@jini-ai/daemon 0.6.10 → 0.6.12

package/dist/core/tool-candidates.d.ts

@@ -1,8 +1,13 @@
 import type { ToolDescriptor } from '@jini-ai/core';
-/** Registered prefix matches for unknown-tool diagnostics, in catalog order, capped at eight.
- * @complexity O(n) time and space over n registered tools. */
-export declare function toolCandidates({ toolId, tools }: {
+/** Registered prefix/near-name suggestions, closest first and capped at eight. Equal scores keep
+ * catalog order; an exact content_read.<resource> takes priority even beyond the old cutoff.
+ * Suggestions grant no execution authority; the caller must retry through the existing gates.
+ * @example toolCandidates({ toolId: 'content_read', input: { resource: 'theme' }, tools });
+ * @complexity O(n*l*r + n log n) time, O(n + r) space; scoring lengths capped at 128.
+ */
+export declare function toolCandidates({ toolId, tools, input }: {
     toolId: string;
     tools: readonly Pick<ToolDescriptor, 'id'>[];
+    input?: unknown;
 }, _optional?: Record<string, never>): string[];
 //# sourceMappingURL=tool-candidates.d.ts.map

package/dist/core/tool-candidates.js

@@ -1,6 +1,41 @@
-/** Registered prefix matches for unknown-tool diagnostics, in catalog order, capped at eight.
- * @complexity O(n) time and space over n registered tools. */
-export function toolCandidates({ toolId, tools }, _optional = {}) {
-    return tools.map((tool) => tool.id).filter((id) => id.startsWith(toolId)).slice(0, 8);
+/** Bounded Levenshtein distance for diagnostic ranking; oversized names retain prefix discovery.
+ * @returns Edit count, or Infinity above the 128-character scoring limit (no effects).
+ * @complexity O(l*r) time and O(r) space, with both name lengths capped at 128.
+ */
+function nameDistance({ left, right }, _options = {}) {
+    if (left.length > 128 || right.length > 128)
+        return Infinity;
+    let previous = Array.from({ length: right.length + 1 }, (_, index) => index);
+    for (let row = 1; row <= left.length; row++) {
+        const current = [row];
+        for (let column = 1; column <= right.length; column++) {
+            current[column] = Math.min(current[column - 1] + 1, previous[column] + 1, previous[column - 1] + Number(left[row - 1] !== right[column - 1]));
+        }
+        previous = current;
+    }
+    return previous[right.length];
+}
+/** Use content_read's explicit resource selector only as a diagnostic hint, never a dispatch.
+ * @returns The target spelling to rank against; malformed selectors use the original tool id.
+ * @complexity O(r) to join an r-character selector; no mutation or effects. Name scoring is bounded separately.
+ */
+function candidateTarget({ toolId, input }, _options = {}) {
+    if (toolId !== 'content_read' || typeof input !== 'object' || input === null || Array.isArray(input))
+        return toolId;
+    const resource = input.resource;
+    return typeof resource === 'string' && resource.length > 0 ? `${toolId}.${resource}` : toolId;
+}
+/** Registered prefix/near-name suggestions, closest first and capped at eight. Equal scores keep
+ * catalog order; an exact content_read.<resource> takes priority even beyond the old cutoff.
+ * Suggestions grant no execution authority; the caller must retry through the existing gates.
+ * @example toolCandidates({ toolId: 'content_read', input: { resource: 'theme' }, tools });
+ * @complexity O(n*l*r + n log n) time, O(n + r) space; scoring lengths capped at 128.
+ */
+export function toolCandidates({ toolId, tools, input }, _optional = {}) {
+    const target = candidateTarget({ toolId, input });
+    return tools.map(({ id }) => ({ id, distance: nameDistance({ left: target, right: id }) }))
+        .filter(({ id, distance }) => id === target || id.startsWith(toolId) || distance <= 2)
+        .sort((left, right) => Number(right.id === target) - Number(left.id === target) || left.distance - right.distance)
+        .slice(0, 8).map(({ id }) => id);
 }
 //# sourceMappingURL=tool-candidates.js.map

package/dist/http/attachments.d.ts

@@ -33,6 +33,19 @@ export interface AttachmentClaim {
     /** Absent only for an empty claim — there is no directory to grant when nothing was claimed. */
     batchDirectory?: string;
 }
+/** Copy an already authenticated claim into the host's filesystem boundary. Keep the original
+ * store records intact for promotion/read-back; the caller owns cleanup after the run ends.
+ * Only claimed files are copied, never batch sidecars or another upload's capability ids.
+ * O(b) I/O for b claimed bytes, bounded by the attachment store's batch limits. Partial copies
+ * are removed before rejection. The temporary directory is private and directly under real root.
+ */
+export declare function stageAttachmentClaim(required: {
+    claim: AttachmentClaim;
+    filesystemRoot: string;
+}, _optional?: {}): Promise<{
+    claim: AttachmentClaim;
+    cleanup: () => Promise<void>;
+}>;
 /** Why an attachment operation was refused. Maps to an HTTP status in `statusForRejection`. */
 export type AttachmentRejectionReason = 
 /** The batch id is missing or not of the accepted shape. */

package/dist/http/attachments.js

@@ -99,13 +99,39 @@
  * correlation-id-bearing generic `INTERNAL_ERROR`, with the real error reaching a host-owned sink —
  * the same `reportInternalError` shape `media.ts`/`delegated-tools.ts` use.
  */
-import { chmod, lstat, mkdir, open, readFile, readdir, realpath, rm, rmdir, writeFile } from 'node:fs/promises';
+import { chmod, copyFile, lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rm, rmdir, writeFile } from 'node:fs/promises';
 import { randomUUID } from 'node:crypto';
 import { basename, dirname, extname, resolve } from 'node:path';
 import { createApiError } from '@jini-ai/protocol';
 import { guardSameOrigin } from '@jini-ai/http-kit';
 import { sendApiError, sendJson } from '@jini-ai/http-kit';
 import { writeJsonFileAtomicAsync } from '@jini-ai/platform/fs';
+/** Copy an already authenticated claim into the host's filesystem boundary. Keep the original
+ * store records intact for promotion/read-back; the caller owns cleanup after the run ends.
+ * Only claimed files are copied, never batch sidecars or another upload's capability ids.
+ * O(b) I/O for b claimed bytes, bounded by the attachment store's batch limits. Partial copies
+ * are removed before rejection. The temporary directory is private and directly under real root.
+ */
+export async function stageAttachmentClaim(required, _optional = {}) {
+    const root = await realpath(required.filesystemRoot);
+    const directory = await mkdtemp(resolve(root, '.agent-attachments-'));
+    const cleanup = () => rm(directory, { recursive: true, force: true });
+    try {
+        await chmod(directory, 0o700);
+        const attachments = [];
+        for (const attachment of required.claim.attachments) {
+            const target = resolve(directory, basename(attachment.path));
+            await copyFile(attachment.path, target);
+            await chmod(target, 0o600);
+            attachments.push({ ...attachment, path: target });
+        }
+        return { claim: { attachments, batchDirectory: directory }, cleanup };
+    }
+    catch (error) {
+        await cleanup();
+        throw error;
+    }
+}
 /**
  * A refusal this module classified itself, as opposed to an unexpected filesystem/programming
  * error. The route pack turns the `reason` into a status code and lets the `message` through only

package/dist/http/delegated-tools.js

@@ -36,7 +36,7 @@ function checkReadOnlyConstraint(deps, input) {
     if (input.requireReadOnly !== true)
         return null;
     const refusal = readOnlyTools.checkReadOnlyTool({
-        toolId: input.toolId, registry: deps.toolRegistry, messages: readOnlyTools.defaultDaemonMessages.readOnly,
+        toolId: input.toolId, input: input.input, registry: deps.toolRegistry, messages: readOnlyTools.defaultDaemonMessages.readOnly,
     });
     if (refusal === null)
         return null;

package/dist/http/index.d.ts

@@ -1,4 +1,5 @@
 /** Daemon route packs; generic transport primitives live in @jini-ai/http-kit. */
+export { createMessageRelayClaimHandler, registerMessageRelayRoutes, type MessageRelayHttpDeps } from './message-relay.js';
 export type { ResolveWorkspaceRootOptions, WorkspaceRootRequest, WorkspaceRootResolver, } from './workspace-root.js';
 export { denyAllWorkspaceRoots, resolveWorkspaceRoot, WorkspaceRootDeniedError } from './workspace-root.js';
 export type { RunCancellationService } from './cancel-owned-runs.js';
@@ -45,7 +46,7 @@ export { createResearchSearchRoute, registerResearchRoutes, researchSearchRoute
 export type { MediaGenerateResponse, MediaHttpDeps, MediaInternalErrorContext, MediaTaskDeleteResponse, MediaTaskListResponse, MediaTaskResponse, } from './media.js';
 export { mediaGenerateRoute, mediaTaskDeleteRoute, mediaTaskGetRoute, mediaTaskListRoute, registerMediaRoutes, } from './media.js';
 export type { AttachmentClaim, AttachmentRejectionReason, AttachmentsHttpDeps, AttachmentsInternalErrorContext, AttachmentStore, AttachmentUploadResponse, CreateDiskAttachmentStoreOptions, ObservedAttachmentIdentity, PendingAttachmentSummary, RecordedAttachmentIdentity, StoredAttachment, } from './attachments.js';
-export { ATTACHMENTS_ROUTE_PATH, AttachmentRejectedError, createDiskAttachmentStore, detectAttachmentKind, handleAttachmentCleanup, handleAttachmentUpload, isUnchangedAttachment, registerAttachmentRoutes, sanitizeAttachmentName, writeBoundedAttachmentBody, } from './attachments.js';
+export { ATTACHMENTS_ROUTE_PATH, AttachmentRejectedError, createDiskAttachmentStore, detectAttachmentKind, handleAttachmentCleanup, handleAttachmentUpload, isUnchangedAttachment, registerAttachmentRoutes, sanitizeAttachmentName, stageAttachmentClaim, writeBoundedAttachmentBody, } from './attachments.js';
 export type { XaiAuthStatusResponse, XaiHttpDeps, XaiInternalErrorContext, XaiOauthStartResponse, XaiOkResponse, XaiSearchResponse, } from './xai.js';
 export { registerXaiRoutes, xaiAuthStatusRoute, xaiOauthCancelRoute, xaiOauthCompleteRoute, xaiOauthDisconnectRoute, xaiOauthStartRoute, xaiSearchRoute, } from './xai.js';
 export * from './run-credentials.js';

package/dist/http/index.js

@@ -1,3 +1,5 @@
+/** Daemon route packs; generic transport primitives live in @jini-ai/http-kit. */
+export { createMessageRelayClaimHandler, registerMessageRelayRoutes } from './message-relay.js';
 export { denyAllWorkspaceRoots, resolveWorkspaceRoot, WorkspaceRootDeniedError } from './workspace-root.js';
 export { cancelRunsOwnedBy } from './cancel-owned-runs.js';
 export { ACTIVE_CONTEXT_TTL_MS, getActiveRoute, registerActiveContextRoutes, setActiveRoute, } from './active-context.js';
@@ -21,7 +23,7 @@ export { apiHealthRoute, apiReadyRoute, apiVersionInfoRoute, healthRoute, readyR
 export { connectorsAuthSessionRoute, connectorsAuthSignInRoute, connectorsAuthSignOutRoute, connectorsAuthSignUpRoute, connectorsDbDeleteRoute, connectorsDbGetRoute, connectorsDbInsertRoute, connectorsDbQueryRoute, connectorsDbUpdateRoute, connectorsRealtimePublishRoute, connectorsStorageDeleteRoute, connectorsStorageGetRoute, connectorsStorageListRoute, connectorsStoragePutRoute, registerConnectorsRoutes, } from './connectors.js';
 export { createResearchSearchRoute, registerResearchRoutes, researchSearchRoute } from './research.js';
 export { mediaGenerateRoute, mediaTaskDeleteRoute, mediaTaskGetRoute, mediaTaskListRoute, registerMediaRoutes, } from './media.js';
-export { ATTACHMENTS_ROUTE_PATH, AttachmentRejectedError, createDiskAttachmentStore, detectAttachmentKind, handleAttachmentCleanup, handleAttachmentUpload, isUnchangedAttachment, registerAttachmentRoutes, sanitizeAttachmentName, writeBoundedAttachmentBody, } from './attachments.js';
+export { ATTACHMENTS_ROUTE_PATH, AttachmentRejectedError, createDiskAttachmentStore, detectAttachmentKind, handleAttachmentCleanup, handleAttachmentUpload, isUnchangedAttachment, registerAttachmentRoutes, sanitizeAttachmentName, stageAttachmentClaim, writeBoundedAttachmentBody, } from './attachments.js';
 export { registerXaiRoutes, xaiAuthStatusRoute, xaiOauthCancelRoute, xaiOauthCompleteRoute, xaiOauthDisconnectRoute, xaiOauthStartRoute, xaiSearchRoute, } from './xai.js';
 export * from './run-credentials.js';
 export { createTavilyResearchProvider } from './research-tavily.adapter.js';

package/dist/http/message-relay.d.ts

@@ -0,0 +1,21 @@
+import type { Express, RequestHandler } from 'express';
+import type { RunScopedCallerResolver } from '../run-credentials.js';
+import type { AgentExecutor } from '../agent-executor/contracts.js';
+export interface MessageRelayHttpDeps {
+    readonly agentExecutor: Pick<AgentExecutor, 'claimUserMessages'>;
+    /** The same live credential registry used to issue JINI_DAEMON_TOKEN at spawn.
+     * Explicit undefined opts into the host's existing unauthenticated loopback trust: any local
+     * process can claim messages. Authenticated hosts must supply their resolver, never proxy identity. */
+    readonly runScopedCallers: RunScopedCallerResolver | undefined;
+}
+/** Claim a FIFO prefix without I/O. A run credential determines scope; the URL only checks it.
+ * Body-supplied scope is refused. A proxy credential or another run's token cannot claim.
+ * @returns Express handler; errors go to the host's existing error boundary.
+ * @complexity O(claimed text bytes); no storage or network work outside the existing event FIFO.
+ */
+export declare function createMessageRelayClaimHandler({ agentExecutor, runScopedCallers }: MessageRelayHttpDeps, _options?: {}): RequestHandler;
+/** Mount behind the host's existing daemon gate; allow this POST for live run credentials there. */
+export declare function registerMessageRelayRoutes({ app, ...deps }: {
+    app: Express;
+} & MessageRelayHttpDeps, _options?: {}): void;
+//# sourceMappingURL=message-relay.d.ts.map

package/dist/http/message-relay.js

@@ -0,0 +1,44 @@
+import { bearerTokenFromHeader } from '@jini-ai/http-kit';
+/** Claim a FIFO prefix without I/O. A run credential determines scope; the URL only checks it.
+ * Body-supplied scope is refused. A proxy credential or another run's token cannot claim.
+ * @returns Express handler; errors go to the host's existing error boundary.
+ * @complexity O(claimed text bytes); no storage or network work outside the existing event FIFO.
+ */
+export function createMessageRelayClaimHandler({ agentExecutor, runScopedCallers }, _options = {}) {
+    return (req, res, next) => {
+        try {
+            const token = bearerTokenFromHeader({ header: req.get('authorization') });
+            const caller = token ? runScopedCallers?.resolveCaller({ token }) : undefined;
+            if (runScopedCallers && !caller) {
+                res.status(401).json({ error: { code: 'UNAUTHENTICATED', message: 'a live run credential is required' } });
+                return;
+            }
+            const runId = caller?.runId ?? req.params.runId;
+            if (!runId || runId !== req.params.runId) {
+                res.status(404).json({ error: { code: 'NOT_FOUND', message: 'run was not found' } });
+                return;
+            }
+            const body = req.body;
+            if (!validClaim(body)) {
+                res.status(400).json({ error: { code: 'BAD_REQUEST', message: 'body must contain only via: tool-result or check_messages' } });
+                return;
+            }
+            res.json({ messages: agentExecutor.claimUserMessages({ runId, via: body.via }) });
+        }
+        catch (error) {
+            next(error);
+        }
+    };
+}
+/** Strict receipt-channel validation; no caller-selected run or principal is accepted. */
+function validClaim(body) {
+    if (body === null || typeof body !== 'object' || Array.isArray(body))
+        return false;
+    const value = body;
+    return Object.keys(value).length === 1 && (value.via === 'tool-result' || value.via === 'check_messages');
+}
+/** Mount behind the host's existing daemon gate; allow this POST for live run credentials there. */
+export function registerMessageRelayRoutes({ app, ...deps }, _options = {}) {
+    app.post('/api/runs/:runId/messages/claim', createMessageRelayClaimHandler(deps));
+}
+//# sourceMappingURL=message-relay.js.map

package/dist/http/runs.d.ts

@@ -55,12 +55,15 @@ export interface RunCancelResponse {
     readonly run: RunStatus;
 }
 export interface RunMessageRequest {
+    /** Generated at intake and passed unchanged to the executor's queue/consumption events. */
+    readonly id?: string;
     readonly runId: string;
     readonly text: string;
     /** Opaque upload capabilities; the host must authorize and prepare every ref before delivery. */
     readonly attachmentIds?: readonly string[];
 }
 export interface RunMessageResponse {
+    readonly id: string;
     readonly delivery: 'delivered';
 }
 /** Ceiling on one mid-run message, matching what a person can reasonably type or paste into a composer. */
@@ -81,8 +84,8 @@ export declare const runCancelRoute: import("@jini-ai/http-kit").JsonRouteSpec<{
 /**
  * `POST /api/runs/:runId/messages` — a message the human sent while the run is going. `202` when it
  * reached the live agent; `409 CONFLICT` with `details.delivery` (`'unsupported'` or
- * `'not-running'`) when it did not, which tells the client whether to interrupt the run and send the
- * text as the next turn, or simply send it next because the run is already ending.
+ * `'not-running'`) when it did not, which tells the client to retain the next-turn queue without canceling live work.
+ * Acceptance is distinct from the UUID-attributed consumption receipt in the run stream.
  */
 export declare const runMessageRoute: import("@jini-ai/http-kit").JsonRouteSpec<RunMessageRequest, RunMessageResponse, RunHttpDeps, undefined>;
 /**

package/dist/http/runs.js

@@ -154,8 +154,8 @@ export const runCancelRoute = defineJsonRoute({
 /**
  * `POST /api/runs/:runId/messages` — a message the human sent while the run is going. `202` when it
  * reached the live agent; `409 CONFLICT` with `details.delivery` (`'unsupported'` or
- * `'not-running'`) when it did not, which tells the client whether to interrupt the run and send the
- * text as the next turn, or simply send it next because the run is already ending.
+ * `'not-running'`) when it did not, which tells the client to retain the next-turn queue without canceling live work.
+ * Acceptance is distinct from the UUID-attributed consumption receipt in the run stream.
  */
 export const runMessageRoute = defineJsonRoute({
     method: 'post', path: '/api/runs/:runId/messages', parse: parseRunMessage, handle: async ({ input, deps }) => {
@@ -163,9 +163,10 @@ export const runMessageRoute = defineJsonRoute({
         if (run === undefined)
             return err({ error: createApiError({ code: 'NOT_FOUND', message: `run "${input.runId}" was not found` }) });
         const deliver = input.attachmentIds?.length ? deps.deliverUserMessageWithAttachments : deps.deliverUserMessage;
-        const delivery = deliver ? await deliver(input) : 'unsupported';
+        const id = randomUUID();
+        const delivery = deliver ? await deliver({ ...input, id }) : 'unsupported';
         if (delivery === 'delivered')
-            return ok({ value: { delivery } });
+            return ok({ value: { delivery, id } });
         return err({ error: createApiError({ code: 'CONFLICT', message: `run "${input.runId}" did not take the message` }, { details: { delivery } }) });
     }
 }, { requireSameOrigin: true, successStatus: 202 });
@@ -208,7 +209,12 @@ export async function handleRunEventStreamRequest({ res, runId, afterCursor, dep
         }
     });
     try {
-        const subscribed = await deps.lifecycle.stream({ runId, onEvent: (event) => channel.enqueue({ event }) }, { afterCursor });
+        const subscribed = await deps.lifecycle.stream({ runId, onEvent: (event) => {
+                // RunLifecycle validates the run/cursor before replay callbacks. Open before enqueueing
+                // history so a healthy response drains replay instead of overflowing the unopened queue.
+                channel.open();
+                channel.enqueue({ event });
+            } }, { afterCursor });
         if (subscribed.kind !== 'ok') {
             // Nothing was ever subscribed, so `abandon()` has nothing to unsubscribe — it only marks
             // the channel closed. `res` itself is untouched, leaving `sendStreamFailure` free to send

package/dist/tool-executor.js

@@ -212,11 +212,12 @@ export function createToolExecutor(requiredArgs, optionalArgs = {}) {
         const error = guidance ? `${message}\n\n${guidance}` : message;
         return { executionId, status: 'failed', error, errorKind, ...(normalizationNotes.length ? { normalizationNotes } : {}) };
     }
-    /** Throws the typed unknown-tool input error, naming up to eight registered prefix matches. */
-    function assertKnownTool({ registry: invocationRegistry, toolId }) {
+    /** Throws the typed unknown-tool input error, naming up to eight similarity-ranked registrations.
+     * Input is used only for a diagnostic resource hint; this never dispatches an alternate tool. */
+    function assertKnownTool({ registry: invocationRegistry, toolId, input }) {
         if (invocationRegistry.has({ toolId }))
             return;
-        const candidates = toolCandidates({ toolId, tools: invocationRegistry.list({}) });
+        const candidates = toolCandidates({ toolId, tools: invocationRegistry.list({}), input });
         const hint = candidates.length > 0 ? `; did you mean ${candidates.join(', ')}?` : '';
         throw new ToolInputError({ message: `ToolExecutor: unknown tool "${toolId}"${hint}` });
     }
@@ -395,7 +396,7 @@ export function createToolExecutor(requiredArgs, optionalArgs = {}) {
         // policy that hangs or throws used to still leave a record behind. `has()` only confirms
         // existence, never returns a handler, so this doesn't reopen the leak authorizeToolInvocation
         // closed — that gate still runs, still unconditionally, inside the call below.
-        assertKnownTool({ registry: invocationRegistry, toolId });
+        assertKnownTool({ registry: invocationRegistry, toolId, input });
         const executionId = openAudit(principal, run, toolId);
         // Observes `signal` for this execution's ENTIRE remaining lifetime, not just the handler-run
         // phase. `requestConfirmation()`'s wait below is unbounded — it settles only when a human

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/daemon",
-  "version": "0.6.10",
+  "version": "0.6.12",
   "description": "The stateful agent daemon runtime: run lifecycle, durable event-log port, the tool-execution boundary, agent executor, terminal sessions, and routines.",
   "license": "Apache-2.0",
   "repository": {
@@ -139,17 +139,17 @@
     "@types/pg": "8.23.1",
     "express": "^4.21.0",
     "@types/express": "^4.17.21",
-    "@jini-ai/http-kit": "0.6.10",
-    "@jini-ai/db": "0.6.10",
-    "@jini-ai/chat": "0.6.10",
-    "@jini-ai/core": "^0.6.10",
-    "@jini-ai/agent-runtime": "^0.6.10",
-    "@jini-ai/protocol": "^0.6.10",
-    "@jini-ai/platform": "^0.6.10"
+    "@jini-ai/http-kit": "0.6.12",
+    "@jini-ai/db": "0.6.12",
+    "@jini-ai/chat": "0.6.12",
+    "@jini-ai/agent-runtime": "^0.6.12",
+    "@jini-ai/platform": "^0.6.12",
+    "@jini-ai/protocol": "^0.6.12",
+    "@jini-ai/core": "^0.6.12"
   },
   "dependencies": {
-    "@jini-ai/protocol": "^0.6.10",
-    "@jini-ai/core": "^0.6.10"
+    "@jini-ai/protocol": "^0.6.12",
+    "@jini-ai/core": "^0.6.12"
   },
   "peerDependencies": {
     "node-pty": "^1.1.0",