@jini-ai/daemon 0.6.15 → 0.6.17

package/dist/terminal.adapter.js

@@ -0,0 +1,47 @@
+/**
+ * Opt-in native PTY adapter. Import from `@jini-ai/daemon/terminal` and inject
+ * `() => loadRealSpawnPty({})` into the session manager's `loadSpawnPty` port.
+ */
+import { loadOptionalPeer } from '@jini-ai/core/optional-peer';
+import { createRequire } from 'node:module';
+import { ensureSpawnHelperExecutable, spawnHelperCandidatePaths, } from '@jini-ai/platform';
+const daemonRequire = createRequire(import.meta.url);
+/** Adapts a real `node-pty` `IPty` to `@jini-ai/platform`'s narrower `PtyProcess` port — explicit per-member mapping rather than relying on structural assignability, matching this package's established "explicit adapter, no implicit coercion" convention (e.g. `agent-executor.ts`'s `toStringEnvRecord`). */
+function toPtyProcess(pty) {
+    return {
+        onData: (cb) => {
+            pty.onData(cb);
+        },
+        onExit: (cb) => {
+            pty.onExit(cb);
+        },
+        write: (input) => pty.write(input),
+        resize: (cols, rows) => pty.resize(cols, rows),
+        kill: (signal) => pty.kill(signal),
+    };
+}
+/**
+ * The real, `node-pty`-backed {@link PtySpawn}. Dynamically imports
+ * `node-pty` (mirroring OD's origin `await import('node-pty')`, not a
+ * static top-level import) so a host process whose platform/environment
+ * lacks a usable `node-pty` addon can still boot — only an actual
+ * `terminal.create` call fails, cleanly, rather than crashing at
+ * module-eval time. Before the first spawn, repairs `node-pty`'s bundled
+ * `spawn-helper` binary's executable bit (pnpm unpacks it non-executable —
+ * see `@jini-ai/platform`'s `terminal.ts` module doc for the full story) via
+ * that package's own `spawnHelperCandidatePaths`/`ensureSpawnHelperExecutable`,
+ * but with the resolver anchored at **this** module
+ * (`createRequire(import.meta.url)` here, not `@jini-ai/platform`'s own
+ * default): `@jini-ai/platform` deliberately does not depend on `node-pty`, so
+ * its default `require.resolve('node-pty')` would not find the copy this
+ * package (`@jini-ai/daemon`) actually declares — this is exactly the
+ * resolver injection seam `spawnHelperCandidatePaths` was built for.
+ * @throws A feature-specific load error with the original resolution/ABI error as `cause`.
+ * @complexity O(1) adapter work; module loading and helper repair belong to the platform.
+ */
+export async function loadRealSpawnPty(_requiredArgs, _optionalArgs = {}) {
+    ensureSpawnHelperExecutable(spawnHelperCandidatePaths({ resolve: (specifier) => daemonRequire.resolve(specifier) }));
+    const nodePty = await loadOptionalPeer({ feature: 'Interactive terminals', dependency: 'node-pty', load: () => import('node-pty') });
+    return (shell, args, options) => toPtyProcess(nodePty.spawn(shell, args, options));
+}
+//# sourceMappingURL=terminal.adapter.js.map

package/dist/tool-executor.d.ts

@@ -17,7 +17,7 @@ export interface ToolConfirmationRequest {
  * The transport-supplied seam for the two touchpoints a headless kernel
  * cannot render itself. Both are optional: a tool whose `ToolPolicy`
  * always resolves definitively needs no `onAuthorize`, and a tool with
- * `requiresConfirmation` unset never triggers `onConfirm`.
+ * `requiresConfirmation` unset has no default prompt; a host may strengthen a single call with `requireConfirmation: true`.
  */
 export interface ExecutionDelegate {
     /**
@@ -42,7 +42,7 @@ export interface ExecutionDelegate {
      */
     onConfirm?(request: ToolConfirmationRequest): ConfirmationDecision | Promise<ConfirmationDecision> | void;
 }
-export type ToolExecutionPhase = 'requested' | 'authorized' | 'denied' | 'confirmed' | 'confirmation-denied' | 'started' | 'completed' | 'failed' | 'timed-out' | 'cancelled';
+export type ToolExecutionPhase = 'requested' | 'authorized' | 'denied' | 'confirmed' | 'approval-recorded' | 'confirmation-denied' | 'started' | 'completed' | 'failed' | 'timed-out' | 'cancelled';
 export interface ToolExecutionAuditEvent {
     readonly phase: ToolExecutionPhase;
     readonly at: number;
@@ -85,6 +85,7 @@ export interface ToolExecutor {
      * @param emitSurface - Transport-supplied seam letting the handler push a human-only surface into
      * the run's event stream *before* this call settles. Omit for a caller with no run event stream;
      * see `@jini-ai/core`'s `SurfaceEmitter` for why a handler that waits on a human needs it.
+     * @param requireConfirmation - Strengthens this call only; cannot bypass a descriptor confirmation.
      * @throws {ToolInputError} If `toolId` isn't registered, with up to eight registered prefix matches.
      */
     execute(args: {
@@ -95,6 +96,7 @@ export interface ToolExecutor {
     }, optionalArgs?: {
         readonly signal?: AbortSignal;
         readonly emitSurface?: SurfaceEmitter;
+        readonly requireConfirmation?: true;
     }): Promise<ToolExecutionResult>;
     /** @throws If `executionId` has no confirmation currently pending (already resumed, never required one, or unknown). */
     resumeConfirmation(args: {

package/dist/tool-executor.js

@@ -46,7 +46,7 @@
  * answer gets back in.
  */
 import { randomUUID } from 'node:crypto';
-import { ToolInputError, withNormalizationNotes, ToolInputNormalizationError, isReadOnlyTool, } from '@jini-ai/core';
+import { ToolInputError, APPROVAL_WAIT_TIMEOUT_MS, withNormalizationNotes, ToolInputNormalizationError, isReadOnlyTool, } from '@jini-ai/core';
 import { authorizeToolInvocation } from '@jini-ai/core/composition';
 import { toolCandidates } from './core/tool-candidates.js';
 /**
@@ -206,15 +206,45 @@ export function createToolExecutor(requiredArgs, optionalArgs = {}) {
      * what distinguishes a `timed-out` result from a `cancelled` one.
      */
     function startTimeout(controller, timeoutMs) {
-        if (timeoutMs === undefined)
-            return { handle: undefined, timedOut: () => false };
+        let handle;
         let timedOut = false;
-        const handle = setTimeout(() => {
-            timedOut = true;
-            controller.abort();
-        }, timeoutMs);
-        handle.unref?.();
-        return { handle, timedOut: () => timedOut };
+        let waiting = false;
+        let approvalWindowUsed = false;
+        let remaining = timeoutMs;
+        let started = Date.now();
+        const stop = () => {
+            if (handle === undefined)
+                return;
+            clearTimeout(handle);
+            handle = undefined;
+        };
+        const arm = (duration) => {
+            stop();
+            started = Date.now();
+            if (duration === undefined)
+                return;
+            handle = setTimeout(() => { timedOut = true; controller.abort(); }, duration);
+            handle.unref?.();
+        };
+        arm(remaining);
+        return {
+            stop,
+            timedOut: () => timedOut,
+            /** Human waiting is bounded independently and cannot replenish the execution budget.
+             * Duplicate progress frames cannot extend either deadline. */
+            approval: ({ pending }) => {
+                if (pending === waiting || controller.signal.aborted)
+                    return;
+                if (pending && approvalWindowUsed)
+                    return;
+                if (pending)
+                    approvalWindowUsed = true;
+                if (pending && remaining !== undefined)
+                    remaining = Math.max(0, remaining - (Date.now() - started));
+                waiting = pending;
+                arm(pending ? APPROVAL_WAIT_TIMEOUT_MS : remaining);
+            },
+        };
     }
     /** Records a terminal transition that carries no detail and returns its bare result. */
     function terminal({ executionId, status }) {
@@ -406,8 +436,8 @@ export function createToolExecutor(requiredArgs, optionalArgs = {}) {
         // the catch). Repeating one call avoids leaving an uncoverable branch
         // behind instead of writing a contrived test or suppressing it.
         const cleanup = () => {
-            if (timeout.handle)
-                clearTimeout(timeout.handle);
+            timeout.stop();
+            approvalStateChange({ run, executionId, toolId: call.toolId, pending: false });
         };
         appendEvent(executionId, 'started');
         try {
@@ -422,7 +452,13 @@ export function createToolExecutor(requiredArgs, optionalArgs = {}) {
                 signal: controller.signal,
             }, {
                 ...surfaceOption(emitSurface),
-                onApprovalStateChange: ({ pending }) => approvalStateChange({ run, executionId, toolId: call.toolId, pending }),
+                onApprovalStateChange: ({ pending, decision }) => {
+                    // The tab owns human confirmation; retain its outcome without opening a chat surface.
+                    if (decision)
+                        appendEvent(executionId, 'approval-recorded', `frontend approval: ${decision}`);
+                    timeout.approval({ pending });
+                    approvalStateChange({ run, executionId, toolId: call.toolId, pending });
+                },
                 invokeTool: nestedInvoker({ principal, run, toolId: call.toolId, invocationRegistry: call.invocationRegistry, signal: controller.signal }, { emitSurface }),
             });
             cleanup();
@@ -433,7 +469,7 @@ export function createToolExecutor(requiredArgs, optionalArgs = {}) {
             return failureResult({ executionId, err, timedOut: timeout.timedOut(), aborted: controller.signal.aborted }, { normalizationNotes, guidance });
         }
     }
-    async function execute({ principal, run, toolId, input }, { signal, emitSurface, invocationRegistry = registry } = {}) {
+    async function execute({ principal, run, toolId, input }, { signal, emitSurface, invocationRegistry = registry, requireConfirmation } = {}) {
         // Existence is checked separately from — and before — authorization so the audit record can
         // be opened before the (possibly slow, possibly throwing) authorization gate runs, matching
         // pre-authorizeToolInvocation timing: `requested` used to precede `policy.authorize`, and a
@@ -494,7 +530,7 @@ export function createToolExecutor(requiredArgs, optionalArgs = {}) {
         }
         const admitted = gate.allowed;
         const { descriptor } = admitted;
-        if (descriptor.requiresConfirmation) {
+        if (descriptor.requiresConfirmation || requireConfirmation) {
             const declined = await confirmGate({ executionId, principal, run, tool: descriptor, input: admitted.input });
             if (declined) {
                 cleanupCancellation();

package/dist/tool-result-media.d.ts

@@ -42,6 +42,10 @@ export interface ToolResultImageBlock {
     readonly mimeType: string;
     /** Base64-encoded image bytes. */
     readonly data: string;
+    /** Optional caption and alt text for a chat renderer. Not an MCP field; MCP clients ignore it. */
+    readonly title?: string;
+    /** Optional link the chat opens on click (e.g. the full-size file). The renderer still checks it. */
+    readonly href?: string;
 }
 /** A tool result content block `media` may carry. Modeled on MCP's own content-block vocabulary —
  *  see this module's doc for why that vocabulary is reused rather than a fourth one invented. */

package/dist/tool-result-media.js

@@ -8,10 +8,11 @@ function isRecord(value) {
 function asImageBlock(block) {
     if (!isRecord(block) || block['type'] !== 'image')
         return undefined;
-    const { mimeType, data } = block;
+    const { mimeType, data, title, href } = block;
     if (typeof mimeType !== 'string' || typeof data !== 'string')
         return undefined;
-    return { type: 'image', mimeType, data };
+    // Untrusted extras are kept only as strings, so a caption or link can never smuggle an object.
+    return { type: 'image', mimeType, data, ...(typeof title === 'string' ? { title } : {}), ...(typeof href === 'string' ? { href } : {}) };
 }
 /**
  * Splits a tool handler's raw return value into its recognized media blocks and the remainder,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/daemon",
-  "version": "0.6.15",
+  "version": "0.6.17",
   "description": "The stateful agent daemon runtime: run lifecycle, durable event-log port, the tool-execution boundary, agent executor, terminal sessions, and routines.",
   "license": "Apache-2.0",
   "repository": {
@@ -14,6 +14,7 @@
     "runtime": "node",
     "entries": {
       ".": "node",
+      "./terminal": "node",
       "./store/event-log/sqlite": "node",
       "./store/agent-sessions": "universal",
       "./store/agent-sessions/sqlite": "node",
@@ -34,6 +35,12 @@
         "src/surface-exchanges.ts",
         "src/scheduler.ts"
       ]
+    },
+    "optionalPeers": {
+      "node-pty": "opt-in: import @jini-ai/daemon/terminal — Interactive terminals could not load node-pty. Install node-pty to enable this feature, or check its installed version and native binaries.",
+      "better-sqlite3": "opt-in: sqlite storage — SQLite storage could not load better-sqlite3. Install better-sqlite3 to enable this feature, or check its installed version and native binaries.",
+      "@electric-sql/pglite": "opt-in: embedded postgresql storage — Embedded PostgreSQL storage could not load @electric-sql/pglite. Install @electric-sql/pglite to enable this feature, or check its installed version and native binaries.",
+      "pg": "opt-in: postgresql storage — PostgreSQL storage could not load pg. Install pg to enable this feature, or check its installed version and native binaries."
     }
   },
   "type": "module",
@@ -46,6 +53,11 @@
       "import": "./dist/index.js",
       "default": "./dist/index.js"
     },
+    "./terminal": {
+      "types": "./dist/terminal.adapter.d.ts",
+      "import": "./dist/terminal.adapter.js",
+      "default": "./dist/terminal.adapter.js"
+    },
     "./store/event-log/sqlite": {
       "types": "./dist/store/event-log/sqlite.d.ts",
       "import": "./dist/store/event-log/sqlite.js",
@@ -140,44 +152,35 @@
     "@types/pg": "8.23.1",
     "express": "^4.21.0",
     "@types/express": "^4.17.21",
-    "@jini-ai/db": "0.6.15",
-    "@jini-ai/http-kit": "0.6.15",
-    "@jini-ai/chat": "0.6.15",
-    "@jini-ai/core": "^0.6.15",
-    "@jini-ai/platform": "^0.6.15",
-    "@jini-ai/protocol": "^0.6.15",
-    "@jini-ai/agent-runtime": "^0.6.15"
+    "@jini-ai/http-kit": "0.6.17",
+    "@jini-ai/chat": "0.6.17",
+    "@jini-ai/db": "0.6.17",
+    "@jini-ai/core": "^0.6.17",
+    "@jini-ai/agent-runtime": "^0.6.17",
+    "@jini-ai/platform": "^0.6.17",
+    "@jini-ai/protocol": "^0.6.17"
   },
   "dependencies": {
-    "@jini-ai/core": "^0.6.15",
-    "@jini-ai/protocol": "^0.6.15"
+    "smol-toml": "1.9.1",
+    "kysely": "^0.29.6",
+    "@jini-ai/core": "^0.6.17",
+    "@jini-ai/db": "^0.6.17",
+    "@jini-ai/platform": "^0.6.17",
+    "@jini-ai/agent-runtime": "^0.6.17",
+    "@jini-ai/protocol": "^0.6.17",
+    "@jini-ai/http-kit": "^0.6.17"
   },
   "peerDependencies": {
-    "smol-toml": "1.9.1",
     "node-pty": "^1.1.0",
-    "@jini-ai/db": "^0.6.10",
-    "kysely": "^0.29.6",
     "better-sqlite3": "^13.0.0",
     "@electric-sql/pglite": "0.5.8",
     "pg": "^8.23.0",
-    "@jini-ai/http-kit": "^0.6.10",
-    "express": "^4.21.0 || ^5.0.0",
-    "@jini-ai/agent-runtime": "^0.6.10",
-    "@jini-ai/platform": "^0.6.10"
+    "express": "^4.21.0 || ^5.0.0"
   },
   "peerDependenciesMeta": {
-    "smol-toml": {
-      "optional": true
-    },
     "node-pty": {
       "optional": true
     },
-    "@jini-ai/db": {
-      "optional": true
-    },
-    "kysely": {
-      "optional": true
-    },
     "better-sqlite3": {
       "optional": true
     },
@@ -186,18 +189,6 @@
     },
     "pg": {
       "optional": true
-    },
-    "@jini-ai/http-kit": {
-      "optional": true
-    },
-    "express": {
-      "optional": true
-    },
-    "@jini-ai/agent-runtime": {
-      "optional": true
-    },
-    "@jini-ai/platform": {
-      "optional": true
     }
   },
   "scripts": {