@jini-ai/daemon 0.6.8 → 0.6.10

package/dist/tool-recovery/recovery.js

@@ -261,26 +261,37 @@ function planRemedyCall(input) {
         return undefined;
     return { remedyToolId, carryForward, askFor };
 }
+/** Prefill keys that name a secret (or a carrier of one) — never accepted as card metadata. */
+const SECRET_SHAPED_PREFILL_KEY = /token|secret|password|authorization|env|headers|body|key/i;
+/** Whether one prefill entry is plain card metadata: a key the setup schema declares that does not
+ *  name a secret, holding a JSON primitive, and — for a string — a value neither the secret detector
+ *  nor the credential-free assertion rejects. */
+function isMetadataPrefillEntry({ key, value, properties, deps }) {
+    if (!(key in properties) || SECRET_SHAPED_PREFILL_KEY.test(key))
+        return false;
+    if (!isJsonPrimitive(value))
+        return false;
+    if (typeof value !== "string")
+        return true;
+    if (deps.containsSecret({ text: value }))
+        return false;
+    try {
+        deps.assertCredentialFreeField({ value, field: key }, {});
+    }
+    catch {
+        return false;
+    }
+    return true;
+}
 /** Card schemas accept metadata only. Reject secret-shaped prefills before even asking. */
 function planCredentialSetup({ diagnostic, descriptor, deps }, _optional = {}) {
     const shape = resolveRemedySchemaShape(descriptor);
     if (!shape || diagnostic.setupToolId !== diagnostic.remedyToolId || !diagnostic.prefill)
         return undefined;
     const prefill = diagnostic.prefill;
-    for (const [key, value] of Object.entries(prefill)) {
-        if (!(key in shape.properties) || /token|secret|password|authorization|env|headers|body|key/i.test(key))
-            return undefined;
-        if (!isJsonPrimitive(value) || (typeof value === "string" && deps.containsSecret({ text: value })))
-            return undefined;
-        if (typeof value === "string") {
-            try {
-                deps.assertCredentialFreeField({ value, field: key }, {});
-            }
-            catch {
-                return undefined;
-            }
-        }
-    }
+    const allMetadata = Object.entries(prefill).every(([key, value]) => isMetadataPrefillEntry({ key, value, properties: shape.properties, deps }));
+    if (!allMetadata)
+        return undefined;
     if (shape.required.some(key => !(key in prefill)))
         return undefined;
     return { remedyToolId: diagnostic.remedyToolId, carryForward: prefill };
@@ -309,7 +320,8 @@ async function resolveRecoveryDecision(exchange, ui, askForKey) {
     return { proceed: true, answerValue };
 }
 function resolveRecoveryGate(input) {
-    const { diagnostic, principal, originalInput, registry, result, deps } = input;
+    const { diagnostic, principal, originalInput, result, deps } = input;
+    const { registry } = deps;
     const readOnlyRefusal = refuseNonReadOnlyDispatch({ principal, toolId: diagnostic.remedyToolId, registry, messages: deps.readOnlyMessages }, {});
     if (readOnlyRefusal !== null)
         return { attempt: false, outcome: { ...result, error: deps.formatReadOnlyRemedyRefusal({ refusal: readOnlyRefusal }) } };
@@ -346,6 +358,36 @@ function buildRemedyInput(plan, decision) {
         remedyInput[plan.askFor.key] = decision.answerValue;
     return remedyInput;
 }
+/**
+ * The remedy tool's input for an accepted gate, or `undefined` when the human did not give a usable
+ * go-ahead. A credential-setup diagnostic skips the recovery surface entirely: it goes directly to the
+ * masked card, which supplies its own human decision. Every other diagnostic asks first through the
+ * host-built recovery form.
+ */
+async function resolveRemedyInput(input) {
+    const { plan, diagnostic, principal, emitSurface, signal, deps } = input;
+    // Credential setup goes directly to the masked card; it supplies its own human decision.
+    if (diagnostic.setupToolId)
+        return { ...plan.carryForward };
+    const exchange = deps.surfaceExchanges.open({ binding: { toolId: deps.recoveryToolId, principalId: principal.id }, emit: emitSurface });
+    const ui = deps.buildRecoveryForm({ exchangeId: exchange.id, hint: diagnostic.hint, remedyToolId: diagnostic.remedyToolId, ...(plan.askFor ? { askFor: plan.askFor } : {}) }, {});
+    const decision = await collectRecoveryDecision({ exchange, ui, askForKey: plan.askFor?.key, signal });
+    // Declined, dismissed, expired, or a blank answer — the ORIGINAL failure is still the truth.
+    if (!decision.proceed)
+        return undefined;
+    return buildRemedyInput(plan, decision);
+}
+/** Whether the remedy call actually applied its fix — see the two cases in the comments below. */
+function remedyApplied(remedyResult) {
+    // The fix itself did not complete (denied, threw, timed out, ...) — nothing changed, so retrying
+    // the original would only reproduce the same failure.
+    if (remedyResult.status !== "completed")
+        return false;
+    // The remedy RAN, but its own result says the fix was never actually applied (a declined,
+    // expired, or invalid human-gated write) — see {@link remedyReportedFailure}. "Completed" is not
+    // "succeeded"; retrying here would only reproduce the same failure.
+    return !remedyReportedFailure(remedyResult.output);
+}
 /**
  * Wraps `inner` with the generic ask -> apply -> retry-once recovery loop described in this file's
  * header. A drop-in `ToolExecutor` — every method other than `execute` delegates straight through,
@@ -378,34 +420,21 @@ export function withToolFailureRecovery({ inner, ...deps }, _optional = {}) {
             // `withReadOnlyToolConstraint` would refuse the dispatch below regardless — it is the
             // enforcement, and it does not depend on this check — but a refusal discovered THERE arrives
             // only after a human has already been asked to fill in a form whose answer is then thrown away.
-            const gate = resolveRecoveryGate({ diagnostic, principal, originalInput: input, registry: deps.registry, result, deps });
+            const gate = resolveRecoveryGate({ diagnostic, principal, originalInput: input, result, deps });
             if (!gate.attempt)
                 return gate.outcome;
-            let remedyInput = { ...gate.plan.carryForward };
-            if (!diagnostic.setupToolId) {
-                const exchange = deps.surfaceExchanges.open({ binding: { toolId: deps.recoveryToolId, principalId: principal.id }, emit: emitSurface });
-                const ui = deps.buildRecoveryForm({ exchangeId: exchange.id, hint: diagnostic.hint, remedyToolId: diagnostic.remedyToolId, ...(gate.plan.askFor ? { askFor: gate.plan.askFor } : {}) }, {});
-                const decision = await collectRecoveryDecision({ exchange, ui, askForKey: gate.plan.askFor?.key, signal });
-                // Declined, dismissed, expired, or a blank answer — the ORIGINAL failure is still the truth.
-                if (!decision.proceed)
-                    return result;
-                remedyInput = buildRemedyInput(gate.plan, decision);
-            }
-            // Credential setup goes directly to the masked card; it supplies its own human decision.
+            const remedyInput = await resolveRemedyInput({ plan: gate.plan, diagnostic, principal, emitSurface, signal, deps });
+            // Declined, dismissed, expired, or a blank answer — the ORIGINAL failure is still the truth.
+            if (!remedyInput)
+                return result;
             // ---- STRUCTURAL ONE-CYCLE GUARD ----
             // Both calls below go straight to `inner` — never back through this function or the object it
             // returns. Whatever either one returns, including a fresh hint+remedyToolId of its own, is never
             // fed back into the scan above: that scan is written exactly once, above this comment, and
             // nothing here loops or recurses into it again. See this file's header.
             const remedyResult = await inner.execute({ ...required, toolId: diagnostic.remedyToolId, input: remedyInput }, optional);
-            // The fix itself did not complete (denied, threw, timed out, ...) — nothing changed, so retrying
-            // the original would only reproduce the same failure. Return the ORIGINAL result, untouched.
-            if (remedyResult.status !== "completed")
-                return result;
-            // The remedy RAN, but its own result says the fix was never actually applied (a declined,
-            // expired, or invalid human-gated write) — see {@link remedyReportedFailure}. "Completed" is not
-            // "succeeded"; retrying here would only reproduce the same failure.
-            if (remedyReportedFailure(remedyResult.output))
+            // The fix was not applied (see `remedyApplied`) — return the ORIGINAL result, untouched.
+            if (!remedyApplied(remedyResult))
                 return result;
             // Retry the ORIGINAL call exactly once, with its exact original input. Whatever this returns —
             // success or a fresh failure — is this wrapper's final answer.

package/dist/tool-recovery/stack.d.ts

@@ -41,7 +41,7 @@
  * Architectural role: `src/assistant` composition-layer adapter. Takes its collaborators as
  * arguments and constructs no policy, sink, or registry of its own.
  */
-import { type ToolExecutor } from "../tool-executor.js";
+import { type ToolExecutor, type PrepareToolGuidance } from "../tool-executor.js";
 import type { ToolRegistry } from "@jini-ai/core";
 import type { ToolAttemptAuditSink } from "../core/tool-audit.js";
 import type { SurfaceExchangeStore } from "../surface-exchanges.js";
@@ -49,6 +49,7 @@ import { type ToolFailureRecoveryDeps } from "./recovery.js";
 import { type RedactedToolFailuresDeps } from "./redaction.js";
 export interface AssistantToolExecutorDeps extends Omit<ToolFailureRecoveryDeps, "registry"> {
     readonly registry: ToolRegistry;
+    readonly prepareGuidance?: PrepareToolGuidance;
     readonly surfaceExchanges: SurfaceExchangeStore;
     readonly newExecutionId: () => string;
     /** Optional sink is a real supported configuration; never require a dummy observer. */

package/dist/tool-recovery/stack.js

@@ -51,7 +51,7 @@ import { withRedactedToolFailures, readToolErrorId } from "./redaction.js";
  * @complexity O(1) composition; each decorator owns its runtime cost.
  */
 export function createAssistantToolExecutor(deps, _optional = {}) {
-    const guarded = withReadOnlyToolConstraint({ inner: createToolExecutor({ registry: deps.registry }),
+    const guarded = withReadOnlyToolConstraint({ inner: createToolExecutor({ registry: deps.registry }, { ...(deps.prepareGuidance ? { prepareGuidance: deps.prepareGuidance } : {}) }),
         registry: deps.registry, idGenerator: { newId: deps.newExecutionId }, messages: deps.readOnlyMessages }, {});
     const redacted = withRedactedToolFailures({ inner: guarded, ...deps.toolFailures }, {});
     const audited = deps.toolAttemptAudit

package/dist/tool-result-diagnostics.d.ts

@@ -0,0 +1,27 @@
+/** Audit writers must store exact chunks in blobs and retain resolvable references separately.
+ * This port deliberately cannot masquerade as the inline RunByteJournal contract. */
+export interface StdoutJournalBlobPort {
+    /** Buffer chunks remain bytes, including UTF-8 characters split at OS read boundaries. */
+    record(input: {
+        runId: string;
+        chunk: string | Uint8Array;
+    }, options?: Record<string, never>): Promise<void>;
+}
+/** Projects one complete diagnostic frame; ordinary non-JSON output remains byte-identical. */
+export declare function projectDiagnosticFrame({ line }: {
+    line: string;
+}, { maxFrameChars }?: {
+    maxFrameChars?: number;
+}): string;
+/** Bounded JSONL framing: split chunks are held until complete, tails flush at close.
+ * Oversized frames produce an explicit notice and are discarded through their newline.
+ * @complexity O(n) total input characters; O(maxFrameChars) retained carry, no per-chunk joins. */
+export declare function createToolResultDiagnosticProjection(_input: Record<string, never>, { maxFrameChars }?: {
+    maxFrameChars?: number;
+}): {
+    feed({ chunk }: {
+        chunk: string;
+    }, _options?: {}): string;
+    flush(_input: Record<string, never>, _options?: {}): string;
+};
+//# sourceMappingURL=tool-result-diagnostics.d.ts.map

package/dist/tool-result-diagnostics.js

@@ -0,0 +1,77 @@
+function imageSummary(value) {
+    if (value.type !== 'image')
+        return undefined;
+    if (typeof value.mimeType === 'string' && typeof value.data === 'string') {
+        return { ...value, data: `[image ${value.mimeType}; ${value.data.length} base64 characters]` };
+    }
+    const source = value.source;
+    if (typeof source !== 'object' || source === null)
+        return undefined;
+    const image = source;
+    if (image.type !== 'base64' || typeof image.data !== 'string' || typeof image.media_type !== 'string')
+        return undefined;
+    return { ...value, source: { ...image, data: `[image ${image.media_type}; ${image.data.length} base64 characters]` } };
+}
+/** Redacts only recognized image fields, including JSON-encoded tool-result content.
+ * @complexity O(n) frame bytes, bounded by the framing limit before parsing. */
+function summarizeImages(_key, value) {
+    if (_key === 'content' && typeof value === 'string')
+        return projectDiagnosticFrame({ line: value });
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return value;
+    return imageSummary(value) ?? value;
+}
+/** Projects one complete diagnostic frame; ordinary non-JSON output remains byte-identical. */
+export function projectDiagnosticFrame({ line }, { maxFrameChars = 16 * 1024 * 1024 } = {}) {
+    if (line.length > maxFrameChars)
+        return '[diagnostic frame exceeded image projection limit]';
+    try {
+        return JSON.stringify(JSON.parse(line), summarizeImages);
+    }
+    catch {
+        return line;
+    }
+}
+/** Bounded JSONL framing: split chunks are held until complete, tails flush at close.
+ * Oversized frames produce an explicit notice and are discarded through their newline.
+ * @complexity O(n) total input characters; O(maxFrameChars) retained carry, no per-chunk joins. */
+export function createToolResultDiagnosticProjection(_input, { maxFrameChars = 16 * 1024 * 1024 } = {}) {
+    if (!Number.isSafeInteger(maxFrameChars) || maxFrameChars < 1)
+        throw new Error('diagnostic frame limit must be a positive integer');
+    let parts = [];
+    let size = 0;
+    let dropping = false;
+    function append(part) {
+        if (dropping || part.length === 0)
+            return;
+        size += part.length;
+        if (size > maxFrameChars) {
+            parts = [];
+            dropping = true;
+            return;
+        }
+        parts.push(part);
+    }
+    function finish() {
+        const line = dropping ? '[diagnostic frame exceeded image projection limit]' : projectDiagnosticFrame({ line: parts.join('') }, { maxFrameChars });
+        parts = [];
+        size = 0;
+        dropping = false;
+        return line;
+    }
+    return {
+        feed({ chunk }, _options = {}) {
+            const completed = [];
+            let start = 0;
+            for (let end = chunk.indexOf('\n'); end !== -1; end = chunk.indexOf('\n', start)) {
+                append(chunk.slice(start, end));
+                completed.push(finish(), '\n');
+                start = end + 1;
+            }
+            append(chunk.slice(start));
+            return completed.join('');
+        },
+        flush(_input, _options = {}) { return size > 0 || dropping ? finish() : ''; },
+    };
+}
+//# sourceMappingURL=tool-result-diagnostics.js.map

package/dist/tool-result-media.d.ts

@@ -1,3 +1,4 @@
+import type { ToolExecutionResult } from './tool-executor.js';
 /**
  * Extracts UI-renderable media blocks from a tool handler's raw MCP-style content envelope
  * (`{ content: [...] }`), for `delegated-tool-bridge.ts` and `agent-executor.ts` to attach to the
@@ -11,18 +12,9 @@
  * and is deliberately narrower: it recognizes exactly one block type today (`image`), and has no
  * withhold-from-model concept of its own.
  *
- * The two DO interact, though not by pipelining: `delegated-tool-bridge.ts`'s `execute()` calls both
- * of them against the SAME raw `executed.output`, not this module's `remainder` into
- * `splitToolResultSurfaces`. That used to be pipelined — this module removed recognized image
- * blocks from `content` before the surfaces pass ran, because `splitToolResultSurfaces`'s whitelist
- * used to recognize only `text`, and an image block left in place would have been swept into
- * `surfaces` and withheld from the model. Now that `image` is itself one of
- * `tool-result-surfaces.ts`'s `MODEL_VISIBLE_BLOCK_TYPES` (a deliberate addition — see that
- * constant's own doc), the surfaces pass classifies an image block correctly on its own, so there is
- * no misclassification left to prevent by removing it first. This module's `remainder` field is
- * therefore no longer read by that caller at all (kept for this module's own tests and any future
- * caller that wants a de-imaged copy); only `media` is used, to populate the `tool_result` event's
- * sibling `media` field for a UI that wants to render inline without re-parsing `content`.
+ * The surface whitelist runs on the original output first. Its model-visible result still
+ * contains images for MCP/model delivery. Only the event projection below serializes this
+ * module's de-imaged remainder, alongside one `media` array for rendering.
  *
  * ## Why only `image`, and why blocks are silently skipped rather than reported
  *
@@ -67,8 +59,7 @@ export interface ExtractResultMedia {
 }
 /**
  * Splits a tool handler's raw return value into its recognized media blocks and the remainder,
- * ready to feed onward into `splitToolResultSurfaces` (see this module's doc for why that order
- * matters).
+ * without modifying the model-facing output. Run the surface whitelist on the original first.
  *
  * @param output - A tool handler's raw return value (`ToolExecutionResult.output` when
  * `status === 'completed'`). Non-envelope values (the overwhelming majority of tools, which return
@@ -78,4 +69,26 @@ export interface ExtractResultMedia {
 export declare function extractResultMedia({ output }: {
     readonly output: unknown;
 }): ExtractResultMedia;
+/** Converts arbitrary registered-tool output into the string-bearing run protocol. */
+export declare function serializeDelegatedToolOutput({ output }: {
+    readonly output: unknown;
+}): string;
+/**
+ * Maps a `ToolExecutionResult`'s status to the string a delegated-tool caller (this bridge, or
+ * gap 3's stdin-tool-result injector in `agent-executor.ts`) reports back as the tool's visible
+ * output/failure reason. Exported so both real callers share one mapping rather than drifting.
+ */
+export declare function resultContent({ result }: {
+    readonly result: ToolExecutionResult;
+}): string;
+/** Projects a model-safe result into the saved event: pixels occur only in `media`.
+ * Uses the existing serializer and status mapping; callers keep the original for the model.
+ * @complexity O(n) output bytes, with O(n) transient serialization space. */
+export declare function projectToolResultEvent({ result }: {
+    result: ToolExecutionResult;
+}, _options?: {}): {
+    content: string;
+    isError?: true;
+    media?: readonly ToolResultMediaBlock[];
+};
 //# sourceMappingURL=tool-result-media.d.ts.map

package/dist/tool-result-media.js

@@ -1,39 +1,4 @@
-/**
- * Extracts UI-renderable media blocks from a tool handler's raw MCP-style content envelope
- * (`{ content: [...] }`), for `delegated-tool-bridge.ts` and `agent-executor.ts` to attach to the
- * `tool_result` wire event's new `media` field (`@jini-ai/protocol`'s `events.ts`).
- *
- * ## Why this is not `tool-result-surfaces.ts`
- *
- * That module's whitelist governs a SECURITY property: which blocks may reach the model versus
- * which are withheld for a human-only UI resource (MCP-UI, still deferred). This module answers a
- * different question — "does this block carry displayable media a chat pane can render inline" —
- * and is deliberately narrower: it recognizes exactly one block type today (`image`), and has no
- * withhold-from-model concept of its own.
- *
- * The two DO interact, though not by pipelining: `delegated-tool-bridge.ts`'s `execute()` calls both
- * of them against the SAME raw `executed.output`, not this module's `remainder` into
- * `splitToolResultSurfaces`. That used to be pipelined — this module removed recognized image
- * blocks from `content` before the surfaces pass ran, because `splitToolResultSurfaces`'s whitelist
- * used to recognize only `text`, and an image block left in place would have been swept into
- * `surfaces` and withheld from the model. Now that `image` is itself one of
- * `tool-result-surfaces.ts`'s `MODEL_VISIBLE_BLOCK_TYPES` (a deliberate addition — see that
- * constant's own doc), the surfaces pass classifies an image block correctly on its own, so there is
- * no misclassification left to prevent by removing it first. This module's `remainder` field is
- * therefore no longer read by that caller at all (kept for this module's own tests and any future
- * caller that wants a de-imaged copy); only `media` is used, to populate the `tool_result` event's
- * sibling `media` field for a UI that wants to render inline without re-parsing `content`.
- *
- * ## Why only `image`, and why blocks are silently skipped rather than reported
- *
- * `text` blocks already reach the model (and the UI, via `content`) through the existing flattened
- * string — duplicating them into `media` would be redundant, not additive, so this module leaves
- * them in `remainder` and never collects them. A block claiming `type: 'image'` without a string
- * `mimeType`/`data` is dropped rather than surfaced as a malformed-block error: a handler's return
- * value is untrusted input to this module (it may come from an external MCP server), and the
- * contract is "render what is well-formed, ignore what isn't" — the same fail-quiet posture
- * `serializeDelegatedToolOutput` already takes on a non-serializable output.
- */
+import { batchOutcomeFor } from '@jini-ai/core';
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
@@ -50,8 +15,7 @@ function asImageBlock(block) {
 }
 /**
  * Splits a tool handler's raw return value into its recognized media blocks and the remainder,
- * ready to feed onward into `splitToolResultSurfaces` (see this module's doc for why that order
- * matters).
+ * without modifying the model-facing output. Run the surface whitelist on the original first.
  *
  * @param output - A tool handler's raw return value (`ToolExecutionResult.output` when
  * `status === 'completed'`). Non-envelope values (the overwhelming majority of tools, which return
@@ -77,4 +41,53 @@ export function extractResultMedia({ output }) {
         return { remainder: output, media: [] };
     return { remainder: { ...output, content: kept }, media };
 }
+/** Converts arbitrary registered-tool output into the string-bearing run protocol. */
+export function serializeDelegatedToolOutput({ output }) {
+    if (typeof output === 'string')
+        return output;
+    if (output === undefined)
+        return '';
+    try {
+        const serialized = JSON.stringify(output);
+        return serialized === undefined ? String(output) : serialized;
+    }
+    catch {
+        return String(output);
+    }
+}
+/**
+ * Maps a `ToolExecutionResult`'s status to the string a delegated-tool caller (this bridge, or
+ * gap 3's stdin-tool-result injector in `agent-executor.ts`) reports back as the tool's visible
+ * output/failure reason. Exported so both real callers share one mapping rather than drifting.
+ */
+export function resultContent({ result }) {
+    switch (result.status) {
+        case 'completed':
+            return serializeDelegatedToolOutput({ output: result.output });
+        case 'denied':
+            return 'Tool execution denied by policy.';
+        case 'confirmation-denied':
+            return 'Tool execution denied during confirmation.';
+        case 'timed-out':
+            return 'Tool execution timed out.';
+        case 'cancelled':
+            return 'Tool execution cancelled.';
+        case 'failed':
+            return result.error ?? 'Tool execution failed.';
+    }
+}
+/** Projects a model-safe result into the saved event: pixels occur only in `media`.
+ * Uses the existing serializer and status mapping; callers keep the original for the model.
+ * @complexity O(n) output bytes, with O(n) transient serialization space. */
+export function projectToolResultEvent({ result }, _options = {}) {
+    const { remainder, media } = extractResultMedia({ output: result.output });
+    const isError = result.status !== 'completed'
+        || (batchOutcomeFor({ output: result.output }) ?? 'completed') !== 'completed'
+        || (isRecord(result.output) && result.output.isError === true);
+    return {
+        content: resultContent({ result: { ...result, output: remainder } }),
+        ...(isError ? { isError: true } : {}),
+        ...(media.length > 0 ? { media } : {}),
+    };
+}
 //# sourceMappingURL=tool-result-media.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/daemon",
-  "version": "0.6.8",
+  "version": "0.6.10",
   "description": "The stateful agent daemon runtime: run lifecycle, durable event-log port, the tool-execution boundary, agent executor, terminal sessions, and routines.",
   "license": "Apache-2.0",
   "repository": {
@@ -139,29 +139,29 @@
     "@types/pg": "8.23.1",
     "express": "^4.21.0",
     "@types/express": "^4.17.21",
-    "@jini-ai/db": "0.3.5",
-    "@jini-ai/http-kit": "0.4.2",
-    "@jini-ai/agent-runtime": "^0.4.11",
-    "@jini-ai/chat": "0.6.6",
-    "@jini-ai/platform": "^0.5.9",
-    "@jini-ai/core": "^0.4.7",
-    "@jini-ai/protocol": "^0.4.4"
+    "@jini-ai/http-kit": "0.6.10",
+    "@jini-ai/db": "0.6.10",
+    "@jini-ai/chat": "0.6.10",
+    "@jini-ai/core": "^0.6.10",
+    "@jini-ai/agent-runtime": "^0.6.10",
+    "@jini-ai/protocol": "^0.6.10",
+    "@jini-ai/platform": "^0.6.10"
   },
   "dependencies": {
-    "@jini-ai/core": "^0.4.7",
-    "@jini-ai/protocol": "^0.4.4"
+    "@jini-ai/protocol": "^0.6.10",
+    "@jini-ai/core": "^0.6.10"
   },
   "peerDependencies": {
     "node-pty": "^1.1.0",
-    "@jini-ai/db": "^0.3.2",
+    "@jini-ai/db": "^0.6.10",
     "kysely": "^0.29.6",
     "better-sqlite3": "^13.0.0",
     "@electric-sql/pglite": "0.5.8",
     "pg": "^8.23.0",
-    "@jini-ai/http-kit": "^0.4.0",
+    "@jini-ai/http-kit": "^0.6.10",
     "express": "^4.21.0 || ^5.0.0",
-    "@jini-ai/agent-runtime": "^0.4.10",
-    "@jini-ai/platform": "^0.5.5"
+    "@jini-ai/agent-runtime": "^0.6.10",
+    "@jini-ai/platform": "^0.6.10"
   },
   "peerDependenciesMeta": {
     "node-pty": {