@jini-ai/daemon 0.6.17 → 0.6.19

package/dist/core/read-only-tools.js

@@ -31,6 +31,8 @@ export function principalIsReadOnlyConstrained({ principal }, _optional = {}) {
 /**
  * Hide writes and unclassified tools from a constrained caller's search and schema discovery.
  * Uses the same classification as dispatch; discovery never grants execution authority.
+ * Guidance entries (`targetToolIds`) are shown only when every target is allowed; the catalog is
+ * told the allowed ids so an overview can list just those.
  * @param required - Per-call identity, live descriptors, and the existing catalog owner.
  * @returns A filtered catalog, or the original catalog for an unconstrained caller.
  * @example filterReadOnlyToolCatalog({ principal, registry, catalog });
@@ -49,13 +51,27 @@ export function filterReadOnlyToolCatalog(required, _optional = {}) {
                 .filter(hit => allowed.has(hit.id)).slice(0, limit)
                 .map(hit => ({ ...hit, ...toolDiscoveryMetadata({ descriptor: allowed.get(hit.id) }) }));
         },
-        describe(input) {
-            const descriptor = allowedTools().get(input.id);
-            const entry = descriptor ? required.catalog.describe(input) : null;
+        describe(input, options = {}) {
+            const allowed = allowedTools();
+            const descriptor = allowed.get(input.id);
+            // A caller may further narrow discovery; read-only attenuation must never widen that set.
+            const visible = new Map([...allowed].filter(([id]) => !options.visibleToolIds || options.visibleToolIds.has(id)));
+            if (!descriptor)
+                return readOnlyGuidance({ entry: required.catalog.describe(input, { visibleToolIds: new Set(visible.keys()) }), allowed: visible });
+            const entry = required.catalog.describe(input, options);
             return entry ? { ...entry, ...toolDiscoveryMetadata({ descriptor }) } : null;
         },
     };
 }
+// An id that is not a registered read-only tool can still name guidance (a retired alias, a
+// namespace overview). Guidance is judged by what it points at, never by its own id; guidance
+// without declared targets cannot be judged, so it stays hidden (fail closed).
+function readOnlyGuidance({ entry, allowed }) {
+    const targets = entry?.targetToolIds;
+    if (!targets || targets.length === 0)
+        return null;
+    return targets.every(id => allowed.has(id)) ? entry : null;
+}
 /** @returns Required host wording for a registered non-read-only tool. */
 export function readOnlyToolRefusalMessage({ toolId, messages }, _optional = {}) {
     return messages.toolRefusalMessage({ toolId });

package/dist/delegated-tool-bridge.js

@@ -64,6 +64,10 @@ export { serializeDelegatedToolOutput, resultContent } from './tool-result-media
 function linkCancellation({ lifecycle, runId }, { signal }) {
     const controller = new AbortController();
     const unsubscribeCancel = lifecycle.onCancelRequested({ runId: runId, listener: () => controller.abort() });
+    const terminalWatch = new AbortController();
+    // A CLI can time out/exit without requesting cancellation. Its unanswered cards must stop
+    // holding the daemon busy, while the exchange owner retains their safe restoration handle.
+    void lifecycle.waitForTerminal({ runId }, { signal: terminalWatch.signal }).then(() => controller.abort(), () => { });
     const abortFromTransport = () => controller.abort();
     if (signal?.aborted)
         controller.abort();
@@ -73,6 +77,7 @@ function linkCancellation({ lifecycle, runId }, { signal }) {
         controller,
         dispose: () => {
             unsubscribeCancel();
+            terminalWatch.abort();
             signal?.removeEventListener('abort', abortFromTransport);
         },
     };
@@ -209,7 +214,7 @@ export function createDelegatedToolBridge(requiredArgs, optionalArgs = {}) {
         const call = { lifecycle, runId, toolUseId, ...(options.delegatedResultCorrelation ? { delegatedResultCorrelation: options.delegatedResultCorrelation } : {}) };
         await lifecycle.emit({ runId: runId, input: {
                 event: 'agent',
-                data: { type: 'tool_use', id: toolUseId, name: toolId, input },
+                data: { type: 'tool_use', id: toolUseId, name: toolId, input, ...{ toolOrigin: 'bridge' } },
             } });
         const cancellation = linkCancellation(call, invocation);
         const seam = createSurfaceSeam(call);

package/dist/http/attachments.d.ts

@@ -1,104 +1,3 @@
-/**
- * @module attachments
- *
- * `POST /api/attachments`, `DELETE /api/attachments` — an HTTP route pack for user file/image
- * uploads staged for one agent run, over a narrow, transport-owned `AttachmentStore` port plus a
- * batteries-included disk implementation (`createDiskAttachmentStore`).
- *
- * **The capability this closes.** A chat composer that accepts drag-and-drop needs somewhere to put
- * the bytes, a way to hand the agent a path it is actually allowed to read, and a guarantee that
- * those bytes disappear when the run ends. That is three separate concerns (an upload endpoint, a
- * trusted-metadata registry, and a run-scoped lifetime) which every host would otherwise hand-roll.
- * This module owns all three; `@jini-ai/chat-react`'s `createDaemonAttachmentUploader` is the
- * matching client half.
- *
- * **Trust model.** A renderer supplies bytes, a filename, and a batch id. None of that is trusted:
- * - the filename is reduced to a basename over a conservative character allowlist
- *   (`sanitizeAttachmentName`) and is only ever used as *display* text plus a short extension
- *   suffix — never as the stored filename, which is a fresh `randomUUID()`;
- * - the `kind` (`'image' | 'file'`) is sniffed from the leading bytes (`detectAttachmentKind`),
- *   never taken from a renderer-controlled MIME type or file extension;
- * - the byte count is measured while streaming, never read from a client-supplied length;
- * - the returned `path` is an opaque `attachment:<uuid>` capability id, not a filesystem path, so a
- *   renderer never learns where the upload root is and cannot name a file it did not upload.
- *   `claim()` is what exchanges those ids for real paths, server-side.
- *
- * **What `claim()` guarantees.** Exactly once per registered attachment, and only if the file is
- * still the same file: `lstat` must report a regular non-symlink whose `dev`/`ino`/`size` and
- * recorded modification/change timestamps match, and `realpath` must equal the recorded path
- * (so neither the file nor any parent directory was swapped for a symlink between upload and run
- * start). Legacy sidecars establish their timestamp baseline on first verified read. Every
- * claimed attachment must belong to one batch, so the single `batchDirectory` a host grants the
- * agent read access to cannot be widened by mixing batches.
- *
- * **Ownership is opt-in and host-attached, not self-asserted.** `register()`'s optional `ownerId`
- * (and `listPendingForOwner`, the discovery method it enables) is never read from anything a
- * renderer sends — a host wires `AttachmentsHttpDeps.resolveOwnerId` to pull it from a channel IT
- * already trusts (its own session-verified principal header, say), never from `req` unauthenticated.
- * A store with no `resolveOwnerId` wired registers every attachment ownerless, and
- * `listPendingForOwner` never returns an ownerless record for any caller — see that method's own doc
- * for why an absent `ownerId` must never become a wildcard match.
- *
- * **Storage lifetime is daemon-lifetime by default, and opt-in restart-surviving.** With
- * `retainAcrossRestarts` left off (the default, and this pack's only behavior before that option
- * existed), `createDiskAttachmentStore` empties its upload directory on construction: files left
- * behind by an interrupted previous process cannot be authenticated against an in-memory registry
- * that no longer exists, so they are removed rather than adopted. Unclaimed uploads also expire by
- * TTL (`pruneExpired`), and a run's claimed files are deleted by `cleanupRun`.
- *
- * That default is wrong for any host whose process restarts while a person is still using the
- * composer. A file-watching dev server restarting the daemon on an unrelated source edit is not a
- * crash, but the construction wipe cannot tell the two apart, so it destroys uploads the user is
- * about to send — real data loss, not a tidy-up. `retainAcrossRestarts: true` replaces "wipe
- * everything, always" with "adopt exactly what can still be authenticated": see
- * {@link prepareAttachmentStorage} for the whole mechanism and {@link loadPersistedAttachments} for
- * why an adopted record is no less trusted than one this process registered itself.
- *
- * **This pack does not auto-wire itself into a run's lifecycle**, because no generic hook for that
- * exists — the same deliberate choice `@jini-ai/daemon`'s `createRunScopedContextStore` makes. A
- * host claims in its own `onRunStarted` and cleans up in a `finally`, roughly:
- *
- * ```ts
- * const store = await createDiskAttachmentStore({ uploadDirectory });
- * // ... httpExtensions: [(app, { adapter }) => registerAttachmentRoutes({ app, deps: { store }, adapter })]
- * onRunStarted: (context) => {
- *   void (async () => {
- *     try {
- *       const claimed = await store.claim({ attachments: attachmentRefsFrom(context.request), runId: context.run.id });
- *       await executor.run({
- *         runId: context.run.id,
- *         // ... prompt, cwd, agentId
- *       }, {
- *         ...(claimed.batchDirectory === undefined ? {} : {
- *           imagePaths: claimed.attachments.filter((a) => a.kind === 'image').map((a) => a.path),
- *           extraAllowedDirs: [claimed.batchDirectory],
- *           uploadRoot: claimed.batchDirectory,
- *         }),
- *       });
- *     } finally {
- *       await store.cleanupRun({ runId: context.run.id });
- *     }
- *   })();
- * }
- * ```
- *
- * `imagePaths`/`extraAllowedDirs`/`uploadRoot` are pre-existing `AgentExecutor.run()` options; this
- * module only produces real values for them.
- *
- * **Body-parser ordering (`POST` reads the raw request stream).** The upload route streams
- * `request` straight to disk, so any body-parsing middleware that has already consumed the stream
- * leaves nothing to write. The classic way to hit this is a JSON body parser mounted app-wide: a
- * user drops a `.json` file, the browser sets `content-type: application/json`, and
- * `express.json()` eats the body — which without a guard shows up as the deeply unhelpful
- * "attachment is empty". `registerAttachmentRoutes` detects an already-consumed stream up front and
- * reports it as a host misconfiguration (`'attachment-body-consumed'`) instead of failing silently.
- * Mount this pack before any global body parser, or scope the parser so it skips this path.
- *
- * **SEC-005 redaction**: a store failure can carry filesystem paths a caller must not see, so
- * anything that is not an explicitly-classified `AttachmentRejectedError` becomes a
- * correlation-id-bearing generic `INTERNAL_ERROR`, with the real error reaching a host-owned sink —
- * the same `reportInternalError` shape `media.ts`/`delegated-tools.ts` use.
- */
 import { type FileHandle } from 'node:fs/promises';
 import type { Express, Request, Response } from 'express';
 import type { AdapterContext } from '@jini-ai/http-kit';
@@ -688,6 +587,8 @@ export interface AttachmentsInternalErrorContext {
 }
 export interface AttachmentsHttpDeps {
     readonly store: AttachmentStore;
+    /** Host busy lease follows handler completion, including cleanup after an aborted response. */
+    readonly acquireActivity?: () => () => void;
     /**
      * Uploads accepted at once before further requests are rate-limited. Bounds concurrent
      * filesystem work, which matters because each in-flight upload holds an open handle and may be

package/dist/http/attachments.js

@@ -99,6 +99,8 @@
  * correlation-id-bearing generic `INTERNAL_ERROR`, with the real error reaching a host-owned sink —
  * the same `reportInternalError` shape `media.ts`/`delegated-tools.ts` use.
  */
+import { inspect } from 'node:util';
+import { redactSecrets } from '@jini-ai/core';
 import { chmod, copyFile, lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rm, rmdir } from 'node:fs/promises';
 import { randomUUID } from 'node:crypto';
 import { basename, dirname, extname, resolve } from 'node:path';
@@ -971,7 +973,7 @@ export async function createDiskAttachmentStore(requiredArgs, optionalArgs = {})
 export const ATTACHMENTS_ROUTE_PATH = '/api/attachments';
 function defaultInternalErrorSink(context) {
     // eslint-disable-next-line no-console
-    console.error(`[@jini-ai/http-kit] internal error (${context.source}, correlationId=${context.correlationId})`, context.error);
+    console.error(`[@jini-ai/http-kit] internal error (${context.source}, correlationId=${context.correlationId})`, redactSecrets({ input: inspect(context.error) }, { redactPii: false }));
 }
 function reportInternalError(deps, source, error, batchId) {
     const correlationId = randomUUID();
@@ -1135,7 +1137,9 @@ export function registerAttachmentRoutes({ app, deps, adapter }, _optional = {})
     // second host) must not share one upload budget.
     const state = { activeUploads: 0 };
     app.post(ATTACHMENTS_ROUTE_PATH, async (req, res) => {
+        let release;
         try {
+            release = deps.acquireActivity?.();
             if (!passesOriginGuard(req, res, deps, adapter))
                 return;
             await handleAttachmentUpload({ req, res, deps, state });
@@ -1151,9 +1155,14 @@ export function registerAttachmentRoutes({ app, deps, adapter }, _optional = {})
             if (!res.headersSent)
                 respondToUploadFailure(res, deps, error, null, 'attachment-upload');
         }
+        finally {
+            release?.();
+        }
     });
     app.delete(ATTACHMENTS_ROUTE_PATH, async (req, res) => {
+        let release;
         try {
+            release = deps.acquireActivity?.();
             if (!passesOriginGuard(req, res, deps, adapter))
                 return;
             await handleAttachmentCleanup({ req, res, deps });
@@ -1162,6 +1171,9 @@ export function registerAttachmentRoutes({ app, deps, adapter }, _optional = {})
             if (!res.headersSent)
                 sendApiError({ res, status: 500, error: reportInternalError(deps, 'attachment-cleanup', error, null) });
         }
+        finally {
+            release?.();
+        }
     });
 }
 //# sourceMappingURL=attachments.js.map

package/dist/http/connectors.js

@@ -44,6 +44,8 @@
  *   to the provider.
  * - `RealtimeProvider.subscribe` has no route here — see the realtime section below for why.
  */
+import { inspect } from 'node:util';
+import { redactSecrets } from '@jini-ai/core';
 import { randomUUID } from 'node:crypto';
 import { createApiError } from '@jini-ai/protocol';
 import { ClientFacingError, defineJsonRoute, mountJsonRoute } from '@jini-ai/http-kit';
@@ -53,7 +55,7 @@ import { err, ok } from '@jini-ai/http-kit';
 const BODY_NOT_OBJECT_MESSAGE = 'body must be a JSON object';
 function defaultInternalErrorSink(context) {
     // eslint-disable-next-line no-console
-    console.error(`[@jini-ai/http-kit] internal error (connectors/${context.source}.${context.operation}, correlationId=${context.correlationId})`, context.error);
+    console.error(`[@jini-ai/http-kit] internal error (connectors/${context.source}.${context.operation}, correlationId=${context.correlationId})`, redactSecrets({ input: inspect(context.error) }, { redactPii: false }));
 }
 function notConfiguredError(capability) {
     return createApiError({ code: 'NOT_CONFIGURED', message: `${capability} provider not configured` });

package/dist/http/db-ops.js

@@ -36,6 +36,8 @@
  * boundary — see {@link denyAllDaemonDbPolicy}'s doc for why the default
  * policy denies every call rather than allowing one.
  */
+import { inspect } from 'node:util';
+import { redactSecrets } from '@jini-ai/core';
 import { randomUUID } from 'node:crypto';
 import { createApiError } from '@jini-ai/protocol';
 import { defineJsonRoute, mountJsonRoute } from '@jini-ai/http-kit';
@@ -116,7 +118,7 @@ export function createDaemonDbToolRegistrations(requiredArgs, optionalArgs = {})
 }
 function defaultDaemonDbInternalErrorSink(context) {
     // eslint-disable-next-line no-console
-    console.error(`[@jini-ai/http-kit] internal error (${context.source}, correlationId=${context.correlationId})`, context.error);
+    console.error(`[@jini-ai/http-kit] internal error (${context.source}, correlationId=${context.correlationId})`, redactSecrets({ input: inspect(context.error) }, { redactPii: false }));
 }
 /** Every DB-ops call gets its own opaque, single-use `RunRef` — these are one-off operations requests, not steps of a longer-lived agent run, so there is no real run to attach the audit trail to. */
 function freshRun() {

package/dist/http/delegated-tools.d.ts

@@ -70,7 +70,7 @@ export interface DelegatedToolsHttpDeps {
      * call it cannot verify is refused outright (the configured refusal message), never
      * waived. Unconstrained calls behave identically with or without it.
      */
-    readonly toolRegistry?: ToolRegistry;
+    readonly toolRegistry?: Pick<ToolRegistry, 'list'>;
     /**
      * Host opt-in: returns `true` for a `failed` result whose `error` text the HOST has already made
      * safe to show the model — secret values blanked, an error id minted — so this route answers it

package/dist/http/delegated-tools.js

@@ -1,3 +1,4 @@
+import { inspect } from 'node:util';
 /**
  * @module delegated-tools
  *
@@ -27,7 +28,7 @@
  */
 import { randomUUID } from 'node:crypto';
 import { createApiError } from '@jini-ai/protocol';
-import { batchOutcomeFor, ToolInputError } from '@jini-ai/core';
+import { redactSecrets, batchOutcomeFor, ToolInputError } from '@jini-ai/core';
 import { createDelegatedToolBridge } from '../index.js';
 import { defineJsonRoute, err, mountJsonRoute, ok, validationError } from '@jini-ai/http-kit';
 import * as readOnlyTools from '../core/read-only-tools.js';
@@ -44,8 +45,9 @@ function checkReadOnlyConstraint(deps, input) {
 }
 /** Logs the real failure server-side and returns the generic, correlation-id-bearing public error (SEC-005: never the raw exception). */
 function defaultInternalErrorSink(context) {
+    // Exceptions can echo credentials; inspect preserves stacks and codes before shared redaction.
     // eslint-disable-next-line no-console
-    console.error(`[@jini-ai/http-kit] internal error (${context.source}, correlationId=${context.correlationId})`, context.error);
+    console.error(`[@jini-ai/http-kit] internal error (${context.source}, correlationId=${context.correlationId})`, redactSecrets({ input: inspect(context.error) }, { redactPii: false }));
 }
 /**
  * The host's {@link DelegatedToolsHttpDeps.describeInternalError} text for `context`, or `undefined`
@@ -62,7 +64,7 @@ function describeSafely(deps, context) {
     }
     catch (error) {
         // eslint-disable-next-line no-console
-        console.error(`[@jini-ai/http-kit] describeInternalError threw (correlationId=${context.correlationId})`, error);
+        console.error(`[@jini-ai/http-kit] describeInternalError threw (correlationId=${context.correlationId})`, redactSecrets({ input: inspect(error) }, { redactPii: false }));
         return undefined;
     }
 }

package/dist/http/frontend-control.d.ts

@@ -1,39 +1,3 @@
-/**
- * @module frontend-control
- *
- * Assembles the three halves of agent-driven frontend control into one thing a host can wire up as
- * a config entry rather than a checklist.
- *
- * The parts already existed and none of them composed: `@jini-ai/daemon`'s `FrontendSessionRegistry`
- * addresses a run to a surface, this package's own frontend-session routes carry invocations to a
- * browser and answers back, and `createFrontendCapabilityRegistrations` projects a manifest into
- * gated tools. A host had to construct all three, keep them consistent, and remember to bind a run
- * when it started. Every one of those is a chance to get it subtly wrong, and one of them —
- * binding — is a security decision.
- *
- * **Moved here from `@jini-ai/server` (2026-07-31).** It never needed that package: its real
- * dependencies are `core`, `daemon`, `express` and this module's own siblings, all of which
- * `http-kit` already has. The only thing pinning it there was a *type-only* import of
- * `LocalNodeHttpExtension` — so a helper any Express host could use sat behind a package that also
- * pulls in `@jini-ai/sidecar` and `better-sqlite3`. The reference implementation hit exactly this
- * and hand-reimplemented the composition instead. `@jini-ai/server` re-exports it, so existing
- * imports keep working.
- *
- * **This facade never returns the registry**, and that is its most important property. The
- * registry's `invoke` executes a capability on a real user's screen with no policy check, no
- * confirmation, no timeout, and no audit record — it is safe only because the sole thing that can
- * reach it is a `ToolHandler` that `ToolExecutor` already gated. Handing a host the registry so it
- * could "wire something custom" would hand it a bypass, and a bypass that exists gets used. The
- * host gets an HTTP extension, a set of registrations, and a bind hook; none of them can execute a
- * capability directly.
- *
- * **The bind token is not a field on the run DTO.** A run is a neutral kernel noun and a browser
- * surface is not; putting `frontendBindToken` on `RunCreateRequest` would push a browser concept
- * into a protocol every consumer shares, to serve one transport. Instead the host supplies
- * {@link CreateFrontendControlOptions.resolveBindToken}, which reads the token out of whatever
- * envelope that host already uses — `contextRef` is an opaque host blob precisely so hosts can put
- * their own metadata in it. The engine stays neutral and the host keeps one place to look.
- */
 import type { Express } from 'express';
 import type { FrontendSessionOwner } from '../frontend-session-registry.js';
 import type { FrontendSessionsHttpDeps } from './frontend-sessions.js';

package/dist/http/frontend-control.js

@@ -1,8 +1,46 @@
+/**
+ * @module frontend-control
+ *
+ * Assembles the three halves of agent-driven frontend control into one thing a host can wire up as
+ * a config entry rather than a checklist.
+ *
+ * The parts already existed and none of them composed: `@jini-ai/daemon`'s `FrontendSessionRegistry`
+ * addresses a run to a surface, this package's own frontend-session routes carry invocations to a
+ * browser and answers back, and `createFrontendCapabilityRegistrations` projects a manifest into
+ * gated tools. A host had to construct all three, keep them consistent, and remember to bind a run
+ * when it started. Every one of those is a chance to get it subtly wrong, and one of them —
+ * binding — is a security decision.
+ *
+ * **Moved here from `@jini-ai/server` (2026-07-31).** It never needed that package: its real
+ * dependencies are `core`, `daemon`, `express` and this module's own siblings, all of which
+ * `http-kit` already has. The only thing pinning it there was a *type-only* import of
+ * `LocalNodeHttpExtension` — so a helper any Express host could use sat behind a package that also
+ * pulls in `@jini-ai/sidecar` and `better-sqlite3`. The reference implementation hit exactly this
+ * and hand-reimplemented the composition instead. `@jini-ai/server` re-exports it, so existing
+ * imports keep working.
+ *
+ * **This facade never returns the registry**, and that is its most important property. The
+ * registry's `invoke` executes a capability on a real user's screen with no policy check, no
+ * confirmation, no timeout, and no audit record — it is safe only because the sole thing that can
+ * reach it is a `ToolHandler` that `ToolExecutor` already gated. Handing a host the registry so it
+ * could "wire something custom" would hand it a bypass, and a bypass that exists gets used. The
+ * host gets an HTTP extension, a set of registrations, and a bind hook; none of them can execute a
+ * capability directly.
+ *
+ * **The bind token is not a field on the run DTO.** A run is a neutral kernel noun and a browser
+ * surface is not; putting `frontendBindToken` on `RunCreateRequest` would push a browser concept
+ * into a protocol every consumer shares, to serve one transport. Instead the host supplies
+ * {@link CreateFrontendControlOptions.resolveBindToken}, which reads the token out of whatever
+ * envelope that host already uses — `contextRef` is an opaque host blob precisely so hosts can put
+ * their own metadata in it. The engine stays neutral and the host keeps one place to look.
+ */
+import { inspect } from 'node:util';
+import { redactSecrets } from '@jini-ai/core';
 import { createFrontendCapabilityRegistrations, createFrontendSessionRegistry, } from '../index.js';
 import { registerFrontendSessionRoutes } from './frontend-sessions.js';
 function defaultBindErrorSink(context) {
     // eslint-disable-next-line no-console
-    console.error(`[@jini-ai/server] could not bind run "${context.runId}" to a frontend surface`, context.error);
+    console.error(`[@jini-ai/server] could not bind run "${context.runId}" to a frontend surface`, redactSecrets({ input: inspect(context.error) }, { redactPii: false }));
 }
 /**
  * Builds the frontend-control bundle.

package/dist/http/frontend-sessions.js

@@ -28,6 +28,8 @@
  * composition root can make (it is the thing that starts runs), so it calls `registry.bindRun`
  * directly — see `@jini-ai/daemon`'s own module doc for why attach and bind are separate.
  */
+import { inspect } from 'node:util';
+import { redactSecrets } from '@jini-ai/core';
 import { randomUUID } from 'node:crypto';
 import { createApiError } from '@jini-ai/protocol';
 import { FrontendSessionCapacityError } from '../frontend-session-registry.js';
@@ -45,12 +47,12 @@ function reportInternalError(deps, source, error) {
             deps.onInternalError({ source, error });
         // eslint-disable-next-line no-console
         else
-            console.error(`[@jini-ai/http-kit] internal error (frontend-sessions:${source})`, error);
+            console.error(`[@jini-ai/http-kit] internal error (frontend-sessions:${source})`, redactSecrets({ input: inspect(error) }, { redactPii: false }));
     }
     catch (sinkError) {
         // A diagnostic sink must never turn a contained failure into an unhandled rejection of its own.
         // eslint-disable-next-line no-console
-        console.error(`[@jini-ai/http-kit] internal error sink failed (frontend-sessions:${source})`, sinkError);
+        console.error(`[@jini-ai/http-kit] internal error sink failed (frontend-sessions:${source})`, redactSecrets({ input: inspect(sinkError) }, { redactPii: false }));
     }
 }
 /**

package/dist/http/index.d.ts

@@ -21,7 +21,7 @@ export type { RoutineDeleteResponse, RoutineHttpDeps, RoutineListResponse, Routi
 export { registerRoutineRoutes, routineCreateRoute, routineDeleteRoute, routineGetRoute, routineListRoute, routineRunNowRoute, routineRunsListRoute, routineUpdateRoute, } from './routines.js';
 export type { CreateDaemonDbToolRegistrationsOptions, DaemonDbHttpDeps, DaemonDbInternalErrorContext, DaemonDbOperations, DaemonDbStatusReport, DaemonDbTableInfo, DaemonDbToolRegistrations, DaemonDbVacuumResult, DbIntegrityIssue, DbIntegrityIssueKind, DbIntegrityReport, } from './db-ops.js';
 export { createDaemonDbToolRegistrations, daemonDbInspectRoute, daemonDbVacuumRoute, daemonDbVerifyRoute, DB_INSPECT_TOOL_ID, DB_VACUUM_TOOL_ID, DB_VERIFY_TOOL_ID, denyAllDaemonDbPolicy, registerDaemonDbRoutes, } from './db-ops.js';
-export type { ToolCatalogEntry, ToolCatalogHttpDeps, ToolCatalogQuery, ToolCatalogSearchHit, } from './tool-catalog.js';
+export type { ToolCatalogEntry, ToolCatalogDescribeOptions, ToolCatalogHttpDeps, ToolCatalogQuery, ToolCatalogSearchHit, } from './tool-catalog.js';
 export { registerToolCatalogRoutes, toolCatalogDescribeRoute, toolCatalogSearchRoute, } from './tool-catalog.js';
 export type { ComponentCatalogEntry, ComponentCatalogHttpDeps, ComponentCatalogQuery, ComponentCatalogSearchHit, } from './component-catalog.js';
 export { registerComponentCatalogRoutes, componentCatalogDescribeRoute, componentCatalogSearchRoute, } from './component-catalog.js';
@@ -58,4 +58,5 @@ export type { RemoteAttachmentLookupOptional, RemoteAttachmentLookupRequired } f
 export { createRemoteAttachmentLookup } from '../remote-attachment-lookup.js';
 export { createTavilyResearchProvider } from './research-tavily.adapter.js';
 export { createFrontendGuestScope } from './frontend-guest-scope.js';
+export { tryRestoreSurface } from './surface-restoration.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/http/index.js

@@ -31,4 +31,5 @@ export { ATTACHMENT_LOOKUP_ROUTE_PATH, registerAttachmentLookupRoutes } from './
 export { createRemoteAttachmentLookup } from '../remote-attachment-lookup.js';
 export { createTavilyResearchProvider } from './research-tavily.adapter.js';
 export { createFrontendGuestScope } from './frontend-guest-scope.js';
+export { tryRestoreSurface } from './surface-restoration.js';
 //# sourceMappingURL=index.js.map

package/dist/http/media.js

@@ -39,6 +39,8 @@
  * itself can throw before ever creating a task — an unregistered `toolId`-shaped programming
  * error, per `MediaDispatchEngine.generate`'s own contract).
  */
+import { inspect } from 'node:util';
+import { redactSecrets } from '@jini-ai/core';
 import { randomUUID } from 'node:crypto';
 import { createApiError } from '@jini-ai/protocol';
 import { defineJsonRoute, mountJsonRoute } from '@jini-ai/http-kit';
@@ -49,7 +51,7 @@ const AUDIO_KINDS = new Set(['music', 'speech', 'sfx']);
 const SPEECH_FORMATS = new Set(['mp3', 'wav', 'flac', 'aac', 'opus']);
 function defaultInternalErrorSink(context) {
     // eslint-disable-next-line no-console
-    console.error(`[@jini-ai/http-kit] internal error (${context.source}, correlationId=${context.correlationId})`, context.error);
+    console.error(`[@jini-ai/http-kit] internal error (${context.source}, correlationId=${context.correlationId})`, redactSecrets({ input: inspect(context.error) }, { redactPii: false }));
 }
 function reportInternalError(deps, source, error, taskId, ownerRef) {
     const correlationId = randomUUID();

package/dist/http/model-proxy.js

@@ -81,6 +81,8 @@
  * over routing for the five providers that already have a dedicated, more
  * specifically-typed path.
  */
+import { inspect } from 'node:util';
+import { redactSecrets } from '@jini-ai/core';
 import { randomUUID } from 'node:crypto';
 import { runAnthropicToolTurn, runAzureToolTurn, runGoogleToolTurn, runOllamaToolTurn, runOpenAiToolTurn, } from '@jini-ai/agent-runtime';
 import { createApiError } from '@jini-ai/protocol';
@@ -92,7 +94,7 @@ import { err, ok } from '@jini-ai/http-kit';
 import { firstOptionalFieldError, isArray, isNumber, isRecord, isString, nonEmptyString, pickDefined, requiredFieldError, } from './model-proxy-fields.js';
 function defaultInternalErrorSink(context) {
     // eslint-disable-next-line no-console
-    console.error(`[@jini-ai/http-kit] internal error (model-proxy/${context.provider}, correlationId=${context.correlationId})`, context.error);
+    console.error(`[@jini-ai/http-kit] internal error (model-proxy/${context.provider}, correlationId=${context.correlationId})`, redactSecrets({ input: inspect(context.error) }, { redactPii: false }));
 }
 const TOOLS_CHECK = ['tools', isArray, 'tools must be an array when provided'];
 const SYSTEM_CHECK = ['system', isString, 'system must be a string when provided'];
@@ -382,7 +384,7 @@ function reportCatchAllError(providerParam, onInternalError, error) {
     }
     else {
         // eslint-disable-next-line no-console
-        console.error(`[@jini-ai/http-kit] internal error (model-proxy/${providerParam || 'unknown'}, correlationId=${correlationId})`, error);
+        console.error(`[@jini-ai/http-kit] internal error (model-proxy/${providerParam || 'unknown'}, correlationId=${correlationId})`, redactSecrets({ input: inspect(error) }, { redactPii: false }));
     }
     return correlationId;
 }

package/dist/http/remote-run-events.js

@@ -22,6 +22,8 @@
  * would also present, and this route grants direct run-event-injection, a materially different
  * capability from what the general API token was designed to gate.
  */
+import { inspect } from 'node:util';
+import { redactSecrets } from '@jini-ai/core';
 import { randomUUID } from 'node:crypto';
 import { createApiError, isTerminalRunState } from '@jini-ai/protocol';
 import { defineJsonRoute, mountJsonRoute } from '@jini-ai/http-kit';
@@ -31,7 +33,7 @@ import { sendApiError, statusForError } from '@jini-ai/http-kit';
 import { err, ok } from '@jini-ai/http-kit';
 function defaultInternalErrorSink(context) {
     // eslint-disable-next-line no-console
-    console.error(`[@jini-ai/http-kit] internal error (remote-run-events/${context.source}, correlationId=${context.correlationId})`, context.error);
+    console.error(`[@jini-ai/http-kit] internal error (remote-run-events/${context.source}, correlationId=${context.correlationId})`, redactSecrets({ input: inspect(context.error) }, { redactPii: false }));
 }
 const DEFAULT_TOKEN_ENV_VAR = 'JINI_REMOTE_TOOL_BRIDGE_TOKEN';
 /**

package/dist/http/research.js

@@ -1,4 +1,3 @@
-import { redactSecrets } from '@jini-ai/core';
 /**
  * @module research
  *
@@ -95,6 +94,8 @@ import { redactSecrets } from '@jini-ai/core';
  * token out of any upstream error text before it is even logged, belt-and-braces alongside the
  * generic-message substitution.
  */
+import { inspect } from 'node:util';
+import { redactSecrets } from '@jini-ai/core';
 import { randomUUID } from 'node:crypto';
 import { createTavilyResearchProvider } from './research-tavily.adapter.js';
 import { createApiError } from '@jini-ai/protocol';
@@ -103,7 +104,7 @@ import { defineJsonRoute, err, mountJsonRoute, ok, validationError } from '@jini
 const MAX_QUERY_LENGTH = 1000;
 function defaultInternalErrorSink(context) {
     // eslint-disable-next-line no-console
-    console.error(`[@jini-ai/http-kit] internal error (research/search, correlationId=${context.correlationId})`, context.error);
+    console.error(`[@jini-ai/http-kit] internal error (research/search, correlationId=${context.correlationId})`, redactSecrets({ input: inspect(context.error) }, { redactPii: false }));
 }
 /**
  * Default `ResearchHttpDeps.resolveCredentials`: reads `TAVILY_API_KEY` from the environment.

package/dist/http/runs.js

@@ -3,13 +3,15 @@
  * agent, tool, or product vocabulary: a host optionally supplies `onStarted`
  * to attach its chosen driver after the lifecycle has durably recorded start.
  */
+import { inspect } from 'node:util';
+import { redactSecrets } from '@jini-ai/core';
 import { randomUUID } from 'node:crypto';
 import { createApiError } from '@jini-ai/protocol';
 import { createSseChannel, defineJsonRoute, err, mountJsonRoute, ok, requestedAfterCursor, sendApiError, sendRawApiError, validationError, } from '@jini-ai/http-kit';
 /** Default sink when a host does not supply `onInternalError`: still observable, never silent. */
 function defaultInternalErrorSink(context) {
     // eslint-disable-next-line no-console
-    console.error(`[@jini-ai/http-kit] internal error (${context.source}, correlationId=${context.correlationId})`, context.error);
+    console.error(`[@jini-ai/http-kit] internal error (${context.source}, correlationId=${context.correlationId})`, redactSecrets({ input: inspect(context.error) }, { redactPii: false }));
 }
 /**
  * Logs the real failure server-side and returns the generic, correlation-id-bearing public error

package/dist/http/surface-restoration.d.ts

@@ -0,0 +1,17 @@
+import type { Response } from 'express';
+import type { SurfaceExchangeStore } from '@jini-ai/core';
+/** Stream a restored card through the existing authenticated callback route. Only the exchange
+ * handle is accepted: tool identity, principal and original arguments come from the shared store.
+ * Returns false without writing a response when another process may own the exchange.
+ * @complexity O(emitted bytes); no answer or credential is retained by this adapter.
+ */
+export declare function tryRestoreSurface({ res, store, exchangeId, principalId, toolId }: {
+    res: Response;
+    store: SurfaceExchangeStore;
+    exchangeId: string;
+    principalId: string;
+    toolId: string;
+}, { params }?: {
+    params?: Record<string, unknown>;
+}): Promise<boolean>;
+//# sourceMappingURL=surface-restoration.d.ts.map

package/dist/http/surface-restoration.js

@@ -0,0 +1,50 @@
+/** Stream a restored card through the existing authenticated callback route. Only the exchange
+ * handle is accepted: tool identity, principal and original arguments come from the shared store.
+ * Returns false without writing a response when another process may own the exchange.
+ * @complexity O(emitted bytes); no answer or credential is retained by this adapter.
+ */
+export async function tryRestoreSurface({ res, store, exchangeId, principalId, toolId }, { params } = {}) {
+    if (!store.restore)
+        return false;
+    const controller = new AbortController();
+    const onClose = () => { if (!res.writableFinished)
+        controller.abort(); };
+    res.on('close', onClose);
+    const write = (value) => {
+        if (res.destroyed)
+            return;
+        if (!res.headersSent)
+            res.status(200).set({ 'content-type': 'application/x-ndjson', 'cache-control': 'no-store' });
+        res.write(`${JSON.stringify(value)}\n`);
+    };
+    // The first card frame opens the response. Subsequent heartbeats keep Node fetch's idle-body
+    // limit from expiring a legitimate human wait at the proxy hop.
+    const heartbeat = setInterval(() => { if (res.headersSent)
+        write({ type: 'keepalive' }); }, 15_000);
+    heartbeat.unref();
+    try {
+        const result = await store.restore({ exchangeId, principalId, emit: async (emission) => {
+                write({ type: 'surface', emission });
+            } }, { toolId, signal: controller.signal, ...(params === undefined ? {} : { params }) });
+        if (!result.ok && result.reason === 'unknown-or-closed' && !res.headersSent)
+            return false;
+        if (!result.ok && !res.headersSent) {
+            res.status(409).json({ code: 'SURFACE_NOT_PENDING', reason: result.reason });
+            return true;
+        }
+        write({ type: 'restored', ...result });
+        res.end();
+        return true;
+    }
+    catch {
+        // Failure messages may contain host or credential details. Restoration never reports them.
+        write({ type: 'restored', ok: false });
+        res.end();
+        return true;
+    }
+    finally {
+        clearInterval(heartbeat);
+        res.off('close', onClose);
+    }
+}
+//# sourceMappingURL=surface-restoration.js.map