@jini-ai/daemon 0.6.3 → 0.6.5

package/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 0.6.5 — 2026-10-14
+
+- Express 5 accepted: the optional `express` peer is now `^4.21.0 || ^5.0.0` (1442d875), so an Express 5 host no longer hits ERESOLVE.
+
+## 0.6.4 — 2026-10-13
+
+- ACP runs forward the run's `permissionMode` to `attachAcpSession`, so a `bypass` run allows each ACP tool request once and a restricted run rejects it, instead of failing on the first permission request. Peer `@jini-ai/agent-runtime` floor is now `^0.4.10`.
+
 ## 0.6.3 — 2026-10-13
 
 - `createAgentExecutor` accepts `codexDisablePlugins` and `piGracefulShutdownMs`; absent, they resolve once from `hostEnv` (`CODEX_DISABLE_PLUGINS`, `PI_GRACEFUL_SHUTDOWN_MS`). Peer `@jini-ai/agent-runtime` floor is now `^0.4.7`.

package/dist/agent-executor/events.d.ts

@@ -158,6 +158,7 @@ interface RunAcpDispatchInput {
     readonly child: ChildProcess;
     readonly prompt: string;
     readonly cwd: string;
+    readonly permissionMode: 'bypass' | 'restricted' | undefined;
     readonly model: string | undefined;
     readonly modelCatalog?: ModelCatalogSnapshot;
     readonly imagePaths: readonly string[];

package/dist/agent-executor/events.js

@@ -892,7 +892,7 @@ function wireAcpLifecycle(ctx) {
             if (event === 'error') {
                 enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'error', data: translateAcpError(payload) } }));
             }
-        } }, { cwd: ctx.cwd, ...(ctx.model !== undefined ? { model: ctx.model } : {}), ...(ctx.imagePaths.length > 0 ? { imagePaths: [...ctx.imagePaths] } : {}), ...(ctx.envFormat !== undefined ? { envFormat: ctx.envFormat } : {}),
+        } }, { cwd: ctx.cwd, ...(ctx.permissionMode !== undefined ? { permissionMode: ctx.permissionMode } : {}), ...(ctx.model !== undefined ? { model: ctx.model } : {}), ...(ctx.imagePaths.length > 0 ? { imagePaths: [...ctx.imagePaths] } : {}), ...(ctx.envFormat !== undefined ? { envFormat: ctx.envFormat } : {}),
         // Spread-when-present rather than always: passing `mcpServers: []` is not the same as passing
         // nothing for every downstream ACP agent, and "no bridge configured" must stay byte-identical
         // to before this field existed.
@@ -1045,6 +1045,7 @@ export async function runAcpDispatch({ input, deps }) {
             lifecycle: deps.lifecycle,
             prompt: input.prompt,
             cwd: input.cwd,
+            permissionMode: input.permissionMode,
             model: input.model,
             ...(input.modelCatalog ? { modelCatalog: input.modelCatalog } : {}),
             imagePaths: input.imagePaths,

package/dist/agent-executor/launch.js

@@ -1013,6 +1013,7 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
                     // sending byte-identical text and never receive the overlay twice.
                     prompt: `${overlayDelivery.promptPrefix}${input.prompt}`,
                     cwd: input.cwd,
+                    permissionMode: input.permissionMode,
                     model: input.model,
                     modelCatalog,
                     imagePaths: input.imagePaths ?? [],

package/dist/tool-recovery/redaction.d.ts

@@ -24,7 +24,7 @@
  * for why only the VALUE is ever blanked, never the surrounding text.
  *
  * Architectural role: `src/assistant` composition-layer adapter, same layer as
- * `tool-executor-audit.ts` and `tool-failure-recovery.ts`. Depends only on the Tovu policy
+ * `tool-executor-audit.ts` and `tool-failure-recovery.ts`. Depends only on the host policy
  * adapter over `@jini-ai/diagnostics/redaction/secrets-only` and `@jini-ai/daemon`'s `ToolExecutor` shape.
  */
 import type { ToolExecutionResult, ToolExecutor } from "../tool-executor.js";

package/dist/tool-recovery/redaction.js

@@ -24,7 +24,7 @@
  * for why only the VALUE is ever blanked, never the surrounding text.
  *
  * Architectural role: `src/assistant` composition-layer adapter, same layer as
- * `tool-executor-audit.ts` and `tool-failure-recovery.ts`. Depends only on the Tovu policy
+ * `tool-executor-audit.ts` and `tool-failure-recovery.ts`. Depends only on the host policy
  * adapter over `@jini-ai/diagnostics/redaction/secrets-only` and `@jini-ai/daemon`'s `ToolExecutor` shape.
  */
 /** Matches a minted error ID anywhere in a string — exported for tests and for a later chat-side

package/dist/tool-recovery/stack.d.ts

@@ -1,5 +1,5 @@
 /**
- * @file The one place Tovu's `ToolExecutor` decorator stack is composed.
+ * @file The one place the host's `ToolExecutor` decorator stack is composed.
  *
  * The order of these three wrappers is load-bearing in two different directions, and it was
  * previously spelled out only as an expression inside `agent-daemon-server.ts` — a module that boots
@@ -32,7 +32,7 @@
  *    "completed" row the audit records for the call the transport actually made, losing the remedy
  *    tool's own attempt from the trail entirely.
  *
- * Composed the SAME way for both of Tovu's tool-dispatch surfaces: the agent daemon's delegated-tool
+ * Composed the SAME way for both of the host's tool-dispatch surfaces: the agent daemon's delegated-tool
  * route and BYOK's `byok-tool-surface.ts` (as of 2026-09-06 — previously BYOK hand-assembled its own
  * second copy of this stack that never wrapped `withReadOnlyToolConstraint`, so a decorator known to
  * apply to "every read-only gateway" in fact applied to only one of the two; see that file's own

package/dist/tool-recovery/stack.js

@@ -1,5 +1,5 @@
 /**
- * @file The one place Tovu's `ToolExecutor` decorator stack is composed.
+ * @file The one place the host's `ToolExecutor` decorator stack is composed.
  *
  * The order of these three wrappers is load-bearing in two different directions, and it was
  * previously spelled out only as an expression inside `agent-daemon-server.ts` — a module that boots
@@ -32,7 +32,7 @@
  *    "completed" row the audit records for the call the transport actually made, losing the remedy
  *    tool's own attempt from the trail entirely.
  *
- * Composed the SAME way for both of Tovu's tool-dispatch surfaces: the agent daemon's delegated-tool
+ * Composed the SAME way for both of the host's tool-dispatch surfaces: the agent daemon's delegated-tool
  * route and BYOK's `byok-tool-surface.ts` (as of 2026-09-06 — previously BYOK hand-assembled its own
  * second copy of this stack that never wrapped `withReadOnlyToolConstraint`, so a decorator known to
  * apply to "every read-only gateway" in fact applied to only one of the two; see that file's own

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/daemon",
-  "version": "0.6.3",
+  "version": "0.6.5",
   "description": "The stateful agent daemon runtime: run lifecycle, durable event-log port, the tool-execution boundary, agent executor, terminal sessions, and routines.",
   "license": "Apache-2.0",
   "repository": {
@@ -139,16 +139,16 @@
     "@types/pg": "8.23.1",
     "express": "^4.21.0",
     "@types/express": "^4.17.21",
-    "@jini-ai/http-kit": "0.4.1",
-    "@jini-ai/agent-runtime": "^0.4.7",
-    "@jini-ai/chat": "0.5.8",
-    "@jini-ai/core": "^0.4.4",
-    "@jini-ai/platform": "^0.5.5",
+    "@jini-ai/http-kit": "0.4.2",
+    "@jini-ai/chat": "0.6.2",
+    "@jini-ai/core": "^0.4.6",
+    "@jini-ai/agent-runtime": "^0.4.11",
+    "@jini-ai/platform": "^0.5.7",
     "@jini-ai/protocol": "^0.4.4",
-    "@jini-ai/db": "0.3.3"
+    "@jini-ai/db": "0.3.4"
   },
   "dependencies": {
-    "@jini-ai/core": "^0.4.4",
+    "@jini-ai/core": "^0.4.6",
     "@jini-ai/protocol": "^0.4.4"
   },
   "peerDependencies": {
@@ -159,8 +159,8 @@
     "@electric-sql/pglite": "0.5.8",
     "pg": "^8.23.0",
     "@jini-ai/http-kit": "^0.4.0",
-    "express": "^4.21.0",
-    "@jini-ai/agent-runtime": "^0.4.7",
+    "express": "^4.21.0 || ^5.0.0",
+    "@jini-ai/agent-runtime": "^0.4.10",
     "@jini-ai/platform": "^0.5.5"
   },
   "peerDependenciesMeta": {