@jini-ai/daemon 0.6.7 → 0.6.9

package/dist/tool-recovery/recovery.js

@@ -261,26 +261,37 @@ function planRemedyCall(input) {
         return undefined;
     return { remedyToolId, carryForward, askFor };
 }
+/** Prefill keys that name a secret (or a carrier of one) — never accepted as card metadata. */
+const SECRET_SHAPED_PREFILL_KEY = /token|secret|password|authorization|env|headers|body|key/i;
+/** Whether one prefill entry is plain card metadata: a key the setup schema declares that does not
+ *  name a secret, holding a JSON primitive, and — for a string — a value neither the secret detector
+ *  nor the credential-free assertion rejects. */
+function isMetadataPrefillEntry({ key, value, properties, deps }) {
+    if (!(key in properties) || SECRET_SHAPED_PREFILL_KEY.test(key))
+        return false;
+    if (!isJsonPrimitive(value))
+        return false;
+    if (typeof value !== "string")
+        return true;
+    if (deps.containsSecret({ text: value }))
+        return false;
+    try {
+        deps.assertCredentialFreeField({ value, field: key }, {});
+    }
+    catch {
+        return false;
+    }
+    return true;
+}
 /** Card schemas accept metadata only. Reject secret-shaped prefills before even asking. */
 function planCredentialSetup({ diagnostic, descriptor, deps }, _optional = {}) {
     const shape = resolveRemedySchemaShape(descriptor);
     if (!shape || diagnostic.setupToolId !== diagnostic.remedyToolId || !diagnostic.prefill)
         return undefined;
     const prefill = diagnostic.prefill;
-    for (const [key, value] of Object.entries(prefill)) {
-        if (!(key in shape.properties) || /token|secret|password|authorization|env|headers|body|key/i.test(key))
-            return undefined;
-        if (!isJsonPrimitive(value) || (typeof value === "string" && deps.containsSecret({ text: value })))
-            return undefined;
-        if (typeof value === "string") {
-            try {
-                deps.assertCredentialFreeField({ value, field: key }, {});
-            }
-            catch {
-                return undefined;
-            }
-        }
-    }
+    const allMetadata = Object.entries(prefill).every(([key, value]) => isMetadataPrefillEntry({ key, value, properties: shape.properties, deps }));
+    if (!allMetadata)
+        return undefined;
     if (shape.required.some(key => !(key in prefill)))
         return undefined;
     return { remedyToolId: diagnostic.remedyToolId, carryForward: prefill };
@@ -309,7 +320,8 @@ async function resolveRecoveryDecision(exchange, ui, askForKey) {
     return { proceed: true, answerValue };
 }
 function resolveRecoveryGate(input) {
-    const { diagnostic, principal, originalInput, registry, result, deps } = input;
+    const { diagnostic, principal, originalInput, result, deps } = input;
+    const { registry } = deps;
     const readOnlyRefusal = refuseNonReadOnlyDispatch({ principal, toolId: diagnostic.remedyToolId, registry, messages: deps.readOnlyMessages }, {});
     if (readOnlyRefusal !== null)
         return { attempt: false, outcome: { ...result, error: deps.formatReadOnlyRemedyRefusal({ refusal: readOnlyRefusal }) } };
@@ -346,6 +358,36 @@ function buildRemedyInput(plan, decision) {
         remedyInput[plan.askFor.key] = decision.answerValue;
     return remedyInput;
 }
+/**
+ * The remedy tool's input for an accepted gate, or `undefined` when the human did not give a usable
+ * go-ahead. A credential-setup diagnostic skips the recovery surface entirely: it goes directly to the
+ * masked card, which supplies its own human decision. Every other diagnostic asks first through the
+ * host-built recovery form.
+ */
+async function resolveRemedyInput(input) {
+    const { plan, diagnostic, principal, emitSurface, signal, deps } = input;
+    // Credential setup goes directly to the masked card; it supplies its own human decision.
+    if (diagnostic.setupToolId)
+        return { ...plan.carryForward };
+    const exchange = deps.surfaceExchanges.open({ binding: { toolId: deps.recoveryToolId, principalId: principal.id }, emit: emitSurface });
+    const ui = deps.buildRecoveryForm({ exchangeId: exchange.id, hint: diagnostic.hint, remedyToolId: diagnostic.remedyToolId, ...(plan.askFor ? { askFor: plan.askFor } : {}) }, {});
+    const decision = await collectRecoveryDecision({ exchange, ui, askForKey: plan.askFor?.key, signal });
+    // Declined, dismissed, expired, or a blank answer — the ORIGINAL failure is still the truth.
+    if (!decision.proceed)
+        return undefined;
+    return buildRemedyInput(plan, decision);
+}
+/** Whether the remedy call actually applied its fix — see the two cases in the comments below. */
+function remedyApplied(remedyResult) {
+    // The fix itself did not complete (denied, threw, timed out, ...) — nothing changed, so retrying
+    // the original would only reproduce the same failure.
+    if (remedyResult.status !== "completed")
+        return false;
+    // The remedy RAN, but its own result says the fix was never actually applied (a declined,
+    // expired, or invalid human-gated write) — see {@link remedyReportedFailure}. "Completed" is not
+    // "succeeded"; retrying here would only reproduce the same failure.
+    return !remedyReportedFailure(remedyResult.output);
+}
 /**
  * Wraps `inner` with the generic ask -> apply -> retry-once recovery loop described in this file's
  * header. A drop-in `ToolExecutor` — every method other than `execute` delegates straight through,
@@ -378,34 +420,21 @@ export function withToolFailureRecovery({ inner, ...deps }, _optional = {}) {
             // `withReadOnlyToolConstraint` would refuse the dispatch below regardless — it is the
             // enforcement, and it does not depend on this check — but a refusal discovered THERE arrives
             // only after a human has already been asked to fill in a form whose answer is then thrown away.
-            const gate = resolveRecoveryGate({ diagnostic, principal, originalInput: input, registry: deps.registry, result, deps });
+            const gate = resolveRecoveryGate({ diagnostic, principal, originalInput: input, result, deps });
             if (!gate.attempt)
                 return gate.outcome;
-            let remedyInput = { ...gate.plan.carryForward };
-            if (!diagnostic.setupToolId) {
-                const exchange = deps.surfaceExchanges.open({ binding: { toolId: deps.recoveryToolId, principalId: principal.id }, emit: emitSurface });
-                const ui = deps.buildRecoveryForm({ exchangeId: exchange.id, hint: diagnostic.hint, remedyToolId: diagnostic.remedyToolId, ...(gate.plan.askFor ? { askFor: gate.plan.askFor } : {}) }, {});
-                const decision = await collectRecoveryDecision({ exchange, ui, askForKey: gate.plan.askFor?.key, signal });
-                // Declined, dismissed, expired, or a blank answer — the ORIGINAL failure is still the truth.
-                if (!decision.proceed)
-                    return result;
-                remedyInput = buildRemedyInput(gate.plan, decision);
-            }
-            // Credential setup goes directly to the masked card; it supplies its own human decision.
+            const remedyInput = await resolveRemedyInput({ plan: gate.plan, diagnostic, principal, emitSurface, signal, deps });
+            // Declined, dismissed, expired, or a blank answer — the ORIGINAL failure is still the truth.
+            if (!remedyInput)
+                return result;
             // ---- STRUCTURAL ONE-CYCLE GUARD ----
             // Both calls below go straight to `inner` — never back through this function or the object it
             // returns. Whatever either one returns, including a fresh hint+remedyToolId of its own, is never
             // fed back into the scan above: that scan is written exactly once, above this comment, and
             // nothing here loops or recurses into it again. See this file's header.
             const remedyResult = await inner.execute({ ...required, toolId: diagnostic.remedyToolId, input: remedyInput }, optional);
-            // The fix itself did not complete (denied, threw, timed out, ...) — nothing changed, so retrying
-            // the original would only reproduce the same failure. Return the ORIGINAL result, untouched.
-            if (remedyResult.status !== "completed")
-                return result;
-            // The remedy RAN, but its own result says the fix was never actually applied (a declined,
-            // expired, or invalid human-gated write) — see {@link remedyReportedFailure}. "Completed" is not
-            // "succeeded"; retrying here would only reproduce the same failure.
-            if (remedyReportedFailure(remedyResult.output))
+            // The fix was not applied (see `remedyApplied`) — return the ORIGINAL result, untouched.
+            if (!remedyApplied(remedyResult))
                 return result;
             // Retry the ORIGINAL call exactly once, with its exact original input. Whatever this returns —
             // success or a fresh failure — is this wrapper's final answer.

package/dist/tool-recovery/stack.d.ts

@@ -41,7 +41,7 @@
  * Architectural role: `src/assistant` composition-layer adapter. Takes its collaborators as
  * arguments and constructs no policy, sink, or registry of its own.
  */
-import { type ToolExecutor } from "../tool-executor.js";
+import { type ToolExecutor, type PrepareToolGuidance } from "../tool-executor.js";
 import type { ToolRegistry } from "@jini-ai/core";
 import type { ToolAttemptAuditSink } from "../core/tool-audit.js";
 import type { SurfaceExchangeStore } from "../surface-exchanges.js";
@@ -49,6 +49,7 @@ import { type ToolFailureRecoveryDeps } from "./recovery.js";
 import { type RedactedToolFailuresDeps } from "./redaction.js";
 export interface AssistantToolExecutorDeps extends Omit<ToolFailureRecoveryDeps, "registry"> {
     readonly registry: ToolRegistry;
+    readonly prepareGuidance?: PrepareToolGuidance;
     readonly surfaceExchanges: SurfaceExchangeStore;
     readonly newExecutionId: () => string;
     /** Optional sink is a real supported configuration; never require a dummy observer. */

package/dist/tool-recovery/stack.js

@@ -51,7 +51,7 @@ import { withRedactedToolFailures, readToolErrorId } from "./redaction.js";
  * @complexity O(1) composition; each decorator owns its runtime cost.
  */
 export function createAssistantToolExecutor(deps, _optional = {}) {
-    const guarded = withReadOnlyToolConstraint({ inner: createToolExecutor({ registry: deps.registry }),
+    const guarded = withReadOnlyToolConstraint({ inner: createToolExecutor({ registry: deps.registry }, { ...(deps.prepareGuidance ? { prepareGuidance: deps.prepareGuidance } : {}) }),
         registry: deps.registry, idGenerator: { newId: deps.newExecutionId }, messages: deps.readOnlyMessages }, {});
     const redacted = withRedactedToolFailures({ inner: guarded, ...deps.toolFailures }, {});
     const audited = deps.toolAttemptAudit

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/daemon",
-  "version": "0.6.7",
+  "version": "0.6.9",
   "description": "The stateful agent daemon runtime: run lifecycle, durable event-log port, the tool-execution boundary, agent executor, terminal sessions, and routines.",
   "license": "Apache-2.0",
   "repository": {
@@ -139,17 +139,17 @@
     "@types/pg": "8.23.1",
     "express": "^4.21.0",
     "@types/express": "^4.17.21",
-    "@jini-ai/agent-runtime": "^0.4.11",
-    "@jini-ai/chat": "0.6.5",
-    "@jini-ai/protocol": "^0.4.4",
-    "@jini-ai/core": "^0.4.6",
-    "@jini-ai/platform": "^0.5.8",
-    "@jini-ai/http-kit": "0.4.2",
-    "@jini-ai/db": "0.3.4"
+    "@jini-ai/db": "0.3.6",
+    "@jini-ai/http-kit": "0.4.3",
+    "@jini-ai/agent-runtime": "^0.4.12",
+    "@jini-ai/core": "^0.4.9",
+    "@jini-ai/protocol": "^0.4.5",
+    "@jini-ai/platform": "^0.5.10",
+    "@jini-ai/chat": "0.6.7"
   },
   "dependencies": {
-    "@jini-ai/protocol": "^0.4.4",
-    "@jini-ai/core": "^0.4.6"
+    "@jini-ai/core": "^0.4.9",
+    "@jini-ai/protocol": "^0.4.5"
   },
   "peerDependencies": {
     "node-pty": "^1.1.0",