@jini-ai/daemon 0.6.15-rc.2 → 0.6.16

package/dist/agent-executor/launch.js

@@ -6,7 +6,7 @@ import { spawn as nodeSpawn, } from 'node:child_process';
 import { promises as fsPromises, } from 'node:fs';
 import { tmpdir, } from 'node:os';
 import { join, } from 'node:path';
-import { agentCapabilities, createClaudeFilesystemSupportProbe, claudeFilesystemRuntimePaths, claudeFilesystemSettings, validateFilesystemLaunch, validateReadOnlyExtraDirs, bindRuntimeAgentDef, defaultRuntimeState, getRuntimeModelDiscoveryDeps, userToolchainBinDirs, applyAgentLaunchEnv, ensureAgentCapabilities, resolveModelForLaunch, getAgentDef, resolveAgentLaunch, attachAcpSession, attachPiRpcSession, checkPromptArgvBudget, checkWindowsCmdShimCommandLineBudget, checkWindowsDirectExeCommandLineBudget, prepareAgentLogFile, preparePromptFileForAgent, } from '@jini-ai/agent-runtime';
+import { agentCapabilities, assessNativeToolPolicy, resolveNativeToolPolicy, createClaudeFilesystemSupportProbe, claudeFilesystemRuntimePaths, claudeFilesystemSettings, validateFilesystemLaunch, validateReadOnlyExtraDirs, bindRuntimeAgentDef, defaultRuntimeState, getRuntimeModelDiscoveryDeps, userToolchainBinDirs, applyAgentLaunchEnv, ensureAgentCapabilities, resolveModelForLaunch, getAgentDef, resolveAgentLaunch, attachAcpSession, attachPiRpcSession, checkPromptArgvBudget, checkWindowsCmdShimCommandLineBudget, checkWindowsDirectExeCommandLineBudget, prepareAgentLogFile, preparePromptFileForAgent, } from '@jini-ai/agent-runtime';
 import { createCommandInvocation } from '@jini-ai/platform/command';
 import { collectProcessTreePids, listProcessSnapshots, stopProcesses, } from '@jini-ai/platform/process';
 import { applyImagePromptDelivery, } from '../image-prompt-delivery.js';
@@ -580,8 +580,8 @@ export async function guardWindowsCommandLineBudget({ input, deps }) {
         checkWindowsDirectExeCommandLineBudget({ def: input.def, resolvedBin: input.launchPath, args: input.args });
     if (windowsBudgetError) {
         await deps.releaseStagedResources();
-        // `failBeforeSpawn` always rejects (`Promise<never>`); returning it propagates that rejection.
-        return deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_PROMPT_TOO_LARGE', message: windowsBudgetError.message });
+        // `failBeforeSpawn` always rejects (`Promise<never>`); awaiting it propagates that rejection.
+        await deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_PROMPT_TOO_LARGE', message: windowsBudgetError.message });
     }
 }
 /**
@@ -631,29 +631,13 @@ export async function confirmChildSpawned({ input, deps }) {
     }
     catch (err) {
         await deps.releaseStagedResources();
-        return deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: failed to spawn agent "${input.def.id}": ${errorMessage(err)}` });
+        await deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: failed to spawn agent "${input.def.id}": ${errorMessage(err)}` });
     }
 }
 /** Only include declared capability restrictions; absence has a distinct downstream contract. */
 function nativeCapabilityInput({ input }, _options = {}) {
     return { ...(input.nativeCapabilities !== undefined ? { nativeCapabilities: input.nativeCapabilities } : {}) };
 }
-/** Switch names a person sees for each native capability (the host's settings use the same words). */
-const NATIVE_CAPABILITY_LABELS = {
-    shell: 'Bash/shell', fileWrite: 'File edit/write', userMcp: 'Your MCP servers', subagents: 'Subagents/Task',
-    userSettings: 'Your skills and settings', web: 'Web fetch/search', workflows: 'Workflows', loginEnvironment: 'Your shell environment',
-};
-/** The refusal a person reads when a CLI without a native-tool policy cannot honor this run's switches:
- * it names the CLI and the switch to turn on. Owner 2026-10-27: the old "no native-tool policy and
- * audit adapter" told a Gemini user nothing. Pure, O(c) for c OFF switches.
- * @example nativeToolPolicyRefusal({ cliName: 'Antigravity', offSwitches: ['userMcp'] }, {});
- */
-function nativeToolPolicyRefusal({ cliName, offSwitches }, _options = {}) {
-    const switches = offSwitches.map(key => `'${NATIVE_CAPABILITY_LABELS[key] ?? key}'`);
-    const blocked = switches.length > 0 ? `with ${new Intl.ListFormat('en', { type: 'conjunction' }).format(switches)} off` : `with this chat's CLI tool limits`;
-    const action = switches.length === 0 ? `Turn on 'Full CLI access'` : `Turn ${switches.length === 1 ? 'it' : 'them'} on`;
-    return `${cliName} can't run ${blocked}. ${action} in the assistant settings, or choose Claude or Codex.`;
-}
 /** Correlation projects retained stdout, so exact-byte journals need a separate blob writer. */
 function validateStdoutJournalOptions(options, _options = {}) {
     if (options.delegatedResultCorrelation && options.journal && !options.stdoutJournalBlobs) {
@@ -709,13 +693,8 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
     const { createCommandInvocation: createCommandInvocationFn, spawn: spawnFn, listProcessSnapshots: listProcessSnapshotsFn, collectProcessTreePids: collectProcessTreePidsFn, stopProcesses: stopProcessesFn, } = resolveProcessDeps(options);
     const { onCleanupFailure: onCleanupFailureFn, bufferedStdoutMaxBytes } = resolveMiscExecutorDeps(options);
     validateStdoutJournalOptions(options);
-    const journal = options.journal;
-    const continuation = options.continuation;
-    const classifyFailure = options.classifyFailure;
-    const mcpJsonInjection = options.mcpJsonInjection;
-    const claudeConfigDirIsolation = options.claudeConfigDirIsolation;
+    const { journal, continuation, classifyFailure, mcpJsonInjection, claudeConfigDirIsolation, promptAugmenter } = options;
     const claudeConfigDirIsolationEnabled = options.claudeConfigDirIsolationEnabled ?? false;
-    const promptAugmenter = options.promptAugmenter;
     const filesystemTemps = new Map();
     const verifyClaudeFilesystem = options.assertClaudeFilesystemSupport ?? createClaudeFilesystemSupportProbe({});
     /** Remove this run's private temp directories on startup failure, exit, crash or cancellation.
@@ -765,7 +744,9 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
     /** `AgentExecutor.sendUserMessage()` — see that interface method's own doc. @complexity O(1). */
     async function sendUserMessage({ runId, text, id = randomUUID(), attachmentIds }, { imageContents } = {}) {
         const deliver = liveRunInputs.get(runId);
-        return deliver ? deliver({ text, id, ...(attachmentIds ? { attachmentIds } : {}) }, imageContents ? { imageContents } : {}) : 'not-running';
+        if (!deliver)
+            return 'not-running';
+        return deliver({ text, id, ...(attachmentIds ? { attachmentIds } : {}) }, imageContents ? { imageContents } : {});
     }
     /** Validates launch input and selects the definition synchronously before yielding. */
     async function prepareRunContext({ requiredArgs, optionalArgs }, _options = {}) {
@@ -778,14 +759,13 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         return { input, ...resolved };
     }
     async function enforceNativeToolPolicy({ input, def }, _options = {}) {
+        Object.assign(input, resolveNativeToolPolicy({ def, policy: input }));
         // Never silently ignore a host's locked native-tool policy on another CLI.
         // Parity cannot override an explicit lock or a restricted run.
         input.cliParity = input.cliParity === true && input.permissionMode === 'bypass' && input.nativeToolAccess !== false;
-        if (def.supportsNativeToolAccess === true)
-            return;
-        const offSwitches = Object.entries(input.nativeCapabilities ?? {}).filter(([, value]) => value === false).map(([key]) => key);
-        if (input.nativeToolAccess !== undefined && !input.cliParity || offSwitches.length > 0) {
-            return failBeforeSpawn({ runId: input.runId, code: 'NATIVE_TOOL_POLICY_UNSUPPORTED', message: nativeToolPolicyRefusal({ cliName: def.name, offSwitches }, {}) });
+        const refusal = assessNativeToolPolicy({ def, policy: input });
+        if (refusal !== null) {
+            await failBeforeSpawn({ runId: input.runId, code: 'NATIVE_TOOL_POLICY_UNSUPPORTED', message: refusal });
         }
     }
     /** Validate every directory after image augmentation, before model probes or resource staging.
@@ -804,7 +784,7 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
             input.cwd = input.filesystemRoot;
         }
         catch {
-            return failBeforeSpawn({ runId: input.runId, code: 'FILESYSTEM_POLICY_INVALID', message: 'Folder-limited launch refused: invalid filesystem root, working directory or attachment path.' });
+            await failBeforeSpawn({ runId: input.runId, code: 'FILESYSTEM_POLICY_INVALID', message: 'Folder-limited launch refused: invalid filesystem root, working directory or attachment path.' });
         }
     }
     /** Apply supported confinement without removing providers; unknown versions keep the settings.
@@ -829,12 +809,14 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
             spawnEnv.TMP = input.filesystemTempDir;
             spawnEnv.TEMP = input.filesystemTempDir;
             if (def.id === 'claude' && process.platform !== 'win32') {
-                // Claude shortens long Bash socket paths to shared scratch. Keep even the /private alias
-                // plus /claude-<uid> below 44 bytes, and isolate it with mkdtemp's private 0700 directory.
-                const runtimeTemp = await fsPromises.mkdtemp('/tmp/jini-');
+                // Read denies also block create/unlink, so Claude's cwd files cannot live under /tmp.
+                // /var/tmp exists on macOS/Linux; its realpath plus /claude-<uid> must fit 44 bytes
+                // or the policy refuses launch instead of letting Bash fall back to shared scratch.
+                // mkdtemp creates a private 0700 directory; register cleanup before resolving aliases.
+                const runtimeTemp = await fsPromises.mkdtemp('/var/tmp/jini-');
                 filesystemTemps.get(input.runId).push(runtimeTemp);
-                input.filesystemRuntimeTempBase = runtimeTemp;
-                spawnEnv.CLAUDE_CODE_TMPDIR = runtimeTemp;
+                input.filesystemRuntimeTempBase = await fsPromises.realpath(runtimeTemp);
+                spawnEnv.CLAUDE_CODE_TMPDIR = input.filesystemRuntimeTempBase;
             }
             if (supported === false) {
                 input.filesystemNotice = 'files and shell are not folder-limited for this agent';
@@ -854,7 +836,7 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
             spawnEnv.CLAUDE_CODE_DISABLE_AUTO_MEMORY = '1';
         }
         catch {
-            return failBeforeSpawn({ runId: input.runId, code: 'FILESYSTEM_POLICY_UNSUPPORTED', message: 'Folder-limited launch refused: invalid host settings or private runtime directory.' });
+            await failBeforeSpawn({ runId: input.runId, code: 'FILESYSTEM_POLICY_UNSUPPORTED', message: 'Folder-limited launch refused: invalid host settings or private runtime directory.' });
         }
     }
     function resolveRunOverlay({ input, def, imageDelivery }, _options = {}) {
@@ -1055,10 +1037,9 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
     }
     /**
      * `AgentExecutor.run()` — see that interface method's own doc for the
-     * public contract. Implementation note on shape: every guard below
-     * returns `failBeforeSpawn(...)` directly (a `Promise<never>`, valid
-     * wherever `Promise<void>` is expected) rather than `await`-then-`return`,
-     * so each failure path reads as a single, obviously-terminal statement.
+     * public contract. Implementation note on shape: every failure path below
+     * awaits `failBeforeSpawn(...)` (a `Promise<never>`, so the await always
+     * throws) and then returns, so each one reads as obviously terminal.
      * @param input - `{runId, agentId, prompt, cwd, model?, reasoning?, imagePaths?, extraAllowedDirs?, uploadRoot?, env?}` — `runId` must already be `lifecycle.start()`-ed.
      * @throws {@link AgentExecutorError} — see index.ts module doc's Invariant; never a bare `Error`.
      * @complexity O(1) setup (registry lookup, launch resolution, one spawn call); steady-state cost thereafter belongs to {@link wireChildLifecycle}.
@@ -1255,7 +1236,8 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         const spawnResult = spawnAgentChildProcess({ input: { cwd: input.cwd, childEnv, invocation }, deps: { spawn: spawnFn } });
         if (spawnResult.kind === 'error') {
             await releaseStagedResources();
-            return failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: spawn threw synchronously for agent "${def.id}": ${errorMessage(spawnResult.error)}` });
+            await failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: spawn threw synchronously for agent "${def.id}": ${errorMessage(spawnResult.error)}` });
+            return;
         }
         const child = spawnResult.child;
         // Registered before the spawn-confirmation await below, for the same reason
@@ -1282,10 +1264,12 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         // worse than releasing early (see `RuntimeLockHold.waitForHandoff`'s own doc).
         armHandoffWatcher({ runtimeLockHold: runtimeLockHold, handoffInput: { logFilePath: preparedLogFile?.path, model: selectedModel, processExited: processExitedController.signal }, release: releaseRuntimeLock });
         if (streamFormat === 'acp-json-rpc') {
-            return dispatchAcpPrompt({ input, def, child, modelCatalog, cleanupStagedFiles, releaseStagedResources, mcpBridge, overlayDelivery }, {});
+            await dispatchAcpPrompt({ input, def, child, modelCatalog, cleanupStagedFiles, releaseStagedResources, mcpBridge, overlayDelivery }, {});
+            return;
         }
         if (streamFormat === 'pi-rpc') {
-            return dispatchPiPrompt({ input, def, child, modelCatalog, cleanupStagedFiles, releaseStagedResources, overlayDelivery }, {});
+            await dispatchPiPrompt({ input, def, child, modelCatalog, cleanupStagedFiles, releaseStagedResources, overlayDelivery }, {});
+            return;
         }
         dispatchStdinPrompt({ input, def, child, overlayDelivery, imageDelivery, stdinHandle }, {});
     }

package/dist/agent-executor/live-session-state.js

@@ -1,4 +1,5 @@
 import { isRecord } from './values.js';
+import { omitKeys } from '../core/omit-keys.js';
 /** Parse only records; malformed stdout remains the stream parser's responsibility. */
 function frameRecord(line) {
     try {
@@ -39,8 +40,7 @@ export function createLiveSessionState({ emit }, _options = {}) {
     let backgroundTasks = 0;
     function publishTask(task) {
         tasks.set(task.id, task);
-        const { local: _local, ...payload } = task;
-        emit(payload);
+        emit(omitKeys(task, ['local']));
     }
     function taskDetails(frame, previous) {
         const patch = isRecord(frame.patch) ? frame.patch : frame;

package/dist/agent-executor/mcp-bridge.js

@@ -276,6 +276,11 @@ export function buildMcpBridgeDelivery(input) {
             return { kind: 'codex-toml', serverEntry };
         case 'env-passthrough':
             return { kind: 'env-passthrough', serverEntry };
+        default: {
+            // Unreachable: every bridge strategy has a case above, and a new one fails typecheck here.
+            const unknownStrategy = strategy;
+            throw new TypeError(`Unknown MCP bridge strategy: ${String(unknownStrategy)}`);
+        }
     }
 }
 function bridgeCredentialOptions(input) {

package/dist/agent-executor/message-relay.js

@@ -26,7 +26,8 @@ export function createMessageRelay({ emit }, { maxChars = 32_000 } = {}) {
         enqueue({ id, text, hasAttachments }) {
             if (closed)
                 return 'not-running';
-            pending.push({ id, text, hasAttachments, seq: ++seq });
+            seq += 1;
+            pending.push({ id, text, hasAttachments, seq });
             emit({ type: 'user_message', id, text, deliveryState: 'queued' });
             return 'delivered';
         },
@@ -36,11 +37,9 @@ export function createMessageRelay({ emit }, { maxChars = 32_000 } = {}) {
             let count = 0;
             let chars = 0;
             for (const message of pending) {
-                if (message.hasAttachments)
-                    break;
-                const size = JSON.stringify({ id: message.id, seq: message.seq, text: message.text }).length;
-                // Whole messages only; a single oversized message is delivered alone.
-                if (count > 0 && chars + size > maxChars)
+                // Whole messages only, stopping at an attachment; a single oversized message is delivered alone.
+                const size = message.hasAttachments ? 0 : JSON.stringify({ id: message.id, seq: message.seq, text: message.text }).length;
+                if (message.hasAttachments || (count > 0 && chars + size > maxChars))
                     break;
                 chars += size;
                 count++;

package/dist/agent-executor/run-output.js

@@ -1,7 +1,12 @@
 import { redactSecrets } from '@jini-ai/core';
 // Only a terminal-prefixed failure overrides real output; ordinary assistant explanations
 // can mention empty output or headless permissions without being failed runs themselves.
-const DIAGNOSTIC_LINE = /^(?:jetski|agy|error|fatal):\s*(?:no (?:output|response) produced(?:\s*[—–:-]|[.!]\s*$)|(?:error:\s*)?permission denied\b.*headless|headless\b.*auto-denied)/i;
+// One pattern per diagnostic; a line is a diagnostic when any of them matches.
+const DIAGNOSTIC_LINES = [
+    /^(?:jetski|agy|error|fatal):\s*no (?:output|response) produced(?:\s*[—–:-]|[.!]\s*$)/i,
+    /^(?:jetski|agy|error|fatal):\s*(?:error:\s*)?permission denied\b.*headless/i,
+    /^(?:jetski|agy|error|fatal):\s*headless\b.*auto-denied/i,
+];
 /** Records whether the event is assistant text, tool activity or a run error. */
 function noteActivity(seen, event) {
     if (event.kind === 'error')
@@ -23,7 +28,7 @@ function noteDiagnostic({ seen, tails, event, plainStdout }) {
         return;
     const channel = event.kind === 'stderr' ? 'stderr' : 'stdout';
     tails[channel] = (tails[channel] + event.payload.chunk).slice(-8192);
-    const line = tails[channel].split(/\r?\n/).find(value => DIAGNOSTIC_LINE.test(value.trim()));
+    const line = tails[channel].split(/\r?\n/).find(value => DIAGNOSTIC_LINES.some(pattern => pattern.test(value.trim())));
     if (line)
         seen.diagnostic = line;
 }

package/dist/ai-trace-lifecycle.d.ts

@@ -2,7 +2,7 @@
  * @module ai-trace-lifecycle
  *
  * Wraps a {@link RunLifecycle} so every run it drives is also recorded as an AI trace. This is
- * the single tap for every provider path: child stream parsers (Claude Code, Copilot, Qoder,
+ * the single tap for every provider path: child stream parsers (Claude Code, Qoder,
  * Codex/OpenCode/Cursor/Kimi JSON streams), ACP sessions and pi-rpc all publish their normalized
  * events through `lifecycle.emit({ event: 'agent' })`. Observing the committed stream also sees
  * watchdog-driven terminal transitions, which call the base lifecycle's closed-over `finish()`.

package/dist/ai-trace-lifecycle.js

@@ -2,7 +2,7 @@
  * @module ai-trace-lifecycle
  *
  * Wraps a {@link RunLifecycle} so every run it drives is also recorded as an AI trace. This is
- * the single tap for every provider path: child stream parsers (Claude Code, Copilot, Qoder,
+ * the single tap for every provider path: child stream parsers (Claude Code, Qoder,
  * Codex/OpenCode/Cursor/Kimi JSON streams), ACP sessions and pi-rpc all publish their normalized
  * events through `lifecycle.emit({ event: 'agent' })`. Observing the committed stream also sees
  * watchdog-driven terminal transitions, which call the base lifecycle's closed-over `finish()`.

package/dist/close-status.js

@@ -30,6 +30,11 @@ export function classifyRunCloseStatus(requiredArgs, optionalArgs = {}) {
     }
     return 'failed';
 }
+/** A set environment value parsed as a positive, finite millisecond count, else undefined. */
+function positiveTimeout(raw) {
+    const value = raw !== undefined ? Number(raw) : undefined;
+    return value !== undefined && Number.isFinite(value) && value > 0 ? value : undefined;
+}
 /**
  * Resolves a timeout in milliseconds from an env-var override, an
  * agent-supplied default, and a kernel default, in that precedence order,
@@ -48,8 +53,7 @@ export function resolveTimeoutMs(requiredArgs, optionalArgs = {}) {
     const input = { ...requiredArgs, ...optionalArgs };
     const env = input.env ?? (typeof process !== 'undefined' ? process.env : {});
     const rawFromEnv = input.envVar ? env[input.envVar] : undefined;
-    const fromEnv = rawFromEnv !== undefined ? Number(rawFromEnv) : undefined;
-    const candidate = fromEnv !== undefined && Number.isFinite(fromEnv) && fromEnv > 0 ? fromEnv : (input.agentDefaultMs ?? input.defaultMs);
+    const candidate = positiveTimeout(rawFromEnv) ?? input.agentDefaultMs ?? input.defaultMs;
     return Math.min(candidate, input.maxMs);
 }
 /**

package/dist/core/omit-keys.d.ts

@@ -0,0 +1,7 @@
+/**
+ * @file Copy an object without some of its keys — what `const { a: _a, ...rest } = source` does,
+ * without binding a throwaway name for every dropped key.
+ */
+/** A shallow copy of `source`'s own enumerable properties, minus `keys`. @complexity O(own keys). */
+export declare function omitKeys<T extends object, K extends keyof T>(source: T, keys: readonly K[]): Omit<T, K>;
+//# sourceMappingURL=omit-keys.d.ts.map

package/dist/core/omit-keys.js

@@ -0,0 +1,12 @@
+/**
+ * @file Copy an object without some of its keys — what `const { a: _a, ...rest } = source` does,
+ * without binding a throwaway name for every dropped key.
+ */
+/** A shallow copy of `source`'s own enumerable properties, minus `keys`. @complexity O(own keys). */
+export function omitKeys(source, keys) {
+    const copy = { ...source };
+    for (const key of keys)
+        delete copy[key];
+    return copy;
+}
+//# sourceMappingURL=omit-keys.js.map

package/dist/core/read-only-tools.js

@@ -1,5 +1,9 @@
 import { isReadOnlyTool, toolDiscoveryMetadata } from '@jini-ai/core';
 import { toolCandidates } from './tool-candidates.js';
+/** ` — did you mean a, b?` for any close tool ids, else nothing. */
+function didYouMean(candidates) {
+    return candidates.length > 0 ? ` — did you mean ${candidates.join(', ')}?` : '';
+}
 /**
  * Default daemon refusal wording, replaceable by the host. Unknown registrations and writes both
  * refuse unsafe dispatch; unknown ids direct discovery because an unrestricted retry cannot run them.
@@ -11,7 +15,7 @@ export const defaultDaemonMessages = {
         toolRefusalMessage: ({ toolId }) => `tool "${toolId}" is not registered as read-only — this gateway executes only tools whose registration declares readOnly; call it through execute_delegated_tool instead`,
         unknownToolMessage: ({ toolId, candidates }) => toolId === 'check_messages'
             ? 'check_messages is an MCP-local tool; call check_messages directly, never as toolId in a delegated gateway'
-            : `no tool "${toolId}" is registered; use search_tools${candidates.length > 0 ? ` — did you mean ${candidates.join(', ')}?` : ''}`,
+            : `no tool "${toolId}" is registered; use search_tools${didYouMean(candidates)}`,
     },
 };
 /** @returns A copied, attenuated principal; its roles are unchanged. */

package/dist/core/tool-audit.js

@@ -49,17 +49,21 @@ function thrownAttempt({ error }, _optional = {}) {
     return { phase: /unknown tool/i.test(error.message) ? 'unknown-tool' : 'failed', detail: error.name };
 }
 /** Settled details retain truncation or an errorId link, never error text or operator content. */
-function settledDetail({ result, readErrorId }, options) {
-    if (result.truncated)
-        return 'output truncated';
+function settledDetail({ result, readErrorId, readAuditRecord }, options) {
+    let detail = result.truncated ? 'output truncated' : null;
     // Host error-ID metadata is optional observation, never part of execution success.
     try {
-        const id = readErrorId({ result });
-        return id === undefined ? null : `errorId=${id}`;
+        const id = result.truncated ? undefined : readErrorId({ result });
+        if (id !== undefined)
+            detail = `errorId=${id}`;
+        const decision = readAuditRecord()?.events.find(event => event.detail?.startsWith('frontend approval: '))?.detail;
+        // A frontend may supply inputs, but only these fixed outcomes belong in the durable trail.
+        const approval = ['approved', 'declined', 'expired', 'abandoned'].map(value => `frontend approval: ${value}`).find(value => value === decision);
+        return [detail, approval].filter(Boolean).join('; ') || null;
     }
     catch (error) {
         reportSinkError(error, options);
-        return null;
+        return detail;
     }
 }
 /** Append requested BEFORE delegation: unknown tools and throwing authorization have no execution
@@ -83,7 +87,7 @@ export function withToolAttemptAudit(deps, options = {}) {
                 await appendSafely({ ...base, executionId: null, phase, at: deps.now(), detail }, deps, options);
                 throw error;
             }
-            const detail = settledDetail({ result, readErrorId: deps.readErrorId }, options);
+            const detail = settledDetail({ result, readErrorId: deps.readErrorId, readAuditRecord: () => deps.inner.getAuditRecord({ executionId: result.executionId }) }, options);
             await appendSafely({ ...base, executionId: result.executionId, phase: result.status, at: deps.now(), detail }, deps, options);
             return result;
         },

package/dist/core/tool-gaps.js

@@ -189,7 +189,7 @@ export function createToolGapCollector(required, optional = {}) {
             const payload = event.payload;
             if (payload.type === 'text_delta')
                 readDelta(payload.delta);
-            else if (payload.type === 'tool_use')
+            if (payload.type === 'tool_use')
                 recordToolUse(payload, event.ts);
         },
         /** Await outstanding audit writes during graceful shutdown/tests. */

package/dist/delegated-result-correlation.js

@@ -1,3 +1,4 @@
+import { omitKeys } from './core/omit-keys.js';
 /** Accept only the complete base64 source shape; extra fields must remain part of the digest. */
 function base64ImageSource({ source }, _options = {}) {
     if (typeof source !== 'object' || source === null)
@@ -14,8 +15,7 @@ function normalizeSourceImage({ record }, _options = {}) {
     const image = base64ImageSource({ source: record.source });
     if (!image)
         return record;
-    const { source: _source, ...rest } = record;
-    return { ...rest, data: image.data, mimeType: image.media_type };
+    return { ...omitKeys(record, ['source']), data: image.data, mimeType: image.media_type };
 }
 /** Normalize unambiguous CLI images and JSON object key order.
  * @complexity O(n + k log k) for n bytes and k keys per object; inputs are wire JSON. */

package/dist/frontend-capability-tools.d.ts

@@ -58,6 +58,8 @@ export interface FrontendCapabilitySpec {
     readonly description: string;
     /** Surfaced on the descriptor so `ToolExecutor`'s confirmation gate enforces it. */
     readonly requiresConfirmation?: boolean;
+    /** Protected page calls require a browser that supplies the human dialog channel. */
+    readonly requiresFrontendApproval?: boolean;
     /** Carried onto `ToolDescriptor.inputSchema` so a discovery surface can state the arguments. */
     readonly inputSchema?: unknown;
 }

package/dist/frontend-capability-tools.js

@@ -63,7 +63,13 @@ export function createFrontendCapabilityRegistrations(requiredArgs, optionalArgs
         policy,
         // `ctx.signal` is `ToolExecutor`'s own timeout/cancel signal, so the descriptor's `timeoutMs`
         // and a cancelled run both reach the pending invocation without this module owning a timer.
-        handler: async (ctx) => registry.invoke({ runId: ctx.run.id, capabilityId: capability.id, input: toCapabilityInput(capability.id, ctx.input) }, { signal: ctx.signal }),
+        handler: async (ctx, options) => {
+            // page.approval advertises the bound tab's human dialog, not an executable tool.
+            if (capability.requiresFrontendApproval && registry.sessionFor({ runId: ctx.run.id }) && !registry.capabilitiesFor({ runId: ctx.run.id }).includes('page.approval')) {
+                throw new Error('Attached frontend has no page approval dialog; reload the page.');
+            }
+            return registry.invoke({ runId: ctx.run.id, capabilityId: capability.id, input: toCapabilityInput(capability.id, ctx.input) }, { signal: ctx.signal, ...(options?.onApprovalStateChange ? { onApprovalStateChange: options.onApprovalStateChange } : {}) });
+        },
     }));
 }
 //# sourceMappingURL=frontend-capability-tools.js.map

package/dist/frontend-session-registry.d.ts

@@ -1,7 +1,22 @@
+import type { ToolApprovalDecision, ToolExecutionOptions } from '@jini-ai/core';
+/** Host-authenticated ownership, never derived from a model/run context blob. */
+export interface FrontendSessionOwner {
+    readonly workspaceId: string;
+    readonly principalId: string;
+    readonly tabId: string;
+}
+/** Shared owner comparison for attachment, binding and human-only reply gates. */
+export declare function sameFrontendOwner({ expected: a, actual: b }: {
+    expected: FrontendSessionOwner | undefined;
+    actual: FrontendSessionOwner | undefined;
+}, _options?: {}): boolean;
 /** A surface that has attached itself and can execute capabilities on a bound run's behalf. */
 export interface FrontendSessionDescriptor {
     /** Identifies this surface. Minted by the host at attach time; opaque here. */
     readonly sessionId: string;
+    readonly owner?: FrontendSessionOwner;
+    /** Host-authenticated quota scopes (e.g. guest and trusted client IP), never browser claims. */
+    readonly capacityKeys?: readonly string[];
     /**
      * Capability ids this surface claims it can execute. A call for anything this surface does not
      * claim fails closed rather than hanging.
@@ -43,6 +58,12 @@ export interface FrontendSessionHandle {
     detach(_args: Record<string, never>): void;
 }
 export interface FrontendSessionRegistry {
+    /** HTTP response authentication; possession of a URL session id grants nothing. */
+    ownsSession(args: {
+        sessionId: string;
+        owner: FrontendSessionOwner;
+        bindToken: string;
+    }): boolean;
     /**
      * Registers a surface and the function that pushes invocations to it (an SSE write, a WebSocket
      * send, an in-process call for a browser-resident caller that needs no relay at all).
@@ -52,6 +73,9 @@ export interface FrontendSessionRegistry {
     attach(args: {
         readonly descriptor: FrontendSessionDescriptor;
         readonly deliver: (invocation: FrontendInvocation) => void;
+        readonly cancel?: (args: {
+            invocationId: string;
+        }) => void;
     }): FrontendSessionHandle;
     /**
      * Associates a started run with the surface that originated it, so capability calls made by that
@@ -68,6 +92,13 @@ export interface FrontendSessionRegistry {
         readonly runId: string;
         readonly sessionId: string;
     }): () => void;
+    /** Acknowledges human-wait progress only for a still-pending invocation on this session. */
+    progress(args: {
+        sessionId: string;
+        invocationId: string;
+        pending: boolean;
+        decision?: ToolApprovalDecision;
+    }): boolean;
     /**
      * Binds a run to whichever surface holds `bindToken` — the wire-safe form of {@link bindRun}.
      *
@@ -86,6 +117,7 @@ export interface FrontendSessionRegistry {
     bindRunByToken(args: {
         readonly runId: string;
         readonly bindToken: string;
+        readonly owner?: FrontendSessionOwner;
     }): () => void;
     /**
      * Routes one capability call to the surface bound to `runId` and resolves with its output.
@@ -99,6 +131,7 @@ export interface FrontendSessionRegistry {
         readonly input: Record<string, unknown>;
     }, optionalArgs?: {
         readonly signal?: AbortSignal;
+        readonly onApprovalStateChange?: ToolExecutionOptions["onApprovalStateChange"];
     }): Promise<unknown>;
     /**
      * Settles a pending invocation with the surface's answer.
@@ -125,6 +158,8 @@ export interface FrontendSessionRegistry {
     }): FrontendSessionDescriptor | undefined;
 }
 export interface CreateFrontendSessionRegistryOptions {
+    readonly maxSessions?: number;
+    readonly maxSessionsPerKey?: number;
     /** Injectable id source for invocation ids — defaults to `randomUUID`. Test-only hook. */
     readonly newInvocationId?: () => string;
     /**
@@ -136,6 +171,10 @@ export interface CreateFrontendSessionRegistryOptions {
      */
     readonly newBindToken?: () => string;
 }
+/** Expected admission refusal; HTTP maps it to a quiet 429 before opening SSE. */
+export declare class FrontendSessionCapacityError extends Error {
+    constructor();
+}
 /**
  * Creates an in-memory registry of attached surfaces.
  *
@@ -143,8 +182,8 @@ export interface CreateFrontendSessionRegistryOptions {
  * so it cannot outlive the process that holds it, and a restart correctly presents as "nothing
  * attached" rather than as a stale route to a tab that is long gone.
  *
- * @complexity Every operation is O(1) except `detach`, which is O(p + b) in that surface\'s pending
- * invocations and bound runs.
+ * @complexity `attach` checks O(s × k) live sessions/quota keys when limits are configured;
+ * `detach` is O(p + b) in pending invocations and bound runs. Other addressing operations are O(1).
  */
-export declare function createFrontendSessionRegistry(requiredArgs: Record<string, never>, optionalArgs?: Pick<CreateFrontendSessionRegistryOptions, "newInvocationId" | "newBindToken">): FrontendSessionRegistry;
+export declare function createFrontendSessionRegistry(requiredArgs: Record<string, never>, optionalArgs?: Pick<CreateFrontendSessionRegistryOptions, "newInvocationId" | "newBindToken" | "maxSessions" | "maxSessionsPerKey">): FrontendSessionRegistry;
 //# sourceMappingURL=frontend-session-registry.d.ts.map