@jini-ai/daemon 0.5.4 → 0.6.0

package/dist/agent-executor/contracts.d.ts

@@ -194,7 +194,27 @@ export interface AgentExecutor {
      * `lifecycle.finish()` before this rejects (see index.ts module doc's Invariant).
      */
     run(requiredArgs: Pick<AgentExecutorRunInput, "runId" | "agentId" | "prompt" | "cwd">, optionalArgs?: Pick<AgentExecutorRunInput, "model" | "reasoning" | "permissionMode" | "imagePaths" | "imageContents" | "extraAllowedDirs" | "uploadRoot" | "credentialEnv" | "env" | "resumeSessionId" | "newSessionId" | "disallowedTools" | "allowedTools" | "settingSources" | "settings">): Promise<void>;
+    /**
+     * Delivers a message the human sent while `runId` is going straight into its live agent process
+     * (see {@link UserMessageDelivery} for each outcome). A stream-json agent is interrupted first and
+     * gets the message once the CLI acknowledges the interrupt, so this settles in milliseconds (at
+     * most `INTERRUPT_ACK_TIMEOUT_MS`); it never waits on the agent's reply.
+     */
+    sendUserMessage(requiredArgs: {
+        readonly runId: string;
+        readonly text: string;
+    }): Promise<UserMessageDelivery>;
 }
+/**
+ * What {@link AgentExecutor.sendUserMessage} did with a mid-run message:
+ * - `'delivered'` — the running turn was interrupted and the message written into the live
+ *   session; the agent answers it next, in the same process and session.
+ * - `'unsupported'` — the run is live, but its agent has no way to take input mid-run (its prompt
+ *   is plain text or an RPC request). The host should interrupt and send it as the next turn.
+ * - `'not-running'` — no live process will accept it: an unknown run, a finished one, or one whose
+ *   last turn already ended and closed stdin. The run is ending; the host should send it next.
+ */
+export type UserMessageDelivery = 'delivered' | 'unsupported' | 'not-running';
 /** Process discovery is a getter; process collection and stopping accept explicit host inputs. */
 export type CollectProcessTreePidsPort = (args: {
     readonly processes: ProcessSnapshot[];
@@ -212,11 +232,11 @@ export interface TerminateChildTreeDeps {
  * Which step reported a contained failure through `onCleanupFailure` (SEC-007).
  *
  * The first three come from {@link terminateChildTreeBestEffort} (process-tree teardown). The last
- * two are the two fallible steps that sit between a child's `'close'` and `finish()` — staged-file
- * removal and the host's own `classifyFailure` — neither of which may prevent the terminal
- * transition, and neither of which may fail silently either. See each close handler.
+ * three cover tool cancellation, staged-file removal and the host's own `classifyFailure`.
+ * These fallible steps between a child's `'close'` and `finish()` must never prevent the terminal
+ * transition, and none may fail silently either. See each close handler.
  */
-export type AgentCleanupFailurePhase = 'cancel' | 'acp-attach-failure' | 'pi-rpc-attach-failure' | 'staged-file-cleanup' | 'failure-classification';
+export type AgentCleanupFailurePhase = 'cancel' | 'acp-attach-failure' | 'pi-rpc-attach-failure' | 'tool-cancellation' | 'staged-file-cleanup' | 'failure-classification';
 export interface AgentCleanupFailureContext {
     readonly runId: string;
     readonly phase: AgentCleanupFailurePhase;
@@ -237,6 +257,8 @@ export interface StdinCloseHandle {
     closeStdinOnce(): void;
     /** Journals a sent-to-stdin byte chunk, queued through the same FIFO {@link wireChildLifecycle} already uses for emitted events. No-op when no journal was configured (see `CreateAgentExecutorOptions.journal`). */
     recordSentBytes(content: string): void;
+    /** Interrupts this child's turn, then writes a mid-run user message into its open stdin — see {@link AgentExecutor.sendUserMessage}. */
+    sendUserMessage(text: string): Promise<UserMessageDelivery>;
 }
 /**
  * Gap 3 (capability-routed continuation transport) — host-owned config for the
@@ -374,6 +396,13 @@ export interface McpJsonInjectionOptions {
     readonly removeDir?: ({ path }: {
         readonly path: string;
     }) => Promise<void>;
+    /** `'codex-toml'` only. Links the run home's sessions/archived_sessions to the operator's
+     * persistent rollout store. Config and auth remain isolated and are removed after the run.
+     * @default Native mkdir (0700) and directory symlinks; errors fail staging before spawn. */
+    readonly linkSessionStore?: (required: {
+        runHome: string;
+        sourceHome: string;
+    }, optional?: {}) => Promise<void>;
 }
 /** One `.mcp.json` `mcpServers` entry — the shape Claude Code's own config schema expects. */
 export interface McpJsonServerEntry {

package/dist/agent-executor/events.d.ts

@@ -118,6 +118,21 @@ interface WireChildLifecycleContext extends TerminateChildTreeDeps {
  * @overallScore 100/100
  */
 export declare function wireChildLifecycle(ctx: WireChildLifecycleContext): StdinCloseHandle;
+/**
+ * Whether a def's live process can take another user message mid-run: only a stream-json stdin
+ * transport keeps stdin open for more JSONL user lines (see `RuntimeAgentDef.promptInputFormat`).
+ * Deliberately not `resolveContinuationTransport`: that answers how a tool result gets back, and
+ * reports `'mcp-callback'` for Claude even though its stdin takes user lines all the same.
+ */
+export declare function acceptsMidRunUserMessages({ def }: {
+    readonly def: RuntimeAgentDef;
+}): boolean;
+/**
+ * How long a mid-run message waits for the CLI to acknowledge its interrupt before being written
+ * anyway. Claude Code acks within milliseconds (it answers before the aborted turn's own result);
+ * the ceiling only bounds an agent that ignores control requests.
+ */
+export declare const INTERRUPT_ACK_TIMEOUT_MS = 5000;
 /**
  * Writes the initial user turn to the child's stdin per `def.promptInputFormat`
  * (both branches only run for `promptViaStdin: true` defs — the only shape
@@ -125,8 +140,8 @@ export declare function wireChildLifecycle(ctx: WireChildLifecycleContext): Stdi
  * - `'text'` (default): the raw prompt buffer, then stdin is closed —
  *   matches `RuntimeAgentDef.promptInputFormat`'s own doc.
  * - `'stream-json'`: one JSONL line wrapping the prompt as an Anthropic
- *   user message; stdin is deliberately left open (a real multi-turn
- *   caller would inject further messages) — v1 has no such caller, so
+ *   user message; stdin is deliberately left open so a message the human
+ *   sends mid-run can follow it (`StdinCloseHandle.sendUserMessage`), and
  *   {@link wireChildLifecycle}'s `turn_end` handling closes it once the
  *   agent's own stream reports the turn ended.
  * @param def - The resolved agent def (only `.promptInputFormat` is read).

package/dist/agent-executor/events.js

@@ -1,3 +1,4 @@
+import { randomUUID } from 'node:crypto';
 import { createModelReceiptTracker } from './model-receipts.js';
 import { messageContentWithImages } from '../attachment-content.js';
 import { redactSecrets, } from '@jini-ai/core';
@@ -8,7 +9,7 @@ import { resolveContinuationTransport, } from '../continuation/continuation-tran
 import { resultContent, } from '../delegated-tool-bridge.js';
 import { extractResultMedia, } from '../tool-result-media.js';
 import { translateAgentRuntimeEvent, translateAcpError, applyAgentTranslationSideEffects, } from './event-translation.js';
-import { errorMessage, } from './values.js';
+import { errorMessage, isRecord, } from './values.js';
 import { MCP_BRIDGE_UNAVAILABLE, unavailableJiniBridgeStatus, bridgeUnavailableMessage, } from './mcp-bridge.js';
 /** Carry PID only on structured status so the host can record its OS start identity early.
  * A PID alone is never proof of death; hosts verify PID reuse before native continuation. */
@@ -68,7 +69,7 @@ export function defaultCleanupFailureSink(context) {
 /**
  * Reports a contained post-close failure through the host's sink, absorbing a throwing sink.
  *
- * A diagnostic sink is host code too, and the whole point of the two callers below is that nothing
+ * A diagnostic sink is host code too, and the whole point of these callers is that nothing
  * between `'close'` and `finish()` can strand the run — a sink that throws must not reintroduce
  * exactly that. Same reasoning `run-lifecycle.ts`'s `handleInactivityTimeout` already applies to its
  * own `onInternalError`.
@@ -273,6 +274,37 @@ export function wireChildLifecycle(ctx) {
     // consumed by a turn-end injection decision. See `ContinuationOptions`'s doc for why this is
     // only ever acted on when a host has explicitly allowlisted the tool's name.
     let pendingToolUse;
+    // Observe the canonical lifecycle, including delegated calls that bypass the CLI parser.
+    // A single latest tool_use cannot represent parallel tools at an interrupt boundary.
+    const unresolvedToolCalls = new Set();
+    const interruptedToolCalls = new Set();
+    const toolSubscription = lifecycle.stream({ runId, onEvent: (event) => {
+            if (event.kind !== 'agent')
+                return;
+            if (event.payload.type === 'tool_use')
+                unresolvedToolCalls.add(event.payload.id);
+            if (event.payload.type === 'tool_result')
+                unresolvedToolCalls.delete(event.payload.toolUseId);
+        } }).catch(error => {
+        // Observing tools is fallible I/O too: report it, but never strand close/finish on a replay
+        // failure or leave an unhandled rejection while the child is still running.
+        reportPostCloseFailure(ctx.onCleanupFailure, { runId, phase: 'tool-cancellation', pid: child.pid, error });
+        return null;
+    });
+    /** Run on the same FIFO as parsed results, after the aborted segment has drained.
+     * O(t) in unresolved calls; completed results are never replaced with cancellation. */
+    async function cancelUnresolvedToolCalls(ids) {
+        await toolSubscription;
+        for (const toolUseId of ids ?? [...unresolvedToolCalls]) {
+            if (!unresolvedToolCalls.has(toolUseId))
+                continue;
+            await lifecycle.emit({ runId, input: { event: 'agent', data: {
+                        type: 'tool_result', toolUseId, content: 'Tool execution cancelled.', isError: true,
+                    } } }).catch(error => {
+                reportPostCloseFailure(ctx.onCleanupFailure, { runId, phase: 'tool-cancellation', pid: child.pid, error });
+            });
+        }
+    }
     // Bridge guard (see `expectsJiniBridge`): checked on the first init frame only. Once the bridge is
     // found unavailable, the child is being stopped and nothing it still prints is forwarded.
     let bridgeChecked = !ctx.expectsJiniBridge;
@@ -311,6 +343,35 @@ export function wireChildLifecycle(ctx) {
         stdinClosed = true;
         child.stdin?.end();
     }
+    // Mid-run interrupts (see `sendUserMessage` below): each sent `interrupt` control request waits
+    // here, by request id, for the CLI's `control_response`. Settled with `true` on the ack, `false`
+    // when the process exits first. Bounded by the mid-run messages in flight on this one run.
+    const pendingInterruptAcks = new Map();
+    // Set once this run has interrupted its agent: from then on a turn the interrupt aborted
+    // (`aborted_*` stop reason) is not the run's last — the message that follows starts a new one.
+    let interruptSent = false;
+    // stdout carry-over for spotting acks; only filled while an interrupt waits for one.
+    let ackScanBuffer = '';
+    /** Resolves every waiting interrupt whose `control_response` is in this stdout chunk. @complexity O(chunk length). */
+    function scanForInterruptAcks(text) {
+        if (pendingInterruptAcks.size === 0)
+            return;
+        ackScanBuffer += text;
+        const lines = ackScanBuffer.split('\n');
+        ackScanBuffer = lines.pop() ?? '';
+        for (const line of lines) {
+            if (!line.includes('"control_response"'))
+                continue;
+            const requestId = controlResponseRequestId({ line: line });
+            const settle = requestId === undefined ? undefined : pendingInterruptAcks.get(requestId);
+            if (!settle)
+                continue;
+            pendingInterruptAcks.delete(requestId);
+            settle(true);
+        }
+        if (pendingInterruptAcks.size === 0)
+            ackScanBuffer = '';
+    }
     /**
      * Writes a structured (never string-concatenated — see `ContinuationOptions`'s doc on the
      * prompt-injection stakes here) tool_result JSONL line, mirroring the shape
@@ -330,6 +391,21 @@ export function wireChildLifecycle(ctx) {
         if (journal)
             enqueueEmit(() => journal.record({ runId: runId, entry: sentJournalEntry(content) }));
     }
+    /**
+     * Whether a `turn_end` leaves stdin open for a live agent that takes mid-run messages, because
+     * the run is not over: a `tool_use` stop (the CLI runs the tool itself and carries on, and a
+     * message sent while the tool runs must still reach it), any end while an interrupt still waits
+     * for its ack (the message is about to be written), and the end of a turn an interrupt aborted
+     * (the message written after it starts the next turn). Every other end closes stdin, so the CLI
+     * exits once it has answered everything written before EOF.
+     */
+    function keepsStdinOpenAfterTurnEnd(stopReason) {
+        if (!acceptsMidRunUserMessages({ def: def }))
+            return false;
+        if (stopReason === 'tool_use' || pendingInterruptAcks.size > 0)
+            return true;
+        return interruptSent && stopReason !== undefined && stopReason.startsWith('aborted');
+    }
     /**
      * Decides, per `turn_end`, whether to auto-resolve a pending tool_use through the injected
      * `ToolExecutor` and keep stdin open (gap 3), or close stdin exactly as every version of this
@@ -337,6 +413,11 @@ export function wireChildLifecycle(ctx) {
      * unconfigured or the pending tool isn't allowlisted).
      */
     function handleTurnEnd(stopReason) {
+        if (stopReason?.startsWith('aborted'))
+            enqueueEmit(async () => {
+                await cancelUnresolvedToolCalls([...interruptedToolCalls]);
+                interruptedToolCalls.clear();
+            });
         const toolUse = pendingToolUse;
         const shouldInject = stopReason === 'tool_use' &&
             toolUse !== undefined &&
@@ -344,7 +425,8 @@ export function wireChildLifecycle(ctx) {
             resolveContinuationTransport({ def: def }) === 'stdin-injection' &&
             continuation.autonomousToolNames.has(toolUse.name);
         if (!shouldInject) {
-            closeStdinOnce();
+            if (!keepsStdinOpenAfterTurnEnd(stopReason))
+                closeStdinOnce();
             return;
         }
         pendingToolUse = undefined;
@@ -497,6 +579,9 @@ export function wireChildLifecycle(ctx) {
             return;
         }
         enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'stdout', data: { chunk: text } } }));
+        // Before the parser: an ack and the aborted turn's end can share a chunk, and the turn end must
+        // see that no interrupt is still waiting (see `keepsStdinOpenAfterTurnEnd`).
+        scanForInterruptAcks(text);
         // Non-null: `streamHandler` is only ever null when `streamFormat === 'plain'` (see its
         // construction above), the branch this statement is provably unreachable from.
         streamHandler.feed({ chunk: text });
@@ -522,6 +607,9 @@ export function wireChildLifecycle(ctx) {
             void terminateChildTreeBestEffort(ctx, child, runId, 'cancel', ctx.onCleanupFailure);
         } });
     child.on('close', (code, signal) => {
+        for (const settle of pendingInterruptAcks.values())
+            settle(false);
+        pendingInterruptAcks.clear();
         void (async () => {
             // Not wrapped in try/catch: all 4 supported parser factories'
             // flush() implementations already internally guard their own
@@ -536,6 +624,11 @@ export function wireChildLifecycle(ctx) {
             // `finish()`'s `'end'` event, exactly like every live-path emit already is.
             flushBufferedStdout();
             await emitQueue;
+            if (cancelRequested)
+                await cancelUnresolvedToolCalls();
+            const subscribedTools = await toolSubscription;
+            if (subscribedTools?.kind === 'ok')
+                subscribedTools.unsubscribe();
             unsubscribeCancel();
             // Both of the next two steps are guarded: neither a failed cleanup nor a rejecting host
             // classifier may prevent the terminal transition below — see each helper's own doc.
@@ -554,14 +647,92 @@ export function wireChildLifecycle(ctx) {
             await lifecycle.finish({ runId, status, code, signal: signal ?? null, resumable }, { ...(capturedSessionId !== undefined ? { sessionRef: capturedSessionId } : {}) });
         })();
     });
+    /**
+     * A mid-run message: first an `interrupt` control request on the still-open stdin, so the agent
+     * stops generating (or abandons the tool it is running) at once instead of finishing its whole
+     * reply; then, once the CLI acknowledges, the message as the next user line, which the CLI
+     * answers straight away in the same session; then the run's own `user_message` event through the
+     * same FIFO as the agent's output, so the message sits in the stream where it took effect.
+     * An ack that never comes (an agent that ignores control requests) only delays the write by
+     * {@link INTERRUPT_ACK_TIMEOUT_MS}: the CLI then folds the line in at its next step. Once
+     * `turn_end` has closed stdin, or the process exits before the ack, there is no session left to
+     * reach — `'not-running'`.
+     */
+    async function sendUserMessage(text) {
+        if (!acceptsMidRunUserMessages({ def: def }))
+            return 'unsupported';
+        const stdin = child.stdin;
+        if (stdinClosed || !stdin)
+            return 'not-running';
+        const requestId = `jini-interrupt-${randomUUID()}`;
+        interruptSent = true;
+        // Capture before requesting the interrupt. Its result can precede the acknowledgement, or
+        // arrive after the next segment starts: neither ordering may cancel that segment's new tools.
+        enqueueEmit(async () => {
+            await toolSubscription;
+            for (const id of interruptedToolCalls)
+                if (!unresolvedToolCalls.has(id))
+                    interruptedToolCalls.delete(id);
+            for (const id of unresolvedToolCalls)
+                interruptedToolCalls.add(id);
+        });
+        const acked = new Promise((resolve) => pendingInterruptAcks.set(requestId, resolve));
+        stdin.write(`${JSON.stringify({ type: 'control_request', request_id: requestId, request: { subtype: 'interrupt' } })}\n`, 'utf8');
+        let timer;
+        const timedOut = new Promise((resolve) => {
+            timer = setTimeout(() => resolve(true), INTERRUPT_ACK_TIMEOUT_MS);
+        });
+        const processAlive = await Promise.race([acked, timedOut]);
+        clearTimeout(timer);
+        pendingInterruptAcks.delete(requestId);
+        if (!processAlive || stdinClosed)
+            return 'not-running';
+        stdin.write(`${JSON.stringify(streamJsonUserMessage({ content: [{ type: 'text', text: text }] }))}\n`, 'utf8');
+        if (journal)
+            enqueueEmit(() => journal.record({ runId: runId, entry: sentJournalEntry(text) }));
+        enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'agent', data: { type: 'user_message', id: randomUUID(), text: text } } }));
+        return 'delivered';
+    }
     return {
         closeStdinOnce,
         recordSentBytes(content) {
             if (journal)
                 enqueueEmit(() => journal.record({ runId: runId, entry: sentJournalEntry(content) }));
         },
+        sendUserMessage,
     };
 }
+/**
+ * Whether a def's live process can take another user message mid-run: only a stream-json stdin
+ * transport keeps stdin open for more JSONL user lines (see `RuntimeAgentDef.promptInputFormat`).
+ * Deliberately not `resolveContinuationTransport`: that answers how a tool result gets back, and
+ * reports `'mcp-callback'` for Claude even though its stdin takes user lines all the same.
+ */
+export function acceptsMidRunUserMessages({ def }) {
+    return def.promptViaStdin === true && def.promptInputFormat === 'stream-json';
+}
+/**
+ * How long a mid-run message waits for the CLI to acknowledge its interrupt before being written
+ * anyway. Claude Code acks within milliseconds (it answers before the aborted turn's own result);
+ * the ceiling only bounds an agent that ignores control requests.
+ */
+export const INTERRUPT_ACK_TIMEOUT_MS = 5_000;
+/** The `request_id` of a stream-json `control_response` line, or `undefined` for anything else. */
+function controlResponseRequestId({ line }) {
+    try {
+        const parsed = JSON.parse(line);
+        if (!isRecord(parsed) || parsed.type !== 'control_response' || !isRecord(parsed.response))
+            return undefined;
+        return typeof parsed.response.request_id === 'string' ? parsed.response.request_id : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The stream-json stdin envelope for one user message — the initial prompt and every mid-run one. */
+function streamJsonUserMessage({ content }) {
+    return { type: 'user', message: { role: 'user', content: content } };
+}
 /**
  * Wires an ACP child to a run. Unlike the JSON-stream path, ACP owns the
  * prompt protocol and reports its parsed events through `attachAcpSession`'s
@@ -773,8 +944,8 @@ function wirePiRpcLifecycle(ctx) {
  * - `'text'` (default): the raw prompt buffer, then stdin is closed —
  *   matches `RuntimeAgentDef.promptInputFormat`'s own doc.
  * - `'stream-json'`: one JSONL line wrapping the prompt as an Anthropic
- *   user message; stdin is deliberately left open (a real multi-turn
- *   caller would inject further messages) — v1 has no such caller, so
+ *   user message; stdin is deliberately left open so a message the human
+ *   sends mid-run can follow it (`StdinCloseHandle.sendUserMessage`), and
  *   {@link wireChildLifecycle}'s `turn_end` handling closes it once the
  *   agent's own stream reports the turn ended.
  * @param def - The resolved agent def (only `.promptInputFormat` is read).
@@ -789,7 +960,7 @@ export function writePromptToStdin(def, child, prompt, handle) {
     if (!stdin)
         return;
     if (def.promptInputFormat === 'stream-json') {
-        const line = JSON.stringify({ type: 'user', message: { role: 'user', content: messageContentWithImages({ prompt, images: handle.imageContents ?? [] }, {}) } });
+        const line = JSON.stringify(streamJsonUserMessage({ content: messageContentWithImages({ prompt, images: handle.imageContents ?? [] }, {}) }));
         stdin.write(`${line}\n`, 'utf8');
         handle.recordSentBytes(prompt);
         return;

package/dist/agent-executor/index.d.ts

@@ -89,7 +89,7 @@
  * a second, independently-built (and rejected) classifier that once lived in
  * this module.
  */
-export { type SupportedStreamFormat, type AgentExecutorCompatibility, type AgentRuntimeEventTranslation, type AgentExecutorErrorCode, AgentExecutorError, type AgentExecutorRunInput, type AgentExecutor, type CollectProcessTreePidsPort, type StopProcessesPort, type AgentCleanupFailurePhase, type AgentCleanupFailureContext, type ContinuationOptions, type McpJsonInjectionOptions, type McpBridgeDelivery, type PreparedCodexHome, type PreparedClaudeConfigDir, type ClaudeConfigDirSeams, type ClaudeConfigDirIsolationOptions, type FailureClassificationContext, type ClassifyFailure, type CreateAgentExecutorOptions, type SystemPromptOverlayDelivery, type PreparedSystemPromptOverlayFile, type SpawnAgentChildProcessResult, } from './contracts.js';
+export { type SupportedStreamFormat, type AgentExecutorCompatibility, type AgentRuntimeEventTranslation, type AgentExecutorErrorCode, AgentExecutorError, type AgentExecutorRunInput, type AgentExecutor, type UserMessageDelivery, type CollectProcessTreePidsPort, type StopProcessesPort, type AgentCleanupFailurePhase, type AgentCleanupFailureContext, type ContinuationOptions, type McpJsonInjectionOptions, type McpBridgeDelivery, type PreparedCodexHome, type PreparedClaudeConfigDir, type ClaudeConfigDirSeams, type ClaudeConfigDirIsolationOptions, type FailureClassificationContext, type ClassifyFailure, type CreateAgentExecutorOptions, type SystemPromptOverlayDelivery, type PreparedSystemPromptOverlayFile, type SpawnAgentChildProcessResult, } from './contracts.js';
 export { isSupportedStreamFormat, assessAgentExecutorCompatibility, isAgentExecutorSupported, resolveDefAndStreamFormat, resolveImageDeliveryAndArgvBudget, resolveRunEnv, resolveLaunch, stagePromptFile, stageLogFile, computeChildEnv, computeRuntimeContext, buildAgentBuildArgsOptions, resolveSystemPromptOverlayDelivery, buildRunArgs, prepareSystemPromptOverlayFileIfNeeded, guardWindowsCommandLineBudget, spawnAgentChildProcess, isStdinDrivenFormat, confirmChildSpawned, createAgentExecutor, } from './launch.js';
 export { extractUsageTokens, translateStatusEvent, translateToolResultEvent, translateErrorEvent, translateTurnEndEvent, translateAgentRuntimeEvent, applyAgentTranslationSideEffects, } from './event-translation.js';
 export { MCP_BRIDGE_UNAVAILABLE, unavailableJiniBridgeStatus, buildMcpJsonServerEntry, mergeMcpJsonContent, buildAcpMcpBridgeServers, mergeEnvContentMcpConfig, mergeEnvContentInstructions, buildCodexMcpServerToml, buildCodexHomeConfigToml, resolveSourceCodexHomeDir, buildMcpBridgeDelivery, resolveSourceClaudeConfigDir, resolveMcpBridgeForRun, writeMcpJsonIfNeeded, prepareCodexHomeIfNeeded, prepareClaudeConfigDirIfNeeded, } from './mcp-bridge.js';

package/dist/agent-executor/launch.js

@@ -640,6 +640,18 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         await lifecycle.finish({ runId, status: 'failed', code: null, signal: null, resumable: false });
         throw new AgentExecutorError({ code: code, message: message });
     }
+    /**
+     * Every run with a live child, keyed by run id, mapped to how a mid-run message reaches it — the
+     * stdin handle's `sendUserMessage` for a stdin-driven run, a constant `'unsupported'` for an
+     * ACP/pi run (whose RPC takes one prompt per turn). Removed on the child's `'close'`, so a
+     * finished or unknown run reads as `'not-running'`. Bounded by the number of live children.
+     */
+    const liveRunInputs = new Map();
+    /** `AgentExecutor.sendUserMessage()` — see that interface method's own doc. @complexity O(1). */
+    async function sendUserMessage({ runId, text }) {
+        const deliver = liveRunInputs.get(runId);
+        return deliver ? deliver(text) : 'not-running';
+    }
     /**
      * `AgentExecutor.run()` — see that interface method's own doc for the
      * public contract. Implementation note on shape: every guard below
@@ -934,7 +946,18 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
                 expectsJiniBridge: writtenMcpJsonPath !== undefined,
             })
             : null;
-        await confirmChildSpawned({ input: { runId: input.runId, def, child }, deps: { releaseStagedResources, failBeforeSpawn } });
+        // Registered with the lifecycle wiring above, before the spawn-confirmation await, so a child
+        // that closes immediately never leaves a stale entry behind.
+        const runId = input.runId;
+        liveRunInputs.set(runId, stdinHandle ? stdinHandle.sendUserMessage : async () => 'unsupported');
+        child.once('close', () => liveRunInputs.delete(runId));
+        try {
+            await confirmChildSpawned({ input: { runId: input.runId, def, child }, deps: { releaseStagedResources, failBeforeSpawn } });
+        }
+        catch (error) {
+            liveRunInputs.delete(runId);
+            throw error;
+        }
         // Now — and only now — is there a live process that could consume the locked side effect, so
         // this is where a def's handoff watcher starts. Deliberately not awaited: the whole point is to
         // release the lock as soon as the child confirms the handoff, in parallel with this run
@@ -1019,6 +1042,6 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
             stdinHandle.imageContents = input.imageContents;
         writePromptToStdin(def, child, stdinPrompt, stdinHandle);
     }
-    return { run };
+    return { run, sendUserMessage };
 }
 //# sourceMappingURL=launch.js.map

package/dist/agent-executor/mcp-bridge.js

@@ -1,6 +1,6 @@
 import { promises as fsPromises, } from 'node:fs';
 import { homedir, tmpdir, } from 'node:os';
-import { join, } from 'node:path';
+import { join, resolve, } from 'node:path';
 import { isRecord, errorMessage, } from './values.js';
 const JINI_MCP_SERVER_KEY = 'jini';
 /** The run-error code a run gets when its CLI reports the injected `jini` bridge as anything but connected. */
@@ -552,12 +552,23 @@ function defaultMkdtempCodexHome({ prefix }) {
 function defaultRemoveCodexHomeDir({ path }) {
     return fsPromises.rm(path, { recursive: true, force: true });
 }
+/** Config credentials stay run-scoped, but rollouts must survive both completion and cancellation.
+ * Native directory links keep Codex as the sole writer of its own persisted session format.
+ * Cleanup removes the links themselves, never their targets. Two fixed directories, O(1) I/O. */
+async function defaultLinkCodexSessionStore({ runHome, sourceHome }, _optional = {}) {
+    for (const name of ['sessions', 'archived_sessions']) {
+        const target = resolve(sourceHome, name);
+        await fsPromises.mkdir(target, { recursive: true, mode: 0o700 });
+        await fsPromises.symlink(target, join(runHome, name), 'junction');
+    }
+}
 function resolveCodexHomeSeams(options) {
     return {
         mkdtemp: options.mkdtemp ?? defaultMkdtempCodexHome,
         readFile: options.readFile ?? defaultReadMcpJsonFile,
         writeFile: options.writeFile ?? defaultWriteMcpJsonFile,
         removeDir: options.removeDir ?? defaultRemoveCodexHomeDir,
+        linkSessionStore: options.linkSessionStore ?? defaultLinkCodexSessionStore,
     };
 }
 /**
@@ -573,8 +584,9 @@ function resolveCodexHomeSeams(options) {
  *     0.151.0) to fail fast with a structured `401 Unauthorized` stream event, never an interactive
  *     login prompt or a hang — see `defs/codex.ts`'s module doc for the full transcript summary.
  *
- * **Never touches the real `CODEX_HOME`.** `sourceCodexHomeDir` is read-only throughout; nothing is
- * ever written back to it.
+ * **Never changes the real config or credentials.** Those source files stay read-only. Only the
+ * native rollout directories are shared: deleting a run's scratch home must not erase the thread
+ * whose id the host already persisted. No copied login or run-bound MCP credential is retained.
  *
  * A failure after the directory is created (a rejecting `writeFile`, most plausibly) does not leak
  * it: the directory may already hold a partial `config.toml` or a copied credential, so the
@@ -584,9 +596,9 @@ function resolveCodexHomeSeams(options) {
  * `@jini-ai/agent-runtime`'s `prepareAgentLogFile`'s `label` is.
  * @param entry - The shared bridge entry.
  * @param sourceCodexHomeDir - Where to read the real install's `config.toml`/`auth.json` from — see {@link resolveSourceCodexHomeDir}.
- * @param seams - Injectable mkdtemp/readFile/writeFile/removeDir, real filesystem by default.
- * @throws Whatever `mkdtemp`/`writeFile` rejects with — the caller ({@link prepareCodexHomeIfNeeded}) turns that into a pre-spawn `AGENT_SPAWN_FAILED` failure, matching {@link writeMcpJsonForRun}'s own contract.
- * @complexity O(1) plus one directory creation and up to two best-effort file read/write round trips.
+ * @param seams - Injectable mkdtemp/readFile/writeFile/removeDir/linkSessionStore, real filesystem by default.
+ * @throws Whatever staging rejects with — the caller ({@link prepareCodexHomeIfNeeded}) turns that into a pre-spawn `AGENT_SPAWN_FAILED` failure, matching {@link writeMcpJsonForRun}'s own contract.
+ * @complexity O(1): fixed directory links and up to two best-effort file read/write round trips.
  * @overallScore 100/100
  */
 async function prepareCodexHomeForRun(runId, entry, sourceCodexHomeDir, seams) {
@@ -616,6 +628,7 @@ async function prepareCodexHomeForRun(runId, entry, sourceCodexHomeDir, seams) {
             // No stored login (or unreadable) — the spawned CLI runs unauthenticated. Confirmed above:
             // this fails the run fast and observably, never as a hang.
         }
+        await seams.linkSessionStore({ runHome: dir, sourceHome: sourceCodexHomeDir }, {});
     }
     catch (err) {
         await seams.removeDir({ path: dir }).catch(() => {

package/dist/agent-executor.d.ts

@@ -6,5 +6,5 @@
  * wrappers or a second implementation would let tested and shipped behavior drift.
  * See agent-executor/index.ts for the driver contracts and invariants.
  */
-export { type SupportedStreamFormat, isSupportedStreamFormat, type AgentExecutorCompatibility, assessAgentExecutorCompatibility, isAgentExecutorSupported, type AgentRuntimeEventTranslation, extractUsageTokens, translateStatusEvent, translateToolResultEvent, translateErrorEvent, translateTurnEndEvent, translateAgentRuntimeEvent, type AgentExecutorErrorCode, AgentExecutorError, type AgentExecutorRunInput, type AgentExecutor, type CollectProcessTreePidsPort, type StopProcessesPort, type AgentCleanupFailurePhase, type AgentCleanupFailureContext, type ContinuationOptions, type McpJsonInjectionOptions, MCP_BRIDGE_UNAVAILABLE, unavailableJiniBridgeStatus, buildMcpJsonServerEntry, mergeMcpJsonContent, buildAcpMcpBridgeServers, mergeEnvContentMcpConfig, mergeEnvContentInstructions, buildCodexMcpServerToml, buildCodexHomeConfigToml, resolveSourceCodexHomeDir, type McpBridgeDelivery, buildMcpBridgeDelivery, type PreparedCodexHome, type PreparedClaudeConfigDir, type ClaudeConfigDirSeams, type ClaudeConfigDirIsolationOptions, resolveSourceClaudeConfigDir, type FailureClassificationContext, type ClassifyFailure, DEFAULT_BUFFERED_STDOUT_MAX_BYTES, applyAgentTranslationSideEffects, type CreateAgentExecutorOptions, resolveDefAndStreamFormat, resolveImageDeliveryAndArgvBudget, resolveRunEnv, resolveLaunch, stagePromptFile, stageLogFile, resolveMcpBridgeForRun, computeChildEnv, computeRuntimeContext, buildAgentBuildArgsOptions, type SystemPromptOverlayDelivery, resolveSystemPromptOverlayDelivery, buildRunArgs, writeMcpJsonIfNeeded, type PreparedSystemPromptOverlayFile, prepareSystemPromptOverlayFileIfNeeded, prepareCodexHomeIfNeeded, prepareClaudeConfigDirIfNeeded, guardWindowsCommandLineBudget, type SpawnAgentChildProcessResult, spawnAgentChildProcess, isStdinDrivenFormat, confirmChildSpawned, armHandoffWatcher, runAcpDispatch, runPiRpcDispatch, createAgentExecutor, } from './agent-executor/index.js';
+export { type SupportedStreamFormat, isSupportedStreamFormat, type AgentExecutorCompatibility, assessAgentExecutorCompatibility, isAgentExecutorSupported, type AgentRuntimeEventTranslation, extractUsageTokens, translateStatusEvent, translateToolResultEvent, translateErrorEvent, translateTurnEndEvent, translateAgentRuntimeEvent, type AgentExecutorErrorCode, AgentExecutorError, type AgentExecutorRunInput, type AgentExecutor, type UserMessageDelivery, type CollectProcessTreePidsPort, type StopProcessesPort, type AgentCleanupFailurePhase, type AgentCleanupFailureContext, type ContinuationOptions, type McpJsonInjectionOptions, MCP_BRIDGE_UNAVAILABLE, unavailableJiniBridgeStatus, buildMcpJsonServerEntry, mergeMcpJsonContent, buildAcpMcpBridgeServers, mergeEnvContentMcpConfig, mergeEnvContentInstructions, buildCodexMcpServerToml, buildCodexHomeConfigToml, resolveSourceCodexHomeDir, type McpBridgeDelivery, buildMcpBridgeDelivery, type PreparedCodexHome, type PreparedClaudeConfigDir, type ClaudeConfigDirSeams, type ClaudeConfigDirIsolationOptions, resolveSourceClaudeConfigDir, type FailureClassificationContext, type ClassifyFailure, DEFAULT_BUFFERED_STDOUT_MAX_BYTES, applyAgentTranslationSideEffects, type CreateAgentExecutorOptions, resolveDefAndStreamFormat, resolveImageDeliveryAndArgvBudget, resolveRunEnv, resolveLaunch, stagePromptFile, stageLogFile, resolveMcpBridgeForRun, computeChildEnv, computeRuntimeContext, buildAgentBuildArgsOptions, type SystemPromptOverlayDelivery, resolveSystemPromptOverlayDelivery, buildRunArgs, writeMcpJsonIfNeeded, type PreparedSystemPromptOverlayFile, prepareSystemPromptOverlayFileIfNeeded, prepareCodexHomeIfNeeded, prepareClaudeConfigDirIfNeeded, guardWindowsCommandLineBudget, type SpawnAgentChildProcessResult, spawnAgentChildProcess, isStdinDrivenFormat, confirmChildSpawned, armHandoffWatcher, runAcpDispatch, runPiRpcDispatch, createAgentExecutor, } from './agent-executor/index.js';
 //# sourceMappingURL=agent-executor.d.ts.map

package/dist/http/index.d.ts

@@ -9,8 +9,8 @@ export type { CatalogueEntry, HostEditor, HostEditorsResponse, HostToolLaunchPla
 export { applicableForPlatform, CATALOGUE, currentPlatform, defaultProbeEnv, hostEditorsRoute, launchHostTool, listAvailableEditors, pathDirs, probeCommandOnPath, probeMacBundle, registerHostToolsRoutes, resolveEntry, resolveHostToolLaunchPlan, } from './host-tools.js';
 export type { DaemonShutdownResponse, DaemonStatusDeps, DaemonStatusResponse, } from './daemon-status.js';
 export { daemonShutdownRoute, daemonStatusRoute, registerDaemonStatusRoutes } from './daemon-status.js';
-export type { RunCancelResponse, RunCreateRequest, RunHttpDeps, RunInternalErrorContext, RunListResponse, RunStartContext, RunStartHandler, RunStartResponse, RunStatusResponse, } from './runs.js';
-export { registerRunEventStream, registerRunRoutes, RUN_EVENTS_ROUTE_PATH, runCancelRoute, runListRoute, runStartRoute, runStatusRoute, } from './runs.js';
+export type { RunCancelResponse, RunCreateRequest, RunHttpDeps, RunInternalErrorContext, RunListResponse, RunStartContext, RunMessageRequest, RunMessageResponse, RunStartHandler, RunStartResponse, RunStatusResponse, } from './runs.js';
+export { registerRunEventStream, registerRunRoutes, RUN_EVENTS_ROUTE_PATH, runCancelRoute, runListRoute, runMessageRoute, RUN_MESSAGE_MAX_CHARS, runStartRoute, runStatusRoute, } from './runs.js';
 export { JINI_ROUTE_MANIFEST, manifestRoutesForFamilies, routeFamilyManifest } from './route-manifest.js';
 export type { AgentListResponse, AgentModelSummary, AgentsHttpDeps, AgentSummary } from './agents.js';
 export { agentListRoute, agentRescanRoute, registerAgentRoutes } from './agents.js';

package/dist/http/index.js

@@ -3,7 +3,7 @@ export { cancelRunsOwnedBy } from './cancel-owned-runs.js';
 export { ACTIVE_CONTEXT_TTL_MS, getActiveRoute, registerActiveContextRoutes, setActiveRoute, } from './active-context.js';
 export { applicableForPlatform, CATALOGUE, currentPlatform, defaultProbeEnv, hostEditorsRoute, launchHostTool, listAvailableEditors, pathDirs, probeCommandOnPath, probeMacBundle, registerHostToolsRoutes, resolveEntry, resolveHostToolLaunchPlan, } from './host-tools.js';
 export { daemonShutdownRoute, daemonStatusRoute, registerDaemonStatusRoutes } from './daemon-status.js';
-export { registerRunEventStream, registerRunRoutes, RUN_EVENTS_ROUTE_PATH, runCancelRoute, runListRoute, runStartRoute, runStatusRoute, } from './runs.js';
+export { registerRunEventStream, registerRunRoutes, RUN_EVENTS_ROUTE_PATH, runCancelRoute, runListRoute, runMessageRoute, RUN_MESSAGE_MAX_CHARS, runStartRoute, runStatusRoute, } from './runs.js';
 export { JINI_ROUTE_MANIFEST, manifestRoutesForFamilies, routeFamilyManifest } from './route-manifest.js';
 export { agentListRoute, agentRescanRoute, registerAgentRoutes } from './agents.js';
 export { memoryClearExtractionsRoute, memoryClearVerificationsRoute, memoryCreateEntryRoute, memoryDeleteEntryRoute, memoryListExtractionsRoute, memoryListVerificationsRoute, memoryOverviewRoute, memoryReadEntryRoute, memoryRemoveExtractionRoute, memoryRemoveVerificationRoute, memoryTreeRoute, memoryUpdateEntryRoute, memoryUpdateTreeNodeRoute, memoryWriteConfigRoute, memoryWriteIndexRoute, registerMemoryEventStream, registerMemoryRoutes, } from './memory.js';

package/dist/http/route-manifest.js

@@ -31,7 +31,7 @@
 import { agentListRoute, agentRescanRoute } from './agents.js';
 import { delegatedToolExecuteRoute } from './delegated-tools.js';
 import { apiHealthRoute, apiReadyRoute, apiVersionInfoRoute, healthRoute, readyRoute, versionInfoRoute, } from './health.js';
-import { RUN_EVENTS_ROUTE_PATH, runCancelRoute, runListRoute, runStartRoute, runStatusRoute, } from './runs.js';
+import { RUN_EVENTS_ROUTE_PATH, runCancelRoute, runMessageRoute, runListRoute, runStartRoute, runStatusRoute, } from './runs.js';
 import { toolCatalogDescribeRoute, toolCatalogSearchRoute } from './tool-catalog.js';
 /**
  * Projects route specs onto `RouteRegistration`s, upper-casing the method so entries compare directly
@@ -52,7 +52,7 @@ function fromSpecs(...specs) {
 export const JINI_ROUTE_MANIFEST = {
     health: fromSpecs(healthRoute, apiHealthRoute, readyRoute, apiReadyRoute, versionInfoRoute, apiVersionInfoRoute),
     runs: [
-        ...fromSpecs(runStartRoute, runListRoute, runStatusRoute, runCancelRoute),
+        ...fromSpecs(runStartRoute, runListRoute, runStatusRoute, runCancelRoute, runMessageRoute),
         // Registered with a bare `app.get` rather than a route spec (by `registerRunRoutes` itself), so
         // it contributes its exported path constant instead of a copied literal.
         { method: 'GET', path: RUN_EVENTS_ROUTE_PATH },

package/dist/http/runs.d.ts

@@ -1,6 +1,6 @@
 import type { Express } from 'express';
 import { type RunStatus } from '@jini-ai/protocol';
-import type { RunLifecycle } from '../index.js';
+import type { RunLifecycle, UserMessageDelivery } from '../index.js';
 import { type AdapterContext } from '@jini-ai/http-kit';
 import type { ServerResponse } from 'node:http';
 /**
@@ -34,6 +34,15 @@ export interface RunHttpDeps {
     readonly onStarted?: RunStartHandler;
     /** Host-owned sink for the real exception behind a generic `INTERNAL_ERROR` response (SEC-005). Defaults to `console.error`. */
     readonly onInternalError?: (context: RunInternalErrorContext) => void;
+    /**
+     * Delivers a message the human sent mid-run into that run's live agent — a host passes its
+     * `AgentExecutor.sendUserMessage`. Omitted, every such message reports `'unsupported'`, so the
+     * client falls back to interrupting the run and sending the text as the next turn.
+     */
+    readonly deliverUserMessage?: (input: {
+        readonly runId: string;
+        readonly text: string;
+    }) => UserMessageDelivery | Promise<UserMessageDelivery>;
 }
 export interface RunStartResponse {
     readonly run: RunStatus;
@@ -45,6 +54,15 @@ export interface RunStatusResponse {
 export interface RunCancelResponse {
     readonly run: RunStatus;
 }
+export interface RunMessageRequest {
+    readonly runId: string;
+    readonly text: string;
+}
+export interface RunMessageResponse {
+    readonly delivery: 'delivered';
+}
+/** Ceiling on one mid-run message, matching what a person can reasonably type or paste into a composer. */
+export declare const RUN_MESSAGE_MAX_CHARS = 100000;
 export interface RunListResponse {
     readonly runs: readonly RunStatus[];
 }
@@ -58,6 +76,13 @@ export declare const runCancelRoute: import("@jini-ai/http-kit").JsonRouteSpec<{
     runId: string;
     reason?: string;
 }, RunCancelResponse, RunHttpDeps, undefined>;
+/**
+ * `POST /api/runs/:runId/messages` — a message the human sent while the run is going. `202` when it
+ * reached the live agent; `409 CONFLICT` with `details.delivery` (`'unsupported'` or
+ * `'not-running'`) when it did not, which tells the client whether to interrupt the run and send the
+ * text as the next turn, or simply send it next because the run is already ending.
+ */
+export declare const runMessageRoute: import("@jini-ai/http-kit").JsonRouteSpec<RunMessageRequest, RunMessageResponse, RunHttpDeps, undefined>;
 /**
  * The core of `GET /api/runs/:runId/events` — canonical events as SSE, with Last-Event-ID
  * reconnect support. Takes `runId`/`afterCursor` already resolved by the caller. `res` is typed
@@ -82,7 +107,7 @@ export declare function registerRunEventStream({ app, deps }: {
     readonly app: Express;
     readonly deps: RunHttpDeps;
 }, _optional?: Record<string, never>): void;
-/** Mounts create/status/cancel JSON endpoints and the SSE event stream as one run transport. */
+/** Mounts create/status/cancel/message JSON endpoints and the SSE event stream as one run transport. */
 export declare function registerRunRoutes({ app, deps, adapter }: {
     readonly app: Express;
     readonly deps: RunHttpDeps;

package/dist/http/runs.js

@@ -57,6 +57,23 @@ function parseRunCreate(input) {
         }
     });
 }
+/** Ceiling on one mid-run message, matching what a person can reasonably type or paste into a composer. */
+export const RUN_MESSAGE_MAX_CHARS = 100_000;
+function parseRunMessage(input) {
+    const parsedRunId = parseRunId(input);
+    if (!parsedRunId.ok)
+        return parsedRunId;
+    if (!isRecord(input.body))
+        return err({ error: validationError({ message: 'body must be a JSON object' }) });
+    const text = optionalString(input.body, 'text');
+    if (text === undefined || text === null) {
+        return err({ error: validationError({ message: 'text must be a non-empty string' }, { issues: [{ path: 'text', message: 'required non-empty string' }] }) });
+    }
+    if (text.length > RUN_MESSAGE_MAX_CHARS) {
+        return err({ error: validationError({ message: `text must be at most ${RUN_MESSAGE_MAX_CHARS} characters` }, { issues: [{ path: 'text', message: 'too long' }] }) });
+    }
+    return ok({ value: { runId: parsedRunId.value, text } });
+}
 function parseRunList(input) {
     const value = input.query.contextRef;
     if (value === undefined)
@@ -121,6 +138,23 @@ export const runCancelRoute = defineJsonRoute({
         return ok({ value: { run: await deps.lifecycle.cancel(input) } });
     }
 }, { requireSameOrigin: true });
+/**
+ * `POST /api/runs/:runId/messages` — a message the human sent while the run is going. `202` when it
+ * reached the live agent; `409 CONFLICT` with `details.delivery` (`'unsupported'` or
+ * `'not-running'`) when it did not, which tells the client whether to interrupt the run and send the
+ * text as the next turn, or simply send it next because the run is already ending.
+ */
+export const runMessageRoute = defineJsonRoute({
+    method: 'post', path: '/api/runs/:runId/messages', parse: parseRunMessage, handle: async ({ input, deps }) => {
+        const run = await deps.lifecycle.get({ runId: input.runId });
+        if (run === undefined)
+            return err({ error: createApiError({ code: 'NOT_FOUND', message: `run "${input.runId}" was not found` }) });
+        const delivery = deps.deliverUserMessage ? await deps.deliverUserMessage({ runId: input.runId, text: input.text }) : 'unsupported';
+        if (delivery === 'delivered')
+            return ok({ value: { delivery } });
+        return err({ error: createApiError({ code: 'CONFLICT', message: `run "${input.runId}" did not take the message` }, { details: { delivery } }) });
+    }
+}, { requireSameOrigin: true, successStatus: 202 });
 function sendStreamFailure(res, kind) {
     if (kind.kind === 'unknown-run') {
         sendRawApiError({ res, status: 404, error: createApiError({ code: 'NOT_FOUND', message: 'run was not found' }) });
@@ -210,12 +244,13 @@ export function registerRunEventStream({ app, deps }, _optional = {}) {
         await handleRunEventStreamRequest({ res, runId, afterCursor: requestedAfterCursor(req), deps });
     });
 }
-/** Mounts create/status/cancel JSON endpoints and the SSE event stream as one run transport. */
+/** Mounts create/status/cancel/message JSON endpoints and the SSE event stream as one run transport. */
 export function registerRunRoutes({ app, deps, adapter }, _optional = {}) {
     mountJsonRoute({ app, spec: runStartRoute, deps, adapter });
     mountJsonRoute({ app, spec: runListRoute, deps, adapter });
     mountJsonRoute({ app, spec: runStatusRoute, deps, adapter });
     mountJsonRoute({ app, spec: runCancelRoute, deps, adapter });
+    mountJsonRoute({ app, spec: runMessageRoute, deps, adapter });
     registerRunEventStream({ app, deps });
 }
 //# sourceMappingURL=runs.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/daemon",
-  "version": "0.5.4",
+  "version": "0.6.0",
   "description": "The stateful agent daemon runtime: run lifecycle, durable event-log port, the tool-execution boundary, agent executor, terminal sessions, and routines.",
   "license": "Apache-2.0",
   "repository": {
@@ -139,17 +139,17 @@
     "@types/pg": "8.23.1",
     "express": "^4.21.0",
     "@types/express": "^4.17.21",
-    "@jini-ai/chat": "0.5.5",
-    "@jini-ai/http-kit": "0.4.1",
     "@jini-ai/db": "0.3.1",
-    "@jini-ai/agent-runtime": "^0.4.2",
+    "@jini-ai/http-kit": "0.4.1",
+    "@jini-ai/agent-runtime": "^0.4.4",
+    "@jini-ai/chat": "0.5.7",
     "@jini-ai/core": "^0.4.2",
-    "@jini-ai/protocol": "^0.4.2",
-    "@jini-ai/platform": "^0.5.2"
+    "@jini-ai/platform": "^0.5.2",
+    "@jini-ai/protocol": "^0.4.3"
   },
   "dependencies": {
     "@jini-ai/core": "^0.4.2",
-    "@jini-ai/protocol": "^0.4.2"
+    "@jini-ai/protocol": "^0.4.3"
   },
   "peerDependencies": {
     "node-pty": "^1.1.0",
@@ -160,7 +160,7 @@
     "pg": "^8.23.0",
     "@jini-ai/http-kit": "^0.4.0",
     "express": "^4.21.0",
-    "@jini-ai/agent-runtime": "^0.4.1",
+    "@jini-ai/agent-runtime": "^0.4.4",
     "@jini-ai/platform": "^0.5.1"
   },
   "peerDependenciesMeta": {