@jini-ai/daemon 0.6.16 → 0.6.19

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## 0.6.19
+
+- `DelegatedToolsHttpDeps.toolRegistry` takes a list-only registry view (`Pick<ToolRegistry, 'list'>`): the route only reads descriptors, and hosts pass descriptor-only facades.
+- Redact exception logs with the shared core redactor while preserving correlation IDs and error codes.
+- Redact host-supplied paths and payload names in the default migration logger; preserve bind-error callback object assertions.
+
+## 0.6.17
+
+### Patch Changes
+
+- Handle npm 12 pack JSON through the shared parser in packed agent-session fixtures.
+
 ## 0.6.16
 
 ### Minor Changes

package/dist/agent-executor/claude/mcp-config.d.ts

@@ -0,0 +1,17 @@
+import type { McpHttpEndpoint, McpJsonInjectionOptions } from '../contracts.js';
+/** Stage Claude's HTTP capability outside the project; only this private path enters argv.
+ * @returns A private config path and removal of only its owned directory.
+ * @throws Filesystem staging errors after removing partial output.
+ * @complexity O(config bytes), one project read and one private config write.
+ */
+export declare function prepareClaudeHttpMcpConfig({ cwd, endpoint }: {
+    cwd: string;
+    endpoint: Pick<McpHttpEndpoint, 'url' | 'token'>;
+}, { inheritUserMcp, readFile }?: {
+    inheritUserMcp?: boolean;
+    readFile?: McpJsonInjectionOptions['readFile'];
+}): Promise<{
+    path: string;
+    cleanup: () => Promise<void>;
+}>;
+//# sourceMappingURL=mcp-config.d.ts.map

package/dist/agent-executor/claude/mcp-config.js

@@ -0,0 +1,29 @@
+import { promises as fs } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { defaultReadMcpJsonFile, mergeMcpJsonContent } from '../mcp-bridge.js';
+/** Stage Claude's HTTP capability outside the project; only this private path enters argv.
+ * @returns A private config path and removal of only its owned directory.
+ * @throws Filesystem staging errors after removing partial output.
+ * @complexity O(config bytes), one project read and one private config write.
+ */
+export async function prepareClaudeHttpMcpConfig({ cwd, endpoint }, { inheritUserMcp = true, readFile = defaultReadMcpJsonFile } = {}) {
+    const dir = await fs.mkdtemp(join(tmpdir(), 'jini-claude-mcp-'));
+    const cleanup = () => fs.rm(dir, { recursive: true, force: true });
+    try {
+        let existingRaw;
+        if (inheritUserMcp)
+            existingRaw = await readFile({ path: join(cwd, '.mcp.json') }).catch(() => undefined);
+        const content = mergeMcpJsonContent({ existingRaw, serverEntry: {
+                type: 'http', url: endpoint.url, headers: { Authorization: `Bearer ${endpoint.token}` },
+            } });
+        const path = join(dir, 'mcp.json');
+        await fs.writeFile(path, content, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+        return { path, cleanup };
+    }
+    catch (error) {
+        await cleanup();
+        throw error;
+    }
+}
+//# sourceMappingURL=mcp-config.js.map

package/dist/agent-executor/codex/home-config.d.ts

@@ -1,23 +1,24 @@
-import type { McpJsonServerEntry } from '../contracts.js';
+import type { McpHttpEndpoint, McpJsonServerEntry } from '../contracts.js';
 /** A TOML key: bare when TOML allows it, quoted otherwise — host-supplied bridge env names are not guaranteed bare-safe. */
 export declare function tomlKey(key: string): string;
 /**
  * Mechanism 5 of 5 — `'codex-toml'`'s serialization step. Builds the `[mcp_servers.jini]` TOML
  * table (plus, when the entry carries any env vars, a separate `[mcp_servers.jini.env]` table)
- * Codex's own config schema expects.
+ * Codex's own config schema expects. An explicit HTTP endpoint instead writes `url` and
+ * literal `http_headers` through the same table replacement and escaping owners.
  *
  * Confirmed against a real installed Codex CLI (0.151.0), not assumed from docs: round-tripping
  * `codex mcp add <name> --env K=V -- <cmd> <args>` against a scratch `CODEX_HOME` and reading back
  * `config.toml` produced exactly this shape (`command`/`args` as TOML strings/array in the main
  * table, env vars in a nested `.env` table) — see `archived provenance ledger` for the transcript.
- * @param entry - The shared bridge entry from {@link buildMcpJsonServerEntry}.
+ * @param entry - A stdio bridge entry or an explicit run HTTP endpoint.
  * @returns A TOML fragment with no leading/trailing blank-line padding — {@link buildCodexHomeConfigToml} owns spacing when combining it with existing content.
  * @complexity O(n) in the number of argv/env entries.
  * @overallScore 100/100
  */
 export declare function buildCodexMcpServerToml({ entry }: {
-    readonly entry: McpJsonServerEntry;
-}): string;
+    readonly entry: McpJsonServerEntry | Pick<McpHttpEndpoint, 'url' | 'token'>;
+}, _options?: {}): string;
 /**
  * Builds the full `config.toml` a run's scratch `CODEX_HOME` gets: the real Codex home's own
  * config, with any pre-existing `[mcp_servers.jini]` table removed (see
@@ -43,7 +44,7 @@ export declare function buildCodexMcpServerToml({ entry }: {
  */
 export declare function buildCodexHomeConfigToml({ existingRaw, entry, inheritUserMcp, inheritUserSettings }: {
     readonly existingRaw: string | undefined;
-    readonly entry: McpJsonServerEntry;
+    readonly entry: McpJsonServerEntry | Pick<McpHttpEndpoint, 'url' | 'token'>;
     readonly inheritUserMcp?: boolean;
     readonly inheritUserSettings?: boolean;
 }, _optional?: Record<string, never>): string;

package/dist/agent-executor/codex/home-config.js

@@ -44,18 +44,21 @@ const CODEX_TOOL_TIMEOUT_SEC = 6 * 60 + 40;
 /**
  * Mechanism 5 of 5 — `'codex-toml'`'s serialization step. Builds the `[mcp_servers.jini]` TOML
  * table (plus, when the entry carries any env vars, a separate `[mcp_servers.jini.env]` table)
- * Codex's own config schema expects.
+ * Codex's own config schema expects. An explicit HTTP endpoint instead writes `url` and
+ * literal `http_headers` through the same table replacement and escaping owners.
  *
  * Confirmed against a real installed Codex CLI (0.151.0), not assumed from docs: round-tripping
  * `codex mcp add <name> --env K=V -- <cmd> <args>` against a scratch `CODEX_HOME` and reading back
  * `config.toml` produced exactly this shape (`command`/`args` as TOML strings/array in the main
  * table, env vars in a nested `.env` table) — see `archived provenance ledger` for the transcript.
- * @param entry - The shared bridge entry from {@link buildMcpJsonServerEntry}.
+ * @param entry - A stdio bridge entry or an explicit run HTTP endpoint.
  * @returns A TOML fragment with no leading/trailing blank-line padding — {@link buildCodexHomeConfigToml} owns spacing when combining it with existing content.
  * @complexity O(n) in the number of argv/env entries.
  * @overallScore 100/100
  */
-export function buildCodexMcpServerToml({ entry }) {
+export function buildCodexMcpServerToml({ entry }, _options = {}) {
+    if ('url' in entry)
+        return buildCodexHttpMcpServerToml({ endpoint: entry });
     const argsLiteral = entry.args.map(tomlString).join(', ');
     const serverTable = `[mcp_servers.${JINI_MCP_SERVER_KEY}]\ncommand = ${tomlString(entry.command)}\nargs = [${argsLiteral}]\n` +
         `tool_timeout_sec = ${CODEX_TOOL_TIMEOUT_SEC}\n`;
@@ -66,6 +69,15 @@ export function buildCodexMcpServerToml({ entry }) {
         return serverTable;
     return `${serverTable}\n[mcp_servers.${JINI_MCP_SERVER_KEY}.env]\n${envLines.join('\n')}\n`;
 }
+/** Literal headers keep the run token out of argv and bearer environment variables.
+ * @returns One HTTP table using the existing timeout and TOML escaping owner.
+ * @complexity O(endpoint bytes), without I/O.
+ */
+function buildCodexHttpMcpServerToml({ endpoint }, _options = {}) {
+    return `[mcp_servers.${JINI_MCP_SERVER_KEY}]\nurl = ${tomlString(endpoint.url)}\n` +
+        `tool_timeout_sec = ${CODEX_TOOL_TIMEOUT_SEC}\n\n[mcp_servers.${JINI_MCP_SERVER_KEY}.http_headers]\n` +
+        `Authorization = ${tomlString(`Bearer ${endpoint.token}`)}\n`;
+}
 /**
  * Splits a TOML table header's dotted key into its individual segments, honoring quoted parts
  * (`"basic"` or `'literal'`) that may themselves contain a literal `.` — a bare `.` only

package/dist/agent-executor/codex/home-staging.d.ts

@@ -1,5 +1,5 @@
 import type { RuntimeAgentDef } from '@jini-ai/agent-runtime';
-import type { McpJsonInjectionOptions, McpBridgeDelivery, PreparedCodexHome, FailBeforeSpawn } from '../contracts.js';
+import type { McpJsonInjectionOptions, McpHttpEndpoint, McpBridgeDelivery, PreparedCodexHome, FailBeforeSpawn } from '../contracts.js';
 /**
  * Where `'codex-toml'` reads the operator's REAL Codex config from, to seed a run's scratch copy —
  * never where it writes. Resolved against the daemon HOST process's own environment (`hostEnv`,
@@ -37,7 +37,8 @@ export declare function codexInheritance(input: {
  * returning the prepared handle `cleanupStagedFiles` should later release (`null` for every other
  * mechanism, or for an unconfigured host — matching {@link writeMcpJsonIfNeeded}'s identical gate).
  * @param input.def - Only used for its `id`, in the failure message.
- * @param input.mcpBridge - This run's resolved bridge delivery — a no-op unless its `kind` is `'codex-toml'`.
+ * @param input.mcpBridge - Existing stdio delivery; HTTP uses the optional `httpEndpoint` instead.
+ * @param input.httpEndpoint - Explicit run listener, using the same isolation, state links and cleanup as stdio.
  * @param deps.hostEnv - The daemon's own environment, threaded through to {@link resolveSourceCodexHomeDir} rather than read from a module-level `process.env` so this phase stays testable with an injected env.
  * @complexity O(1) plus {@link prepareCodexHomeForRun}'s own cost.
  * @overallScore 100/100
@@ -49,6 +50,7 @@ export declare function prepareCodexHomeIfNeeded({ input, deps }: {
         readonly nativeCapabilities?: Partial<import('@jini-ai/agent-runtime').NativeCapabilities>;
         readonly def: RuntimeAgentDef;
         readonly mcpBridge: McpBridgeDelivery | null;
+        readonly httpEndpoint?: McpHttpEndpoint;
     };
     readonly deps: {
         readonly mcpJsonInjection: McpJsonInjectionOptions | undefined;

package/dist/agent-executor/codex/home-staging.js

@@ -165,13 +165,15 @@ export function codexInheritance(input) {
  * returning the prepared handle `cleanupStagedFiles` should later release (`null` for every other
  * mechanism, or for an unconfigured host — matching {@link writeMcpJsonIfNeeded}'s identical gate).
  * @param input.def - Only used for its `id`, in the failure message.
- * @param input.mcpBridge - This run's resolved bridge delivery — a no-op unless its `kind` is `'codex-toml'`.
+ * @param input.mcpBridge - Existing stdio delivery; HTTP uses the optional `httpEndpoint` instead.
+ * @param input.httpEndpoint - Explicit run listener, using the same isolation, state links and cleanup as stdio.
  * @param deps.hostEnv - The daemon's own environment, threaded through to {@link resolveSourceCodexHomeDir} rather than read from a module-level `process.env` so this phase stays testable with an injected env.
  * @complexity O(1) plus {@link prepareCodexHomeForRun}'s own cost.
  * @overallScore 100/100
  */
 export async function prepareCodexHomeIfNeeded({ input, deps }) {
-    if (input.mcpBridge?.kind !== 'codex-toml' || deps.mcpJsonInjection === undefined) {
+    const entry = input.httpEndpoint ?? (input.mcpBridge?.kind === 'codex-toml' ? input.mcpBridge.serverEntry : undefined);
+    if (entry === undefined || deps.mcpJsonInjection === undefined) {
         if (codexTurnsOffPersonalConfig(input)) {
             await deps.releaseStagedResources();
             return deps.failBeforeSpawn({ runId: input.runId, code: 'NATIVE_TOOL_POLICY_UNSUPPORTED',
@@ -181,7 +183,7 @@ export async function prepareCodexHomeIfNeeded({ input, deps }) {
     }
     const inherit = codexInheritance(input);
     try {
-        return await prepareCodexHomeForRun(input.runId, input.mcpBridge.serverEntry, resolveSourceCodexHomeDir({ hostEnv: deps.hostEnv }), resolveCodexHomeSeams(deps.mcpJsonInjection), inherit.settings, inherit.mcp);
+        return await prepareCodexHomeForRun(input.runId, entry, resolveSourceCodexHomeDir({ hostEnv: deps.hostEnv }), resolveCodexHomeSeams(deps.mcpJsonInjection), inherit.settings, inherit.mcp);
     }
     catch (err) {
         await deps.releaseStagedResources();

package/dist/agent-executor/contracts.d.ts

@@ -344,7 +344,22 @@ export interface ContinuationOptions {
  * loopback URL this package could assume on a caller's behalf (matching every other seam on this
  * interface that defaults to *nothing* rather than a real implementation).
  */
+/** A private per-run listener; its token authorizes this endpoint, never daemon callbacks. */
+export interface McpHttpEndpoint {
+    readonly url: string;
+    readonly token: string;
+    close(required: Record<string, never>, optional?: Record<string, never>): Promise<void>;
+}
 export interface McpJsonInjectionOptions {
+    /** Optional transport port. Reject before CLI launch when HTTP cannot be prepared.
+     * The host keeps callback credentials in memory; only this endpoint capability reaches the CLI. */
+    readonly prepareHttp?: (required: {
+        readonly runId: string;
+    }, optional?: {
+        readonly messageRelayNonce?: string;
+        readonly startupToolIds?: readonly string[];
+        readonly diagnosticToolIds?: readonly string[];
+    }) => Promise<McpHttpEndpoint>;
     /** Read current host-registered tool IDs at launch, outside model-controlled input. */
     readonly diagnosticToolIds?: () => readonly string[];
     /**

package/dist/agent-executor/event-translation.js

@@ -86,6 +86,9 @@ function translateToolUseEvent(rawEvent) {
             id: asString(rawEvent.id),
             name: asString(rawEvent.name),
             input: rawEvent.input ?? null,
+            ...(isRecord(rawEvent.bridgeCall) && typeof rawEvent.bridgeCall.name === 'string'
+                ? { bridgeCall: { name: rawEvent.bridgeCall.name, input: rawEvent.bridgeCall.input,
+                        ...(rawEvent.bridgeCall.buffered === true ? { buffered: true } : {}) } } : {}),
         },
     };
 }

package/dist/agent-executor/events.js

@@ -13,6 +13,7 @@ import { classifyRunCloseStatus, } from '../close-status.js';
 import { resolveContinuationTransport, } from '../continuation/continuation-transport.js';
 import { resultContent, } from '../delegated-tool-bridge.js';
 import { projectToolResultEvent, } from '../tool-result-media.js';
+import { createCliToolCallReceiver } from './tool-call-receipts.js';
 import { translateAgentRuntimeEvent, translateAcpError, applyAgentTranslationSideEffects, } from './event-translation.js';
 import { errorMessage, } from './values.js';
 import { MCP_BRIDGE_UNAVAILABLE, unavailableJiniBridgeStatus, bridgeUnavailableMessage, } from './mcp-bridge.js';
@@ -45,7 +46,7 @@ function createStreamHandlerForDef(def, streamFormat, onEvent) {
         case 'qoder-stream-json':
             return createQoderStreamHandler({ onEvent: onEvent });
         case 'json-event-stream':
-            return createJsonEventStreamHandler({ kind: def.eventParser ?? '', onEvent: onEvent });
+            return createJsonEventStreamHandler({ kind: def.eventParser ?? '', onEvent: createCliToolCallReceiver({ kind: def.eventParser ?? '', onEvent }) });
         default: {
             // Unreachable: every stream format has a case above, and a new one fails typecheck here.
             const unknownFormat = streamFormat;

package/dist/agent-executor/gemini/tool-calls.d.ts

@@ -0,0 +1,7 @@
+/** Gemini's legacy stream reports bare MCP names, indistinguishable from native tool names.
+ * Correlation is only a candidate: the shared fold requires a real bridge row with equal input.
+ * Keep native names/arguments intact for presentation and auditing. Pure, O(1). */
+export declare function geminiToolCallReceipt({ event }: {
+    event: Record<string, unknown>;
+}, _options?: {}): Record<string, unknown>;
+//# sourceMappingURL=tool-calls.d.ts.map

package/dist/agent-executor/gemini/tool-calls.js

@@ -0,0 +1,9 @@
+/** Gemini's legacy stream reports bare MCP names, indistinguishable from native tool names.
+ * Correlation is only a candidate: the shared fold requires a real bridge row with equal input.
+ * Keep native names/arguments intact for presentation and auditing. Pure, O(1). */
+export function geminiToolCallReceipt({ event }, _options = {}) {
+    if (event.type !== 'tool_use' || typeof event.name !== 'string' || event.name.startsWith('mcp__'))
+        return event;
+    return { ...event, bridgeCall: { name: event.name, input: event.input } };
+}
+//# sourceMappingURL=tool-calls.js.map

package/dist/agent-executor/http-mcp.d.ts

@@ -0,0 +1,23 @@
+import type { RuntimeAgentDef } from '@jini-ai/agent-runtime';
+import type { RunLifecycle } from '../run-lifecycle.js';
+import type { McpHttpEndpoint, McpJsonInjectionOptions } from './contracts.js';
+/** Owned transport resources; cleanup is idempotent and also armed on cancellation/termination. */
+export interface PreparedHttpMcp {
+    readonly endpoint: McpHttpEndpoint;
+    readonly mcpJsonPath?: string;
+    cleanup(): Promise<void>;
+}
+/** Prepare HTTP before launch; only missing support or listener failure selects stdio.
+ * @returns Null for stdio, otherwise a run-owned endpoint and optional private Claude config.
+ * @throws Configuration staging errors after closing the endpoint; never retries dispatched work.
+ * @complexity O(config bytes) for Claude; O(1) otherwise, plus the injected host preparation.
+ */
+export declare function prepareHttpMcpForRun({ runId, cwd, def, lifecycle, injection, inheritUserMcp }: {
+    runId: string;
+    cwd: string;
+    def: RuntimeAgentDef;
+    lifecycle: RunLifecycle;
+    injection: McpJsonInjectionOptions | undefined;
+    inheritUserMcp?: boolean;
+}, _options?: {}): Promise<PreparedHttpMcp | null>;
+//# sourceMappingURL=http-mcp.d.ts.map

package/dist/agent-executor/http-mcp.js

@@ -0,0 +1,74 @@
+import { randomBytes } from 'node:crypto';
+import { prepareClaudeHttpMcpConfig } from './claude/mcp-config.js';
+import { supportsMessageRelay } from './message-relay.js';
+/** Close admission on cancellation/terminal transition without waiting for the CLI pipes.
+ * The shared close promise also handles explicit pre-spawn cleanup exactly once.
+ * @complexity O(1), one cancellable terminal waiter and one cancel subscription per live listener.
+ */
+function watchEndpoint({ endpoint, lifecycle, runId, cleanupConfig }) {
+    const waiting = new AbortController();
+    let closing;
+    let unsubscribe = () => { };
+    const close = () => {
+        waiting.abort();
+        unsubscribe();
+        closing ??= endpoint.close({}).finally(cleanupConfig);
+        return closing;
+    };
+    const closeSafely = () => { void close().catch(() => console.warn('[agent-executor] MCP HTTP cleanup failed')); };
+    unsubscribe = lifecycle.onCancelRequested({ runId, listener: closeSafely });
+    // onCancelRequested replays a prior cancellation before returning its unsubscribe handle.
+    if (closing)
+        unsubscribe();
+    void lifecycle.waitForTerminal({ runId }, { signal: waiting.signal }).then(closeSafely, () => { });
+    return close;
+}
+/** Snapshot host-selected metadata once at launch; it is never learned from model arguments. */
+function httpLaunchOptions({ def, runId, injection }) {
+    return {
+        ...(supportsMessageRelay({ def }) ? { messageRelayNonce: randomBytes(24).toString('hex') } : {}),
+        ...(injection.startupToolIds ? { startupToolIds: injection.startupToolIds({ runId }) } : {}),
+        ...(injection.diagnosticToolIds ? { diagnosticToolIds: injection.diagnosticToolIds() } : {}),
+    };
+}
+/** Claude's path is staged before argv; other vendors use their existing env/home carriers. */
+async function stageHttpConfig({ cwd, def, injection, endpoint, inheritUserMcp }) {
+    if (def.externalMcpInjection !== 'claude-mcp-json')
+        return {};
+    const config = await prepareClaudeHttpMcpConfig({ cwd, endpoint }, { inheritUserMcp,
+        ...(injection.readFile ? { readFile: injection.readFile } : {}),
+    });
+    return { mcpJsonPath: config.path, cleanupConfig: config.cleanup };
+}
+/** Prepare HTTP before launch; only missing support or listener failure selects stdio.
+ * @returns Null for stdio, otherwise a run-owned endpoint and optional private Claude config.
+ * @throws Configuration staging errors after closing the endpoint; never retries dispatched work.
+ * @complexity O(config bytes) for Claude; O(1) otherwise, plus the injected host preparation.
+ */
+export async function prepareHttpMcpForRun({ runId, cwd, def, lifecycle, injection, inheritUserMcp = true }, _options = {}) {
+    if (!injection?.prepareHttp || !def.externalMcpInjection)
+        return null;
+    if (!('mcpHttp' in def) || def.mcpHttp !== true) {
+        console.warn('[agent-executor] MCP HTTP unsupported for this agent; using stdio');
+        return null;
+    }
+    const launchOptions = httpLaunchOptions({ def, runId, injection });
+    let endpoint;
+    try {
+        endpoint = await injection.prepareHttp({ runId }, launchOptions);
+    }
+    catch {
+        console.warn('[agent-executor] MCP HTTP listener unavailable; using stdio');
+        return null;
+    }
+    try {
+        const config = await stageHttpConfig({ cwd, def, injection, endpoint, inheritUserMcp });
+        const cleanup = watchEndpoint({ endpoint, lifecycle, runId, ...config });
+        return { endpoint, ...(config.mcpJsonPath ? { mcpJsonPath: config.mcpJsonPath } : {}), cleanup };
+    }
+    catch (error) {
+        await endpoint.close({});
+        throw error;
+    }
+}
+//# sourceMappingURL=http-mcp.js.map

package/dist/agent-executor/launch.js

@@ -1,3 +1,5 @@
+import { prepareHttpMcpForRun } from './http-mcp.js';
+import { mergeOpenCodeHttpMcpConfig } from './opencode/mcp-config.js';
 import { buildAgentEnv } from './agent-env.js';
 import { randomUUID } from 'node:crypto';
 import { supportsMessageRelay } from './message-relay.js';
@@ -363,8 +365,8 @@ function settingsBuildOptions({ input }, _options = {}) {
     };
 }
 /** A relay needs both a delivered bridge and a runtime that understands it. Pure, O(1). */
-function canRegisterRunMessageRelay({ def, mcpBridge }, _options = {}) {
-    return mcpBridge !== null && supportsMessageRelay({ def });
+function canRegisterRunMessageRelay({ def, mcpBridge, httpMcp }, _options = {}) {
+    return (mcpBridge !== null || httpMcp === true) && supportsMessageRelay({ def });
 }
 /** Phase 9a: the def's `buildArgs` 4th argument. Historically omitted when every override was absent;
  * that let defs silently enable auto-approval. Always supply the validated restricted default now. Pure. */
@@ -619,6 +621,16 @@ export function spawnAgentChildProcess({ input, deps }) {
         return { kind: 'error', error };
     }
 }
+/** Command preparation is part of pre-spawn staging, so failures must release all owned resources. */
+async function prepareRunCommand({ command, args, env, runId }, { createInvocation, release, failBeforeSpawn, }) {
+    try {
+        return createInvocation({ command, args, env });
+    }
+    catch {
+        await release();
+        return failBeforeSpawn({ runId, code: 'AGENT_SPAWN_FAILED', message: 'AgentExecutor: could not prepare agent command' });
+    }
+}
 /** Named predicate replacing an inline `streamFormat === 'acp-json-rpc' || streamFormat === 'pi-rpc'` check — the two formats that own their own prompt/event protocol and skip `wireChildLifecycle`. */
 export function isStdinDrivenFormat(args) {
     const { streamFormat } = args;
@@ -913,11 +925,11 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
             ? mcpBridge.serverEntry
             : undefined;
     }
-    function wireRunInput({ input, def, streamFormat, child, modelCatalog, cleanupStagedFiles, writtenMcpJsonPath, mcpBridge }, _options = {}) {
+    function wireRunInput({ input, def, streamFormat, child, modelCatalog, cleanupStagedFiles, writtenMcpJsonPath, mcpBridge, httpMcp }, _options = {}) {
         const formatForStdin = { streamFormat };
         const stdinHandle = isStdinDrivenFormat(formatForStdin)
             ? wireChildLifecycle({
-                ...(canRegisterRunMessageRelay({ def, mcpBridge }) ? { registerMessageRelay: (relay) => liveRunRelays.set(input.runId, relay) } : {}),
+                ...(canRegisterRunMessageRelay({ def, mcpBridge, ...(httpMcp === undefined ? {} : { httpMcp }) }) ? { registerMessageRelay: (relay) => liveRunRelays.set(input.runId, relay) } : {}),
                 ...childLifecycleOptions({ input, modelCatalog }),
                 runId: input.runId,
                 def,
@@ -933,7 +945,7 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
                 continuation,
                 classifyFailure,
                 bufferedStdoutMaxBytes,
-                expectsJiniBridge: writtenMcpJsonPath !== undefined,
+                expectsJiniBridge: writtenMcpJsonPath !== undefined || httpMcp === true,
                 bridgeProbeEntry: bridgeProbeEntryForRun({ mcpBridge }, {}),
                 probeMcpBridge: options.probeMcpBridge ?? probeMcpBridge,
             })
@@ -1095,6 +1107,7 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
          * `'claude-mcp-json'` mechanism stages a file at all — `'acp-merge'` and `'env-content'` leave
          * nothing on disk, so this stays `undefined` for those.
          */
+        let preparedHttpMcp = null;
         let writtenMcpJsonPath;
         const removeMcpJsonFileFn = mcpJsonInjection?.removeFile ?? defaultRemoveMcpJsonFile;
         /**
@@ -1120,6 +1133,11 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
          */
         let preparedSystemPromptOverlayFile = null;
         const cleanupStagedFiles = async () => {
+            if (preparedHttpMcp) {
+                const http = preparedHttpMcp;
+                preparedHttpMcp = null;
+                await http.cleanup();
+            }
             await cleanupFilesystemTemp({ runId: input.runId }, {});
             if (preparedPromptFile)
                 await preparedPromptFile.cleanup();
@@ -1151,8 +1169,18 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         // resolving here means the per-run bearer credential is minted exactly once no matter which of
         // the five mechanisms ends up carrying it. `null` for an unconfigured host or a def declaring
         // no strategy — see `buildMcpBridgeDelivery`'s doc.
-        const mcpBridge = await resolveMcpBridgeForRun({ input: { runId: input.runId, cwd: input.cwd, def }, deps: { mcpJsonInjection, cleanupStagedFiles, failBeforeSpawn } });
-        const runtimeContext = computeRuntimeContext({ preparedPromptFile: preparedPromptFile, preparedLogFile: preparedLogFile, mcpBridge: mcpBridge }, sessionRuntimeContext(input, {}));
+        try {
+            preparedHttpMcp = await prepareHttpMcpForRun({ runId: input.runId, cwd: input.cwd, def, lifecycle,
+                injection: mcpJsonInjection, inheritUserMcp: input.nativeToolAccess !== false && input.nativeCapabilities?.userMcp !== false });
+        }
+        catch {
+            await cleanupStagedFiles();
+            return failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: 'AgentExecutor: could not stage private HTTP MCP configuration' });
+        }
+        const mcpBridge = preparedHttpMcp ? null : await resolveMcpBridgeForRun({ input: { runId: input.runId, cwd: input.cwd, def }, deps: { mcpJsonInjection, cleanupStagedFiles, failBeforeSpawn } });
+        const baseRuntimeContext = computeRuntimeContext({ preparedPromptFile, preparedLogFile, mcpBridge }, sessionRuntimeContext(input, {}));
+        const runtimeContext = preparedHttpMcp?.mcpJsonPath
+            ? { ...baseRuntimeContext, mcpJsonPath: preparedHttpMcp.mcpJsonPath } : baseRuntimeContext;
         // A `runtimeLock` def's buildArgs mutates process-global state its own CLI reads back at
         // startup, so the mutex must be held from before buildArgs until the spawned child has
         // demonstrably consumed it — see `RuntimeLock`'s own doc for the concrete race. Undefined for
@@ -1195,7 +1223,7 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         // `codex.ts`'s `buildArgs` needs no argv change for this (CODEX_HOME is an env var, not a flag),
         // so — unlike the `.mcp.json` staging above — this can run after `buildArgs` with no ordering
         // constraint of its own; it is placed here only to keep the two staging steps adjacent.
-        preparedCodexHome = await prepareCodexHomeIfNeeded({ input: { runId: input.runId, nativeToolAccess: input.nativeToolAccess, ...nativeCapabilityInput({ input }, {}), def, mcpBridge }, deps: { mcpJsonInjection, hostEnv: input.cliParity ? spawnEnv : hostEnv, releaseStagedResources, failBeforeSpawn } });
+        preparedCodexHome = await prepareCodexHomeIfNeeded({ input: { runId: input.runId, nativeToolAccess: input.nativeToolAccess, ...nativeCapabilityInput({ input }, {}), def, mcpBridge, ...(def.id === 'codex' && preparedHttpMcp ? { httpEndpoint: preparedHttpMcp.endpoint } : {}) }, deps: { mcpJsonInjection, hostEnv: input.cliParity ? spawnEnv : hostEnv, releaseStagedResources, failBeforeSpawn } });
         // Finding 1 of SEC-assistant-env-isolation-2026-09-07's one effect — stage this run's scratch
         // `CLAUDE_CONFIG_DIR` directory. Unconditional for a `claude`-id run (unlike CODEX_HOME above,
         // this does not depend on `mcpJsonInjection` being configured at all — see
@@ -1221,7 +1249,9 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         // `McpBridgeDelivery`'s `'codex-toml'` variant doc for why it cannot be pre-computed the way
         // `'claude-mcp-json'`'s deterministic path is). Nothing between the old, earlier call site and
         // here ever read `childEnv`, so moving the call cost nothing.
-        const childEnv = computeChildEnv({ spawnEnv, mcpBridge }, stagedChildEnvOptions({
+        const httpSpawnEnv = def.id === 'opencode' && preparedHttpMcp
+            ? { ...spawnEnv, OPENCODE_CONFIG_CONTENT: mergeOpenCodeHttpMcpConfig({ existingRaw: spawnEnv.OPENCODE_CONFIG_CONTENT, endpoint: preparedHttpMcp.endpoint }) } : spawnEnv;
+        const childEnv = computeChildEnv({ spawnEnv: httpSpawnEnv, mcpBridge }, stagedChildEnvOptions({
             def, preparedCodexHome, preparedClaudeConfigDir, preparedSystemPromptOverlayFile, systemPromptEnvOverrides,
         }, {}));
         // Post-buildArgs guard for argv-bound defs whose resolved binary is a
@@ -1229,7 +1259,9 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         // budget can still expand past CreateProcess's command-line cap once
         // quote-escaped. Both are no-ops off-Windows / for non-argv-bound defs.
         await guardWindowsCommandLineBudget({ input: { runId: input.runId, def, launchPath: launch.launchPath, args }, deps: { releaseStagedResources, failBeforeSpawn } });
-        const invocation = createCommandInvocationFn({ command: launch.launchPath, args, env: childEnv });
+        const invocation = await prepareRunCommand({ command: launch.launchPath, args, env: childEnv, runId: input.runId }, {
+            createInvocation: createCommandInvocationFn, release: releaseStagedResources, failBeforeSpawn,
+        });
         // Kept a synchronous call (no `await`) on purpose — see `spawnAgentChildProcess`'s own doc for
         // the microtask-timing race this avoids. The error branch's own cleanup/failBeforeSpawn calls are
         // async, which is fine: no child exists yet on that path, so nothing is racing a listener.
@@ -1247,7 +1279,7 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         // grandchild inheriting them can delay arbitrarily). A spawn that never produced a process at
         // all emits no `'exit'`, and is covered instead by `releaseStagedResources` on the reject path.
         child.once('exit', releaseRuntimeLock);
-        const stdinHandle = wireRunInput({ input, def, streamFormat, child, modelCatalog, cleanupStagedFiles, writtenMcpJsonPath, mcpBridge }, {});
+        const stdinHandle = wireRunInput({ input, def, streamFormat, child, modelCatalog, cleanupStagedFiles, writtenMcpJsonPath, mcpBridge, httpMcp: preparedHttpMcp !== null }, {});
         const runId = input.runId;
         try {
             await confirmChildSpawned({ input: { runId: input.runId, def, child }, deps: { releaseStagedResources, failBeforeSpawn } });

package/dist/agent-executor/mcp-bridge.d.ts

@@ -52,7 +52,11 @@ export declare function buildMcpJsonServerEntry({ runId, options }: {
  */
 export declare function mergeMcpJsonContent({ existingRaw, serverEntry }: {
     readonly existingRaw: string | undefined;
-    readonly serverEntry: McpJsonServerEntry;
+    readonly serverEntry: McpJsonServerEntry | {
+        readonly type: 'http';
+        readonly url: string;
+        readonly headers: Readonly<Record<string, string>>;
+    };
 }): string;
 /**
  * Mechanism 2 of 5 — `'acp-merge'`. Re-shapes the same bridge entry into the `mcpServers` element
@@ -107,7 +111,11 @@ export declare function buildAcpMcpBridgeServers({ entry }: {
  */
 export declare function mergeEnvContentMcpConfig({ existingRaw, entry }: {
     readonly existingRaw: string | undefined;
-    readonly entry: McpJsonServerEntry;
+    readonly entry: McpJsonServerEntry | {
+        readonly type: 'remote';
+        readonly url: string;
+        readonly headers: Readonly<Record<string, string>>;
+    };
 }): string;
 /**
  * Merges a staged system-prompt overlay file's path into the `instructions` array of the same

package/dist/agent-executor/mcp-bridge.js

@@ -175,12 +175,12 @@ export function mergeEnvContentMcpConfig({ existingRaw, entry }) {
     const existingMcp = isRecord(doc.mcp) ? doc.mcp : {};
     const mcp = {
         ...existingMcp,
-        [JINI_MCP_SERVER_KEY]: {
+        [JINI_MCP_SERVER_KEY]: 'command' in entry ? {
             type: 'local',
             command: [entry.command, ...entry.args],
             environment: { ...entry.env },
             enabled: true,
-        },
+        } : entry,
     };
     return JSON.stringify({ ...doc, mcp });
 }

package/dist/agent-executor/opencode/mcp-config.d.ts

@@ -0,0 +1,10 @@
+import type { McpHttpEndpoint } from '../contracts.js';
+/** Keep OpenCode's run-local inline carrier and its existing settings/instruction merge owner.
+ * @returns Remote entry replacing stale stdio fields; only the endpoint token is delivered.
+ * @complexity O(config bytes) time/space, without I/O.
+ */
+export declare function mergeOpenCodeHttpMcpConfig({ existingRaw, endpoint }: {
+    existingRaw: string | undefined;
+    endpoint: Pick<McpHttpEndpoint, 'url' | 'token'>;
+}, _options?: {}): string;
+//# sourceMappingURL=mcp-config.d.ts.map

package/dist/agent-executor/opencode/mcp-config.js

@@ -0,0 +1,11 @@
+import { mergeEnvContentMcpConfig } from '../mcp-bridge.js';
+/** Keep OpenCode's run-local inline carrier and its existing settings/instruction merge owner.
+ * @returns Remote entry replacing stale stdio fields; only the endpoint token is delivered.
+ * @complexity O(config bytes) time/space, without I/O.
+ */
+export function mergeOpenCodeHttpMcpConfig({ existingRaw, endpoint }, _options = {}) {
+    return mergeEnvContentMcpConfig({ existingRaw, entry: {
+            type: 'remote', url: endpoint.url, headers: { Authorization: `Bearer ${endpoint.token}` },
+        } });
+}
+//# sourceMappingURL=mcp-config.js.map

package/dist/agent-executor/opencode/tool-calls.d.ts

@@ -0,0 +1,7 @@
+/** OpenCode joins server and tool with an underscore and can emit a completed call after its
+ * bridge result. Preserve the receipt; only its correlation candidate uses the remote name.
+ * A native snake-case tool cannot fold without a matching canonical bridge row. Pure, O(n). */
+export declare function openCodeToolCallReceipt({ event }: {
+    event: Record<string, unknown>;
+}, _options?: {}): Record<string, unknown>;
+//# sourceMappingURL=tool-calls.d.ts.map

package/dist/agent-executor/opencode/tool-calls.js

@@ -0,0 +1,12 @@
+/** OpenCode joins server and tool with an underscore and can emit a completed call after its
+ * bridge result. Preserve the receipt; only its correlation candidate uses the remote name.
+ * A native snake-case tool cannot fold without a matching canonical bridge row. Pure, O(n). */
+export function openCodeToolCallReceipt({ event }, _options = {}) {
+    if (event.type !== 'tool_use' || typeof event.name !== 'string' || event.name.startsWith('mcp__'))
+        return event;
+    const separator = event.name.indexOf('_');
+    if (separator <= 0 || separator === event.name.length - 1)
+        return event;
+    return { ...event, bridgeCall: { name: event.name.slice(separator + 1), input: event.input, buffered: true } };
+}
+//# sourceMappingURL=tool-calls.js.map

package/dist/agent-executor/tool-call-receipts.d.ts

@@ -0,0 +1,7 @@
+/** Select the CLI's receipt dialect once; raw events and tools from other CLIs pass unchanged.
+ * Folding stays in chat's existing shared rule. O(1) construction, O(name length) per receipt. */
+export declare function createCliToolCallReceiver({ kind, onEvent }: {
+    kind: string;
+    onEvent: (event: Record<string, unknown>) => void;
+}, _options?: {}): (event: Record<string, unknown>) => void;
+//# sourceMappingURL=tool-call-receipts.d.ts.map

package/dist/agent-executor/tool-call-receipts.js

@@ -0,0 +1,9 @@
+import { geminiToolCallReceipt } from './gemini/tool-calls.js';
+import { openCodeToolCallReceipt } from './opencode/tool-calls.js';
+/** Select the CLI's receipt dialect once; raw events and tools from other CLIs pass unchanged.
+ * Folding stays in chat's existing shared rule. O(1) construction, O(name length) per receipt. */
+export function createCliToolCallReceiver({ kind, onEvent }, _options = {}) {
+    const adapt = kind === 'legacy-google-stream-json' ? geminiToolCallReceipt : kind === 'opencode' ? openCodeToolCallReceipt : undefined;
+    return event => onEvent(adapt ? adapt({ event }, {}) : event);
+}
+//# sourceMappingURL=tool-call-receipts.js.map

package/dist/core/read-only-tools.d.ts

@@ -77,6 +77,8 @@ export declare function principalIsReadOnlyConstrained({ principal }: {
 /**
  * Hide writes and unclassified tools from a constrained caller's search and schema discovery.
  * Uses the same classification as dispatch; discovery never grants execution authority.
+ * Guidance entries (`targetToolIds`) are shown only when every target is allowed; the catalog is
+ * told the allowed ids so an overview can list just those.
  * @param required - Per-call identity, live descriptors, and the existing catalog owner.
  * @returns A filtered catalog, or the original catalog for an unconstrained caller.
  * @example filterReadOnlyToolCatalog({ principal, registry, catalog });