@jini-ai/daemon 0.6.15-rc.2 → 0.6.15

package/dist/store/agent-sessions/sql.js

@@ -13,6 +13,12 @@ export function validateSessionKernel({ kernel, dialect, transports }) {
 function runSessionQuery(kernel, body) {
     return kernel.run(db => body(db));
 }
+/** The one atomic upsert behind `setSessionId`: insert the pair, or replace its session id and time. */
+function upsertSessionQuery({ conversationId, agentId, sessionId, updatedAt }) {
+    return (db) => db.insertInto('assistant_agent_sessions')
+        .values({ conversation_id: conversationId, agent_id: agentId, session_id: sessionId, updated_at: updatedAt })
+        .onConflict(oc => oc.columns(['conversation_id', 'agent_id']).doUpdateSet({ session_id: sessionId, updated_at: updatedAt })).execute();
+}
 /** Translate opaque driver failures without losing their cause or mutating host state. */
 async function atSessionBoundary(operation) {
     try {
@@ -43,9 +49,7 @@ export function createSqlAgentSessionStore({ kernel }, { clock = createSystemClo
         setSessionId({ conversationId, agentId, sessionId }) {
             return atSessionBoundary(async () => {
                 const updatedAt = clock.nowMs();
-                await runSessionQuery(kernel, db => db.insertInto('assistant_agent_sessions')
-                    .values({ conversation_id: conversationId, agent_id: agentId, session_id: sessionId, updated_at: updatedAt })
-                    .onConflict(oc => oc.columns(['conversation_id', 'agent_id']).doUpdateSet({ session_id: sessionId, updated_at: updatedAt })).execute());
+                await runSessionQuery(kernel, upsertSessionQuery({ conversationId, agentId, sessionId, updatedAt }));
             });
         },
         clearSessionId({ conversationId, agentId }) {

package/dist/store/event-log/sqlite-kernel.js

@@ -129,7 +129,11 @@ async function replayInKernel({ db, runId, afterCursor }) {
     const result = replayResult({ run: { run_id: runId, next_cursor: first.next_cursor }, oldest, afterCursor });
     if (result.kind !== 'ok')
         return result;
-    const entries = rows.flatMap(({ cursor, event, data, recorded_at }) => cursor === null || event === null || data === null || recorded_at === null ? [] : [rowToEntry({ cursor, event, data, recorded_at })]);
+    // A row missing any event column carries no entry.
+    const entries = rows.flatMap(({ cursor, event, data, recorded_at }) => {
+        const missing = cursor === null || event === null;
+        return missing || data === null || recorded_at === null ? [] : [rowToEntry({ cursor, event, data, recorded_at })];
+    });
     return { ...result, entries };
 }
 //# sourceMappingURL=sqlite-kernel.js.map

package/dist/store/event-log/sqlite.js

@@ -58,8 +58,12 @@ export function openSqliteEventLog(input, options = {}) {
             } }, { pragmas: ['journal_mode = WAL'] });
         const log = bindSqliteEventLog(db, options);
         let closed = false;
-        return { ...log, async close(_args) { if (closed)
-                return; closed = true; db.close(); } };
+        return { ...log, async close(_args) {
+                if (closed)
+                    return;
+                closed = true;
+                db.close();
+            } };
     }
     catch (error) {
         try {

package/dist/surface-exchanges.js

@@ -143,9 +143,9 @@ export function createSurfaceExchangeStore(deps, { idleTtlMs = DEFAULT_SURFACE_I
             // Unknown and closed are the same situation to a human whose dialog is no longer waiting.
             if (!entry)
                 return { ok: false, reason: 'unknown-or-closed' };
-            if ((spec.toolId !== undefined && entry.binding.toolId !== spec.toolId)
-                || (entry.binding.channel ?? deps.defaultChannel) !== (spec.channel ?? deps.defaultChannel)
-                || entry.binding.principalId !== spec.principalId) {
+            const toolMismatch = spec.toolId !== undefined && entry.binding.toolId !== spec.toolId;
+            const channelMismatch = (entry.binding.channel ?? deps.defaultChannel) !== (spec.channel ?? deps.defaultChannel);
+            if (toolMismatch || channelMismatch || entry.binding.principalId !== spec.principalId) {
                 // A wrong-binding delivery must not consume a conversation the right human is still having.
                 return { ok: false, reason: 'binding-mismatch' };
             }

package/dist/terminal-session.js

@@ -200,11 +200,10 @@ export function createTerminalSessionManager(_requiredArgs, options = {}) {
         const result = [];
         for (const session of terminalService.list()) {
             const meta = metadata.get(session.id);
-            if (!meta || meta.principalId !== principal.id)
-                continue;
-            if (filter.resourceRef !== undefined && meta.resourceRef !== filter.resourceRef)
-                continue;
-            result.push(toSessionInfo(session, meta.resourceRef));
+            const visible = meta !== undefined && meta.principalId === principal.id
+                && (filter.resourceRef === undefined || meta.resourceRef === filter.resourceRef);
+            if (visible)
+                result.push(toSessionInfo(session, meta.resourceRef));
         }
         return result;
     }

package/dist/tool-executor.js

@@ -46,7 +46,7 @@
  * answer gets back in.
  */
 import { randomUUID } from 'node:crypto';
-import { ToolInputError, withNormalizationNotes, ToolInputNormalizationError, } from '@jini-ai/core';
+import { ToolInputError, withNormalizationNotes, ToolInputNormalizationError, isReadOnlyTool, } from '@jini-ai/core';
 import { authorizeToolInvocation } from '@jini-ai/core/composition';
 import { toolCandidates } from './core/tool-candidates.js';
 /**
@@ -104,6 +104,8 @@ export function createToolExecutor(requiredArgs, optionalArgs = {}) {
     // Finished executionIds, oldest first (Set insertion order): the only records `retireAudit` evicts.
     const finishedAudits = new Set();
     const pendingConfirmations = new Map();
+    // Owned by the executor, not a bridge: concurrent HTTP/MCP calls create separate bridges.
+    const approvalWaits = new Map();
     const activeControllers = new Map();
     /**
      * Marks a pending confirmation `cancel()` just resolved (as opposed to a genuine human `deny`),
@@ -114,6 +116,34 @@ export function createToolExecutor(requiredArgs, optionalArgs = {}) {
      * `requestConfirmation()` settles, so it can never leak onto a later execution.
      */
     const cancelledConfirmations = new Set();
+    /** Records only actual human waits; terminal decisions and aborts release the run's write block.
+     * @complexity O(1) time/space per pending execution; empty run entries are removed. */
+    function approvalStateChange({ run, executionId, toolId, pending }, _optional = {}) {
+        if (pending) {
+            const waits = approvalWaits.get(run.id) ?? new Map();
+            waits.set(executionId, toolId);
+            approvalWaits.set(run.id, waits);
+            return;
+        }
+        const waits = approvalWaits.get(run.id);
+        waits?.delete(executionId);
+        if (waits?.size === 0)
+            approvalWaits.delete(run.id);
+    }
+    /** Refuses writes using the registered read-only contract, never a model's claim.
+     * The validation result reaches every delegated transport as an actionable error, without
+     * resolving or approving the original call. @complexity O(1) time/space. */
+    function approvalRefusal({ executionId, run, descriptor }, _optional = {}) {
+        const pendingToolId = approvalWaits.get(run.id)?.values().next().value;
+        if (pendingToolId === undefined || isReadOnlyTool({ descriptor }))
+            return undefined;
+        const error = JSON.stringify({
+            status: 'awaiting_approval', started: false, toolId: descriptor.id, pendingToolId,
+            message: 'Another action is waiting for human confirmation and has not started. This write was refused. Reads may continue. Never say an action has started until its tool result explicitly says it started.',
+        });
+        appendEvent(executionId, 'failed', error);
+        return { executionId, status: 'failed', errorKind: 'validation', error };
+    }
     function appendEvent(executionId, phase, detail) {
         // Every call site passes an `executionId` this same `execute()` call
         // already registered in `audits` (right before its first `appendEvent`
@@ -242,7 +272,7 @@ export function createToolExecutor(requiredArgs, optionalArgs = {}) {
      * Acts on the authorization outcome synchronously: `{ refusal }` if the call ends here
      * (cancelled meanwhile, or denied), otherwise records `authorized` and returns `{ allowed }`.
      */
-    function admitAuthorized({ executionId, resolved, signal }) {
+    function admitAuthorized({ executionId, resolved, signal, run }) {
         // `authorize()` isn't itself signal-aware — it's typically a fast policy check, not a
         // human-in-the-loop wait — so this is a post-await check rather than a mid-flight abort, the
         // same idiom the post-handler check below already uses: a signal that fired while `authorize()`
@@ -253,6 +283,10 @@ export function createToolExecutor(requiredArgs, optionalArgs = {}) {
             return { refusal: terminal({ executionId, status: 'denied' }) };
         const { normalizationNotes } = resolved;
         appendEvent(executionId, 'authorized', normalizationNotes.length ? `normalized: ${normalizationNotes.join('; ')}` : undefined);
+        // Check after authorization awaits: an approval may have opened while this policy was pending.
+        const refusal = approvalRefusal({ executionId, run, descriptor: resolved.descriptor });
+        if (refusal)
+            return { refusal };
         return { allowed: resolved };
     }
     /**
@@ -268,13 +302,18 @@ export function createToolExecutor(requiredArgs, optionalArgs = {}) {
     async function confirmGate(request) {
         const { executionId } = request;
         let confirmation;
+        const state = { run: request.run, executionId, toolId: request.tool.id };
         try {
+            approvalStateChange({ ...state, pending: true });
             confirmation = await requestConfirmation(request);
         }
         catch {
             // Same reasoning as the authorization gate: terminal, recorded, and generic.
             return operationalFailure({ executionId, error: 'confirmation failed' });
         }
+        finally {
+            approvalStateChange({ ...state, pending: false });
+        }
         if (confirmation === 'confirm') {
             appendEvent(executionId, 'confirmed');
             return undefined;
@@ -353,6 +392,10 @@ export function createToolExecutor(requiredArgs, optionalArgs = {}) {
         if (controller.signal.aborted) {
             return terminal({ executionId, status: 'cancelled' });
         }
+        // Guidance may await I/O after admission; another call can open a confirmation in that gap.
+        const refusal = approvalRefusal({ executionId, run, descriptor });
+        if (refusal)
+            return refusal;
         const timeout = startTimeout(controller, descriptor.timeoutMs);
         // Cleanup (clear the timeout) is repeated at
         // each return below rather than centralized in a `finally` — a
@@ -379,6 +422,7 @@ export function createToolExecutor(requiredArgs, optionalArgs = {}) {
                 signal: controller.signal,
             }, {
                 ...surfaceOption(emitSurface),
+                onApprovalStateChange: ({ pending }) => approvalStateChange({ run, executionId, toolId: call.toolId, pending }),
                 invokeTool: nestedInvoker({ principal, run, toolId: call.toolId, invocationRegistry: call.invocationRegistry, signal: controller.signal }, { emitSurface }),
             });
             cleanup();
@@ -443,7 +487,7 @@ export function createToolExecutor(requiredArgs, optionalArgs = {}) {
         // `invocationRegistry.has({ toolId })` above already confirmed the tool exists, and `ToolRegistry` is
         // append-only (no unregister — see `createToolRegistry`'s doc), so `authorizeToolInvocation`
         // resolving the same `toolId` against the same `registry` cannot come back `undefined` here.
-        const gate = admitAuthorized({ executionId, resolved: resolved, signal: controller.signal });
+        const gate = admitAuthorized({ executionId, resolved: resolved, signal: controller.signal, run });
         if ('refusal' in gate) {
             cleanupCancellation();
             return gate.refusal;

package/dist/tool-recovery/recovery.js

@@ -1,5 +1,5 @@
 import { isIssuedToolFailureDiagnostic } from "./diagnostics.js";
-import { askOnce, SURFACE_DISMISSED_PARAM, SURFACE_EXCHANGE_ID_PARAM, } from "../surface-exchanges.js";
+import { askOnce, SURFACE_DISMISSED_PARAM, } from "../surface-exchanges.js";
 import { refuseNonReadOnlyDispatch } from "../core/read-only-tools.js";
 /**
  * @file The CONSUMER of `contracts/core/tool-failure-diagnostics.ts`'s `ToolFailureDiagnostic`
@@ -119,7 +119,9 @@ function isActionableDiagnostic(value) {
  * @complexity O(1).
  */
 function remedyReportedFailure(output) {
-    return isPlainObject(output) && (output["saved"] === false || output["created"] === false || output["cancelled"] === true || output["connected"] === false);
+    if (!isPlainObject(output))
+        return false;
+    return output["saved"] === false || output["created"] === false || output["cancelled"] === true || output["connected"] === false;
 }
 /** `true` once the bounded walk should stop descending — depth past {@link MAX_DIAGNOSTIC_SCAN_DEPTH}
  *  or the node budget exhausted. Pulled out of {@link walkForDiagnostic} so that function's own guard
@@ -400,7 +402,7 @@ function remedyApplied(remedyResult) {
 export function withToolFailureRecovery({ inner, ...deps }, _optional = {}) {
     return {
         execute: async (required, optional = {}) => {
-            const { principal, toolId, input } = required;
+            const { principal, input } = required;
             const { signal, emitSurface } = optional;
             const result = await inner.execute(required, optional);
             // SILENCE STAYS FREE: everything but a completed call whose output carries an actionable

package/dist/tool-recovery/redaction.js

@@ -148,8 +148,7 @@ function redactFailedResult(result, context, deps) {
             return result;
         return { ...result, error: deps.redactSecretShapes({ text: result.error }).text };
     }
-    const mintErrorId = deps.mintErrorId;
-    const onFailure = deps.onFailure;
+    const { mintErrorId, onFailure } = deps;
     const { text, redactions } = deps.redactSecretShapes({ text: result.error ?? `tool "${context.toolId}" failed` });
     const errorId = mintErrorId();
     safeOnFailure(onFailure, {

package/dist/tool-recovery/stack.js

@@ -46,6 +46,10 @@ import { withReadOnlyToolConstraint } from "../core/read-only-tools.js";
 import { withToolAttemptAudit } from "../core/tool-audit.js";
 import { withToolFailureRecovery } from "./recovery.js";
 import { withRedactedToolFailures, readToolErrorId } from "./redaction.js";
+/** The audit wrapper's options: only an error sink the caller actually supplied. */
+function auditOptions(audit) {
+    return audit.onSinkError ? { onSinkError: audit.onSinkError } : {};
+}
 /** One registry and innermost read-only gate protect original, remedy and retry alike.
  * Redaction precedes observation; recovery is outermost so each actual attempt is audited.
  * @complexity O(1) composition; each decorator owns its runtime cost.
@@ -55,7 +59,7 @@ export function createAssistantToolExecutor(deps, _optional = {}) {
         registry: deps.registry, idGenerator: { newId: deps.newExecutionId }, messages: deps.readOnlyMessages }, {});
     const redacted = withRedactedToolFailures({ inner: guarded, ...deps.toolFailures }, {});
     const audited = deps.toolAttemptAudit
-        ? withToolAttemptAudit({ inner: redacted, ...deps.toolAttemptAudit, readErrorId: readToolErrorId }, deps.toolAttemptAudit.onSinkError ? { onSinkError: deps.toolAttemptAudit.onSinkError } : {})
+        ? withToolAttemptAudit({ inner: redacted, ...deps.toolAttemptAudit, readErrorId: readToolErrorId }, auditOptions(deps.toolAttemptAudit))
         : redacted;
     return withToolFailureRecovery({ ...deps, inner: audited }, {});
 }

package/dist/tool-result-media.js

@@ -74,6 +74,11 @@ export function resultContent({ result }) {
             return 'Tool execution cancelled.';
         case 'failed':
             return result.error ?? 'Tool execution failed.';
+        default: {
+            // Unreachable: every tool result status has a case above, and a new one fails typecheck here.
+            const unhandled = result.status;
+            throw new TypeError(`Unhandled tool result status: ${String(unhandled)}`);
+        }
     }
 }
 /** Projects a model-safe result into the saved event: pixels occur only in `media`.
@@ -81,9 +86,10 @@ export function resultContent({ result }) {
  * @complexity O(n) output bytes, with O(n) transient serialization space. */
 export function projectToolResultEvent({ result }, _options = {}) {
     const { remainder, media } = extractResultMedia({ output: result.output });
+    const outputFlagsError = isRecord(result.output) && result.output.isError === true;
     const isError = result.status !== 'completed'
         || (batchOutcomeFor({ output: result.output }) ?? 'completed') !== 'completed'
-        || (isRecord(result.output) && result.output.isError === true);
+        || outputFlagsError;
     return {
         content: resultContent({ result: { ...result, output: remainder } }),
         ...(isError ? { isError: true } : {}),

package/dist/tool-result-surfaces.js

@@ -52,6 +52,13 @@
  * break the feature. Anything else absent from this list is still treated as human-only.
  */
 export const MODEL_VISIBLE_BLOCK_TYPES = ['text', 'image'];
+/** A record block whose string `type` is one the model may see. */
+function isModelVisibleBlock(block) {
+    if (!isRecord(block))
+        return false;
+    const type = block['type'];
+    return typeof type === 'string' && MODEL_VISIBLE_BLOCK_TYPES.includes(type);
+}
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
@@ -74,16 +81,10 @@ export function splitToolResultSurfaces({ output }) {
     for (const block of content) {
         // A non-record block carries no `type` to check, so it cannot be shown to be model-safe.
         // Withheld rather than passed through, per this module's fail-closed rule.
-        if (!isRecord(block)) {
-            surfaces.push({ type: 'unknown', value: block });
-            continue;
-        }
-        const type = block['type'];
-        if (typeof type === 'string' && MODEL_VISIBLE_BLOCK_TYPES.includes(type)) {
+        if (isModelVisibleBlock(block))
             modelBlocks.push(block);
-            continue;
-        }
-        surfaces.push(block);
+        else
+            surfaces.push(isRecord(block) ? block : { type: 'unknown', value: block });
     }
     if (surfaces.length === 0)
         return { modelOutput: output, surfaces: [] };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/daemon",
-  "version": "0.6.15-rc.2",
+  "version": "0.6.15",
   "description": "The stateful agent daemon runtime: run lifecycle, durable event-log port, the tool-execution boundary, agent executor, terminal sessions, and routines.",
   "license": "Apache-2.0",
   "repository": {
@@ -129,6 +129,7 @@
     "registry": "https://registry.npmjs.org"
   },
   "devDependencies": {
+    "smol-toml": "1.9.1",
     "@vitest/coverage-v8": "^2.1.9",
     "node-pty": "^1.1.0",
     "better-sqlite3": "^13.0.0",
@@ -139,32 +140,35 @@
     "@types/pg": "8.23.1",
     "express": "^4.21.0",
     "@types/express": "^4.17.21",
-    "@jini-ai/db": "0.6.15-rc.2",
-    "@jini-ai/chat": "0.6.15-rc.2",
-    "@jini-ai/http-kit": "0.6.15-rc.2",
-    "@jini-ai/core": "^0.6.15-rc.2",
-    "@jini-ai/agent-runtime": "^0.6.15-rc.2",
-    "@jini-ai/platform": "^0.6.15-rc.2",
-    "@jini-ai/protocol": "^0.6.15-rc.2"
+    "@jini-ai/db": "0.6.15",
+    "@jini-ai/http-kit": "0.6.15",
+    "@jini-ai/chat": "0.6.15",
+    "@jini-ai/core": "^0.6.15",
+    "@jini-ai/platform": "^0.6.15",
+    "@jini-ai/protocol": "^0.6.15",
+    "@jini-ai/agent-runtime": "^0.6.15"
   },
   "dependencies": {
-    "smol-toml": "1.9.1",
-    "@jini-ai/core": "^0.6.15-rc.2",
-    "@jini-ai/protocol": "^0.6.15-rc.2"
+    "@jini-ai/core": "^0.6.15",
+    "@jini-ai/protocol": "^0.6.15"
   },
   "peerDependencies": {
+    "smol-toml": "1.9.1",
     "node-pty": "^1.1.0",
-    "@jini-ai/db": "^0.6.15-rc.2",
+    "@jini-ai/db": "^0.6.10",
     "kysely": "^0.29.6",
     "better-sqlite3": "^13.0.0",
     "@electric-sql/pglite": "0.5.8",
     "pg": "^8.23.0",
-    "@jini-ai/http-kit": "^0.6.15-rc.2",
+    "@jini-ai/http-kit": "^0.6.10",
     "express": "^4.21.0 || ^5.0.0",
-    "@jini-ai/agent-runtime": "^0.6.15-rc.2",
-    "@jini-ai/platform": "^0.6.15-rc.2"
+    "@jini-ai/agent-runtime": "^0.6.10",
+    "@jini-ai/platform": "^0.6.10"
   },
   "peerDependenciesMeta": {
+    "smol-toml": {
+      "optional": true
+    },
     "node-pty": {
       "optional": true
     },
@@ -200,6 +204,7 @@
     "build": "tsc -p tsconfig.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "vitest run",
+    "test:live:claude-bash": "vitest run --config vitest.claude-bash.live.config.ts",
     "test:coverage": "vitest run --coverage",
     "test:postgres": "vitest run --config vitest.postgres.config.ts src/store/agent-sessions/__tests__/postgres.postgres.test.ts"
   }