@jini-ai/daemon 0.6.19 → 0.6.22

package/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.6.22
+
+- Child stdout can be framed and sanitized line by line before parsing. A timed-out or cancelled delegated tool can report host-loaded recovery facts through `recoverInterruptedTool`, with no retry.
+
 ## 0.6.19
 
 - `DelegatedToolsHttpDeps.toolRegistry` takes a list-only registry view (`Pick<ToolRegistry, 'list'>`): the route only reads descriptors, and hosts pass descriptor-only facades.

package/dist/agent-executor/events.d.ts

@@ -11,7 +11,7 @@ import type { ChildDrivenStreamFormat, TerminateChildTreeDeps, AgentCleanupFailu
 /** Default sink when a host does not supply `onCleanupFailure`: still observable, never silent. Redacted per SEC-007 (a spawn/permission error can embed paths/host detail). */
 export declare function defaultCleanupFailureSink(context: AgentCleanupFailureContext): void;
 /**
- * Default ceiling on the `'until-close'` stdout accumulator (see `RuntimeStdoutPolicy` in
+ * Default ceiling on the `'until-close'` or per-line stdout accumulator (see `RuntimeStdoutPolicy` in
  * `@jini-ai/agent-runtime`), in bytes of received UTF-8.
  *
  * A buffered def holds its child's entire stdout in one in-memory string until the process closes,
@@ -20,8 +20,8 @@ export declare function defaultCleanupFailureSink(context: AgentCleanupFailureCo
  * nothing obliges it to ever close or to stop emitting. Without a ceiling one run could exhaust the
  * daemon's heap and take every unrelated run in the process down with it.
  *
- * 8 MiB is chosen to sit far above any real buffered-agent transcript (antigravity's print-mode
- * output — the only `'until-close'` def — is a few KiB of auth prompt and result text) while staying
+ * 8 MiB was chosen to sit far above the original buffered print-mode auth prompt and result text
+ * (a few KiB) while staying
  * small enough that a hostile child cannot meaningfully pressure the heap. A host that genuinely
  * needs more passes `CreateAgentExecutorOptions.bufferedStdoutMaxBytes`.
  */
@@ -101,13 +101,15 @@ interface WireChildLifecycleContext extends TerminateChildTreeDeps {
  *
  * *When* those chunks leave is the def's call, via `def.stdoutPolicy`:
  *
- *   - `'live'` (the default, and every def but antigravity) — emit per
+ *   - `'live'` (the default) — emit per
  *     chunk, as it arrives.
  *   - `'until-close'` — accumulate, and emit the whole thing exactly once
  *     from the `close` handler, after `def.stdoutPolicy.sanitize`. For an
  *     adapter that can print a secret to stdout and still exit 0, no
  *     per-chunk decision is safe: the pattern to redact can straddle two
  *     `'data'` events.
+ *   - `'line'` — sanitize each bounded complete wire line before both raw delivery and parsing;
+ *     retain only its partial tail. Secrets split across chunks stay private without waiting for exit.
  *
  * The buffered path holds back the raw `'stdout'` echo too, not just the
  * `'agent'`/`text_delta`, and sanitizes both. Emitting an unsanitized raw

package/dist/agent-executor/events.js

@@ -1,6 +1,7 @@
 import { createToolResultDiagnosticProjection, projectDiagnosticFrame } from '../tool-result-diagnostics.js';
 import { appendSerialTask } from "@jini-ai/core/primitives";
 import { createLiveSessionState } from './live-session-state.js';
+import { createSanitizedLineStream } from './sanitized-line-stream.js';
 import { acceptsMidRunUserMessages, createMessageRelay } from './message-relay.js';
 import { randomUUID } from 'node:crypto';
 import { createModelReceiptTracker } from './model-receipts.js';
@@ -186,7 +187,7 @@ function receivedJournalEntry(channel, content) {
     return { content, provenance: { source: 'agent', channel }, trust: 'untrusted' };
 }
 /**
- * Default ceiling on the `'until-close'` stdout accumulator (see `RuntimeStdoutPolicy` in
+ * Default ceiling on the `'until-close'` or per-line stdout accumulator (see `RuntimeStdoutPolicy` in
  * `@jini-ai/agent-runtime`), in bytes of received UTF-8.
  *
  * A buffered def holds its child's entire stdout in one in-memory string until the process closes,
@@ -195,8 +196,8 @@ function receivedJournalEntry(channel, content) {
  * nothing obliges it to ever close or to stop emitting. Without a ceiling one run could exhaust the
  * daemon's heap and take every unrelated run in the process down with it.
  *
- * 8 MiB is chosen to sit far above any real buffered-agent transcript (antigravity's print-mode
- * output — the only `'until-close'` def — is a few KiB of auth prompt and result text) while staying
+ * 8 MiB was chosen to sit far above the original buffered print-mode auth prompt and result text
+ * (a few KiB) while staying
  * small enough that a hostile child cannot meaningfully pressure the heap. A host that genuinely
  * needs more passes `CreateAgentExecutorOptions.bufferedStdoutMaxBytes`.
  */
@@ -283,13 +284,15 @@ function createStdoutDiagnostics({ ctx, enqueueEmit }, _options = {}) {
  *
  * *When* those chunks leave is the def's call, via `def.stdoutPolicy`:
  *
- *   - `'live'` (the default, and every def but antigravity) — emit per
+ *   - `'live'` (the default) — emit per
  *     chunk, as it arrives.
  *   - `'until-close'` — accumulate, and emit the whole thing exactly once
  *     from the `close` handler, after `def.stdoutPolicy.sanitize`. For an
  *     adapter that can print a secret to stdout and still exit 0, no
  *     per-chunk decision is safe: the pattern to redact can straddle two
  *     `'data'` events.
+ *   - `'line'` — sanitize each bounded complete wire line before both raw delivery and parsing;
+ *     retain only its partial tail. Secrets split across chunks stay private without waiting for exit.
  *
  * The buffered path holds back the raw `'stdout'` echo too, not just the
  * `'agent'`/`text_delta`, and sanitizes both. Emitting an unsanitized raw
@@ -364,12 +367,25 @@ export function wireChildLifecycle(ctx) {
     let bridgeChecked = !ctx.expectsJiniBridge;
     let bridgeUnavailable = false;
     // `def.stdoutPolicy` read once, up front, so the per-chunk handler below is a single boolean
-    // test rather than a repeated union narrowing. `undefined` (every def but antigravity) means
+    // test rather than a repeated union narrowing. `undefined` means
     // live — see this function's own doc.
     const stdoutPolicy = def.stdoutPolicy;
     const bufferStdoutUntilClose = stdoutPolicy?.buffering === 'until-close';
     const sanitizeBufferedStdout = stdoutPolicy?.buffering === 'until-close' ? stdoutPolicy.sanitize : undefined;
-    // Accumulator for the `'until-close'` path. Stays `''` for every live def, and the flush below
+    const lineStdout = stdoutPolicy?.buffering === 'line' ? createSanitizedLineStream({
+        maxBytes: ctx.bufferedStdoutMaxBytes, sanitize: stdoutPolicy.sanitize,
+        emit: ({ text }) => {
+            stdoutDiagnostics.feed({ text });
+            if (streamFormat === 'plain')
+                enqueueEmit(() => lifecycle.emit({ runId, input: { event: 'agent', data: { type: 'text_delta', delta: text } } }));
+            else
+                streamHandler?.feed({ chunk: text });
+        },
+        onOverflow: ({ bytes }) => enqueueEmit(() => lifecycle.emit({ runId, input: { event: 'error', data: {
+                    message: bufferedStdoutTruncationNotice(bytes, ctx.bufferedStdoutMaxBytes),
+                } } })),
+    }) : undefined;
+    // Accumulator for the `'until-close'` path. Stays `''` for live and line policies, and the flush below
     // is then a no-op that emits nothing. Bounded by `ctx.bufferedStdoutMaxBytes` — see
     // {@link DEFAULT_BUFFERED_STDOUT_MAX_BYTES} for why an unbounded accumulator was a
     // denial-of-service surface rather than merely untidy.
@@ -647,6 +663,10 @@ export function wireChildLifecycle(ctx) {
     child.stdout?.on('data', (chunk) => {
         const text = chunk.toString('utf8');
         stdoutDiagnostics.record({ chunk, text });
+        if (lineStdout) {
+            lineStdout.feed({ chunk: text });
+            return;
+        }
         if (streamFormat === 'plain' && text.length > 0)
             userVisibleOutputSeen = true;
         if (bufferStdoutUntilClose) {
@@ -716,6 +736,7 @@ export function wireChildLifecycle(ctx) {
                 controlScanBuffer = '';
             }
             flushBufferedStdout();
+            lineStdout?.flush({});
             streamHandler?.flush();
             session.endSession();
             stdoutDiagnostics.flush();

package/dist/agent-executor/sanitized-line-stream.d.ts

@@ -0,0 +1,24 @@
+/** Frame and sanitize stdout before either parser or raw-event delivery.
+ * @param required - Host byte cap, pure sanitizer and delivery/error sinks.
+ * @returns A per-process stream; flush delivers a final unterminated line once.
+ * @complexity O(n) time for n wire characters, O(maxBytes) retained text plus incoming chunk slices.
+ * @example const stream = createSanitizedLineStream({ maxBytes: 4096, sanitize, emit, onOverflow });
+ */
+export declare function createSanitizedLineStream({ maxBytes, sanitize, emit, onOverflow }: {
+    maxBytes: number;
+    sanitize: (required: {
+        fullText: string;
+    }) => string;
+    emit: (required: {
+        text: string;
+    }, optional?: Record<string, never>) => void;
+    onOverflow: (required: {
+        bytes: number;
+    }, optional?: Record<string, never>) => void;
+}, _options?: Record<string, never>): {
+    feed(required: {
+        chunk: string;
+    }, optional?: Record<string, never>): void;
+    flush(required: Record<string, never>, optional?: Record<string, never>): void;
+};
+//# sourceMappingURL=sanitized-line-stream.d.ts.map

package/dist/agent-executor/sanitized-line-stream.js

@@ -0,0 +1,45 @@
+/** Frame and sanitize stdout before either parser or raw-event delivery.
+ * @param required - Host byte cap, pure sanitizer and delivery/error sinks.
+ * @returns A per-process stream; flush delivers a final unterminated line once.
+ * @complexity O(n) time for n wire characters, O(maxBytes) retained text plus incoming chunk slices.
+ * @example const stream = createSanitizedLineStream({ maxBytes: 4096, sanitize, emit, onOverflow });
+ */
+export function createSanitizedLineStream({ maxBytes, sanitize, emit, onOverflow }, _options = {}) {
+    let parts = [];
+    let bytes = 0;
+    let overflow = false;
+    /** One line's fragments retain at most maxBytes; an oversized line is discarded through its end. */
+    function append(text) {
+        if (!text)
+            return;
+        bytes += Buffer.byteLength(text, 'utf8');
+        if (bytes > maxBytes) {
+            parts = [];
+            overflow = true;
+        }
+        if (!overflow)
+            parts.push(text);
+    }
+    /** Delivery happens once per completed line, or once for the final unterminated tail. */
+    function flush(newline) {
+        if (overflow)
+            onOverflow({ bytes });
+        else if (bytes > 0 || newline)
+            emit({ text: sanitize({ fullText: parts.join('') + newline }) });
+        parts = [];
+        bytes = 0;
+        overflow = false;
+    }
+    return {
+        feed({ chunk }, _optional = {}) {
+            const lines = chunk.split('\n');
+            lines.forEach((line, index) => {
+                append(line);
+                if (index < lines.length - 1)
+                    flush('\n');
+            });
+        },
+        flush(_required, _optional = {}) { flush(''); },
+    };
+}
+//# sourceMappingURL=sanitized-line-stream.js.map

package/dist/http/delegated-tools.d.ts

@@ -37,6 +37,8 @@ export interface DelegatedToolExecuteResponse {
  */
 export interface DelegatedToolsInternalErrorContext {
     readonly source: 'delegated-tool-execute' | 'resolve-principal';
+    /** Optional host-loaded recovery facts; the host describer must redact these as usual. */
+    readonly recoveryMessage?: string;
     readonly runId: string;
     readonly toolId: string;
     readonly correlationId: string;
@@ -50,6 +52,16 @@ export interface DelegatedToolsInternalErrorContext {
     readonly status?: 'timed-out' | 'cancelled' | 'failed';
 }
 export interface DelegatedToolsHttpDeps {
+    /** One bounded read after an interrupted call, for hosts whose jobs live in another process.
+     * Must authorize with the supplied principal, never execute a write/retry, and impose its own
+     * deadline. A throw is contained; absent facts remain unknown. No calls on the success path.
+     */
+    readonly recoverInterruptedTool?: (required: {
+        principal: Principal;
+        runId: string;
+        toolId: string;
+        result: ToolExecutionResult;
+    }) => Promise<string | undefined>;
     /** The same negotiated digest store supplied to the run lifecycle and agent executor. */
     readonly delegatedResultCorrelation?: DelegatedResultCorrelation;
     readonly lifecycle: RunLifecycle;

package/dist/http/delegated-tools.js

@@ -130,7 +130,7 @@ function parseDelegatedToolExecute(input) {
  * vouches for this exact result via `deps.isModelSafeToolFailure` (it has already redacted the text
  * itself), in which case it is a `422 TOOL_EXECUTION_FAILED` carrying the host's text verbatim.
  */
-function toolExecutionResultToApiResult(deps, { runId, toolId, result }) {
+function toolExecutionResultToApiResult(deps, { runId, toolId, result, recoveryMessage }) {
     switch (result.status) {
         case 'completed': {
             const outcome = batchOutcomeFor({ output: result.output });
@@ -143,7 +143,7 @@ function toolExecutionResultToApiResult(deps, { runId, toolId, result }) {
             return err({ error: createApiError({ code: 'TOOL_OPERATION_DENIED', message: 'this operation was denied during confirmation' }) });
         case 'timed-out':
         case 'cancelled':
-            return err({ error: reportInternalError(deps, { source: 'delegated-tool-execute', error: result.status, runId, toolId, status: result.status }) });
+            return err({ error: reportInternalError(deps, { source: 'delegated-tool-execute', error: result.status, runId, toolId, ...(recoveryMessage ? { recoveryMessage } : {}), status: result.status }) });
         case 'failed':
             return err({ error: failedResultToApiError(deps, { runId, toolId, result }) });
         default: {
@@ -163,6 +163,21 @@ function failedResultToApiError(deps, { runId, toolId, result }) {
     }
     return reportInternalError(deps, { source: 'delegated-tool-execute', error: result.error ?? result.status, runId, toolId, status: 'failed' });
 }
+/** Read host-owned recovery facts once after interruption. The host supplies the deadline and
+ * permission-checked read; a failed read never replaces or retries the original operation.
+ * @complexity One optional bounded read; no extra work on successful executions.
+ */
+async function toolExecutionResultWithRecovery(deps, required) {
+    const { principal, runId, toolId, result } = required;
+    let recoveryMessage;
+    if (result.status === 'timed-out' || result.status === 'cancelled') {
+        try {
+            recoveryMessage = await deps.recoverInterruptedTool?.({ principal, runId, toolId, result });
+        }
+        catch { /* Recovery cannot change the interrupted write or expose its own failure. */ }
+    }
+    return toolExecutionResultToApiResult(deps, { runId, toolId, result, ...(recoveryMessage ? { recoveryMessage } : {}) });
+}
 /**
  * `POST /api/delegated-tool-calls` — executes one delegated tool call against an already-started
  * run. Maps `ToolExecutionResult.status` to the HTTP response via `toolExecutionResultToApiResult`
@@ -224,7 +239,7 @@ export const delegatedToolExecuteRoute = defineJsonRoute({
                 input: input.input,
                 ...(signal !== undefined ? { signal } : {}),
             });
-            return toolExecutionResultToApiResult(deps, { runId: input.runId, toolId: input.toolId, result });
+            return toolExecutionResultWithRecovery(deps, { principal, runId: input.runId, toolId: input.toolId, result });
         }
         catch (error) {
             if (error instanceof ToolInputError) {

package/dist/tool-recovery/redaction.d.ts

@@ -77,6 +77,7 @@ export declare function isRedactedToolFailure({ result }: {
  * compiles against a published http-kit that predates `status`.
  */
 export interface DelegatedInternalErrorContext {
+    readonly recoveryMessage?: string;
     readonly source: string;
     readonly runId: string;
     readonly toolId: string;

package/dist/tool-recovery/redaction.js

@@ -97,7 +97,10 @@ function delegatedInternalErrorReason(context) {
  * @complexity O(reason length) for the redaction pass.
  */
 export function describeDelegatedInternalError({ context, ...deps }, _optional = {}) {
-    const { text, redactions } = deps.redactSecretShapes({ text: delegatedInternalErrorReason(context) });
+    let reason = delegatedInternalErrorReason(context);
+    if ((context.status === "timed-out" || context.status === "cancelled") && context.recoveryMessage)
+        reason = context.recoveryMessage;
+    const { text, redactions } = deps.redactSecretShapes({ text: reason });
     const errorId = deps.mintErrorId();
     safeOnFailure(deps.onFailure, {
         errorId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/daemon",
-  "version": "0.6.19",
+  "version": "0.6.22",
   "description": "The stateful agent daemon runtime: run lifecycle, durable event-log port, the tool-execution boundary, agent executor, terminal sessions, and routines.",
   "license": "Apache-2.0",
   "repository": {
@@ -153,22 +153,22 @@
     "express": "^4.21.0",
     "@types/express": "^4.17.21",
     "@jini-ai/db": "0.6.19",
-    "@jini-ai/agent-runtime": "^0.6.19",
-    "@jini-ai/chat": "0.6.19",
-    "@jini-ai/core": "^0.6.19",
-    "@jini-ai/platform": "^0.6.19",
-    "@jini-ai/http-kit": "0.6.19",
-    "@jini-ai/protocol": "^0.6.19"
+    "@jini-ai/agent-runtime": "^0.6.22",
+    "@jini-ai/chat": "0.6.22",
+    "@jini-ai/core": "^0.6.22",
+    "@jini-ai/protocol": "^0.6.19",
+    "@jini-ai/platform": "^0.6.22",
+    "@jini-ai/http-kit": "0.6.22"
   },
   "dependencies": {
     "smol-toml": "1.9.1",
     "kysely": "^0.29.6",
-    "@jini-ai/core": "^0.6.19",
+    "@jini-ai/core": "^0.6.22",
     "@jini-ai/protocol": "^0.6.19",
-    "@jini-ai/agent-runtime": "^0.6.19",
     "@jini-ai/db": "^0.6.19",
-    "@jini-ai/platform": "^0.6.19",
-    "@jini-ai/http-kit": "^0.6.19"
+    "@jini-ai/agent-runtime": "^0.6.22",
+    "@jini-ai/platform": "^0.6.22",
+    "@jini-ai/http-kit": "^0.6.22"
   },
   "peerDependencies": {
     "node-pty": "^1.1.0",