@jini-ai/daemon 0.6.2 → 0.6.4

package/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 0.6.4 — 2026-10-13
+
+- ACP runs forward the run's `permissionMode` to `attachAcpSession`, so a `bypass` run allows each ACP tool request once and a restricted run rejects it, instead of failing on the first permission request. Peer `@jini-ai/agent-runtime` floor is now `^0.4.10`.
+
+## 0.6.3 — 2026-10-13
+
+- `createAgentExecutor` accepts `codexDisablePlugins` and `piGracefulShutdownMs`; absent, they resolve once from `hostEnv` (`CODEX_DISABLE_PLUGINS`, `PI_GRACEFUL_SHUTDOWN_MS`). Peer `@jini-ai/agent-runtime` floor is now `^0.4.7`.
+
 ## 0.6.2 — 2026-10-13
 
 - Agent executor and host tools import `@jini-ai/platform/command` and `/process` instead of the platform root; peer `@jini-ai/platform` floor is now `^0.5.5`. No behavior change.

package/dist/agent-executor/contracts.d.ts

@@ -575,6 +575,10 @@ export interface CreateAgentExecutorOptions {
     /** Host environment snapshot; baseline spawn keys and source config paths are allowlisted. */
     readonly hostEnv?: NodeJS.ProcessEnv;
     readonly runtimeState?: AgentRuntimeState;
+    /** Host policy; native executor composition resolves its env default when absent. */
+    readonly codexDisablePlugins?: boolean;
+    /** Post-completion pi RPC grace period, resolved once at native composition. */
+    readonly piGracefulShutdownMs?: number;
     readonly lifecycle: RunLifecycle;
     /** Resolves/pins the concrete starting model against the actual launch scope. */
     readonly resolveModelForLaunch?: typeof resolveModelForLaunch;

package/dist/agent-executor/events.d.ts

@@ -158,6 +158,7 @@ interface RunAcpDispatchInput {
     readonly child: ChildProcess;
     readonly prompt: string;
     readonly cwd: string;
+    readonly permissionMode: 'bypass' | 'restricted' | undefined;
     readonly model: string | undefined;
     readonly modelCatalog?: ModelCatalogSnapshot;
     readonly imagePaths: readonly string[];

package/dist/agent-executor/events.js

@@ -892,7 +892,7 @@ function wireAcpLifecycle(ctx) {
             if (event === 'error') {
                 enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'error', data: translateAcpError(payload) } }));
             }
-        } }, { cwd: ctx.cwd, ...(ctx.model !== undefined ? { model: ctx.model } : {}), ...(ctx.imagePaths.length > 0 ? { imagePaths: [...ctx.imagePaths] } : {}), ...(ctx.envFormat !== undefined ? { envFormat: ctx.envFormat } : {}),
+        } }, { cwd: ctx.cwd, ...(ctx.permissionMode !== undefined ? { permissionMode: ctx.permissionMode } : {}), ...(ctx.model !== undefined ? { model: ctx.model } : {}), ...(ctx.imagePaths.length > 0 ? { imagePaths: [...ctx.imagePaths] } : {}), ...(ctx.envFormat !== undefined ? { envFormat: ctx.envFormat } : {}),
         // Spread-when-present rather than always: passing `mcpServers: []` is not the same as passing
         // nothing for every downstream ACP agent, and "no bridge configured" must stay byte-identical
         // to before this field existed.
@@ -1045,6 +1045,7 @@ export async function runAcpDispatch({ input, deps }) {
             lifecycle: deps.lifecycle,
             prompt: input.prompt,
             cwd: input.cwd,
+            permissionMode: input.permissionMode,
             model: input.model,
             ...(input.modelCatalog ? { modelCatalog: input.modelCatalog } : {}),
             imagePaths: input.imagePaths,

package/dist/agent-executor/launch.d.ts

@@ -379,6 +379,6 @@ export declare function confirmChildSpawned({ input, deps }: {
  * @complexity `run()`'s own setup is O(1); steady-state cost is the chosen stream parser's.
  * @overallScore 100/100
  */
-export declare function createAgentExecutor(requiredArgs: Pick<CreateAgentExecutorOptions, "lifecycle">, optionalArgs?: Pick<CreateAgentExecutorOptions, "runtimeState" | "hostEnv" | "getAgentDef" | "resolveAgentLaunch" | "resolveModelForLaunch" | "ensureAgentCapabilities" | "applyAgentLaunchEnv" | "createCommandInvocation" | "spawn" | "attachAcpSession" | "acpPermissionHandler" | "attachPiRpcSession" | "preparePromptFileForAgent" | "prepareAgentLogFile" | "listProcessSnapshots" | "collectProcessTreePids" | "stopProcesses" | "onCleanupFailure" | "journal" | "continuation" | "classifyFailure" | "mcpJsonInjection" | "claudeConfigDirIsolation" | "claudeConfigDirIsolationEnabled" | "bufferedStdoutMaxBytes" | "promptAugmenter">): AgentExecutor;
+export declare function createAgentExecutor(requiredArgs: Pick<CreateAgentExecutorOptions, "lifecycle">, optionalArgs?: Pick<CreateAgentExecutorOptions, "runtimeState" | "codexDisablePlugins" | "piGracefulShutdownMs" | "hostEnv" | "getAgentDef" | "resolveAgentLaunch" | "resolveModelForLaunch" | "ensureAgentCapabilities" | "applyAgentLaunchEnv" | "createCommandInvocation" | "spawn" | "attachAcpSession" | "acpPermissionHandler" | "attachPiRpcSession" | "preparePromptFileForAgent" | "prepareAgentLogFile" | "listProcessSnapshots" | "collectProcessTreePids" | "stopProcesses" | "onCleanupFailure" | "journal" | "continuation" | "classifyFailure" | "mcpJsonInjection" | "claudeConfigDirIsolation" | "claudeConfigDirIsolationEnabled" | "bufferedStdoutMaxBytes" | "promptAugmenter">): AgentExecutor;
 export {};
 //# sourceMappingURL=launch.d.ts.map

package/dist/agent-executor/launch.js

@@ -179,13 +179,18 @@ function resolveAgentRuntimeDeps(options) {
     return {
         getAgentDef: (input) => {
             const def = lookupDef(input);
-            return def && options.runtimeState ? bindRuntimeAgentDef({ def, state: options.runtimeState }) : def;
+            // Without owned state, only an enabled plugin policy needs binding; otherwise keep the published definition.
+            if (!def || (!options.runtimeState && !options.codexDisablePlugins))
+                return def;
+            return bindRuntimeAgentDef({ def, state: options.runtimeState ?? defaultRuntimeState }, options.codexDisablePlugins ? { codexDisablePlugins: true } : {});
         },
         resolveAgentLaunch: options.resolveAgentLaunch ?? ((input, optional = {}) => resolveAgentLaunch(input, { ...optional, ...runtimeOptions, ...envOptions })),
         ensureAgentCapabilities: options.ensureAgentCapabilities ?? ((input) => ensureAgentCapabilities(input, runtimeOptions)),
         applyAgentLaunchEnv: options.applyAgentLaunchEnv ?? ((input, optional = {}) => applyAgentLaunchEnv(input, { appendPathDirs: userToolchainBinDirs({}, { ...runtimeOptions, ...envOptions }), ...optional })),
         attachAcpSession: options.attachAcpSession ?? attachAcpSession,
-        attachPiRpcSession: options.attachPiRpcSession ?? attachPiRpcSession,
+        attachPiRpcSession: (required, optional = {}) => (options.attachPiRpcSession ?? attachPiRpcSession)(required, {
+            ...optional, ...(options.piGracefulShutdownMs !== undefined ? { gracefulShutdownMs: options.piGracefulShutdownMs } : {}),
+        }),
         preparePromptFileForAgent: options.preparePromptFileForAgent ?? preparePromptFileForAgent,
         prepareAgentLogFile: options.prepareAgentLogFile ?? prepareAgentLogFile,
     };
@@ -628,7 +633,12 @@ export async function confirmChildSpawned({ input, deps }) {
  * @overallScore 100/100
  */
 export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
-    const options = { ...requiredArgs, ...optionalArgs };
+    // This native composition boundary resolves ambient defaults once, before allowlisting child env.
+    const env = optionalArgs.hostEnv ?? process.env;
+    const options = { ...requiredArgs, ...optionalArgs,
+        codexDisablePlugins: optionalArgs.codexDisablePlugins ?? (env.CODEX_DISABLE_PLUGINS === '1'),
+        piGracefulShutdownMs: optionalArgs.piGracefulShutdownMs ?? (Number(env.PI_GRACEFUL_SHUTDOWN_MS) || 5000),
+    };
     const lifecycle = options.lifecycle;
     const hostEnv = selectAgentExecutorHostEnv({ env: options.hostEnv ?? process.env }, options.runtimeState ? { runtimeState: options.runtimeState } : {});
     const { getAgentDef: getAgentDefFn, resolveAgentLaunch: resolveAgentLaunchFn, ensureAgentCapabilities: ensureAgentCapabilitiesFn, applyAgentLaunchEnv: applyAgentLaunchEnvFn, attachAcpSession: attachAcpSessionFn, attachPiRpcSession: attachPiRpcSessionFn, preparePromptFileForAgent: preparePromptFileForAgentFn, prepareAgentLogFile: prepareAgentLogFileFn, } = resolveAgentRuntimeDeps({ ...options, hostEnv });
@@ -1003,6 +1013,7 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
                     // sending byte-identical text and never receive the overlay twice.
                     prompt: `${overlayDelivery.promptPrefix}${input.prompt}`,
                     cwd: input.cwd,
+                    permissionMode: input.permissionMode,
                     model: input.model,
                     modelCatalog,
                     imagePaths: input.imagePaths ?? [],

package/dist/tool-recovery/redaction.d.ts

@@ -24,7 +24,7 @@
  * for why only the VALUE is ever blanked, never the surrounding text.
  *
  * Architectural role: `src/assistant` composition-layer adapter, same layer as
- * `tool-executor-audit.ts` and `tool-failure-recovery.ts`. Depends only on the Tovu policy
+ * `tool-executor-audit.ts` and `tool-failure-recovery.ts`. Depends only on the host policy
  * adapter over `@jini-ai/diagnostics/redaction/secrets-only` and `@jini-ai/daemon`'s `ToolExecutor` shape.
  */
 import type { ToolExecutionResult, ToolExecutor } from "../tool-executor.js";

package/dist/tool-recovery/redaction.js

@@ -24,7 +24,7 @@
  * for why only the VALUE is ever blanked, never the surrounding text.
  *
  * Architectural role: `src/assistant` composition-layer adapter, same layer as
- * `tool-executor-audit.ts` and `tool-failure-recovery.ts`. Depends only on the Tovu policy
+ * `tool-executor-audit.ts` and `tool-failure-recovery.ts`. Depends only on the host policy
  * adapter over `@jini-ai/diagnostics/redaction/secrets-only` and `@jini-ai/daemon`'s `ToolExecutor` shape.
  */
 /** Matches a minted error ID anywhere in a string — exported for tests and for a later chat-side

package/dist/tool-recovery/stack.d.ts

@@ -1,5 +1,5 @@
 /**
- * @file The one place Tovu's `ToolExecutor` decorator stack is composed.
+ * @file The one place the host's `ToolExecutor` decorator stack is composed.
  *
  * The order of these three wrappers is load-bearing in two different directions, and it was
  * previously spelled out only as an expression inside `agent-daemon-server.ts` — a module that boots
@@ -32,7 +32,7 @@
  *    "completed" row the audit records for the call the transport actually made, losing the remedy
  *    tool's own attempt from the trail entirely.
  *
- * Composed the SAME way for both of Tovu's tool-dispatch surfaces: the agent daemon's delegated-tool
+ * Composed the SAME way for both of the host's tool-dispatch surfaces: the agent daemon's delegated-tool
  * route and BYOK's `byok-tool-surface.ts` (as of 2026-09-06 — previously BYOK hand-assembled its own
  * second copy of this stack that never wrapped `withReadOnlyToolConstraint`, so a decorator known to
  * apply to "every read-only gateway" in fact applied to only one of the two; see that file's own

package/dist/tool-recovery/stack.js

@@ -1,5 +1,5 @@
 /**
- * @file The one place Tovu's `ToolExecutor` decorator stack is composed.
+ * @file The one place the host's `ToolExecutor` decorator stack is composed.
  *
  * The order of these three wrappers is load-bearing in two different directions, and it was
  * previously spelled out only as an expression inside `agent-daemon-server.ts` — a module that boots
@@ -32,7 +32,7 @@
  *    "completed" row the audit records for the call the transport actually made, losing the remedy
  *    tool's own attempt from the trail entirely.
  *
- * Composed the SAME way for both of Tovu's tool-dispatch surfaces: the agent daemon's delegated-tool
+ * Composed the SAME way for both of the host's tool-dispatch surfaces: the agent daemon's delegated-tool
  * route and BYOK's `byok-tool-surface.ts` (as of 2026-09-06 — previously BYOK hand-assembled its own
  * second copy of this stack that never wrapped `withReadOnlyToolConstraint`, so a decorator known to
  * apply to "every read-only gateway" in fact applied to only one of the two; see that file's own

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/daemon",
-  "version": "0.6.2",
+  "version": "0.6.4",
   "description": "The stateful agent daemon runtime: run lifecycle, durable event-log port, the tool-execution boundary, agent executor, terminal sessions, and routines.",
   "license": "Apache-2.0",
   "repository": {
@@ -139,17 +139,17 @@
     "@types/pg": "8.23.1",
     "express": "^4.21.0",
     "@types/express": "^4.17.21",
+    "@jini-ai/agent-runtime": "^0.4.10",
+    "@jini-ai/core": "^0.4.5",
+    "@jini-ai/protocol": "^0.4.4",
+    "@jini-ai/platform": "^0.5.6",
     "@jini-ai/http-kit": "0.4.1",
-    "@jini-ai/chat": "0.5.8",
-    "@jini-ai/agent-runtime": "^0.4.6",
-    "@jini-ai/core": "^0.4.4",
-    "@jini-ai/db": "0.3.3",
-    "@jini-ai/platform": "^0.5.5",
-    "@jini-ai/protocol": "^0.4.4"
+    "@jini-ai/chat": "0.6.2",
+    "@jini-ai/db": "0.3.4"
   },
   "dependencies": {
-    "@jini-ai/core": "^0.4.4",
-    "@jini-ai/protocol": "^0.4.4"
+    "@jini-ai/protocol": "^0.4.4",
+    "@jini-ai/core": "^0.4.5"
   },
   "peerDependencies": {
     "node-pty": "^1.1.0",
@@ -160,7 +160,7 @@
     "pg": "^8.23.0",
     "@jini-ai/http-kit": "^0.4.0",
     "express": "^4.21.0",
-    "@jini-ai/agent-runtime": "^0.4.5",
+    "@jini-ai/agent-runtime": "^0.4.10",
     "@jini-ai/platform": "^0.5.5"
   },
   "peerDependenciesMeta": {