@jini-ai/daemon 0.6.17 → 0.6.22

package/CHANGELOG.md

@@ -1,3 +1,13 @@
+## 0.6.22
+
+- Child stdout can be framed and sanitized line by line before parsing. A timed-out or cancelled delegated tool can report host-loaded recovery facts through `recoverInterruptedTool`, with no retry.
+
+## 0.6.19
+
+- `DelegatedToolsHttpDeps.toolRegistry` takes a list-only registry view (`Pick<ToolRegistry, 'list'>`): the route only reads descriptors, and hosts pass descriptor-only facades.
+- Redact exception logs with the shared core redactor while preserving correlation IDs and error codes.
+- Redact host-supplied paths and payload names in the default migration logger; preserve bind-error callback object assertions.
+
 ## 0.6.17
 
 ### Patch Changes

package/dist/agent-executor/claude/mcp-config.d.ts

@@ -0,0 +1,17 @@
+import type { McpHttpEndpoint, McpJsonInjectionOptions } from '../contracts.js';
+/** Stage Claude's HTTP capability outside the project; only this private path enters argv.
+ * @returns A private config path and removal of only its owned directory.
+ * @throws Filesystem staging errors after removing partial output.
+ * @complexity O(config bytes), one project read and one private config write.
+ */
+export declare function prepareClaudeHttpMcpConfig({ cwd, endpoint }: {
+    cwd: string;
+    endpoint: Pick<McpHttpEndpoint, 'url' | 'token'>;
+}, { inheritUserMcp, readFile }?: {
+    inheritUserMcp?: boolean;
+    readFile?: McpJsonInjectionOptions['readFile'];
+}): Promise<{
+    path: string;
+    cleanup: () => Promise<void>;
+}>;
+//# sourceMappingURL=mcp-config.d.ts.map

package/dist/agent-executor/claude/mcp-config.js

@@ -0,0 +1,29 @@
+import { promises as fs } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { defaultReadMcpJsonFile, mergeMcpJsonContent } from '../mcp-bridge.js';
+/** Stage Claude's HTTP capability outside the project; only this private path enters argv.
+ * @returns A private config path and removal of only its owned directory.
+ * @throws Filesystem staging errors after removing partial output.
+ * @complexity O(config bytes), one project read and one private config write.
+ */
+export async function prepareClaudeHttpMcpConfig({ cwd, endpoint }, { inheritUserMcp = true, readFile = defaultReadMcpJsonFile } = {}) {
+    const dir = await fs.mkdtemp(join(tmpdir(), 'jini-claude-mcp-'));
+    const cleanup = () => fs.rm(dir, { recursive: true, force: true });
+    try {
+        let existingRaw;
+        if (inheritUserMcp)
+            existingRaw = await readFile({ path: join(cwd, '.mcp.json') }).catch(() => undefined);
+        const content = mergeMcpJsonContent({ existingRaw, serverEntry: {
+                type: 'http', url: endpoint.url, headers: { Authorization: `Bearer ${endpoint.token}` },
+            } });
+        const path = join(dir, 'mcp.json');
+        await fs.writeFile(path, content, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+        return { path, cleanup };
+    }
+    catch (error) {
+        await cleanup();
+        throw error;
+    }
+}
+//# sourceMappingURL=mcp-config.js.map

package/dist/agent-executor/codex/home-config.d.ts

@@ -1,23 +1,24 @@
-import type { McpJsonServerEntry } from '../contracts.js';
+import type { McpHttpEndpoint, McpJsonServerEntry } from '../contracts.js';
 /** A TOML key: bare when TOML allows it, quoted otherwise — host-supplied bridge env names are not guaranteed bare-safe. */
 export declare function tomlKey(key: string): string;
 /**
  * Mechanism 5 of 5 — `'codex-toml'`'s serialization step. Builds the `[mcp_servers.jini]` TOML
  * table (plus, when the entry carries any env vars, a separate `[mcp_servers.jini.env]` table)
- * Codex's own config schema expects.
+ * Codex's own config schema expects. An explicit HTTP endpoint instead writes `url` and
+ * literal `http_headers` through the same table replacement and escaping owners.
  *
  * Confirmed against a real installed Codex CLI (0.151.0), not assumed from docs: round-tripping
  * `codex mcp add <name> --env K=V -- <cmd> <args>` against a scratch `CODEX_HOME` and reading back
  * `config.toml` produced exactly this shape (`command`/`args` as TOML strings/array in the main
  * table, env vars in a nested `.env` table) — see `archived provenance ledger` for the transcript.
- * @param entry - The shared bridge entry from {@link buildMcpJsonServerEntry}.
+ * @param entry - A stdio bridge entry or an explicit run HTTP endpoint.
  * @returns A TOML fragment with no leading/trailing blank-line padding — {@link buildCodexHomeConfigToml} owns spacing when combining it with existing content.
  * @complexity O(n) in the number of argv/env entries.
  * @overallScore 100/100
  */
 export declare function buildCodexMcpServerToml({ entry }: {
-    readonly entry: McpJsonServerEntry;
-}): string;
+    readonly entry: McpJsonServerEntry | Pick<McpHttpEndpoint, 'url' | 'token'>;
+}, _options?: {}): string;
 /**
  * Builds the full `config.toml` a run's scratch `CODEX_HOME` gets: the real Codex home's own
  * config, with any pre-existing `[mcp_servers.jini]` table removed (see
@@ -43,7 +44,7 @@ export declare function buildCodexMcpServerToml({ entry }: {
  */
 export declare function buildCodexHomeConfigToml({ existingRaw, entry, inheritUserMcp, inheritUserSettings }: {
     readonly existingRaw: string | undefined;
-    readonly entry: McpJsonServerEntry;
+    readonly entry: McpJsonServerEntry | Pick<McpHttpEndpoint, 'url' | 'token'>;
     readonly inheritUserMcp?: boolean;
     readonly inheritUserSettings?: boolean;
 }, _optional?: Record<string, never>): string;

package/dist/agent-executor/codex/home-config.js

@@ -44,18 +44,21 @@ const CODEX_TOOL_TIMEOUT_SEC = 6 * 60 + 40;
 /**
  * Mechanism 5 of 5 — `'codex-toml'`'s serialization step. Builds the `[mcp_servers.jini]` TOML
  * table (plus, when the entry carries any env vars, a separate `[mcp_servers.jini.env]` table)
- * Codex's own config schema expects.
+ * Codex's own config schema expects. An explicit HTTP endpoint instead writes `url` and
+ * literal `http_headers` through the same table replacement and escaping owners.
  *
  * Confirmed against a real installed Codex CLI (0.151.0), not assumed from docs: round-tripping
  * `codex mcp add <name> --env K=V -- <cmd> <args>` against a scratch `CODEX_HOME` and reading back
  * `config.toml` produced exactly this shape (`command`/`args` as TOML strings/array in the main
  * table, env vars in a nested `.env` table) — see `archived provenance ledger` for the transcript.
- * @param entry - The shared bridge entry from {@link buildMcpJsonServerEntry}.
+ * @param entry - A stdio bridge entry or an explicit run HTTP endpoint.
  * @returns A TOML fragment with no leading/trailing blank-line padding — {@link buildCodexHomeConfigToml} owns spacing when combining it with existing content.
  * @complexity O(n) in the number of argv/env entries.
  * @overallScore 100/100
  */
-export function buildCodexMcpServerToml({ entry }) {
+export function buildCodexMcpServerToml({ entry }, _options = {}) {
+    if ('url' in entry)
+        return buildCodexHttpMcpServerToml({ endpoint: entry });
     const argsLiteral = entry.args.map(tomlString).join(', ');
     const serverTable = `[mcp_servers.${JINI_MCP_SERVER_KEY}]\ncommand = ${tomlString(entry.command)}\nargs = [${argsLiteral}]\n` +
         `tool_timeout_sec = ${CODEX_TOOL_TIMEOUT_SEC}\n`;
@@ -66,6 +69,15 @@ export function buildCodexMcpServerToml({ entry }) {
         return serverTable;
     return `${serverTable}\n[mcp_servers.${JINI_MCP_SERVER_KEY}.env]\n${envLines.join('\n')}\n`;
 }
+/** Literal headers keep the run token out of argv and bearer environment variables.
+ * @returns One HTTP table using the existing timeout and TOML escaping owner.
+ * @complexity O(endpoint bytes), without I/O.
+ */
+function buildCodexHttpMcpServerToml({ endpoint }, _options = {}) {
+    return `[mcp_servers.${JINI_MCP_SERVER_KEY}]\nurl = ${tomlString(endpoint.url)}\n` +
+        `tool_timeout_sec = ${CODEX_TOOL_TIMEOUT_SEC}\n\n[mcp_servers.${JINI_MCP_SERVER_KEY}.http_headers]\n` +
+        `Authorization = ${tomlString(`Bearer ${endpoint.token}`)}\n`;
+}
 /**
  * Splits a TOML table header's dotted key into its individual segments, honoring quoted parts
  * (`"basic"` or `'literal'`) that may themselves contain a literal `.` — a bare `.` only

package/dist/agent-executor/codex/home-staging.d.ts

@@ -1,5 +1,5 @@
 import type { RuntimeAgentDef } from '@jini-ai/agent-runtime';
-import type { McpJsonInjectionOptions, McpBridgeDelivery, PreparedCodexHome, FailBeforeSpawn } from '../contracts.js';
+import type { McpJsonInjectionOptions, McpHttpEndpoint, McpBridgeDelivery, PreparedCodexHome, FailBeforeSpawn } from '../contracts.js';
 /**
  * Where `'codex-toml'` reads the operator's REAL Codex config from, to seed a run's scratch copy —
  * never where it writes. Resolved against the daemon HOST process's own environment (`hostEnv`,
@@ -37,7 +37,8 @@ export declare function codexInheritance(input: {
  * returning the prepared handle `cleanupStagedFiles` should later release (`null` for every other
  * mechanism, or for an unconfigured host — matching {@link writeMcpJsonIfNeeded}'s identical gate).
  * @param input.def - Only used for its `id`, in the failure message.
- * @param input.mcpBridge - This run's resolved bridge delivery — a no-op unless its `kind` is `'codex-toml'`.
+ * @param input.mcpBridge - Existing stdio delivery; HTTP uses the optional `httpEndpoint` instead.
+ * @param input.httpEndpoint - Explicit run listener, using the same isolation, state links and cleanup as stdio.
  * @param deps.hostEnv - The daemon's own environment, threaded through to {@link resolveSourceCodexHomeDir} rather than read from a module-level `process.env` so this phase stays testable with an injected env.
  * @complexity O(1) plus {@link prepareCodexHomeForRun}'s own cost.
  * @overallScore 100/100
@@ -49,6 +50,7 @@ export declare function prepareCodexHomeIfNeeded({ input, deps }: {
         readonly nativeCapabilities?: Partial<import('@jini-ai/agent-runtime').NativeCapabilities>;
         readonly def: RuntimeAgentDef;
         readonly mcpBridge: McpBridgeDelivery | null;
+        readonly httpEndpoint?: McpHttpEndpoint;
     };
     readonly deps: {
         readonly mcpJsonInjection: McpJsonInjectionOptions | undefined;

package/dist/agent-executor/codex/home-staging.js

@@ -165,13 +165,15 @@ export function codexInheritance(input) {
  * returning the prepared handle `cleanupStagedFiles` should later release (`null` for every other
  * mechanism, or for an unconfigured host — matching {@link writeMcpJsonIfNeeded}'s identical gate).
  * @param input.def - Only used for its `id`, in the failure message.
- * @param input.mcpBridge - This run's resolved bridge delivery — a no-op unless its `kind` is `'codex-toml'`.
+ * @param input.mcpBridge - Existing stdio delivery; HTTP uses the optional `httpEndpoint` instead.
+ * @param input.httpEndpoint - Explicit run listener, using the same isolation, state links and cleanup as stdio.
  * @param deps.hostEnv - The daemon's own environment, threaded through to {@link resolveSourceCodexHomeDir} rather than read from a module-level `process.env` so this phase stays testable with an injected env.
  * @complexity O(1) plus {@link prepareCodexHomeForRun}'s own cost.
  * @overallScore 100/100
  */
 export async function prepareCodexHomeIfNeeded({ input, deps }) {
-    if (input.mcpBridge?.kind !== 'codex-toml' || deps.mcpJsonInjection === undefined) {
+    const entry = input.httpEndpoint ?? (input.mcpBridge?.kind === 'codex-toml' ? input.mcpBridge.serverEntry : undefined);
+    if (entry === undefined || deps.mcpJsonInjection === undefined) {
         if (codexTurnsOffPersonalConfig(input)) {
             await deps.releaseStagedResources();
             return deps.failBeforeSpawn({ runId: input.runId, code: 'NATIVE_TOOL_POLICY_UNSUPPORTED',
@@ -181,7 +183,7 @@ export async function prepareCodexHomeIfNeeded({ input, deps }) {
     }
     const inherit = codexInheritance(input);
     try {
-        return await prepareCodexHomeForRun(input.runId, input.mcpBridge.serverEntry, resolveSourceCodexHomeDir({ hostEnv: deps.hostEnv }), resolveCodexHomeSeams(deps.mcpJsonInjection), inherit.settings, inherit.mcp);
+        return await prepareCodexHomeForRun(input.runId, entry, resolveSourceCodexHomeDir({ hostEnv: deps.hostEnv }), resolveCodexHomeSeams(deps.mcpJsonInjection), inherit.settings, inherit.mcp);
     }
     catch (err) {
         await deps.releaseStagedResources();

package/dist/agent-executor/contracts.d.ts

@@ -344,7 +344,22 @@ export interface ContinuationOptions {
  * loopback URL this package could assume on a caller's behalf (matching every other seam on this
  * interface that defaults to *nothing* rather than a real implementation).
  */
+/** A private per-run listener; its token authorizes this endpoint, never daemon callbacks. */
+export interface McpHttpEndpoint {
+    readonly url: string;
+    readonly token: string;
+    close(required: Record<string, never>, optional?: Record<string, never>): Promise<void>;
+}
 export interface McpJsonInjectionOptions {
+    /** Optional transport port. Reject before CLI launch when HTTP cannot be prepared.
+     * The host keeps callback credentials in memory; only this endpoint capability reaches the CLI. */
+    readonly prepareHttp?: (required: {
+        readonly runId: string;
+    }, optional?: {
+        readonly messageRelayNonce?: string;
+        readonly startupToolIds?: readonly string[];
+        readonly diagnosticToolIds?: readonly string[];
+    }) => Promise<McpHttpEndpoint>;
     /** Read current host-registered tool IDs at launch, outside model-controlled input. */
     readonly diagnosticToolIds?: () => readonly string[];
     /**

package/dist/agent-executor/event-translation.js

@@ -86,6 +86,9 @@ function translateToolUseEvent(rawEvent) {
             id: asString(rawEvent.id),
             name: asString(rawEvent.name),
             input: rawEvent.input ?? null,
+            ...(isRecord(rawEvent.bridgeCall) && typeof rawEvent.bridgeCall.name === 'string'
+                ? { bridgeCall: { name: rawEvent.bridgeCall.name, input: rawEvent.bridgeCall.input,
+                        ...(rawEvent.bridgeCall.buffered === true ? { buffered: true } : {}) } } : {}),
         },
     };
 }

package/dist/agent-executor/events.d.ts

@@ -11,7 +11,7 @@ import type { ChildDrivenStreamFormat, TerminateChildTreeDeps, AgentCleanupFailu
 /** Default sink when a host does not supply `onCleanupFailure`: still observable, never silent. Redacted per SEC-007 (a spawn/permission error can embed paths/host detail). */
 export declare function defaultCleanupFailureSink(context: AgentCleanupFailureContext): void;
 /**
- * Default ceiling on the `'until-close'` stdout accumulator (see `RuntimeStdoutPolicy` in
+ * Default ceiling on the `'until-close'` or per-line stdout accumulator (see `RuntimeStdoutPolicy` in
  * `@jini-ai/agent-runtime`), in bytes of received UTF-8.
  *
  * A buffered def holds its child's entire stdout in one in-memory string until the process closes,
@@ -20,8 +20,8 @@ export declare function defaultCleanupFailureSink(context: AgentCleanupFailureCo
  * nothing obliges it to ever close or to stop emitting. Without a ceiling one run could exhaust the
  * daemon's heap and take every unrelated run in the process down with it.
  *
- * 8 MiB is chosen to sit far above any real buffered-agent transcript (antigravity's print-mode
- * output — the only `'until-close'` def — is a few KiB of auth prompt and result text) while staying
+ * 8 MiB was chosen to sit far above the original buffered print-mode auth prompt and result text
+ * (a few KiB) while staying
  * small enough that a hostile child cannot meaningfully pressure the heap. A host that genuinely
  * needs more passes `CreateAgentExecutorOptions.bufferedStdoutMaxBytes`.
  */
@@ -101,13 +101,15 @@ interface WireChildLifecycleContext extends TerminateChildTreeDeps {
  *
  * *When* those chunks leave is the def's call, via `def.stdoutPolicy`:
  *
- *   - `'live'` (the default, and every def but antigravity) — emit per
+ *   - `'live'` (the default) — emit per
  *     chunk, as it arrives.
  *   - `'until-close'` — accumulate, and emit the whole thing exactly once
  *     from the `close` handler, after `def.stdoutPolicy.sanitize`. For an
  *     adapter that can print a secret to stdout and still exit 0, no
  *     per-chunk decision is safe: the pattern to redact can straddle two
  *     `'data'` events.
+ *   - `'line'` — sanitize each bounded complete wire line before both raw delivery and parsing;
+ *     retain only its partial tail. Secrets split across chunks stay private without waiting for exit.
  *
  * The buffered path holds back the raw `'stdout'` echo too, not just the
  * `'agent'`/`text_delta`, and sanitizes both. Emitting an unsanitized raw

package/dist/agent-executor/events.js

@@ -1,6 +1,7 @@
 import { createToolResultDiagnosticProjection, projectDiagnosticFrame } from '../tool-result-diagnostics.js';
 import { appendSerialTask } from "@jini-ai/core/primitives";
 import { createLiveSessionState } from './live-session-state.js';
+import { createSanitizedLineStream } from './sanitized-line-stream.js';
 import { acceptsMidRunUserMessages, createMessageRelay } from './message-relay.js';
 import { randomUUID } from 'node:crypto';
 import { createModelReceiptTracker } from './model-receipts.js';
@@ -13,6 +14,7 @@ import { classifyRunCloseStatus, } from '../close-status.js';
 import { resolveContinuationTransport, } from '../continuation/continuation-transport.js';
 import { resultContent, } from '../delegated-tool-bridge.js';
 import { projectToolResultEvent, } from '../tool-result-media.js';
+import { createCliToolCallReceiver } from './tool-call-receipts.js';
 import { translateAgentRuntimeEvent, translateAcpError, applyAgentTranslationSideEffects, } from './event-translation.js';
 import { errorMessage, } from './values.js';
 import { MCP_BRIDGE_UNAVAILABLE, unavailableJiniBridgeStatus, bridgeUnavailableMessage, } from './mcp-bridge.js';
@@ -45,7 +47,7 @@ function createStreamHandlerForDef(def, streamFormat, onEvent) {
         case 'qoder-stream-json':
             return createQoderStreamHandler({ onEvent: onEvent });
         case 'json-event-stream':
-            return createJsonEventStreamHandler({ kind: def.eventParser ?? '', onEvent: onEvent });
+            return createJsonEventStreamHandler({ kind: def.eventParser ?? '', onEvent: createCliToolCallReceiver({ kind: def.eventParser ?? '', onEvent }) });
         default: {
             // Unreachable: every stream format has a case above, and a new one fails typecheck here.
             const unknownFormat = streamFormat;
@@ -185,7 +187,7 @@ function receivedJournalEntry(channel, content) {
     return { content, provenance: { source: 'agent', channel }, trust: 'untrusted' };
 }
 /**
- * Default ceiling on the `'until-close'` stdout accumulator (see `RuntimeStdoutPolicy` in
+ * Default ceiling on the `'until-close'` or per-line stdout accumulator (see `RuntimeStdoutPolicy` in
  * `@jini-ai/agent-runtime`), in bytes of received UTF-8.
  *
  * A buffered def holds its child's entire stdout in one in-memory string until the process closes,
@@ -194,8 +196,8 @@ function receivedJournalEntry(channel, content) {
  * nothing obliges it to ever close or to stop emitting. Without a ceiling one run could exhaust the
  * daemon's heap and take every unrelated run in the process down with it.
  *
- * 8 MiB is chosen to sit far above any real buffered-agent transcript (antigravity's print-mode
- * output — the only `'until-close'` def — is a few KiB of auth prompt and result text) while staying
+ * 8 MiB was chosen to sit far above the original buffered print-mode auth prompt and result text
+ * (a few KiB) while staying
  * small enough that a hostile child cannot meaningfully pressure the heap. A host that genuinely
  * needs more passes `CreateAgentExecutorOptions.bufferedStdoutMaxBytes`.
  */
@@ -282,13 +284,15 @@ function createStdoutDiagnostics({ ctx, enqueueEmit }, _options = {}) {
  *
  * *When* those chunks leave is the def's call, via `def.stdoutPolicy`:
  *
- *   - `'live'` (the default, and every def but antigravity) — emit per
+ *   - `'live'` (the default) — emit per
  *     chunk, as it arrives.
  *   - `'until-close'` — accumulate, and emit the whole thing exactly once
  *     from the `close` handler, after `def.stdoutPolicy.sanitize`. For an
  *     adapter that can print a secret to stdout and still exit 0, no
  *     per-chunk decision is safe: the pattern to redact can straddle two
  *     `'data'` events.
+ *   - `'line'` — sanitize each bounded complete wire line before both raw delivery and parsing;
+ *     retain only its partial tail. Secrets split across chunks stay private without waiting for exit.
  *
  * The buffered path holds back the raw `'stdout'` echo too, not just the
  * `'agent'`/`text_delta`, and sanitizes both. Emitting an unsanitized raw
@@ -363,12 +367,25 @@ export function wireChildLifecycle(ctx) {
     let bridgeChecked = !ctx.expectsJiniBridge;
     let bridgeUnavailable = false;
     // `def.stdoutPolicy` read once, up front, so the per-chunk handler below is a single boolean
-    // test rather than a repeated union narrowing. `undefined` (every def but antigravity) means
+    // test rather than a repeated union narrowing. `undefined` means
     // live — see this function's own doc.
     const stdoutPolicy = def.stdoutPolicy;
     const bufferStdoutUntilClose = stdoutPolicy?.buffering === 'until-close';
     const sanitizeBufferedStdout = stdoutPolicy?.buffering === 'until-close' ? stdoutPolicy.sanitize : undefined;
-    // Accumulator for the `'until-close'` path. Stays `''` for every live def, and the flush below
+    const lineStdout = stdoutPolicy?.buffering === 'line' ? createSanitizedLineStream({
+        maxBytes: ctx.bufferedStdoutMaxBytes, sanitize: stdoutPolicy.sanitize,
+        emit: ({ text }) => {
+            stdoutDiagnostics.feed({ text });
+            if (streamFormat === 'plain')
+                enqueueEmit(() => lifecycle.emit({ runId, input: { event: 'agent', data: { type: 'text_delta', delta: text } } }));
+            else
+                streamHandler?.feed({ chunk: text });
+        },
+        onOverflow: ({ bytes }) => enqueueEmit(() => lifecycle.emit({ runId, input: { event: 'error', data: {
+                    message: bufferedStdoutTruncationNotice(bytes, ctx.bufferedStdoutMaxBytes),
+                } } })),
+    }) : undefined;
+    // Accumulator for the `'until-close'` path. Stays `''` for live and line policies, and the flush below
     // is then a no-op that emits nothing. Bounded by `ctx.bufferedStdoutMaxBytes` — see
     // {@link DEFAULT_BUFFERED_STDOUT_MAX_BYTES} for why an unbounded accumulator was a
     // denial-of-service surface rather than merely untidy.
@@ -646,6 +663,10 @@ export function wireChildLifecycle(ctx) {
     child.stdout?.on('data', (chunk) => {
         const text = chunk.toString('utf8');
         stdoutDiagnostics.record({ chunk, text });
+        if (lineStdout) {
+            lineStdout.feed({ chunk: text });
+            return;
+        }
         if (streamFormat === 'plain' && text.length > 0)
             userVisibleOutputSeen = true;
         if (bufferStdoutUntilClose) {
@@ -715,6 +736,7 @@ export function wireChildLifecycle(ctx) {
                 controlScanBuffer = '';
             }
             flushBufferedStdout();
+            lineStdout?.flush({});
             streamHandler?.flush();
             session.endSession();
             stdoutDiagnostics.flush();

package/dist/agent-executor/gemini/tool-calls.d.ts

@@ -0,0 +1,7 @@
+/** Gemini's legacy stream reports bare MCP names, indistinguishable from native tool names.
+ * Correlation is only a candidate: the shared fold requires a real bridge row with equal input.
+ * Keep native names/arguments intact for presentation and auditing. Pure, O(1). */
+export declare function geminiToolCallReceipt({ event }: {
+    event: Record<string, unknown>;
+}, _options?: {}): Record<string, unknown>;
+//# sourceMappingURL=tool-calls.d.ts.map

package/dist/agent-executor/gemini/tool-calls.js

@@ -0,0 +1,9 @@
+/** Gemini's legacy stream reports bare MCP names, indistinguishable from native tool names.
+ * Correlation is only a candidate: the shared fold requires a real bridge row with equal input.
+ * Keep native names/arguments intact for presentation and auditing. Pure, O(1). */
+export function geminiToolCallReceipt({ event }, _options = {}) {
+    if (event.type !== 'tool_use' || typeof event.name !== 'string' || event.name.startsWith('mcp__'))
+        return event;
+    return { ...event, bridgeCall: { name: event.name, input: event.input } };
+}
+//# sourceMappingURL=tool-calls.js.map

package/dist/agent-executor/http-mcp.d.ts

@@ -0,0 +1,23 @@
+import type { RuntimeAgentDef } from '@jini-ai/agent-runtime';
+import type { RunLifecycle } from '../run-lifecycle.js';
+import type { McpHttpEndpoint, McpJsonInjectionOptions } from './contracts.js';
+/** Owned transport resources; cleanup is idempotent and also armed on cancellation/termination. */
+export interface PreparedHttpMcp {
+    readonly endpoint: McpHttpEndpoint;
+    readonly mcpJsonPath?: string;
+    cleanup(): Promise<void>;
+}
+/** Prepare HTTP before launch; only missing support or listener failure selects stdio.
+ * @returns Null for stdio, otherwise a run-owned endpoint and optional private Claude config.
+ * @throws Configuration staging errors after closing the endpoint; never retries dispatched work.
+ * @complexity O(config bytes) for Claude; O(1) otherwise, plus the injected host preparation.
+ */
+export declare function prepareHttpMcpForRun({ runId, cwd, def, lifecycle, injection, inheritUserMcp }: {
+    runId: string;
+    cwd: string;
+    def: RuntimeAgentDef;
+    lifecycle: RunLifecycle;
+    injection: McpJsonInjectionOptions | undefined;
+    inheritUserMcp?: boolean;
+}, _options?: {}): Promise<PreparedHttpMcp | null>;
+//# sourceMappingURL=http-mcp.d.ts.map

package/dist/agent-executor/http-mcp.js

@@ -0,0 +1,74 @@
+import { randomBytes } from 'node:crypto';
+import { prepareClaudeHttpMcpConfig } from './claude/mcp-config.js';
+import { supportsMessageRelay } from './message-relay.js';
+/** Close admission on cancellation/terminal transition without waiting for the CLI pipes.
+ * The shared close promise also handles explicit pre-spawn cleanup exactly once.
+ * @complexity O(1), one cancellable terminal waiter and one cancel subscription per live listener.
+ */
+function watchEndpoint({ endpoint, lifecycle, runId, cleanupConfig }) {
+    const waiting = new AbortController();
+    let closing;
+    let unsubscribe = () => { };
+    const close = () => {
+        waiting.abort();
+        unsubscribe();
+        closing ??= endpoint.close({}).finally(cleanupConfig);
+        return closing;
+    };
+    const closeSafely = () => { void close().catch(() => console.warn('[agent-executor] MCP HTTP cleanup failed')); };
+    unsubscribe = lifecycle.onCancelRequested({ runId, listener: closeSafely });
+    // onCancelRequested replays a prior cancellation before returning its unsubscribe handle.
+    if (closing)
+        unsubscribe();
+    void lifecycle.waitForTerminal({ runId }, { signal: waiting.signal }).then(closeSafely, () => { });
+    return close;
+}
+/** Snapshot host-selected metadata once at launch; it is never learned from model arguments. */
+function httpLaunchOptions({ def, runId, injection }) {
+    return {
+        ...(supportsMessageRelay({ def }) ? { messageRelayNonce: randomBytes(24).toString('hex') } : {}),
+        ...(injection.startupToolIds ? { startupToolIds: injection.startupToolIds({ runId }) } : {}),
+        ...(injection.diagnosticToolIds ? { diagnosticToolIds: injection.diagnosticToolIds() } : {}),
+    };
+}
+/** Claude's path is staged before argv; other vendors use their existing env/home carriers. */
+async function stageHttpConfig({ cwd, def, injection, endpoint, inheritUserMcp }) {
+    if (def.externalMcpInjection !== 'claude-mcp-json')
+        return {};
+    const config = await prepareClaudeHttpMcpConfig({ cwd, endpoint }, { inheritUserMcp,
+        ...(injection.readFile ? { readFile: injection.readFile } : {}),
+    });
+    return { mcpJsonPath: config.path, cleanupConfig: config.cleanup };
+}
+/** Prepare HTTP before launch; only missing support or listener failure selects stdio.
+ * @returns Null for stdio, otherwise a run-owned endpoint and optional private Claude config.
+ * @throws Configuration staging errors after closing the endpoint; never retries dispatched work.
+ * @complexity O(config bytes) for Claude; O(1) otherwise, plus the injected host preparation.
+ */
+export async function prepareHttpMcpForRun({ runId, cwd, def, lifecycle, injection, inheritUserMcp = true }, _options = {}) {
+    if (!injection?.prepareHttp || !def.externalMcpInjection)
+        return null;
+    if (!('mcpHttp' in def) || def.mcpHttp !== true) {
+        console.warn('[agent-executor] MCP HTTP unsupported for this agent; using stdio');
+        return null;
+    }
+    const launchOptions = httpLaunchOptions({ def, runId, injection });
+    let endpoint;
+    try {
+        endpoint = await injection.prepareHttp({ runId }, launchOptions);
+    }
+    catch {
+        console.warn('[agent-executor] MCP HTTP listener unavailable; using stdio');
+        return null;
+    }
+    try {
+        const config = await stageHttpConfig({ cwd, def, injection, endpoint, inheritUserMcp });
+        const cleanup = watchEndpoint({ endpoint, lifecycle, runId, ...config });
+        return { endpoint, ...(config.mcpJsonPath ? { mcpJsonPath: config.mcpJsonPath } : {}), cleanup };
+    }
+    catch (error) {
+        await endpoint.close({});
+        throw error;
+    }
+}
+//# sourceMappingURL=http-mcp.js.map