@jini-ai/daemon 0.6.10 → 0.6.11

package/dist/agent-executor/launch.js

@@ -1,10 +1,12 @@
 import { buildAgentEnv } from './agent-env.js';
+import { randomUUID } from 'node:crypto';
+import { supportsMessageRelay } from './message-relay.js';
 import { probeMcpBridge } from './mcp-bridge-probe.js';
 import { spawn as nodeSpawn, } from 'node:child_process';
 import { promises as fsPromises, } from 'node:fs';
 import { tmpdir, } from 'node:os';
 import { join, } from 'node:path';
-import { agentCapabilities, bindRuntimeAgentDef, defaultRuntimeState, getRuntimeModelDiscoveryDeps, userToolchainBinDirs, applyAgentLaunchEnv, ensureAgentCapabilities, resolveModelForLaunch, getAgentDef, resolveAgentLaunch, attachAcpSession, attachPiRpcSession, checkPromptArgvBudget, checkWindowsCmdShimCommandLineBudget, checkWindowsDirectExeCommandLineBudget, prepareAgentLogFile, preparePromptFileForAgent, } from '@jini-ai/agent-runtime';
+import { agentCapabilities, assertClaudeFilesystemSupport, claudeFilesystemRuntimePaths, claudeFilesystemSettings, validateFilesystemLaunch, bindRuntimeAgentDef, defaultRuntimeState, getRuntimeModelDiscoveryDeps, userToolchainBinDirs, applyAgentLaunchEnv, ensureAgentCapabilities, resolveModelForLaunch, getAgentDef, resolveAgentLaunch, attachAcpSession, attachPiRpcSession, checkPromptArgvBudget, checkWindowsCmdShimCommandLineBudget, checkWindowsDirectExeCommandLineBudget, prepareAgentLogFile, preparePromptFileForAgent, } from '@jini-ai/agent-runtime';
 import { createCommandInvocation } from '@jini-ai/platform/command';
 import { collectProcessTreePids, listProcessSnapshots, stopProcesses, } from '@jini-ai/platform/process';
 import { applyImagePromptDelivery, } from '../image-prompt-delivery.js';
@@ -337,6 +339,10 @@ function nativeBuildOptions({ input, permissionMode }, _options = {}) {
 /** Preserve explicit empty restrictions and settings: they have meaning to the native CLI. */
 function settingsBuildOptions({ input }, _options = {}) {
     return {
+        ...(input.filesystemRoot !== undefined ? { filesystemRoot: input.filesystemRoot } : {}),
+        ...(input.filesystemSharedTempRoots ? { filesystemSharedTempRoots: input.filesystemSharedTempRoots } : {}),
+        ...(input.filesystemTempDir ? { filesystemTempDir: input.filesystemTempDir } : {}),
+        ...(input.filesystemRuntimeReadPaths ? { filesystemRuntimeReadPaths: input.filesystemRuntimeReadPaths } : {}),
         ...(input.disallowedTools !== undefined ? { disallowedTools: input.disallowedTools } : {}),
         ...(input.allowedTools !== undefined ? { allowedTools: input.allowedTools } : {}),
         ...(input.settingSources !== undefined ? { settingSources: input.settingSources } : {}),
@@ -678,6 +684,15 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
     const claudeConfigDirIsolation = options.claudeConfigDirIsolation;
     const claudeConfigDirIsolationEnabled = options.claudeConfigDirIsolationEnabled ?? false;
     const promptAugmenter = options.promptAugmenter;
+    const filesystemTemps = new Map();
+    /** Remove only this run's private temp directory, on startup failure or child cleanup. */
+    async function cleanupFilesystemTemp({ runId }, _optional = {}) {
+        const path = filesystemTemps.get(runId);
+        if (!path)
+            return;
+        await fsPromises.rm(path, { recursive: true, force: true }).catch(() => console.warn('[agent-executor] private temp cleanup failed'));
+        filesystemTemps.delete(runId);
+    }
     /**
      * Transitions `runId` to `'failed'` (idempotent, never resumable — no
      * classifier exists, see index.ts module doc) then rejects with a typed
@@ -698,6 +713,7 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         await lifecycle
             .emit({ runId: runId, input: { event: 'error', data: { message: `The assistant could not start: ${message.replace(/^AgentExecutor:\s*/, '')}` } } })
             .catch(() => undefined);
+        await cleanupFilesystemTemp({ runId }, {});
         await lifecycle.finish({ runId, status: 'failed', code: null, signal: null, resumable: false });
         throw new AgentExecutorError({ code: code, message: message });
     }
@@ -708,10 +724,12 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
      * finished or unknown run reads as `'not-running'`. Bounded by the number of live children.
      */
     const liveRunInputs = new Map();
+    const liveRunRelays = new Map();
+    const claimUserMessages = ({ runId, via }) => liveRunRelays.get(runId)?.claim({ via }) ?? [];
     /** `AgentExecutor.sendUserMessage()` — see that interface method's own doc. @complexity O(1). */
-    async function sendUserMessage({ runId, text }, { imageContents } = {}) {
+    async function sendUserMessage({ runId, text, id = randomUUID(), attachmentIds }, { imageContents } = {}) {
         const deliver = liveRunInputs.get(runId);
-        return deliver ? deliver(text, imageContents) : 'not-running';
+        return deliver ? deliver({ text, id, ...(attachmentIds ? { attachmentIds } : {}) }, imageContents ? { imageContents } : {}) : 'not-running';
     }
     /** Validates launch input and selects the definition synchronously before yielding. */
     async function prepareRunContext({ requiredArgs, optionalArgs }, _options = {}) {
@@ -731,6 +749,66 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
             return failBeforeSpawn({ runId: input.runId, code: 'NATIVE_TOOL_POLICY_UNSUPPORTED', message: 'This CLI has no native-tool policy and audit adapter. Choose a CLI with native-tool policy support.' });
         }
     }
+    /** Validate every directory after image augmentation, before model probes or resource staging.
+     * Unknown containment fails this run; O(n) filesystem checks for n attachment directories.
+     */
+    async function enforceFilesystemPaths({ input, imageDelivery }, _options = {}) {
+        if (input.filesystemRoot === undefined)
+            return;
+        try {
+            input.filesystemRoot = validateFilesystemLaunch({ filesystemRoot: input.filesystemRoot, cwd: input.cwd,
+                ...(imageDelivery.extraAllowedDirs ? { extraAllowedDirs: imageDelivery.extraAllowedDirs } : {}),
+                ...(input.imagePaths ? { imagePaths: input.imagePaths } : {}),
+            }, {});
+            input.cwd = input.filesystemRoot;
+        }
+        catch {
+            return failBeforeSpawn({ runId: input.runId, code: 'FILESYSTEM_POLICY_INVALID', message: 'Folder-limited launch refused: invalid filesystem root, working directory or attachment path.' });
+        }
+    }
+    /** Apply supported confinement without removing providers; unknown versions keep the settings.
+     * Runtime and git config reads are explicit infrastructure exceptions; network is unchanged.
+     * O(1) metadata/staging I/O plus the cached, bounded version probe.
+     */
+    async function enforceFilesystemRuntime({ input, def, launch, spawnEnv }, _options = {}) {
+        if (input.filesystemRoot === undefined)
+            return;
+        try {
+            const verify = options.assertClaudeFilesystemSupport ?? assertClaudeFilesystemSupport;
+            const supported = await verify({ agentId: def.id, launchPath: launch.launchPath, env: spawnEnv }, {});
+            const runtimeDir = join(input.filesystemRoot, '.agent-runtime');
+            await fsPromises.mkdir(runtimeDir, { recursive: true, mode: 0o700 });
+            // Refuse a runtime-folder symlink escaping the site before creating anything beneath it.
+            validateFilesystemLaunch({ filesystemRoot: input.filesystemRoot, cwd: input.cwd, extraAllowedDirs: [runtimeDir] }, {});
+            input.filesystemTempDir = await fsPromises.realpath(await fsPromises.mkdtemp(join(runtimeDir, 'tmp-')));
+            filesystemTemps.set(input.runId, input.filesystemTempDir);
+            // Recheck after creation too: swapping the runtime symlink must never grant outside temp access.
+            validateFilesystemLaunch({ filesystemRoot: input.filesystemRoot, cwd: input.cwd, extraAllowedDirs: [input.filesystemTempDir] }, {});
+            input.filesystemSharedTempRoots = [spawnEnv.TMPDIR, spawnEnv.TMP, spawnEnv.TEMP].filter((path) => Boolean(path));
+            spawnEnv.TMPDIR = input.filesystemTempDir;
+            spawnEnv.TMP = input.filesystemTempDir;
+            spawnEnv.TEMP = input.filesystemTempDir;
+            if (supported === false) {
+                input.filesystemNotice = 'files and shell are not folder-limited for this agent';
+                console.warn('[agent-executor] files and shell are not folder-limited for this agent');
+                // Personal Claude hooks/permissions stay excluded even on an unconfined CLI fallback.
+                if (def.id === 'claude')
+                    input.settingSources = [];
+                delete input.filesystemRoot;
+                return;
+            }
+            if (supported === undefined)
+                console.warn('[agent-executor] filesystem capability unknown; applying read block and sandbox settings');
+            input.filesystemRuntimeReadPaths = claudeFilesystemRuntimePaths({ launchPath: launch.launchPath }, {});
+            // Validates host settings here so a malformed value fails cleanly; buildArgs merges again (idempotent).
+            input.settings = claudeFilesystemSettings({ options: input }, {});
+            // A login environment can otherwise force auto-memory back on despite the host setting.
+            spawnEnv.CLAUDE_CODE_DISABLE_AUTO_MEMORY = '1';
+        }
+        catch {
+            return failBeforeSpawn({ runId: input.runId, code: 'FILESYSTEM_POLICY_UNSUPPORTED', message: 'Folder-limited launch refused: invalid host settings or private runtime directory.' });
+        }
+    }
     function resolveRunOverlay({ input, def, imageDelivery }, _options = {}) {
         // Phase 8, hoisted deliberately above EVERY step that writes or sends the prompt. Four
         // different channels carry a prompt in this driver, and they do not all run at the same point:
@@ -751,7 +829,8 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         // same overlay on every turn, not a first-turn-only one; a caller that needs finer-grained turn
         // numbering can track it itself and ignore this arg.
         const preStagingRuntimeContext = computeRuntimeContext({ preparedPromptFile: null, preparedLogFile: null, mcpBridge: null }, sessionRuntimeContext(input, {}));
-        const systemPromptOverlay = computeSystemPromptOverlay(promptAugmenter, def.id);
+        const hostOverlay = computeSystemPromptOverlay(promptAugmenter, def.id);
+        const systemPromptOverlay = input.filesystemNotice ? `${hostOverlay ?? ''}\n${input.filesystemNotice}\n` : hostOverlay;
         const overlayDelivery = resolveSystemPromptOverlayDelivery({
             defId: def.id,
             systemPromptDelivery: def.systemPromptDelivery,
@@ -805,6 +884,7 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         const formatForStdin = { streamFormat };
         const stdinHandle = isStdinDrivenFormat(formatForStdin)
             ? wireChildLifecycle({
+                ...(mcpBridge && supportsMessageRelay({ def }) ? { registerMessageRelay: (relay) => liveRunRelays.set(input.runId, relay) } : {}),
                 ...(input.model ? { startingModel: input.model } : {}),
                 ...(modelCatalog ? { modelCatalog } : {}),
                 runId: input.runId,
@@ -831,8 +911,10 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         // Registered with the lifecycle wiring above, before the spawn-confirmation await, so a child
         // that closes immediately never leaves a stale entry behind.
         const runId = input.runId;
-        liveRunInputs.set(runId, stdinHandle ? stdinHandle.sendUserMessage : async () => 'unsupported');
-        child.once('close', () => liveRunInputs.delete(runId));
+        liveRunInputs.set(runId, stdinHandle ? stdinHandle.sendUserMessage : async ({ text, id = randomUUID(), attachmentIds }, { imageContents } = {}) => {
+            return liveRunRelays.get(runId)?.enqueue({ id, text, hasAttachments: (attachmentIds?.length ?? 0) > 0 || (imageContents?.length ?? 0) > 0 }) ?? 'unsupported';
+        });
+        child.once('close', () => { liveRunInputs.delete(runId); liveRunRelays.delete(runId); });
         return stdinHandle;
     }
     async function dispatchAcpPrompt({ input, def, child, modelCatalog, cleanupStagedFiles, releaseStagedResources, mcpBridge, overlayDelivery }, _options = {}) {
@@ -859,6 +941,7 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
             }, deps: {
                 lifecycle,
                 attachAcpSession: attachAcpSessionFn,
+                ...(mcpBridge && supportsMessageRelay({ def }) ? { registerMessageRelay: (relay) => liveRunRelays.set(input.runId, relay) } : {}),
                 onPermissionRequest: options.acpPermissionHandler,
                 listProcessSnapshots: listProcessSnapshotsFn,
                 collectProcessTreePids: collectProcessTreePidsFn,
@@ -939,8 +1022,10 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         // treatment (the double-delivery hazard this mechanism exists to avoid).
         await enforceNativeToolPolicy({ input, def }, {});
         const imageDelivery = await resolveImageDeliveryAndArgvBudget({ input: { runId: input.runId, def, prompt: input.prompt, imagePaths: input.imagePaths, extraAllowedDirs: input.extraAllowedDirs }, deps: { failBeforeSpawn } });
-        const { systemPromptOverlay, overlayDelivery } = resolveRunOverlay({ input, def, imageDelivery }, {});
+        await enforceFilesystemPaths({ input, imageDelivery }, {});
         const { launch, spawnEnv } = await resolveRunLaunch({ input, def }, {});
+        await enforceFilesystemRuntime({ input, def, launch, spawnEnv }, {});
+        const { systemPromptOverlay, overlayDelivery } = resolveRunOverlay({ input, def, imageDelivery }, {});
         const modelCatalog = await selectRunModel({ input, def, launch, spawnEnv }, {});
         // Fill the def's `--help` capability gate before `buildArgs` reads it. Without this, only a
         // host that happened to call `detectAgents` in THIS process ever had the gate filled, so e.g.
@@ -998,6 +1083,7 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
          */
         let preparedSystemPromptOverlayFile = null;
         const cleanupStagedFiles = async () => {
+            await cleanupFilesystemTemp({ runId: input.runId }, {});
             if (preparedPromptFile)
                 await preparedPromptFile.cleanup();
             if (preparedLogFile)
@@ -1130,6 +1216,7 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         }
         catch (error) {
             liveRunInputs.delete(runId);
+            liveRunRelays.delete(runId);
             throw error;
         }
         // Now — and only now — is there a live process that could consume the locked side effect, so
@@ -1146,6 +1233,6 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         }
         dispatchStdinPrompt({ input, def, child, overlayDelivery, imageDelivery, stdinHandle }, {});
     }
-    return { run, sendUserMessage };
+    return { run, sendUserMessage, claimUserMessages };
 }
 //# sourceMappingURL=launch.js.map

package/dist/agent-executor/live-session-state.d.ts

@@ -0,0 +1,23 @@
+import type { RunAgentPayload } from '@jini-ai/protocol';
+/** Per-process receipts and task projection for the existing stdin lifecycle. O(p + t) retained
+ * state for pending inputs and observed tasks; each frame is O(frame size + affected tasks).
+ * The injected emitter uses the lifecycle's existing FIFO, preserving ordering with tool output.
+ */
+export declare function createLiveSessionState({ emit }: {
+    emit: (payload: RunAgentPayload) => void;
+}, _options?: {}): {
+    queue({ id, text }: {
+        id: string;
+        text: string;
+    }): void;
+    observe: ({ line }: {
+        line: string;
+    }) => {
+        result: boolean;
+        startedInput: boolean;
+    };
+    hasPendingInput: () => boolean;
+    backgroundTaskCount: () => number;
+    endSession(): void;
+};
+//# sourceMappingURL=live-session-state.d.ts.map

package/dist/agent-executor/live-session-state.js

@@ -0,0 +1,155 @@
+import { isRecord } from './values.js';
+/** Parse only records; malformed stdout remains the stream parser's responsibility. */
+function frameRecord(line) {
+    try {
+        const value = JSON.parse(line);
+        return isRecord(value) ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** UUID attribution is a consumption receipt; an echoed user line or HTTP 202 is not. */
+function consumedIds(frame) {
+    if (!['assistant', 'stream_event', 'result'].includes(String(frame.type)))
+        return [];
+    const ids = Array.isArray(frame.user_message_uuids) ? frame.user_message_uuids : [frame.user_message_uuid];
+    return ids.filter((id) => typeof id === 'string');
+}
+/** Preserve unknown task outcomes rather than guessing success or who stopped them. */
+function taskStatus(value) {
+    if (value === 'killed')
+        return 'stopped';
+    if (value === 'running' || value === 'completed' || value === 'failed' || value === 'stopped')
+        return value;
+    return 'unknown';
+}
+/** Per-process receipts and task projection for the existing stdin lifecycle. O(p + t) retained
+ * state for pending inputs and observed tasks; each frame is O(frame size + affected tasks).
+ * The injected emitter uses the lifecycle's existing FIFO, preserving ordering with tool output.
+ */
+export function createLiveSessionState({ emit }, _options = {}) {
+    const pending = new Map();
+    // Ids written since the last result. Only these and the CLI's own queued_turn_count hold stdin:
+    // a CLI that never attributes a receipt must not keep the run open forever. Closing after a
+    // result is safe for a line still in the pipe: the CLI answers everything written before EOF.
+    const unanswered = new Set();
+    const tasks = new Map();
+    let queuedTurns = 0;
+    let backgroundTasks = 0;
+    function publishTask(task) {
+        tasks.set(task.id, task);
+        const { local: _local, ...payload } = task;
+        emit(payload);
+    }
+    function taskDetails(frame, previous) {
+        const patch = isRecord(frame.patch) ? frame.patch : frame;
+        const description = typeof patch.description === 'string' ? patch.description : previous?.description;
+        const detail = typeof frame.summary === 'string' ? frame.summary : previous?.detail;
+        const local = frame.task_type === 'local_agent' || typeof frame.subagent_type === 'string' || previous?.local === true;
+        return { local, ...(description === undefined ? {} : { description }), ...(detail === undefined ? {} : { detail }) };
+    }
+    function nextTaskStatus(frame, previous) {
+        if (frame.subtype === 'task_started')
+            return 'running';
+        const patch = isRecord(frame.patch) ? frame.patch : frame;
+        if (patch.status === undefined)
+            return previous?.status ?? 'unknown';
+        return taskStatus(patch.status);
+    }
+    /** Older task runs and duplicate starts cannot overwrite a confirmed terminal receipt. */
+    function staleTaskUpdate(previous, taskRunId, status) {
+        if (!previous)
+            return false;
+        // The CLI mints run ids as zero-padded base36 time plus random hex, so they sort by start.
+        if (previous.taskRunId && taskRunId && taskRunId < previous.taskRunId)
+            return true;
+        const terminal = ['completed', 'failed', 'stopped'].includes(previous.status);
+        return terminal && previous.taskRunId === taskRunId && status === 'running';
+    }
+    function updateTask(frame) {
+        if (typeof frame.task_id !== 'string')
+            return;
+        const previous = tasks.get(frame.task_id);
+        const taskRunId = typeof frame.run_id === 'string' ? frame.run_id : previous?.taskRunId;
+        const status = nextTaskStatus(frame, previous);
+        // Resumed tasks reuse task_id. A late frame from an older run cannot stop its replacement.
+        if (staleTaskUpdate(previous, taskRunId, status))
+            return;
+        publishTask({ type: 'background_task', id: frame.task_id, status, ...taskDetails(frame, previous),
+            ...(taskRunId === undefined ? {} : { taskRunId }) });
+    }
+    function updateMembership(frame) {
+        if (!Array.isArray(frame.tasks))
+            return;
+        backgroundTasks = frame.tasks.length;
+        const listed = new Set();
+        for (const task of frame.tasks) {
+            if (!isRecord(task))
+                continue;
+            if (typeof task.task_id === 'string')
+                listed.add(task.task_id);
+            updateTask({ ...task, subtype: 'task_started' });
+        }
+        // Level and edge notifications have unspecified ordering. Disappearance proves neither
+        // completion nor cancellation; a later task_notification supplies the actual outcome.
+        for (const task of tasks.values()) {
+            if (task.status === 'running' && !listed.has(task.id))
+                publishTask({ ...task, status: 'unknown', detail: 'status unknown' });
+        }
+    }
+    function consume(frame) {
+        let consumed = false;
+        for (const id of consumedIds(frame)) {
+            const text = pending.get(id);
+            if (text === undefined)
+                continue;
+            pending.delete(id);
+            unanswered.delete(id);
+            emit({ type: 'user_message', id, text, deliveryState: 'consumed' });
+            consumed = true;
+        }
+        return consumed;
+    }
+    function observe({ line }) {
+        const frame = frameRecord(line);
+        if (!frame)
+            return { result: false, startedInput: false };
+        const consumed = consume(frame);
+        if (frame.type === 'result') {
+            queuedTurns = typeof frame.queued_turn_count === 'number' ? Math.max(0, frame.queued_turn_count) : 0;
+            unanswered.clear();
+        }
+        if (frame.type === 'system')
+            observeSystem(frame);
+        return { result: frame.type === 'result', startedInput: consumed && frame.type !== 'result' };
+    }
+    function observeSystem(frame) {
+        if (frame.subtype === 'background_tasks_changed')
+            updateMembership(frame);
+        if (['task_started', 'task_notification', 'task_updated'].includes(String(frame.subtype)))
+            updateTask(frame);
+    }
+    return {
+        queue({ id, text }) {
+            pending.set(id, text);
+            unanswered.add(id);
+            emit({ type: 'user_message', id, text, deliveryState: 'queued' });
+        },
+        observe,
+        hasPendingInput: () => unanswered.size > 0 || queuedTurns > 0,
+        backgroundTaskCount: () => backgroundTasks,
+        endSession() {
+            for (const task of tasks.values()) {
+                if (task.status !== 'running' && task.status !== 'unknown')
+                    continue;
+                // A task already missing from membership may have completed without a receipt. Only
+                // a still-running, process-local subagent is known to stop with this session.
+                const stopped = task.local && task.status === 'running';
+                publishTask({ ...task, status: stopped ? 'stopped' : 'unknown',
+                    detail: stopped ? 'Stopped because the agent session ended' : 'status unknown' });
+            }
+        },
+    };
+}
+//# sourceMappingURL=live-session-state.js.map

package/dist/agent-executor/mcp-bridge.d.ts

@@ -34,8 +34,9 @@ export declare function bridgeUnavailableMessage(status: string, probe?: McpBrid
 export declare function buildMcpJsonServerEntry({ runId, options }: {
     readonly runId: string;
     readonly options: Pick<McpJsonInjectionOptions, 'command' | 'args' | 'daemonUrl' | 'env' | 'diagnosticToolIds' | 'startupToolIds'>;
-}, { credential }?: {
+}, { credential, messageRelayNonce }?: {
     readonly credential?: string;
+    readonly messageRelayNonce?: string;
 }): McpJsonServerEntry;
 /**
  * Merges {@link JINI_MCP_SERVER_KEY} into an existing `.mcp.json`'s `mcpServers` map, preserving
@@ -235,6 +236,7 @@ export declare function buildMcpBridgeDelivery(input: {
     readonly strategy: RuntimeAgentDef['externalMcpInjection'];
     readonly options: McpJsonInjectionOptions | undefined;
     readonly credential: string | undefined;
+    readonly messageRelayNonce?: string;
 }): McpBridgeDelivery | null;
 export declare function defaultRemoveMcpJsonFile({ path }: {
     readonly path: string;

package/dist/agent-executor/mcp-bridge.js

@@ -1,4 +1,6 @@
 import { promises as fsPromises, } from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import { supportsMessageRelay } from './message-relay.js';
 import { ensureAntigravityMcpPermission } from './antigravity-permissions.js';
 import { homedir, tmpdir, } from 'node:os';
 import { join, resolve, } from 'node:path';
@@ -46,7 +48,7 @@ export function bridgeUnavailableMessage(status, probe) {
  * entirely. Omitting produces byte-identical output to before this parameter existed.
  * @complexity O(t) output space/time for t launch environment and registered ID bytes.
  */
-export function buildMcpJsonServerEntry({ runId, options }, { credential } = {}) {
+export function buildMcpJsonServerEntry({ runId, options }, { credential, messageRelayNonce } = {}) {
     const hostEnv = Object.entries(options.env ?? {}).filter(([key]) => !key.startsWith('JINI_'));
     return {
         command: options.command,
@@ -58,6 +60,7 @@ export function buildMcpJsonServerEntry({ runId, options }, { credential } = {})
             ...(options.diagnosticToolIds ? { JINI_DIAGNOSTIC_TOOL_IDS: JSON.stringify(options.diagnosticToolIds()) } : {}),
             ...(options.startupToolIds ? { JINI_STARTUP_TOOL_IDS: JSON.stringify(options.startupToolIds({ runId })) } : {}),
             ...(credential !== undefined ? { JINI_DAEMON_TOKEN: credential } : {}),
+            ...(messageRelayNonce ? { JINI_MESSAGE_RELAY: '1', JINI_MESSAGE_RELAY_NONCE: messageRelayNonce } : {}),
         },
     };
 }
@@ -479,7 +482,10 @@ export function buildMcpBridgeDelivery(input) {
     const { cwd, runId, strategy, options, credential } = input;
     if (options === undefined || strategy === undefined)
         return null;
-    const serverEntry = buildMcpJsonServerEntry({ runId: runId, options: options }, credential === undefined ? {} : { credential });
+    const serverEntry = buildMcpJsonServerEntry({ runId: runId, options: options }, {
+        ...(credential === undefined ? {} : { credential }),
+        ...(input.messageRelayNonce ? { messageRelayNonce: input.messageRelayNonce } : {}),
+    });
     switch (strategy) {
         case 'claude-mcp-json':
             return { kind: 'claude-mcp-json', mcpJsonPath: mcpJsonPathForRun(cwd, runId), serverEntry };
@@ -789,6 +795,7 @@ export async function resolveMcpBridgeForRun({ input, deps }) {
             strategy: input.def.externalMcpInjection,
             options: deps.mcpJsonInjection,
             credential,
+            ...(supportsMessageRelay({ def: input.def }) ? { messageRelayNonce: randomBytes(24).toString('hex') } : {}),
         });
         if (input.def.id === 'antigravity' && delivery?.kind === 'env-passthrough') {
             await (deps.ensureAntigravityMcpPermission ?? ensureAntigravityMcpPermission)({

package/dist/agent-executor/message-relay.d.ts

@@ -0,0 +1,39 @@
+import type { RuntimeAgentDef } from '@jini-ai/agent-runtime';
+import type { RunAgentPayload, RelayedUserMessage, MessageRelayVia } from '@jini-ai/protocol';
+export interface RunMessageRelay {
+    enqueue(input: {
+        id: string;
+        text: string;
+        hasAttachments: boolean;
+    }): 'delivered' | 'not-running';
+    claim(input: {
+        via: MessageRelayVia;
+    }): readonly RelayedUserMessage[];
+    close(): void;
+}
+/**
+ * Whether a def's live process can take another user message mid-run: only a stream-json stdin
+ * transport keeps stdin open for more JSONL user lines (see `RuntimeAgentDef.promptInputFormat`).
+ * Deliberately not `resolveContinuationTransport`: that answers how a tool result gets back, and
+ * reports `'mcp-callback'` for Claude even though its stdin takes user lines all the same.
+ * Native stream-json input wins even when the engine also has MCP.
+ */
+export declare function acceptsMidRunUserMessages({ def }: {
+    def: RuntimeAgentDef;
+}, _options?: {}): boolean;
+/** A definition without an injected MCP bridge must retain next-turn fallback. */
+export declare function supportsMessageRelay({ def }: {
+    def: RuntimeAgentDef;
+}, _options?: {}): boolean;
+/** One synchronous FIFO claim per process: parallel tool results get disjoint prefixes.
+ * The browser retains the fallback copy until the emitted consumption receipt arrives.
+ * @param emit - Enqueues receipts on the driver's existing lifecycle FIFO; never waits on I/O.
+ * @returns A text-only inbox, closed synchronously before the driver's terminal event.
+ * @complexity O(n) retained messages; each claim scans its prefix and removes it in one splice.
+ */
+export declare function createMessageRelay({ emit }: {
+    emit: (payload: RunAgentPayload) => void;
+}, { maxChars }?: {
+    maxChars?: number;
+}): RunMessageRelay;
+//# sourceMappingURL=message-relay.d.ts.map

package/dist/agent-executor/message-relay.js

@@ -0,0 +1,56 @@
+/**
+ * Whether a def's live process can take another user message mid-run: only a stream-json stdin
+ * transport keeps stdin open for more JSONL user lines (see `RuntimeAgentDef.promptInputFormat`).
+ * Deliberately not `resolveContinuationTransport`: that answers how a tool result gets back, and
+ * reports `'mcp-callback'` for Claude even though its stdin takes user lines all the same.
+ * Native stream-json input wins even when the engine also has MCP.
+ */
+export function acceptsMidRunUserMessages({ def }, _options = {}) {
+    return def.promptViaStdin === true && def.promptInputFormat === 'stream-json';
+}
+/** A definition without an injected MCP bridge must retain next-turn fallback. */
+export function supportsMessageRelay({ def }, _options = {}) {
+    return def.externalMcpInjection !== undefined && !acceptsMidRunUserMessages({ def });
+}
+/** One synchronous FIFO claim per process: parallel tool results get disjoint prefixes.
+ * The browser retains the fallback copy until the emitted consumption receipt arrives.
+ * @param emit - Enqueues receipts on the driver's existing lifecycle FIFO; never waits on I/O.
+ * @returns A text-only inbox, closed synchronously before the driver's terminal event.
+ * @complexity O(n) retained messages; each claim scans its prefix and removes it in one splice.
+ */
+export function createMessageRelay({ emit }, { maxChars = 32_000 } = {}) {
+    const pending = [];
+    let seq = 0;
+    let closed = false;
+    return {
+        enqueue({ id, text, hasAttachments }) {
+            if (closed)
+                return 'not-running';
+            pending.push({ id, text, hasAttachments, seq: ++seq });
+            emit({ type: 'user_message', id, text, deliveryState: 'queued' });
+            return 'delivered';
+        },
+        claim({ via }) {
+            if (closed)
+                return [];
+            let count = 0;
+            let chars = 0;
+            for (const message of pending) {
+                if (message.hasAttachments)
+                    break;
+                const size = JSON.stringify({ id: message.id, seq: message.seq, text: message.text }).length;
+                // Whole messages only; a single oversized message is delivered alone.
+                if (count > 0 && chars + size > maxChars)
+                    break;
+                chars += size;
+                count++;
+            }
+            return pending.splice(0, count).map(({ id, seq, text }) => {
+                emit({ type: 'user_message', id, text, deliveryState: 'consumed', via });
+                return { id, seq, text };
+            });
+        },
+        close() { closed = true; pending.length = 0; },
+    };
+}
+//# sourceMappingURL=message-relay.js.map

package/dist/core/read-only-tools.d.ts

@@ -55,6 +55,8 @@ export interface ReadOnlyToolMessages {
 }
 export interface ReadOnlyToolCheckRequired {
     readonly toolId: string;
+    /** Diagnostic selector only; never changes which registration is checked or executed. */
+    readonly input?: unknown;
     readonly registry: Pick<ToolRegistry, 'list'> | undefined;
     readonly messages: ReadOnlyToolMessages;
 }
@@ -94,8 +96,9 @@ export declare function readOnlyToolRefusalMessage({ toolId, messages }: {
 /**
  * Single read-only registration decision, shared by routes and inner dispatch.
  * @returns Null for an explicitly read-only registration, otherwise host refusal text.
+ * @complexity O(n) for known tools; unknown-tool diagnostics add bounded name scoring and O(n log n) sorting.
  */
-export declare function checkReadOnlyTool({ toolId, registry, messages }: ReadOnlyToolCheckRequired, _optional?: Record<string, never>): string | null;
+export declare function checkReadOnlyTool({ toolId, input, registry, messages }: ReadOnlyToolCheckRequired, _optional?: Record<string, never>): string | null;
 /**
  * THE read-only dispatch decision for any tool id a consumer's own `ToolExecutor` composition is
  * about to invoke — the outer call the route already checked, or a nested one a decorator issues
@@ -110,8 +113,9 @@ export declare function checkReadOnlyTool({ toolId, registry, messages }: ReadOn
  * @param required.registry - Descriptors to resolve `toolId` against; `undefined` ⇒ refuse (an
  *   unverifiable constrained dispatch is refused, never waived, matching `checkReadOnlyTool`).
  * @returns `null` when the dispatch may proceed, otherwise the refusal text to report.
- * @complexity O(1) for an unconstrained principal; O(n) in registered tool count for a constrained
- *   one, since `ToolRegistry` exposes enumeration rather than lookup by id.
+ * @complexity O(1) for an unconstrained principal; O(n) in registered tool count for a known tool,
+ *   since `ToolRegistry` exposes enumeration rather than lookup by id. Unknown ids also incur
+ *   the bounded similarity scoring and sorting cost documented by `toolCandidates`.
  */
 export declare function refuseNonReadOnlyDispatch(required: ReadOnlyToolCheckRequired & {
     readonly principal: Principal;
@@ -147,7 +151,8 @@ export declare function readOnlyRemedyRefusalMessage({ refusal, formatMessage }:
  *
  * @returns A drop-in `ToolExecutor`; `resumeConfirmation`/`cancel`/`getAuditRecord` delegate
  *   straight through.
- * @complexity One extra property read per unconstrained call; one registry scan per constrained one.
+ * @complexity One extra property read per unconstrained call; one registry scan per constrained one,
+ *   plus bounded similarity scoring and sorting for an unknown id.
  */
 export declare function withReadOnlyToolConstraint({ inner, registry, idGenerator, messages }: ReadOnlyToolConstraintRequired, _optional?: Record<string, never>): ToolExecutor;
 //# sourceMappingURL=read-only-tools.d.ts.map

package/dist/core/read-only-tools.js

@@ -60,14 +60,15 @@ export function readOnlyToolRefusalMessage({ toolId, messages }, _optional = {})
 /**
  * Single read-only registration decision, shared by routes and inner dispatch.
  * @returns Null for an explicitly read-only registration, otherwise host refusal text.
+ * @complexity O(n) for known tools; unknown-tool diagnostics add bounded name scoring and O(n log n) sorting.
  */
-export function checkReadOnlyTool({ toolId, registry, messages }, _optional = {}) {
+export function checkReadOnlyTool({ toolId, input, registry, messages }, _optional = {}) {
     if (registry === undefined)
         return messages.unverifiableMessage;
     const tools = registry.list({});
     const descriptor = tools.find((candidate) => candidate.id === toolId);
     if (!descriptor)
-        return messages.unknownToolMessage({ toolId, candidates: toolCandidates({ toolId, tools }) });
+        return messages.unknownToolMessage({ toolId, candidates: toolCandidates({ toolId, tools, input }) });
     if (isReadOnlyTool({ descriptor }))
         return null;
     return readOnlyToolRefusalMessage({ toolId, messages });
@@ -86,8 +87,9 @@ export function checkReadOnlyTool({ toolId, registry, messages }, _optional = {}
  * @param required.registry - Descriptors to resolve `toolId` against; `undefined` ⇒ refuse (an
  *   unverifiable constrained dispatch is refused, never waived, matching `checkReadOnlyTool`).
  * @returns `null` when the dispatch may proceed, otherwise the refusal text to report.
- * @complexity O(1) for an unconstrained principal; O(n) in registered tool count for a constrained
- *   one, since `ToolRegistry` exposes enumeration rather than lookup by id.
+ * @complexity O(1) for an unconstrained principal; O(n) in registered tool count for a known tool,
+ *   since `ToolRegistry` exposes enumeration rather than lookup by id. Unknown ids also incur
+ *   the bounded similarity scoring and sorting cost documented by `toolCandidates`.
  */
 export function refuseNonReadOnlyDispatch(required, _optional = {}) {
     if (!principalIsReadOnlyConstrained({ principal: required.principal }))
@@ -127,13 +129,14 @@ export function readOnlyRemedyRefusalMessage({ refusal, formatMessage }, _option
  *
  * @returns A drop-in `ToolExecutor`; `resumeConfirmation`/`cancel`/`getAuditRecord` delegate
  *   straight through.
- * @complexity One extra property read per unconstrained call; one registry scan per constrained one.
+ * @complexity One extra property read per unconstrained call; one registry scan per constrained one,
+ *   plus bounded similarity scoring and sorting for an unknown id.
  */
 export function withReadOnlyToolConstraint({ inner, registry, idGenerator, messages }, _optional = {}) {
     return {
         execute: async (requiredArgs, optionalArgs = {}) => {
-            const { principal, toolId } = requiredArgs;
-            const refusal = refuseNonReadOnlyDispatch({ principal, toolId, registry, messages });
+            const { principal, toolId, input } = requiredArgs;
+            const refusal = refuseNonReadOnlyDispatch({ principal, toolId, input, registry, messages });
             // Deny before inner: no handler or kernel audit record exists. Use the authorization result
             // union instead of throwing, and mint a denial ID because there is no inner execution ID.
             if (refusal !== null)