@jini-ai/daemon 0.6.8 → 0.6.10

package/CHANGELOG.md

@@ -1,3 +1,151 @@
+## 0.6.10
+
+### Patch Changes
+
+- 4f52784: Stop advertising agents `AgentExecutor` cannot run.
+
+  The built-in `agents` feature scanned every runtime definition, but `AgentExecutor` rejects some of
+  them (`antigravity`, whose deferral is documented in that module). A consumer could therefore offer a
+  user an agent that failed the instant it was selected, with the mismatch visible nowhere.
+
+  - `@jini-ai/daemon` exports `isAgentExecutorSupported(def)` and `assessAgentExecutorCompatibility(def)`.
+    `run()` now consumes the latter instead of re-checking the conditions itself, so the discovery-time
+    answer and the run-time guards cannot drift apart. Error messages are unchanged.
+  - `@jini-ai/server`'s `agents` feature applies the predicate by default, and exports
+    `isExecutableDetectedAgent` for hosts that want it directly.
+
+  `antigravity`'s definition remains in `@jini-ai/agent-runtime` — the predicate is advisory, and a
+  non-`AgentExecutor` launch path can ignore it. An id with no registered def is kept rather than
+  dropped, so a host supplying its own `detector` is unaffected.
+
+  Note for anyone implementing something similar: the predicate deliberately takes the full
+  `RuntimeAgentDef`, not a projected `DetectedAgent`. That projection omits `maxPromptArgBytes`, and the
+  argv-bound defs (`aider`, `deepseek`) qualify solely through it — judging the projection would have
+  dropped two working agents while fixing one broken one.
+
+- 8ff5653: Drive Antigravity (`agy`) — the 24th and last agent definition `AgentExecutor` rejected.
+
+  `AgentExecutor` drove 23 of 24 registered definitions. Antigravity was rejected by an explicit
+  `def.id === 'antigravity'` guard, for two reasons that are real but narrow:
+
+  - **`agy` can print an OAuth sign-in URL to stdout and still exit 0.** Streaming stdout live shows
+    that URL to the user as if it were the model's reply — a URL that carries the daemon operator's
+    `client_id`/`redirect_uri` into a chat transcript, and that is useless to click anyway (`agy -p`
+    print mode has no field to paste the resulting auth code into).
+  - **`agy` has no `--model` flag.** The model choice is written into one process-global
+    `~/.gemini/antigravity-cli/settings.json` that `agy` reads on its own startup, so two concurrent
+    runs race: run A writes model A, A spawns, B writes model B, and only _then_ does A's `agy` read
+    the file — so A silently executes on B's model.
+
+  Both are now met by **declarative `RuntimeAgentDef` fields the executor reads generically**, joining
+  the 14 optional behavior flags (`promptViaFile`, `authProbe`, …) that already work this way. There is
+  no agent-id branch anywhere in the dispatch path — a deliberate divergence from Open Design's own
+  daemon, which hardcodes the id twice.
+
+  New on `@jini-ai/agent-runtime`'s `RuntimeAgentDef`:
+
+  - `needsAgentLogFile?: boolean` — asks the caller to stage a temp path and pass it as
+    `RuntimeContext.agentLogFilePath` before `buildArgs` runs, mirroring `promptViaFile`. Staged by the
+    new `prepareAgentLogFile(def, label)` (the sibling of `preparePromptFileForAgent`; it creates only
+    the `0o700` containing directory, since the log file is output the CLI authors, not input we do).
+  - `stdoutPolicy?: RuntimeStdoutPolicy` — `{buffering: 'live'}` (the default, and every other
+    definition's behavior) or `{buffering: 'until-close', sanitize?}`. A discriminated union rather
+    than two flat fields on purpose: a sanitizer is only meaningful on the buffered path, because the
+    pattern to redact can straddle two `'data'` chunks. Two independent flags would let a definition
+    declare a sanitizer the caller could not honor — a confidentiality gap that _looks_ closed.
+  - `runtimeLock?: RuntimeLock` — a mutex around a process-global side effect `buildArgs` performs.
+    Acquired before `buildArgs`, released on whichever of `waitForHandoff` settling or process exit
+    comes first. Releasing on exit is load-bearing, not a fallback: a watcher that stops polling means
+    "I stopped watching", never "the child definitely didn't read the file".
+
+  All three are stripped from the `DetectedAgent` registry projection. They instruct whoever _spawns_
+  the CLI, not whoever lists agents — and two carry closures, which `JSON.stringify` would flatten into
+  a misleading `{"buffering":"until-close"}` / `{}` rather than omit.
+
+  In `@jini-ai/daemon`, `AgentExecutor` now stages a log file when `needsAgentLogFile` is set (released
+  on every pre-spawn, spawn-failure, and close path alongside the prompt file, through one composed
+  `cleanupStagedFiles` closure), calls `runtimeLock.acquire()` before `buildArgs`, and branches its
+  `streamFormat: 'plain'` stdout handling on `stdoutPolicy`. `assessAgentExecutorCompatibility` no
+  longer rejects anything by id, and `isAgentExecutorSupported` now accepts all 24 definitions.
+
+  **No behavior change for any other agent.** Antigravity is the only definition declaring any of the
+  three fields; the other four `streamFormat: 'plain'` definitions (`grok-build`, `aider`, `deepseek`,
+  `qwen`) keep streaming live, per chunk, which `aider`'s and `deepseek`'s own comments call out as
+  deliberate. That is pinned by an explicit regression test rather than left implied.
+
+  One thing worth knowing if you consume the run event stream: on the buffered path the raw `'stdout'`
+  echo is held back and sanitized too, not just the `'agent'`/`text_delta` copy. Emitting an
+  unsanitized raw echo while withholding the chat copy would leak the exact string the sanitizer exists
+  to remove to any subscriber. The opt-in byte journal still records raw bytes per chunk — that is its
+  documented contract, and it deliberately lives in a separate `EventLog` instance that is never
+  replayed to run-event subscribers.
+
+- 3fe4d14: Store tool-result images once in media, preserve model-facing pixels, and provide opt-in digest-verified echo summaries and bounded image-safe diagnostics. Hosts with exact-byte journaling must inject a separate stdout blob/reference writer.
+
+  Preserve conflicting image representations during digest verification, and keep the required bridge executor authoritative when route dependencies supply optional settings.
+
+- e16a907: Choose reported-cost semantics from agent definition metadata rather than a vendor id; absent metadata retains per-run behavior.
+- 4f52784: Add `createRunScopedContextStore` and widen `ResolvedRunInput` with the executor's optional inputs.
+
+  **`createRunScopedContextStore<T>({ lifecycle })`** — bind/resolve/auto-evict keyed by run id, for
+  host-owned context that must survive the gap between starting a run and a later delegated call that
+  carries only that run's id. `resolve` fails closed (`RunContextNotBoundError`) rather than fabricating a
+  default, and bindings are evicted when the run reaches a terminal state.
+
+  `resolveRunInput` could already decode and stash such context, but it is handed no lifecycle and so
+  cannot register the eviction half — leaving a map that only grows and keeps stale authority resolvable.
+  Owning both halves together is the point. `T` is fully generic: this helper does not decode
+  `contextRef`, does not sign or verify anything, and has no notion of a principal. It is in-memory only,
+  and says so — after a restart every `resolve` fails, which is the correct posture rather than a gap.
+
+  **`ResolvedRunInput` now carries `permissionMode`, `model`, `reasoning`, and `credentialEnv`**, each
+  forwarded to `AgentExecutor.run()` only when present.
+
+  `permissionMode` is the load-bearing one and closes a real trap: every def with an auto-approve flag
+  (`bypassPermissions` / `--yolo` / `--dangerously-skip-permissions`) applies it by default when the field
+  is absent. A host that had been passing `'restricted'` to `AgentExecutor.run()` by hand and then adopted
+  `createDefaultRunStartHandler` would silently have started auto-approving every action — a security
+  regression wearing the clothes of a refactor. Existing behavior is unchanged: omitted fields are omitted
+  from the executor call, never passed as an explicit `undefined`.
+
+- 4f52784: Add a `sidecar-strict` security mode and per-run MCP credential propagation.
+
+  For a daemon whose threat model is **another process running as the same OS user** rather than a
+  remote attacker, the existing `jini-local` mode is a no-op: `registerApiBearerAuthMiddleware`
+  short-circuits for any loopback peer before it reads the `Authorization` header, and a `127.0.0.1`
+  bind keeps remote hosts out while doing nothing about a co-resident process. A consumer that spawns a
+  Jini daemon holding real authority — starting agent runs, executing tools against a real database —
+  previously had to write its own middleware.
+
+  - `@jini-ai/http-kit` gains `requireStrictBearerToken`: fail-closed 503 when the named token env var
+    is unset, 401 on mismatch, **no loopback exemption and no disable flag**. Its `tokenEnvVar` is
+    required with no default, so this package never names a host's secret.
+  - `composeJiniKernel` gains `security: { mode: 'sidecar-strict', host, tokenEnvVar, exemptPaths? }`.
+    Purely additive — `host` and `jini-local` are unchanged by construction, since the modes are arms of
+    a discriminated union. The strict gate mounts ahead of the JSON body parser, so a caller it rejects
+    never has its body parsed.
+  - `@jini-ai/daemon`'s `McpJsonInjectionOptions` gains `credential?: (runId) => string | Promise<string>`
+    — a **resolver, not a string**, because injection options are built once before any run exists and a
+    boot-wide shared secret would defeat the point of scoping a credential to a run. It is delivered to
+    the child as `JINI_DAEMON_TOKEN`.
+  - `@jini-ai/mcp`'s `jini-mcp` reads that variable and attaches `Authorization` to every daemon call.
+    Optional throughout: with no credential, request headers and `.mcp.json` output are byte-identical
+    to before.
+
+  Also generalized: both existing bearer gates now compare tokens in constant time (`timingSafeEqual`)
+  and share one header-parsing helper, closing a timing side channel and removing a duplicated regex.
+
+- Updated dependencies [22f0619]
+- Updated dependencies [82ed2d3]
+- Updated dependencies [3fe4d14]
+- Updated dependencies [5a3de86]
+  - @jini-ai/core@0.6.10
+  - @jini-ai/protocol@0.6.10
+
+## 0.6.9 — 2026-10-22
+
+- 2026-10-22: Memory fixes (bounded event log and tool-executor audit), chromeIntegration option, provider-plugin registration, coverage.
+
 ## 0.6.8 — 2026-10-16
 
 - An unknown tool on the read-only gateway points to discovery, never a mutation 409 (75d37c32).

package/dist/agent-executor/antigravity-permissions.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Persist one server's MCP grant for agy, which has no run-scoped settings override.
+ * Reuses the platform lock and atomic writer; keeps the first existing file as a backup.
+ * Invalid settings and I/O failures reject before spawn rather than widening permissions.
+ * @complexity O(settings bytes), including the allow-list scan; bounded by the settings file.
+ */
+export declare function ensureAntigravityMcpPermission({ settingsPath, serverName }: {
+    settingsPath: string;
+    serverName: string;
+}, _options?: Record<string, never>): Promise<void>;
+//# sourceMappingURL=antigravity-permissions.d.ts.map

package/dist/agent-executor/antigravity-permissions.js

@@ -0,0 +1,64 @@
+import { constants, promises as fs } from 'node:fs';
+import { withFileLock, writeFileAtomicAsync } from '@jini-ai/platform/fs';
+import { isRecord } from './values.js';
+/** Read the current settings text; a missing file is undefined, every other failure rejects. */
+async function readSettingsText(settingsPath) {
+    try {
+        return await fs.readFile(settingsPath, 'utf8');
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+        return undefined;
+    }
+}
+/** Parse and validate the settings shape; anything unexpected rejects rather than widening permissions. */
+function parseSettings(raw) {
+    const settings = raw === undefined ? {} : JSON.parse(raw);
+    if (!isRecord(settings))
+        throw new Error('Antigravity settings must be an object');
+    const permissions = settings.permissions === undefined ? {} : settings.permissions;
+    if (!isRecord(permissions) || (permissions.allow !== undefined && !Array.isArray(permissions.allow))) {
+        throw new Error('Antigravity permissions.allow must be an array');
+    }
+    return { settings, permissions, allow: permissions.allow ?? [] };
+}
+/** The allow list holding exactly one copy of rule (first occurrence kept, order otherwise
+ * unchanged), or null when it already holds exactly one and nothing needs writing. */
+function grantedAllowList(allow, rule) {
+    const first = allow.indexOf(rule);
+    if (first < 0)
+        return [...allow, rule];
+    const deduped = allow.filter((entry, index) => entry !== rule || index === first);
+    return deduped.length === allow.length ? null : deduped;
+}
+async function backupOriginalOnce(settingsPath) {
+    // Never replace the first backup, including on subsequent launches after operator edits.
+    await fs.copyFile(settingsPath, `${settingsPath}.jini-backup`, constants.COPYFILE_EXCL)
+        .catch((error) => { if (error.code !== 'EEXIST')
+        throw error; });
+}
+/**
+ * Persist one server's MCP grant for agy, which has no run-scoped settings override.
+ * Reuses the platform lock and atomic writer; keeps the first existing file as a backup.
+ * Invalid settings and I/O failures reject before spawn rather than widening permissions.
+ * @complexity O(settings bytes), including the allow-list scan; bounded by the settings file.
+ */
+export async function ensureAntigravityMcpPermission({ settingsPath, serverName }, _options = {}) {
+    if (!/^[\w.-]+$/.test(serverName))
+        throw new Error('Invalid MCP server name');
+    const rule = `mcp(${serverName}/*)`;
+    await withFileLock({ lockPath: `${settingsPath}.jini-lock`, run: async () => {
+            const raw = await readSettingsText(settingsPath);
+            const { settings, permissions, allow } = parseSettings(raw);
+            const nextAllow = grantedAllowList(allow, rule);
+            if (nextAllow === null)
+                return;
+            if (raw !== undefined)
+                await backupOriginalOnce(settingsPath);
+            await writeFileAtomicAsync({ filePath: settingsPath, content: `${JSON.stringify({
+                    ...settings, permissions: { ...permissions, allow: nextAllow },
+                }, null, 2)}\n` }, { refuseSymlink: true });
+        } }, { createParent: true, timeoutMs: 5000 });
+}
+//# sourceMappingURL=antigravity-permissions.js.map

package/dist/agent-executor/contracts.d.ts

@@ -1,3 +1,5 @@
+import type { DelegatedResultCorrelation } from '../delegated-result-correlation.js';
+import type { StdoutJournalBlobPort } from '../tool-result-diagnostics.js';
 import type { MessageAttachmentImage } from '../attachment-content.js';
 import type { probeMcpBridge } from './mcp-bridge-probe.js';
 import type { spawn as nodeSpawn, ChildProcess } from 'node:child_process';
@@ -92,7 +94,7 @@ export type AgentRuntimeEventTranslation = {
     readonly kind: 'ignored';
 };
 /** Machine-readable failure reasons `run()` can reject with — every one is preceded by a `lifecycle.finish({status:'failed'})` call (see index.ts module doc's Invariant section). */
-export type AgentExecutorErrorCode = 'AGENT_MODEL_UNRESOLVED' | 'AGENT_PERMISSION_MODE_INVALID' | 'AGENT_NOT_FOUND' | 'AGENT_RUNTIME_UNSUPPORTED' | 'AGENT_BINARY_NOT_RESOLVED' | 'AGENT_SPAWN_FAILED' | 'AGENT_PROMPT_TOO_LARGE';
+export type AgentExecutorErrorCode = 'NATIVE_TOOL_POLICY_UNSUPPORTED' | 'AGENT_MODEL_UNRESOLVED' | 'AGENT_PERMISSION_MODE_INVALID' | 'AGENT_NOT_FOUND' | 'AGENT_RUNTIME_UNSUPPORTED' | 'AGENT_BINARY_NOT_RESOLVED' | 'AGENT_SPAWN_FAILED' | 'AGENT_PROMPT_TOO_LARGE';
 /** Thrown by `AgentExecutor.run()` on every failure path — never a bare `Error`, so callers can branch on `.code` instead of parsing `.message`. */
 export declare class AgentExecutorError extends Error {
     readonly code: AgentExecutorErrorCode;
@@ -119,6 +121,12 @@ export interface AgentExecutorRunInput {
      * delegate auto-approval, and any unknown mode is rejected before launching a process.
      */
     readonly permissionMode?: 'bypass' | 'restricted';
+    /** Host-authorized native shell/edit grant; unsupported restricted providers fail before spawn. */
+    readonly nativeToolAccess?: boolean;
+    /** Independent host-verified permissions, snapshotted for this run. */
+    readonly nativeCapabilities?: Partial<import('@jini-ai/agent-runtime').NativeCapabilities>;
+    /** Trusted-host CLI parity; never derived from prompt/context fields. */
+    readonly cliParity?: boolean;
     /**
      * Host-validated image files. How each one actually reaches the model
      * depends on `def.imageDelivery` (see `@jini-ai/agent-runtime`'s `types.ts`):
@@ -184,6 +192,8 @@ export interface AgentExecutorRunInput {
     readonly settingSources?: readonly string[];
     /** Forwarded verbatim to `RuntimeBuildOptions.settings` (extra settings JSON or file path for this run). */
     readonly settings?: string;
+    /** Forwarded verbatim to `RuntimeBuildOptions.chromeIntegration`; `undefined` = no browser-integration flag. */
+    readonly chromeIntegration?: boolean;
 }
 export interface AgentExecutor {
     /**
@@ -195,16 +205,19 @@ export interface AgentExecutor {
      * underlying run is always already transitioned to `'failed'` via
      * `lifecycle.finish()` before this rejects (see index.ts module doc's Invariant).
      */
-    run(requiredArgs: Pick<AgentExecutorRunInput, "runId" | "agentId" | "prompt" | "cwd">, optionalArgs?: Pick<AgentExecutorRunInput, "model" | "reasoning" | "permissionMode" | "imagePaths" | "imageContents" | "extraAllowedDirs" | "uploadRoot" | "credentialEnv" | "env" | "resumeSessionId" | "newSessionId" | "disallowedTools" | "allowedTools" | "settingSources" | "settings">): Promise<void>;
+    run(requiredArgs: Pick<AgentExecutorRunInput, "runId" | "agentId" | "prompt" | "cwd">, optionalArgs?: Pick<AgentExecutorRunInput, "model" | "reasoning" | "nativeToolAccess" | "nativeCapabilities" | "cliParity" | "permissionMode" | "imagePaths" | "imageContents" | "extraAllowedDirs" | "uploadRoot" | "credentialEnv" | "env" | "resumeSessionId" | "newSessionId" | "disallowedTools" | "allowedTools" | "settingSources" | "settings" | "chromeIntegration">): Promise<void>;
     /**
      * Delivers a message the human sent while `runId` is going straight into its live agent process
      * (see {@link UserMessageDelivery} for each outcome). A stream-json agent is interrupted first and
      * gets the message once the CLI acknowledges the interrupt, so this settles in milliseconds (at
      * most `INTERRUPT_ACK_TIMEOUT_MS`); it never waits on the agent's reply.
+     * Optional `imageContents` contains host-authorized pixels, encoded exactly as in an idle send.
      */
     sendUserMessage(requiredArgs: {
         readonly runId: string;
         readonly text: string;
+    }, optionalArgs?: {
+        readonly imageContents?: readonly MessageAttachmentImage[];
     }): Promise<UserMessageDelivery>;
 }
 /**
@@ -212,7 +225,8 @@ export interface AgentExecutor {
  * - `'delivered'` — the running turn was interrupted and the message written into the live
  *   session; the agent answers it next, in the same process and session.
  * - `'unsupported'` — the run is live, but its agent has no way to take input mid-run (its prompt
- *   is plain text or an RPC request). The host should interrupt and send it as the next turn.
+ *   is plain text or an RPC request). Queue attachment turns intact after the reply; text-only
+ *   turns may retain the interrupt-and-resume fallback.
  * - `'not-running'` — no live process will accept it: an unknown run, a finished one, or one whose
  *   last turn already ended and closed stdin. The run is ending; the host should send it next.
  */
@@ -260,7 +274,7 @@ export interface StdinCloseHandle {
     /** Journals a sent-to-stdin byte chunk, queued through the same FIFO {@link wireChildLifecycle} already uses for emitted events. No-op when no journal was configured (see `CreateAgentExecutorOptions.journal`). */
     recordSentBytes(content: string): void;
     /** Interrupts this child's turn, then writes a mid-run user message into its open stdin — see {@link AgentExecutor.sendUserMessage}. */
-    sendUserMessage(text: string): Promise<UserMessageDelivery>;
+    sendUserMessage(text: string, imageContents?: readonly MessageAttachmentImage[]): Promise<UserMessageDelivery>;
 }
 /**
  * Gap 3 (capability-routed continuation transport) — host-owned config for the
@@ -313,6 +327,17 @@ export interface ContinuationOptions {
  * interface that defaults to *nothing* rather than a real implementation).
  */
 export interface McpJsonInjectionOptions {
+    /** Read current host-registered tool IDs at launch, outside model-controlled input. */
+    readonly diagnosticToolIds?: () => readonly string[];
+    /**
+     * Visible registry IDs to resolve before the bridge's first tools/list, including for clients
+     * whose mid-run refresh is unverified. Independent of diagnostic/redaction IDs; this grants
+     * no execution permission. The bridge fetches authoritative descriptors using the run credential.
+     * @example startupToolIds: ({ runId }) => visibleToolsForRun(runId).map(tool => tool.id)
+     */
+    readonly startupToolIds?: (requiredArgs: {
+        readonly runId: string;
+    }, optionalArgs?: Record<string, never>) => readonly string[];
     /** Probe a reported bridge failure before emitting its error. @default true when injection is configured. */
     readonly probeOnFailure?: boolean;
     /** Absolute path (or PATH-resolvable name) to the `jini-mcp` bin entry (`packages/mcp/src/bin/serve.ts`) this driver tells the spawned CLI to launch as its own MCP server subprocess. */
@@ -401,12 +426,14 @@ export interface McpJsonInjectionOptions {
         readonly path: string;
     }) => Promise<void>;
     /** `'codex-toml'` only. Links the run home's sessions/archived_sessions to the operator's
-     * persistent rollout store. Config and auth remain isolated and are removed after the run.
+     * persistent rollout store and authentication. Parity also links user home entries; config alone stays isolated.
      * @default Native mkdir (0700) and directory symlinks; errors fail staging before spawn. */
     readonly linkSessionStore?: (required: {
         runHome: string;
         sourceHome: string;
-    }, optional?: {}) => Promise<void>;
+    }, optional?: {
+        inheritUserConfig?: boolean;
+    }) => Promise<void>;
 }
 /** One `.mcp.json` `mcpServers` entry — the shape Claude Code's own config schema expects. */
 export interface McpJsonServerEntry {
@@ -575,6 +602,10 @@ export interface FailureClassificationContext {
  */
 export type ClassifyFailure = (context: FailureClassificationContext) => boolean | Promise<boolean>;
 export interface CreateAgentExecutorOptions {
+    /** Negotiated v1 only; share with bridge/lifecycle. Absent preserves legacy diagnostics/echoes. */
+    readonly delegatedResultCorrelation?: DelegatedResultCorrelation;
+    /** Required with correlation + byte journal: exact stdout blobs and durable reference records. */
+    readonly stdoutJournalBlobs?: StdoutJournalBlobPort;
     /** Host environment snapshot; baseline spawn keys and source config paths are allowlisted. */
     readonly hostEnv?: NodeJS.ProcessEnv;
     readonly runtimeState?: AgentRuntimeState;

package/dist/agent-executor/event-translation.d.ts

@@ -63,7 +63,12 @@ interface AgentTranslationSideEffectSink {
     readonly onSessionId: (args: {
         readonly sessionId: string;
     }) => void;
-    readonly onToolCall: () => void;
+    /** Receives the already-narrowed `tool_use` payload, so a caller never re-checks its variant. */
+    readonly onToolCall: (args: {
+        readonly toolUse: Extract<RunAgentPayload, {
+            type: 'tool_use';
+        }>;
+    }) => void;
     readonly onUserVisibleOutput: () => void;
 }
 /**

package/dist/agent-executor/event-translation.js

@@ -101,6 +101,7 @@ function translateToolInputDeltaEvent(rawEvent) {
     };
 }
 export function translateToolResultEvent({ rawEvent }) {
+    const delegatedToolUseId = asOptionalString(rawEvent.delegatedToolUseId);
     const isError = typeof rawEvent.isError === 'boolean' ? rawEvent.isError : undefined;
     return {
         kind: 'agent',
@@ -108,6 +109,7 @@ export function translateToolResultEvent({ rawEvent }) {
             type: 'tool_result',
             toolUseId: asString(rawEvent.toolUseId),
             content: asString(rawEvent.content),
+            ...(delegatedToolUseId !== undefined ? { delegatedToolUseId } : {}),
             ...(isError !== undefined ? { isError } : {}),
         },
     };
@@ -224,7 +226,7 @@ export function applyAgentTranslationSideEffects({ payload, sessionId, sink }) {
     if (sessionId !== undefined)
         sink.onSessionId({ sessionId });
     if (payload.type === 'tool_use') {
-        sink.onToolCall();
+        sink.onToolCall({ toolUse: payload });
     }
     else if ((payload.type === 'text_delta' || payload.type === 'thinking_delta') && payload.delta.length > 0) {
         sink.onUserVisibleOutput();

package/dist/agent-executor/events.d.ts

@@ -1,3 +1,5 @@
+import type { DelegatedResultCorrelation } from '../delegated-result-correlation.js';
+import type { StdoutJournalBlobPort } from '../tool-result-diagnostics.js';
 import type { probeMcpBridge } from './mcp-bridge-probe.js';
 import type { ModelCatalogSnapshot } from '@jini-ai/agent-runtime';
 import type { ChildProcess } from 'node:child_process';
@@ -24,6 +26,8 @@ export declare function defaultCleanupFailureSink(context: AgentCleanupFailureCo
  */
 export declare const DEFAULT_BUFFERED_STDOUT_MAX_BYTES: number;
 interface WireChildLifecycleContext extends TerminateChildTreeDeps {
+    readonly delegatedResultCorrelation?: DelegatedResultCorrelation;
+    readonly stdoutJournalBlobs?: StdoutJournalBlobPort;
     readonly startingModel?: string;
     readonly modelCatalog?: ModelCatalogSnapshot;
     readonly runId: string;
@@ -162,6 +166,7 @@ interface RunAcpDispatchInput {
     readonly prompt: string;
     readonly cwd: string;
     readonly permissionMode: 'bypass' | 'restricted' | undefined;
+    readonly cliParity?: boolean | undefined;
     readonly model: string | undefined;
     readonly modelCatalog?: ModelCatalogSnapshot;
     readonly imagePaths: readonly string[];