@jini-ai/daemon 0.6.15-rc.1 → 0.6.15

package/dist/agent-executor/codex/home-config.js

@@ -103,7 +103,7 @@ function scanBareTomlKeyChar(scan, ch) {
         scan.current += ch;
 }
 // An inline or dotted root `mcp_servers` declaration, which the table scanner below cannot rewrite.
-const INLINE_MCP_SERVERS = /^\s*(?:mcp_servers|"mcp_servers"|'mcp_servers')\s*(?:\.|=)/;
+const INLINE_MCP_SERVERS = /^\s*(?:mcp_servers|"mcp_servers"|'mcp_servers')\s*[.=]/;
 // `[<key>]` optionally followed only by a `# comment`; `[[...]]` never matches (see below).
 const TOML_TABLE_HEADER = /^\s*\[([^[\]]+)\]\s*(#.*)?$/;
 /**
@@ -203,7 +203,8 @@ function stripExistingJiniMcpServerTable(existingRaw, optional = {}) {
  */
 export function buildCodexHomeConfigToml({ existingRaw, entry, inheritUserMcp = true, inheritUserSettings = true }, _optional = {}) {
     const base = stripExistingJiniMcpServerTable(existingRaw ?? '', { allServers: !inheritUserMcp, mcpOnly: !inheritUserSettings });
-    const separator = base.length === 0 ? '' : base.endsWith('\n') ? '\n' : '\n\n';
+    const blockBreak = base.endsWith('\n') ? '\n' : '\n\n';
+    const separator = base.length === 0 ? '' : blockBreak;
     return `${base}${separator}${buildCodexMcpServerToml({ entry: entry })}`;
 }
 //# sourceMappingURL=home-config.js.map

package/dist/agent-executor/codex/home-staging.js

@@ -5,6 +5,7 @@ import { errorMessage } from '../values.js';
 import { defaultReadMcpJsonFile, defaultWriteMcpJsonFile } from '../mcp-bridge.js';
 import { buildCodexHomeConfigToml } from './home-config.js';
 import { assertCodexHomeConfigParses, assertStagedHomeIsolated, CodexMcpIsolationError, codexIsolationRefusalMessage } from './isolation.js';
+import { omitKeys } from '../../core/omit-keys.js';
 /**
  * Where `'codex-toml'` reads the operator's REAL Codex config from, to seed a run's scratch copy —
  * never where it writes. Resolved against the daemon HOST process's own environment (`hostEnv`,
@@ -27,8 +28,7 @@ export function resolveSourceCodexHomeDir({ hostEnv }) {
  * `mcp_skill_dependencies.rs`), and `codex exec` is `codex_exec` without it.
  */
 export function withStagedCodexHome({ env, codexHomeDir }, _options = {}) {
-    const { CODEX_INTERNAL_ORIGINATOR_OVERRIDE: _originator, ...rest } = env;
-    return { ...rest, CODEX_HOME: codexHomeDir };
+    return { ...omitKeys(env, ['CODEX_INTERNAL_ORIGINATOR_OVERRIDE']), CODEX_HOME: codexHomeDir };
 }
 function defaultMkdtempCodexHome({ prefix }) {
     return fsPromises.mkdtemp(join(tmpdir(), prefix));

package/dist/agent-executor/codex/isolation.js

@@ -1,4 +1,4 @@
-import { parse } from 'smol-toml';
+import { createRequire } from 'node:module';
 import { JINI_MCP_SERVER_KEY } from '../mcp-bridge.js';
 import { isRecord } from '../values.js';
 /** A run with personal MCP off that Codex cannot keep to the bridge alone: refused, never run with a leak. */
@@ -15,7 +15,9 @@ export function codexIsolationRefusalMessage(reason) {
  * known, and Codex could not load it either.
  * @complexity O(n) in the file length.
  */
-function parseCodexLayer(raw, path) {
+function parseCodexLayer({ raw, path }, _optional = {}) {
+    // The optional parser is needed only for Codex isolation, so memory-only hosts can still boot.
+    const { parse } = createRequire(import.meta.url)('smol-toml');
     try {
         return parse(raw);
     }
@@ -41,7 +43,7 @@ function assertTrustsNoProject(config, path) {
  */
 export function assertCodexHomeConfigParses({ raw, path }) {
     if (raw !== undefined)
-        parseCodexLayer(raw, path);
+        parseCodexLayer({ raw, path });
 }
 /**
  * The staged home config, parsed: it must declare no MCP server but the bridge and trust no
@@ -54,7 +56,7 @@ export function assertStagedHomeIsolated({ homeConfig, path }) {
     const refusal = new CodexMcpIsolationError(`${path} declares MCP servers that can't be removed safely.`);
     let config;
     try {
-        config = parse(homeConfig);
+        config = parseCodexLayer({ raw: homeConfig, path });
     }
     catch {
         throw refusal;

package/dist/agent-executor/event-translation.js

@@ -227,9 +227,9 @@ export function applyAgentTranslationSideEffects({ payload, sessionId, sink }) {
         sink.onSessionId({ sessionId });
     if (payload.type === 'tool_use') {
         sink.onToolCall({ toolUse: payload });
+        return;
     }
-    else if ((payload.type === 'text_delta' || payload.type === 'thinking_delta') && payload.delta.length > 0) {
+    if ((payload.type === 'text_delta' || payload.type === 'thinking_delta') && payload.delta.length > 0)
         sink.onUserVisibleOutput();
-    }
 }
 //# sourceMappingURL=event-translation.js.map

package/dist/agent-executor/events.js

@@ -8,7 +8,7 @@ import { observeRunOutput } from './run-output.js';
 import { messageContentWithImages } from '../attachment-content.js';
 import { redactSecrets, } from '@jini-ai/core';
 import { createClaudeStreamHandler, createCopilotStreamHandler, createJsonEventStreamHandler, createQoderStreamHandler, attachAcpSession, attachPiRpcSession, } from '@jini-ai/agent-runtime';
-import { collectProcessTreePids, listProcessSnapshots, stopProcesses, } from '@jini-ai/platform/process';
+import { listProcessSnapshots, stopProcesses, } from '@jini-ai/platform/process';
 import { classifyRunCloseStatus, } from '../close-status.js';
 import { resolveContinuationTransport, } from '../continuation/continuation-transport.js';
 import { resultContent, } from '../delegated-tool-bridge.js';
@@ -48,6 +48,11 @@ function createStreamHandlerForDef(def, streamFormat, onEvent) {
             return createQoderStreamHandler({ onEvent: onEvent });
         case 'json-event-stream':
             return createJsonEventStreamHandler({ kind: def.eventParser ?? '', onEvent: onEvent });
+        default: {
+            // Unreachable: every stream format has a case above, and a new one fails typecheck here.
+            const unknownFormat = streamFormat;
+            throw new TypeError(`Unknown agent stream format: ${String(unknownFormat)}`);
+        }
     }
 }
 /**
@@ -463,9 +468,8 @@ export function wireChildLifecycle(ctx) {
      */
     function handleTurnEnd(stopReason) {
         const toolUse = pendingToolUse;
-        const shouldInject = stopReason === 'tool_use' &&
-            toolUse !== undefined &&
-            continuation !== undefined &&
+        const toolTurnPending = stopReason === 'tool_use' && toolUse !== undefined && continuation !== undefined;
+        const shouldInject = toolTurnPending &&
             resolveContinuationTransport({ def: def }) === 'stdin-injection' &&
             continuation.autonomousToolNames.has(toolUse.name);
         if (!shouldInject) {
@@ -547,10 +551,10 @@ export function wireChildLifecycle(ctx) {
                     return lifecycle.emit({ runId, input: { event: 'agent', data: statusWithChildIdentity({ payload, childPid: ctx.child.pid }, {}) } });
                 });
             }
-            else if (translation.kind === 'error') {
+            if (translation.kind === 'error') {
                 enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'error', data: translation.payload } }));
             }
-            else if (translation.kind === 'turn-end') {
+            if (translation.kind === 'turn-end') {
                 handleTurnEnd(translation.stopReason);
             }
         });
@@ -607,7 +611,8 @@ export function wireChildLifecycle(ctx) {
     }
     /**
      * Emits the accumulated `'until-close'` stdout — sanitized — as exactly one raw `'stdout'` echo
-     * plus one `text_delta`, through the same `enqueueEmit` FIFO queue every other emit uses, so the
+     * plus one `text_delta` for plain output, or through the declared structured parser. Both use
+     * the same `enqueueEmit` FIFO queue every other emit uses, so the
      * flush is ordered after every already-queued event and before `finish()`'s `'end'`. A no-op for
      * every live-streaming def (nothing was ever accumulated) and for a buffered run that produced
      * no stdout at all — an empty `text_delta` is noise, not information.
@@ -622,10 +627,19 @@ export function wireChildLifecycle(ctx) {
         const safe = sanitizeBufferedStdout ? sanitizeBufferedStdout({ fullText: bufferedStdout }) : bufferedStdout;
         bufferedStdout = '';
         bufferedStdoutBytes = 0;
-        const text = droppedStdoutBytes > 0
-            ? `${safe}${bufferedStdoutTruncationNotice(droppedStdoutBytes, ctx.bufferedStdoutMaxBytes)}`
-            : safe;
+        const dropped = droppedStdoutBytes;
         droppedStdoutBytes = 0;
+        if (streamHandler !== null) {
+            // Redact the complete wire text before parsing: structured errors can contain sign-in URLs too.
+            stdoutDiagnostics.feed({ text: safe });
+            streamHandler.feed({ chunk: safe });
+            if (dropped > 0)
+                enqueueEmit(() => lifecycle.emit({ runId, input: { event: 'error', data: {
+                            message: bufferedStdoutTruncationNotice(dropped, ctx.bufferedStdoutMaxBytes),
+                        } } }));
+            return;
+        }
+        const text = dropped > 0 ? `${safe}${bufferedStdoutTruncationNotice(dropped, ctx.bufferedStdoutMaxBytes)}` : safe;
         if (text.length === 0)
             return;
         enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'stdout', data: { chunk: text } } }));
@@ -634,27 +648,27 @@ export function wireChildLifecycle(ctx) {
     child.stdout?.on('data', (chunk) => {
         const text = chunk.toString('utf8');
         stdoutDiagnostics.record({ chunk, text });
-        if (streamFormat === 'plain') {
-            if (text.length > 0)
-                userVisibleOutputSeen = true;
-            if (bufferStdoutUntilClose) {
-                // Nothing is emitted on *either* channel yet — see this function's doc on why holding the
-                // raw echo back matters as much as holding back the chat copy.
-                //
-                // Whole chunks only: a chunk that would cross the ceiling is dropped entirely rather than
-                // sliced to fit, which keeps the accumulator free of half-written multi-byte characters (a
-                // `data` event boundary already need not align with one) and makes the kept prefix exactly
-                // the bytes some prefix of chunks produced. Everything after the first refusal is dropped
-                // too — the point is a hard ceiling on resident bytes, not a best-effort tail.
-                const chunkBytes = Buffer.byteLength(text, 'utf8');
-                if (droppedStdoutBytes > 0 || bufferedStdoutBytes + chunkBytes > ctx.bufferedStdoutMaxBytes) {
-                    droppedStdoutBytes += chunkBytes;
-                    return;
-                }
-                bufferedStdout += text;
-                bufferedStdoutBytes += chunkBytes;
+        if (streamFormat === 'plain' && text.length > 0)
+            userVisibleOutputSeen = true;
+        if (bufferStdoutUntilClose) {
+            // Nothing is emitted on *either* channel yet — see this function's doc on why holding the
+            // raw echo back matters as much as holding back the chat copy.
+            //
+            // Whole chunks only: a chunk that would cross the ceiling is dropped entirely rather than
+            // sliced to fit, which keeps the accumulator free of half-written multi-byte characters (a
+            // `data` event boundary already need not align with one) and makes the kept prefix exactly
+            // the bytes some prefix of chunks produced. Everything after the first refusal is dropped
+            // too — the point is a hard ceiling on resident bytes, not a best-effort tail.
+            const chunkBytes = Buffer.byteLength(text, 'utf8');
+            if (droppedStdoutBytes > 0 || bufferedStdoutBytes + chunkBytes > ctx.bufferedStdoutMaxBytes) {
+                droppedStdoutBytes += chunkBytes;
                 return;
             }
+            bufferedStdout += text;
+            bufferedStdoutBytes += chunkBytes;
+            return;
+        }
+        if (streamFormat === 'plain') {
             enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'stdout', data: { chunk: text } } }));
             enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'agent', data: { type: 'text_delta', delta: text } } }));
             return;
@@ -702,12 +716,12 @@ export function wireChildLifecycle(ctx) {
                 feedSessionLine(controlScanBuffer);
                 controlScanBuffer = '';
             }
+            flushBufferedStdout();
             streamHandler?.flush();
             session.endSession();
             stdoutDiagnostics.flush();
-            // Queued before `await emitQueue` so the flushed text is durably appended ahead of
-            // `finish()`'s `'end'` event, exactly like every live-path emit already is.
-            flushBufferedStdout();
+            // The buffered flush is queued before `await emitQueue` so its sanitized events are durable
+            // ahead of `finish()`'s `'end'`, exactly like every live-path emit already is.
             await emitQueue;
             if (cancelRequested)
                 await cancelUnresolvedToolCalls();
@@ -741,7 +755,7 @@ export function wireChildLifecycle(ctx) {
      * confirms the write; UUID-attributed CLI receipts separately confirm consumption. */
     async function sendUserMessage({ text, id = randomUUID(), attachmentIds }, { imageContents: images = [] } = {}) {
         if (!acceptsMidRunUserMessages({ def }))
-            return relay?.enqueue({ id, text, hasAttachments: images.length > 0 || (attachmentIds?.length ?? 0) > 0 }) ?? 'unsupported';
+            return relayUserMessage({ id, text, images, attachmentIds });
         const stdin = child.stdin;
         if (stdinClosed || !stdin)
             return 'not-running';
@@ -749,6 +763,9 @@ export function wireChildLifecycle(ctx) {
         writeUserMessage(stdin, text, images, id);
         return 'delivered';
     }
+    function relayUserMessage({ id, text, images, attachmentIds }) {
+        return relay?.enqueue({ id, text, hasAttachments: images.length > 0 || (attachmentIds?.length ?? 0) > 0 }) ?? 'unsupported';
+    }
     /** Writes a complete mid-run turn using the idle image encoder; journals text without base64.
      * The same UUID identifies stdin, queue acceptance and subsequent consumption receipts. */
     function writeUserMessage(stdin, text, images, id) {
@@ -840,7 +857,10 @@ function wireAcpLifecycle(ctx) {
             unsubscribeCancel();
             // Guarded for the same reasons as the child-driven handler above.
             await cleanupStagedFilesSafely(ctx);
-            const status = await output.settle({ status: cancelRequested ? 'cancelled' : controller?.completedSuccessfully() ? 'succeeded' : 'failed' });
+            let finalStatus = 'cancelled';
+            if (!cancelRequested)
+                finalStatus = controller?.completedSuccessfully() ? 'succeeded' : 'failed';
+            const status = await output.settle({ status: finalStatus });
             const resumable = status === 'failed' && classifyFailure !== undefined
                 ? await classifyFailureSafely(ctx, classifyFailure, {
                     runId,
@@ -867,7 +887,7 @@ function wireAcpLifecycle(ctx) {
                         } });
                     enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'agent', data: translation.payload } }));
                 }
-                else if (translation.kind === 'error') {
+                if (translation.kind === 'error') {
                     enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'error', data: translation.payload } }));
                 }
                 return;
@@ -939,7 +959,10 @@ function wirePiRpcLifecycle(ctx) {
             unsubscribeCancel();
             // Guarded for the same reasons as the child-driven handler above.
             await cleanupStagedFilesSafely(ctx);
-            const status = await output.settle({ status: cancelRequested ? 'cancelled' : session?.hasFatalError() ? 'failed' : 'succeeded' });
+            let finalStatus = 'cancelled';
+            if (!cancelRequested)
+                finalStatus = session?.hasFatalError() ? 'failed' : 'succeeded';
+            const status = await output.settle({ status: finalStatus });
             const resumable = status === 'failed' && classifyFailure !== undefined
                 ? await classifyFailureSafely(ctx, classifyFailure, {
                     runId,
@@ -958,18 +981,14 @@ function wirePiRpcLifecycle(ctx) {
                 const receipt = modelReceipt(translation.payload);
                 if (receipt)
                     enqueueEmit(() => lifecycle.emit({ runId, input: { event: 'agent', data: receipt } }));
-                if (translation.sessionId !== undefined)
-                    capturedSessionId = translation.sessionId;
-                if (translation.payload.type === 'tool_use') {
-                    toolCallSeen = true;
-                }
-                else if ((translation.payload.type === 'text_delta' || translation.payload.type === 'thinking_delta') &&
-                    translation.payload.delta.length > 0) {
-                    userVisibleOutputSeen = true;
-                }
+                applyAgentTranslationSideEffects({ payload: translation.payload, sessionId: translation.sessionId, sink: {
+                        onSessionId: ({ sessionId }) => { capturedSessionId = sessionId; },
+                        onToolCall: () => { toolCallSeen = true; },
+                        onUserVisibleOutput: () => { userVisibleOutputSeen = true; },
+                    } });
                 enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'agent', data: translation.payload } }));
             }
-            else if (translation.kind === 'error') {
+            if (translation.kind === 'error') {
                 enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'error', data: translation.payload } }));
             }
         } }, { cwd: ctx.cwd, ...(ctx.model !== undefined ? { model: ctx.model } : {}), ...(ctx.imagePaths.length > 0 ? { imagePaths: [...ctx.imagePaths] } : {}), ...(ctx.uploadRoot !== undefined ? { uploadRoot: ctx.uploadRoot } : {}) });
@@ -1044,8 +1063,8 @@ export async function runAcpDispatch({ input, deps }) {
         // fired-and-forgotten (SEC-007: "await where lifecycle ordering allows it").
         await terminateChildTreeBestEffort({ listProcessSnapshots: deps.listProcessSnapshots, collectProcessTreePids: deps.collectProcessTreePids, stopProcesses: deps.stopProcesses }, input.child, input.runId, 'acp-attach-failure', deps.onCleanupFailure);
         await deps.releaseStagedResources();
-        // `failBeforeSpawn` always rejects (`Promise<never>`); returning it propagates that rejection.
-        return deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: could not attach ACP session for agent "${input.agentId}": ${errorMessage(err)}` });
+        // `failBeforeSpawn` always rejects (`Promise<never>`); awaiting it propagates that rejection.
+        await deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: could not attach ACP session for agent "${input.agentId}": ${errorMessage(err)}` });
     }
 }
 /** Phase 15 (pi-rpc branch): same discipline as {@link runAcpDispatch}, for the one `'pi-rpc'` def. */
@@ -1077,7 +1096,7 @@ export async function runPiRpcDispatch({ input, deps }) {
         // fire-and-forget (SEC-007).
         await terminateChildTreeBestEffort({ listProcessSnapshots: deps.listProcessSnapshots, collectProcessTreePids: deps.collectProcessTreePids, stopProcesses: deps.stopProcesses }, input.child, input.runId, 'pi-rpc-attach-failure', deps.onCleanupFailure);
         await deps.releaseStagedResources();
-        return deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: could not attach pi-rpc session for agent "${input.agentId}": ${errorMessage(err)}` });
+        await deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: could not attach pi-rpc session for agent "${input.agentId}": ${errorMessage(err)}` });
     }
 }
 //# sourceMappingURL=events.js.map

package/dist/agent-executor/launch.js

@@ -6,7 +6,7 @@ import { spawn as nodeSpawn, } from 'node:child_process';
 import { promises as fsPromises, } from 'node:fs';
 import { tmpdir, } from 'node:os';
 import { join, } from 'node:path';
-import { agentCapabilities, createClaudeFilesystemSupportProbe, claudeFilesystemRuntimePaths, claudeFilesystemSettings, validateFilesystemLaunch, validateReadOnlyExtraDirs, bindRuntimeAgentDef, defaultRuntimeState, getRuntimeModelDiscoveryDeps, userToolchainBinDirs, applyAgentLaunchEnv, ensureAgentCapabilities, resolveModelForLaunch, getAgentDef, resolveAgentLaunch, attachAcpSession, attachPiRpcSession, checkPromptArgvBudget, checkWindowsCmdShimCommandLineBudget, checkWindowsDirectExeCommandLineBudget, prepareAgentLogFile, preparePromptFileForAgent, } from '@jini-ai/agent-runtime';
+import { agentCapabilities, assessNativeToolPolicy, resolveNativeToolPolicy, createClaudeFilesystemSupportProbe, claudeFilesystemRuntimePaths, claudeFilesystemSettings, validateFilesystemLaunch, validateReadOnlyExtraDirs, bindRuntimeAgentDef, defaultRuntimeState, getRuntimeModelDiscoveryDeps, userToolchainBinDirs, applyAgentLaunchEnv, ensureAgentCapabilities, resolveModelForLaunch, getAgentDef, resolveAgentLaunch, attachAcpSession, attachPiRpcSession, checkPromptArgvBudget, checkWindowsCmdShimCommandLineBudget, checkWindowsDirectExeCommandLineBudget, prepareAgentLogFile, preparePromptFileForAgent, } from '@jini-ai/agent-runtime';
 import { createCommandInvocation } from '@jini-ai/platform/command';
 import { collectProcessTreePids, listProcessSnapshots, stopProcesses, } from '@jini-ai/platform/process';
 import { applyImagePromptDelivery, } from '../image-prompt-delivery.js';
@@ -580,8 +580,8 @@ export async function guardWindowsCommandLineBudget({ input, deps }) {
         checkWindowsDirectExeCommandLineBudget({ def: input.def, resolvedBin: input.launchPath, args: input.args });
     if (windowsBudgetError) {
         await deps.releaseStagedResources();
-        // `failBeforeSpawn` always rejects (`Promise<never>`); returning it propagates that rejection.
-        return deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_PROMPT_TOO_LARGE', message: windowsBudgetError.message });
+        // `failBeforeSpawn` always rejects (`Promise<never>`); awaiting it propagates that rejection.
+        await deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_PROMPT_TOO_LARGE', message: windowsBudgetError.message });
     }
 }
 /**
@@ -631,29 +631,13 @@ export async function confirmChildSpawned({ input, deps }) {
     }
     catch (err) {
         await deps.releaseStagedResources();
-        return deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: failed to spawn agent "${input.def.id}": ${errorMessage(err)}` });
+        await deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: failed to spawn agent "${input.def.id}": ${errorMessage(err)}` });
     }
 }
 /** Only include declared capability restrictions; absence has a distinct downstream contract. */
 function nativeCapabilityInput({ input }, _options = {}) {
     return { ...(input.nativeCapabilities !== undefined ? { nativeCapabilities: input.nativeCapabilities } : {}) };
 }
-/** Switch names a person sees for each native capability (the host's settings use the same words). */
-const NATIVE_CAPABILITY_LABELS = {
-    shell: 'Bash/shell', fileWrite: 'File edit/write', userMcp: 'Your MCP servers', subagents: 'Subagents/Task',
-    userSettings: 'Your skills and settings', web: 'Web fetch/search', workflows: 'Workflows', loginEnvironment: 'Your shell environment',
-};
-/** The refusal a person reads when a CLI without a native-tool policy cannot honor this run's switches:
- * it names the CLI and the switch to turn on. Owner 2026-10-27: the old "no native-tool policy and
- * audit adapter" told a Gemini user nothing. Pure, O(c) for c OFF switches.
- * @example nativeToolPolicyRefusal({ cliName: 'Antigravity', offSwitches: ['userMcp'] }, {});
- */
-function nativeToolPolicyRefusal({ cliName, offSwitches }, _options = {}) {
-    const switches = offSwitches.map(key => `'${NATIVE_CAPABILITY_LABELS[key] ?? key}'`);
-    const blocked = switches.length > 0 ? `with ${new Intl.ListFormat('en', { type: 'conjunction' }).format(switches)} off` : `with this chat's CLI tool limits`;
-    const action = switches.length === 0 ? `Turn on 'Full CLI access'` : `Turn ${switches.length === 1 ? 'it' : 'them'} on`;
-    return `${cliName} can't run ${blocked}. ${action} in the assistant settings, or choose Claude or Codex.`;
-}
 /** Correlation projects retained stdout, so exact-byte journals need a separate blob writer. */
 function validateStdoutJournalOptions(options, _options = {}) {
     if (options.delegatedResultCorrelation && options.journal && !options.stdoutJournalBlobs) {
@@ -709,13 +693,8 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
     const { createCommandInvocation: createCommandInvocationFn, spawn: spawnFn, listProcessSnapshots: listProcessSnapshotsFn, collectProcessTreePids: collectProcessTreePidsFn, stopProcesses: stopProcessesFn, } = resolveProcessDeps(options);
     const { onCleanupFailure: onCleanupFailureFn, bufferedStdoutMaxBytes } = resolveMiscExecutorDeps(options);
     validateStdoutJournalOptions(options);
-    const journal = options.journal;
-    const continuation = options.continuation;
-    const classifyFailure = options.classifyFailure;
-    const mcpJsonInjection = options.mcpJsonInjection;
-    const claudeConfigDirIsolation = options.claudeConfigDirIsolation;
+    const { journal, continuation, classifyFailure, mcpJsonInjection, claudeConfigDirIsolation, promptAugmenter } = options;
     const claudeConfigDirIsolationEnabled = options.claudeConfigDirIsolationEnabled ?? false;
-    const promptAugmenter = options.promptAugmenter;
     const filesystemTemps = new Map();
     const verifyClaudeFilesystem = options.assertClaudeFilesystemSupport ?? createClaudeFilesystemSupportProbe({});
     /** Remove this run's private temp directories on startup failure, exit, crash or cancellation.
@@ -765,7 +744,9 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
     /** `AgentExecutor.sendUserMessage()` — see that interface method's own doc. @complexity O(1). */
     async function sendUserMessage({ runId, text, id = randomUUID(), attachmentIds }, { imageContents } = {}) {
         const deliver = liveRunInputs.get(runId);
-        return deliver ? deliver({ text, id, ...(attachmentIds ? { attachmentIds } : {}) }, imageContents ? { imageContents } : {}) : 'not-running';
+        if (!deliver)
+            return 'not-running';
+        return deliver({ text, id, ...(attachmentIds ? { attachmentIds } : {}) }, imageContents ? { imageContents } : {});
     }
     /** Validates launch input and selects the definition synchronously before yielding. */
     async function prepareRunContext({ requiredArgs, optionalArgs }, _options = {}) {
@@ -778,14 +759,13 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         return { input, ...resolved };
     }
     async function enforceNativeToolPolicy({ input, def }, _options = {}) {
+        Object.assign(input, resolveNativeToolPolicy({ def, policy: input }));
         // Never silently ignore a host's locked native-tool policy on another CLI.
         // Parity cannot override an explicit lock or a restricted run.
         input.cliParity = input.cliParity === true && input.permissionMode === 'bypass' && input.nativeToolAccess !== false;
-        if (def.supportsNativeToolAccess === true)
-            return;
-        const offSwitches = Object.entries(input.nativeCapabilities ?? {}).filter(([, value]) => value === false).map(([key]) => key);
-        if (input.nativeToolAccess !== undefined && !input.cliParity || offSwitches.length > 0) {
-            return failBeforeSpawn({ runId: input.runId, code: 'NATIVE_TOOL_POLICY_UNSUPPORTED', message: nativeToolPolicyRefusal({ cliName: def.name, offSwitches }, {}) });
+        const refusal = assessNativeToolPolicy({ def, policy: input });
+        if (refusal !== null) {
+            await failBeforeSpawn({ runId: input.runId, code: 'NATIVE_TOOL_POLICY_UNSUPPORTED', message: refusal });
         }
     }
     /** Validate every directory after image augmentation, before model probes or resource staging.
@@ -804,7 +784,7 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
             input.cwd = input.filesystemRoot;
         }
         catch {
-            return failBeforeSpawn({ runId: input.runId, code: 'FILESYSTEM_POLICY_INVALID', message: 'Folder-limited launch refused: invalid filesystem root, working directory or attachment path.' });
+            await failBeforeSpawn({ runId: input.runId, code: 'FILESYSTEM_POLICY_INVALID', message: 'Folder-limited launch refused: invalid filesystem root, working directory or attachment path.' });
         }
     }
     /** Apply supported confinement without removing providers; unknown versions keep the settings.
@@ -829,12 +809,14 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
             spawnEnv.TMP = input.filesystemTempDir;
             spawnEnv.TEMP = input.filesystemTempDir;
             if (def.id === 'claude' && process.platform !== 'win32') {
-                // Claude shortens long Bash socket paths to shared scratch. Keep even the /private alias
-                // plus /claude-<uid> below 44 bytes, and isolate it with mkdtemp's private 0700 directory.
-                const runtimeTemp = await fsPromises.mkdtemp('/tmp/jini-');
+                // Read denies also block create/unlink, so Claude's cwd files cannot live under /tmp.
+                // /var/tmp exists on macOS/Linux; its realpath plus /claude-<uid> must fit 44 bytes
+                // or the policy refuses launch instead of letting Bash fall back to shared scratch.
+                // mkdtemp creates a private 0700 directory; register cleanup before resolving aliases.
+                const runtimeTemp = await fsPromises.mkdtemp('/var/tmp/jini-');
                 filesystemTemps.get(input.runId).push(runtimeTemp);
-                input.filesystemRuntimeTempBase = runtimeTemp;
-                spawnEnv.CLAUDE_CODE_TMPDIR = runtimeTemp;
+                input.filesystemRuntimeTempBase = await fsPromises.realpath(runtimeTemp);
+                spawnEnv.CLAUDE_CODE_TMPDIR = input.filesystemRuntimeTempBase;
             }
             if (supported === false) {
                 input.filesystemNotice = 'files and shell are not folder-limited for this agent';
@@ -854,7 +836,7 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
             spawnEnv.CLAUDE_CODE_DISABLE_AUTO_MEMORY = '1';
         }
         catch {
-            return failBeforeSpawn({ runId: input.runId, code: 'FILESYSTEM_POLICY_UNSUPPORTED', message: 'Folder-limited launch refused: invalid host settings or private runtime directory.' });
+            await failBeforeSpawn({ runId: input.runId, code: 'FILESYSTEM_POLICY_UNSUPPORTED', message: 'Folder-limited launch refused: invalid host settings or private runtime directory.' });
         }
     }
     function resolveRunOverlay({ input, def, imageDelivery }, _options = {}) {
@@ -936,8 +918,7 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         const stdinHandle = isStdinDrivenFormat(formatForStdin)
             ? wireChildLifecycle({
                 ...(canRegisterRunMessageRelay({ def, mcpBridge }) ? { registerMessageRelay: (relay) => liveRunRelays.set(input.runId, relay) } : {}),
-                ...(input.model ? { startingModel: input.model } : {}),
-                ...(modelCatalog ? { modelCatalog } : {}),
+                ...childLifecycleOptions({ input, modelCatalog }),
                 runId: input.runId,
                 def,
                 streamFormat: formatForStdin.streamFormat,
@@ -949,8 +930,6 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
                 onCleanupFailure: onCleanupFailureFn,
                 cleanupStagedFiles,
                 journal,
-                ...(options.delegatedResultCorrelation ? { delegatedResultCorrelation: options.delegatedResultCorrelation } : {}),
-                ...(options.stdoutJournalBlobs ? { stdoutJournalBlobs: options.stdoutJournalBlobs } : {}),
                 continuation,
                 classifyFailure,
                 bufferedStdoutMaxBytes,
@@ -968,6 +947,14 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         child.once('close', () => { liveRunInputs.delete(runId); liveRunRelays.delete(runId); });
         return stdinHandle;
     }
+    function childLifecycleOptions({ input, modelCatalog }) {
+        return {
+            ...(input.model ? { startingModel: input.model } : {}),
+            ...(modelCatalog ? { modelCatalog } : {}),
+            ...(options.delegatedResultCorrelation ? { delegatedResultCorrelation: options.delegatedResultCorrelation } : {}),
+            ...(options.stdoutJournalBlobs ? { stdoutJournalBlobs: options.stdoutJournalBlobs } : {}),
+        };
+    }
     async function dispatchAcpPrompt({ input, def, child, modelCatalog, cleanupStagedFiles, releaseStagedResources, mcpBridge, overlayDelivery }, _options = {}) {
         await runAcpDispatch({ input: {
                 runId: input.runId,
@@ -1050,10 +1037,9 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
     }
     /**
      * `AgentExecutor.run()` — see that interface method's own doc for the
-     * public contract. Implementation note on shape: every guard below
-     * returns `failBeforeSpawn(...)` directly (a `Promise<never>`, valid
-     * wherever `Promise<void>` is expected) rather than `await`-then-`return`,
-     * so each failure path reads as a single, obviously-terminal statement.
+     * public contract. Implementation note on shape: every failure path below
+     * awaits `failBeforeSpawn(...)` (a `Promise<never>`, so the await always
+     * throws) and then returns, so each one reads as obviously terminal.
      * @param input - `{runId, agentId, prompt, cwd, model?, reasoning?, imagePaths?, extraAllowedDirs?, uploadRoot?, env?}` — `runId` must already be `lifecycle.start()`-ed.
      * @throws {@link AgentExecutorError} — see index.ts module doc's Invariant; never a bare `Error`.
      * @complexity O(1) setup (registry lookup, launch resolution, one spawn call); steady-state cost thereafter belongs to {@link wireChildLifecycle}.
@@ -1250,7 +1236,8 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         const spawnResult = spawnAgentChildProcess({ input: { cwd: input.cwd, childEnv, invocation }, deps: { spawn: spawnFn } });
         if (spawnResult.kind === 'error') {
             await releaseStagedResources();
-            return failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: spawn threw synchronously for agent "${def.id}": ${errorMessage(spawnResult.error)}` });
+            await failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: spawn threw synchronously for agent "${def.id}": ${errorMessage(spawnResult.error)}` });
+            return;
         }
         const child = spawnResult.child;
         // Registered before the spawn-confirmation await below, for the same reason
@@ -1277,10 +1264,12 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         // worse than releasing early (see `RuntimeLockHold.waitForHandoff`'s own doc).
         armHandoffWatcher({ runtimeLockHold: runtimeLockHold, handoffInput: { logFilePath: preparedLogFile?.path, model: selectedModel, processExited: processExitedController.signal }, release: releaseRuntimeLock });
         if (streamFormat === 'acp-json-rpc') {
-            return dispatchAcpPrompt({ input, def, child, modelCatalog, cleanupStagedFiles, releaseStagedResources, mcpBridge, overlayDelivery }, {});
+            await dispatchAcpPrompt({ input, def, child, modelCatalog, cleanupStagedFiles, releaseStagedResources, mcpBridge, overlayDelivery }, {});
+            return;
         }
         if (streamFormat === 'pi-rpc') {
-            return dispatchPiPrompt({ input, def, child, modelCatalog, cleanupStagedFiles, releaseStagedResources, overlayDelivery }, {});
+            await dispatchPiPrompt({ input, def, child, modelCatalog, cleanupStagedFiles, releaseStagedResources, overlayDelivery }, {});
+            return;
         }
         dispatchStdinPrompt({ input, def, child, overlayDelivery, imageDelivery, stdinHandle }, {});
     }

package/dist/agent-executor/live-session-state.js

@@ -1,4 +1,5 @@
 import { isRecord } from './values.js';
+import { omitKeys } from '../core/omit-keys.js';
 /** Parse only records; malformed stdout remains the stream parser's responsibility. */
 function frameRecord(line) {
     try {
@@ -39,16 +40,18 @@ export function createLiveSessionState({ emit }, _options = {}) {
     let backgroundTasks = 0;
     function publishTask(task) {
         tasks.set(task.id, task);
-        const { local: _local, ...payload } = task;
-        emit(payload);
+        emit(omitKeys(task, ['local']));
     }
     function taskDetails(frame, previous) {
         const patch = isRecord(frame.patch) ? frame.patch : frame;
         const description = typeof patch.description === 'string' ? patch.description : previous?.description;
         const detail = typeof frame.summary === 'string' ? frame.summary : previous?.detail;
-        const local = frame.task_type === 'local_agent' || typeof frame.subagent_type === 'string' || previous?.local === true;
+        const local = isLocalTask({ frame, previous });
         return { local, ...(description === undefined ? {} : { description }), ...(detail === undefined ? {} : { detail }) };
     }
+    function isLocalTask({ frame, previous }) {
+        return frame.task_type === 'local_agent' || typeof frame.subagent_type === 'string' || previous?.local === true;
+    }
     function nextTaskStatus(frame, previous) {
         if (frame.subtype === 'task_started')
             return 'running';

package/dist/agent-executor/mcp-bridge.js

@@ -260,13 +260,10 @@ export function mergeEnvContentInstructions({ existingRaw, instructionsFilePath
  * @overallScore 100/100
  */
 export function buildMcpBridgeDelivery(input) {
-    const { cwd, runId, strategy, options, credential } = input;
+    const { cwd, runId, strategy, options } = input;
     if (options === undefined || strategy === undefined)
         return null;
-    const serverEntry = buildMcpJsonServerEntry({ runId: runId, options: options }, {
-        ...(credential === undefined ? {} : { credential }),
-        ...(input.messageRelayNonce ? { messageRelayNonce: input.messageRelayNonce } : {}),
-    });
+    const serverEntry = buildMcpJsonServerEntry({ runId: runId, options: options }, bridgeCredentialOptions(input));
     switch (strategy) {
         case 'claude-mcp-json':
             return { kind: 'claude-mcp-json', mcpJsonPath: mcpJsonPathForRun(cwd, runId), serverEntry };
@@ -279,8 +276,19 @@ export function buildMcpBridgeDelivery(input) {
             return { kind: 'codex-toml', serverEntry };
         case 'env-passthrough':
             return { kind: 'env-passthrough', serverEntry };
+        default: {
+            // Unreachable: every bridge strategy has a case above, and a new one fails typecheck here.
+            const unknownStrategy = strategy;
+            throw new TypeError(`Unknown MCP bridge strategy: ${String(unknownStrategy)}`);
+        }
     }
 }
+function bridgeCredentialOptions(input) {
+    return {
+        ...(input.credential === undefined ? {} : { credential: input.credential }),
+        ...(input.messageRelayNonce ? { messageRelayNonce: input.messageRelayNonce } : {}),
+    };
+}
 export function defaultReadMcpJsonFile({ path }) {
     return fsPromises.readFile(path, 'utf8');
 }

package/dist/agent-executor/message-relay.js

@@ -26,7 +26,8 @@ export function createMessageRelay({ emit }, { maxChars = 32_000 } = {}) {
         enqueue({ id, text, hasAttachments }) {
             if (closed)
                 return 'not-running';
-            pending.push({ id, text, hasAttachments, seq: ++seq });
+            seq += 1;
+            pending.push({ id, text, hasAttachments, seq });
             emit({ type: 'user_message', id, text, deliveryState: 'queued' });
             return 'delivered';
         },
@@ -36,11 +37,9 @@ export function createMessageRelay({ emit }, { maxChars = 32_000 } = {}) {
             let count = 0;
             let chars = 0;
             for (const message of pending) {
-                if (message.hasAttachments)
-                    break;
-                const size = JSON.stringify({ id: message.id, seq: message.seq, text: message.text }).length;
-                // Whole messages only; a single oversized message is delivered alone.
-                if (count > 0 && chars + size > maxChars)
+                // Whole messages only, stopping at an attachment; a single oversized message is delivered alone.
+                const size = message.hasAttachments ? 0 : JSON.stringify({ id: message.id, seq: message.seq, text: message.text }).length;
+                if (message.hasAttachments || (count > 0 && chars + size > maxChars))
                     break;
                 chars += size;
                 count++;