@jini-ai/daemon 0.6.8 → 0.6.9

package/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.6.9 — 2026-10-22
+
+- 2026-10-22: Memory fixes (bounded event log and tool-executor audit), chromeIntegration option, provider-plugin registration, coverage.
+
 ## 0.6.8 — 2026-10-16
 
 - An unknown tool on the read-only gateway points to discovery, never a mutation 409 (75d37c32).

package/dist/agent-executor/antigravity-permissions.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Persist one server's MCP grant for agy, which has no run-scoped settings override.
+ * Reuses the platform lock and atomic writer; keeps the first existing file as a backup.
+ * Invalid settings and I/O failures reject before spawn rather than widening permissions.
+ * @complexity O(settings bytes), including the allow-list scan; bounded by the settings file.
+ */
+export declare function ensureAntigravityMcpPermission({ settingsPath, serverName }: {
+    settingsPath: string;
+    serverName: string;
+}, _options?: Record<string, never>): Promise<void>;
+//# sourceMappingURL=antigravity-permissions.d.ts.map

package/dist/agent-executor/antigravity-permissions.js

@@ -0,0 +1,64 @@
+import { constants, promises as fs } from 'node:fs';
+import { withFileLock, writeFileAtomicAsync } from '@jini-ai/platform/fs';
+import { isRecord } from './values.js';
+/** Read the current settings text; a missing file is undefined, every other failure rejects. */
+async function readSettingsText(settingsPath) {
+    try {
+        return await fs.readFile(settingsPath, 'utf8');
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+        return undefined;
+    }
+}
+/** Parse and validate the settings shape; anything unexpected rejects rather than widening permissions. */
+function parseSettings(raw) {
+    const settings = raw === undefined ? {} : JSON.parse(raw);
+    if (!isRecord(settings))
+        throw new Error('Antigravity settings must be an object');
+    const permissions = settings.permissions === undefined ? {} : settings.permissions;
+    if (!isRecord(permissions) || (permissions.allow !== undefined && !Array.isArray(permissions.allow))) {
+        throw new Error('Antigravity permissions.allow must be an array');
+    }
+    return { settings, permissions, allow: permissions.allow ?? [] };
+}
+/** The allow list holding exactly one copy of rule (first occurrence kept, order otherwise
+ * unchanged), or null when it already holds exactly one and nothing needs writing. */
+function grantedAllowList(allow, rule) {
+    const first = allow.indexOf(rule);
+    if (first < 0)
+        return [...allow, rule];
+    const deduped = allow.filter((entry, index) => entry !== rule || index === first);
+    return deduped.length === allow.length ? null : deduped;
+}
+async function backupOriginalOnce(settingsPath) {
+    // Never replace the first backup, including on subsequent launches after operator edits.
+    await fs.copyFile(settingsPath, `${settingsPath}.jini-backup`, constants.COPYFILE_EXCL)
+        .catch((error) => { if (error.code !== 'EEXIST')
+        throw error; });
+}
+/**
+ * Persist one server's MCP grant for agy, which has no run-scoped settings override.
+ * Reuses the platform lock and atomic writer; keeps the first existing file as a backup.
+ * Invalid settings and I/O failures reject before spawn rather than widening permissions.
+ * @complexity O(settings bytes), including the allow-list scan; bounded by the settings file.
+ */
+export async function ensureAntigravityMcpPermission({ settingsPath, serverName }, _options = {}) {
+    if (!/^[\w.-]+$/.test(serverName))
+        throw new Error('Invalid MCP server name');
+    const rule = `mcp(${serverName}/*)`;
+    await withFileLock({ lockPath: `${settingsPath}.jini-lock`, run: async () => {
+            const raw = await readSettingsText(settingsPath);
+            const { settings, permissions, allow } = parseSettings(raw);
+            const nextAllow = grantedAllowList(allow, rule);
+            if (nextAllow === null)
+                return;
+            if (raw !== undefined)
+                await backupOriginalOnce(settingsPath);
+            await writeFileAtomicAsync({ filePath: settingsPath, content: `${JSON.stringify({
+                    ...settings, permissions: { ...permissions, allow: nextAllow },
+                }, null, 2)}\n` }, { refuseSymlink: true });
+        } }, { createParent: true, timeoutMs: 5000 });
+}
+//# sourceMappingURL=antigravity-permissions.js.map

package/dist/agent-executor/contracts.d.ts

@@ -92,7 +92,7 @@ export type AgentRuntimeEventTranslation = {
     readonly kind: 'ignored';
 };
 /** Machine-readable failure reasons `run()` can reject with — every one is preceded by a `lifecycle.finish({status:'failed'})` call (see index.ts module doc's Invariant section). */
-export type AgentExecutorErrorCode = 'AGENT_MODEL_UNRESOLVED' | 'AGENT_PERMISSION_MODE_INVALID' | 'AGENT_NOT_FOUND' | 'AGENT_RUNTIME_UNSUPPORTED' | 'AGENT_BINARY_NOT_RESOLVED' | 'AGENT_SPAWN_FAILED' | 'AGENT_PROMPT_TOO_LARGE';
+export type AgentExecutorErrorCode = 'NATIVE_TOOL_POLICY_UNSUPPORTED' | 'AGENT_MODEL_UNRESOLVED' | 'AGENT_PERMISSION_MODE_INVALID' | 'AGENT_NOT_FOUND' | 'AGENT_RUNTIME_UNSUPPORTED' | 'AGENT_BINARY_NOT_RESOLVED' | 'AGENT_SPAWN_FAILED' | 'AGENT_PROMPT_TOO_LARGE';
 /** Thrown by `AgentExecutor.run()` on every failure path — never a bare `Error`, so callers can branch on `.code` instead of parsing `.message`. */
 export declare class AgentExecutorError extends Error {
     readonly code: AgentExecutorErrorCode;
@@ -119,6 +119,12 @@ export interface AgentExecutorRunInput {
      * delegate auto-approval, and any unknown mode is rejected before launching a process.
      */
     readonly permissionMode?: 'bypass' | 'restricted';
+    /** Host-authorized native shell/edit grant; unsupported restricted providers fail before spawn. */
+    readonly nativeToolAccess?: boolean;
+    /** Independent host-verified permissions, snapshotted for this run. */
+    readonly nativeCapabilities?: Partial<import('@jini-ai/agent-runtime').NativeCapabilities>;
+    /** Trusted-host CLI parity; never derived from prompt/context fields. */
+    readonly cliParity?: boolean;
     /**
      * Host-validated image files. How each one actually reaches the model
      * depends on `def.imageDelivery` (see `@jini-ai/agent-runtime`'s `types.ts`):
@@ -184,6 +190,8 @@ export interface AgentExecutorRunInput {
     readonly settingSources?: readonly string[];
     /** Forwarded verbatim to `RuntimeBuildOptions.settings` (extra settings JSON or file path for this run). */
     readonly settings?: string;
+    /** Forwarded verbatim to `RuntimeBuildOptions.chromeIntegration`; `undefined` = no browser-integration flag. */
+    readonly chromeIntegration?: boolean;
 }
 export interface AgentExecutor {
     /**
@@ -195,16 +203,19 @@ export interface AgentExecutor {
      * underlying run is always already transitioned to `'failed'` via
      * `lifecycle.finish()` before this rejects (see index.ts module doc's Invariant).
      */
-    run(requiredArgs: Pick<AgentExecutorRunInput, "runId" | "agentId" | "prompt" | "cwd">, optionalArgs?: Pick<AgentExecutorRunInput, "model" | "reasoning" | "permissionMode" | "imagePaths" | "imageContents" | "extraAllowedDirs" | "uploadRoot" | "credentialEnv" | "env" | "resumeSessionId" | "newSessionId" | "disallowedTools" | "allowedTools" | "settingSources" | "settings">): Promise<void>;
+    run(requiredArgs: Pick<AgentExecutorRunInput, "runId" | "agentId" | "prompt" | "cwd">, optionalArgs?: Pick<AgentExecutorRunInput, "model" | "reasoning" | "nativeToolAccess" | "nativeCapabilities" | "cliParity" | "permissionMode" | "imagePaths" | "imageContents" | "extraAllowedDirs" | "uploadRoot" | "credentialEnv" | "env" | "resumeSessionId" | "newSessionId" | "disallowedTools" | "allowedTools" | "settingSources" | "settings" | "chromeIntegration">): Promise<void>;
     /**
      * Delivers a message the human sent while `runId` is going straight into its live agent process
      * (see {@link UserMessageDelivery} for each outcome). A stream-json agent is interrupted first and
      * gets the message once the CLI acknowledges the interrupt, so this settles in milliseconds (at
      * most `INTERRUPT_ACK_TIMEOUT_MS`); it never waits on the agent's reply.
+     * Optional `imageContents` contains host-authorized pixels, encoded exactly as in an idle send.
      */
     sendUserMessage(requiredArgs: {
         readonly runId: string;
         readonly text: string;
+    }, optionalArgs?: {
+        readonly imageContents?: readonly MessageAttachmentImage[];
     }): Promise<UserMessageDelivery>;
 }
 /**
@@ -212,7 +223,8 @@ export interface AgentExecutor {
  * - `'delivered'` — the running turn was interrupted and the message written into the live
  *   session; the agent answers it next, in the same process and session.
  * - `'unsupported'` — the run is live, but its agent has no way to take input mid-run (its prompt
- *   is plain text or an RPC request). The host should interrupt and send it as the next turn.
+ *   is plain text or an RPC request). Queue attachment turns intact after the reply; text-only
+ *   turns may retain the interrupt-and-resume fallback.
  * - `'not-running'` — no live process will accept it: an unknown run, a finished one, or one whose
  *   last turn already ended and closed stdin. The run is ending; the host should send it next.
  */
@@ -260,7 +272,7 @@ export interface StdinCloseHandle {
     /** Journals a sent-to-stdin byte chunk, queued through the same FIFO {@link wireChildLifecycle} already uses for emitted events. No-op when no journal was configured (see `CreateAgentExecutorOptions.journal`). */
     recordSentBytes(content: string): void;
     /** Interrupts this child's turn, then writes a mid-run user message into its open stdin — see {@link AgentExecutor.sendUserMessage}. */
-    sendUserMessage(text: string): Promise<UserMessageDelivery>;
+    sendUserMessage(text: string, imageContents?: readonly MessageAttachmentImage[]): Promise<UserMessageDelivery>;
 }
 /**
  * Gap 3 (capability-routed continuation transport) — host-owned config for the
@@ -313,6 +325,17 @@ export interface ContinuationOptions {
  * interface that defaults to *nothing* rather than a real implementation).
  */
 export interface McpJsonInjectionOptions {
+    /** Read current host-registered tool IDs at launch, outside model-controlled input. */
+    readonly diagnosticToolIds?: () => readonly string[];
+    /**
+     * Visible registry IDs to resolve before the bridge's first tools/list, including for clients
+     * whose mid-run refresh is unverified. Independent of diagnostic/redaction IDs; this grants
+     * no execution permission. The bridge fetches authoritative descriptors using the run credential.
+     * @example startupToolIds: ({ runId }) => visibleToolsForRun(runId).map(tool => tool.id)
+     */
+    readonly startupToolIds?: (requiredArgs: {
+        readonly runId: string;
+    }, optionalArgs?: Record<string, never>) => readonly string[];
     /** Probe a reported bridge failure before emitting its error. @default true when injection is configured. */
     readonly probeOnFailure?: boolean;
     /** Absolute path (or PATH-resolvable name) to the `jini-mcp` bin entry (`packages/mcp/src/bin/serve.ts`) this driver tells the spawned CLI to launch as its own MCP server subprocess. */
@@ -401,12 +424,14 @@ export interface McpJsonInjectionOptions {
         readonly path: string;
     }) => Promise<void>;
     /** `'codex-toml'` only. Links the run home's sessions/archived_sessions to the operator's
-     * persistent rollout store. Config and auth remain isolated and are removed after the run.
+     * persistent rollout store and authentication. Parity also links user home entries; config alone stays isolated.
      * @default Native mkdir (0700) and directory symlinks; errors fail staging before spawn. */
     readonly linkSessionStore?: (required: {
         runHome: string;
         sourceHome: string;
-    }, optional?: {}) => Promise<void>;
+    }, optional?: {
+        inheritUserConfig?: boolean;
+    }) => Promise<void>;
 }
 /** One `.mcp.json` `mcpServers` entry — the shape Claude Code's own config schema expects. */
 export interface McpJsonServerEntry {

package/dist/agent-executor/event-translation.d.ts

@@ -63,7 +63,12 @@ interface AgentTranslationSideEffectSink {
     readonly onSessionId: (args: {
         readonly sessionId: string;
     }) => void;
-    readonly onToolCall: () => void;
+    /** Receives the already-narrowed `tool_use` payload, so a caller never re-checks its variant. */
+    readonly onToolCall: (args: {
+        readonly toolUse: Extract<RunAgentPayload, {
+            type: 'tool_use';
+        }>;
+    }) => void;
     readonly onUserVisibleOutput: () => void;
 }
 /**

package/dist/agent-executor/event-translation.js

@@ -224,7 +224,7 @@ export function applyAgentTranslationSideEffects({ payload, sessionId, sink }) {
     if (sessionId !== undefined)
         sink.onSessionId({ sessionId });
     if (payload.type === 'tool_use') {
-        sink.onToolCall();
+        sink.onToolCall({ toolUse: payload });
     }
     else if ((payload.type === 'text_delta' || payload.type === 'thinking_delta') && payload.delta.length > 0) {
         sink.onUserVisibleOutput();

package/dist/agent-executor/events.d.ts

@@ -162,6 +162,7 @@ interface RunAcpDispatchInput {
     readonly prompt: string;
     readonly cwd: string;
     readonly permissionMode: 'bypass' | 'restricted' | undefined;
+    readonly cliParity?: boolean | undefined;
     readonly model: string | undefined;
     readonly modelCatalog?: ModelCatalogSnapshot;
     readonly imagePaths: readonly string[];

package/dist/agent-executor/events.js

@@ -1,5 +1,7 @@
+import { appendSerialTask } from "@jini-ai/core/primitives";
 import { randomUUID } from 'node:crypto';
 import { createModelReceiptTracker } from './model-receipts.js';
+import { observeRunOutput } from './run-output.js';
 import { messageContentWithImages } from '../attachment-content.js';
 import { redactSecrets, } from '@jini-ai/core';
 import { createClaudeStreamHandler, createCopilotStreamHandler, createJsonEventStreamHandler, createQoderStreamHandler, attachAcpSession, attachPiRpcSession, } from '@jini-ai/agent-runtime';
@@ -61,6 +63,11 @@ async function terminateChildTree(deps, child) {
     const pids = deps.collectProcessTreePids({ processes, rootPids: [child.pid] });
     await deps.stopProcesses({ pids });
 }
+// A late emit can race a terminal run. Keep later events/cleanup ordered even after failure;
+// lifecycle exceptions can contain provider text, so report only this fixed diagnostic.
+function reportDroppedEmit() {
+    console.warn('[daemon] Queued lifecycle event could not be delivered.');
+}
 /** Default sink when a host does not supply `onCleanupFailure`: still observable, never silent. Redacted per SEC-007 (a spawn/permission error can embed paths/host detail). */
 export function defaultCleanupFailureSink(context) {
     // eslint-disable-next-line no-console
@@ -257,6 +264,7 @@ function bufferedStdoutTruncationNotice(droppedBytes, maxBytes) {
  */
 export function wireChildLifecycle(ctx) {
     const { runId, def, streamFormat, child, lifecycle, journal, continuation, classifyFailure } = ctx;
+    const output = observeRunOutput({ lifecycle, runId, agentName: def.name }, { plainStdout: streamFormat === 'plain' });
     const modelReceipt = createModelReceiptTracker(ctx.startingModel, ctx.modelCatalog?.models);
     let stdinClosed = false;
     let cancelRequested = false;
@@ -324,16 +332,7 @@ export function wireChildLifecycle(ctx) {
     /** Bytes the ceiling refused, reported verbatim on flush so truncation is never silent. */
     let droppedStdoutBytes = 0;
     function enqueueEmit(task) {
-        emitQueue = emitQueue.then(async () => {
-            try {
-                await task();
-            }
-            catch {
-                // A single emit failing (e.g. a race against an already-terminal
-                // run) must not block delivery of subsequently queued events —
-                // see this function's own doc.
-            }
-        });
+        emitQueue = appendSerialTask({ previous: emitQueue, task, onError: reportDroppedEmit });
     }
     if (ctx.startingModel)
         enqueueEmit(() => lifecycle.emit({ runId, input: { event: 'agent', data: { type: 'status', label: 'starting_model', model: ctx.startingModel } } }));
@@ -398,8 +397,10 @@ export function wireChildLifecycle(ctx) {
         controlScanBuffer += text;
         if (!text.includes('\n'))
             return;
-        const lines = controlScanBuffer.split('\n');
-        controlScanBuffer = lines.pop() ?? '';
+        // `text` holds a newline, so the buffer does: split off the complete lines, keep the partial tail.
+        const lastNewline = controlScanBuffer.lastIndexOf('\n');
+        const lines = controlScanBuffer.slice(0, lastNewline).split('\n');
+        controlScanBuffer = controlScanBuffer.slice(lastNewline + 1);
         for (const line of lines) {
             // Both checked: either word can also appear inside the other kind of line's text.
             if (line.includes('"control_response"'))
@@ -526,24 +527,18 @@ export function wireChildLifecycle(ctx) {
                 const receipt = modelReceipt(translation.payload);
                 if (receipt)
                     enqueueEmit(() => lifecycle.emit({ runId, input: { event: 'agent', data: receipt } }));
-                if (translation.sessionId !== undefined)
-                    capturedSessionId = translation.sessionId;
-                if (!bridgeChecked && translation.payload.type === 'status' && translation.payload.label === 'initializing') {
-                    bridgeChecked = true;
-                    const bridgeStatus = unavailableJiniBridgeStatus({ rawEvent: rawEvent });
-                    if (bridgeStatus !== undefined) {
-                        stopForUnavailableBridge(translation.payload, bridgeStatus);
-                        return;
-                    }
-                }
-                if (translation.payload.type === 'tool_use') {
-                    pendingToolUse = { id: translation.payload.id, name: translation.payload.name, input: translation.payload.input };
-                    toolCallSeen = true;
-                }
-                else if ((translation.payload.type === 'text_delta' || translation.payload.type === 'thinking_delta') &&
-                    translation.payload.delta.length > 0) {
-                    userVisibleOutputSeen = true;
-                }
+                applyAgentTranslationSideEffects({ payload: translation.payload, sessionId: translation.sessionId, sink: {
+                        onSessionId: ({ sessionId }) => { capturedSessionId = sessionId; },
+                        onToolCall: ({ toolUse }) => {
+                            // A tool signal always carries the tool_use variant (the sink hands it over narrowed);
+                            // retain its full input for continuation.
+                            pendingToolUse = { id: toolUse.id, name: toolUse.name, input: toolUse.input };
+                            toolCallSeen = true;
+                        },
+                        onUserVisibleOutput: () => { userVisibleOutputSeen = true; },
+                    } });
+                if (rejectUnavailableBridge({ payload: translation.payload, rawEvent }, {}))
+                    return;
                 enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'agent', data: statusWithChildIdentity({ payload: translation.payload, childPid: ctx.child.pid }, {}) } }));
             }
             else if (translation.kind === 'error') {
@@ -553,6 +548,17 @@ export function wireChildLifecycle(ctx) {
                 handleTurnEnd(translation.stopReason);
             }
         });
+    function rejectUnavailableBridge({ payload, rawEvent }, _options = {}) {
+        if (!bridgeChecked && payload.type === 'status' && payload.label === 'initializing') {
+            bridgeChecked = true;
+            const bridgeStatus = unavailableJiniBridgeStatus({ rawEvent });
+            if (bridgeStatus !== undefined) {
+                stopForUnavailableBridge(payload, bridgeStatus);
+                return true;
+            }
+        }
+        return false;
+    }
     /**
      * Ends a run whose CLI started without the `jini` bridge: emits the init status and a
      * {@link MCP_BRIDGE_UNAVAILABLE} error, then stops the child's process tree before the model can
@@ -693,20 +699,23 @@ export function wireChildLifecycle(ctx) {
             // Both of the next two steps are guarded: neither a failed cleanup nor a rejecting host
             // classifier may prevent the terminal transition below — see each helper's own doc.
             await cleanupStagedFilesSafely(ctx);
-            const status = bridgeUnavailable ? 'failed' : classifyRunCloseStatus({ cancelRequested, code }, { signal });
-            // A bridge failure is not resumable: resuming would start the same CLI with the same bridge.
-            const resumable = status === 'failed' && !bridgeUnavailable && classifyFailure !== undefined
-                ? await classifyFailureSafely(ctx, classifyFailure, {
-                    runId,
-                    agentId: def.id,
-                    code,
-                    signal: signal ?? null,
-                    sideEffects: { userVisibleOutputSeen, toolCallSeen },
-                })
-                : false;
+            const status = await output.settle({ status: bridgeUnavailable ? 'failed' : classifyRunCloseStatus({ cancelRequested, code }, { signal }) });
+            const resumable = await resolveChildResumable({ status, code, signal }, {});
             await lifecycle.finish({ runId, status, code, signal: signal ?? null, resumable }, { ...(capturedSessionId !== undefined ? { sessionRef: capturedSessionId } : {}) });
         })();
     });
+    async function resolveChildResumable({ status, code, signal }, _options = {}) {
+        // A bridge failure is not resumable: resuming would start the same CLI with the same bridge.
+        return status === 'failed' && !bridgeUnavailable && classifyFailure !== undefined
+            ? await classifyFailureSafely(ctx, classifyFailure, {
+                runId,
+                agentId: def.id,
+                code,
+                signal: signal ?? null,
+                sideEffects: { userVisibleOutputSeen, toolCallSeen },
+            })
+            : false;
+    }
     /**
      * A mid-run message: first an `interrupt` control request on the still-open stdin, so the agent
      * stops generating (or abandons the tool it is running) at once instead of finishing its whole
@@ -718,8 +727,10 @@ export function wireChildLifecycle(ctx) {
      * `turn_end` has closed stdin, or the process exits before the ack, there is no session left to
      * reach — `'not-running'`. Between turns, while stdin is held only for background tasks, there is
      * no generation to stop: the line is written at once and starts the next turn.
+     * Host-prepared images use the same content blocks as the initial stdin turn; no file tools
+     * or new directory grants are needed to see these pixels.
      */
-    async function sendUserMessage(text) {
+    async function sendUserMessage(text, images = []) {
         if (!acceptsMidRunUserMessages({ def: def }))
             return 'unsupported';
         const stdin = child.stdin;
@@ -727,7 +738,7 @@ export function wireChildLifecycle(ctx) {
             return 'not-running';
         if (heldForBackgroundTasks) {
             heldForBackgroundTasks = false;
-            writeUserMessage(stdin, text);
+            writeUserMessage(stdin, text, images);
             return 'delivered';
         }
         const requestId = `jini-interrupt-${randomUUID()}`;
@@ -753,12 +764,12 @@ export function wireChildLifecycle(ctx) {
         pendingInterruptAcks.delete(requestId);
         if (!processAlive || stdinClosed)
             return 'not-running';
-        writeUserMessage(stdin, text);
+        writeUserMessage(stdin, text, images);
         return 'delivered';
     }
-    /** Writes a mid-run message as the next user line, journals it, and emits its `user_message` run event. */
-    function writeUserMessage(stdin, text) {
-        stdin.write(`${JSON.stringify(streamJsonUserMessage({ content: [{ type: 'text', text: text }] }))}\n`, 'utf8');
+    /** Writes a complete mid-run turn using the idle image encoder; journals text without base64. */
+    function writeUserMessage(stdin, text, images) {
+        stdin.write(`${JSON.stringify(streamJsonUserMessage({ content: messageContentWithImages({ prompt: text, images }, {}) }))}\n`, 'utf8');
         if (journal)
             enqueueEmit(() => journal.record({ runId: runId, entry: sentJournalEntry(text) }));
         enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'agent', data: { type: 'user_message', id: randomUUID(), text: text } } }));
@@ -815,6 +826,22 @@ function backgroundTaskListLength({ line }) {
 function streamJsonUserMessage({ content }) {
     return { type: 'user', message: { role: 'user', content: content } };
 }
+/** Preserve ACP's distinction between absent fields and explicitly supplied empty values. */
+function acpSessionOptions({ ctx }, _options = {}) {
+    return {
+        cwd: ctx.cwd,
+        ...(ctx.cliParity ? { cliParity: true, stageTimeoutMs: 0 } : {}),
+        ...(ctx.permissionMode !== undefined ? { permissionMode: ctx.permissionMode } : {}),
+        ...(ctx.model !== undefined ? { model: ctx.model } : {}),
+        ...(ctx.imagePaths.length > 0 ? { imagePaths: [...ctx.imagePaths] } : {}),
+        ...(ctx.envFormat !== undefined ? { envFormat: ctx.envFormat } : {}),
+        // Spread-when-present rather than always: passing `mcpServers: []` is not the same as passing
+        // nothing for every downstream ACP agent, and "no bridge configured" must stay byte-identical
+        // to before this field existed.
+        ...(ctx.mcpServers !== undefined && ctx.mcpServers.length > 0 ? { mcpServers: [...ctx.mcpServers] } : {}),
+        ...(ctx.onPermissionRequest !== undefined ? { onPermissionRequest: ctx.onPermissionRequest } : {}),
+    };
+}
 /**
  * Wires an ACP child to a run. Unlike the JSON-stream path, ACP owns the
  * prompt protocol and reports its parsed events through `attachAcpSession`'s
@@ -827,6 +854,7 @@ function streamJsonUserMessage({ content }) {
 function wireAcpLifecycle(ctx) {
     const modelReceipt = createModelReceiptTracker(ctx.model, ctx.modelCatalog?.models);
     const { runId, agentId, child, lifecycle, journal, classifyFailure } = ctx;
+    const output = observeRunOutput({ lifecycle, runId, agentName: agentId });
     let cancelRequested = false;
     let emitQueue = Promise.resolve();
     // Gap 5 (session resume) — see wireChildLifecycle's identical local for the full rationale.
@@ -835,15 +863,7 @@ function wireAcpLifecycle(ctx) {
     let userVisibleOutputSeen = false;
     let toolCallSeen = false;
     function enqueueEmit(task) {
-        emitQueue = emitQueue.then(async () => {
-            try {
-                await task();
-            }
-            catch {
-                // A late event racing a terminal lifecycle is intentionally dropped;
-                // it must not prevent subsequent queued cleanup from running.
-            }
-        });
+        emitQueue = appendSerialTask({ previous: emitQueue, task, onError: reportDroppedEmit });
     }
     if (ctx.model)
         enqueueEmit(() => lifecycle.emit({ runId, input: { event: 'agent', data: { type: 'status', label: 'starting_model', model: ctx.model } } }));
@@ -873,7 +893,7 @@ function wireAcpLifecycle(ctx) {
             unsubscribeCancel();
             // Guarded for the same reasons as the child-driven handler above.
             await cleanupStagedFilesSafely(ctx);
-            const status = cancelRequested ? 'cancelled' : controller?.completedSuccessfully() ? 'succeeded' : 'failed';
+            const status = await output.settle({ status: cancelRequested ? 'cancelled' : controller?.completedSuccessfully() ? 'succeeded' : 'failed' });
             const resumable = status === 'failed' && classifyFailure !== undefined
                 ? await classifyFailureSafely(ctx, classifyFailure, {
                     runId,
@@ -908,11 +928,7 @@ function wireAcpLifecycle(ctx) {
             if (event === 'error') {
                 enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'error', data: translateAcpError(payload) } }));
             }
-        } }, { cwd: ctx.cwd, ...(ctx.permissionMode !== undefined ? { permissionMode: ctx.permissionMode } : {}), ...(ctx.model !== undefined ? { model: ctx.model } : {}), ...(ctx.imagePaths.length > 0 ? { imagePaths: [...ctx.imagePaths] } : {}), ...(ctx.envFormat !== undefined ? { envFormat: ctx.envFormat } : {}),
-        // Spread-when-present rather than always: passing `mcpServers: []` is not the same as passing
-        // nothing for every downstream ACP agent, and "no bridge configured" must stay byte-identical
-        // to before this field existed.
-        ...(ctx.mcpServers !== undefined && ctx.mcpServers.length > 0 ? { mcpServers: [...ctx.mcpServers] } : {}), ...(ctx.onPermissionRequest !== undefined ? { onPermissionRequest: ctx.onPermissionRequest } : {}) });
+        } }, acpSessionOptions({ ctx }, {}));
     return controller;
 }
 /**
@@ -937,6 +953,7 @@ function wireAcpLifecycle(ctx) {
 function wirePiRpcLifecycle(ctx) {
     const modelReceipt = createModelReceiptTracker(ctx.model, ctx.modelCatalog?.models);
     const { runId, agentId, child, lifecycle, journal, classifyFailure } = ctx;
+    const output = observeRunOutput({ lifecycle, runId, agentName: agentId });
     let cancelRequested = false;
     let emitQueue = Promise.resolve();
     // Gap 5 (session resume) — see wireChildLifecycle's identical local for the full rationale.
@@ -945,15 +962,7 @@ function wirePiRpcLifecycle(ctx) {
     let userVisibleOutputSeen = false;
     let toolCallSeen = false;
     function enqueueEmit(task) {
-        emitQueue = emitQueue.then(async () => {
-            try {
-                await task();
-            }
-            catch {
-                // A late event racing a terminal lifecycle is intentionally dropped;
-                // it must not prevent subsequent queued cleanup from running.
-            }
-        });
+        emitQueue = appendSerialTask({ previous: emitQueue, task, onError: reportDroppedEmit });
     }
     if (ctx.model)
         enqueueEmit(() => lifecycle.emit({ runId, input: { event: 'agent', data: { type: 'status', label: 'starting_model', model: ctx.model } } }));
@@ -983,7 +992,7 @@ function wirePiRpcLifecycle(ctx) {
             unsubscribeCancel();
             // Guarded for the same reasons as the child-driven handler above.
             await cleanupStagedFilesSafely(ctx);
-            const status = cancelRequested ? 'cancelled' : session?.hasFatalError() ? 'failed' : 'succeeded';
+            const status = await output.settle({ status: cancelRequested ? 'cancelled' : session?.hasFatalError() ? 'failed' : 'succeeded' });
             const resumable = status === 'failed' && classifyFailure !== undefined
                 ? await classifyFailureSafely(ctx, classifyFailure, {
                     runId,
@@ -1062,6 +1071,7 @@ export async function runAcpDispatch({ input, deps }) {
             prompt: input.prompt,
             cwd: input.cwd,
             permissionMode: input.permissionMode,
+            cliParity: input.cliParity,
             model: input.model,
             ...(input.modelCatalog ? { modelCatalog: input.modelCatalog } : {}),
             imagePaths: input.imagePaths,
@@ -1086,7 +1096,8 @@ export async function runAcpDispatch({ input, deps }) {
         // fired-and-forgotten (SEC-007: "await where lifecycle ordering allows it").
         await terminateChildTreeBestEffort({ listProcessSnapshots: deps.listProcessSnapshots, collectProcessTreePids: deps.collectProcessTreePids, stopProcesses: deps.stopProcesses }, input.child, input.runId, 'acp-attach-failure', deps.onCleanupFailure);
         await deps.releaseStagedResources();
-        await deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: could not attach ACP session for agent "${input.agentId}": ${errorMessage(err)}` });
+        // `failBeforeSpawn` always rejects (`Promise<never>`); returning it propagates that rejection.
+        return deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: could not attach ACP session for agent "${input.agentId}": ${errorMessage(err)}` });
     }
 }
 /** Phase 15 (pi-rpc branch): same discipline as {@link runAcpDispatch}, for the one `'pi-rpc'` def. */
@@ -1118,7 +1129,7 @@ export async function runPiRpcDispatch({ input, deps }) {
         // fire-and-forget (SEC-007).
         await terminateChildTreeBestEffort({ listProcessSnapshots: deps.listProcessSnapshots, collectProcessTreePids: deps.collectProcessTreePids, stopProcesses: deps.stopProcesses }, input.child, input.runId, 'pi-rpc-attach-failure', deps.onCleanupFailure);
         await deps.releaseStagedResources();
-        await deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: could not attach pi-rpc session for agent "${input.agentId}": ${errorMessage(err)}` });
+        return deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: could not attach pi-rpc session for agent "${input.agentId}": ${errorMessage(err)}` });
     }
 }
 //# sourceMappingURL=events.js.map

package/dist/agent-executor/launch.d.ts

@@ -189,9 +189,9 @@ export declare function computeRuntimeContext({ preparedPromptFile, preparedLogF
 /** Phase 9a: the def's `buildArgs` 4th argument. Historically omitted when every override was absent;
  * that let defs silently enable auto-approval. Always supply the validated restricted default now. Pure. */
 export declare function buildAgentBuildArgsOptions({ input, systemPromptOverlay }: {
-    readonly input: Pick<AgentExecutorRunInput, 'model' | 'reasoning' | 'permissionMode' | 'disallowedTools' | 'allowedTools' | 'settingSources' | 'settings'>;
+    readonly input: Pick<AgentExecutorRunInput, 'model' | 'reasoning' | 'permissionMode' | 'nativeToolAccess' | 'nativeCapabilities' | 'cliParity' | 'disallowedTools' | 'allowedTools' | 'settingSources' | 'settings' | 'chromeIntegration'>;
     readonly systemPromptOverlay: string | null | undefined;
-}): RuntimeBuildOptions | undefined;
+}): RuntimeBuildOptions;
 /**
  * **The single dispatch point from a computed system-prompt overlay to its delivery mechanism** —
  * see `RuntimeAgentDef.systemPromptDelivery`'s own doc for the declared shape. Pure and
@@ -290,6 +290,7 @@ export declare function buildRunArgs({ input, deps }: {
  * a defensive extra.
  * @param input.def - Only used for its `id`, in the failure message, and its `systemPromptDelivery` declaration.
  * @param input.overlay - The computed `PromptAugmenter.systemOverlay()` result for this run.
+ * @param deps.mkdtemp - Creates the run-scoped directory from a prefix; default a fresh `mkdtemp` under `os.tmpdir()`.
  * @complexity O(1) plus one directory creation and one file write.
  * @overallScore 100/100
  */
@@ -302,6 +303,7 @@ export declare function prepareSystemPromptOverlayFileIfNeeded({ input, deps }:
     readonly deps: {
         readonly releaseStagedResources: () => Promise<void>;
         readonly failBeforeSpawn: FailBeforeSpawn;
+        readonly mkdtemp?: (prefix: string) => Promise<string>;
     };
 }): Promise<PreparedSystemPromptOverlayFile | null>;
 /** Phase 11: post-`buildArgs` guard for argv-bound defs whose resolved binary is a Windows shim/.exe — a no-op off-Windows and for non-argv-bound defs. */