@jini-ai/daemon 0.5.4 → 0.6.1

package/dist/agent-executor/launch.js

@@ -2,7 +2,7 @@ import { spawn as nodeSpawn, } from 'node:child_process';
 import { promises as fsPromises, } from 'node:fs';
 import { tmpdir, } from 'node:os';
 import { join, } from 'node:path';
-import { agentCapabilities, applyAgentLaunchEnv, ensureAgentCapabilities, resolveModelForLaunch, getAgentDef, resolveAgentLaunch, attachAcpSession, attachPiRpcSession, checkPromptArgvBudget, checkWindowsCmdShimCommandLineBudget, checkWindowsDirectExeCommandLineBudget, prepareAgentLogFile, preparePromptFileForAgent, } from '@jini-ai/agent-runtime';
+import { agentCapabilities, bindRuntimeAgentDef, defaultRuntimeState, getRuntimeModelDiscoveryDeps, userToolchainBinDirs, applyAgentLaunchEnv, ensureAgentCapabilities, resolveModelForLaunch, getAgentDef, resolveAgentLaunch, attachAcpSession, attachPiRpcSession, checkPromptArgvBudget, checkWindowsCmdShimCommandLineBudget, checkWindowsDirectExeCommandLineBudget, prepareAgentLogFile, preparePromptFileForAgent, } from '@jini-ai/agent-runtime';
 import { collectProcessTreePids, createCommandInvocation, listProcessSnapshots, stopProcesses, } from '@jini-ai/platform';
 import { applyImagePromptDelivery, } from '../image-prompt-delivery.js';
 import { SUPPORTED_STREAM_FORMATS, AgentExecutorError, } from './contracts.js';
@@ -131,6 +131,22 @@ function buildAgentEnv(hostEnv, credentialEnv) {
     }
     return result;
 }
+/** Snapshot only host configuration used by spawn and config staging; credentials stay per-run.
+ * Returns an independent allowlisted record. @complexity O(1), fixed key list. */
+export function selectAgentExecutorHostEnv({ env }, { runtimeState } = {}) {
+    const selected = buildAgentEnv(env, undefined);
+    for (const key of ['CODEX_HOME', 'CLAUDE_CONFIG_DIR', 'VELA_OPENCODE_BIN', 'AGENT_RUNTIME_HOME', 'AGENT_RUNTIME_RESOURCE_ROOT', 'VP_HOME', 'NPM_CONFIG_PREFIX', 'npm_config_prefix', 'APPDATA', 'LOCALAPPDATA', 'MISE_DATA_DIR', 'FNM_DIR']) {
+        if (typeof env[key] === 'string')
+            selected[key] = env[key];
+    }
+    // Host-configured resolution names are explicit configuration, never a scan of the env bag.
+    const state = runtimeState ?? defaultRuntimeState;
+    for (const key of Object.values(state.executable.envNames)) {
+        if (typeof env[key] === 'string')
+            selected[key] = env[key];
+    }
+    return selected;
+}
 /**
  * Resolves once `child` emits `'spawn'`, or rejects on `'error'`. Replicates
  * `@jini-ai/platform`'s own internal (non-exported) `waitForChildSpawn` race
@@ -156,11 +172,17 @@ function waitForSpawnOrError(child) {
  * hiding which options belong together. Pure.
  */
 function resolveAgentRuntimeDeps(options) {
+    const runtimeOptions = options.runtimeState ? { state: options.runtimeState } : {};
+    const envOptions = options.hostEnv ? { env: options.hostEnv } : {};
+    const lookupDef = options.getAgentDef ?? getAgentDef;
     return {
-        getAgentDef: options.getAgentDef ?? getAgentDef,
-        resolveAgentLaunch: options.resolveAgentLaunch ?? resolveAgentLaunch,
-        ensureAgentCapabilities: options.ensureAgentCapabilities ?? ensureAgentCapabilities,
-        applyAgentLaunchEnv: options.applyAgentLaunchEnv ?? applyAgentLaunchEnv,
+        getAgentDef: (input) => {
+            const def = lookupDef(input);
+            return def && options.runtimeState ? bindRuntimeAgentDef({ def, state: options.runtimeState }) : def;
+        },
+        resolveAgentLaunch: options.resolveAgentLaunch ?? ((input, optional = {}) => resolveAgentLaunch(input, { ...optional, ...runtimeOptions, ...envOptions })),
+        ensureAgentCapabilities: options.ensureAgentCapabilities ?? ((input) => ensureAgentCapabilities(input, runtimeOptions)),
+        applyAgentLaunchEnv: options.applyAgentLaunchEnv ?? ((input, optional = {}) => applyAgentLaunchEnv(input, { appendPathDirs: userToolchainBinDirs({}, { ...runtimeOptions, ...envOptions }), ...optional })),
         attachAcpSession: options.attachAcpSession ?? attachAcpSession,
         attachPiRpcSession: options.attachPiRpcSession ?? attachPiRpcSession,
         preparePromptFileForAgent: options.preparePromptFileForAgent ?? preparePromptFileForAgent,
@@ -397,7 +419,7 @@ export function buildAgentBuildArgsOptions({ input, systemPromptOverlay }) {
  * @complexity O(n) in the overlay/prompt lengths — string concatenation only, no I/O.
  * @overallScore 100/100
  */
-export function resolveSystemPromptOverlayDelivery(input) {
+export function resolveSystemPromptOverlayDelivery(input, { state } = {}) {
     const { defId, systemPromptDelivery, resumesSessionViaCli, resumesSessionViaAcpLoad, overlay, prompt, resumeSessionId } = input;
     if (typeof overlay !== 'string' || overlay.length === 0) {
         return { promptPrefix: '', prompt, extraArgs: [], envOverrides: {} };
@@ -410,7 +432,7 @@ export function resolveSystemPromptOverlayDelivery(input) {
         // `--help` probe ran and did not find the flag) withholds it. `capabilityKey === undefined`
         // (e.g. `pi`'s existing `--append-system-prompt`, trusted unconditionally) always passes, same
         // as an absent key.
-        const capabilityOk = capabilityKey === undefined || agentCapabilities.get(defId)?.[capabilityKey] !== false;
+        const capabilityOk = capabilityKey === undefined || (state?.capabilities ?? agentCapabilities).get(defId)?.[capabilityKey] !== false;
         return { promptPrefix: '', prompt, extraArgs: capabilityOk ? [systemPromptDelivery.flag, overlay] : [], envOverrides: {} };
     }
     if (systemPromptDelivery?.strategy === 'env-var') {
@@ -607,7 +629,8 @@ export async function confirmChildSpawned({ input, deps }) {
 export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
     const options = { ...requiredArgs, ...optionalArgs };
     const lifecycle = options.lifecycle;
-    const { getAgentDef: getAgentDefFn, resolveAgentLaunch: resolveAgentLaunchFn, ensureAgentCapabilities: ensureAgentCapabilitiesFn, applyAgentLaunchEnv: applyAgentLaunchEnvFn, attachAcpSession: attachAcpSessionFn, attachPiRpcSession: attachPiRpcSessionFn, preparePromptFileForAgent: preparePromptFileForAgentFn, prepareAgentLogFile: prepareAgentLogFileFn, } = resolveAgentRuntimeDeps(options);
+    const hostEnv = selectAgentExecutorHostEnv({ env: options.hostEnv ?? process.env }, options.runtimeState ? { runtimeState: options.runtimeState } : {});
+    const { getAgentDef: getAgentDefFn, resolveAgentLaunch: resolveAgentLaunchFn, ensureAgentCapabilities: ensureAgentCapabilitiesFn, applyAgentLaunchEnv: applyAgentLaunchEnvFn, attachAcpSession: attachAcpSessionFn, attachPiRpcSession: attachPiRpcSessionFn, preparePromptFileForAgent: preparePromptFileForAgentFn, prepareAgentLogFile: prepareAgentLogFileFn, } = resolveAgentRuntimeDeps({ ...options, hostEnv });
     const { createCommandInvocation: createCommandInvocationFn, spawn: spawnFn, listProcessSnapshots: listProcessSnapshotsFn, collectProcessTreePids: collectProcessTreePidsFn, stopProcesses: stopProcessesFn, } = resolveProcessDeps(options);
     const { onCleanupFailure: onCleanupFailureFn, bufferedStdoutMaxBytes } = resolveMiscExecutorDeps(options);
     const journal = options.journal;
@@ -640,6 +663,18 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         await lifecycle.finish({ runId, status: 'failed', code: null, signal: null, resumable: false });
         throw new AgentExecutorError({ code: code, message: message });
     }
+    /**
+     * Every run with a live child, keyed by run id, mapped to how a mid-run message reaches it — the
+     * stdin handle's `sendUserMessage` for a stdin-driven run, a constant `'unsupported'` for an
+     * ACP/pi run (whose RPC takes one prompt per turn). Removed on the child's `'close'`, so a
+     * finished or unknown run reads as `'not-running'`. Bounded by the number of live children.
+     */
+    const liveRunInputs = new Map();
+    /** `AgentExecutor.sendUserMessage()` — see that interface method's own doc. @complexity O(1). */
+    async function sendUserMessage({ runId, text }) {
+        const deliver = liveRunInputs.get(runId);
+        return deliver ? deliver(text) : 'not-running';
+    }
     /**
      * `AgentExecutor.run()` — see that interface method's own doc for the
      * public contract. Implementation note on shape: every guard below
@@ -699,18 +734,19 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
             overlay: systemPromptOverlay,
             prompt: imageDelivery.prompt,
             resumeSessionId: preStagingRuntimeContext?.resumeSessionId,
-        });
+        }, options.runtimeState ? { state: options.runtimeState } : {});
         // The def's own declared env (e.g. claude's `ENABLE_TOOL_SEARCH=false`) is a default the run's
         // env can override. Detection already spawns with it (`detection.ts`); without this the run
         // spawn silently dropped it. Declared by the def itself, so it never widens SEC-001's allowlist.
-        const resolvedEnv = { ...(def.env ?? {}), ...resolveRunEnv({ input: input, hostEnv: process.env }) };
+        const resolvedEnv = { ...(def.env ?? {}), ...resolveRunEnv({ input: input, hostEnv }) };
         const launch = await resolveLaunch({ input: { runId: input.runId, def, resolvedEnv }, deps: { resolveAgentLaunch: resolveAgentLaunchFn, failBeforeSpawn } });
         const spawnEnv = applyAgentLaunchEnvFn({ env: { ...resolvedEnv }, launch });
         // Resolve from the launch environment before staging or sending any prompt. Pin the same
         // concrete ID that the picker displays; an opaque native route cannot silently start a run.
         let modelCatalog;
         try {
-            const selection = await (options.resolveModelForLaunch ?? resolveModelForLaunch)({ def, context: {
+            const selectModel = options.resolveModelForLaunch ?? ((input) => resolveModelForLaunch(input, options.runtimeState ? { deps: getRuntimeModelDiscoveryDeps({ state: options.runtimeState }) } : {}));
+            const selection = await selectModel({ def, context: {
                     executable: launch.launchPath, cwd: input.cwd, env: spawnEnv,
                     ...(input.model && input.model !== 'default' ? { model: input.model } : {}),
                     ...(input.resumeSessionId ? { resumeSessionId: input.resumeSessionId } : {}),
@@ -856,7 +892,7 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         // `codex.ts`'s `buildArgs` needs no argv change for this (CODEX_HOME is an env var, not a flag),
         // so — unlike the `.mcp.json` staging above — this can run after `buildArgs` with no ordering
         // constraint of its own; it is placed here only to keep the two staging steps adjacent.
-        preparedCodexHome = await prepareCodexHomeIfNeeded({ input: { runId: input.runId, def, mcpBridge }, deps: { mcpJsonInjection, hostEnv: process.env, releaseStagedResources, failBeforeSpawn } });
+        preparedCodexHome = await prepareCodexHomeIfNeeded({ input: { runId: input.runId, def, mcpBridge }, deps: { mcpJsonInjection, hostEnv, releaseStagedResources, failBeforeSpawn } });
         // Finding 1 of SEC-assistant-env-isolation-2026-09-07's one effect — stage this run's scratch
         // `CLAUDE_CONFIG_DIR` directory. Unconditional for a `claude`-id run (unlike CODEX_HOME above,
         // this does not depend on `mcpJsonInjection` being configured at all — see
@@ -866,7 +902,7 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         preparedClaudeConfigDir = await prepareClaudeConfigDirIfNeeded({ input: { runId: input.runId, def }, deps: {
                 enabled: claudeConfigDirIsolationEnabled,
                 claudeConfigDirIsolation,
-                hostEnv: process.env,
+                hostEnv,
                 releaseStagedResources,
                 failBeforeSpawn,
             } });
@@ -934,7 +970,18 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
                 expectsJiniBridge: writtenMcpJsonPath !== undefined,
             })
             : null;
-        await confirmChildSpawned({ input: { runId: input.runId, def, child }, deps: { releaseStagedResources, failBeforeSpawn } });
+        // Registered with the lifecycle wiring above, before the spawn-confirmation await, so a child
+        // that closes immediately never leaves a stale entry behind.
+        const runId = input.runId;
+        liveRunInputs.set(runId, stdinHandle ? stdinHandle.sendUserMessage : async () => 'unsupported');
+        child.once('close', () => liveRunInputs.delete(runId));
+        try {
+            await confirmChildSpawned({ input: { runId: input.runId, def, child }, deps: { releaseStagedResources, failBeforeSpawn } });
+        }
+        catch (error) {
+            liveRunInputs.delete(runId);
+            throw error;
+        }
         // Now — and only now — is there a live process that could consume the locked side effect, so
         // this is where a def's handoff watcher starts. Deliberately not awaited: the whole point is to
         // release the lock as soon as the child confirms the handoff, in parallel with this run
@@ -1019,6 +1066,6 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
             stdinHandle.imageContents = input.imageContents;
         writePromptToStdin(def, child, stdinPrompt, stdinHandle);
     }
-    return { run };
+    return { run, sendUserMessage };
 }
 //# sourceMappingURL=launch.js.map

package/dist/agent-executor/mcp-bridge.js

@@ -1,6 +1,6 @@
 import { promises as fsPromises, } from 'node:fs';
 import { homedir, tmpdir, } from 'node:os';
-import { join, } from 'node:path';
+import { join, resolve, } from 'node:path';
 import { isRecord, errorMessage, } from './values.js';
 const JINI_MCP_SERVER_KEY = 'jini';
 /** The run-error code a run gets when its CLI reports the injected `jini` bridge as anything but connected. */
@@ -552,12 +552,23 @@ function defaultMkdtempCodexHome({ prefix }) {
 function defaultRemoveCodexHomeDir({ path }) {
     return fsPromises.rm(path, { recursive: true, force: true });
 }
+/** Config credentials stay run-scoped, but rollouts must survive both completion and cancellation.
+ * Native directory links keep Codex as the sole writer of its own persisted session format.
+ * Cleanup removes the links themselves, never their targets. Two fixed directories, O(1) I/O. */
+async function defaultLinkCodexSessionStore({ runHome, sourceHome }, _optional = {}) {
+    for (const name of ['sessions', 'archived_sessions']) {
+        const target = resolve(sourceHome, name);
+        await fsPromises.mkdir(target, { recursive: true, mode: 0o700 });
+        await fsPromises.symlink(target, join(runHome, name), 'junction');
+    }
+}
 function resolveCodexHomeSeams(options) {
     return {
         mkdtemp: options.mkdtemp ?? defaultMkdtempCodexHome,
         readFile: options.readFile ?? defaultReadMcpJsonFile,
         writeFile: options.writeFile ?? defaultWriteMcpJsonFile,
         removeDir: options.removeDir ?? defaultRemoveCodexHomeDir,
+        linkSessionStore: options.linkSessionStore ?? defaultLinkCodexSessionStore,
     };
 }
 /**
@@ -573,8 +584,9 @@ function resolveCodexHomeSeams(options) {
  *     0.151.0) to fail fast with a structured `401 Unauthorized` stream event, never an interactive
  *     login prompt or a hang — see `defs/codex.ts`'s module doc for the full transcript summary.
  *
- * **Never touches the real `CODEX_HOME`.** `sourceCodexHomeDir` is read-only throughout; nothing is
- * ever written back to it.
+ * **Never changes the real config or credentials.** Those source files stay read-only. Only the
+ * native rollout directories are shared: deleting a run's scratch home must not erase the thread
+ * whose id the host already persisted. No copied login or run-bound MCP credential is retained.
  *
  * A failure after the directory is created (a rejecting `writeFile`, most plausibly) does not leak
  * it: the directory may already hold a partial `config.toml` or a copied credential, so the
@@ -584,9 +596,9 @@ function resolveCodexHomeSeams(options) {
  * `@jini-ai/agent-runtime`'s `prepareAgentLogFile`'s `label` is.
  * @param entry - The shared bridge entry.
  * @param sourceCodexHomeDir - Where to read the real install's `config.toml`/`auth.json` from — see {@link resolveSourceCodexHomeDir}.
- * @param seams - Injectable mkdtemp/readFile/writeFile/removeDir, real filesystem by default.
- * @throws Whatever `mkdtemp`/`writeFile` rejects with — the caller ({@link prepareCodexHomeIfNeeded}) turns that into a pre-spawn `AGENT_SPAWN_FAILED` failure, matching {@link writeMcpJsonForRun}'s own contract.
- * @complexity O(1) plus one directory creation and up to two best-effort file read/write round trips.
+ * @param seams - Injectable mkdtemp/readFile/writeFile/removeDir/linkSessionStore, real filesystem by default.
+ * @throws Whatever staging rejects with — the caller ({@link prepareCodexHomeIfNeeded}) turns that into a pre-spawn `AGENT_SPAWN_FAILED` failure, matching {@link writeMcpJsonForRun}'s own contract.
+ * @complexity O(1): fixed directory links and up to two best-effort file read/write round trips.
  * @overallScore 100/100
  */
 async function prepareCodexHomeForRun(runId, entry, sourceCodexHomeDir, seams) {
@@ -616,6 +628,7 @@ async function prepareCodexHomeForRun(runId, entry, sourceCodexHomeDir, seams) {
             // No stored login (or unreadable) — the spawned CLI runs unauthenticated. Confirmed above:
             // this fails the run fast and observably, never as a hang.
         }
+        await seams.linkSessionStore({ runHome: dir, sourceHome: sourceCodexHomeDir }, {});
     }
     catch (err) {
         await seams.removeDir({ path: dir }).catch(() => {

package/dist/agent-executor.d.ts

@@ -6,5 +6,5 @@
  * wrappers or a second implementation would let tested and shipped behavior drift.
  * See agent-executor/index.ts for the driver contracts and invariants.
  */
-export { type SupportedStreamFormat, isSupportedStreamFormat, type AgentExecutorCompatibility, assessAgentExecutorCompatibility, isAgentExecutorSupported, type AgentRuntimeEventTranslation, extractUsageTokens, translateStatusEvent, translateToolResultEvent, translateErrorEvent, translateTurnEndEvent, translateAgentRuntimeEvent, type AgentExecutorErrorCode, AgentExecutorError, type AgentExecutorRunInput, type AgentExecutor, type CollectProcessTreePidsPort, type StopProcessesPort, type AgentCleanupFailurePhase, type AgentCleanupFailureContext, type ContinuationOptions, type McpJsonInjectionOptions, MCP_BRIDGE_UNAVAILABLE, unavailableJiniBridgeStatus, buildMcpJsonServerEntry, mergeMcpJsonContent, buildAcpMcpBridgeServers, mergeEnvContentMcpConfig, mergeEnvContentInstructions, buildCodexMcpServerToml, buildCodexHomeConfigToml, resolveSourceCodexHomeDir, type McpBridgeDelivery, buildMcpBridgeDelivery, type PreparedCodexHome, type PreparedClaudeConfigDir, type ClaudeConfigDirSeams, type ClaudeConfigDirIsolationOptions, resolveSourceClaudeConfigDir, type FailureClassificationContext, type ClassifyFailure, DEFAULT_BUFFERED_STDOUT_MAX_BYTES, applyAgentTranslationSideEffects, type CreateAgentExecutorOptions, resolveDefAndStreamFormat, resolveImageDeliveryAndArgvBudget, resolveRunEnv, resolveLaunch, stagePromptFile, stageLogFile, resolveMcpBridgeForRun, computeChildEnv, computeRuntimeContext, buildAgentBuildArgsOptions, type SystemPromptOverlayDelivery, resolveSystemPromptOverlayDelivery, buildRunArgs, writeMcpJsonIfNeeded, type PreparedSystemPromptOverlayFile, prepareSystemPromptOverlayFileIfNeeded, prepareCodexHomeIfNeeded, prepareClaudeConfigDirIfNeeded, guardWindowsCommandLineBudget, type SpawnAgentChildProcessResult, spawnAgentChildProcess, isStdinDrivenFormat, confirmChildSpawned, armHandoffWatcher, runAcpDispatch, runPiRpcDispatch, createAgentExecutor, } from './agent-executor/index.js';
+export { type SupportedStreamFormat, isSupportedStreamFormat, type AgentExecutorCompatibility, assessAgentExecutorCompatibility, isAgentExecutorSupported, type AgentRuntimeEventTranslation, extractUsageTokens, translateStatusEvent, translateToolResultEvent, translateErrorEvent, translateTurnEndEvent, translateAgentRuntimeEvent, type AgentExecutorErrorCode, AgentExecutorError, type AgentExecutorRunInput, type AgentExecutor, type UserMessageDelivery, type CollectProcessTreePidsPort, type StopProcessesPort, type AgentCleanupFailurePhase, type AgentCleanupFailureContext, type ContinuationOptions, type McpJsonInjectionOptions, MCP_BRIDGE_UNAVAILABLE, unavailableJiniBridgeStatus, buildMcpJsonServerEntry, mergeMcpJsonContent, buildAcpMcpBridgeServers, mergeEnvContentMcpConfig, mergeEnvContentInstructions, buildCodexMcpServerToml, buildCodexHomeConfigToml, resolveSourceCodexHomeDir, type McpBridgeDelivery, buildMcpBridgeDelivery, type PreparedCodexHome, type PreparedClaudeConfigDir, type ClaudeConfigDirSeams, type ClaudeConfigDirIsolationOptions, resolveSourceClaudeConfigDir, type FailureClassificationContext, type ClassifyFailure, DEFAULT_BUFFERED_STDOUT_MAX_BYTES, applyAgentTranslationSideEffects, type CreateAgentExecutorOptions, resolveDefAndStreamFormat, resolveImageDeliveryAndArgvBudget, resolveRunEnv, selectAgentExecutorHostEnv, resolveLaunch, stagePromptFile, stageLogFile, resolveMcpBridgeForRun, computeChildEnv, computeRuntimeContext, buildAgentBuildArgsOptions, type SystemPromptOverlayDelivery, resolveSystemPromptOverlayDelivery, buildRunArgs, writeMcpJsonIfNeeded, type PreparedSystemPromptOverlayFile, prepareSystemPromptOverlayFileIfNeeded, prepareCodexHomeIfNeeded, prepareClaudeConfigDirIfNeeded, guardWindowsCommandLineBudget, type SpawnAgentChildProcessResult, spawnAgentChildProcess, isStdinDrivenFormat, confirmChildSpawned, armHandoffWatcher, runAcpDispatch, runPiRpcDispatch, createAgentExecutor, } from './agent-executor/index.js';
 //# sourceMappingURL=agent-executor.d.ts.map

package/dist/agent-executor.js

@@ -6,5 +6,5 @@
  * wrappers or a second implementation would let tested and shipped behavior drift.
  * See agent-executor/index.ts for the driver contracts and invariants.
  */
-export { isSupportedStreamFormat, assessAgentExecutorCompatibility, isAgentExecutorSupported, extractUsageTokens, translateStatusEvent, translateToolResultEvent, translateErrorEvent, translateTurnEndEvent, translateAgentRuntimeEvent, AgentExecutorError, MCP_BRIDGE_UNAVAILABLE, unavailableJiniBridgeStatus, buildMcpJsonServerEntry, mergeMcpJsonContent, buildAcpMcpBridgeServers, mergeEnvContentMcpConfig, mergeEnvContentInstructions, buildCodexMcpServerToml, buildCodexHomeConfigToml, resolveSourceCodexHomeDir, buildMcpBridgeDelivery, resolveSourceClaudeConfigDir, DEFAULT_BUFFERED_STDOUT_MAX_BYTES, applyAgentTranslationSideEffects, resolveDefAndStreamFormat, resolveImageDeliveryAndArgvBudget, resolveRunEnv, resolveLaunch, stagePromptFile, stageLogFile, resolveMcpBridgeForRun, computeChildEnv, computeRuntimeContext, buildAgentBuildArgsOptions, resolveSystemPromptOverlayDelivery, buildRunArgs, writeMcpJsonIfNeeded, prepareSystemPromptOverlayFileIfNeeded, prepareCodexHomeIfNeeded, prepareClaudeConfigDirIfNeeded, guardWindowsCommandLineBudget, spawnAgentChildProcess, isStdinDrivenFormat, confirmChildSpawned, armHandoffWatcher, runAcpDispatch, runPiRpcDispatch, createAgentExecutor, } from './agent-executor/index.js';
+export { isSupportedStreamFormat, assessAgentExecutorCompatibility, isAgentExecutorSupported, extractUsageTokens, translateStatusEvent, translateToolResultEvent, translateErrorEvent, translateTurnEndEvent, translateAgentRuntimeEvent, AgentExecutorError, MCP_BRIDGE_UNAVAILABLE, unavailableJiniBridgeStatus, buildMcpJsonServerEntry, mergeMcpJsonContent, buildAcpMcpBridgeServers, mergeEnvContentMcpConfig, mergeEnvContentInstructions, buildCodexMcpServerToml, buildCodexHomeConfigToml, resolveSourceCodexHomeDir, buildMcpBridgeDelivery, resolveSourceClaudeConfigDir, DEFAULT_BUFFERED_STDOUT_MAX_BYTES, applyAgentTranslationSideEffects, resolveDefAndStreamFormat, resolveImageDeliveryAndArgvBudget, resolveRunEnv, selectAgentExecutorHostEnv, resolveLaunch, stagePromptFile, stageLogFile, resolveMcpBridgeForRun, computeChildEnv, computeRuntimeContext, buildAgentBuildArgsOptions, resolveSystemPromptOverlayDelivery, buildRunArgs, writeMcpJsonIfNeeded, prepareSystemPromptOverlayFileIfNeeded, prepareCodexHomeIfNeeded, prepareClaudeConfigDirIfNeeded, guardWindowsCommandLineBudget, spawnAgentChildProcess, isStdinDrivenFormat, confirmChildSpawned, armHandoffWatcher, runAcpDispatch, runPiRpcDispatch, createAgentExecutor, } from './agent-executor/index.js';
 //# sourceMappingURL=agent-executor.js.map

package/dist/http/index.d.ts

@@ -9,8 +9,8 @@ export type { CatalogueEntry, HostEditor, HostEditorsResponse, HostToolLaunchPla
 export { applicableForPlatform, CATALOGUE, currentPlatform, defaultProbeEnv, hostEditorsRoute, launchHostTool, listAvailableEditors, pathDirs, probeCommandOnPath, probeMacBundle, registerHostToolsRoutes, resolveEntry, resolveHostToolLaunchPlan, } from './host-tools.js';
 export type { DaemonShutdownResponse, DaemonStatusDeps, DaemonStatusResponse, } from './daemon-status.js';
 export { daemonShutdownRoute, daemonStatusRoute, registerDaemonStatusRoutes } from './daemon-status.js';
-export type { RunCancelResponse, RunCreateRequest, RunHttpDeps, RunInternalErrorContext, RunListResponse, RunStartContext, RunStartHandler, RunStartResponse, RunStatusResponse, } from './runs.js';
-export { registerRunEventStream, registerRunRoutes, RUN_EVENTS_ROUTE_PATH, runCancelRoute, runListRoute, runStartRoute, runStatusRoute, } from './runs.js';
+export type { RunCancelResponse, RunCreateRequest, RunHttpDeps, RunInternalErrorContext, RunListResponse, RunStartContext, RunMessageRequest, RunMessageResponse, RunStartHandler, RunStartResponse, RunStatusResponse, } from './runs.js';
+export { registerRunEventStream, registerRunRoutes, RUN_EVENTS_ROUTE_PATH, runCancelRoute, runListRoute, runMessageRoute, RUN_MESSAGE_MAX_CHARS, runStartRoute, runStatusRoute, } from './runs.js';
 export { JINI_ROUTE_MANIFEST, manifestRoutesForFamilies, routeFamilyManifest } from './route-manifest.js';
 export type { AgentListResponse, AgentModelSummary, AgentsHttpDeps, AgentSummary } from './agents.js';
 export { agentListRoute, agentRescanRoute, registerAgentRoutes } from './agents.js';
@@ -40,8 +40,8 @@ export type { HealthHttpDeps, HealthReadinessResult, LivenessResponse, Readiness
 export { apiHealthRoute, apiReadyRoute, apiVersionInfoRoute, healthRoute, readyRoute, registerHealthRoutes, versionInfoRoute, } from './health.js';
 export type { AuthCredentials, AuthProvider, AuthSession, AuthUser, Charge, ChargeInput, ChargeStatus, ConnectorsAuthSessionResponse, ConnectorsAuthUserResponse, ConnectorsAuthVerifyResponse, ConnectorsChargeResponse, ConnectorsDbQueryResponse, ConnectorsDbRecordResponse, ConnectorsHttpDeps, ConnectorsInternalErrorContext, ConnectorsOkResponse, ConnectorsStorageGetResponse, ConnectorsStorageListResponse, ConnectorsStorageMetaResponse, DbProvider, DbQuery, DbRecord, PaymentsProvider, RealtimeProvider, StorageObjectMeta, StorageProvider, StoragePutOptions, } from './connectors.js';
 export { connectorsAuthSessionRoute, connectorsAuthSignInRoute, connectorsAuthSignOutRoute, connectorsAuthSignUpRoute, connectorsDbDeleteRoute, connectorsDbGetRoute, connectorsDbInsertRoute, connectorsDbQueryRoute, connectorsDbUpdateRoute, connectorsPaymentsChargeRoute, connectorsPaymentsGetRoute, connectorsPaymentsRefundRoute, connectorsRealtimePublishRoute, connectorsStorageDeleteRoute, connectorsStorageGetRoute, connectorsStorageListRoute, connectorsStoragePutRoute, registerConnectorsRoutes, } from './connectors.js';
-export type { ResearchHttpDeps, ResearchInternalErrorContext, ResearchProviderCredentials, ResearchSearchResponse, ResearchSource, } from './research.js';
-export { registerResearchRoutes, researchSearchRoute } from './research.js';
+export type { ResearchProvider, ResearchSearchRequest, ResearchHttpDeps, ResearchInternalErrorContext, ResearchProviderCredentials, ResearchSearchResponse, ResearchSource, } from './research.js';
+export { createResearchSearchRoute, registerResearchRoutes, researchSearchRoute } from './research.js';
 export type { MediaGenerateResponse, MediaHttpDeps, MediaInternalErrorContext, MediaTaskDeleteResponse, MediaTaskListResponse, MediaTaskResponse, } from './media.js';
 export { mediaGenerateRoute, mediaTaskDeleteRoute, mediaTaskGetRoute, mediaTaskListRoute, registerMediaRoutes, } from './media.js';
 export type { AttachmentClaim, AttachmentRejectionReason, AttachmentsHttpDeps, AttachmentsInternalErrorContext, AttachmentStore, AttachmentUploadResponse, CreateDiskAttachmentStoreOptions, ObservedAttachmentIdentity, PendingAttachmentSummary, RecordedAttachmentIdentity, StoredAttachment, } from './attachments.js';
@@ -49,4 +49,5 @@ export { ATTACHMENTS_ROUTE_PATH, AttachmentRejectedError, createDiskAttachmentSt
 export type { XaiAuthStatusResponse, XaiHttpDeps, XaiInternalErrorContext, XaiOauthStartResponse, XaiOkResponse, XaiSearchResponse, } from './xai.js';
 export { registerXaiRoutes, xaiAuthStatusRoute, xaiOauthCancelRoute, xaiOauthCompleteRoute, xaiOauthDisconnectRoute, xaiOauthStartRoute, xaiSearchRoute, } from './xai.js';
 export * from './run-credentials.js';
+export { createTavilyResearchProvider } from './research-tavily.adapter.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/http/index.js

@@ -3,7 +3,7 @@ export { cancelRunsOwnedBy } from './cancel-owned-runs.js';
 export { ACTIVE_CONTEXT_TTL_MS, getActiveRoute, registerActiveContextRoutes, setActiveRoute, } from './active-context.js';
 export { applicableForPlatform, CATALOGUE, currentPlatform, defaultProbeEnv, hostEditorsRoute, launchHostTool, listAvailableEditors, pathDirs, probeCommandOnPath, probeMacBundle, registerHostToolsRoutes, resolveEntry, resolveHostToolLaunchPlan, } from './host-tools.js';
 export { daemonShutdownRoute, daemonStatusRoute, registerDaemonStatusRoutes } from './daemon-status.js';
-export { registerRunEventStream, registerRunRoutes, RUN_EVENTS_ROUTE_PATH, runCancelRoute, runListRoute, runStartRoute, runStatusRoute, } from './runs.js';
+export { registerRunEventStream, registerRunRoutes, RUN_EVENTS_ROUTE_PATH, runCancelRoute, runListRoute, runMessageRoute, RUN_MESSAGE_MAX_CHARS, runStartRoute, runStatusRoute, } from './runs.js';
 export { JINI_ROUTE_MANIFEST, manifestRoutesForFamilies, routeFamilyManifest } from './route-manifest.js';
 export { agentListRoute, agentRescanRoute, registerAgentRoutes } from './agents.js';
 export { memoryClearExtractionsRoute, memoryClearVerificationsRoute, memoryCreateEntryRoute, memoryDeleteEntryRoute, memoryListExtractionsRoute, memoryListVerificationsRoute, memoryOverviewRoute, memoryReadEntryRoute, memoryRemoveExtractionRoute, memoryRemoveVerificationRoute, memoryTreeRoute, memoryUpdateEntryRoute, memoryUpdateTreeNodeRoute, memoryWriteConfigRoute, memoryWriteIndexRoute, registerMemoryEventStream, registerMemoryRoutes, } from './memory.js';
@@ -19,9 +19,10 @@ export { registerTerminalEventStream, registerTerminalRoutes, terminalCreateRout
 export { registerModelProxyRoutes } from './model-proxy.js';
 export { apiHealthRoute, apiReadyRoute, apiVersionInfoRoute, healthRoute, readyRoute, registerHealthRoutes, versionInfoRoute, } from './health.js';
 export { connectorsAuthSessionRoute, connectorsAuthSignInRoute, connectorsAuthSignOutRoute, connectorsAuthSignUpRoute, connectorsDbDeleteRoute, connectorsDbGetRoute, connectorsDbInsertRoute, connectorsDbQueryRoute, connectorsDbUpdateRoute, connectorsPaymentsChargeRoute, connectorsPaymentsGetRoute, connectorsPaymentsRefundRoute, connectorsRealtimePublishRoute, connectorsStorageDeleteRoute, connectorsStorageGetRoute, connectorsStorageListRoute, connectorsStoragePutRoute, registerConnectorsRoutes, } from './connectors.js';
-export { registerResearchRoutes, researchSearchRoute } from './research.js';
+export { createResearchSearchRoute, registerResearchRoutes, researchSearchRoute } from './research.js';
 export { mediaGenerateRoute, mediaTaskDeleteRoute, mediaTaskGetRoute, mediaTaskListRoute, registerMediaRoutes, } from './media.js';
 export { ATTACHMENTS_ROUTE_PATH, AttachmentRejectedError, createDiskAttachmentStore, detectAttachmentKind, handleAttachmentCleanup, handleAttachmentUpload, isUnchangedAttachment, registerAttachmentRoutes, sanitizeAttachmentName, writeBoundedAttachmentBody, } from './attachments.js';
 export { registerXaiRoutes, xaiAuthStatusRoute, xaiOauthCancelRoute, xaiOauthCompleteRoute, xaiOauthDisconnectRoute, xaiOauthStartRoute, xaiSearchRoute, } from './xai.js';
 export * from './run-credentials.js';
+export { createTavilyResearchProvider } from './research-tavily.adapter.js';
 //# sourceMappingURL=index.js.map

package/dist/http/research-tavily.adapter.d.ts

@@ -0,0 +1,6 @@
+import type { ResearchProvider } from './research.js';
+/** Creates today's transport with a host-owned fetch port. */
+export declare function createTavilyResearchProvider(_required: Record<string, never>, options?: {
+    fetch?: typeof globalThis.fetch;
+}): ResearchProvider;
+//# sourceMappingURL=research-tavily.adapter.d.ts.map

package/dist/http/research-tavily.adapter.js

@@ -0,0 +1,109 @@
+/** Tavily default adapter. Request limits, timeout and secret-redaction policy remain here. */
+import { validateBaseUrl } from '@jini-ai/agent-runtime';
+import { redactSecrets } from '@jini-ai/core';
+const DEFAULT_TAVILY_BASE_URL = 'https://api.tavily.com';
+/** Tavily's own documented cap on `max_results` (see OD's `tavily.ts#TAVILY_MAX_RESULTS_LIMIT`). */
+const TAVILY_MAX_RESULTS_LIMIT = 20;
+const DEFAULT_MAX_SOURCES = 5;
+/** Matches OD's own `tavily.ts` timeout — see research.ts's module doc. */
+const DEFAULT_TAVILY_TIMEOUT_MS = 30_000;
+/**
+ * Calls Tavily's real `POST /search` endpoint directly — see research.ts's module doc for the port's exact
+ * scope/provenance. Throws (never a `Result`) on any failure; the route handler in research.ts is the one
+ * place that converts a thrown error into the package's SEC-005 response shape.
+ *
+ * `apiKey` is a separate, non-optional parameter rather than being read off `credentials`, so the
+ * "credential is present" invariant is carried by the type system instead of by a runtime guard.
+ * This function used to take only `credentials` and re-check `credentials.apiKey` itself, but the
+ * route caller in research.ts already returns `NOT_CONFIGURED` before it ever gets here — the check was
+ * unreachable by construction, so it is now expressed as a required argument instead of dead code.
+ * `credentials` is still passed for its optional transport config (`baseUrl`).
+ */
+async function tavilySearch({ apiKey, credentials, request }, { fetch: fetchImpl = globalThis.fetch } = {}) {
+    const baseUrl = credentials.baseUrl ?? DEFAULT_TAVILY_BASE_URL;
+    const baseUrlCheck = validateBaseUrl({ baseUrl });
+    if (baseUrlCheck.error) {
+        throw new Error(baseUrlCheck.error);
+    }
+    const base = baseUrl.replace(/\/+$/, '');
+    // Floor before clamping, matching OD's real `clampMaxSources` — see research.ts's module doc. Without the
+    // floor, a fractional `maxSources` (e.g. `2.7`, or `0.5` before the `Math.max(1, ...)` floor
+    // below) would forward a non-integer `max_results` straight to Tavily's real API.
+    const maxResults = Math.max(1, Math.min(Math.floor(request.maxSources ?? DEFAULT_MAX_SOURCES), TAVILY_MAX_RESULTS_LIMIT));
+    const body = {
+        query: request.query,
+        search_depth: 'basic',
+        max_results: maxResults,
+        include_answer: true,
+        include_raw_content: false,
+    };
+    // The timeout must stay armed for the full operation, not just until `fetch` resolves —
+    // `fetch` resolves as soon as response headers arrive, before the body is read. A round-2
+    // external audit caught (and locally reproduced) an earlier version of this fix that cleared
+    // the timer right after `fetch` resolved, leaving `response.text()`/`response.json()` below
+    // completely unbounded against a server that sends headers promptly and then stalls the body.
+    //
+    // `TavilyHttpError` marks an error already redacted and formatted by the `!response.ok` branch
+    // below, so the outer catch can rethrow it verbatim instead of wrapping it a second time (which
+    // would otherwise produce a "Tavily request failed: Tavily 429: ..." double-prefixed message).
+    class TavilyHttpError extends Error {
+    }
+    const timeoutController = new AbortController();
+    const timeoutHandle = setTimeout(() => timeoutController.abort(), DEFAULT_TAVILY_TIMEOUT_MS);
+    // Assigned in the `try` and returned *after* the `finally`, rather than returned from inside the
+    // `try`. Both forms behave identically, but a return-through-`finally` compiles to three copies of
+    // the `finally` body (normal completion, return, throw) and one of those is unreachable here — the
+    // `try` cannot fall off its end and the `catch` always throws. Falling through to a single return
+    // keeps the cleanup path honestly measurable instead of permanently one-third uncovered.
+    let output;
+    try {
+        const response = await fetchImpl(`${base}/search`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', authorization: `Bearer ${apiKey}` },
+            body: JSON.stringify(body),
+            signal: timeoutController.signal,
+        });
+        if (!response.ok) {
+            const text = await response.text().catch(() => '');
+            throw new TavilyHttpError(redactSecrets({ input: `Tavily ${response.status}: ${text.slice(0, 200) || 'no body'}` }, { exactSecrets: [apiKey] }));
+        }
+        const json = (await response.json());
+        const answer = typeof json.answer === 'string' ? json.answer : '';
+        const rawResults = Array.isArray(json.results) ? json.results : [];
+        const sources = [];
+        for (const raw of rawResults) {
+            const url = typeof raw.url === 'string' ? raw.url : '';
+            if (!url)
+                continue;
+            const publishedAt = typeof raw.published_date === 'string' && raw.published_date.trim() ? raw.published_date.trim() : undefined;
+            sources.push({
+                title: typeof raw.title === 'string' && raw.title.trim() ? raw.title.trim() : url,
+                url,
+                snippet: typeof raw.content === 'string' ? raw.content.trim().slice(0, 800) : '',
+                provider: 'tavily',
+                ...(publishedAt ? { publishedAt } : {}),
+            });
+        }
+        output = { answer, sources };
+    }
+    catch (error) {
+        if (!timeoutController.signal.aborted && error instanceof TavilyHttpError) {
+            throw error;
+        }
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(redactSecrets({
+            input: timeoutController.signal.aborted
+                ? `Tavily request timed out after ${DEFAULT_TAVILY_TIMEOUT_MS}ms`
+                : `Tavily request failed: ${message}`,
+        }, { exactSecrets: [apiKey] }));
+    }
+    finally {
+        clearTimeout(timeoutHandle);
+    }
+    return output;
+}
+/** Creates today's transport with a host-owned fetch port. */
+export function createTavilyResearchProvider(_required, options = {}) {
+    return { id: 'tavily', search: (input) => tavilySearch(input, options) };
+}
+//# sourceMappingURL=research-tavily.adapter.js.map

package/dist/http/research.d.ts

@@ -25,7 +25,22 @@ export interface ResearchProviderCredentials {
     readonly baseUrl?: string;
     readonly model?: string;
 }
+/** Research transport contract: the route owns validation/HTTP errors; adapters own vendor I/O. */
+export interface ResearchProvider {
+    readonly id: string;
+    search(required: {
+        apiKey: string;
+        credentials: ResearchProviderCredentials;
+        request: ResearchSearchRequest;
+    }, optional: Record<string, never>): Promise<{
+        readonly answer: string;
+        readonly sources: readonly ResearchSource[];
+    }>;
+}
 export interface ResearchHttpDeps {
+    readonly provider?: ResearchProvider;
+    readonly fetch?: typeof globalThis.fetch;
+    readonly env?: Readonly<Record<string, string | undefined>>;
     /** Resolves per-provider credentials. Defaults to `TAVILY_API_KEY` for the built-in Tavily transport. */
     readonly resolveCredentials?: ({ providerId }: {
         providerId: string;
@@ -33,10 +48,14 @@ export interface ResearchHttpDeps {
     /** Host-owned sink for the real exception behind a generic `INTERNAL_ERROR` response (SEC-005). Defaults to `console.error`. */
     readonly onInternalError?: (context: ResearchInternalErrorContext) => void;
 }
-interface ResearchSearchRequest {
+export interface ResearchSearchRequest {
     readonly query: string;
     readonly maxSources?: number;
 }
+/** Builds one route over a host-selected provider, preserving the default Tavily validation contract. */
+export declare function createResearchSearchRoute({ provider }: {
+    provider?: ResearchProvider;
+}, _optional?: Record<string, never>): import("@jini-ai/http-kit").JsonRouteSpec<ResearchSearchRequest, ResearchSearchResponse, ResearchHttpDeps, undefined>;
 export declare const researchSearchRoute: import("@jini-ai/http-kit").JsonRouteSpec<ResearchSearchRequest, ResearchSearchResponse, ResearchHttpDeps, undefined>;
 /** Mounts `POST /api/research/search` on `app`. A pack's `http(app, services)` calls this directly. */
 export declare function registerResearchRoutes({ app, deps, adapter }: {
@@ -44,5 +63,4 @@ export declare function registerResearchRoutes({ app, deps, adapter }: {
     readonly deps: ResearchHttpDeps;
     readonly adapter: AdapterContext;
 }, _optional?: Record<string, never>): void;
-export {};
 //# sourceMappingURL=research.d.ts.map