@jini-ai/daemon 0.6.11 → 0.6.15-rc.1

package/dist/agent-executor/codex/isolation.js

@@ -0,0 +1,67 @@
+import { parse } from 'smol-toml';
+import { JINI_MCP_SERVER_KEY } from '../mcp-bridge.js';
+import { isRecord } from '../values.js';
+/** A run with personal MCP off that Codex cannot keep to the bridge alone: refused, never run with a leak. */
+export class CodexMcpIsolationError extends Error {
+}
+/** The user-facing refusal for a {@link CodexMcpIsolationError} reason. */
+export function codexIsolationRefusalMessage(reason) {
+    return `Codex can't run with 'Your MCP servers' off: ${reason} Turn it on in the assistant settings, or choose Claude.`;
+}
+/**
+ * Parses one Codex config layer with a real TOML parser, so no spelling (quoted or escaped keys,
+ * dotted keys, inline tables, or a `[header]`-shaped line inside a multi-line string or array)
+ * hides a server from the check. A file that does not parse is refused: what it declares can't be
+ * known, and Codex could not load it either.
+ * @complexity O(n) in the file length.
+ */
+function parseCodexLayer(raw, path) {
+    try {
+        return parse(raw);
+    }
+    catch {
+        throw new CodexMcpIsolationError(`${path} isn't valid TOML, so its MCP servers can't be checked.`);
+    }
+}
+/**
+ * Refuses a layer that trusts a project. Codex loads a project's `.codex/config.toml` only when the
+ * config merged below it trusts that project (codex-rs `config/src/loader/mod.rs` L:1098-1125), so
+ * with no `projects` table anywhere no project layer, worktree root or root-marker range can add a
+ * server. Parsed, so a dotted, inline or escaped spelling is caught too.
+ */
+function assertTrustsNoProject(config, path) {
+    if ('projects' in config)
+        throw new CodexMcpIsolationError(`${path} trusts projects in a way that can't be removed safely.`);
+}
+/**
+ * The real home config must parse before its line-based rewrite ({@link buildCodexHomeConfigToml})
+ * is trusted: a malformed block the rewrite drops would otherwise hide that the line scan misread
+ * the file. A missing file (`undefined`) is fine.
+ * @throws {@link CodexMcpIsolationError} when it isn't valid TOML.
+ */
+export function assertCodexHomeConfigParses({ raw, path }) {
+    if (raw !== undefined)
+        parseCodexLayer(raw, path);
+}
+/**
+ * The staged home config, parsed: it must declare no MCP server but the bridge and trust no
+ * project. The home rewrite ({@link buildCodexHomeConfigToml}) is line-based so every other byte
+ * survives, so a server or trust entry it cannot see (an escaped header, a dotted root key) or a
+ * multi-line value a fake header split is refused here instead of staged. O(n) in the config length.
+ * @throws {@link CodexMcpIsolationError} when the staged config would not isolate the run.
+ */
+export function assertStagedHomeIsolated({ homeConfig, path }) {
+    const refusal = new CodexMcpIsolationError(`${path} declares MCP servers that can't be removed safely.`);
+    let config;
+    try {
+        config = parse(homeConfig);
+    }
+    catch {
+        throw refusal;
+    }
+    const ids = isRecord(config.mcp_servers) ? Object.keys(config.mcp_servers) : [];
+    if (ids.some(id => id !== JINI_MCP_SERVER_KEY))
+        throw refusal;
+    assertTrustsNoProject(config, path);
+}
+//# sourceMappingURL=isolation.js.map

package/dist/agent-executor/contracts.d.ts

@@ -144,6 +144,9 @@ export interface AgentExecutorRunInput {
     readonly imageContents?: readonly MessageAttachmentImage[];
     /** Additional host-validated directories the runtime may read. */
     readonly extraAllowedDirs?: readonly string[];
+    /** Owner-picked folders outside filesystemRoot: readable where the CLI can enforce read-only, never
+     * a writable grant. Refused before spawn when unsafe (see `validateReadOnlyExtraDirs`). */
+    readonly readOnlyExtraDirs?: readonly string[];
     /** Trusted root that must contain pi-rpc image paths after realpath resolution. */
     readonly uploadRoot?: string;
     /**
@@ -207,7 +210,7 @@ export interface AgentExecutor {
      * underlying run is always already transitioned to `'failed'` via
      * `lifecycle.finish()` before this rejects (see index.ts module doc's Invariant).
      */
-    run(requiredArgs: Pick<AgentExecutorRunInput, "runId" | "agentId" | "prompt" | "cwd">, optionalArgs?: Pick<AgentExecutorRunInput, "filesystemRoot" | "model" | "reasoning" | "nativeToolAccess" | "nativeCapabilities" | "cliParity" | "permissionMode" | "imagePaths" | "imageContents" | "extraAllowedDirs" | "uploadRoot" | "credentialEnv" | "env" | "resumeSessionId" | "newSessionId" | "disallowedTools" | "allowedTools" | "settingSources" | "settings" | "chromeIntegration">): Promise<void>;
+    run(requiredArgs: Pick<AgentExecutorRunInput, "runId" | "agentId" | "prompt" | "cwd">, optionalArgs?: Pick<AgentExecutorRunInput, "filesystemRoot" | "model" | "reasoning" | "nativeToolAccess" | "nativeCapabilities" | "cliParity" | "permissionMode" | "imagePaths" | "imageContents" | "extraAllowedDirs" | "readOnlyExtraDirs" | "uploadRoot" | "credentialEnv" | "env" | "resumeSessionId" | "newSessionId" | "disallowedTools" | "allowedTools" | "settingSources" | "settings" | "chromeIntegration">): Promise<void>;
     /**
      * Delivers a message the human sent while `runId` is going straight into its live agent process
      * (see {@link UserMessageDelivery} for each outcome). A stream-json agent queues the message

package/dist/agent-executor/event-translation.d.ts

@@ -1,20 +1,20 @@
 import type { RunAgentPayload, RunErrorPayload } from '@jini-ai/protocol';
 import type { AgentRuntimeEventTranslation } from './contracts.js';
 /**
- * Narrows a parsed `usage` event's `usage` sub-object (`{input_tokens?, output_tokens?}`) — the one
+ * Narrows a parsed `usage` event's `usage` sub-object — the one
  * piece of {@link translateUsagePayload} with real nested branching (an optional container holding
- * two optional numeric fields), extracted so that function reads as a flat field-by-field mapping.
+ * optional numeric fields), extracted so that function reads as a flat field-by-field mapping.
+ * Reuses the runtime's alias owner so cache/reasoning counters survive the canonical boundary.
  * @param rawUsage - `rawEvent.usage` once already narrowed to a record, or `undefined` when absent/malformed.
- * @returns `undefined` when neither token count is present — matching `translateUsagePayload`'s
+ * @returns `undefined` when no token count is present — matching `translateUsagePayload`'s
  * original "omit the whole `usage` field rather than emit an empty object" behavior.
  * @complexity O(1).
  */
 export declare function extractUsageTokens({ rawUsage }: {
     readonly rawUsage: Record<string, unknown> | undefined;
-}): {
-    input_tokens?: number;
-    output_tokens?: number;
-} | undefined;
+}, _options?: Record<string, never>): Extract<RunAgentPayload, {
+    type: 'usage';
+}>['usage'];
 export declare function translateStatusEvent({ rawEvent }: {
     readonly rawEvent: Record<string, unknown>;
 }): AgentRuntimeEventTranslation;

package/dist/agent-executor/event-translation.js

@@ -1,47 +1,46 @@
+import { normalizeAiUsage } from '@jini-ai/agent-runtime';
 import { isRecord, asString, asOptionalString, } from './values.js';
 function asOptionalNumber(value) {
     return typeof value === 'number' ? value : undefined;
 }
 /**
- * Narrows a parsed `usage` event's `usage` sub-object (`{input_tokens?, output_tokens?}`) — the one
+ * Narrows a parsed `usage` event's `usage` sub-object — the one
  * piece of {@link translateUsagePayload} with real nested branching (an optional container holding
- * two optional numeric fields), extracted so that function reads as a flat field-by-field mapping.
+ * optional numeric fields), extracted so that function reads as a flat field-by-field mapping.
+ * Reuses the runtime's alias owner so cache/reasoning counters survive the canonical boundary.
  * @param rawUsage - `rawEvent.usage` once already narrowed to a record, or `undefined` when absent/malformed.
- * @returns `undefined` when neither token count is present — matching `translateUsagePayload`'s
+ * @returns `undefined` when no token count is present — matching `translateUsagePayload`'s
  * original "omit the whole `usage` field rather than emit an empty object" behavior.
  * @complexity O(1).
  */
-export function extractUsageTokens({ rawUsage }) {
-    if (!rawUsage)
+export function extractUsageTokens({ rawUsage }, _options = {}) {
+    const normalized = normalizeAiUsage({ usage: rawUsage });
+    if (!normalized)
         return undefined;
-    const inputTokens = asOptionalNumber(rawUsage.input_tokens);
-    const outputTokens = asOptionalNumber(rawUsage.output_tokens);
-    if (inputTokens === undefined && outputTokens === undefined)
-        return undefined;
-    return {
-        ...(inputTokens !== undefined ? { input_tokens: inputTokens } : {}),
-        ...(outputTokens !== undefined ? { output_tokens: outputTokens } : {}),
-    };
+    const fields = { input_tokens: normalized.inputTokens, output_tokens: normalized.outputTokens, cache_read_input_tokens: normalized.cacheReadTokens, cache_creation_input_tokens: normalized.cacheWriteTokens, reasoning_tokens: normalized.reasoningTokens };
+    return Object.fromEntries(Object.entries(fields).filter(([, value]) => value !== null));
 }
 /**
  * Narrows one parsed `usage` event's loosely-typed fields into
  * `RunAgentPayload`'s `usage` variant. The 4 source parsers attach extra
- * fields this narrow payload has no room for — `thought_tokens`,
+ * fields beyond the basic counts — `thought_tokens`,
  * `cached_read_tokens`/`cached_write_tokens` (opencode/gemini/codex),
  * `modelUsage`/`stopReason`/`isError` (qoder), a top-level `stopReason`
- * (claude/copilot) — all intentionally dropped here, not carried through.
+ * (claude/copilot). Cache/reasoning counters and stop reasons now survive tracing; vendor-only
+ * `modelUsage` and `isError` remain outside this neutral usage contract.
  * @param rawEvent - The raw `{type:'usage', ...}` record from a stream parser.
  * @returns The narrowed `RunAgentPayload` `usage` variant.
  * @complexity O(1).
  * @overallScore 100/100
  */
-function translateUsagePayload(rawEvent) {
+function translateUsagePayload({ rawEvent }) {
     const rawUsage = isRecord(rawEvent.usage) ? rawEvent.usage : undefined;
     const usage = extractUsageTokens({ rawUsage: rawUsage });
     const costUsd = asOptionalNumber(rawEvent.costUsd);
     const cumulativeCostUsd = asOptionalNumber(rawEvent.cumulativeCostUsd);
     const costSessionId = asOptionalString(rawEvent.costSessionId);
     const durationMs = asOptionalNumber(rawEvent.durationMs);
+    const stopReason = asOptionalString(rawEvent.stopReason);
     return {
         type: 'usage',
         ...(usage !== undefined ? { usage } : {}),
@@ -49,6 +48,7 @@ function translateUsagePayload(rawEvent) {
         ...(cumulativeCostUsd !== undefined ? { cumulativeCostUsd } : {}),
         ...(costSessionId !== undefined ? { costSessionId } : {}),
         ...(durationMs !== undefined ? { durationMs } : {}),
+        ...(stopReason !== undefined ? { stopReason } : {}),
     };
 }
 export function translateStatusEvent({ rawEvent }) {
@@ -115,7 +115,7 @@ export function translateToolResultEvent({ rawEvent }) {
     };
 }
 function translateUsageEvent(rawEvent) {
-    return { kind: 'agent', payload: translateUsagePayload(rawEvent) };
+    return { kind: 'agent', payload: translateUsagePayload({ rawEvent }) };
 }
 function translateRawEvent(rawEvent) {
     return { kind: 'agent', payload: { type: 'raw', line: asString(rawEvent.line) } };

package/dist/agent-executor/events.js

@@ -14,7 +14,7 @@ import { resolveContinuationTransport, } from '../continuation/continuation-tran
 import { resultContent, } from '../delegated-tool-bridge.js';
 import { projectToolResultEvent, } from '../tool-result-media.js';
 import { translateAgentRuntimeEvent, translateAcpError, applyAgentTranslationSideEffects, } from './event-translation.js';
-import { errorMessage, isRecord, } from './values.js';
+import { errorMessage, } from './values.js';
 import { MCP_BRIDGE_UNAVAILABLE, unavailableJiniBridgeStatus, bridgeUnavailableMessage, } from './mcp-bridge.js';
 /** Carry PID only on structured status so the host can record its OS start identity early.
  * A PID alone is never proof of death; hosts verify PID reuse before native continuation. */

package/dist/agent-executor/index.d.ts

@@ -92,7 +92,9 @@
 export { type SupportedStreamFormat, type AgentExecutorCompatibility, type AgentRuntimeEventTranslation, type AgentExecutorErrorCode, AgentExecutorError, type AgentExecutorRunInput, type AgentExecutor, type UserMessageDelivery, type CollectProcessTreePidsPort, type StopProcessesPort, type AgentCleanupFailurePhase, type AgentCleanupFailureContext, type ContinuationOptions, type McpJsonInjectionOptions, type McpBridgeDelivery, type PreparedCodexHome, type PreparedClaudeConfigDir, type ClaudeConfigDirSeams, type ClaudeConfigDirIsolationOptions, type FailureClassificationContext, type ClassifyFailure, type CreateAgentExecutorOptions, type SystemPromptOverlayDelivery, type PreparedSystemPromptOverlayFile, type SpawnAgentChildProcessResult, } from './contracts.js';
 export { isSupportedStreamFormat, assessAgentExecutorCompatibility, isAgentExecutorSupported, resolveDefAndStreamFormat, resolveImageDeliveryAndArgvBudget, resolveRunEnv, selectAgentExecutorHostEnv, resolveLaunch, stagePromptFile, stageLogFile, computeChildEnv, computeRuntimeContext, buildAgentBuildArgsOptions, resolveSystemPromptOverlayDelivery, buildRunArgs, prepareSystemPromptOverlayFileIfNeeded, guardWindowsCommandLineBudget, spawnAgentChildProcess, isStdinDrivenFormat, confirmChildSpawned, createAgentExecutor, } from './launch.js';
 export { extractUsageTokens, translateStatusEvent, translateToolResultEvent, translateErrorEvent, translateTurnEndEvent, translateAgentRuntimeEvent, applyAgentTranslationSideEffects, } from './event-translation.js';
-export { MCP_BRIDGE_UNAVAILABLE, unavailableJiniBridgeStatus, buildMcpJsonServerEntry, mergeMcpJsonContent, buildAcpMcpBridgeServers, mergeEnvContentMcpConfig, mergeEnvContentInstructions, buildCodexMcpServerToml, buildCodexHomeConfigToml, resolveSourceCodexHomeDir, buildMcpBridgeDelivery, resolveSourceClaudeConfigDir, resolveMcpBridgeForRun, writeMcpJsonIfNeeded, prepareCodexHomeIfNeeded, prepareClaudeConfigDirIfNeeded, } from './mcp-bridge.js';
+export { MCP_BRIDGE_UNAVAILABLE, unavailableJiniBridgeStatus, buildMcpJsonServerEntry, mergeMcpJsonContent, buildAcpMcpBridgeServers, mergeEnvContentMcpConfig, mergeEnvContentInstructions, buildMcpBridgeDelivery, resolveSourceClaudeConfigDir, resolveMcpBridgeForRun, writeMcpJsonIfNeeded, prepareClaudeConfigDirIfNeeded, } from './mcp-bridge.js';
+export { buildCodexMcpServerToml, buildCodexHomeConfigToml } from './codex/home-config.js';
+export { resolveSourceCodexHomeDir, prepareCodexHomeIfNeeded } from './codex/home-staging.js';
 export { probeMcpBridge, type McpBridgeProbeResult } from './mcp-bridge-probe.js';
 export { DEFAULT_BUFFERED_STDOUT_MAX_BYTES, runAcpDispatch, runPiRpcDispatch, } from './events.js';
 export { armHandoffWatcher, } from './handoff.js';

package/dist/agent-executor/index.js

@@ -92,7 +92,9 @@
 export { AgentExecutorError, } from './contracts.js';
 export { isSupportedStreamFormat, assessAgentExecutorCompatibility, isAgentExecutorSupported, resolveDefAndStreamFormat, resolveImageDeliveryAndArgvBudget, resolveRunEnv, selectAgentExecutorHostEnv, resolveLaunch, stagePromptFile, stageLogFile, computeChildEnv, computeRuntimeContext, buildAgentBuildArgsOptions, resolveSystemPromptOverlayDelivery, buildRunArgs, prepareSystemPromptOverlayFileIfNeeded, guardWindowsCommandLineBudget, spawnAgentChildProcess, isStdinDrivenFormat, confirmChildSpawned, createAgentExecutor, } from './launch.js';
 export { extractUsageTokens, translateStatusEvent, translateToolResultEvent, translateErrorEvent, translateTurnEndEvent, translateAgentRuntimeEvent, applyAgentTranslationSideEffects, } from './event-translation.js';
-export { MCP_BRIDGE_UNAVAILABLE, unavailableJiniBridgeStatus, buildMcpJsonServerEntry, mergeMcpJsonContent, buildAcpMcpBridgeServers, mergeEnvContentMcpConfig, mergeEnvContentInstructions, buildCodexMcpServerToml, buildCodexHomeConfigToml, resolveSourceCodexHomeDir, buildMcpBridgeDelivery, resolveSourceClaudeConfigDir, resolveMcpBridgeForRun, writeMcpJsonIfNeeded, prepareCodexHomeIfNeeded, prepareClaudeConfigDirIfNeeded, } from './mcp-bridge.js';
+export { MCP_BRIDGE_UNAVAILABLE, unavailableJiniBridgeStatus, buildMcpJsonServerEntry, mergeMcpJsonContent, buildAcpMcpBridgeServers, mergeEnvContentMcpConfig, mergeEnvContentInstructions, buildMcpBridgeDelivery, resolveSourceClaudeConfigDir, resolveMcpBridgeForRun, writeMcpJsonIfNeeded, prepareClaudeConfigDirIfNeeded, } from './mcp-bridge.js';
+export { buildCodexMcpServerToml, buildCodexHomeConfigToml } from './codex/home-config.js';
+export { resolveSourceCodexHomeDir, prepareCodexHomeIfNeeded } from './codex/home-staging.js';
 export { probeMcpBridge } from './mcp-bridge-probe.js';
 export { DEFAULT_BUFFERED_STDOUT_MAX_BYTES, runAcpDispatch, runPiRpcDispatch, } from './events.js';
 export { armHandoffWatcher, } from './handoff.js';

package/dist/agent-executor/launch.d.ts

@@ -190,14 +190,15 @@ type AgentBuildInput = Parameters<typeof buildAgentBuildArgsOptions>[0]['input']
 /** Phase 9a: the def's `buildArgs` 4th argument. Historically omitted when every override was absent;
  * that let defs silently enable auto-approval. Always supply the validated restricted default now. Pure. */
 export declare function buildAgentBuildArgsOptions({ input, systemPromptOverlay }: {
-    readonly input: Pick<AgentExecutorRunInput, 'filesystemRoot' | 'model' | 'reasoning' | 'permissionMode' | 'nativeToolAccess' | 'nativeCapabilities' | 'cliParity' | 'disallowedTools' | 'allowedTools' | 'settingSources' | 'settings' | 'chromeIntegration'> & {
+    readonly input: Pick<AgentExecutorRunInput, 'filesystemRoot' | 'readOnlyExtraDirs' | 'model' | 'reasoning' | 'permissionMode' | 'nativeToolAccess' | 'nativeCapabilities' | 'cliParity' | 'disallowedTools' | 'allowedTools' | 'settingSources' | 'settings' | 'chromeIntegration'> & {
         filesystemRuntimeReadPaths?: readonly string[];
         filesystemTempDir?: string;
         filesystemSharedTempRoots?: readonly string[];
+        filesystemRuntimeTempBase?: string;
         filesystemNotice?: string;
     };
     readonly systemPromptOverlay: string | null | undefined;
-}): RuntimeBuildOptions;
+}, _options?: {}): RuntimeBuildOptions;
 /**
  * **The single dispatch point from a computed system-prompt overlay to its delivery mechanism** —
  * see `RuntimeAgentDef.systemPromptDelivery`'s own doc for the declared shape. Pure and

package/dist/agent-executor/launch.js

@@ -6,14 +6,15 @@ import { spawn as nodeSpawn, } from 'node:child_process';
 import { promises as fsPromises, } from 'node:fs';
 import { tmpdir, } from 'node:os';
 import { join, } from 'node:path';
-import { agentCapabilities, assertClaudeFilesystemSupport, claudeFilesystemRuntimePaths, claudeFilesystemSettings, validateFilesystemLaunch, bindRuntimeAgentDef, defaultRuntimeState, getRuntimeModelDiscoveryDeps, userToolchainBinDirs, applyAgentLaunchEnv, ensureAgentCapabilities, resolveModelForLaunch, getAgentDef, resolveAgentLaunch, attachAcpSession, attachPiRpcSession, checkPromptArgvBudget, checkWindowsCmdShimCommandLineBudget, checkWindowsDirectExeCommandLineBudget, prepareAgentLogFile, preparePromptFileForAgent, } from '@jini-ai/agent-runtime';
+import { agentCapabilities, createClaudeFilesystemSupportProbe, claudeFilesystemRuntimePaths, claudeFilesystemSettings, validateFilesystemLaunch, validateReadOnlyExtraDirs, bindRuntimeAgentDef, defaultRuntimeState, getRuntimeModelDiscoveryDeps, userToolchainBinDirs, applyAgentLaunchEnv, ensureAgentCapabilities, resolveModelForLaunch, getAgentDef, resolveAgentLaunch, attachAcpSession, attachPiRpcSession, checkPromptArgvBudget, checkWindowsCmdShimCommandLineBudget, checkWindowsDirectExeCommandLineBudget, prepareAgentLogFile, preparePromptFileForAgent, } from '@jini-ai/agent-runtime';
 import { createCommandInvocation } from '@jini-ai/platform/command';
 import { collectProcessTreePids, listProcessSnapshots, stopProcesses, } from '@jini-ai/platform/process';
 import { applyImagePromptDelivery, } from '../image-prompt-delivery.js';
 import { SUPPORTED_STREAM_FORMATS, AgentExecutorError, } from './contracts.js';
 import { errorMessage, } from './values.js';
 import { defaultCleanupFailureSink, DEFAULT_BUFFERED_STDOUT_MAX_BYTES, wireChildLifecycle, writePromptToStdin, runAcpDispatch, runPiRpcDispatch, } from './events.js';
-import { mergeEnvContentMcpConfig, mergeEnvContentInstructions, defaultRemoveMcpJsonFile, resolveMcpBridgeForRun, writeMcpJsonIfNeeded, prepareCodexHomeIfNeeded, prepareClaudeConfigDirIfNeeded, } from './mcp-bridge.js';
+import { mergeEnvContentMcpConfig, mergeEnvContentInstructions, defaultRemoveMcpJsonFile, resolveMcpBridgeForRun, writeMcpJsonIfNeeded, prepareClaudeConfigDirIfNeeded, } from './mcp-bridge.js';
+import { prepareCodexHomeIfNeeded, withStagedCodexHome } from './codex/home-staging.js';
 import { acquireRuntimeLockIfConfigured, armHandoffWatcher, } from './handoff.js';
 /**
  * Narrows a `RuntimeAgentDef.streamFormat` string to the supported
@@ -279,7 +280,7 @@ export function computeChildEnv({ spawnEnv, mcpBridge }, { codexHomeDir, systemP
             ...envPassthroughApplied,
             [stagedInstructionsFile.varName]: mergeEnvContentInstructions({ existingRaw: envPassthroughApplied[stagedInstructionsFile.varName], instructionsFilePath: stagedInstructionsFile.path }),
         };
-    const codexHomeApplied = codexHomeDir === undefined ? instructionsApplied : { ...instructionsApplied, CODEX_HOME: codexHomeDir };
+    const codexHomeApplied = codexHomeDir === undefined ? instructionsApplied : withStagedCodexHome({ env: instructionsApplied, codexHomeDir });
     // Finding 1 of SEC-assistant-env-isolation-2026-09-07: same "only set when staged" shape as
     // codexHomeApplied above — mutually exclusive with it in practice (codexHomeDir is only ever set
     // for a 'codex-toml' bridge, claudeConfigDir only ever for a `claude`-id run), so both existing
@@ -336,13 +337,24 @@ function nativeBuildOptions({ input, permissionMode }, _options = {}) {
         ...(input.cliParity === true && permissionMode === 'bypass' && input.nativeToolAccess !== false ? { cliParity: true } : {}),
     };
 }
-/** Preserve explicit empty restrictions and settings: they have meaning to the native CLI. */
-function settingsBuildOptions({ input }, _options = {}) {
+/** Forward only supplied confinement paths; empty restriction arrays remain meaningful.
+ * Keeps executor-resolved filesystem facts through the definition's second settings merge. Pure, O(1).
+ */
+function filesystemBuildOptions({ input }, _options = {}) {
     return {
         ...(input.filesystemRoot !== undefined ? { filesystemRoot: input.filesystemRoot } : {}),
         ...(input.filesystemSharedTempRoots ? { filesystemSharedTempRoots: input.filesystemSharedTempRoots } : {}),
         ...(input.filesystemTempDir ? { filesystemTempDir: input.filesystemTempDir } : {}),
         ...(input.filesystemRuntimeReadPaths ? { filesystemRuntimeReadPaths: input.filesystemRuntimeReadPaths } : {}),
+        ...(input.filesystemRuntimeTempBase !== undefined ? { filesystemRuntimeTempBase: input.filesystemRuntimeTempBase } : {}),
+        // Only while a folder limit applies: an unconfined CLI gets no extra grant, read-only or otherwise.
+        ...(input.filesystemRoot !== undefined && input.readOnlyExtraDirs?.length ? { filesystemReadOnlyDirs: input.readOnlyExtraDirs } : {}),
+    };
+}
+/** Preserve explicit empty restrictions and settings: they have meaning to the native CLI. */
+function settingsBuildOptions({ input }, _options = {}) {
+    return {
+        ...filesystemBuildOptions({ input }),
         ...(input.disallowedTools !== undefined ? { disallowedTools: input.disallowedTools } : {}),
         ...(input.allowedTools !== undefined ? { allowedTools: input.allowedTools } : {}),
         ...(input.settingSources !== undefined ? { settingSources: input.settingSources } : {}),
@@ -350,9 +362,13 @@ function settingsBuildOptions({ input }, _options = {}) {
         ...(input.chromeIntegration !== undefined ? { chromeIntegration: input.chromeIntegration } : {}),
     };
 }
+/** A relay needs both a delivered bridge and a runtime that understands it. Pure, O(1). */
+function canRegisterRunMessageRelay({ def, mcpBridge }, _options = {}) {
+    return mcpBridge !== null && supportsMessageRelay({ def });
+}
 /** Phase 9a: the def's `buildArgs` 4th argument. Historically omitted when every override was absent;
  * that let defs silently enable auto-approval. Always supply the validated restricted default now. Pure. */
-export function buildAgentBuildArgsOptions({ input, systemPromptOverlay }) {
+export function buildAgentBuildArgsOptions({ input, systemPromptOverlay }, _options = {}) {
     const permissionMode = input.permissionMode ?? 'restricted';
     if (permissionMode !== 'restricted' && permissionMode !== 'bypass') {
         throw new AgentExecutorError({ code: 'AGENT_PERMISSION_MODE_INVALID', message: 'AgentExecutor: permissionMode must be restricted or bypass' });
@@ -622,6 +638,22 @@ export async function confirmChildSpawned({ input, deps }) {
 function nativeCapabilityInput({ input }, _options = {}) {
     return { ...(input.nativeCapabilities !== undefined ? { nativeCapabilities: input.nativeCapabilities } : {}) };
 }
+/** Switch names a person sees for each native capability (the host's settings use the same words). */
+const NATIVE_CAPABILITY_LABELS = {
+    shell: 'Bash/shell', fileWrite: 'File edit/write', userMcp: 'Your MCP servers', subagents: 'Subagents/Task',
+    userSettings: 'Your skills and settings', web: 'Web fetch/search', workflows: 'Workflows', loginEnvironment: 'Your shell environment',
+};
+/** The refusal a person reads when a CLI without a native-tool policy cannot honor this run's switches:
+ * it names the CLI and the switch to turn on. Owner 2026-10-27: the old "no native-tool policy and
+ * audit adapter" told a Gemini user nothing. Pure, O(c) for c OFF switches.
+ * @example nativeToolPolicyRefusal({ cliName: 'Antigravity', offSwitches: ['userMcp'] }, {});
+ */
+function nativeToolPolicyRefusal({ cliName, offSwitches }, _options = {}) {
+    const switches = offSwitches.map(key => `'${NATIVE_CAPABILITY_LABELS[key] ?? key}'`);
+    const blocked = switches.length > 0 ? `with ${new Intl.ListFormat('en', { type: 'conjunction' }).format(switches)} off` : `with this chat's CLI tool limits`;
+    const action = switches.length === 0 ? `Turn on 'Full CLI access'` : `Turn ${switches.length === 1 ? 'it' : 'them'} on`;
+    return `${cliName} can't run ${blocked}. ${action} in the assistant settings, or choose Claude or Codex.`;
+}
 /** Correlation projects retained stdout, so exact-byte journals need a separate blob writer. */
 function validateStdoutJournalOptions(options, _options = {}) {
     if (options.delegatedResultCorrelation && options.journal && !options.stdoutJournalBlobs) {
@@ -685,12 +717,16 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
     const claudeConfigDirIsolationEnabled = options.claudeConfigDirIsolationEnabled ?? false;
     const promptAugmenter = options.promptAugmenter;
     const filesystemTemps = new Map();
-    /** Remove only this run's private temp directory, on startup failure or child cleanup. */
+    const verifyClaudeFilesystem = options.assertClaudeFilesystemSupport ?? createClaudeFilesystemSupportProbe({});
+    /** Remove this run's private temp directories on startup failure, exit, crash or cancellation.
+     * O(d) removals for d staged directories; each failure is reported without skipping the others.
+     */
     async function cleanupFilesystemTemp({ runId }, _optional = {}) {
-        const path = filesystemTemps.get(runId);
-        if (!path)
+        const paths = filesystemTemps.get(runId);
+        if (!paths)
             return;
-        await fsPromises.rm(path, { recursive: true, force: true }).catch(() => console.warn('[agent-executor] private temp cleanup failed'));
+        await Promise.all(paths.map(path => fsPromises.rm(path, { recursive: true, force: true })
+            .catch(() => console.warn('[agent-executor] private temp cleanup failed'))));
         filesystemTemps.delete(runId);
     }
     /**
@@ -711,7 +747,7 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         // the user got a bare "Run failed". Best-effort: a stream that will not take the event must not
         // stop the run from finishing.
         await lifecycle
-            .emit({ runId: runId, input: { event: 'error', data: { message: `The assistant could not start: ${message.replace(/^AgentExecutor:\s*/, '')}` } } })
+            .emit({ runId: runId, input: { event: 'error', data: { error: { code, message }, message: `The assistant could not start: ${message.replace(/^AgentExecutor:\s*/, '')}` } } })
             .catch(() => undefined);
         await cleanupFilesystemTemp({ runId }, {});
         await lifecycle.finish({ runId, status: 'failed', code: null, signal: null, resumable: false });
@@ -745,8 +781,11 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         // Never silently ignore a host's locked native-tool policy on another CLI.
         // Parity cannot override an explicit lock or a restricted run.
         input.cliParity = input.cliParity === true && input.permissionMode === 'bypass' && input.nativeToolAccess !== false;
-        if ((input.nativeToolAccess !== undefined && !input.cliParity || Object.values(input.nativeCapabilities ?? {}).some(value => value === false)) && def.supportsNativeToolAccess !== true) {
-            return failBeforeSpawn({ runId: input.runId, code: 'NATIVE_TOOL_POLICY_UNSUPPORTED', message: 'This CLI has no native-tool policy and audit adapter. Choose a CLI with native-tool policy support.' });
+        if (def.supportsNativeToolAccess === true)
+            return;
+        const offSwitches = Object.entries(input.nativeCapabilities ?? {}).filter(([, value]) => value === false).map(([key]) => key);
+        if (input.nativeToolAccess !== undefined && !input.cliParity || offSwitches.length > 0) {
+            return failBeforeSpawn({ runId: input.runId, code: 'NATIVE_TOOL_POLICY_UNSUPPORTED', message: nativeToolPolicyRefusal({ cliName: def.name, offSwitches }, {}) });
         }
     }
     /** Validate every directory after image augmentation, before model probes or resource staging.
@@ -760,6 +799,8 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
                 ...(imageDelivery.extraAllowedDirs ? { extraAllowedDirs: imageDelivery.extraAllowedDirs } : {}),
                 ...(input.imagePaths ? { imagePaths: input.imagePaths } : {}),
             }, {});
+            if (input.readOnlyExtraDirs)
+                input.readOnlyExtraDirs = validateReadOnlyExtraDirs({ filesystemRoot: input.filesystemRoot, dirs: input.readOnlyExtraDirs }, {});
             input.cwd = input.filesystemRoot;
         }
         catch {
@@ -774,20 +815,27 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         if (input.filesystemRoot === undefined)
             return;
         try {
-            const verify = options.assertClaudeFilesystemSupport ?? assertClaudeFilesystemSupport;
-            const supported = await verify({ agentId: def.id, launchPath: launch.launchPath, env: spawnEnv }, {});
+            const supported = await verifyClaudeFilesystem({ agentId: def.id, launchPath: launch.launchPath, env: spawnEnv }, {});
             const runtimeDir = join(input.filesystemRoot, '.agent-runtime');
             await fsPromises.mkdir(runtimeDir, { recursive: true, mode: 0o700 });
             // Refuse a runtime-folder symlink escaping the site before creating anything beneath it.
             validateFilesystemLaunch({ filesystemRoot: input.filesystemRoot, cwd: input.cwd, extraAllowedDirs: [runtimeDir] }, {});
             input.filesystemTempDir = await fsPromises.realpath(await fsPromises.mkdtemp(join(runtimeDir, 'tmp-')));
-            filesystemTemps.set(input.runId, input.filesystemTempDir);
+            filesystemTemps.set(input.runId, [input.filesystemTempDir]);
             // Recheck after creation too: swapping the runtime symlink must never grant outside temp access.
             validateFilesystemLaunch({ filesystemRoot: input.filesystemRoot, cwd: input.cwd, extraAllowedDirs: [input.filesystemTempDir] }, {});
             input.filesystemSharedTempRoots = [spawnEnv.TMPDIR, spawnEnv.TMP, spawnEnv.TEMP].filter((path) => Boolean(path));
             spawnEnv.TMPDIR = input.filesystemTempDir;
             spawnEnv.TMP = input.filesystemTempDir;
             spawnEnv.TEMP = input.filesystemTempDir;
+            if (def.id === 'claude' && process.platform !== 'win32') {
+                // Claude shortens long Bash socket paths to shared scratch. Keep even the /private alias
+                // plus /claude-<uid> below 44 bytes, and isolate it with mkdtemp's private 0700 directory.
+                const runtimeTemp = await fsPromises.mkdtemp('/tmp/jini-');
+                filesystemTemps.get(input.runId).push(runtimeTemp);
+                input.filesystemRuntimeTempBase = runtimeTemp;
+                spawnEnv.CLAUDE_CODE_TMPDIR = runtimeTemp;
+            }
             if (supported === false) {
                 input.filesystemNotice = 'files and shell are not folder-limited for this agent';
                 console.warn('[agent-executor] files and shell are not folder-limited for this agent');
@@ -842,6 +890,9 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         }, options.runtimeState ? { state: options.runtimeState } : {});
         return { systemPromptOverlay, overlayDelivery };
     }
+    /** Resolve the launch environment before staging the run's private temp overrides.
+     * Mutates only this run's input; O(e) for e environment entries plus executable resolution I/O.
+     */
     async function resolveRunLaunch({ input, def }, _options = {}) {
         // The def's own declared env (e.g. claude's `ENABLE_TOOL_SEARCH=false`) is a default the run's
         // env can override. Detection already spawns with it (`detection.ts`); without this the run
@@ -884,7 +935,7 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         const formatForStdin = { streamFormat };
         const stdinHandle = isStdinDrivenFormat(formatForStdin)
             ? wireChildLifecycle({
-                ...(mcpBridge && supportsMessageRelay({ def }) ? { registerMessageRelay: (relay) => liveRunRelays.set(input.runId, relay) } : {}),
+                ...(canRegisterRunMessageRelay({ def, mcpBridge }) ? { registerMessageRelay: (relay) => liveRunRelays.set(input.runId, relay) } : {}),
                 ...(input.model ? { startingModel: input.model } : {}),
                 ...(modelCatalog ? { modelCatalog } : {}),
                 runId: input.runId,

package/dist/agent-executor/mcp-bridge-probe.d.ts

@@ -16,8 +16,9 @@ export declare function probeMcpBridge({ entry }: {
         readonly args: readonly string[];
         readonly env?: Readonly<Record<string, string>>;
     };
-}, { spawn, baseEnv, timeoutMs, now }?: {
+}, { spawn, hostEnv, baseEnv, timeoutMs, now }?: {
     readonly spawn?: typeof nodeSpawn;
+    readonly hostEnv?: Readonly<Record<string, string | undefined>>;
     readonly baseEnv?: Readonly<Record<string, string>>;
     readonly timeoutMs?: number;
     readonly now?: () => number;

package/dist/agent-executor/mcp-bridge-probe.js

@@ -44,7 +44,7 @@ function reapProbe({ timer, lines, child }) {
  * Spawn/errors/exits/timeouts return diagnostics rather than rejecting. Stderr retains 2000 bytes.
  * @complexity O(n) in received bytes; stderr storage is bounded independently of child output.
  */
-export async function probeMcpBridge({ entry }, { spawn = nodeSpawn, baseEnv = buildAgentEnv({ hostEnv: process.env }), timeoutMs = 15_000, now = Date.now } = {}) {
+export async function probeMcpBridge({ entry }, { spawn = nodeSpawn, hostEnv = process.env, baseEnv = buildAgentEnv({ hostEnv }), timeoutMs = 15_000, now = Date.now } = {}) {
     const startedAt = now();
     const env = { ...baseEnv, ...entry.env, JINI_RUN_ID: 'bridge-probe' };
     // Initialize needs no callback: never delegate a real run's authority to this diagnostic child.

package/dist/agent-executor/mcp-bridge.d.ts

@@ -1,7 +1,8 @@
 import type { McpBridgeProbeResult } from './mcp-bridge-probe.js';
 import { ensureAntigravityMcpPermission } from './antigravity-permissions.js';
 import type { AcpMcpServerInput, RuntimeAgentDef } from '@jini-ai/agent-runtime';
-import type { McpJsonInjectionOptions, McpJsonServerEntry, McpBridgeDelivery, PreparedCodexHome, PreparedClaudeConfigDir, ClaudeConfigDirIsolationOptions, FailBeforeSpawn } from './contracts.js';
+import type { McpJsonInjectionOptions, McpJsonServerEntry, McpBridgeDelivery, PreparedClaudeConfigDir, ClaudeConfigDirIsolationOptions, FailBeforeSpawn } from './contracts.js';
+export declare const JINI_MCP_SERVER_KEY = "jini";
 /** The run-error code a run gets when its CLI reports the injected `jini` bridge as anything but connected. */
 export declare const MCP_BRIDGE_UNAVAILABLE = "MCP_BRIDGE_UNAVAILABLE";
 /**
@@ -149,66 +150,6 @@ export declare function mergeEnvContentInstructions({ existingRaw, instructionsF
     readonly existingRaw: string | undefined;
     readonly instructionsFilePath: string;
 }): string;
-/**
- * Mechanism 5 of 5 — `'codex-toml'`'s serialization step. Builds the `[mcp_servers.jini]` TOML
- * table (plus, when the entry carries any env vars, a separate `[mcp_servers.jini.env]` table)
- * Codex's own config schema expects.
- *
- * Confirmed against a real installed Codex CLI (0.151.0), not assumed from docs: round-tripping
- * `codex mcp add <name> --env K=V -- <cmd> <args>` against a scratch `CODEX_HOME` and reading back
- * `config.toml` produced exactly this shape (`command`/`args` as TOML strings/array in the main
- * table, env vars in a nested `.env` table) — see `archived provenance ledger` for the transcript.
- * @param entry - The shared bridge entry from {@link buildMcpJsonServerEntry}.
- * @returns A TOML fragment with no leading/trailing blank-line padding — {@link buildCodexHomeConfigToml} owns spacing when combining it with existing content.
- * @complexity O(n) in the number of argv/env entries.
- * @overallScore 100/100
- */
-export declare function buildCodexMcpServerToml({ entry }: {
-    readonly entry: McpJsonServerEntry;
-}): string;
-/**
- * Builds the full `config.toml` a run's scratch `CODEX_HOME` gets: the real Codex home's own
- * config, with any pre-existing `[mcp_servers.jini]` table removed (see
- * {@link stripExistingJiniMcpServerTable}), then this run's own table appended.
- *
- * **Append-only by design, not a parse-and-merge, for everything but the jini table itself.**
- * `mergeMcpJsonContent`/`mergeEnvContentMcpConfig` above can safely parse-merge-reserialize because
- * their formats have a JS-native parser (`JSON.parse`); this driver has no general TOML parser in
- * its dependency graph (see `buildCodexMcpServerToml`'s doc), and every other setting a real Codex
- * install carries — model choice, sandbox policy, the trusted-project list, the operator's own
- * other MCP servers — must survive a spawn byte-for-byte. Only the one table this driver itself
- * owns (`jini` is this integration's own reserved server name — see {@link JINI_MCP_SERVER_KEY}) is
- * removed by default, via the narrow line-oriented scan above, never a full TOML parse. Explicit
- * per-run OFF choices additionally omit personal MCP tables or retain only those tables when
- * user settings are off. Inline root MCP declarations fail closed when isolation is requested.
- * @param existingRaw - The real Codex home's `config.toml` content, or `undefined` when it does not
- * exist (a fresh Codex install — degrades to "start from just this run's block", matching
- * {@link mergeMcpJsonContent}'s own "missing file" handling).
- * @param entry - The shared bridge entry.
- * @returns The full text to write to the scratch `CODEX_HOME`'s `config.toml`.
- * @complexity O(n) in the existing config's length.
- */
-export declare function buildCodexHomeConfigToml({ existingRaw, entry, inheritUserMcp, inheritUserSettings }: {
-    readonly existingRaw: string | undefined;
-    readonly entry: McpJsonServerEntry;
-    readonly inheritUserMcp?: boolean;
-    readonly inheritUserSettings?: boolean;
-}, _optional?: Record<string, never>): string;
-/**
- * Where `'codex-toml'` reads the operator's REAL Codex config from, to seed a run's scratch copy —
- * never where it writes. Resolved against the daemon HOST process's own environment (`hostEnv`,
- * `process.env` at the real call site), not a run's sandboxed spawn env: `CODEX_HOME` is not in
- * `BASELINE_AGENT_ENV_KEYS`, so a spawned child never inherits it anyway, and the whole point here
- * is finding wherever the *operator's actual* Codex install lives, which is a host-machine fact.
- * @param hostEnv - The daemon process's own environment.
- * @returns `hostEnv.CODEX_HOME` when set to a non-blank value (matching Codex's own resolution
- * order), else the CLI's documented default, `~/.codex`.
- * @complexity O(1).
- * @overallScore 100/100
- */
-export declare function resolveSourceCodexHomeDir({ hostEnv }: {
-    readonly hostEnv: NodeJS.ProcessEnv;
-}): string;
 /**
  * **The single dispatch point from an `externalMcpInjection` strategy to its delivery mechanism.**
  * Pure and synchronous — the one effectful input (the per-run bearer credential) arrives already
@@ -238,6 +179,13 @@ export declare function buildMcpBridgeDelivery(input: {
     readonly credential: string | undefined;
     readonly messageRelayNonce?: string;
 }): McpBridgeDelivery | null;
+export declare function defaultReadMcpJsonFile({ path }: {
+    readonly path: string;
+}): Promise<string>;
+export declare function defaultWriteMcpJsonFile({ path, content }: {
+    readonly path: string;
+    readonly content: string;
+}): Promise<void>;
 export declare function defaultRemoveMcpJsonFile({ path }: {
     readonly path: string;
 }): Promise<void>;
@@ -287,31 +235,6 @@ export declare function writeMcpJsonIfNeeded({ input, deps }: {
         readonly failBeforeSpawn: FailBeforeSpawn;
     };
 }): Promise<string | undefined>;
-/**
- * Phase 10b: mechanism 5 of 5's one effect — stages this run's scratch `CODEX_HOME` directory,
- * returning the prepared handle `cleanupStagedFiles` should later release (`null` for every other
- * mechanism, or for an unconfigured host — matching {@link writeMcpJsonIfNeeded}'s identical gate).
- * @param input.def - Only used for its `id`, in the failure message.
- * @param input.mcpBridge - This run's resolved bridge delivery — a no-op unless its `kind` is `'codex-toml'`.
- * @param deps.hostEnv - The daemon's own environment, threaded through to {@link resolveSourceCodexHomeDir} rather than read from a module-level `process.env` so this phase stays testable with an injected env.
- * @complexity O(1) plus {@link prepareCodexHomeForRun}'s own cost.
- * @overallScore 100/100
- */
-export declare function prepareCodexHomeIfNeeded({ input, deps }: {
-    readonly input: {
-        readonly runId: string;
-        readonly nativeToolAccess?: boolean | undefined;
-        readonly nativeCapabilities?: Partial<import('@jini-ai/agent-runtime').NativeCapabilities>;
-        readonly def: RuntimeAgentDef;
-        readonly mcpBridge: McpBridgeDelivery | null;
-    };
-    readonly deps: {
-        readonly mcpJsonInjection: McpJsonInjectionOptions | undefined;
-        readonly hostEnv: NodeJS.ProcessEnv;
-        readonly releaseStagedResources: () => Promise<void>;
-        readonly failBeforeSpawn: FailBeforeSpawn;
-    };
-}): Promise<PreparedCodexHome | null>;
 /**
  * Finding 1 of SEC-assistant-env-isolation-2026-09-07's one effect — stages this run's scratch
  * `CLAUDE_CONFIG_DIR` directory, returning the prepared handle `cleanupStagedFiles` should later