including
+     *   that run's claims keeps image, video and generic file discovery available after delivery.
+     *   Owner matching remains mandatory even for the matching run. Without runId, the original
+     *   unclaimed-only behavior is unchanged. Listing never claims, releases, or reads a file; callers
+     *   still use `resolveForRun` for integrity-checked bytes/promotion.
      *
      * What this does NOT scope by: batch, conversation, or run — none of those are recorded on an
-     * `AttachmentRecord` today. Two different conversations run by the SAME `ownerId` will each see
+     * `AttachmentRecord` today (except run ownership once claimed). Hosts restricting discovery to
+     * an accepted message must also intersect these summaries with that message's refs. Without that
+     * intersection, two different conversations run by the SAME `ownerId` will each see
      * the other's pending attachments through this method. A host for whom that is too wide needs a
      * finer-grained id than `ownerId` to pass into `register()` — this method does not itself assume
      * `ownerId` means "one admin account" rather than "one conversation, one composer, one browser
@@ -184,7 +191,9 @@ export interface AttachmentStore {
      */
     listPendingForOwner: ({ ownerId }: {
         readonly ownerId: string;
-    }, _optional?: Record<string, never>) => Promise<PendingAttachmentSummary[]>;
+    }, optional?: {
+        readonly runId?: string;
+    }) => Promise<PendingAttachmentSummary[]>;
     /** Deletes the named still-unclaimed uploads, then the batch directory if it is now empty. */
     deleteUnclaimed: ({ batchId, paths }: {
         readonly batchId: string;
@@ -265,7 +274,7 @@ export interface AttachmentRecord {
     ownerId?: string;
 }
 /**
- * What `listPendingForOwner` hands back for one still-unclaimed attachment: enough for a caller to
+ * What `listPendingForOwner` hands back for an unclaimed or same-run claimed attachment: enough for a caller to
  * show a person what is waiting, and to name it again (`ref`) to `claim()`/`resolveForRun`.
  */
 export interface PendingAttachmentSummary {

package/dist/http/attachments.js

@@ -835,12 +835,13 @@ export async function createDiskAttachmentStore(requiredArgs, optionalArgs = {})
             }
             return { path: record.filePath, name: record.name, kind: record.kind, size: record.size };
         },
-        async listPendingForOwner({ ownerId }, _optional = {}) {
+        async listPendingForOwner({ ownerId }, { runId } = {}) {
             return [...records.values()]
                 // `record.ownerId !== undefined` first, short-circuiting before the comparison: this is
                 // what makes an ownerless record excluded rather than accidentally matched by a falsy-ish
                 // `ownerId` argument — see this method's own doc on why that must never be a wildcard.
-                .filter((record) => record.claimedRunId === undefined && record.ownerId !== undefined && record.ownerId === ownerId)
+                .filter((record) => record.ownerId !== undefined && record.ownerId === ownerId
+                && (record.claimedRunId === undefined || (runId !== undefined && record.claimedRunId === runId)))
                 .sort((a, b) => a.createdAt - b.createdAt)
                 .map((record) => ({ ref: record.id, name: record.name, kind: record.kind, size: record.size, createdAt: record.createdAt }));
         },

package/dist/index.d.ts

@@ -588,4 +588,5 @@ export * from './legacy-data-migration.js';
 export * from './run/index.js';
 export * from './continuation/index.js';
 export * from './routines/index.js';
+export * from './attachment-content.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -588,4 +588,5 @@ export * from './legacy-data-migration.js';
 export * from './run/index.js';
 export * from './continuation/index.js';
 export * from './routines/index.js';
+export * from './attachment-content.js';
 //# sourceMappingURL=index.js.map

package/dist/run-lifecycle.d.ts

@@ -15,7 +15,7 @@ export interface StartRunInput {
     readonly idempotencyKey?: string;
     /** Override the generated run id — test/fixture hook only. */
     readonly runId?: string;
-    /** When set, arms an inactivity watchdog that fails the run as a resumable failure if no `emit()` occurs within this window. */
+    /** When set, arms an inactivity watchdog that fails the run permanently if no `emit()` occurs within this window. */
     readonly inactivityTimeoutMs?: number;
 }
 export interface StartRunResult {
@@ -106,6 +106,7 @@ export interface RunLifecycle {
      * on a run that never actually stalled. A driver that knows exactly why a run is quiet must say so
      * rather than leaving the watchdog to guess from silence alone. No-op if `runId` is unknown,
      * already terminal, or the slow-run notice is disabled kernel-wide (`slowRunThresholdMs: null`).
+     * Pairs nest: the notice stays suspended until every open suspension has been resumed.
      */
     suspendSlowRunNotice(args: {
         readonly runId: string;

package/dist/run-lifecycle.js

@@ -102,6 +102,7 @@ function rehydratedRunRecord(runId, entries) {
             terminalEndEntry: endEntry,
             watchdog: undefined,
             slowRunWatchdog: undefined,
+            slowRunSuspensions: 0,
             startPromise: undefined,
             finishPromise: undefined,
             retentionTimer: undefined,
@@ -290,6 +291,7 @@ function buildNewRunRecord(startInput, runId, now) {
         terminalEndEntry: undefined,
         watchdog: undefined,
         slowRunWatchdog: undefined,
+        slowRunSuspensions: 0,
         startPromise: undefined,
         finishPromise: undefined,
         retentionTimer: undefined,
@@ -448,10 +450,9 @@ export function createRunLifecycle(requiredArgs, optionalArgs = {}) {
     }
     /**
      * Fires when a run's inactivity watchdog times out with no intervening
-     * `emit()`/`finish()`. Classified as a resumable failure (`code: null,
-     * signal: null`), mirroring OD's own timeout/inactivity classification
-     * (`isResumableFailure` in the researched `run-failure-classification.ts`
-     * treats timeout/inactivity as one of only two resumable categories).
+     * `emit()`/`finish()`. A deliberate watchdog kill is permanent: automatically restarting
+     * it would undo the operator's inactivity policy. Other unexpected process failures still
+     * retain their original runtime classification.
      *
      * The `!record || isTerminalRunState(...)` guard below is defensive only and is currently
      * unreachable through the public API — deliberately kept, not fake-tested, and the reason is
@@ -477,7 +478,9 @@ export function createRunLifecycle(requiredArgs, optionalArgs = {}) {
             return;
         }
         try {
-            await lifecycle.finish({ runId, status: 'failed', code: null, signal: null, resumable: true });
+            // A deliberate inactivity kill is permanent for this attempt, not an auto-resume signal.
+            await lifecycle.emit({ runId, input: { event: 'agent', data: { type: 'status', label: 'Stopped by inactivity watchdog', detail: 'inactivity-watchdog' } } });
+            await lifecycle.finish({ runId, status: 'failed', code: null, signal: null, resumable: false });
         }
         catch (error) {
             const context = { source: 'inactivity-timeout', runId, error };
@@ -748,7 +751,9 @@ export function createRunLifecycle(requiredArgs, optionalArgs = {}) {
             // freshly-started one does. Without this, `finish()`'s `record.slowRunWatchdog?.cancel()` (which
             // never fires again on its own — the underlying timer is one-shot) left the notice permanently
             // dark for the rest of a resumed run's life, silently disabling a feature the run is otherwise
-            // still eligible for.
+            // still eligible for. Suspensions left open when the run ended can never be resumed (resume is a
+            // no-op on a terminal run), so they are dropped here or they would keep the notice dark forever.
+            record.slowRunSuspensions = 0;
             armSlowRunWatchdogIfConfigured({ record: record, timeoutMs: slowRunThresholdMs, onTimeout: () => {
                     void handleSlowRunNotice(runId);
                 } });
@@ -762,12 +767,18 @@ export function createRunLifecycle(requiredArgs, optionalArgs = {}) {
             const record = runs.get(runId);
             if (!record || isTerminalRunState({ state: record.status.state }))
                 return;
+            record.slowRunSuspensions += 1;
             record.slowRunWatchdog?.cancel({});
         },
         resumeSlowRunNotice({ runId }) {
             const record = runs.get(runId);
             if (!record || isTerminalRunState({ state: record.status.state }))
                 return;
+            // Re-arm only when the LAST open suspension closes (see `RunRecord.slowRunSuspensions`).
+            if (record.slowRunSuspensions > 0)
+                record.slowRunSuspensions -= 1;
+            if (record.slowRunSuspensions > 0)
+                return;
             // Suspension cancels permanently. Resuming must create a new window, never revive that handle.
             record.slowRunWatchdog?.cancel({});
             armSlowRunWatchdogIfConfigured({ record, timeoutMs: slowRunThresholdMs, onTimeout: () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/daemon",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "description": "The stateful agent daemon runtime: run lifecycle, durable event-log port, the tool-execution boundary, agent executor, terminal sessions, and routines.",
   "license": "Apache-2.0",
   "repository": {
@@ -116,10 +116,10 @@
     "registry": "https://registry.npmjs.org"
   },
   "dependencies": {
-    "@jini-ai/agent-runtime": "^0.4.0",
-    "@jini-ai/core": "^0.4.1",
-    "@jini-ai/protocol": "^0.4.0",
-    "@jini-ai/platform": "^0.5.1"
+    "@jini-ai/protocol": "^0.4.1",
+    "@jini-ai/agent-runtime": "^0.4.1",
+    "@jini-ai/platform": "^0.5.1",
+    "@jini-ai/core": "^0.4.1"
   },
   "devDependencies": {
     "@vitest/coverage-v8": "^2.1.9",
@@ -132,9 +132,9 @@
     "@types/pg": "8.23.1",
     "express": "^4.21.0",
     "@types/express": "^4.17.21",
-    "@jini-ai/chat": "0.5.2",
     "@jini-ai/http-kit": "0.4.0",
-    "@jini-ai/db": "0.3.0"
+    "@jini-ai/db": "0.3.0",
+    "@jini-ai/chat": "0.5.4"
   },
   "peerDependencies": {
     "node-pty": "^1.1.0",