@jini-ai/daemon 0.6.22 → 0.6.23

package/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.6.23
+
+- Security hardening.
+
 ## 0.6.22
 
 - Child stdout can be framed and sanitized line by line before parsing. A timed-out or cancelled delegated tool can report host-loaded recovery facts through `recoverInterruptedTool`, with no retry.

package/dist/agent-executor/codex/home-config.d.ts

@@ -1,4 +1,4 @@
-import type { McpHttpEndpoint, McpJsonServerEntry } from '../contracts.js';
+import type { McpHttpEndpoint, McpJsonServerEntry, McpJsonInjectionOptions } from '../contracts.js';
 /** A TOML key: bare when TOML allows it, quoted otherwise — host-supplied bridge env names are not guaranteed bare-safe. */
 export declare function tomlKey(key: string): string;
 /**
@@ -16,8 +16,9 @@ export declare function tomlKey(key: string): string;
  * @complexity O(n) in the number of argv/env entries.
  * @overallScore 100/100
  */
-export declare function buildCodexMcpServerToml({ entry }: {
+export declare function buildCodexMcpServerToml({ entry, toolApprovalOwner }: {
     readonly entry: McpJsonServerEntry | Pick<McpHttpEndpoint, 'url' | 'token'>;
+    readonly toolApprovalOwner?: McpJsonInjectionOptions['toolApprovalOwner'];
 }, _options?: {}): string;
 /**
  * Builds the full `config.toml` a run's scratch `CODEX_HOME` gets: the real Codex home's own
@@ -42,10 +43,11 @@ export declare function buildCodexMcpServerToml({ entry }: {
  * @returns The full text to write to the scratch `CODEX_HOME`'s `config.toml`.
  * @complexity O(n) in the existing config's length.
  */
-export declare function buildCodexHomeConfigToml({ existingRaw, entry, inheritUserMcp, inheritUserSettings }: {
+export declare function buildCodexHomeConfigToml({ existingRaw, entry, inheritUserMcp, inheritUserSettings, toolApprovalOwner }: {
     readonly existingRaw: string | undefined;
     readonly entry: McpJsonServerEntry | Pick<McpHttpEndpoint, 'url' | 'token'>;
     readonly inheritUserMcp?: boolean;
     readonly inheritUserSettings?: boolean;
+    readonly toolApprovalOwner?: McpJsonInjectionOptions['toolApprovalOwner'];
 }, _optional?: Record<string, never>): string;
 //# sourceMappingURL=home-config.d.ts.map

package/dist/agent-executor/codex/home-config.js

@@ -56,12 +56,13 @@ const CODEX_TOOL_TIMEOUT_SEC = 6 * 60 + 40;
  * @complexity O(n) in the number of argv/env entries.
  * @overallScore 100/100
  */
-export function buildCodexMcpServerToml({ entry }, _options = {}) {
+export function buildCodexMcpServerToml({ entry, toolApprovalOwner }, _options = {}) {
+    const approval = toolApprovalOwner === 'host' ? 'default_tools_approval_mode = "approve"\n' : '';
     if ('url' in entry)
-        return buildCodexHttpMcpServerToml({ endpoint: entry });
+        return buildCodexHttpMcpServerToml({ endpoint: entry }, { approval });
     const argsLiteral = entry.args.map(tomlString).join(', ');
     const serverTable = `[mcp_servers.${JINI_MCP_SERVER_KEY}]\ncommand = ${tomlString(entry.command)}\nargs = [${argsLiteral}]\n` +
-        `tool_timeout_sec = ${CODEX_TOOL_TIMEOUT_SEC}\n`;
+        `tool_timeout_sec = ${CODEX_TOOL_TIMEOUT_SEC}\n${approval}`;
     const envLines = Object.entries(entry.env)
         .filter((pair) => typeof pair[1] === 'string')
         .map(([key, value]) => `${tomlKey(key)} = ${tomlString(value)}`);
@@ -73,9 +74,9 @@ export function buildCodexMcpServerToml({ entry }, _options = {}) {
  * @returns One HTTP table using the existing timeout and TOML escaping owner.
  * @complexity O(endpoint bytes), without I/O.
  */
-function buildCodexHttpMcpServerToml({ endpoint }, _options = {}) {
+function buildCodexHttpMcpServerToml({ endpoint }, { approval = '' } = {}) {
     return `[mcp_servers.${JINI_MCP_SERVER_KEY}]\nurl = ${tomlString(endpoint.url)}\n` +
-        `tool_timeout_sec = ${CODEX_TOOL_TIMEOUT_SEC}\n\n[mcp_servers.${JINI_MCP_SERVER_KEY}.http_headers]\n` +
+        `tool_timeout_sec = ${CODEX_TOOL_TIMEOUT_SEC}\n${approval}\n[mcp_servers.${JINI_MCP_SERVER_KEY}.http_headers]\n` +
         `Authorization = ${tomlString(`Bearer ${endpoint.token}`)}\n`;
 }
 /**
@@ -213,10 +214,10 @@ function stripExistingJiniMcpServerTable(existingRaw, optional = {}) {
  * @returns The full text to write to the scratch `CODEX_HOME`'s `config.toml`.
  * @complexity O(n) in the existing config's length.
  */
-export function buildCodexHomeConfigToml({ existingRaw, entry, inheritUserMcp = true, inheritUserSettings = true }, _optional = {}) {
+export function buildCodexHomeConfigToml({ existingRaw, entry, inheritUserMcp = true, inheritUserSettings = true, toolApprovalOwner }, _optional = {}) {
     const base = stripExistingJiniMcpServerTable(existingRaw ?? '', { allServers: !inheritUserMcp, mcpOnly: !inheritUserSettings });
     const blockBreak = base.endsWith('\n') ? '\n' : '\n\n';
     const separator = base.length === 0 ? '' : blockBreak;
-    return `${base}${separator}${buildCodexMcpServerToml({ entry: entry })}`;
+    return `${base}${separator}${buildCodexMcpServerToml({ entry, toolApprovalOwner })}`;
 }
 //# sourceMappingURL=home-config.js.map

package/dist/agent-executor/codex/home-staging.js

@@ -75,8 +75,8 @@ function resolveCodexHomeSeams(options) {
  * {@link prepareCodexHomeIfNeeded} stays the backstop for every blocked case.
  * @throws {@link CodexMcpIsolationError} when the run can't be isolated.
  */
-function buildStagedCodexConfig({ existingRaw, entry, inheritUserConfig, inheritUserMcp, sourceHome }) {
-    const build = () => buildCodexHomeConfigToml({ existingRaw, entry, inheritUserMcp, inheritUserSettings: inheritUserConfig });
+function buildStagedCodexConfig({ existingRaw, entry, inheritUserConfig, inheritUserMcp, sourceHome, toolApprovalOwner }) {
+    const build = () => buildCodexHomeConfigToml({ existingRaw, entry, inheritUserMcp, inheritUserSettings: inheritUserConfig, toolApprovalOwner });
     if (inheritUserMcp)
         return build();
     const path = join(sourceHome, 'config.toml');
@@ -115,7 +115,7 @@ function buildStagedCodexConfig({ existingRaw, entry, inheritUserConfig, inherit
  * @complexity O(h) filesystem operations for h top-level user-home entries; one staged config write.
  * @overallScore 100/100
  */
-async function prepareCodexHomeForRun(runId, entry, sourceCodexHomeDir, seams, inheritUserConfig = true, inheritUserMcp = true) {
+async function prepareCodexHomeForRun(runId, entry, sourceCodexHomeDir, seams, inheritUserConfig = true, inheritUserMcp = true, toolApprovalOwner) {
     // Stricter than `@jini-ai/agent-runtime`'s `prepareAgentLogFile`/`preparePromptFileForAgent`
     // labels (which keep dots): this prefix stages a directory that ends up holding a copied Codex
     // login credential, so it gets `mcpJsonPathForRun`'s tighter discipline instead — dots stripped
@@ -133,7 +133,7 @@ async function prepareCodexHomeForRun(runId, entry, sourceCodexHomeDir, seams, i
             // matching writeMcpJsonForRun's identical "missing file" handling.
             existingConfigRaw = undefined;
         }
-        const content = buildStagedCodexConfig({ existingRaw: existingConfigRaw, entry, inheritUserConfig, inheritUserMcp, sourceHome: sourceCodexHomeDir });
+        const content = buildStagedCodexConfig({ existingRaw: existingConfigRaw, entry, inheritUserConfig, inheritUserMcp, sourceHome: sourceCodexHomeDir, toolApprovalOwner });
         await seams.writeFile({ path: join(dir, 'config.toml'), content });
         await seams.linkSessionStore({ runHome: dir, sourceHome: sourceCodexHomeDir }, { inheritUserConfig });
     }
@@ -183,7 +183,7 @@ export async function prepareCodexHomeIfNeeded({ input, deps }) {
     }
     const inherit = codexInheritance(input);
     try {
-        return await prepareCodexHomeForRun(input.runId, entry, resolveSourceCodexHomeDir({ hostEnv: deps.hostEnv }), resolveCodexHomeSeams(deps.mcpJsonInjection), inherit.settings, inherit.mcp);
+        return await prepareCodexHomeForRun(input.runId, entry, resolveSourceCodexHomeDir({ hostEnv: deps.hostEnv }), resolveCodexHomeSeams(deps.mcpJsonInjection), inherit.settings, inherit.mcp, deps.mcpJsonInjection.toolApprovalOwner);
     }
     catch (err) {
         await deps.releaseStagedResources();

package/dist/agent-executor/contracts.d.ts

@@ -351,6 +351,10 @@ export interface McpHttpEndpoint {
     close(required: Record<string, never>, optional?: Record<string, never>): Promise<void>;
 }
 export interface McpJsonInjectionOptions {
+    /** The trusted host owns authorization and human confirmation for bridge calls. Codex may
+     * approve the jini MCP transport without its own prompt; this grants no target-tool permission.
+     * Omission preserves the CLI's default approval behavior. Applies only to the jini bridge. */
+    readonly toolApprovalOwner?: 'host';
     /** Optional transport port. Reject before CLI launch when HTTP cannot be prepared.
      * The host keeps callback credentials in memory; only this endpoint capability reaches the CLI. */
     readonly prepareHttp?: (required: {

package/dist/http/frontend-control.d.ts

@@ -52,6 +52,10 @@ export interface CreateFrontendControlOptions {
     readonly resolveBindToken: (requiredArgs: {
         readonly request: RunCreateRequest;
     }) => string | undefined;
+    /** Authenticated owner of a run's originating surface when session ownership is enabled. */
+    readonly resolveBindOwner?: (required: {
+        readonly request: RunCreateRequest;
+    }) => FrontendSessionOwner | undefined;
     /** @default `@jini-ai/daemon`'s `denyAllFrontendCapabilityPolicy` — a host grants access explicitly. */
     readonly policy?: ToolPolicy;
     /** @default `@jini-ai/daemon`'s `DEFAULT_FRONTEND_CAPABILITY_TIMEOUT_MS`. */

package/dist/http/frontend-control.js

@@ -100,7 +100,8 @@ export function createFrontendControl(requiredArgs, optionalArgs = {}) {
             return;
         let release;
         try {
-            release = registry.bindRunByToken({ runId: run.id, bindToken });
+            const owner = options.resolveBindOwner?.({ request });
+            release = registry.bindRunByToken({ runId: run.id, bindToken, ...(owner ? { owner } : {}) });
         }
         catch (error) {
             reportBindError({ runId: run.id, error });

package/dist/http/frontend-request-route.d.ts

@@ -0,0 +1,27 @@
+import type { Express, Request, Response } from 'express';
+import type { FrontendControl } from './frontend-control.js';
+import type { FrontendSessionOwner } from '../frontend-session-registry.js';
+import type { ToolExecutor } from '../tool-executor.js';
+export interface FrontendRequestRouteRequired {
+    readonly app: Express;
+    readonly path: string;
+    readonly control: Pick<FrontendControl, 'bindRequest'>;
+    readonly executor: Pick<ToolExecutor, 'execute'>;
+    /** Host must authenticate session, origin and the tab before returning an owner. */
+    readonly resolveOwner: (required: {
+        req: Request;
+        res: Response;
+    }) => Promise<FrontendSessionOwner | null>;
+    readonly capabilityIds: readonly string[];
+}
+/** Bind one authenticated request to its originating surface, then use the host's existing gates.
+ * @param required Host-authenticated owner, frontend control, gated executor and allowed ids.
+ * @param optional Injectable fresh request id. A caller never chooses a run id or principal.
+ * @returns Nothing; mounts one JSON-body route behind the host's authentication/body-limit middleware.
+ * @complexity O(allowed ids) setup; one binding and one execution per request, no storage or polling.
+ * @overallScore 100
+ */
+export declare function registerFrontendRequestRoute({ app, path, control, executor, resolveOwner, capabilityIds }: FrontendRequestRouteRequired, { newRequestId }?: {
+    newRequestId?: () => string;
+}): void;
+//# sourceMappingURL=frontend-request-route.d.ts.map

package/dist/http/frontend-request-route.js

@@ -0,0 +1,69 @@
+import { randomUUID } from 'node:crypto';
+import { streamToolExecution } from './tool-execution-routes.js';
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+/** Exact browser envelope: an agent cannot borrow a run or supply execution authority.
+ * @complexity O(input bytes) time and space for the frozen request; envelope has three keys.
+ * @overallScore 100
+ */
+function readFrontendRequest(body, allowed) {
+    if (!isRecord(body))
+        return null;
+    const value = body;
+    if (Object.keys(value).length !== 3)
+        return null;
+    if (typeof value.capabilityId !== 'string' || !allowed.has(value.capabilityId))
+        return null;
+    if (typeof value.bindToken !== 'string' || value.bindToken.length === 0)
+        return null;
+    if (!isRecord(value.input))
+        return null;
+    return { capabilityId: value.capabilityId, bindToken: value.bindToken, input: structuredClone(value.input) };
+}
+/** Bind one authenticated request to its originating surface, then use the host's existing gates.
+ * @param required Host-authenticated owner, frontend control, gated executor and allowed ids.
+ * @param optional Injectable fresh request id. A caller never chooses a run id or principal.
+ * @returns Nothing; mounts one JSON-body route behind the host's authentication/body-limit middleware.
+ * @complexity O(allowed ids) setup; one binding and one execution per request, no storage or polling.
+ * @overallScore 100
+ */
+export function registerFrontendRequestRoute({ app, path, control, executor, resolveOwner, capabilityIds }, { newRequestId = randomUUID } = {}) {
+    const allowed = new Set(capabilityIds);
+    app.post(path, async (req, res) => {
+        const request = readFrontendRequest(req.body, allowed);
+        if (!request) {
+            res.status(400).json({ error: 'Expected an allowed capabilityId, object input and frontend bindToken.' });
+            return;
+        }
+        let owner;
+        try {
+            owner = await resolveOwner({ req, res });
+        }
+        catch {
+            res.status(403).json({ error: 'The browser session could not be verified for this page action.' });
+            return;
+        }
+        if (!owner) {
+            res.status(403).json({ error: 'This page request has no authenticated browser owner.' });
+            return;
+        }
+        const runId = newRequestId();
+        const boundExecutor = {
+            execute: async (call, options = {}) => {
+                const signal = options.signal;
+                const release = control.bindRequest({ runId, bindToken: request.bindToken, owner, signal });
+                try {
+                    return await executor.execute(call, options);
+                }
+                finally {
+                    release();
+                }
+            },
+        };
+        await streamToolExecution({ req, res, executor: boundExecutor, call: {
+                executionId: runId, run: { id: runId }, principal: { id: owner.principalId }, toolId: request.capabilityId, input: request.input,
+            } }, { keepalive: true });
+    });
+}
+//# sourceMappingURL=frontend-request-route.js.map

package/dist/http/index.d.ts

@@ -59,4 +59,6 @@ export { createRemoteAttachmentLookup } from '../remote-attachment-lookup.js';
 export { createTavilyResearchProvider } from './research-tavily.adapter.js';
 export { createFrontendGuestScope } from './frontend-guest-scope.js';
 export { tryRestoreSurface } from './surface-restoration.js';
+export { registerFrontendRequestRoute } from './frontend-request-route.js';
+export type { FrontendRequestRouteRequired } from './frontend-request-route.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/http/index.js

@@ -32,4 +32,5 @@ export { createRemoteAttachmentLookup } from '../remote-attachment-lookup.js';
 export { createTavilyResearchProvider } from './research-tavily.adapter.js';
 export { createFrontendGuestScope } from './frontend-guest-scope.js';
 export { tryRestoreSurface } from './surface-restoration.js';
+export { registerFrontendRequestRoute } from './frontend-request-route.js';
 //# sourceMappingURL=index.js.map

package/dist/http/tool-execution-routes.d.ts

@@ -22,10 +22,10 @@
  * body that never completed never reaches the executor. Listeners are detached once the call
  * settles, so a long-lived keep-alive socket never accumulates them.
  */
-import { type ErrorRequestHandler, type RequestHandler } from 'express';
+import { type ErrorRequestHandler, type Request, type RequestHandler, type Response } from 'express';
 import type { ToolDescriptor } from '@jini-ai/core';
 import type { ToolExecutor } from '../tool-executor.js';
-import { TOOL_EXECUTIONS_ROUTE_PATH } from '../remote-tool-executor.js';
+import { TOOL_EXECUTIONS_ROUTE_PATH, type ToolExecutionWireRequest } from '../remote-tool-executor.js';
 export { TOOL_EXECUTIONS_ROUTE_PATH };
 export declare const TOOL_CATALOG_ROUTE_PATH = "/internal/tool-catalog";
 export declare const DEFAULT_TOOL_EXEC_TOKEN_ENV_VAR = "JINI_TOOL_EXEC_TOKEN";
@@ -62,6 +62,18 @@ export interface ToolExecutionRoutesOptional {
 }
 /** The token + loopback gate; mounted before any body parser. Exported for hosts that need it on another path. */
 export declare function requireToolExecutionCaller(_required: Record<string, never>, { tokenEnvVar, env }?: Pick<ToolExecutionRoutesOptional, 'tokenEnvVar' | 'env'>): RequestHandler;
+/**
+ * Streams one execution as NDJSON. Headers go out first; surfaces are written as they are emitted
+ * and are dropped once the call settled; exactly one terminal line follows.
+ */
+export declare function streamToolExecution({ req, res, call, executor }: {
+    readonly req: Request;
+    readonly res: Response;
+    readonly call: ToolExecutionWireRequest;
+    readonly executor: Pick<ToolExecutor, 'execute'>;
+}, { runWithContext, keepalive }: Pick<ToolExecutionRoutesOptional, 'runWithContext'> & {
+    keepalive?: boolean;
+}): Promise<void>;
 /**
  * Mounts both routes on `app` (an Express app or a `Router`). Mount it BEFORE any app-level
  * `express.json()` with a smaller limit: this route parses its own body after its gate, and an

package/dist/http/tool-execution-routes.js

@@ -99,7 +99,9 @@ function wireError(error) {
  * Streams one execution as NDJSON. Headers go out first; surfaces are written as they are emitted
  * and are dropped once the call settled; exactly one terminal line follows.
  */
-async function streamExecution({ req, res, call, executor }, { runWithContext }) {
+export async function streamToolExecution({ req, res, call, executor }, { runWithContext, keepalive = false }) {
+    if (res.destroyed)
+        return;
     const controller = new AbortController();
     // `res` 'close' (not `req` 'close', which fires as soon as a completed body was read) means the
     // caller went away; after a normal end `writableFinished` is already true and nothing aborts.
@@ -116,6 +118,9 @@ async function streamExecution({ req, res, call, executor }, { runWithContext })
         res.write(`${JSON.stringify(line)}\n`); };
     const emitSurface = async (emission) => { if (!settled)
         writeLine({ type: 'surface', emission }); };
+    // Human confirmation may outlive the proxy's idle-body timeout; never poll for an answer.
+    const heartbeat = keepalive ? setInterval(() => writeLine({ type: 'keepalive' }), 15_000) : undefined;
+    heartbeat?.unref();
     const run = () => executor.execute({ principal: call.principal, run: call.run, toolId: call.toolId, input: call.input }, { signal: controller.signal, emitSurface });
     try {
         if (!req.complete || controller.signal.aborted)
@@ -128,6 +133,8 @@ async function streamExecution({ req, res, call, executor }, { runWithContext })
     }
     finally {
         settled = true;
+        if (heartbeat)
+            clearInterval(heartbeat);
         res.off('close', onClose);
         req.off('error', onRequestError);
         res.end();
@@ -141,7 +148,7 @@ function executionHandler({ executor }, optional) {
             sendApiError({ res, status: 400, error });
             return;
         }
-        void streamExecution({ req, res, call, executor }, optional);
+        void streamToolExecution({ req, res, call, executor }, optional);
     };
 }
 /**

package/dist/session-coordination.d.ts

@@ -77,11 +77,18 @@ export interface FailingRunLifecycle {
     }, optional?: Record<string, never>): Promise<unknown>;
 }
 /** Emit the refusal reason on the run stream so the chat can show and save it. Event delivery
- * is best-effort; finishing remains mandatory even when the stream cannot accept the event. */
-export declare function failRunBeforeStart({ lifecycle, runId, message }: {
+ * is best-effort; finishing remains mandatory even when the stream cannot accept the event.
+ * Startup exceptions carry redacted stage/cause text through that same saved error event.
+ * @example failRunBeforeStart({ lifecycle, runId, message: 'Could not start.', startup: { stage: 'session binding', error } }, {});
+ */
+export declare function failRunBeforeStart({ lifecycle, runId, message, startup }: {
     lifecycle: FailingRunLifecycle;
     runId: string;
     message: string;
+    startup?: {
+        stage: string;
+        error: unknown;
+    };
 }, _optional?: Record<string, never>): Promise<void>;
 export interface AgentCapabilities {
     readonly resumesSessionViaCli?: boolean;

package/dist/session-coordination.js

@@ -1,3 +1,4 @@
+import { startupFailureMessage } from '@jini-ai/agent-runtime';
 /** Fresh private maps keep daemon instances independent. */
 export function createLiveRunTracker(_args, _optional = {}) {
     const runs = new Map();
@@ -82,10 +83,14 @@ export async function waitForStoppingRuns({ tracker, lifecycle, scheduler, conve
     }
 }
 /** Emit the refusal reason on the run stream so the chat can show and save it. Event delivery
- * is best-effort; finishing remains mandatory even when the stream cannot accept the event. */
-export async function failRunBeforeStart({ lifecycle, runId, message }, _optional = {}) {
+ * is best-effort; finishing remains mandatory even when the stream cannot accept the event.
+ * Startup exceptions carry redacted stage/cause text through that same saved error event.
+ * @example failRunBeforeStart({ lifecycle, runId, message: 'Could not start.', startup: { stage: 'session binding', error } }, {});
+ */
+export async function failRunBeforeStart({ lifecycle, runId, message, startup }, _optional = {}) {
+    const reason = startup ? startupFailureMessage(startup, {}) : message;
     try {
-        await lifecycle.emit({ runId: runId, input: { event: 'error', data: { message } } });
+        await lifecycle.emit({ runId: runId, input: { event: 'error', data: { message: reason } } });
     }
     catch { /* Finishing remains mandatory. */ }
     await lifecycle.finish({ runId, status: 'failed', code: null, signal: null, resumable: false });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/daemon",
-  "version": "0.6.22",
+  "version": "0.6.23",
   "description": "The stateful agent daemon runtime: run lifecycle, durable event-log port, the tool-execution boundary, agent executor, terminal sessions, and routines.",
   "license": "Apache-2.0",
   "repository": {
@@ -153,22 +153,22 @@
     "express": "^4.21.0",
     "@types/express": "^4.17.21",
     "@jini-ai/db": "0.6.19",
-    "@jini-ai/agent-runtime": "^0.6.22",
-    "@jini-ai/chat": "0.6.22",
-    "@jini-ai/core": "^0.6.22",
+    "@jini-ai/chat": "0.6.23",
+    "@jini-ai/core": "^0.6.23",
+    "@jini-ai/platform": "^0.6.23",
     "@jini-ai/protocol": "^0.6.19",
-    "@jini-ai/platform": "^0.6.22",
+    "@jini-ai/agent-runtime": "^0.6.23",
     "@jini-ai/http-kit": "0.6.22"
   },
   "dependencies": {
     "smol-toml": "1.9.1",
     "kysely": "^0.29.6",
-    "@jini-ai/core": "^0.6.22",
-    "@jini-ai/protocol": "^0.6.19",
+    "@jini-ai/core": "^0.6.23",
     "@jini-ai/db": "^0.6.19",
-    "@jini-ai/agent-runtime": "^0.6.22",
-    "@jini-ai/platform": "^0.6.22",
-    "@jini-ai/http-kit": "^0.6.22"
+    "@jini-ai/protocol": "^0.6.19",
+    "@jini-ai/platform": "^0.6.23",
+    "@jini-ai/http-kit": "^0.6.22",
+    "@jini-ai/agent-runtime": "^0.6.23"
   },
   "peerDependencies": {
     "node-pty": "^1.1.0",