@jini-ai/daemon 0.6.15-rc.2 → 0.6.15

package/dist/agent-executor/codex/home-config.js

@@ -103,7 +103,7 @@ function scanBareTomlKeyChar(scan, ch) {
         scan.current += ch;
 }
 // An inline or dotted root `mcp_servers` declaration, which the table scanner below cannot rewrite.
-const INLINE_MCP_SERVERS = /^\s*(?:mcp_servers|"mcp_servers"|'mcp_servers')\s*(?:\.|=)/;
+const INLINE_MCP_SERVERS = /^\s*(?:mcp_servers|"mcp_servers"|'mcp_servers')\s*[.=]/;
 // `[<key>]` optionally followed only by a `# comment`; `[[...]]` never matches (see below).
 const TOML_TABLE_HEADER = /^\s*\[([^[\]]+)\]\s*(#.*)?$/;
 /**
@@ -203,7 +203,8 @@ function stripExistingJiniMcpServerTable(existingRaw, optional = {}) {
  */
 export function buildCodexHomeConfigToml({ existingRaw, entry, inheritUserMcp = true, inheritUserSettings = true }, _optional = {}) {
     const base = stripExistingJiniMcpServerTable(existingRaw ?? '', { allServers: !inheritUserMcp, mcpOnly: !inheritUserSettings });
-    const separator = base.length === 0 ? '' : base.endsWith('\n') ? '\n' : '\n\n';
+    const blockBreak = base.endsWith('\n') ? '\n' : '\n\n';
+    const separator = base.length === 0 ? '' : blockBreak;
     return `${base}${separator}${buildCodexMcpServerToml({ entry: entry })}`;
 }
 //# sourceMappingURL=home-config.js.map

package/dist/agent-executor/codex/home-staging.js

@@ -5,6 +5,7 @@ import { errorMessage } from '../values.js';
 import { defaultReadMcpJsonFile, defaultWriteMcpJsonFile } from '../mcp-bridge.js';
 import { buildCodexHomeConfigToml } from './home-config.js';
 import { assertCodexHomeConfigParses, assertStagedHomeIsolated, CodexMcpIsolationError, codexIsolationRefusalMessage } from './isolation.js';
+import { omitKeys } from '../../core/omit-keys.js';
 /**
  * Where `'codex-toml'` reads the operator's REAL Codex config from, to seed a run's scratch copy —
  * never where it writes. Resolved against the daemon HOST process's own environment (`hostEnv`,
@@ -27,8 +28,7 @@ export function resolveSourceCodexHomeDir({ hostEnv }) {
  * `mcp_skill_dependencies.rs`), and `codex exec` is `codex_exec` without it.
  */
 export function withStagedCodexHome({ env, codexHomeDir }, _options = {}) {
-    const { CODEX_INTERNAL_ORIGINATOR_OVERRIDE: _originator, ...rest } = env;
-    return { ...rest, CODEX_HOME: codexHomeDir };
+    return { ...omitKeys(env, ['CODEX_INTERNAL_ORIGINATOR_OVERRIDE']), CODEX_HOME: codexHomeDir };
 }
 function defaultMkdtempCodexHome({ prefix }) {
     return fsPromises.mkdtemp(join(tmpdir(), prefix));

package/dist/agent-executor/codex/isolation.js

@@ -1,4 +1,4 @@
-import { parse } from 'smol-toml';
+import { createRequire } from 'node:module';
 import { JINI_MCP_SERVER_KEY } from '../mcp-bridge.js';
 import { isRecord } from '../values.js';
 /** A run with personal MCP off that Codex cannot keep to the bridge alone: refused, never run with a leak. */
@@ -15,7 +15,9 @@ export function codexIsolationRefusalMessage(reason) {
  * known, and Codex could not load it either.
  * @complexity O(n) in the file length.
  */
-function parseCodexLayer(raw, path) {
+function parseCodexLayer({ raw, path }, _optional = {}) {
+    // The optional parser is needed only for Codex isolation, so memory-only hosts can still boot.
+    const { parse } = createRequire(import.meta.url)('smol-toml');
     try {
         return parse(raw);
     }
@@ -41,7 +43,7 @@ function assertTrustsNoProject(config, path) {
  */
 export function assertCodexHomeConfigParses({ raw, path }) {
     if (raw !== undefined)
-        parseCodexLayer(raw, path);
+        parseCodexLayer({ raw, path });
 }
 /**
  * The staged home config, parsed: it must declare no MCP server but the bridge and trust no
@@ -54,7 +56,7 @@ export function assertStagedHomeIsolated({ homeConfig, path }) {
     const refusal = new CodexMcpIsolationError(`${path} declares MCP servers that can't be removed safely.`);
     let config;
     try {
-        config = parse(homeConfig);
+        config = parseCodexLayer({ raw: homeConfig, path });
     }
     catch {
         throw refusal;

package/dist/agent-executor/event-translation.js

@@ -227,9 +227,9 @@ export function applyAgentTranslationSideEffects({ payload, sessionId, sink }) {
         sink.onSessionId({ sessionId });
     if (payload.type === 'tool_use') {
         sink.onToolCall({ toolUse: payload });
+        return;
     }
-    else if ((payload.type === 'text_delta' || payload.type === 'thinking_delta') && payload.delta.length > 0) {
+    if ((payload.type === 'text_delta' || payload.type === 'thinking_delta') && payload.delta.length > 0)
         sink.onUserVisibleOutput();
-    }
 }
 //# sourceMappingURL=event-translation.js.map

package/dist/agent-executor/events.js

@@ -8,7 +8,7 @@ import { observeRunOutput } from './run-output.js';
 import { messageContentWithImages } from '../attachment-content.js';
 import { redactSecrets, } from '@jini-ai/core';
 import { createClaudeStreamHandler, createCopilotStreamHandler, createJsonEventStreamHandler, createQoderStreamHandler, attachAcpSession, attachPiRpcSession, } from '@jini-ai/agent-runtime';
-import { collectProcessTreePids, listProcessSnapshots, stopProcesses, } from '@jini-ai/platform/process';
+import { listProcessSnapshots, stopProcesses, } from '@jini-ai/platform/process';
 import { classifyRunCloseStatus, } from '../close-status.js';
 import { resolveContinuationTransport, } from '../continuation/continuation-transport.js';
 import { resultContent, } from '../delegated-tool-bridge.js';
@@ -48,6 +48,11 @@ function createStreamHandlerForDef(def, streamFormat, onEvent) {
             return createQoderStreamHandler({ onEvent: onEvent });
         case 'json-event-stream':
             return createJsonEventStreamHandler({ kind: def.eventParser ?? '', onEvent: onEvent });
+        default: {
+            // Unreachable: every stream format has a case above, and a new one fails typecheck here.
+            const unknownFormat = streamFormat;
+            throw new TypeError(`Unknown agent stream format: ${String(unknownFormat)}`);
+        }
     }
 }
 /**
@@ -463,9 +468,8 @@ export function wireChildLifecycle(ctx) {
      */
     function handleTurnEnd(stopReason) {
         const toolUse = pendingToolUse;
-        const shouldInject = stopReason === 'tool_use' &&
-            toolUse !== undefined &&
-            continuation !== undefined &&
+        const toolTurnPending = stopReason === 'tool_use' && toolUse !== undefined && continuation !== undefined;
+        const shouldInject = toolTurnPending &&
             resolveContinuationTransport({ def: def }) === 'stdin-injection' &&
             continuation.autonomousToolNames.has(toolUse.name);
         if (!shouldInject) {
@@ -547,10 +551,10 @@ export function wireChildLifecycle(ctx) {
                     return lifecycle.emit({ runId, input: { event: 'agent', data: statusWithChildIdentity({ payload, childPid: ctx.child.pid }, {}) } });
                 });
             }
-            else if (translation.kind === 'error') {
+            if (translation.kind === 'error') {
                 enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'error', data: translation.payload } }));
             }
-            else if (translation.kind === 'turn-end') {
+            if (translation.kind === 'turn-end') {
                 handleTurnEnd(translation.stopReason);
             }
         });
@@ -607,7 +611,8 @@ export function wireChildLifecycle(ctx) {
     }
     /**
      * Emits the accumulated `'until-close'` stdout — sanitized — as exactly one raw `'stdout'` echo
-     * plus one `text_delta`, through the same `enqueueEmit` FIFO queue every other emit uses, so the
+     * plus one `text_delta` for plain output, or through the declared structured parser. Both use
+     * the same `enqueueEmit` FIFO queue every other emit uses, so the
      * flush is ordered after every already-queued event and before `finish()`'s `'end'`. A no-op for
      * every live-streaming def (nothing was ever accumulated) and for a buffered run that produced
      * no stdout at all — an empty `text_delta` is noise, not information.
@@ -622,10 +627,19 @@ export function wireChildLifecycle(ctx) {
         const safe = sanitizeBufferedStdout ? sanitizeBufferedStdout({ fullText: bufferedStdout }) : bufferedStdout;
         bufferedStdout = '';
         bufferedStdoutBytes = 0;
-        const text = droppedStdoutBytes > 0
-            ? `${safe}${bufferedStdoutTruncationNotice(droppedStdoutBytes, ctx.bufferedStdoutMaxBytes)}`
-            : safe;
+        const dropped = droppedStdoutBytes;
         droppedStdoutBytes = 0;
+        if (streamHandler !== null) {
+            // Redact the complete wire text before parsing: structured errors can contain sign-in URLs too.
+            stdoutDiagnostics.feed({ text: safe });
+            streamHandler.feed({ chunk: safe });
+            if (dropped > 0)
+                enqueueEmit(() => lifecycle.emit({ runId, input: { event: 'error', data: {
+                            message: bufferedStdoutTruncationNotice(dropped, ctx.bufferedStdoutMaxBytes),
+                        } } }));
+            return;
+        }
+        const text = dropped > 0 ? `${safe}${bufferedStdoutTruncationNotice(dropped, ctx.bufferedStdoutMaxBytes)}` : safe;
         if (text.length === 0)
             return;
         enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'stdout', data: { chunk: text } } }));
@@ -634,27 +648,27 @@ export function wireChildLifecycle(ctx) {
     child.stdout?.on('data', (chunk) => {
         const text = chunk.toString('utf8');
         stdoutDiagnostics.record({ chunk, text });
-        if (streamFormat === 'plain') {
-            if (text.length > 0)
-                userVisibleOutputSeen = true;
-            if (bufferStdoutUntilClose) {
-                // Nothing is emitted on *either* channel yet — see this function's doc on why holding the
-                // raw echo back matters as much as holding back the chat copy.
-                //
-                // Whole chunks only: a chunk that would cross the ceiling is dropped entirely rather than
-                // sliced to fit, which keeps the accumulator free of half-written multi-byte characters (a
-                // `data` event boundary already need not align with one) and makes the kept prefix exactly
-                // the bytes some prefix of chunks produced. Everything after the first refusal is dropped
-                // too — the point is a hard ceiling on resident bytes, not a best-effort tail.
-                const chunkBytes = Buffer.byteLength(text, 'utf8');
-                if (droppedStdoutBytes > 0 || bufferedStdoutBytes + chunkBytes > ctx.bufferedStdoutMaxBytes) {
-                    droppedStdoutBytes += chunkBytes;
-                    return;
-                }
-                bufferedStdout += text;
-                bufferedStdoutBytes += chunkBytes;
+        if (streamFormat === 'plain' && text.length > 0)
+            userVisibleOutputSeen = true;
+        if (bufferStdoutUntilClose) {
+            // Nothing is emitted on *either* channel yet — see this function's doc on why holding the
+            // raw echo back matters as much as holding back the chat copy.
+            //
+            // Whole chunks only: a chunk that would cross the ceiling is dropped entirely rather than
+            // sliced to fit, which keeps the accumulator free of half-written multi-byte characters (a
+            // `data` event boundary already need not align with one) and makes the kept prefix exactly
+            // the bytes some prefix of chunks produced. Everything after the first refusal is dropped
+            // too — the point is a hard ceiling on resident bytes, not a best-effort tail.
+            const chunkBytes = Buffer.byteLength(text, 'utf8');
+            if (droppedStdoutBytes > 0 || bufferedStdoutBytes + chunkBytes > ctx.bufferedStdoutMaxBytes) {
+                droppedStdoutBytes += chunkBytes;
                 return;
             }
+            bufferedStdout += text;
+            bufferedStdoutBytes += chunkBytes;
+            return;
+        }
+        if (streamFormat === 'plain') {
             enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'stdout', data: { chunk: text } } }));
             enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'agent', data: { type: 'text_delta', delta: text } } }));
             return;
@@ -702,12 +716,12 @@ export function wireChildLifecycle(ctx) {
                 feedSessionLine(controlScanBuffer);
                 controlScanBuffer = '';
             }
+            flushBufferedStdout();
             streamHandler?.flush();
             session.endSession();
             stdoutDiagnostics.flush();
-            // Queued before `await emitQueue` so the flushed text is durably appended ahead of
-            // `finish()`'s `'end'` event, exactly like every live-path emit already is.
-            flushBufferedStdout();
+            // The buffered flush is queued before `await emitQueue` so its sanitized events are durable
+            // ahead of `finish()`'s `'end'`, exactly like every live-path emit already is.
             await emitQueue;
             if (cancelRequested)
                 await cancelUnresolvedToolCalls();
@@ -843,7 +857,10 @@ function wireAcpLifecycle(ctx) {
             unsubscribeCancel();
             // Guarded for the same reasons as the child-driven handler above.
             await cleanupStagedFilesSafely(ctx);
-            const status = await output.settle({ status: cancelRequested ? 'cancelled' : controller?.completedSuccessfully() ? 'succeeded' : 'failed' });
+            let finalStatus = 'cancelled';
+            if (!cancelRequested)
+                finalStatus = controller?.completedSuccessfully() ? 'succeeded' : 'failed';
+            const status = await output.settle({ status: finalStatus });
             const resumable = status === 'failed' && classifyFailure !== undefined
                 ? await classifyFailureSafely(ctx, classifyFailure, {
                     runId,
@@ -870,7 +887,7 @@ function wireAcpLifecycle(ctx) {
                         } });
                     enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'agent', data: translation.payload } }));
                 }
-                else if (translation.kind === 'error') {
+                if (translation.kind === 'error') {
                     enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'error', data: translation.payload } }));
                 }
                 return;
@@ -942,7 +959,10 @@ function wirePiRpcLifecycle(ctx) {
             unsubscribeCancel();
             // Guarded for the same reasons as the child-driven handler above.
             await cleanupStagedFilesSafely(ctx);
-            const status = await output.settle({ status: cancelRequested ? 'cancelled' : session?.hasFatalError() ? 'failed' : 'succeeded' });
+            let finalStatus = 'cancelled';
+            if (!cancelRequested)
+                finalStatus = session?.hasFatalError() ? 'failed' : 'succeeded';
+            const status = await output.settle({ status: finalStatus });
             const resumable = status === 'failed' && classifyFailure !== undefined
                 ? await classifyFailureSafely(ctx, classifyFailure, {
                     runId,
@@ -961,18 +981,14 @@ function wirePiRpcLifecycle(ctx) {
                 const receipt = modelReceipt(translation.payload);
                 if (receipt)
                     enqueueEmit(() => lifecycle.emit({ runId, input: { event: 'agent', data: receipt } }));
-                if (translation.sessionId !== undefined)
-                    capturedSessionId = translation.sessionId;
-                if (translation.payload.type === 'tool_use') {
-                    toolCallSeen = true;
-                }
-                else if ((translation.payload.type === 'text_delta' || translation.payload.type === 'thinking_delta') &&
-                    translation.payload.delta.length > 0) {
-                    userVisibleOutputSeen = true;
-                }
+                applyAgentTranslationSideEffects({ payload: translation.payload, sessionId: translation.sessionId, sink: {
+                        onSessionId: ({ sessionId }) => { capturedSessionId = sessionId; },
+                        onToolCall: () => { toolCallSeen = true; },
+                        onUserVisibleOutput: () => { userVisibleOutputSeen = true; },
+                    } });
                 enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'agent', data: translation.payload } }));
             }
-            else if (translation.kind === 'error') {
+            if (translation.kind === 'error') {
                 enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'error', data: translation.payload } }));
             }
         } }, { cwd: ctx.cwd, ...(ctx.model !== undefined ? { model: ctx.model } : {}), ...(ctx.imagePaths.length > 0 ? { imagePaths: [...ctx.imagePaths] } : {}), ...(ctx.uploadRoot !== undefined ? { uploadRoot: ctx.uploadRoot } : {}) });
@@ -1047,8 +1063,8 @@ export async function runAcpDispatch({ input, deps }) {
         // fired-and-forgotten (SEC-007: "await where lifecycle ordering allows it").
         await terminateChildTreeBestEffort({ listProcessSnapshots: deps.listProcessSnapshots, collectProcessTreePids: deps.collectProcessTreePids, stopProcesses: deps.stopProcesses }, input.child, input.runId, 'acp-attach-failure', deps.onCleanupFailure);
         await deps.releaseStagedResources();
-        // `failBeforeSpawn` always rejects (`Promise<never>`); returning it propagates that rejection.
-        return deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: could not attach ACP session for agent "${input.agentId}": ${errorMessage(err)}` });
+        // `failBeforeSpawn` always rejects (`Promise<never>`); awaiting it propagates that rejection.
+        await deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: could not attach ACP session for agent "${input.agentId}": ${errorMessage(err)}` });
     }
 }
 /** Phase 15 (pi-rpc branch): same discipline as {@link runAcpDispatch}, for the one `'pi-rpc'` def. */
@@ -1080,7 +1096,7 @@ export async function runPiRpcDispatch({ input, deps }) {
         // fire-and-forget (SEC-007).
         await terminateChildTreeBestEffort({ listProcessSnapshots: deps.listProcessSnapshots, collectProcessTreePids: deps.collectProcessTreePids, stopProcesses: deps.stopProcesses }, input.child, input.runId, 'pi-rpc-attach-failure', deps.onCleanupFailure);
         await deps.releaseStagedResources();
-        return deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: could not attach pi-rpc session for agent "${input.agentId}": ${errorMessage(err)}` });
+        await deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: could not attach pi-rpc session for agent "${input.agentId}": ${errorMessage(err)}` });
     }
 }
 //# sourceMappingURL=events.js.map

package/dist/agent-executor/launch.js

@@ -6,7 +6,7 @@ import { spawn as nodeSpawn, } from 'node:child_process';
 import { promises as fsPromises, } from 'node:fs';
 import { tmpdir, } from 'node:os';
 import { join, } from 'node:path';
-import { agentCapabilities, createClaudeFilesystemSupportProbe, claudeFilesystemRuntimePaths, claudeFilesystemSettings, validateFilesystemLaunch, validateReadOnlyExtraDirs, bindRuntimeAgentDef, defaultRuntimeState, getRuntimeModelDiscoveryDeps, userToolchainBinDirs, applyAgentLaunchEnv, ensureAgentCapabilities, resolveModelForLaunch, getAgentDef, resolveAgentLaunch, attachAcpSession, attachPiRpcSession, checkPromptArgvBudget, checkWindowsCmdShimCommandLineBudget, checkWindowsDirectExeCommandLineBudget, prepareAgentLogFile, preparePromptFileForAgent, } from '@jini-ai/agent-runtime';
+import { agentCapabilities, assessNativeToolPolicy, resolveNativeToolPolicy, createClaudeFilesystemSupportProbe, claudeFilesystemRuntimePaths, claudeFilesystemSettings, validateFilesystemLaunch, validateReadOnlyExtraDirs, bindRuntimeAgentDef, defaultRuntimeState, getRuntimeModelDiscoveryDeps, userToolchainBinDirs, applyAgentLaunchEnv, ensureAgentCapabilities, resolveModelForLaunch, getAgentDef, resolveAgentLaunch, attachAcpSession, attachPiRpcSession, checkPromptArgvBudget, checkWindowsCmdShimCommandLineBudget, checkWindowsDirectExeCommandLineBudget, prepareAgentLogFile, preparePromptFileForAgent, } from '@jini-ai/agent-runtime';
 import { createCommandInvocation } from '@jini-ai/platform/command';
 import { collectProcessTreePids, listProcessSnapshots, stopProcesses, } from '@jini-ai/platform/process';
 import { applyImagePromptDelivery, } from '../image-prompt-delivery.js';
@@ -580,8 +580,8 @@ export async function guardWindowsCommandLineBudget({ input, deps }) {
         checkWindowsDirectExeCommandLineBudget({ def: input.def, resolvedBin: input.launchPath, args: input.args });
     if (windowsBudgetError) {
         await deps.releaseStagedResources();
-        // `failBeforeSpawn` always rejects (`Promise<never>`); returning it propagates that rejection.
-        return deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_PROMPT_TOO_LARGE', message: windowsBudgetError.message });
+        // `failBeforeSpawn` always rejects (`Promise<never>`); awaiting it propagates that rejection.
+        await deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_PROMPT_TOO_LARGE', message: windowsBudgetError.message });
     }
 }
 /**
@@ -631,29 +631,13 @@ export async function confirmChildSpawned({ input, deps }) {
     }
     catch (err) {
         await deps.releaseStagedResources();
-        return deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: failed to spawn agent "${input.def.id}": ${errorMessage(err)}` });
+        await deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: failed to spawn agent "${input.def.id}": ${errorMessage(err)}` });
     }
 }
 /** Only include declared capability restrictions; absence has a distinct downstream contract. */
 function nativeCapabilityInput({ input }, _options = {}) {
     return { ...(input.nativeCapabilities !== undefined ? { nativeCapabilities: input.nativeCapabilities } : {}) };
 }
-/** Switch names a person sees for each native capability (the host's settings use the same words). */
-const NATIVE_CAPABILITY_LABELS = {
-    shell: 'Bash/shell', fileWrite: 'File edit/write', userMcp: 'Your MCP servers', subagents: 'Subagents/Task',
-    userSettings: 'Your skills and settings', web: 'Web fetch/search', workflows: 'Workflows', loginEnvironment: 'Your shell environment',
-};
-/** The refusal a person reads when a CLI without a native-tool policy cannot honor this run's switches:
- * it names the CLI and the switch to turn on. Owner 2026-10-27: the old "no native-tool policy and
- * audit adapter" told a Gemini user nothing. Pure, O(c) for c OFF switches.
- * @example nativeToolPolicyRefusal({ cliName: 'Antigravity', offSwitches: ['userMcp'] }, {});
- */
-function nativeToolPolicyRefusal({ cliName, offSwitches }, _options = {}) {
-    const switches = offSwitches.map(key => `'${NATIVE_CAPABILITY_LABELS[key] ?? key}'`);
-    const blocked = switches.length > 0 ? `with ${new Intl.ListFormat('en', { type: 'conjunction' }).format(switches)} off` : `with this chat's CLI tool limits`;
-    const action = switches.length === 0 ? `Turn on 'Full CLI access'` : `Turn ${switches.length === 1 ? 'it' : 'them'} on`;
-    return `${cliName} can't run ${blocked}. ${action} in the assistant settings, or choose Claude or Codex.`;
-}
 /** Correlation projects retained stdout, so exact-byte journals need a separate blob writer. */
 function validateStdoutJournalOptions(options, _options = {}) {
     if (options.delegatedResultCorrelation && options.journal && !options.stdoutJournalBlobs) {
@@ -709,13 +693,8 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
     const { createCommandInvocation: createCommandInvocationFn, spawn: spawnFn, listProcessSnapshots: listProcessSnapshotsFn, collectProcessTreePids: collectProcessTreePidsFn, stopProcesses: stopProcessesFn, } = resolveProcessDeps(options);
     const { onCleanupFailure: onCleanupFailureFn, bufferedStdoutMaxBytes } = resolveMiscExecutorDeps(options);
     validateStdoutJournalOptions(options);
-    const journal = options.journal;
-    const continuation = options.continuation;
-    const classifyFailure = options.classifyFailure;
-    const mcpJsonInjection = options.mcpJsonInjection;
-    const claudeConfigDirIsolation = options.claudeConfigDirIsolation;
+    const { journal, continuation, classifyFailure, mcpJsonInjection, claudeConfigDirIsolation, promptAugmenter } = options;
     const claudeConfigDirIsolationEnabled = options.claudeConfigDirIsolationEnabled ?? false;
-    const promptAugmenter = options.promptAugmenter;
     const filesystemTemps = new Map();
     const verifyClaudeFilesystem = options.assertClaudeFilesystemSupport ?? createClaudeFilesystemSupportProbe({});
     /** Remove this run's private temp directories on startup failure, exit, crash or cancellation.
@@ -765,7 +744,9 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
     /** `AgentExecutor.sendUserMessage()` — see that interface method's own doc. @complexity O(1). */
     async function sendUserMessage({ runId, text, id = randomUUID(), attachmentIds }, { imageContents } = {}) {
         const deliver = liveRunInputs.get(runId);
-        return deliver ? deliver({ text, id, ...(attachmentIds ? { attachmentIds } : {}) }, imageContents ? { imageContents } : {}) : 'not-running';
+        if (!deliver)
+            return 'not-running';
+        return deliver({ text, id, ...(attachmentIds ? { attachmentIds } : {}) }, imageContents ? { imageContents } : {});
     }
     /** Validates launch input and selects the definition synchronously before yielding. */
     async function prepareRunContext({ requiredArgs, optionalArgs }, _options = {}) {
@@ -778,14 +759,13 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         return { input, ...resolved };
     }
     async function enforceNativeToolPolicy({ input, def }, _options = {}) {
+        Object.assign(input, resolveNativeToolPolicy({ def, policy: input }));
         // Never silently ignore a host's locked native-tool policy on another CLI.
         // Parity cannot override an explicit lock or a restricted run.
         input.cliParity = input.cliParity === true && input.permissionMode === 'bypass' && input.nativeToolAccess !== false;
-        if (def.supportsNativeToolAccess === true)
-            return;
-        const offSwitches = Object.entries(input.nativeCapabilities ?? {}).filter(([, value]) => value === false).map(([key]) => key);
-        if (input.nativeToolAccess !== undefined && !input.cliParity || offSwitches.length > 0) {
-            return failBeforeSpawn({ runId: input.runId, code: 'NATIVE_TOOL_POLICY_UNSUPPORTED', message: nativeToolPolicyRefusal({ cliName: def.name, offSwitches }, {}) });
+        const refusal = assessNativeToolPolicy({ def, policy: input });
+        if (refusal !== null) {
+            await failBeforeSpawn({ runId: input.runId, code: 'NATIVE_TOOL_POLICY_UNSUPPORTED', message: refusal });
         }
     }
     /** Validate every directory after image augmentation, before model probes or resource staging.
@@ -804,7 +784,7 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
             input.cwd = input.filesystemRoot;
         }
         catch {
-            return failBeforeSpawn({ runId: input.runId, code: 'FILESYSTEM_POLICY_INVALID', message: 'Folder-limited launch refused: invalid filesystem root, working directory or attachment path.' });
+            await failBeforeSpawn({ runId: input.runId, code: 'FILESYSTEM_POLICY_INVALID', message: 'Folder-limited launch refused: invalid filesystem root, working directory or attachment path.' });
         }
     }
     /** Apply supported confinement without removing providers; unknown versions keep the settings.
@@ -829,12 +809,14 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
             spawnEnv.TMP = input.filesystemTempDir;
             spawnEnv.TEMP = input.filesystemTempDir;
             if (def.id === 'claude' && process.platform !== 'win32') {
-                // Claude shortens long Bash socket paths to shared scratch. Keep even the /private alias
-                // plus /claude-<uid> below 44 bytes, and isolate it with mkdtemp's private 0700 directory.
-                const runtimeTemp = await fsPromises.mkdtemp('/tmp/jini-');
+                // Read denies also block create/unlink, so Claude's cwd files cannot live under /tmp.
+                // /var/tmp exists on macOS/Linux; its realpath plus /claude-<uid> must fit 44 bytes
+                // or the policy refuses launch instead of letting Bash fall back to shared scratch.
+                // mkdtemp creates a private 0700 directory; register cleanup before resolving aliases.
+                const runtimeTemp = await fsPromises.mkdtemp('/var/tmp/jini-');
                 filesystemTemps.get(input.runId).push(runtimeTemp);
-                input.filesystemRuntimeTempBase = runtimeTemp;
-                spawnEnv.CLAUDE_CODE_TMPDIR = runtimeTemp;
+                input.filesystemRuntimeTempBase = await fsPromises.realpath(runtimeTemp);
+                spawnEnv.CLAUDE_CODE_TMPDIR = input.filesystemRuntimeTempBase;
             }
             if (supported === false) {
                 input.filesystemNotice = 'files and shell are not folder-limited for this agent';
@@ -854,7 +836,7 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
             spawnEnv.CLAUDE_CODE_DISABLE_AUTO_MEMORY = '1';
         }
         catch {
-            return failBeforeSpawn({ runId: input.runId, code: 'FILESYSTEM_POLICY_UNSUPPORTED', message: 'Folder-limited launch refused: invalid host settings or private runtime directory.' });
+            await failBeforeSpawn({ runId: input.runId, code: 'FILESYSTEM_POLICY_UNSUPPORTED', message: 'Folder-limited launch refused: invalid host settings or private runtime directory.' });
         }
     }
     function resolveRunOverlay({ input, def, imageDelivery }, _options = {}) {
@@ -1055,10 +1037,9 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
     }
     /**
      * `AgentExecutor.run()` — see that interface method's own doc for the
-     * public contract. Implementation note on shape: every guard below
-     * returns `failBeforeSpawn(...)` directly (a `Promise<never>`, valid
-     * wherever `Promise<void>` is expected) rather than `await`-then-`return`,
-     * so each failure path reads as a single, obviously-terminal statement.
+     * public contract. Implementation note on shape: every failure path below
+     * awaits `failBeforeSpawn(...)` (a `Promise<never>`, so the await always
+     * throws) and then returns, so each one reads as obviously terminal.
      * @param input - `{runId, agentId, prompt, cwd, model?, reasoning?, imagePaths?, extraAllowedDirs?, uploadRoot?, env?}` — `runId` must already be `lifecycle.start()`-ed.
      * @throws {@link AgentExecutorError} — see index.ts module doc's Invariant; never a bare `Error`.
      * @complexity O(1) setup (registry lookup, launch resolution, one spawn call); steady-state cost thereafter belongs to {@link wireChildLifecycle}.
@@ -1255,7 +1236,8 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         const spawnResult = spawnAgentChildProcess({ input: { cwd: input.cwd, childEnv, invocation }, deps: { spawn: spawnFn } });
         if (spawnResult.kind === 'error') {
             await releaseStagedResources();
-            return failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: spawn threw synchronously for agent "${def.id}": ${errorMessage(spawnResult.error)}` });
+            await failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: spawn threw synchronously for agent "${def.id}": ${errorMessage(spawnResult.error)}` });
+            return;
         }
         const child = spawnResult.child;
         // Registered before the spawn-confirmation await below, for the same reason
@@ -1282,10 +1264,12 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         // worse than releasing early (see `RuntimeLockHold.waitForHandoff`'s own doc).
         armHandoffWatcher({ runtimeLockHold: runtimeLockHold, handoffInput: { logFilePath: preparedLogFile?.path, model: selectedModel, processExited: processExitedController.signal }, release: releaseRuntimeLock });
         if (streamFormat === 'acp-json-rpc') {
-            return dispatchAcpPrompt({ input, def, child, modelCatalog, cleanupStagedFiles, releaseStagedResources, mcpBridge, overlayDelivery }, {});
+            await dispatchAcpPrompt({ input, def, child, modelCatalog, cleanupStagedFiles, releaseStagedResources, mcpBridge, overlayDelivery }, {});
+            return;
         }
         if (streamFormat === 'pi-rpc') {
-            return dispatchPiPrompt({ input, def, child, modelCatalog, cleanupStagedFiles, releaseStagedResources, overlayDelivery }, {});
+            await dispatchPiPrompt({ input, def, child, modelCatalog, cleanupStagedFiles, releaseStagedResources, overlayDelivery }, {});
+            return;
         }
         dispatchStdinPrompt({ input, def, child, overlayDelivery, imageDelivery, stdinHandle }, {});
     }

package/dist/agent-executor/live-session-state.js

@@ -1,4 +1,5 @@
 import { isRecord } from './values.js';
+import { omitKeys } from '../core/omit-keys.js';
 /** Parse only records; malformed stdout remains the stream parser's responsibility. */
 function frameRecord(line) {
     try {
@@ -39,8 +40,7 @@ export function createLiveSessionState({ emit }, _options = {}) {
     let backgroundTasks = 0;
     function publishTask(task) {
         tasks.set(task.id, task);
-        const { local: _local, ...payload } = task;
-        emit(payload);
+        emit(omitKeys(task, ['local']));
     }
     function taskDetails(frame, previous) {
         const patch = isRecord(frame.patch) ? frame.patch : frame;

package/dist/agent-executor/mcp-bridge.js

@@ -276,6 +276,11 @@ export function buildMcpBridgeDelivery(input) {
             return { kind: 'codex-toml', serverEntry };
         case 'env-passthrough':
             return { kind: 'env-passthrough', serverEntry };
+        default: {
+            // Unreachable: every bridge strategy has a case above, and a new one fails typecheck here.
+            const unknownStrategy = strategy;
+            throw new TypeError(`Unknown MCP bridge strategy: ${String(unknownStrategy)}`);
+        }
     }
 }
 function bridgeCredentialOptions(input) {

package/dist/agent-executor/message-relay.js

@@ -26,7 +26,8 @@ export function createMessageRelay({ emit }, { maxChars = 32_000 } = {}) {
         enqueue({ id, text, hasAttachments }) {
             if (closed)
                 return 'not-running';
-            pending.push({ id, text, hasAttachments, seq: ++seq });
+            seq += 1;
+            pending.push({ id, text, hasAttachments, seq });
             emit({ type: 'user_message', id, text, deliveryState: 'queued' });
             return 'delivered';
         },
@@ -36,11 +37,9 @@ export function createMessageRelay({ emit }, { maxChars = 32_000 } = {}) {
             let count = 0;
             let chars = 0;
             for (const message of pending) {
-                if (message.hasAttachments)
-                    break;
-                const size = JSON.stringify({ id: message.id, seq: message.seq, text: message.text }).length;
-                // Whole messages only; a single oversized message is delivered alone.
-                if (count > 0 && chars + size > maxChars)
+                // Whole messages only, stopping at an attachment; a single oversized message is delivered alone.
+                const size = message.hasAttachments ? 0 : JSON.stringify({ id: message.id, seq: message.seq, text: message.text }).length;
+                if (message.hasAttachments || (count > 0 && chars + size > maxChars))
                     break;
                 chars += size;
                 count++;

package/dist/agent-executor/run-output.js

@@ -1,7 +1,12 @@
 import { redactSecrets } from '@jini-ai/core';
 // Only a terminal-prefixed failure overrides real output; ordinary assistant explanations
 // can mention empty output or headless permissions without being failed runs themselves.
-const DIAGNOSTIC_LINE = /^(?:jetski|agy|error|fatal):\s*(?:no (?:output|response) produced(?:\s*[—–:-]|[.!]\s*$)|(?:error:\s*)?permission denied\b.*headless|headless\b.*auto-denied)/i;
+// One pattern per diagnostic; a line is a diagnostic when any of them matches.
+const DIAGNOSTIC_LINES = [
+    /^(?:jetski|agy|error|fatal):\s*no (?:output|response) produced(?:\s*[—–:-]|[.!]\s*$)/i,
+    /^(?:jetski|agy|error|fatal):\s*(?:error:\s*)?permission denied\b.*headless/i,
+    /^(?:jetski|agy|error|fatal):\s*headless\b.*auto-denied/i,
+];
 /** Records whether the event is assistant text, tool activity or a run error. */
 function noteActivity(seen, event) {
     if (event.kind === 'error')
@@ -23,7 +28,7 @@ function noteDiagnostic({ seen, tails, event, plainStdout }) {
         return;
     const channel = event.kind === 'stderr' ? 'stderr' : 'stdout';
     tails[channel] = (tails[channel] + event.payload.chunk).slice(-8192);
-    const line = tails[channel].split(/\r?\n/).find(value => DIAGNOSTIC_LINE.test(value.trim()));
+    const line = tails[channel].split(/\r?\n/).find(value => DIAGNOSTIC_LINES.some(pattern => pattern.test(value.trim())));
     if (line)
         seen.diagnostic = line;
 }

package/dist/close-status.js

@@ -30,6 +30,11 @@ export function classifyRunCloseStatus(requiredArgs, optionalArgs = {}) {
     }
     return 'failed';
 }
+/** A set environment value parsed as a positive, finite millisecond count, else undefined. */
+function positiveTimeout(raw) {
+    const value = raw !== undefined ? Number(raw) : undefined;
+    return value !== undefined && Number.isFinite(value) && value > 0 ? value : undefined;
+}
 /**
  * Resolves a timeout in milliseconds from an env-var override, an
  * agent-supplied default, and a kernel default, in that precedence order,
@@ -48,8 +53,7 @@ export function resolveTimeoutMs(requiredArgs, optionalArgs = {}) {
     const input = { ...requiredArgs, ...optionalArgs };
     const env = input.env ?? (typeof process !== 'undefined' ? process.env : {});
     const rawFromEnv = input.envVar ? env[input.envVar] : undefined;
-    const fromEnv = rawFromEnv !== undefined ? Number(rawFromEnv) : undefined;
-    const candidate = fromEnv !== undefined && Number.isFinite(fromEnv) && fromEnv > 0 ? fromEnv : (input.agentDefaultMs ?? input.defaultMs);
+    const candidate = positiveTimeout(rawFromEnv) ?? input.agentDefaultMs ?? input.defaultMs;
     return Math.min(candidate, input.maxMs);
 }
 /**

package/dist/core/omit-keys.d.ts

@@ -0,0 +1,7 @@
+/**
+ * @file Copy an object without some of its keys — what `const { a: _a, ...rest } = source` does,
+ * without binding a throwaway name for every dropped key.
+ */
+/** A shallow copy of `source`'s own enumerable properties, minus `keys`. @complexity O(own keys). */
+export declare function omitKeys<T extends object, K extends keyof T>(source: T, keys: readonly K[]): Omit<T, K>;
+//# sourceMappingURL=omit-keys.d.ts.map

package/dist/core/omit-keys.js

@@ -0,0 +1,12 @@
+/**
+ * @file Copy an object without some of its keys — what `const { a: _a, ...rest } = source` does,
+ * without binding a throwaway name for every dropped key.
+ */
+/** A shallow copy of `source`'s own enumerable properties, minus `keys`. @complexity O(own keys). */
+export function omitKeys(source, keys) {
+    const copy = { ...source };
+    for (const key of keys)
+        delete copy[key];
+    return copy;
+}
+//# sourceMappingURL=omit-keys.js.map