@jini-ai/daemon 0.5.4 → 0.6.1

package/dist/agent-executor/contracts.d.ts

@@ -2,7 +2,7 @@ import type { MessageAttachmentImage } from '../attachment-content.js';
 import type { spawn as nodeSpawn, ChildProcess } from 'node:child_process';
 import type { Principal } from '@jini-ai/core';
 import type { RunAgentPayload, RunErrorPayload } from '@jini-ai/protocol';
-import type { applyAgentLaunchEnv, ensureAgentCapabilities, resolveModelForLaunch, getAgentDef, resolveAgentLaunch, attachAcpSession, attachPiRpcSession, prepareAgentLogFile, preparePromptFileForAgent, AcpMcpServerInput, AcpPermissionHandler, PromptAugmenter } from '@jini-ai/agent-runtime';
+import type { AgentRuntimeState, applyAgentLaunchEnv, ensureAgentCapabilities, resolveModelForLaunch, getAgentDef, resolveAgentLaunch, attachAcpSession, attachPiRpcSession, prepareAgentLogFile, preparePromptFileForAgent, AcpMcpServerInput, AcpPermissionHandler, PromptAugmenter } from '@jini-ai/agent-runtime';
 import type { createCommandInvocation, listProcessSnapshots, ProcessSnapshot, StopProcessesResult } from '@jini-ai/platform';
 import type { RunByteJournal } from '../continuation/journal.js';
 import type { RunRetrySideEffectState } from '../run/core/index.js';
@@ -194,7 +194,27 @@ export interface AgentExecutor {
      * `lifecycle.finish()` before this rejects (see index.ts module doc's Invariant).
      */
     run(requiredArgs: Pick<AgentExecutorRunInput, "runId" | "agentId" | "prompt" | "cwd">, optionalArgs?: Pick<AgentExecutorRunInput, "model" | "reasoning" | "permissionMode" | "imagePaths" | "imageContents" | "extraAllowedDirs" | "uploadRoot" | "credentialEnv" | "env" | "resumeSessionId" | "newSessionId" | "disallowedTools" | "allowedTools" | "settingSources" | "settings">): Promise<void>;
+    /**
+     * Delivers a message the human sent while `runId` is going straight into its live agent process
+     * (see {@link UserMessageDelivery} for each outcome). A stream-json agent is interrupted first and
+     * gets the message once the CLI acknowledges the interrupt, so this settles in milliseconds (at
+     * most `INTERRUPT_ACK_TIMEOUT_MS`); it never waits on the agent's reply.
+     */
+    sendUserMessage(requiredArgs: {
+        readonly runId: string;
+        readonly text: string;
+    }): Promise<UserMessageDelivery>;
 }
+/**
+ * What {@link AgentExecutor.sendUserMessage} did with a mid-run message:
+ * - `'delivered'` — the running turn was interrupted and the message written into the live
+ *   session; the agent answers it next, in the same process and session.
+ * - `'unsupported'` — the run is live, but its agent has no way to take input mid-run (its prompt
+ *   is plain text or an RPC request). The host should interrupt and send it as the next turn.
+ * - `'not-running'` — no live process will accept it: an unknown run, a finished one, or one whose
+ *   last turn already ended and closed stdin. The run is ending; the host should send it next.
+ */
+export type UserMessageDelivery = 'delivered' | 'unsupported' | 'not-running';
 /** Process discovery is a getter; process collection and stopping accept explicit host inputs. */
 export type CollectProcessTreePidsPort = (args: {
     readonly processes: ProcessSnapshot[];
@@ -212,11 +232,11 @@ export interface TerminateChildTreeDeps {
  * Which step reported a contained failure through `onCleanupFailure` (SEC-007).
  *
  * The first three come from {@link terminateChildTreeBestEffort} (process-tree teardown). The last
- * two are the two fallible steps that sit between a child's `'close'` and `finish()` — staged-file
- * removal and the host's own `classifyFailure` — neither of which may prevent the terminal
- * transition, and neither of which may fail silently either. See each close handler.
+ * three cover tool cancellation, staged-file removal and the host's own `classifyFailure`.
+ * These fallible steps between a child's `'close'` and `finish()` must never prevent the terminal
+ * transition, and none may fail silently either. See each close handler.
  */
-export type AgentCleanupFailurePhase = 'cancel' | 'acp-attach-failure' | 'pi-rpc-attach-failure' | 'staged-file-cleanup' | 'failure-classification';
+export type AgentCleanupFailurePhase = 'cancel' | 'acp-attach-failure' | 'pi-rpc-attach-failure' | 'tool-cancellation' | 'staged-file-cleanup' | 'failure-classification';
 export interface AgentCleanupFailureContext {
     readonly runId: string;
     readonly phase: AgentCleanupFailurePhase;
@@ -237,6 +257,8 @@ export interface StdinCloseHandle {
     closeStdinOnce(): void;
     /** Journals a sent-to-stdin byte chunk, queued through the same FIFO {@link wireChildLifecycle} already uses for emitted events. No-op when no journal was configured (see `CreateAgentExecutorOptions.journal`). */
     recordSentBytes(content: string): void;
+    /** Interrupts this child's turn, then writes a mid-run user message into its open stdin — see {@link AgentExecutor.sendUserMessage}. */
+    sendUserMessage(text: string): Promise<UserMessageDelivery>;
 }
 /**
  * Gap 3 (capability-routed continuation transport) — host-owned config for the
@@ -374,6 +396,13 @@ export interface McpJsonInjectionOptions {
     readonly removeDir?: ({ path }: {
         readonly path: string;
     }) => Promise<void>;
+    /** `'codex-toml'` only. Links the run home's sessions/archived_sessions to the operator's
+     * persistent rollout store. Config and auth remain isolated and are removed after the run.
+     * @default Native mkdir (0700) and directory symlinks; errors fail staging before spawn. */
+    readonly linkSessionStore?: (required: {
+        runHome: string;
+        sourceHome: string;
+    }, optional?: {}) => Promise<void>;
 }
 /** One `.mcp.json` `mcpServers` entry — the shape Claude Code's own config schema expects. */
 export interface McpJsonServerEntry {
@@ -542,6 +571,9 @@ export interface FailureClassificationContext {
  */
 export type ClassifyFailure = (context: FailureClassificationContext) => boolean | Promise<boolean>;
 export interface CreateAgentExecutorOptions {
+    /** Host environment snapshot; baseline spawn keys and source config paths are allowlisted. */
+    readonly hostEnv?: NodeJS.ProcessEnv;
+    readonly runtimeState?: AgentRuntimeState;
     readonly lifecycle: RunLifecycle;
     /** Resolves/pins the concrete starting model against the actual launch scope. */
     readonly resolveModelForLaunch?: typeof resolveModelForLaunch;

package/dist/agent-executor/event-translation.js

@@ -39,11 +39,15 @@ function translateUsagePayload(rawEvent) {
     const rawUsage = isRecord(rawEvent.usage) ? rawEvent.usage : undefined;
     const usage = extractUsageTokens({ rawUsage: rawUsage });
     const costUsd = asOptionalNumber(rawEvent.costUsd);
+    const cumulativeCostUsd = asOptionalNumber(rawEvent.cumulativeCostUsd);
+    const costSessionId = asOptionalString(rawEvent.costSessionId);
     const durationMs = asOptionalNumber(rawEvent.durationMs);
     return {
         type: 'usage',
         ...(usage !== undefined ? { usage } : {}),
         ...(costUsd !== undefined ? { costUsd } : {}),
+        ...(cumulativeCostUsd !== undefined ? { cumulativeCostUsd } : {}),
+        ...(costSessionId !== undefined ? { costSessionId } : {}),
         ...(durationMs !== undefined ? { durationMs } : {}),
     };
 }

package/dist/agent-executor/events.d.ts

@@ -118,6 +118,21 @@ interface WireChildLifecycleContext extends TerminateChildTreeDeps {
  * @overallScore 100/100
  */
 export declare function wireChildLifecycle(ctx: WireChildLifecycleContext): StdinCloseHandle;
+/**
+ * Whether a def's live process can take another user message mid-run: only a stream-json stdin
+ * transport keeps stdin open for more JSONL user lines (see `RuntimeAgentDef.promptInputFormat`).
+ * Deliberately not `resolveContinuationTransport`: that answers how a tool result gets back, and
+ * reports `'mcp-callback'` for Claude even though its stdin takes user lines all the same.
+ */
+export declare function acceptsMidRunUserMessages({ def }: {
+    readonly def: RuntimeAgentDef;
+}): boolean;
+/**
+ * How long a mid-run message waits for the CLI to acknowledge its interrupt before being written
+ * anyway. Claude Code acks within milliseconds (it answers before the aborted turn's own result);
+ * the ceiling only bounds an agent that ignores control requests.
+ */
+export declare const INTERRUPT_ACK_TIMEOUT_MS = 5000;
 /**
  * Writes the initial user turn to the child's stdin per `def.promptInputFormat`
  * (both branches only run for `promptViaStdin: true` defs — the only shape
@@ -125,8 +140,8 @@ export declare function wireChildLifecycle(ctx: WireChildLifecycleContext): Stdi
  * - `'text'` (default): the raw prompt buffer, then stdin is closed —
  *   matches `RuntimeAgentDef.promptInputFormat`'s own doc.
  * - `'stream-json'`: one JSONL line wrapping the prompt as an Anthropic
- *   user message; stdin is deliberately left open (a real multi-turn
- *   caller would inject further messages) — v1 has no such caller, so
+ *   user message; stdin is deliberately left open so a message the human
+ *   sends mid-run can follow it (`StdinCloseHandle.sendUserMessage`), and
  *   {@link wireChildLifecycle}'s `turn_end` handling closes it once the
  *   agent's own stream reports the turn ended.
  * @param def - The resolved agent def (only `.promptInputFormat` is read).

package/dist/agent-executor/events.js

@@ -1,3 +1,4 @@
+import { randomUUID } from 'node:crypto';
 import { createModelReceiptTracker } from './model-receipts.js';
 import { messageContentWithImages } from '../attachment-content.js';
 import { redactSecrets, } from '@jini-ai/core';
@@ -8,7 +9,7 @@ import { resolveContinuationTransport, } from '../continuation/continuation-tran
 import { resultContent, } from '../delegated-tool-bridge.js';
 import { extractResultMedia, } from '../tool-result-media.js';
 import { translateAgentRuntimeEvent, translateAcpError, applyAgentTranslationSideEffects, } from './event-translation.js';
-import { errorMessage, } from './values.js';
+import { errorMessage, isRecord, } from './values.js';
 import { MCP_BRIDGE_UNAVAILABLE, unavailableJiniBridgeStatus, bridgeUnavailableMessage, } from './mcp-bridge.js';
 /** Carry PID only on structured status so the host can record its OS start identity early.
  * A PID alone is never proof of death; hosts verify PID reuse before native continuation. */
@@ -25,7 +26,7 @@ function statusWithChildIdentity({ payload, childPid }, _optional = {}) {
  * parser's own documented behavior. Never called for `streamFormat:
  * 'plain'` — `wireChildLifecycle` handles that format inline with no
  * parser at all (see `ChildDrivenStreamFormat`'s doc).
- * @param def - The resolved agent def (only `.eventParser` is read beyond `streamFormat`).
+ * @param def - The resolved agent def (`.eventParser` and `.usageCostBasis` configure parser behavior).
  * @param streamFormat - `def.streamFormat`, already narrowed by {@link isSupportedStreamFormat}.
  * @param onEvent - Sink the parser calls once per parsed (or malformed-raw) event.
  * @returns A `{feed, flush}` handle for the chosen parser.
@@ -35,7 +36,7 @@ function statusWithChildIdentity({ payload, childPid }, _optional = {}) {
 function createStreamHandlerForDef(def, streamFormat, onEvent) {
     switch (streamFormat) {
         case 'claude-stream-json':
-            return createClaudeStreamHandler({ onEvent: onEvent });
+            return createClaudeStreamHandler({ onEvent: onEvent }, { costBasis: def.usageCostBasis ?? 'run' });
         case 'copilot-stream-json':
             return createCopilotStreamHandler({ onEvent: onEvent });
         case 'qoder-stream-json':
@@ -68,7 +69,7 @@ export function defaultCleanupFailureSink(context) {
 /**
  * Reports a contained post-close failure through the host's sink, absorbing a throwing sink.
  *
- * A diagnostic sink is host code too, and the whole point of the two callers below is that nothing
+ * A diagnostic sink is host code too, and the whole point of these callers is that nothing
  * between `'close'` and `finish()` can strand the run — a sink that throws must not reintroduce
  * exactly that. Same reasoning `run-lifecycle.ts`'s `handleInactivityTimeout` already applies to its
  * own `onInternalError`.
@@ -273,6 +274,37 @@ export function wireChildLifecycle(ctx) {
     // consumed by a turn-end injection decision. See `ContinuationOptions`'s doc for why this is
     // only ever acted on when a host has explicitly allowlisted the tool's name.
     let pendingToolUse;
+    // Observe the canonical lifecycle, including delegated calls that bypass the CLI parser.
+    // A single latest tool_use cannot represent parallel tools at an interrupt boundary.
+    const unresolvedToolCalls = new Set();
+    const interruptedToolCalls = new Set();
+    const toolSubscription = lifecycle.stream({ runId, onEvent: (event) => {
+            if (event.kind !== 'agent')
+                return;
+            if (event.payload.type === 'tool_use')
+                unresolvedToolCalls.add(event.payload.id);
+            if (event.payload.type === 'tool_result')
+                unresolvedToolCalls.delete(event.payload.toolUseId);
+        } }).catch(error => {
+        // Observing tools is fallible I/O too: report it, but never strand close/finish on a replay
+        // failure or leave an unhandled rejection while the child is still running.
+        reportPostCloseFailure(ctx.onCleanupFailure, { runId, phase: 'tool-cancellation', pid: child.pid, error });
+        return null;
+    });
+    /** Run on the same FIFO as parsed results, after the aborted segment has drained.
+     * O(t) in unresolved calls; completed results are never replaced with cancellation. */
+    async function cancelUnresolvedToolCalls(ids) {
+        await toolSubscription;
+        for (const toolUseId of ids ?? [...unresolvedToolCalls]) {
+            if (!unresolvedToolCalls.has(toolUseId))
+                continue;
+            await lifecycle.emit({ runId, input: { event: 'agent', data: {
+                        type: 'tool_result', toolUseId, content: 'Tool execution cancelled.', isError: true,
+                    } } }).catch(error => {
+                reportPostCloseFailure(ctx.onCleanupFailure, { runId, phase: 'tool-cancellation', pid: child.pid, error });
+            });
+        }
+    }
     // Bridge guard (see `expectsJiniBridge`): checked on the first init frame only. Once the bridge is
     // found unavailable, the child is being stopped and nothing it still prints is forwarded.
     let bridgeChecked = !ctx.expectsJiniBridge;
@@ -311,6 +343,71 @@ export function wireChildLifecycle(ctx) {
         stdinClosed = true;
         child.stdin?.end();
     }
+    // Mid-run interrupts (see `sendUserMessage` below): each sent `interrupt` control request waits
+    // here, by request id, for the CLI's `control_response`. Settled with `true` on the ack, `false`
+    // when the process exits first. Bounded by the mid-run messages in flight on this one run.
+    const pendingInterruptAcks = new Map();
+    // Set once this run has interrupted its agent: from then on a turn the interrupt aborted
+    // (`aborted_*` stop reason) is not the run's last — the message that follows starts a new one.
+    let interruptSent = false;
+    // Claude Code's background tasks still running (a subagent or shell it started in the
+    // background), from its latest `background_tasks_changed` line, which lists them all. While any
+    // runs, an `end_turn` is not the run's end: the CLI keeps going until they finish and reports on
+    // them, so stdin must stay open for mid-run messages. Closing it there (2026-10-10, plannie chat)
+    // made every message sent while two subagents worked come back 'not-running' and wait for the run
+    // to end — and at EOF the CLI stops background tasks at its own wait ceiling (10 minutes).
+    let backgroundTaskCount = 0;
+    // Set when a turn ended and stdin stayed open only for background tasks: no turn is running, so a
+    // mid-run message has nothing to interrupt, and the last task finishing closes stdin (below).
+    let heldForBackgroundTasks = false;
+    // stdout carry-over for the control lines below; holds at most the current partial line.
+    let controlScanBuffer = '';
+    /** Resolves the waiting interrupt this `control_response` line acknowledges, if any. @complexity O(line length). */
+    function settleInterruptAck(line) {
+        const requestId = controlResponseRequestId({ line: line });
+        const settle = requestId === undefined ? undefined : pendingInterruptAcks.get(requestId);
+        if (!settle)
+            return;
+        pendingInterruptAcks.delete(requestId);
+        settle(true);
+    }
+    /**
+     * Tracks a `background_tasks_changed` line. The last background task finishing while stdin is
+     * held only for them closes it, exactly as the turn end would have: the CLI then answers what it
+     * still owes (the tasks' report) and exits. @complexity O(line length).
+     */
+    function updateBackgroundTasks(line) {
+        const count = backgroundTaskListLength({ line: line });
+        if (count === undefined)
+            return;
+        backgroundTaskCount = count;
+        if (count === 0 && heldForBackgroundTasks) {
+            heldForBackgroundTasks = false;
+            closeStdinOnce();
+        }
+    }
+    /**
+     * Reads the stdout lines a mid-run message depends on: interrupt acks and background-task
+     * changes. Only agents that take mid-run messages are scanned. A chunk with no newline is only
+     * appended, so a long line split across many chunks is split once, not once per chunk.
+     * @complexity O(chunk length) amortized.
+     */
+    function scanControlLines(text) {
+        if (!acceptsMidRunUserMessages({ def: def }))
+            return;
+        controlScanBuffer += text;
+        if (!text.includes('\n'))
+            return;
+        const lines = controlScanBuffer.split('\n');
+        controlScanBuffer = lines.pop() ?? '';
+        for (const line of lines) {
+            // Both checked: either word can also appear inside the other kind of line's text.
+            if (line.includes('"control_response"'))
+                settleInterruptAck(line);
+            if (line.includes('"background_tasks_changed"'))
+                updateBackgroundTasks(line);
+        }
+    }
     /**
      * Writes a structured (never string-concatenated — see `ContinuationOptions`'s doc on the
      * prompt-injection stakes here) tool_result JSONL line, mirroring the shape
@@ -330,6 +427,26 @@ export function wireChildLifecycle(ctx) {
         if (journal)
             enqueueEmit(() => journal.record({ runId: runId, entry: sentJournalEntry(content) }));
     }
+    /**
+     * Whether a `turn_end` leaves stdin open for a live agent that takes mid-run messages — and why:
+     * `'background-tasks'` when only background tasks keep the run going (no turn runs until the next
+     * message or task report), `'turn-continues'` for the reasons below, `'close'` otherwise. Open
+     * because the run is not over: a `tool_use` stop (the CLI runs the tool itself and carries on, and a
+     * message sent while the tool runs must still reach it), any end while an interrupt still waits
+     * for its ack (the message is about to be written), and the end of a turn an interrupt aborted
+     * (the message written after it starts the next turn), and any end while background tasks still
+     * run (see `backgroundTaskCount`). Every other end closes stdin, so the CLI exits once it has
+     * answered everything written before EOF.
+     */
+    function stdinHoldAfterTurnEnd(stopReason) {
+        if (!acceptsMidRunUserMessages({ def: def }))
+            return 'close';
+        if (stopReason === 'tool_use' || pendingInterruptAcks.size > 0)
+            return 'turn-continues';
+        if (interruptSent && stopReason !== undefined && stopReason.startsWith('aborted'))
+            return 'turn-continues';
+        return backgroundTaskCount > 0 ? 'background-tasks' : 'close';
+    }
     /**
      * Decides, per `turn_end`, whether to auto-resolve a pending tool_use through the injected
      * `ToolExecutor` and keep stdin open (gap 3), or close stdin exactly as every version of this
@@ -337,6 +454,11 @@ export function wireChildLifecycle(ctx) {
      * unconfigured or the pending tool isn't allowlisted).
      */
     function handleTurnEnd(stopReason) {
+        if (stopReason?.startsWith('aborted'))
+            enqueueEmit(async () => {
+                await cancelUnresolvedToolCalls([...interruptedToolCalls]);
+                interruptedToolCalls.clear();
+            });
         const toolUse = pendingToolUse;
         const shouldInject = stopReason === 'tool_use' &&
             toolUse !== undefined &&
@@ -344,7 +466,10 @@ export function wireChildLifecycle(ctx) {
             resolveContinuationTransport({ def: def }) === 'stdin-injection' &&
             continuation.autonomousToolNames.has(toolUse.name);
         if (!shouldInject) {
-            closeStdinOnce();
+            const hold = stdinHoldAfterTurnEnd(stopReason);
+            heldForBackgroundTasks = hold === 'background-tasks';
+            if (hold === 'close')
+                closeStdinOnce();
             return;
         }
         pendingToolUse = undefined;
@@ -497,6 +622,10 @@ export function wireChildLifecycle(ctx) {
             return;
         }
         enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'stdout', data: { chunk: text } } }));
+        // Before the parser: an ack and the aborted turn's end can share a chunk, and the turn end must
+        // see that no interrupt is still waiting (see `stdinHoldAfterTurnEnd`); a background task
+        // starting and the turn's end can share one too.
+        scanControlLines(text);
         // Non-null: `streamHandler` is only ever null when `streamFormat === 'plain'` (see its
         // construction above), the branch this statement is provably unreachable from.
         streamHandler.feed({ chunk: text });
@@ -522,6 +651,9 @@ export function wireChildLifecycle(ctx) {
             void terminateChildTreeBestEffort(ctx, child, runId, 'cancel', ctx.onCleanupFailure);
         } });
     child.on('close', (code, signal) => {
+        for (const settle of pendingInterruptAcks.values())
+            settle(false);
+        pendingInterruptAcks.clear();
         void (async () => {
             // Not wrapped in try/catch: all 4 supported parser factories'
             // flush() implementations already internally guard their own
@@ -536,6 +668,11 @@ export function wireChildLifecycle(ctx) {
             // `finish()`'s `'end'` event, exactly like every live-path emit already is.
             flushBufferedStdout();
             await emitQueue;
+            if (cancelRequested)
+                await cancelUnresolvedToolCalls();
+            const subscribedTools = await toolSubscription;
+            if (subscribedTools?.kind === 'ok')
+                subscribedTools.unsubscribe();
             unsubscribeCancel();
             // Both of the next two steps are guarded: neither a failed cleanup nor a rejecting host
             // classifier may prevent the terminal transition below — see each helper's own doc.
@@ -554,14 +691,114 @@ export function wireChildLifecycle(ctx) {
             await lifecycle.finish({ runId, status, code, signal: signal ?? null, resumable }, { ...(capturedSessionId !== undefined ? { sessionRef: capturedSessionId } : {}) });
         })();
     });
+    /**
+     * A mid-run message: first an `interrupt` control request on the still-open stdin, so the agent
+     * stops generating (or abandons the tool it is running) at once instead of finishing its whole
+     * reply; then, once the CLI acknowledges, the message as the next user line, which the CLI
+     * answers straight away in the same session; then the run's own `user_message` event through the
+     * same FIFO as the agent's output, so the message sits in the stream where it took effect.
+     * An ack that never comes (an agent that ignores control requests) only delays the write by
+     * {@link INTERRUPT_ACK_TIMEOUT_MS}: the CLI then folds the line in at its next step. Once
+     * `turn_end` has closed stdin, or the process exits before the ack, there is no session left to
+     * reach — `'not-running'`. Between turns, while stdin is held only for background tasks, there is
+     * no generation to stop: the line is written at once and starts the next turn.
+     */
+    async function sendUserMessage(text) {
+        if (!acceptsMidRunUserMessages({ def: def }))
+            return 'unsupported';
+        const stdin = child.stdin;
+        if (stdinClosed || !stdin)
+            return 'not-running';
+        if (heldForBackgroundTasks) {
+            heldForBackgroundTasks = false;
+            writeUserMessage(stdin, text);
+            return 'delivered';
+        }
+        const requestId = `jini-interrupt-${randomUUID()}`;
+        interruptSent = true;
+        // Capture before requesting the interrupt. Its result can precede the acknowledgement, or
+        // arrive after the next segment starts: neither ordering may cancel that segment's new tools.
+        enqueueEmit(async () => {
+            await toolSubscription;
+            for (const id of interruptedToolCalls)
+                if (!unresolvedToolCalls.has(id))
+                    interruptedToolCalls.delete(id);
+            for (const id of unresolvedToolCalls)
+                interruptedToolCalls.add(id);
+        });
+        const acked = new Promise((resolve) => pendingInterruptAcks.set(requestId, resolve));
+        stdin.write(`${JSON.stringify({ type: 'control_request', request_id: requestId, request: { subtype: 'interrupt' } })}\n`, 'utf8');
+        let timer;
+        const timedOut = new Promise((resolve) => {
+            timer = setTimeout(() => resolve(true), INTERRUPT_ACK_TIMEOUT_MS);
+        });
+        const processAlive = await Promise.race([acked, timedOut]);
+        clearTimeout(timer);
+        pendingInterruptAcks.delete(requestId);
+        if (!processAlive || stdinClosed)
+            return 'not-running';
+        writeUserMessage(stdin, text);
+        return 'delivered';
+    }
+    /** Writes a mid-run message as the next user line, journals it, and emits its `user_message` run event. */
+    function writeUserMessage(stdin, text) {
+        stdin.write(`${JSON.stringify(streamJsonUserMessage({ content: [{ type: 'text', text: text }] }))}\n`, 'utf8');
+        if (journal)
+            enqueueEmit(() => journal.record({ runId: runId, entry: sentJournalEntry(text) }));
+        enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'agent', data: { type: 'user_message', id: randomUUID(), text: text } } }));
+    }
     return {
         closeStdinOnce,
         recordSentBytes(content) {
             if (journal)
                 enqueueEmit(() => journal.record({ runId: runId, entry: sentJournalEntry(content) }));
         },
+        sendUserMessage,
     };
 }
+/**
+ * Whether a def's live process can take another user message mid-run: only a stream-json stdin
+ * transport keeps stdin open for more JSONL user lines (see `RuntimeAgentDef.promptInputFormat`).
+ * Deliberately not `resolveContinuationTransport`: that answers how a tool result gets back, and
+ * reports `'mcp-callback'` for Claude even though its stdin takes user lines all the same.
+ */
+export function acceptsMidRunUserMessages({ def }) {
+    return def.promptViaStdin === true && def.promptInputFormat === 'stream-json';
+}
+/**
+ * How long a mid-run message waits for the CLI to acknowledge its interrupt before being written
+ * anyway. Claude Code acks within milliseconds (it answers before the aborted turn's own result);
+ * the ceiling only bounds an agent that ignores control requests.
+ */
+export const INTERRUPT_ACK_TIMEOUT_MS = 5_000;
+/** The `request_id` of a stream-json `control_response` line, or `undefined` for anything else. */
+function controlResponseRequestId({ line }) {
+    try {
+        const parsed = JSON.parse(line);
+        if (!isRecord(parsed) || parsed.type !== 'control_response' || !isRecord(parsed.response))
+            return undefined;
+        return typeof parsed.response.request_id === 'string' ? parsed.response.request_id : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** How many tasks a `background_tasks_changed` line lists, or `undefined` for any other line. */
+function backgroundTaskListLength({ line }) {
+    try {
+        const parsed = JSON.parse(line);
+        if (!isRecord(parsed) || parsed.type !== 'system' || parsed.subtype !== 'background_tasks_changed')
+            return undefined;
+        return Array.isArray(parsed.tasks) ? parsed.tasks.length : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The stream-json stdin envelope for one user message — the initial prompt and every mid-run one. */
+function streamJsonUserMessage({ content }) {
+    return { type: 'user', message: { role: 'user', content: content } };
+}
 /**
  * Wires an ACP child to a run. Unlike the JSON-stream path, ACP owns the
  * prompt protocol and reports its parsed events through `attachAcpSession`'s
@@ -773,8 +1010,8 @@ function wirePiRpcLifecycle(ctx) {
  * - `'text'` (default): the raw prompt buffer, then stdin is closed —
  *   matches `RuntimeAgentDef.promptInputFormat`'s own doc.
  * - `'stream-json'`: one JSONL line wrapping the prompt as an Anthropic
- *   user message; stdin is deliberately left open (a real multi-turn
- *   caller would inject further messages) — v1 has no such caller, so
+ *   user message; stdin is deliberately left open so a message the human
+ *   sends mid-run can follow it (`StdinCloseHandle.sendUserMessage`), and
  *   {@link wireChildLifecycle}'s `turn_end` handling closes it once the
  *   agent's own stream reports the turn ended.
  * @param def - The resolved agent def (only `.promptInputFormat` is read).
@@ -789,7 +1026,7 @@ export function writePromptToStdin(def, child, prompt, handle) {
     if (!stdin)
         return;
     if (def.promptInputFormat === 'stream-json') {
-        const line = JSON.stringify({ type: 'user', message: { role: 'user', content: messageContentWithImages({ prompt, images: handle.imageContents ?? [] }, {}) } });
+        const line = JSON.stringify(streamJsonUserMessage({ content: messageContentWithImages({ prompt, images: handle.imageContents ?? [] }, {}) }));
         stdin.write(`${line}\n`, 'utf8');
         handle.recordSentBytes(prompt);
         return;

package/dist/agent-executor/index.d.ts

@@ -89,8 +89,8 @@
  * a second, independently-built (and rejected) classifier that once lived in
  * this module.
  */
-export { type SupportedStreamFormat, type AgentExecutorCompatibility, type AgentRuntimeEventTranslation, type AgentExecutorErrorCode, AgentExecutorError, type AgentExecutorRunInput, type AgentExecutor, type CollectProcessTreePidsPort, type StopProcessesPort, type AgentCleanupFailurePhase, type AgentCleanupFailureContext, type ContinuationOptions, type McpJsonInjectionOptions, type McpBridgeDelivery, type PreparedCodexHome, type PreparedClaudeConfigDir, type ClaudeConfigDirSeams, type ClaudeConfigDirIsolationOptions, type FailureClassificationContext, type ClassifyFailure, type CreateAgentExecutorOptions, type SystemPromptOverlayDelivery, type PreparedSystemPromptOverlayFile, type SpawnAgentChildProcessResult, } from './contracts.js';
-export { isSupportedStreamFormat, assessAgentExecutorCompatibility, isAgentExecutorSupported, resolveDefAndStreamFormat, resolveImageDeliveryAndArgvBudget, resolveRunEnv, resolveLaunch, stagePromptFile, stageLogFile, computeChildEnv, computeRuntimeContext, buildAgentBuildArgsOptions, resolveSystemPromptOverlayDelivery, buildRunArgs, prepareSystemPromptOverlayFileIfNeeded, guardWindowsCommandLineBudget, spawnAgentChildProcess, isStdinDrivenFormat, confirmChildSpawned, createAgentExecutor, } from './launch.js';
+export { type SupportedStreamFormat, type AgentExecutorCompatibility, type AgentRuntimeEventTranslation, type AgentExecutorErrorCode, AgentExecutorError, type AgentExecutorRunInput, type AgentExecutor, type UserMessageDelivery, type CollectProcessTreePidsPort, type StopProcessesPort, type AgentCleanupFailurePhase, type AgentCleanupFailureContext, type ContinuationOptions, type McpJsonInjectionOptions, type McpBridgeDelivery, type PreparedCodexHome, type PreparedClaudeConfigDir, type ClaudeConfigDirSeams, type ClaudeConfigDirIsolationOptions, type FailureClassificationContext, type ClassifyFailure, type CreateAgentExecutorOptions, type SystemPromptOverlayDelivery, type PreparedSystemPromptOverlayFile, type SpawnAgentChildProcessResult, } from './contracts.js';
+export { isSupportedStreamFormat, assessAgentExecutorCompatibility, isAgentExecutorSupported, resolveDefAndStreamFormat, resolveImageDeliveryAndArgvBudget, resolveRunEnv, selectAgentExecutorHostEnv, resolveLaunch, stagePromptFile, stageLogFile, computeChildEnv, computeRuntimeContext, buildAgentBuildArgsOptions, resolveSystemPromptOverlayDelivery, buildRunArgs, prepareSystemPromptOverlayFileIfNeeded, guardWindowsCommandLineBudget, spawnAgentChildProcess, isStdinDrivenFormat, confirmChildSpawned, createAgentExecutor, } from './launch.js';
 export { extractUsageTokens, translateStatusEvent, translateToolResultEvent, translateErrorEvent, translateTurnEndEvent, translateAgentRuntimeEvent, applyAgentTranslationSideEffects, } from './event-translation.js';
 export { MCP_BRIDGE_UNAVAILABLE, unavailableJiniBridgeStatus, buildMcpJsonServerEntry, mergeMcpJsonContent, buildAcpMcpBridgeServers, mergeEnvContentMcpConfig, mergeEnvContentInstructions, buildCodexMcpServerToml, buildCodexHomeConfigToml, resolveSourceCodexHomeDir, buildMcpBridgeDelivery, resolveSourceClaudeConfigDir, resolveMcpBridgeForRun, writeMcpJsonIfNeeded, prepareCodexHomeIfNeeded, prepareClaudeConfigDirIfNeeded, } from './mcp-bridge.js';
 export { DEFAULT_BUFFERED_STDOUT_MAX_BYTES, runAcpDispatch, runPiRpcDispatch, } from './events.js';

package/dist/agent-executor/index.js

@@ -90,7 +90,7 @@
  * this module.
  */
 export { AgentExecutorError, } from './contracts.js';
-export { isSupportedStreamFormat, assessAgentExecutorCompatibility, isAgentExecutorSupported, resolveDefAndStreamFormat, resolveImageDeliveryAndArgvBudget, resolveRunEnv, resolveLaunch, stagePromptFile, stageLogFile, computeChildEnv, computeRuntimeContext, buildAgentBuildArgsOptions, resolveSystemPromptOverlayDelivery, buildRunArgs, prepareSystemPromptOverlayFileIfNeeded, guardWindowsCommandLineBudget, spawnAgentChildProcess, isStdinDrivenFormat, confirmChildSpawned, createAgentExecutor, } from './launch.js';
+export { isSupportedStreamFormat, assessAgentExecutorCompatibility, isAgentExecutorSupported, resolveDefAndStreamFormat, resolveImageDeliveryAndArgvBudget, resolveRunEnv, selectAgentExecutorHostEnv, resolveLaunch, stagePromptFile, stageLogFile, computeChildEnv, computeRuntimeContext, buildAgentBuildArgsOptions, resolveSystemPromptOverlayDelivery, buildRunArgs, prepareSystemPromptOverlayFileIfNeeded, guardWindowsCommandLineBudget, spawnAgentChildProcess, isStdinDrivenFormat, confirmChildSpawned, createAgentExecutor, } from './launch.js';
 export { extractUsageTokens, translateStatusEvent, translateToolResultEvent, translateErrorEvent, translateTurnEndEvent, translateAgentRuntimeEvent, applyAgentTranslationSideEffects, } from './event-translation.js';
 export { MCP_BRIDGE_UNAVAILABLE, unavailableJiniBridgeStatus, buildMcpJsonServerEntry, mergeMcpJsonContent, buildAcpMcpBridgeServers, mergeEnvContentMcpConfig, mergeEnvContentInstructions, buildCodexMcpServerToml, buildCodexHomeConfigToml, resolveSourceCodexHomeDir, buildMcpBridgeDelivery, resolveSourceClaudeConfigDir, resolveMcpBridgeForRun, writeMcpJsonIfNeeded, prepareCodexHomeIfNeeded, prepareClaudeConfigDirIfNeeded, } from './mcp-bridge.js';
 export { DEFAULT_BUFFERED_STDOUT_MAX_BYTES, runAcpDispatch, runPiRpcDispatch, } from './events.js';

package/dist/agent-executor/launch.d.ts

@@ -1,5 +1,5 @@
 import { spawn as nodeSpawn, type ChildProcess } from 'node:child_process';
-import { getAgentDef, resolveAgentLaunch, prepareAgentLogFile, preparePromptFileForAgent, type AgentLaunchResolution, type PreparedAgentLogFile, type PreparedPromptFile, type RuntimeAgentDef, type RuntimeBuildOptions, type RuntimeContext } from '@jini-ai/agent-runtime';
+import { type AgentRuntimeState, getAgentDef, resolveAgentLaunch, prepareAgentLogFile, preparePromptFileForAgent, type AgentLaunchResolution, type PreparedAgentLogFile, type PreparedPromptFile, type RuntimeAgentDef, type RuntimeBuildOptions, type RuntimeContext } from '@jini-ai/agent-runtime';
 import { createCommandInvocation } from '@jini-ai/platform';
 import { type ImagePromptDelivery } from '../image-prompt-delivery.js';
 import { type SupportedStreamFormat, type ChildDrivenStreamFormat, type AgentExecutorCompatibility, type AgentExecutorRunInput, type AgentExecutor, type McpBridgeDelivery, type CreateAgentExecutorOptions, type FailBeforeSpawn, type SystemPromptOverlayDelivery, type PreparedSystemPromptOverlayFile, type SpawnAgentChildProcessResult } from './contracts.js';
@@ -53,6 +53,13 @@ export declare function assessAgentExecutorCompatibility({ def }: {
 export declare function isAgentExecutorSupported({ def }: {
     readonly def: RuntimeAgentDef;
 }): boolean;
+/** Snapshot only host configuration used by spawn and config staging; credentials stay per-run.
+ * Returns an independent allowlisted record. @complexity O(1), fixed key list. */
+export declare function selectAgentExecutorHostEnv({ env }: {
+    env: NodeJS.ProcessEnv;
+}, { runtimeState }?: {
+    runtimeState?: AgentRuntimeState;
+}): NodeJS.ProcessEnv;
 interface ResolvedDefAndFormat {
     readonly def: RuntimeAgentDef;
     readonly streamFormat: SupportedStreamFormat;
@@ -236,6 +243,8 @@ export declare function resolveSystemPromptOverlayDelivery(input: {
     readonly overlay: string | null | undefined;
     readonly prompt: string;
     readonly resumeSessionId: string | null | undefined;
+}, { state }?: {
+    state?: AgentRuntimeState;
 }): SystemPromptOverlayDelivery;
 /**
  * Phase 9b: calls the def's `buildArgs`, releasing staged resources and failing the run on a throw.
@@ -370,6 +379,6 @@ export declare function confirmChildSpawned({ input, deps }: {
  * @complexity `run()`'s own setup is O(1); steady-state cost is the chosen stream parser's.
  * @overallScore 100/100
  */
-export declare function createAgentExecutor(requiredArgs: Pick<CreateAgentExecutorOptions, "lifecycle">, optionalArgs?: Pick<CreateAgentExecutorOptions, "getAgentDef" | "resolveAgentLaunch" | "resolveModelForLaunch" | "ensureAgentCapabilities" | "applyAgentLaunchEnv" | "createCommandInvocation" | "spawn" | "attachAcpSession" | "acpPermissionHandler" | "attachPiRpcSession" | "preparePromptFileForAgent" | "prepareAgentLogFile" | "listProcessSnapshots" | "collectProcessTreePids" | "stopProcesses" | "onCleanupFailure" | "journal" | "continuation" | "classifyFailure" | "mcpJsonInjection" | "claudeConfigDirIsolation" | "claudeConfigDirIsolationEnabled" | "bufferedStdoutMaxBytes" | "promptAugmenter">): AgentExecutor;
+export declare function createAgentExecutor(requiredArgs: Pick<CreateAgentExecutorOptions, "lifecycle">, optionalArgs?: Pick<CreateAgentExecutorOptions, "runtimeState" | "hostEnv" | "getAgentDef" | "resolveAgentLaunch" | "resolveModelForLaunch" | "ensureAgentCapabilities" | "applyAgentLaunchEnv" | "createCommandInvocation" | "spawn" | "attachAcpSession" | "acpPermissionHandler" | "attachPiRpcSession" | "preparePromptFileForAgent" | "prepareAgentLogFile" | "listProcessSnapshots" | "collectProcessTreePids" | "stopProcesses" | "onCleanupFailure" | "journal" | "continuation" | "classifyFailure" | "mcpJsonInjection" | "claudeConfigDirIsolation" | "claudeConfigDirIsolationEnabled" | "bufferedStdoutMaxBytes" | "promptAugmenter">): AgentExecutor;
 export {};
 //# sourceMappingURL=launch.d.ts.map