@jini-ai/daemon 0.6.17 → 0.6.22

package/dist/agent-executor/launch.js

@@ -1,3 +1,5 @@
+import { prepareHttpMcpForRun } from './http-mcp.js';
+import { mergeOpenCodeHttpMcpConfig } from './opencode/mcp-config.js';
 import { buildAgentEnv } from './agent-env.js';
 import { randomUUID } from 'node:crypto';
 import { supportsMessageRelay } from './message-relay.js';
@@ -363,8 +365,8 @@ function settingsBuildOptions({ input }, _options = {}) {
     };
 }
 /** A relay needs both a delivered bridge and a runtime that understands it. Pure, O(1). */
-function canRegisterRunMessageRelay({ def, mcpBridge }, _options = {}) {
-    return mcpBridge !== null && supportsMessageRelay({ def });
+function canRegisterRunMessageRelay({ def, mcpBridge, httpMcp }, _options = {}) {
+    return (mcpBridge !== null || httpMcp === true) && supportsMessageRelay({ def });
 }
 /** Phase 9a: the def's `buildArgs` 4th argument. Historically omitted when every override was absent;
  * that let defs silently enable auto-approval. Always supply the validated restricted default now. Pure. */
@@ -619,6 +621,16 @@ export function spawnAgentChildProcess({ input, deps }) {
         return { kind: 'error', error };
     }
 }
+/** Command preparation is part of pre-spawn staging, so failures must release all owned resources. */
+async function prepareRunCommand({ command, args, env, runId }, { createInvocation, release, failBeforeSpawn, }) {
+    try {
+        return createInvocation({ command, args, env });
+    }
+    catch {
+        await release();
+        return failBeforeSpawn({ runId, code: 'AGENT_SPAWN_FAILED', message: 'AgentExecutor: could not prepare agent command' });
+    }
+}
 /** Named predicate replacing an inline `streamFormat === 'acp-json-rpc' || streamFormat === 'pi-rpc'` check — the two formats that own their own prompt/event protocol and skip `wireChildLifecycle`. */
 export function isStdinDrivenFormat(args) {
     const { streamFormat } = args;
@@ -913,11 +925,11 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
             ? mcpBridge.serverEntry
             : undefined;
     }
-    function wireRunInput({ input, def, streamFormat, child, modelCatalog, cleanupStagedFiles, writtenMcpJsonPath, mcpBridge }, _options = {}) {
+    function wireRunInput({ input, def, streamFormat, child, modelCatalog, cleanupStagedFiles, writtenMcpJsonPath, mcpBridge, httpMcp }, _options = {}) {
         const formatForStdin = { streamFormat };
         const stdinHandle = isStdinDrivenFormat(formatForStdin)
             ? wireChildLifecycle({
-                ...(canRegisterRunMessageRelay({ def, mcpBridge }) ? { registerMessageRelay: (relay) => liveRunRelays.set(input.runId, relay) } : {}),
+                ...(canRegisterRunMessageRelay({ def, mcpBridge, ...(httpMcp === undefined ? {} : { httpMcp }) }) ? { registerMessageRelay: (relay) => liveRunRelays.set(input.runId, relay) } : {}),
                 ...childLifecycleOptions({ input, modelCatalog }),
                 runId: input.runId,
                 def,
@@ -933,7 +945,7 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
                 continuation,
                 classifyFailure,
                 bufferedStdoutMaxBytes,
-                expectsJiniBridge: writtenMcpJsonPath !== undefined,
+                expectsJiniBridge: writtenMcpJsonPath !== undefined || httpMcp === true,
                 bridgeProbeEntry: bridgeProbeEntryForRun({ mcpBridge }, {}),
                 probeMcpBridge: options.probeMcpBridge ?? probeMcpBridge,
             })
@@ -1095,6 +1107,7 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
          * `'claude-mcp-json'` mechanism stages a file at all — `'acp-merge'` and `'env-content'` leave
          * nothing on disk, so this stays `undefined` for those.
          */
+        let preparedHttpMcp = null;
         let writtenMcpJsonPath;
         const removeMcpJsonFileFn = mcpJsonInjection?.removeFile ?? defaultRemoveMcpJsonFile;
         /**
@@ -1120,6 +1133,11 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
          */
         let preparedSystemPromptOverlayFile = null;
         const cleanupStagedFiles = async () => {
+            if (preparedHttpMcp) {
+                const http = preparedHttpMcp;
+                preparedHttpMcp = null;
+                await http.cleanup();
+            }
             await cleanupFilesystemTemp({ runId: input.runId }, {});
             if (preparedPromptFile)
                 await preparedPromptFile.cleanup();
@@ -1151,8 +1169,18 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         // resolving here means the per-run bearer credential is minted exactly once no matter which of
         // the five mechanisms ends up carrying it. `null` for an unconfigured host or a def declaring
         // no strategy — see `buildMcpBridgeDelivery`'s doc.
-        const mcpBridge = await resolveMcpBridgeForRun({ input: { runId: input.runId, cwd: input.cwd, def }, deps: { mcpJsonInjection, cleanupStagedFiles, failBeforeSpawn } });
-        const runtimeContext = computeRuntimeContext({ preparedPromptFile: preparedPromptFile, preparedLogFile: preparedLogFile, mcpBridge: mcpBridge }, sessionRuntimeContext(input, {}));
+        try {
+            preparedHttpMcp = await prepareHttpMcpForRun({ runId: input.runId, cwd: input.cwd, def, lifecycle,
+                injection: mcpJsonInjection, inheritUserMcp: input.nativeToolAccess !== false && input.nativeCapabilities?.userMcp !== false });
+        }
+        catch {
+            await cleanupStagedFiles();
+            return failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: 'AgentExecutor: could not stage private HTTP MCP configuration' });
+        }
+        const mcpBridge = preparedHttpMcp ? null : await resolveMcpBridgeForRun({ input: { runId: input.runId, cwd: input.cwd, def }, deps: { mcpJsonInjection, cleanupStagedFiles, failBeforeSpawn } });
+        const baseRuntimeContext = computeRuntimeContext({ preparedPromptFile, preparedLogFile, mcpBridge }, sessionRuntimeContext(input, {}));
+        const runtimeContext = preparedHttpMcp?.mcpJsonPath
+            ? { ...baseRuntimeContext, mcpJsonPath: preparedHttpMcp.mcpJsonPath } : baseRuntimeContext;
         // A `runtimeLock` def's buildArgs mutates process-global state its own CLI reads back at
         // startup, so the mutex must be held from before buildArgs until the spawned child has
         // demonstrably consumed it — see `RuntimeLock`'s own doc for the concrete race. Undefined for
@@ -1195,7 +1223,7 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         // `codex.ts`'s `buildArgs` needs no argv change for this (CODEX_HOME is an env var, not a flag),
         // so — unlike the `.mcp.json` staging above — this can run after `buildArgs` with no ordering
         // constraint of its own; it is placed here only to keep the two staging steps adjacent.
-        preparedCodexHome = await prepareCodexHomeIfNeeded({ input: { runId: input.runId, nativeToolAccess: input.nativeToolAccess, ...nativeCapabilityInput({ input }, {}), def, mcpBridge }, deps: { mcpJsonInjection, hostEnv: input.cliParity ? spawnEnv : hostEnv, releaseStagedResources, failBeforeSpawn } });
+        preparedCodexHome = await prepareCodexHomeIfNeeded({ input: { runId: input.runId, nativeToolAccess: input.nativeToolAccess, ...nativeCapabilityInput({ input }, {}), def, mcpBridge, ...(def.id === 'codex' && preparedHttpMcp ? { httpEndpoint: preparedHttpMcp.endpoint } : {}) }, deps: { mcpJsonInjection, hostEnv: input.cliParity ? spawnEnv : hostEnv, releaseStagedResources, failBeforeSpawn } });
         // Finding 1 of SEC-assistant-env-isolation-2026-09-07's one effect — stage this run's scratch
         // `CLAUDE_CONFIG_DIR` directory. Unconditional for a `claude`-id run (unlike CODEX_HOME above,
         // this does not depend on `mcpJsonInjection` being configured at all — see
@@ -1221,7 +1249,9 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         // `McpBridgeDelivery`'s `'codex-toml'` variant doc for why it cannot be pre-computed the way
         // `'claude-mcp-json'`'s deterministic path is). Nothing between the old, earlier call site and
         // here ever read `childEnv`, so moving the call cost nothing.
-        const childEnv = computeChildEnv({ spawnEnv, mcpBridge }, stagedChildEnvOptions({
+        const httpSpawnEnv = def.id === 'opencode' && preparedHttpMcp
+            ? { ...spawnEnv, OPENCODE_CONFIG_CONTENT: mergeOpenCodeHttpMcpConfig({ existingRaw: spawnEnv.OPENCODE_CONFIG_CONTENT, endpoint: preparedHttpMcp.endpoint }) } : spawnEnv;
+        const childEnv = computeChildEnv({ spawnEnv: httpSpawnEnv, mcpBridge }, stagedChildEnvOptions({
             def, preparedCodexHome, preparedClaudeConfigDir, preparedSystemPromptOverlayFile, systemPromptEnvOverrides,
         }, {}));
         // Post-buildArgs guard for argv-bound defs whose resolved binary is a
@@ -1229,7 +1259,9 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         // budget can still expand past CreateProcess's command-line cap once
         // quote-escaped. Both are no-ops off-Windows / for non-argv-bound defs.
         await guardWindowsCommandLineBudget({ input: { runId: input.runId, def, launchPath: launch.launchPath, args }, deps: { releaseStagedResources, failBeforeSpawn } });
-        const invocation = createCommandInvocationFn({ command: launch.launchPath, args, env: childEnv });
+        const invocation = await prepareRunCommand({ command: launch.launchPath, args, env: childEnv, runId: input.runId }, {
+            createInvocation: createCommandInvocationFn, release: releaseStagedResources, failBeforeSpawn,
+        });
         // Kept a synchronous call (no `await`) on purpose — see `spawnAgentChildProcess`'s own doc for
         // the microtask-timing race this avoids. The error branch's own cleanup/failBeforeSpawn calls are
         // async, which is fine: no child exists yet on that path, so nothing is racing a listener.
@@ -1247,7 +1279,7 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
         // grandchild inheriting them can delay arbitrarily). A spawn that never produced a process at
         // all emits no `'exit'`, and is covered instead by `releaseStagedResources` on the reject path.
         child.once('exit', releaseRuntimeLock);
-        const stdinHandle = wireRunInput({ input, def, streamFormat, child, modelCatalog, cleanupStagedFiles, writtenMcpJsonPath, mcpBridge }, {});
+        const stdinHandle = wireRunInput({ input, def, streamFormat, child, modelCatalog, cleanupStagedFiles, writtenMcpJsonPath, mcpBridge, httpMcp: preparedHttpMcp !== null }, {});
         const runId = input.runId;
         try {
             await confirmChildSpawned({ input: { runId: input.runId, def, child }, deps: { releaseStagedResources, failBeforeSpawn } });

package/dist/agent-executor/mcp-bridge.d.ts

@@ -52,7 +52,11 @@ export declare function buildMcpJsonServerEntry({ runId, options }: {
  */
 export declare function mergeMcpJsonContent({ existingRaw, serverEntry }: {
     readonly existingRaw: string | undefined;
-    readonly serverEntry: McpJsonServerEntry;
+    readonly serverEntry: McpJsonServerEntry | {
+        readonly type: 'http';
+        readonly url: string;
+        readonly headers: Readonly<Record<string, string>>;
+    };
 }): string;
 /**
  * Mechanism 2 of 5 — `'acp-merge'`. Re-shapes the same bridge entry into the `mcpServers` element
@@ -107,7 +111,11 @@ export declare function buildAcpMcpBridgeServers({ entry }: {
  */
 export declare function mergeEnvContentMcpConfig({ existingRaw, entry }: {
     readonly existingRaw: string | undefined;
-    readonly entry: McpJsonServerEntry;
+    readonly entry: McpJsonServerEntry | {
+        readonly type: 'remote';
+        readonly url: string;
+        readonly headers: Readonly<Record<string, string>>;
+    };
 }): string;
 /**
  * Merges a staged system-prompt overlay file's path into the `instructions` array of the same

package/dist/agent-executor/mcp-bridge.js

@@ -175,12 +175,12 @@ export function mergeEnvContentMcpConfig({ existingRaw, entry }) {
     const existingMcp = isRecord(doc.mcp) ? doc.mcp : {};
     const mcp = {
         ...existingMcp,
-        [JINI_MCP_SERVER_KEY]: {
+        [JINI_MCP_SERVER_KEY]: 'command' in entry ? {
             type: 'local',
             command: [entry.command, ...entry.args],
             environment: { ...entry.env },
             enabled: true,
-        },
+        } : entry,
     };
     return JSON.stringify({ ...doc, mcp });
 }

package/dist/agent-executor/opencode/mcp-config.d.ts

@@ -0,0 +1,10 @@
+import type { McpHttpEndpoint } from '../contracts.js';
+/** Keep OpenCode's run-local inline carrier and its existing settings/instruction merge owner.
+ * @returns Remote entry replacing stale stdio fields; only the endpoint token is delivered.
+ * @complexity O(config bytes) time/space, without I/O.
+ */
+export declare function mergeOpenCodeHttpMcpConfig({ existingRaw, endpoint }: {
+    existingRaw: string | undefined;
+    endpoint: Pick<McpHttpEndpoint, 'url' | 'token'>;
+}, _options?: {}): string;
+//# sourceMappingURL=mcp-config.d.ts.map

package/dist/agent-executor/opencode/mcp-config.js

@@ -0,0 +1,11 @@
+import { mergeEnvContentMcpConfig } from '../mcp-bridge.js';
+/** Keep OpenCode's run-local inline carrier and its existing settings/instruction merge owner.
+ * @returns Remote entry replacing stale stdio fields; only the endpoint token is delivered.
+ * @complexity O(config bytes) time/space, without I/O.
+ */
+export function mergeOpenCodeHttpMcpConfig({ existingRaw, endpoint }, _options = {}) {
+    return mergeEnvContentMcpConfig({ existingRaw, entry: {
+            type: 'remote', url: endpoint.url, headers: { Authorization: `Bearer ${endpoint.token}` },
+        } });
+}
+//# sourceMappingURL=mcp-config.js.map

package/dist/agent-executor/opencode/tool-calls.d.ts

@@ -0,0 +1,7 @@
+/** OpenCode joins server and tool with an underscore and can emit a completed call after its
+ * bridge result. Preserve the receipt; only its correlation candidate uses the remote name.
+ * A native snake-case tool cannot fold without a matching canonical bridge row. Pure, O(n). */
+export declare function openCodeToolCallReceipt({ event }: {
+    event: Record<string, unknown>;
+}, _options?: {}): Record<string, unknown>;
+//# sourceMappingURL=tool-calls.d.ts.map

package/dist/agent-executor/opencode/tool-calls.js

@@ -0,0 +1,12 @@
+/** OpenCode joins server and tool with an underscore and can emit a completed call after its
+ * bridge result. Preserve the receipt; only its correlation candidate uses the remote name.
+ * A native snake-case tool cannot fold without a matching canonical bridge row. Pure, O(n). */
+export function openCodeToolCallReceipt({ event }, _options = {}) {
+    if (event.type !== 'tool_use' || typeof event.name !== 'string' || event.name.startsWith('mcp__'))
+        return event;
+    const separator = event.name.indexOf('_');
+    if (separator <= 0 || separator === event.name.length - 1)
+        return event;
+    return { ...event, bridgeCall: { name: event.name.slice(separator + 1), input: event.input, buffered: true } };
+}
+//# sourceMappingURL=tool-calls.js.map

package/dist/agent-executor/sanitized-line-stream.d.ts

@@ -0,0 +1,24 @@
+/** Frame and sanitize stdout before either parser or raw-event delivery.
+ * @param required - Host byte cap, pure sanitizer and delivery/error sinks.
+ * @returns A per-process stream; flush delivers a final unterminated line once.
+ * @complexity O(n) time for n wire characters, O(maxBytes) retained text plus incoming chunk slices.
+ * @example const stream = createSanitizedLineStream({ maxBytes: 4096, sanitize, emit, onOverflow });
+ */
+export declare function createSanitizedLineStream({ maxBytes, sanitize, emit, onOverflow }: {
+    maxBytes: number;
+    sanitize: (required: {
+        fullText: string;
+    }) => string;
+    emit: (required: {
+        text: string;
+    }, optional?: Record<string, never>) => void;
+    onOverflow: (required: {
+        bytes: number;
+    }, optional?: Record<string, never>) => void;
+}, _options?: Record<string, never>): {
+    feed(required: {
+        chunk: string;
+    }, optional?: Record<string, never>): void;
+    flush(required: Record<string, never>, optional?: Record<string, never>): void;
+};
+//# sourceMappingURL=sanitized-line-stream.d.ts.map

package/dist/agent-executor/sanitized-line-stream.js

@@ -0,0 +1,45 @@
+/** Frame and sanitize stdout before either parser or raw-event delivery.
+ * @param required - Host byte cap, pure sanitizer and delivery/error sinks.
+ * @returns A per-process stream; flush delivers a final unterminated line once.
+ * @complexity O(n) time for n wire characters, O(maxBytes) retained text plus incoming chunk slices.
+ * @example const stream = createSanitizedLineStream({ maxBytes: 4096, sanitize, emit, onOverflow });
+ */
+export function createSanitizedLineStream({ maxBytes, sanitize, emit, onOverflow }, _options = {}) {
+    let parts = [];
+    let bytes = 0;
+    let overflow = false;
+    /** One line's fragments retain at most maxBytes; an oversized line is discarded through its end. */
+    function append(text) {
+        if (!text)
+            return;
+        bytes += Buffer.byteLength(text, 'utf8');
+        if (bytes > maxBytes) {
+            parts = [];
+            overflow = true;
+        }
+        if (!overflow)
+            parts.push(text);
+    }
+    /** Delivery happens once per completed line, or once for the final unterminated tail. */
+    function flush(newline) {
+        if (overflow)
+            onOverflow({ bytes });
+        else if (bytes > 0 || newline)
+            emit({ text: sanitize({ fullText: parts.join('') + newline }) });
+        parts = [];
+        bytes = 0;
+        overflow = false;
+    }
+    return {
+        feed({ chunk }, _optional = {}) {
+            const lines = chunk.split('\n');
+            lines.forEach((line, index) => {
+                append(line);
+                if (index < lines.length - 1)
+                    flush('\n');
+            });
+        },
+        flush(_required, _optional = {}) { flush(''); },
+    };
+}
+//# sourceMappingURL=sanitized-line-stream.js.map

package/dist/agent-executor/tool-call-receipts.d.ts

@@ -0,0 +1,7 @@
+/** Select the CLI's receipt dialect once; raw events and tools from other CLIs pass unchanged.
+ * Folding stays in chat's existing shared rule. O(1) construction, O(name length) per receipt. */
+export declare function createCliToolCallReceiver({ kind, onEvent }: {
+    kind: string;
+    onEvent: (event: Record<string, unknown>) => void;
+}, _options?: {}): (event: Record<string, unknown>) => void;
+//# sourceMappingURL=tool-call-receipts.d.ts.map

package/dist/agent-executor/tool-call-receipts.js

@@ -0,0 +1,9 @@
+import { geminiToolCallReceipt } from './gemini/tool-calls.js';
+import { openCodeToolCallReceipt } from './opencode/tool-calls.js';
+/** Select the CLI's receipt dialect once; raw events and tools from other CLIs pass unchanged.
+ * Folding stays in chat's existing shared rule. O(1) construction, O(name length) per receipt. */
+export function createCliToolCallReceiver({ kind, onEvent }, _options = {}) {
+    const adapt = kind === 'legacy-google-stream-json' ? geminiToolCallReceipt : kind === 'opencode' ? openCodeToolCallReceipt : undefined;
+    return event => onEvent(adapt ? adapt({ event }, {}) : event);
+}
+//# sourceMappingURL=tool-call-receipts.js.map

package/dist/core/read-only-tools.d.ts

@@ -77,6 +77,8 @@ export declare function principalIsReadOnlyConstrained({ principal }: {
 /**
  * Hide writes and unclassified tools from a constrained caller's search and schema discovery.
  * Uses the same classification as dispatch; discovery never grants execution authority.
+ * Guidance entries (`targetToolIds`) are shown only when every target is allowed; the catalog is
+ * told the allowed ids so an overview can list just those.
  * @param required - Per-call identity, live descriptors, and the existing catalog owner.
  * @returns A filtered catalog, or the original catalog for an unconstrained caller.
  * @example filterReadOnlyToolCatalog({ principal, registry, catalog });

package/dist/core/read-only-tools.js

@@ -31,6 +31,8 @@ export function principalIsReadOnlyConstrained({ principal }, _optional = {}) {
 /**
  * Hide writes and unclassified tools from a constrained caller's search and schema discovery.
  * Uses the same classification as dispatch; discovery never grants execution authority.
+ * Guidance entries (`targetToolIds`) are shown only when every target is allowed; the catalog is
+ * told the allowed ids so an overview can list just those.
  * @param required - Per-call identity, live descriptors, and the existing catalog owner.
  * @returns A filtered catalog, or the original catalog for an unconstrained caller.
  * @example filterReadOnlyToolCatalog({ principal, registry, catalog });
@@ -49,13 +51,27 @@ export function filterReadOnlyToolCatalog(required, _optional = {}) {
                 .filter(hit => allowed.has(hit.id)).slice(0, limit)
                 .map(hit => ({ ...hit, ...toolDiscoveryMetadata({ descriptor: allowed.get(hit.id) }) }));
         },
-        describe(input) {
-            const descriptor = allowedTools().get(input.id);
-            const entry = descriptor ? required.catalog.describe(input) : null;
+        describe(input, options = {}) {
+            const allowed = allowedTools();
+            const descriptor = allowed.get(input.id);
+            // A caller may further narrow discovery; read-only attenuation must never widen that set.
+            const visible = new Map([...allowed].filter(([id]) => !options.visibleToolIds || options.visibleToolIds.has(id)));
+            if (!descriptor)
+                return readOnlyGuidance({ entry: required.catalog.describe(input, { visibleToolIds: new Set(visible.keys()) }), allowed: visible });
+            const entry = required.catalog.describe(input, options);
             return entry ? { ...entry, ...toolDiscoveryMetadata({ descriptor }) } : null;
         },
     };
 }
+// An id that is not a registered read-only tool can still name guidance (a retired alias, a
+// namespace overview). Guidance is judged by what it points at, never by its own id; guidance
+// without declared targets cannot be judged, so it stays hidden (fail closed).
+function readOnlyGuidance({ entry, allowed }) {
+    const targets = entry?.targetToolIds;
+    if (!targets || targets.length === 0)
+        return null;
+    return targets.every(id => allowed.has(id)) ? entry : null;
+}
 /** @returns Required host wording for a registered non-read-only tool. */
 export function readOnlyToolRefusalMessage({ toolId, messages }, _optional = {}) {
     return messages.toolRefusalMessage({ toolId });

package/dist/delegated-tool-bridge.js

@@ -64,6 +64,10 @@ export { serializeDelegatedToolOutput, resultContent } from './tool-result-media
 function linkCancellation({ lifecycle, runId }, { signal }) {
     const controller = new AbortController();
     const unsubscribeCancel = lifecycle.onCancelRequested({ runId: runId, listener: () => controller.abort() });
+    const terminalWatch = new AbortController();
+    // A CLI can time out/exit without requesting cancellation. Its unanswered cards must stop
+    // holding the daemon busy, while the exchange owner retains their safe restoration handle.
+    void lifecycle.waitForTerminal({ runId }, { signal: terminalWatch.signal }).then(() => controller.abort(), () => { });
     const abortFromTransport = () => controller.abort();
     if (signal?.aborted)
         controller.abort();
@@ -73,6 +77,7 @@ function linkCancellation({ lifecycle, runId }, { signal }) {
         controller,
         dispose: () => {
             unsubscribeCancel();
+            terminalWatch.abort();
             signal?.removeEventListener('abort', abortFromTransport);
         },
     };
@@ -209,7 +214,7 @@ export function createDelegatedToolBridge(requiredArgs, optionalArgs = {}) {
         const call = { lifecycle, runId, toolUseId, ...(options.delegatedResultCorrelation ? { delegatedResultCorrelation: options.delegatedResultCorrelation } : {}) };
         await lifecycle.emit({ runId: runId, input: {
                 event: 'agent',
-                data: { type: 'tool_use', id: toolUseId, name: toolId, input },
+                data: { type: 'tool_use', id: toolUseId, name: toolId, input, ...{ toolOrigin: 'bridge' } },
             } });
         const cancellation = linkCancellation(call, invocation);
         const seam = createSurfaceSeam(call);

package/dist/http/attachments.d.ts

@@ -1,104 +1,3 @@
-/**
- * @module attachments
- *
- * `POST /api/attachments`, `DELETE /api/attachments` — an HTTP route pack for user file/image
- * uploads staged for one agent run, over a narrow, transport-owned `AttachmentStore` port plus a
- * batteries-included disk implementation (`createDiskAttachmentStore`).
- *
- * **The capability this closes.** A chat composer that accepts drag-and-drop needs somewhere to put
- * the bytes, a way to hand the agent a path it is actually allowed to read, and a guarantee that
- * those bytes disappear when the run ends. That is three separate concerns (an upload endpoint, a
- * trusted-metadata registry, and a run-scoped lifetime) which every host would otherwise hand-roll.
- * This module owns all three; `@jini-ai/chat-react`'s `createDaemonAttachmentUploader` is the
- * matching client half.
- *
- * **Trust model.** A renderer supplies bytes, a filename, and a batch id. None of that is trusted:
- * - the filename is reduced to a basename over a conservative character allowlist
- *   (`sanitizeAttachmentName`) and is only ever used as *display* text plus a short extension
- *   suffix — never as the stored filename, which is a fresh `randomUUID()`;
- * - the `kind` (`'image' | 'file'`) is sniffed from the leading bytes (`detectAttachmentKind`),
- *   never taken from a renderer-controlled MIME type or file extension;
- * - the byte count is measured while streaming, never read from a client-supplied length;
- * - the returned `path` is an opaque `attachment:<uuid>` capability id, not a filesystem path, so a
- *   renderer never learns where the upload root is and cannot name a file it did not upload.
- *   `claim()` is what exchanges those ids for real paths, server-side.
- *
- * **What `claim()` guarantees.** Exactly once per registered attachment, and only if the file is
- * still the same file: `lstat` must report a regular non-symlink whose `dev`/`ino`/`size` and
- * recorded modification/change timestamps match, and `realpath` must equal the recorded path
- * (so neither the file nor any parent directory was swapped for a symlink between upload and run
- * start). Legacy sidecars establish their timestamp baseline on first verified read. Every
- * claimed attachment must belong to one batch, so the single `batchDirectory` a host grants the
- * agent read access to cannot be widened by mixing batches.
- *
- * **Ownership is opt-in and host-attached, not self-asserted.** `register()`'s optional `ownerId`
- * (and `listPendingForOwner`, the discovery method it enables) is never read from anything a
- * renderer sends — a host wires `AttachmentsHttpDeps.resolveOwnerId` to pull it from a channel IT
- * already trusts (its own session-verified principal header, say), never from `req` unauthenticated.
- * A store with no `resolveOwnerId` wired registers every attachment ownerless, and
- * `listPendingForOwner` never returns an ownerless record for any caller — see that method's own doc
- * for why an absent `ownerId` must never become a wildcard match.
- *
- * **Storage lifetime is daemon-lifetime by default, and opt-in restart-surviving.** With
- * `retainAcrossRestarts` left off (the default, and this pack's only behavior before that option
- * existed), `createDiskAttachmentStore` empties its upload directory on construction: files left
- * behind by an interrupted previous process cannot be authenticated against an in-memory registry
- * that no longer exists, so they are removed rather than adopted. Unclaimed uploads also expire by
- * TTL (`pruneExpired`), and a run's claimed files are deleted by `cleanupRun`.
- *
- * That default is wrong for any host whose process restarts while a person is still using the
- * composer. A file-watching dev server restarting the daemon on an unrelated source edit is not a
- * crash, but the construction wipe cannot tell the two apart, so it destroys uploads the user is
- * about to send — real data loss, not a tidy-up. `retainAcrossRestarts: true` replaces "wipe
- * everything, always" with "adopt exactly what can still be authenticated": see
- * {@link prepareAttachmentStorage} for the whole mechanism and {@link loadPersistedAttachments} for
- * why an adopted record is no less trusted than one this process registered itself.
- *
- * **This pack does not auto-wire itself into a run's lifecycle**, because no generic hook for that
- * exists — the same deliberate choice `@jini-ai/daemon`'s `createRunScopedContextStore` makes. A
- * host claims in its own `onRunStarted` and cleans up in a `finally`, roughly:
- *
- * ```ts
- * const store = await createDiskAttachmentStore({ uploadDirectory });
- * // ... httpExtensions: [(app, { adapter }) => registerAttachmentRoutes({ app, deps: { store }, adapter })]
- * onRunStarted: (context) => {
- *   void (async () => {
- *     try {
- *       const claimed = await store.claim({ attachments: attachmentRefsFrom(context.request), runId: context.run.id });
- *       await executor.run({
- *         runId: context.run.id,
- *         // ... prompt, cwd, agentId
- *       }, {
- *         ...(claimed.batchDirectory === undefined ? {} : {
- *           imagePaths: claimed.attachments.filter((a) => a.kind === 'image').map((a) => a.path),
- *           extraAllowedDirs: [claimed.batchDirectory],
- *           uploadRoot: claimed.batchDirectory,
- *         }),
- *       });
- *     } finally {
- *       await store.cleanupRun({ runId: context.run.id });
- *     }
- *   })();
- * }
- * ```
- *
- * `imagePaths`/`extraAllowedDirs`/`uploadRoot` are pre-existing `AgentExecutor.run()` options; this
- * module only produces real values for them.
- *
- * **Body-parser ordering (`POST` reads the raw request stream).** The upload route streams
- * `request` straight to disk, so any body-parsing middleware that has already consumed the stream
- * leaves nothing to write. The classic way to hit this is a JSON body parser mounted app-wide: a
- * user drops a `.json` file, the browser sets `content-type: application/json`, and
- * `express.json()` eats the body — which without a guard shows up as the deeply unhelpful
- * "attachment is empty". `registerAttachmentRoutes` detects an already-consumed stream up front and
- * reports it as a host misconfiguration (`'attachment-body-consumed'`) instead of failing silently.
- * Mount this pack before any global body parser, or scope the parser so it skips this path.
- *
- * **SEC-005 redaction**: a store failure can carry filesystem paths a caller must not see, so
- * anything that is not an explicitly-classified `AttachmentRejectedError` becomes a
- * correlation-id-bearing generic `INTERNAL_ERROR`, with the real error reaching a host-owned sink —
- * the same `reportInternalError` shape `media.ts`/`delegated-tools.ts` use.
- */
 import { type FileHandle } from 'node:fs/promises';
 import type { Express, Request, Response } from 'express';
 import type { AdapterContext } from '@jini-ai/http-kit';
@@ -688,6 +587,8 @@ export interface AttachmentsInternalErrorContext {
 }
 export interface AttachmentsHttpDeps {
     readonly store: AttachmentStore;
+    /** Host busy lease follows handler completion, including cleanup after an aborted response. */
+    readonly acquireActivity?: () => () => void;
     /**
      * Uploads accepted at once before further requests are rate-limited. Bounds concurrent
      * filesystem work, which matters because each in-flight upload holds an open handle and may be

package/dist/http/attachments.js

@@ -99,6 +99,8 @@
  * correlation-id-bearing generic `INTERNAL_ERROR`, with the real error reaching a host-owned sink —
  * the same `reportInternalError` shape `media.ts`/`delegated-tools.ts` use.
  */
+import { inspect } from 'node:util';
+import { redactSecrets } from '@jini-ai/core';
 import { chmod, copyFile, lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rm, rmdir } from 'node:fs/promises';
 import { randomUUID } from 'node:crypto';
 import { basename, dirname, extname, resolve } from 'node:path';
@@ -971,7 +973,7 @@ export async function createDiskAttachmentStore(requiredArgs, optionalArgs = {})
 export const ATTACHMENTS_ROUTE_PATH = '/api/attachments';
 function defaultInternalErrorSink(context) {
     // eslint-disable-next-line no-console
-    console.error(`[@jini-ai/http-kit] internal error (${context.source}, correlationId=${context.correlationId})`, context.error);
+    console.error(`[@jini-ai/http-kit] internal error (${context.source}, correlationId=${context.correlationId})`, redactSecrets({ input: inspect(context.error) }, { redactPii: false }));
 }
 function reportInternalError(deps, source, error, batchId) {
     const correlationId = randomUUID();
@@ -1135,7 +1137,9 @@ export function registerAttachmentRoutes({ app, deps, adapter }, _optional = {})
     // second host) must not share one upload budget.
     const state = { activeUploads: 0 };
     app.post(ATTACHMENTS_ROUTE_PATH, async (req, res) => {
+        let release;
         try {
+            release = deps.acquireActivity?.();
             if (!passesOriginGuard(req, res, deps, adapter))
                 return;
             await handleAttachmentUpload({ req, res, deps, state });
@@ -1151,9 +1155,14 @@ export function registerAttachmentRoutes({ app, deps, adapter }, _optional = {})
             if (!res.headersSent)
                 respondToUploadFailure(res, deps, error, null, 'attachment-upload');
         }
+        finally {
+            release?.();
+        }
     });
     app.delete(ATTACHMENTS_ROUTE_PATH, async (req, res) => {
+        let release;
         try {
+            release = deps.acquireActivity?.();
             if (!passesOriginGuard(req, res, deps, adapter))
                 return;
             await handleAttachmentCleanup({ req, res, deps });
@@ -1162,6 +1171,9 @@ export function registerAttachmentRoutes({ app, deps, adapter }, _optional = {})
             if (!res.headersSent)
                 sendApiError({ res, status: 500, error: reportInternalError(deps, 'attachment-cleanup', error, null) });
         }
+        finally {
+            release?.();
+        }
     });
 }
 //# sourceMappingURL=attachments.js.map

package/dist/http/connectors.js

@@ -44,6 +44,8 @@
  *   to the provider.
  * - `RealtimeProvider.subscribe` has no route here — see the realtime section below for why.
  */
+import { inspect } from 'node:util';
+import { redactSecrets } from '@jini-ai/core';
 import { randomUUID } from 'node:crypto';
 import { createApiError } from '@jini-ai/protocol';
 import { ClientFacingError, defineJsonRoute, mountJsonRoute } from '@jini-ai/http-kit';
@@ -53,7 +55,7 @@ import { err, ok } from '@jini-ai/http-kit';
 const BODY_NOT_OBJECT_MESSAGE = 'body must be a JSON object';
 function defaultInternalErrorSink(context) {
     // eslint-disable-next-line no-console
-    console.error(`[@jini-ai/http-kit] internal error (connectors/${context.source}.${context.operation}, correlationId=${context.correlationId})`, context.error);
+    console.error(`[@jini-ai/http-kit] internal error (connectors/${context.source}.${context.operation}, correlationId=${context.correlationId})`, redactSecrets({ input: inspect(context.error) }, { redactPii: false }));
 }
 function notConfiguredError(capability) {
     return createApiError({ code: 'NOT_CONFIGURED', message: `${capability} provider not configured` });

package/dist/http/db-ops.js

@@ -36,6 +36,8 @@
  * boundary — see {@link denyAllDaemonDbPolicy}'s doc for why the default
  * policy denies every call rather than allowing one.
  */
+import { inspect } from 'node:util';
+import { redactSecrets } from '@jini-ai/core';
 import { randomUUID } from 'node:crypto';
 import { createApiError } from '@jini-ai/protocol';
 import { defineJsonRoute, mountJsonRoute } from '@jini-ai/http-kit';
@@ -116,7 +118,7 @@ export function createDaemonDbToolRegistrations(requiredArgs, optionalArgs = {})
 }
 function defaultDaemonDbInternalErrorSink(context) {
     // eslint-disable-next-line no-console
-    console.error(`[@jini-ai/http-kit] internal error (${context.source}, correlationId=${context.correlationId})`, context.error);
+    console.error(`[@jini-ai/http-kit] internal error (${context.source}, correlationId=${context.correlationId})`, redactSecrets({ input: inspect(context.error) }, { redactPii: false }));
 }
 /** Every DB-ops call gets its own opaque, single-use `RunRef` — these are one-off operations requests, not steps of a longer-lived agent run, so there is no real run to attach the audit trail to. */
 function freshRun() {

package/dist/http/delegated-tools.d.ts

@@ -37,6 +37,8 @@ export interface DelegatedToolExecuteResponse {
  */
 export interface DelegatedToolsInternalErrorContext {
     readonly source: 'delegated-tool-execute' | 'resolve-principal';
+    /** Optional host-loaded recovery facts; the host describer must redact these as usual. */
+    readonly recoveryMessage?: string;
     readonly runId: string;
     readonly toolId: string;
     readonly correlationId: string;
@@ -50,6 +52,16 @@ export interface DelegatedToolsInternalErrorContext {
     readonly status?: 'timed-out' | 'cancelled' | 'failed';
 }
 export interface DelegatedToolsHttpDeps {
+    /** One bounded read after an interrupted call, for hosts whose jobs live in another process.
+     * Must authorize with the supplied principal, never execute a write/retry, and impose its own
+     * deadline. A throw is contained; absent facts remain unknown. No calls on the success path.
+     */
+    readonly recoverInterruptedTool?: (required: {
+        principal: Principal;
+        runId: string;
+        toolId: string;
+        result: ToolExecutionResult;
+    }) => Promise<string | undefined>;
     /** The same negotiated digest store supplied to the run lifecycle and agent executor. */
     readonly delegatedResultCorrelation?: DelegatedResultCorrelation;
     readonly lifecycle: RunLifecycle;
@@ -70,7 +82,7 @@ export interface DelegatedToolsHttpDeps {
      * call it cannot verify is refused outright (the configured refusal message), never
      * waived. Unconstrained calls behave identically with or without it.
      */
-    readonly toolRegistry?: ToolRegistry;
+    readonly toolRegistry?: Pick<ToolRegistry, 'list'>;
     /**
      * Host opt-in: returns `true` for a `failed` result whose `error` text the HOST has already made
      * safe to show the model — secret values blanked, an error id minted — so this route answers it