@jini-ai/daemon 0.6.15 → 0.6.17

package/CHANGELOG.md

@@ -1,3 +1,21 @@
+## 0.6.17
+
+### Patch Changes
+
+- Handle npm 12 pack JSON through the shared parser in packed agent-session fixtures.
+
+## 0.6.16
+
+### Minor Changes
+
+- Remove the GitHub Copilot CLI agent: its def, `createCopilotStreamHandler`/`CopilotStreamEvent`,
+  account model discovery and the `@github/copilot-sdk` optional peer, the MCP installer's `copilot`
+  slug, and its icon. A saved `copilot` agent id no longer resolves (`getAgentDef` returns `null`).
+  CopilotKit/AG-UI is unrelated and unchanged.
+
+  Drop peers no runtime entry loads: `express` from core and http-kit (type-only imports; type
+  consumers keep `@types/express`), `vue` from ui-kit, `react-dom` from vibecoding.
+
 ## 0.6.13
 
 ### Patch Changes

package/README.md

@@ -20,8 +20,18 @@ npm install @jini-ai/daemon
 
 `node-pty` is an **optional peer dependency** — the package boots and every other capability
 (run lifecycle, tool executor, agent executor, routines) works without it. Only
-`createTerminalSessionManager`'s real (non-test) `PtySpawn` — an actual interactive terminal/PTY
-spawn — needs `node-pty` installed; everything else has no native-addon dependency at all.
+the native adapter at `@jini-ai/daemon/terminal` needs `node-pty` installed.
+The default entry's session manager requires a host-supplied `terminalService` or `loadSpawnPty`:
+
+```ts
+import { createTerminalSessionManager } from '@jini-ai/daemon';
+import { loadRealSpawnPty } from '@jini-ai/daemon/terminal';
+
+const manager = createTerminalSessionManager({}, { loadSpawnPty: () => loadRealSpawnPty({}) });
+```
+
+With `@jini-ai/server`, pass that loader as `featureOptions.terminal.loadSpawnPty` to
+`composeJiniKernel`, or as `loadTerminalSpawnPty` to `createLocalNodeDaemon`.
 
 ## What you get
 
@@ -47,8 +57,8 @@ spawn — needs `node-pty` installed; everything else has no native-addon depend
   browser surface) and `createFrontendCapabilityRegistrations` (projects a frontend capability
   manifest into `ToolRegistry` registrations — the only door into it).
 - **Terminal sessions** — `createTerminalSessionManager`, `createTerminalToolRegistrations` — a
-  `node-pty`-backed session manager built on `@jini-ai/platform`'s generic ring-buffer engine, plus
-  session-token gating.
+  session manager built on `@jini-ai/platform`'s generic ring-buffer engine, plus session-token
+  gating. The optional native `loadRealSpawnPty` adapter lives at `@jini-ai/daemon/terminal`.
 - **Routines** — `RoutineService`, `createInMemoryRoutineStore` (`routines/`) — a DST-safe
   wall-clock scheduler plus CRUD + run-history store port.
 - **Run-orchestration helpers** (`run/`) — `runResultFromStatus`, `deriveRunErrorCode`,

package/dist/agent-executor/codex/isolation.js

@@ -1,4 +1,4 @@
-import { createRequire } from 'node:module';
+import { parse } from 'smol-toml';
 import { JINI_MCP_SERVER_KEY } from '../mcp-bridge.js';
 import { isRecord } from '../values.js';
 /** A run with personal MCP off that Codex cannot keep to the bridge alone: refused, never run with a leak. */
@@ -16,8 +16,7 @@ export function codexIsolationRefusalMessage(reason) {
  * @complexity O(n) in the file length.
  */
 function parseCodexLayer({ raw, path }, _optional = {}) {
-    // The optional parser is needed only for Codex isolation, so memory-only hosts can still boot.
-    const { parse } = createRequire(import.meta.url)('smol-toml');
+    // Codex isolation is a default security boundary; its parser must ship with the daemon.
     try {
         return parse(raw);
     }

package/dist/agent-executor/contracts.d.ts

@@ -23,7 +23,7 @@ export type StreamHandler = {
     }): void;
     flush(): void;
 };
-export declare const SUPPORTED_STREAM_FORMATS: readonly ["claude-stream-json", "json-event-stream", "copilot-stream-json", "qoder-stream-json", "acp-json-rpc", "pi-rpc", "plain"];
+export declare const SUPPORTED_STREAM_FORMATS: readonly ["claude-stream-json", "json-event-stream", "qoder-stream-json", "acp-json-rpc", "pi-rpc", "plain"];
 /** The families of the registry's stream-format this driver implements — see index.ts module doc. */
 export type SupportedStreamFormat = (typeof SUPPORTED_STREAM_FORMATS)[number];
 export type JsonStreamFormat = Exclude<SupportedStreamFormat, 'acp-json-rpc' | 'pi-rpc' | 'plain'>;

package/dist/agent-executor/contracts.js

@@ -1,7 +1,6 @@
 export const SUPPORTED_STREAM_FORMATS = [
     'claude-stream-json',
     'json-event-stream',
-    'copilot-stream-json',
     'qoder-stream-json',
     'acp-json-rpc',
     'pi-rpc',

package/dist/agent-executor/event-translation.d.ts

@@ -35,9 +35,9 @@ export declare function translateTurnEndEvent({ rawEvent }: {
  * assertable in isolation.
  *
  * Defensive by construction: several real parser emissions carry fields
- * looser than `RunAgentPayload`'s types promise (e.g. copilot's
- * `tool.execution_start` emits `id: data.toolCallId ?? null` — a literal
- * `null`, not the `string` `RunAgentPayload['tool_use']['id']` demands).
+ * looser than `RunAgentPayload`'s types promise (e.g. an untrusted
+ * tool event can carry a literal `null`, not the `string`
+ * `RunAgentPayload['tool_use']['id']` demands).
  * Every field read here is defensively coerced (`asString`/
  * `asOptionalString`/`asOptionalNumber`) rather than trusted, so a
  * malformed or null field degrades to a safe default instead of

package/dist/agent-executor/event-translation.js

@@ -26,7 +26,7 @@ export function extractUsageTokens({ rawUsage }, _options = {}) {
  * fields beyond the basic counts — `thought_tokens`,
  * `cached_read_tokens`/`cached_write_tokens` (opencode/gemini/codex),
  * `modelUsage`/`stopReason`/`isError` (qoder), a top-level `stopReason`
- * (claude/copilot). Cache/reasoning counters and stop reasons now survive tracing; vendor-only
+ * (claude). Cache/reasoning counters and stop reasons now survive tracing; vendor-only
  * `modelUsage` and `isError` remain outside this neutral usage contract.
  * @param rawEvent - The raw `{type:'usage', ...}` record from a stream parser.
  * @returns The narrowed `RunAgentPayload` `usage` variant.
@@ -164,9 +164,9 @@ const EVENT_TYPE_TRANSLATORS = {
  * assertable in isolation.
  *
  * Defensive by construction: several real parser emissions carry fields
- * looser than `RunAgentPayload`'s types promise (e.g. copilot's
- * `tool.execution_start` emits `id: data.toolCallId ?? null` — a literal
- * `null`, not the `string` `RunAgentPayload['tool_use']['id']` demands).
+ * looser than `RunAgentPayload`'s types promise (e.g. an untrusted
+ * tool event can carry a literal `null`, not the `string`
+ * `RunAgentPayload['tool_use']['id']` demands).
  * Every field read here is defensively coerced (`asString`/
  * `asOptionalString`/`asOptionalNumber`) rather than trusted, so a
  * malformed or null field degrades to a safe default instead of

package/dist/agent-executor/events.js

@@ -7,7 +7,7 @@ import { createModelReceiptTracker } from './model-receipts.js';
 import { observeRunOutput } from './run-output.js';
 import { messageContentWithImages } from '../attachment-content.js';
 import { redactSecrets, } from '@jini-ai/core';
-import { createClaudeStreamHandler, createCopilotStreamHandler, createJsonEventStreamHandler, createQoderStreamHandler, attachAcpSession, attachPiRpcSession, } from '@jini-ai/agent-runtime';
+import { createClaudeStreamHandler, createJsonEventStreamHandler, createQoderStreamHandler, attachAcpSession, attachPiRpcSession, } from '@jini-ai/agent-runtime';
 import { listProcessSnapshots, stopProcesses, } from '@jini-ai/platform/process';
 import { classifyRunCloseStatus, } from '../close-status.js';
 import { resolveContinuationTransport, } from '../continuation/continuation-transport.js';
@@ -42,8 +42,6 @@ function createStreamHandlerForDef(def, streamFormat, onEvent) {
     switch (streamFormat) {
         case 'claude-stream-json':
             return createClaudeStreamHandler({ onEvent: onEvent }, { costBasis: def.usageCostBasis ?? 'run' });
-        case 'copilot-stream-json':
-            return createCopilotStreamHandler({ onEvent: onEvent });
         case 'qoder-stream-json':
             return createQoderStreamHandler({ onEvent: onEvent });
         case 'json-event-stream':

package/dist/agent-executor/index.d.ts

@@ -11,12 +11,12 @@
  *
  * ## v1 scope: all 24 registered agent defs
  *
- * `@jini-ai/agent-runtime`'s registry ships 24 built-in defs across four
- * `streamFormat` families. The JSON-stream-parser family — the four
+ * `@jini-ai/agent-runtime`'s registry ships built-in defs across four
+ * `streamFormat` families. The JSON-stream-parser family — the three
  * `createXStreamHandler`-shaped parsers (`claude-stream-json`,
- * `json-event-stream`, `copilot-stream-json`, `qoder-stream-json`), covering
- * 9 defs (amp, codebuddy, claude, codex, cursor-agent, opencode, mimo,
- * copilot, qoder) — plus all 9 `acp-json-rpc` defs, plus the one `pi-rpc`
+ * `json-event-stream`, `qoder-stream-json`), covering
+ * 8 defs (amp, codebuddy, claude, codex, cursor-agent, opencode, mimo,
+ * qoder) — plus all 9 `acp-json-rpc` defs, plus the one `pi-rpc`
  * def (`pi`), are wired here. ACP and pi-rpc each own their own JSON-RPC
  * prompt-delivery protocol, so each takes its own lifecycle branch rather
  * than being treated as a stdout-tail parser; pi-rpc's events arrive through

package/dist/agent-executor/index.js

@@ -11,12 +11,12 @@
  *
  * ## v1 scope: all 24 registered agent defs
  *
- * `@jini-ai/agent-runtime`'s registry ships 24 built-in defs across four
- * `streamFormat` families. The JSON-stream-parser family — the four
+ * `@jini-ai/agent-runtime`'s registry ships built-in defs across four
+ * `streamFormat` families. The JSON-stream-parser family — the three
  * `createXStreamHandler`-shaped parsers (`claude-stream-json`,
- * `json-event-stream`, `copilot-stream-json`, `qoder-stream-json`), covering
- * 9 defs (amp, codebuddy, claude, codex, cursor-agent, opencode, mimo,
- * copilot, qoder) — plus all 9 `acp-json-rpc` defs, plus the one `pi-rpc`
+ * `json-event-stream`, `qoder-stream-json`), covering
+ * 8 defs (amp, codebuddy, claude, codex, cursor-agent, opencode, mimo,
+ * qoder) — plus all 9 `acp-json-rpc` defs, plus the one `pi-rpc`
  * def (`pi`), are wired here. ACP and pi-rpc each own their own JSON-RPC
  * prompt-delivery protocol, so each takes its own lifecycle branch rather
  * than being treated as a stdout-tail parser; pi-rpc's events arrive through

package/dist/ai-trace-lifecycle.d.ts

@@ -2,7 +2,7 @@
  * @module ai-trace-lifecycle
  *
  * Wraps a {@link RunLifecycle} so every run it drives is also recorded as an AI trace. This is
- * the single tap for every provider path: child stream parsers (Claude Code, Copilot, Qoder,
+ * the single tap for every provider path: child stream parsers (Claude Code, Qoder,
  * Codex/OpenCode/Cursor/Kimi JSON streams), ACP sessions and pi-rpc all publish their normalized
  * events through `lifecycle.emit({ event: 'agent' })`. Observing the committed stream also sees
  * watchdog-driven terminal transitions, which call the base lifecycle's closed-over `finish()`.

package/dist/ai-trace-lifecycle.js

@@ -2,7 +2,7 @@
  * @module ai-trace-lifecycle
  *
  * Wraps a {@link RunLifecycle} so every run it drives is also recorded as an AI trace. This is
- * the single tap for every provider path: child stream parsers (Claude Code, Copilot, Qoder,
+ * the single tap for every provider path: child stream parsers (Claude Code, Qoder,
  * Codex/OpenCode/Cursor/Kimi JSON streams), ACP sessions and pi-rpc all publish their normalized
  * events through `lifecycle.emit({ event: 'agent' })`. Observing the committed stream also sees
  * watchdog-driven terminal transitions, which call the base lifecycle's closed-over `finish()`.

package/dist/core/tool-audit.js

@@ -49,17 +49,21 @@ function thrownAttempt({ error }, _optional = {}) {
     return { phase: /unknown tool/i.test(error.message) ? 'unknown-tool' : 'failed', detail: error.name };
 }
 /** Settled details retain truncation or an errorId link, never error text or operator content. */
-function settledDetail({ result, readErrorId }, options) {
-    if (result.truncated)
-        return 'output truncated';
+function settledDetail({ result, readErrorId, readAuditRecord }, options) {
+    let detail = result.truncated ? 'output truncated' : null;
     // Host error-ID metadata is optional observation, never part of execution success.
     try {
-        const id = readErrorId({ result });
-        return id === undefined ? null : `errorId=${id}`;
+        const id = result.truncated ? undefined : readErrorId({ result });
+        if (id !== undefined)
+            detail = `errorId=${id}`;
+        const decision = readAuditRecord()?.events.find(event => event.detail?.startsWith('frontend approval: '))?.detail;
+        // A frontend may supply inputs, but only these fixed outcomes belong in the durable trail.
+        const approval = ['approved', 'declined', 'expired', 'abandoned'].map(value => `frontend approval: ${value}`).find(value => value === decision);
+        return [detail, approval].filter(Boolean).join('; ') || null;
     }
     catch (error) {
         reportSinkError(error, options);
-        return null;
+        return detail;
     }
 }
 /** Append requested BEFORE delegation: unknown tools and throwing authorization have no execution
@@ -83,7 +87,7 @@ export function withToolAttemptAudit(deps, options = {}) {
                 await appendSafely({ ...base, executionId: null, phase, at: deps.now(), detail }, deps, options);
                 throw error;
             }
-            const detail = settledDetail({ result, readErrorId: deps.readErrorId }, options);
+            const detail = settledDetail({ result, readErrorId: deps.readErrorId, readAuditRecord: () => deps.inner.getAuditRecord({ executionId: result.executionId }) }, options);
             await appendSafely({ ...base, executionId: result.executionId, phase: result.status, at: deps.now(), detail }, deps, options);
             return result;
         },

package/dist/frontend-capability-tools.d.ts

@@ -58,6 +58,8 @@ export interface FrontendCapabilitySpec {
     readonly description: string;
     /** Surfaced on the descriptor so `ToolExecutor`'s confirmation gate enforces it. */
     readonly requiresConfirmation?: boolean;
+    /** Protected page calls require a browser that supplies the human dialog channel. */
+    readonly requiresFrontendApproval?: boolean;
     /** Carried onto `ToolDescriptor.inputSchema` so a discovery surface can state the arguments. */
     readonly inputSchema?: unknown;
 }

package/dist/frontend-capability-tools.js

@@ -63,7 +63,13 @@ export function createFrontendCapabilityRegistrations(requiredArgs, optionalArgs
         policy,
         // `ctx.signal` is `ToolExecutor`'s own timeout/cancel signal, so the descriptor's `timeoutMs`
         // and a cancelled run both reach the pending invocation without this module owning a timer.
-        handler: async (ctx) => registry.invoke({ runId: ctx.run.id, capabilityId: capability.id, input: toCapabilityInput(capability.id, ctx.input) }, { signal: ctx.signal }),
+        handler: async (ctx, options) => {
+            // page.approval advertises the bound tab's human dialog, not an executable tool.
+            if (capability.requiresFrontendApproval && registry.sessionFor({ runId: ctx.run.id }) && !registry.capabilitiesFor({ runId: ctx.run.id }).includes('page.approval')) {
+                throw new Error('Attached frontend has no page approval dialog; reload the page.');
+            }
+            return registry.invoke({ runId: ctx.run.id, capabilityId: capability.id, input: toCapabilityInput(capability.id, ctx.input) }, { signal: ctx.signal, ...(options?.onApprovalStateChange ? { onApprovalStateChange: options.onApprovalStateChange } : {}) });
+        },
     }));
 }
 //# sourceMappingURL=frontend-capability-tools.js.map

package/dist/frontend-session-registry.d.ts

@@ -1,7 +1,22 @@
+import type { ToolApprovalDecision, ToolExecutionOptions } from '@jini-ai/core';
+/** Host-authenticated ownership, never derived from a model/run context blob. */
+export interface FrontendSessionOwner {
+    readonly workspaceId: string;
+    readonly principalId: string;
+    readonly tabId: string;
+}
+/** Shared owner comparison for attachment, binding and human-only reply gates. */
+export declare function sameFrontendOwner({ expected: a, actual: b }: {
+    expected: FrontendSessionOwner | undefined;
+    actual: FrontendSessionOwner | undefined;
+}, _options?: {}): boolean;
 /** A surface that has attached itself and can execute capabilities on a bound run's behalf. */
 export interface FrontendSessionDescriptor {
     /** Identifies this surface. Minted by the host at attach time; opaque here. */
     readonly sessionId: string;
+    readonly owner?: FrontendSessionOwner;
+    /** Host-authenticated quota scopes (e.g. guest and trusted client IP), never browser claims. */
+    readonly capacityKeys?: readonly string[];
     /**
      * Capability ids this surface claims it can execute. A call for anything this surface does not
      * claim fails closed rather than hanging.
@@ -43,6 +58,12 @@ export interface FrontendSessionHandle {
     detach(_args: Record<string, never>): void;
 }
 export interface FrontendSessionRegistry {
+    /** HTTP response authentication; possession of a URL session id grants nothing. */
+    ownsSession(args: {
+        sessionId: string;
+        owner: FrontendSessionOwner;
+        bindToken: string;
+    }): boolean;
     /**
      * Registers a surface and the function that pushes invocations to it (an SSE write, a WebSocket
      * send, an in-process call for a browser-resident caller that needs no relay at all).
@@ -52,6 +73,9 @@ export interface FrontendSessionRegistry {
     attach(args: {
         readonly descriptor: FrontendSessionDescriptor;
         readonly deliver: (invocation: FrontendInvocation) => void;
+        readonly cancel?: (args: {
+            invocationId: string;
+        }) => void;
     }): FrontendSessionHandle;
     /**
      * Associates a started run with the surface that originated it, so capability calls made by that
@@ -68,6 +92,13 @@ export interface FrontendSessionRegistry {
         readonly runId: string;
         readonly sessionId: string;
     }): () => void;
+    /** Acknowledges human-wait progress only for a still-pending invocation on this session. */
+    progress(args: {
+        sessionId: string;
+        invocationId: string;
+        pending: boolean;
+        decision?: ToolApprovalDecision;
+    }): boolean;
     /**
      * Binds a run to whichever surface holds `bindToken` — the wire-safe form of {@link bindRun}.
      *
@@ -86,6 +117,7 @@ export interface FrontendSessionRegistry {
     bindRunByToken(args: {
         readonly runId: string;
         readonly bindToken: string;
+        readonly owner?: FrontendSessionOwner;
     }): () => void;
     /**
      * Routes one capability call to the surface bound to `runId` and resolves with its output.
@@ -99,6 +131,7 @@ export interface FrontendSessionRegistry {
         readonly input: Record<string, unknown>;
     }, optionalArgs?: {
         readonly signal?: AbortSignal;
+        readonly onApprovalStateChange?: ToolExecutionOptions["onApprovalStateChange"];
     }): Promise<unknown>;
     /**
      * Settles a pending invocation with the surface's answer.
@@ -125,6 +158,8 @@ export interface FrontendSessionRegistry {
     }): FrontendSessionDescriptor | undefined;
 }
 export interface CreateFrontendSessionRegistryOptions {
+    readonly maxSessions?: number;
+    readonly maxSessionsPerKey?: number;
     /** Injectable id source for invocation ids — defaults to `randomUUID`. Test-only hook. */
     readonly newInvocationId?: () => string;
     /**
@@ -136,6 +171,10 @@ export interface CreateFrontendSessionRegistryOptions {
      */
     readonly newBindToken?: () => string;
 }
+/** Expected admission refusal; HTTP maps it to a quiet 429 before opening SSE. */
+export declare class FrontendSessionCapacityError extends Error {
+    constructor();
+}
 /**
  * Creates an in-memory registry of attached surfaces.
  *
@@ -143,8 +182,8 @@ export interface CreateFrontendSessionRegistryOptions {
  * so it cannot outlive the process that holds it, and a restart correctly presents as "nothing
  * attached" rather than as a stale route to a tab that is long gone.
  *
- * @complexity Every operation is O(1) except `detach`, which is O(p + b) in that surface\'s pending
- * invocations and bound runs.
+ * @complexity `attach` checks O(s × k) live sessions/quota keys when limits are configured;
+ * `detach` is O(p + b) in pending invocations and bound runs. Other addressing operations are O(1).
  */
-export declare function createFrontendSessionRegistry(requiredArgs: Record<string, never>, optionalArgs?: Pick<CreateFrontendSessionRegistryOptions, "newInvocationId" | "newBindToken">): FrontendSessionRegistry;
+export declare function createFrontendSessionRegistry(requiredArgs: Record<string, never>, optionalArgs?: Pick<CreateFrontendSessionRegistryOptions, "newInvocationId" | "newBindToken" | "maxSessions" | "maxSessionsPerKey">): FrontendSessionRegistry;
 //# sourceMappingURL=frontend-session-registry.d.ts.map

package/dist/frontend-session-registry.js

@@ -46,6 +46,34 @@
  *    so the existing `timeoutMs` on a tool descriptor covers this for free.
  */
 import { randomUUID } from 'node:crypto';
+/** Shared owner comparison for attachment, binding and human-only reply gates. */
+export function sameFrontendOwner({ expected: a, actual: b }, _options = {}) {
+    if (!a || !b)
+        return a === b;
+    return a.workspaceId === b.workspaceId && a.principalId === b.principalId && a.tabId === b.tabId;
+}
+/** Expected admission refusal; HTTP maps it to a quiet 429 before opening SSE. */
+export class FrontendSessionCapacityError extends Error {
+    constructor() { super('Frontend session capacity reached'); this.name = 'FrontendSessionCapacityError'; }
+}
+/** Admission is synchronous with attach, so concurrent opens cannot oversubscribe a scope.
+ * O(s × k) over the bounded live sessions and the host's quota keys; no retained IP counters.
+ * Detach automatically releases capacity, including stale handles and expired connections. */
+function assertSessionCapacity({ sessions, descriptor, options }) {
+    if (options.maxSessions !== undefined && sessions.size >= options.maxSessions)
+        throw new FrontendSessionCapacityError();
+    if (options.maxSessionsPerKey === undefined)
+        return;
+    for (const key of descriptor.capacityKeys ?? []) {
+        let count = 0;
+        for (const session of sessions.values()) {
+            if (session.descriptor.capacityKeys?.includes(key))
+                count++;
+        }
+        if (count >= options.maxSessionsPerKey)
+            throw new FrontendSessionCapacityError();
+    }
+}
 /**
  * Creates an in-memory registry of attached surfaces.
  *
@@ -53,8 +81,8 @@ import { randomUUID } from 'node:crypto';
  * so it cannot outlive the process that holds it, and a restart correctly presents as "nothing
  * attached" rather than as a stale route to a tab that is long gone.
  *
- * @complexity Every operation is O(1) except `detach`, which is O(p + b) in that surface\'s pending
- * invocations and bound runs.
+ * @complexity `attach` checks O(s × k) live sessions/quota keys when limits are configured;
+ * `detach` is O(p + b) in pending invocations and bound runs. Other addressing operations are O(1).
  */
 export function createFrontendSessionRegistry(requiredArgs, optionalArgs = {}) {
     const options = { ...requiredArgs, ...optionalArgs };
@@ -106,11 +134,12 @@ export function createFrontendSessionRegistry(requiredArgs, optionalArgs = {}) {
         }
         return session;
     }
-    function attach({ descriptor, deliver }) {
+    function attach({ descriptor, deliver, cancel }) {
+        assertSessionCapacity({ sessions, descriptor, options });
         if (sessions.has(descriptor.sessionId)) {
             throw new Error(`FrontendSessionRegistry: session "${descriptor.sessionId}" is already attached`);
         }
-        const session = { descriptor, deliver, pending: new Map() };
+        const session = { descriptor, deliver, ...(cancel ? { cancel } : {}), pending: new Map() };
         sessions.set(descriptor.sessionId, session);
         const bindToken = newBindToken();
         bindTokens.set(bindToken, descriptor.sessionId);
@@ -133,6 +162,7 @@ export function createFrontendSessionRegistry(requiredArgs, optionalArgs = {}) {
                 }
                 for (const [, entry] of session.pending) {
                     entry.dispose();
+                    entry.onApprovalStateChange?.({ pending: false });
                     entry.reject(new Error(`frontend session "${descriptor.sessionId}" detached before answering`));
                 }
                 session.pending.clear();
@@ -153,12 +183,12 @@ export function createFrontendSessionRegistry(requiredArgs, optionalArgs = {}) {
                 runBindings.delete(runId);
         };
     }
-    function bindRunByToken({ runId, bindToken }) {
+    function bindRunByToken({ runId, bindToken, owner }) {
         const sessionId = bindTokens.get(bindToken);
         // One message for both "no such token" and "the surface holding it detached". Distinguishing
         // them tells a caller whether a guess was close, which is the feedback a probe needs and the
         // only feedback it needs.
-        if (sessionId === undefined) {
+        if (sessionId === undefined || !sameFrontendOwner({ expected: sessions.get(sessionId)?.descriptor.owner, actual: owner })) {
             throw new Error(`FrontendSessionRegistry: cannot bind run "${runId}" — unknown or expired bind token`);
         }
         return bindRun({ runId: runId, sessionId: sessionId });
@@ -167,13 +197,18 @@ export function createFrontendSessionRegistry(requiredArgs, optionalArgs = {}) {
     // every other failure here. Throwing synchronously out of a Promise-returning function would
     // make `invoke(...).catch(...)` an uncaught exception for exactly the fail-closed cases this
     // registry exists to report.
-    async function invoke({ runId, capabilityId, input }, { signal } = {}) {
+    async function invoke({ runId, capabilityId, input }, { signal, onApprovalStateChange } = {}) {
         const target = resolveTarget(runId, capabilityId);
         const invocationId = newInvocationId();
         return new Promise((resolve, reject) => {
             const cancelled = () => new Error(`"${capabilityId}" was cancelled before the frontend answered`);
             const onAbort = () => {
                 target.pending.delete(invocationId);
+                try {
+                    target.cancel?.({ invocationId });
+                }
+                catch { /* A closed channel cannot revive the action. */ }
+                onApprovalStateChange?.({ pending: false });
                 reject(cancelled());
             };
             const dispose = () => signal?.removeEventListener('abort', onAbort);
@@ -182,7 +217,7 @@ export function createFrontendSessionRegistry(requiredArgs, optionalArgs = {}) {
                 return;
             }
             signal?.addEventListener('abort', onAbort, { once: true });
-            target.pending.set(invocationId, { resolve, reject, dispose });
+            target.pending.set(invocationId, { resolve, reject, dispose, ...(onApprovalStateChange ? { onApprovalStateChange } : {}) });
             try {
                 target.deliver({ invocationId, capabilityId, input });
             }
@@ -190,10 +225,23 @@ export function createFrontendSessionRegistry(requiredArgs, optionalArgs = {}) {
                 // A dead channel must fail the call rather than leave it pending until the tool times out.
                 target.pending.delete(invocationId);
                 dispose();
+                onApprovalStateChange?.({ pending: false });
                 reject(error instanceof Error ? error : new Error(String(error)));
             }
         });
     }
+    function progress({ sessionId, invocationId, pending, decision }) {
+        const entry = sessions.get(sessionId)?.pending.get(invocationId);
+        if (!entry)
+            return false;
+        // Only the first outcome following a real wait is recorded; replayed frames are observation-free.
+        const settledDecision = entry.approvalPending && !pending ? decision : undefined;
+        if (settledDecision)
+            entry.approvalRecorded = true;
+        entry.approvalPending = pending && !entry.approvalRecorded;
+        entry.onApprovalStateChange?.({ pending, ...(settledDecision ? { decision: settledDecision } : {}) });
+        return true;
+    }
     function settle({ sessionId, invocationId, outcome }) {
         const session = sessions.get(sessionId);
         const entry = session?.pending.get(invocationId);
@@ -201,6 +249,7 @@ export function createFrontendSessionRegistry(requiredArgs, optionalArgs = {}) {
             return false;
         session.pending.delete(invocationId);
         entry.dispose();
+        entry.onApprovalStateChange?.({ pending: false });
         if (outcome.ok)
             entry.resolve(outcome.output);
         else
@@ -213,6 +262,9 @@ export function createFrontendSessionRegistry(requiredArgs, optionalArgs = {}) {
     function capabilitiesFor({ runId }) {
         return sessionFor({ runId: runId })?.capabilities ?? [];
     }
-    return { attach, bindRun, bindRunByToken, invoke, settle, capabilitiesFor, sessionFor };
+    function ownsSession({ sessionId, owner, bindToken }) {
+        return bindTokens.get(bindToken) === sessionId && sameFrontendOwner({ expected: sessions.get(sessionId)?.descriptor.owner, actual: owner });
+    }
+    return { attach, bindRun, bindRunByToken, invoke, settle, progress, capabilitiesFor, sessionFor, ownsSession };
 }
 //# sourceMappingURL=frontend-session-registry.js.map

package/dist/http/frontend-control.d.ts

@@ -35,6 +35,8 @@
  * their own metadata in it. The engine stays neutral and the host keeps one place to look.
  */
 import type { Express } from 'express';
+import type { FrontendSessionOwner } from '../frontend-session-registry.js';
+import type { FrontendSessionsHttpDeps } from './frontend-sessions.js';
 import type { ToolPolicy, ToolRegistration } from '@jini-ai/core';
 import { type FrontendCapabilitySpec } from '../index.js';
 import type { AdapterContext } from '@jini-ai/http-kit';
@@ -67,6 +69,10 @@ export interface CreateFrontendControlOptions {
      * (see `frontend-capability-tools.ts`'s module doc for why the edge points one way).
      */
     readonly capabilities: readonly FrontendCapabilitySpec[];
+    readonly session?: Pick<FrontendSessionsHttpDeps, 'routePrefix' | 'resolveOwner' | 'sessionTtlMs' | 'resolveCapacityKeys'> & {
+        readonly maxSessions?: number;
+        readonly maxSessionsPerKey?: number;
+    };
     /**
      * Reads this run's bind token out of the host's own run request, or returns `undefined` when the
      * run has no originating surface.
@@ -98,6 +104,13 @@ export interface CreateFrontendControlOptions {
     readonly onBindError?: (context: FrontendBindErrorContext) => void;
 }
 export interface FrontendControl {
+    /** Request-lifetime binding for hosts without daemon runs; release in finally and on cancel. */
+    bindRequest(required: {
+        runId: string;
+        bindToken: string;
+        owner: FrontendSessionOwner;
+        signal: AbortSignal;
+    }, optional?: Record<string, never>): () => void;
     /**
      * Mounts the frontend-session stream and response routes. Pass in `createLocalNodeDaemon`'s
      * `httpExtensions`, or call it directly with `(app, { adapter })` from a host that owns its own

package/dist/http/frontend-control.js

@@ -17,7 +17,10 @@ function defaultBindErrorSink(context) {
 export function createFrontendControl(requiredArgs, optionalArgs = {}) {
     const options = { ...requiredArgs, ...optionalArgs };
     // Closed over, never exposed. See the module doc: reaching this is reaching an ungated `invoke`.
-    const registry = createFrontendSessionRegistry({});
+    const registry = createFrontendSessionRegistry({}, {
+        ...(options.session?.maxSessions !== undefined ? { maxSessions: options.session.maxSessions } : {}),
+        ...(options.session?.maxSessionsPerKey !== undefined ? { maxSessionsPerKey: options.session.maxSessionsPerKey } : {}),
+    });
     const onBindError = options.onBindError ?? defaultBindErrorSink;
     const toolRegistrations = createFrontendCapabilityRegistrations({
         registry,
@@ -28,7 +31,7 @@ export function createFrontendControl(requiredArgs, optionalArgs = {}) {
         ...(options.maxOutputBytes !== undefined ? { maxOutputBytes: options.maxOutputBytes } : {}),
     });
     const httpExtension = ({ app, context }) => {
-        registerFrontendSessionRoutes({ app, deps: { registry }, adapter: context.adapter });
+        registerFrontendSessionRoutes({ app, deps: { registry, ...options.session, allowedCapabilities: options.capabilities.map(c => c.id) }, adapter: context.adapter });
     };
     /**
      * The error boundary the `onBindError` contract actually needs. A `RunStartHandler` throwing is
@@ -74,6 +77,14 @@ export function createFrontendControl(requiredArgs, optionalArgs = {}) {
             .then(release, release)
             .catch(() => undefined);
     };
-    return { httpExtension, toolRegistrations, bindOnStarted };
+    const bindRequest = ({ runId, bindToken, owner, signal }) => {
+        if (signal.aborted)
+            throw new Error('Frontend request cancelled');
+        const unbind = registry.bindRunByToken({ runId, bindToken, owner });
+        const release = () => { signal.removeEventListener('abort', release); unbind(); };
+        signal.addEventListener('abort', release, { once: true });
+        return release;
+    };
+    return { httpExtension, toolRegistrations, bindOnStarted, bindRequest };
 }
 //# sourceMappingURL=frontend-control.js.map

package/dist/http/frontend-guest-scope.d.ts

@@ -0,0 +1,32 @@
+import type { Request, Response } from 'express';
+import type { FrontendSessionOwner } from '../frontend-session-registry.js';
+/** Per-instance keys isolate visitor control from every other frontend registry.
+ * Tokens are bounded and expire; never put either credential in URLs or diagnostics.
+ * O(1) bounded cookie/token parsing and signing, no persistent guest database. */
+export declare function createFrontendGuestScope({ workspaceId, cookieName, cookiePath, allowsRequest }: {
+    workspaceId: string;
+    cookieName: string;
+    cookiePath: string;
+    allowsRequest: (args: {
+        req: Request;
+    }) => Promise<boolean>;
+}, { now, lifetimeMs }?: {
+    now?: () => number;
+    lifetimeMs?: number;
+}): {
+    /** Authenticate the cookie independently of a tab for credential-minting budgets. */
+    resolveGuest({ req }: {
+        req: Request;
+    }, _options?: {}): Promise<string | undefined>;
+    issue({ req, res }: {
+        req: Request;
+        res: Response;
+    }, _options?: {}): Promise<{
+        tabCredential: string;
+    } | null>;
+    resolveOwner({ req }: {
+        req: Request;
+        res?: Response;
+    }, _options?: {}): Promise<FrontendSessionOwner | null>;
+};
+//# sourceMappingURL=frontend-guest-scope.d.ts.map