@jini-ai/daemon 0.6.8 → 0.6.9

package/dist/agent-executor/mcp-bridge-probe.js

@@ -3,6 +3,43 @@ import { createInterface } from 'node:readline';
 import { redactSecrets } from '@jini-ai/core';
 import { buildAgentEnv } from './agent-env.js';
 import { errorMessage, isRecord } from './values.js';
+const STDERR_TAIL_BYTES = 2000;
+/** Bounded stderr tail: keeps only the last STDERR_TAIL_BYTES bytes, redacted when read. */
+function createStderrTail() {
+    let stderr = Buffer.alloc(0);
+    return {
+        append: (chunk) => {
+            stderr = Buffer.concat([stderr, Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)]).subarray(-STDERR_TAIL_BYTES);
+        },
+        text: () => redactSecrets({ input: stderr.toString('utf8') }, {
+            extraPatterns: [{ name: 'daemon_token', regex: /JINI_DAEMON_TOKEN\s*=\s*\S+/gi }],
+        }).trim(),
+    };
+}
+/** Resolve on the first stdout line that is the initialize (id 1) result. */
+function watchInitializeReply(lines, onReply) {
+    lines.on('line', (line) => {
+        try {
+            const reply = JSON.parse(line);
+            if (isRecord(reply) && reply.id === 1 && Object.hasOwn(reply, 'result'))
+                onReply();
+        }
+        catch {
+            // Startup chatter is not an initialize response; keep waiting for the matching reply.
+        }
+    });
+}
+/** Always reap the probe child; cleanup failures never replace the probe's own diagnostic. */
+function reapProbe({ timer, lines, child }) {
+    clearTimeout(timer);
+    lines?.close();
+    try {
+        child?.kill('SIGKILL');
+    }
+    catch {
+        // A process already gone or refusing cleanup must not discard the original probe diagnostic.
+    }
+}
 /** Initialize a disposable bridge without a run credential; always reap it after the bounded probe.
  * Spawn/errors/exits/timeouts return diagnostics rather than rejecting. Stderr retains 2000 bytes.
  * @complexity O(n) in received bytes; stderr storage is bounded independently of child output.
@@ -15,63 +52,42 @@ export async function probeMcpBridge({ entry }, { spawn = nodeSpawn, baseEnv = b
     let child;
     let lines;
     let timer;
-    let stderr = Buffer.alloc(0);
-    const appendStderr = (chunk) => {
-        stderr = Buffer.concat([stderr, Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)]).subarray(-2000);
-    };
+    const stderr = createStderrTail();
     const result = (ok, exitCode = null, signal = null) => ({
-        ok, exitCode, signal,
-        stderrTail: redactSecrets({ input: stderr.toString('utf8') }, {
-            extraPatterns: [{ name: 'daemon_token', regex: /JINI_DAEMON_TOKEN\s*=\s*\S+/gi }],
-        }).trim(),
-        elapsedMs: now() - startedAt,
+        ok, exitCode, signal, stderrTail: stderr.text(), elapsedMs: now() - startedAt,
     });
+    let outcome;
     try {
         child = spawn(entry.command, [...entry.args], { env, stdio: 'pipe' });
         const bridge = child;
         lines = bridge.stdout ? createInterface({ input: bridge.stdout, crlfDelay: Infinity }) : undefined;
-        return await new Promise((resolve) => {
+        const reader = lines;
+        outcome = await new Promise((resolve) => {
             const fail = (error) => {
-                appendStderr(`\n${errorMessage(error)}`);
+                stderr.append(`\n${errorMessage(error)}`);
                 resolve(result(false));
             };
             timer = setTimeout(() => resolve(result(false)), timeoutMs);
             bridge.once('error', fail);
             bridge.once('exit', (code, signal) => resolve(result(false, code, signal)));
             bridge.once('close', (code, signal) => resolve(result(false, code, signal)));
-            bridge.stderr?.on('data', appendStderr);
+            bridge.stderr?.on('data', stderr.append);
             bridge.stdin?.once('error', fail);
-            if (lines) {
-                lines.once('error', fail);
-                lines.on('line', (line) => {
-                    try {
-                        const reply = JSON.parse(line);
-                        if (isRecord(reply) && reply.id === 1 && Object.hasOwn(reply, 'result'))
-                            resolve(result(true));
-                    }
-                    catch {
-                        // Startup chatter is not an initialize response; keep waiting for the matching reply.
-                    }
-                });
-            }
+            reader?.once('error', fail);
+            if (reader)
+                watchInitializeReply(reader, () => resolve(result(true)));
             bridge.stdin?.end(`${JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'initialize', params: {
                     protocolVersion: '2025-06-18', capabilities: {}, clientInfo: { name: 'jini-bridge-probe', version: '0' },
                 } })}\n`);
         });
     }
     catch (error) {
-        appendStderr(`\n${errorMessage(error)}`);
-        return result(false);
+        stderr.append(`\n${errorMessage(error)}`);
+        outcome = result(false);
     }
     finally {
-        clearTimeout(timer);
-        lines?.close();
-        try {
-            child?.kill('SIGKILL');
-        }
-        catch {
-            // A process already gone or refusing cleanup must not discard the original probe diagnostic.
-        }
+        reapProbe({ timer, lines, child });
     }
+    return outcome;
 }
 //# sourceMappingURL=mcp-bridge-probe.js.map

package/dist/agent-executor/mcp-bridge.d.ts

@@ -1,4 +1,5 @@
 import type { McpBridgeProbeResult } from './mcp-bridge-probe.js';
+import { ensureAntigravityMcpPermission } from './antigravity-permissions.js';
 import type { AcpMcpServerInput, RuntimeAgentDef } from '@jini-ai/agent-runtime';
 import type { McpJsonInjectionOptions, McpJsonServerEntry, McpBridgeDelivery, PreparedCodexHome, PreparedClaudeConfigDir, ClaudeConfigDirIsolationOptions, FailBeforeSpawn } from './contracts.js';
 /** The run-error code a run gets when its CLI reports the injected `jini` bridge as anything but connected. */
@@ -25,15 +26,14 @@ export declare function bridgeUnavailableMessage(status: string, probe?: McpBrid
  * `writeMcpJsonForRun`'s job, which keeps the effect out of this function.
  *
  * @param runId - The run this entry scopes its child to.
- * @param options - `command`/`args`/`daemonUrl`/`env` from the host's injection options.
+ * @param options - Launch settings and independent readers of diagnostic and visible startup IDs.
  * @param credential - The already-resolved bearer token, or `undefined` to omit `JINI_DAEMON_TOKEN`
  * entirely. Omitting produces byte-identical output to before this parameter existed.
- * @complexity O(1).
- * @overallScore 100/100
+ * @complexity O(t) output space/time for t launch environment and registered ID bytes.
  */
 export declare function buildMcpJsonServerEntry({ runId, options }: {
     readonly runId: string;
-    readonly options: Pick<McpJsonInjectionOptions, 'command' | 'args' | 'daemonUrl' | 'env'>;
+    readonly options: Pick<McpJsonInjectionOptions, 'command' | 'args' | 'daemonUrl' | 'env' | 'diagnosticToolIds' | 'startupToolIds'>;
 }, { credential }?: {
     readonly credential?: string;
 }): McpJsonServerEntry;
@@ -177,7 +177,9 @@ export declare function buildCodexMcpServerToml({ entry }: {
  * install carries — model choice, sandbox policy, the trusted-project list, the operator's own
  * other MCP servers — must survive a spawn byte-for-byte. Only the one table this driver itself
  * owns (`jini` is this integration's own reserved server name — see {@link JINI_MCP_SERVER_KEY}) is
- * ever removed, via the narrow line-oriented scan above, never a full TOML parse.
+ * removed by default, via the narrow line-oriented scan above, never a full TOML parse. Explicit
+ * per-run OFF choices additionally omit personal MCP tables or retain only those tables when
+ * user settings are off. Inline root MCP declarations fail closed when isolation is requested.
  * @param existingRaw - The real Codex home's `config.toml` content, or `undefined` when it does not
  * exist (a fresh Codex install — degrades to "start from just this run's block", matching
  * {@link mergeMcpJsonContent}'s own "missing file" handling).
@@ -185,10 +187,12 @@ export declare function buildCodexMcpServerToml({ entry }: {
  * @returns The full text to write to the scratch `CODEX_HOME`'s `config.toml`.
  * @complexity O(n) in the existing config's length.
  */
-export declare function buildCodexHomeConfigToml({ existingRaw, entry }: {
+export declare function buildCodexHomeConfigToml({ existingRaw, entry, inheritUserMcp, inheritUserSettings }: {
     readonly existingRaw: string | undefined;
     readonly entry: McpJsonServerEntry;
-}): string;
+    readonly inheritUserMcp?: boolean;
+    readonly inheritUserSettings?: boolean;
+}, _optional?: Record<string, never>): string;
 /**
  * Where `'codex-toml'` reads the operator's REAL Codex config from, to seed a run's scratch copy —
  * never where it writes. Resolved against the daemon HOST process's own environment (`hostEnv`,
@@ -250,7 +254,8 @@ export declare function defaultRemoveMcpJsonFile({ path }: {
 export declare function resolveSourceClaudeConfigDir({ hostEnv }: {
     readonly hostEnv: NodeJS.ProcessEnv;
 }): string;
-/** Phase 5: resolves this run's MCP bridge delivery (credential resolution + {@link buildMcpBridgeDelivery}). */
+/** Phase 5: resolve credentials and delivery, then await agy's scoped MCP permission setup.
+ * Setup errors release staged files and fail before spawn. @complexity O(settings bytes) for agy. */
 export declare function resolveMcpBridgeForRun({ input, deps }: {
     readonly input: {
         readonly runId: string;
@@ -261,6 +266,7 @@ export declare function resolveMcpBridgeForRun({ input, deps }: {
         readonly mcpJsonInjection: McpJsonInjectionOptions | undefined;
         readonly cleanupStagedFiles: () => Promise<void>;
         readonly failBeforeSpawn: FailBeforeSpawn;
+        readonly ensureAntigravityMcpPermission?: typeof ensureAntigravityMcpPermission;
     };
 }): Promise<McpBridgeDelivery | null>;
 /** Phase 10: mechanism 1 of 5's one effect — stages this run's own `.mcp.json`, returning the path `cleanupStagedFiles` should later remove (`undefined` for every other mechanism / unconfigured host). */
@@ -268,6 +274,8 @@ export declare function writeMcpJsonIfNeeded({ input, deps }: {
     readonly input: {
         readonly runId: string;
         readonly cwd: string;
+        readonly nativeToolAccess?: boolean | undefined;
+        readonly nativeCapabilities?: Partial<import('@jini-ai/agent-runtime').NativeCapabilities>;
         readonly def: RuntimeAgentDef;
         readonly mcpBridge: McpBridgeDelivery | null;
     };
@@ -290,6 +298,8 @@ export declare function writeMcpJsonIfNeeded({ input, deps }: {
 export declare function prepareCodexHomeIfNeeded({ input, deps }: {
     readonly input: {
         readonly runId: string;
+        readonly nativeToolAccess?: boolean | undefined;
+        readonly nativeCapabilities?: Partial<import('@jini-ai/agent-runtime').NativeCapabilities>;
         readonly def: RuntimeAgentDef;
         readonly mcpBridge: McpBridgeDelivery | null;
     };

package/dist/agent-executor/mcp-bridge.js

@@ -1,4 +1,5 @@
 import { promises as fsPromises, } from 'node:fs';
+import { ensureAntigravityMcpPermission } from './antigravity-permissions.js';
 import { homedir, tmpdir, } from 'node:os';
 import { join, resolve, } from 'node:path';
 import { isRecord, errorMessage, } from './values.js';
@@ -40,11 +41,10 @@ export function bridgeUnavailableMessage(status, probe) {
  * `writeMcpJsonForRun`'s job, which keeps the effect out of this function.
  *
  * @param runId - The run this entry scopes its child to.
- * @param options - `command`/`args`/`daemonUrl`/`env` from the host's injection options.
+ * @param options - Launch settings and independent readers of diagnostic and visible startup IDs.
  * @param credential - The already-resolved bearer token, or `undefined` to omit `JINI_DAEMON_TOKEN`
  * entirely. Omitting produces byte-identical output to before this parameter existed.
- * @complexity O(1).
- * @overallScore 100/100
+ * @complexity O(t) output space/time for t launch environment and registered ID bytes.
  */
 export function buildMcpJsonServerEntry({ runId, options }, { credential } = {}) {
     const hostEnv = Object.entries(options.env ?? {}).filter(([key]) => !key.startsWith('JINI_'));
@@ -55,6 +55,8 @@ export function buildMcpJsonServerEntry({ runId, options }, { credential } = {})
             ...Object.fromEntries(hostEnv),
             JINI_RUN_ID: runId,
             JINI_DAEMON_URL: options.daemonUrl,
+            ...(options.diagnosticToolIds ? { JINI_DIAGNOSTIC_TOOL_IDS: JSON.stringify(options.diagnosticToolIds()) } : {}),
+            ...(options.startupToolIds ? { JINI_STARTUP_TOOL_IDS: JSON.stringify(options.startupToolIds({ runId })) } : {}),
             ...(credential !== undefined ? { JINI_DAEMON_TOKEN: credential } : {}),
         },
     };
@@ -313,30 +315,43 @@ export function buildCodexMcpServerToml({ entry }) {
  * @complexity O(n) in the length of `rawKey`.
  */
 function splitTomlDottedKey(rawKey) {
-    const segments = [];
-    let current = '';
-    let quote = null;
+    const scan = { segments: [], current: '', quote: null };
     for (const ch of rawKey) {
-        if (quote) {
-            if (ch === quote)
-                quote = null;
-            else
-                current += ch;
-            continue;
-        }
-        if (ch === '"' || ch === "'") {
-            quote = ch;
-            continue;
-        }
-        if (ch === '.') {
-            segments.push(current.trim());
-            current = '';
-            continue;
-        }
-        current += ch;
+        if (scan.quote === null)
+            scanBareTomlKeyChar(scan, ch);
+        else if (ch === scan.quote)
+            scan.quote = null;
+        else
+            scan.current += ch;
+    }
+    scan.segments.push(scan.current.trim());
+    return scan.segments;
+}
+/** One key character outside quotes: opens a quote, ends the open segment at a `.`, or extends it. */
+function scanBareTomlKeyChar(scan, ch) {
+    if (ch === '"' || ch === "'")
+        scan.quote = ch;
+    else if (ch === '.') {
+        scan.segments.push(scan.current.trim());
+        scan.current = '';
     }
-    segments.push(current.trim());
-    return segments;
+    else
+        scan.current += ch;
+}
+// An inline or dotted root `mcp_servers` declaration, which the table scanner below cannot rewrite.
+const INLINE_MCP_SERVERS = /^\s*(?:mcp_servers|"mcp_servers"|'mcp_servers')\s*(?:\.|=)/;
+// `[<key>]` optionally followed only by a `# comment`; `[[...]]` never matches (see below).
+const TOML_TABLE_HEADER = /^\s*\[([^[\]]+)\]\s*(#.*)?$/;
+/**
+ * Whether {@link stripExistingJiniMcpServerTable} drops the table named `key`: always the jini
+ * table and its subtables; with `allServers` every MCP table; with `mcpOnly` every non-MCP table.
+ */
+function dropsTomlTable(key, optional) {
+    const jiniTableKey = `mcp_servers.${JINI_MCP_SERVER_KEY}`;
+    if (key === jiniTableKey || key.startsWith(`${jiniTableKey}.`))
+        return true;
+    const isMcp = key === 'mcp_servers' || key.startsWith('mcp_servers.');
+    return (optional.allServers === true && isMcp) || (optional.mcpOnly === true && !isMcp);
 }
 /**
  * Removes any pre-existing `[mcp_servers.{@link JINI_MCP_SERVER_KEY}]` table — and its
@@ -378,18 +393,19 @@ function splitTomlDottedKey(rawKey) {
  * @returns `existingRaw` with any jini table/subtable removed.
  * @complexity O(n) in the number of lines.
  */
-function stripExistingJiniMcpServerTable(existingRaw) {
-    const jiniTableKey = `mcp_servers.${JINI_MCP_SERVER_KEY}`;
+function stripExistingJiniMcpServerTable(existingRaw, optional = {}) {
     const kept = [];
-    let skipping = false;
+    let skipping = optional.mcpOnly === true;
     for (const line of existingRaw.split('\n')) {
-        const header = /^\s*\[([^[\]]+)\]\s*(#.*)?$/.exec(line);
-        if (header) {
-            const key = splitTomlDottedKey(header[1] ?? '').join('.');
-            skipping = key === jiniTableKey || key.startsWith(`${jiniTableKey}.`);
-            if (skipping)
-                continue;
+        // The existing table scanner cannot safely rewrite inline/dotted root server values. Refuse
+        // that uncommon shape when isolating servers rather than accidentally preserving a grant.
+        if (optional.allServers && INLINE_MCP_SERVERS.test(line)) {
+            throw new Error('Cannot turn off personal MCP servers: the Codex config.toml declares mcp_servers inline (a dotted key or `mcp_servers = {...}`), which cannot be removed safely; move each server into its own [mcp_servers.<name>] table.');
         }
+        const header = TOML_TABLE_HEADER.exec(line);
+        // The header's key capture group is not optional, so `header[1]` is always set on a match.
+        if (header)
+            skipping = dropsTomlTable(splitTomlDottedKey(header[1]).join('.'), optional);
         if (!skipping)
             kept.push(line);
     }
@@ -407,7 +423,9 @@ function stripExistingJiniMcpServerTable(existingRaw) {
  * install carries — model choice, sandbox policy, the trusted-project list, the operator's own
  * other MCP servers — must survive a spawn byte-for-byte. Only the one table this driver itself
  * owns (`jini` is this integration's own reserved server name — see {@link JINI_MCP_SERVER_KEY}) is
- * ever removed, via the narrow line-oriented scan above, never a full TOML parse.
+ * removed by default, via the narrow line-oriented scan above, never a full TOML parse. Explicit
+ * per-run OFF choices additionally omit personal MCP tables or retain only those tables when
+ * user settings are off. Inline root MCP declarations fail closed when isolation is requested.
  * @param existingRaw - The real Codex home's `config.toml` content, or `undefined` when it does not
  * exist (a fresh Codex install — degrades to "start from just this run's block", matching
  * {@link mergeMcpJsonContent}'s own "missing file" handling).
@@ -415,8 +433,8 @@ function stripExistingJiniMcpServerTable(existingRaw) {
  * @returns The full text to write to the scratch `CODEX_HOME`'s `config.toml`.
  * @complexity O(n) in the existing config's length.
  */
-export function buildCodexHomeConfigToml({ existingRaw, entry }) {
-    const base = stripExistingJiniMcpServerTable(existingRaw ?? '');
+export function buildCodexHomeConfigToml({ existingRaw, entry, inheritUserMcp = true, inheritUserSettings = true }, _optional = {}) {
+    const base = stripExistingJiniMcpServerTable(existingRaw ?? '', { allServers: !inheritUserMcp, mcpOnly: !inheritUserSettings });
     const separator = base.length === 0 ? '' : base.endsWith('\n') ? '\n' : '\n\n';
     return `${base}${separator}${buildCodexMcpServerToml({ entry: entry })}`;
 }
@@ -537,12 +555,12 @@ function mcpJsonPathForRun(cwd, runId) {
  * @complexity O(1) plus one `readFile`/`writeFile` round trip.
  * @overallScore 100/100
  */
-async function writeMcpJsonForRun(cwd, delivery, options) {
+async function writeMcpJsonForRun(cwd, delivery, options, inheritUserConfig = true) {
     const readFileFn = options.readFile ?? defaultReadMcpJsonFile;
     const writeFileFn = options.writeFile ?? defaultWriteMcpJsonFile;
     let existingRaw;
     try {
-        existingRaw = await readFileFn({ path: join(cwd, '.mcp.json') });
+        existingRaw = inheritUserConfig ? await readFileFn({ path: join(cwd, '.mcp.json') }) : undefined;
     }
     catch {
         // No existing file (ENOENT — the common case) or unreadable for any other reason: both
@@ -558,14 +576,24 @@ function defaultRemoveCodexHomeDir({ path }) {
     return fsPromises.rm(path, { recursive: true, force: true });
 }
 /** Config credentials stay run-scoped, but rollouts must survive both completion and cancellation.
- * Native directory links keep Codex as the sole writer of its own persisted session format.
- * Cleanup removes the links themselves, never their targets. Two fixed directories, O(1) I/O. */
-async function defaultLinkCodexSessionStore({ runHome, sourceHome }, _optional = {}) {
+ * Native links keep Codex as the sole writer of sessions and refreshed authentication.
+ * Parity also links skills/rules/plugins and other home entries; config.toml alone stays staged
+ * so run-scoped bearer tokens never reach the real config. Cleanup removes links, not targets.
+ * O(h) I/O for h top-level home entries; locked runs link only sessions and authentication. */
+async function defaultLinkCodexSessionStore({ runHome, sourceHome }, optional = {}) {
     for (const name of ['sessions', 'archived_sessions']) {
         const target = resolve(sourceHome, name);
         await fsPromises.mkdir(target, { recursive: true, mode: 0o700 });
         await fsPromises.symlink(target, join(runHome, name), 'junction');
     }
+    await fsPromises.symlink(join(sourceHome, 'auth.json'), join(runHome, 'auth.json'), 'file');
+    if (optional.inheritUserConfig !== false) {
+        for (const entry of await fsPromises.readdir(sourceHome, { withFileTypes: true })) {
+            if (['config.toml', 'auth.json', 'sessions', 'archived_sessions'].includes(entry.name))
+                continue;
+            await fsPromises.symlink(join(sourceHome, entry.name), join(runHome, entry.name), entry.isDirectory() ? 'junction' : 'file');
+        }
+    }
 }
 function resolveCodexHomeSeams(options) {
     return {
@@ -583,15 +611,15 @@ function resolveCodexHomeSeams(options) {
  *   - `config.toml`: the real Codex home's own config (read best-effort — see
  *     {@link buildCodexHomeConfigToml}'s "missing file" handling) with this run's
  *     `[mcp_servers.jini]` table appended.
- *   - `auth.json`: a best-effort copy of the real Codex home's stored login, so the spawned CLI is
+ *   - `auth.json`: a link to the real Codex home's stored login, so the spawned CLI is
  *     still authenticated. Best-effort is safe here, not merely convenient: a real headless spawn
  *     against a `CODEX_HOME` with no `auth.json` at all was confirmed (against installed Codex CLI
  *     0.151.0) to fail fast with a structured `401 Unauthorized` stream event, never an interactive
  *     login prompt or a hang — see `defs/codex.ts`'s module doc for the full transcript summary.
  *
- * **Never changes the real config or credentials.** Those source files stay read-only. Only the
- * native rollout directories are shared: deleting a run's scratch home must not erase the thread
- * whose id the host already persisted. No copied login or run-bound MCP credential is retained.
+ * Never changes the real config. Authentication is linked so a CLI token refresh survives cleanup;
+ * copying rotating credentials lost refreshes and could log the operator out. Deleting scratch
+ * state must not erase linked native state. The run-bound MCP credential stays in scratch config.
  *
  * A failure after the directory is created (a rejecting `writeFile`, most plausibly) does not leak
  * it: the directory may already hold a partial `config.toml` or a copied credential, so the
@@ -603,10 +631,10 @@ function resolveCodexHomeSeams(options) {
  * @param sourceCodexHomeDir - Where to read the real install's `config.toml`/`auth.json` from — see {@link resolveSourceCodexHomeDir}.
  * @param seams - Injectable mkdtemp/readFile/writeFile/removeDir/linkSessionStore, real filesystem by default.
  * @throws Whatever staging rejects with — the caller ({@link prepareCodexHomeIfNeeded}) turns that into a pre-spawn `AGENT_SPAWN_FAILED` failure, matching {@link writeMcpJsonForRun}'s own contract.
- * @complexity O(1): fixed directory links and up to two best-effort file read/write round trips.
+ * @complexity O(h) filesystem operations for h top-level user-home entries; one staged config write.
  * @overallScore 100/100
  */
-async function prepareCodexHomeForRun(runId, entry, sourceCodexHomeDir, seams) {
+async function prepareCodexHomeForRun(runId, entry, sourceCodexHomeDir, seams, inheritUserConfig = true, inheritUserMcp = true) {
     // Stricter than `@jini-ai/agent-runtime`'s `prepareAgentLogFile`/`preparePromptFileForAgent`
     // labels (which keep dots): this prefix stages a directory that ends up holding a copied Codex
     // login credential, so it gets `mcpJsonPathForRun`'s tighter discipline instead — dots stripped
@@ -617,23 +645,15 @@ async function prepareCodexHomeForRun(runId, entry, sourceCodexHomeDir, seams) {
     try {
         let existingConfigRaw;
         try {
-            existingConfigRaw = await seams.readFile({ path: join(sourceCodexHomeDir, 'config.toml') });
+            existingConfigRaw = inheritUserConfig || inheritUserMcp ? await seams.readFile({ path: join(sourceCodexHomeDir, 'config.toml') }) : undefined;
         }
         catch {
             // No config yet (fresh Codex install) or unreadable — start from just this run's block,
             // matching writeMcpJsonForRun's identical "missing file" handling.
             existingConfigRaw = undefined;
         }
-        await seams.writeFile({ path: join(dir, 'config.toml'), content: buildCodexHomeConfigToml({ existingRaw: existingConfigRaw, entry: entry }) });
-        try {
-            const authRaw = await seams.readFile({ path: join(sourceCodexHomeDir, 'auth.json') });
-            await seams.writeFile({ path: join(dir, 'auth.json'), content: authRaw });
-        }
-        catch {
-            // No stored login (or unreadable) — the spawned CLI runs unauthenticated. Confirmed above:
-            // this fails the run fast and observably, never as a hang.
-        }
-        await seams.linkSessionStore({ runHome: dir, sourceHome: sourceCodexHomeDir }, {});
+        await seams.writeFile({ path: join(dir, 'config.toml'), content: buildCodexHomeConfigToml({ existingRaw: existingConfigRaw, entry: entry, inheritUserMcp, inheritUserSettings: inheritUserConfig }) });
+        await seams.linkSessionStore({ runHome: dir, sourceHome: sourceCodexHomeDir }, { inheritUserConfig });
     }
     catch (err) {
         await seams.removeDir({ path: dir }).catch(() => {
@@ -756,25 +776,34 @@ async function prepareClaudeConfigDirForRun(runId, sourceConfigDir, seams) {
         },
     };
 }
-/** Phase 5: resolves this run's MCP bridge delivery (credential resolution + {@link buildMcpBridgeDelivery}). */
+/** Phase 5: resolve credentials and delivery, then await agy's scoped MCP permission setup.
+ * Setup errors release staged files and fail before spawn. @complexity O(settings bytes) for agy. */
 export async function resolveMcpBridgeForRun({ input, deps }) {
     try {
         // Awaited here rather than inside `buildMcpBridgeDelivery` so that function stays pure and
         // synchronous. `undefined` when the host supplied no resolver, which omits the token entirely.
         const credential = deps.mcpJsonInjection !== undefined ? await deps.mcpJsonInjection.credential?.({ runId: input.runId }) : undefined;
-        return buildMcpBridgeDelivery({
+        const delivery = buildMcpBridgeDelivery({
             cwd: input.cwd,
             runId: input.runId,
             strategy: input.def.externalMcpInjection,
             options: deps.mcpJsonInjection,
             credential,
         });
+        if (input.def.id === 'antigravity' && delivery?.kind === 'env-passthrough') {
+            await (deps.ensureAntigravityMcpPermission ?? ensureAntigravityMcpPermission)({
+                settingsPath: join(homedir(), '.gemini', 'antigravity-cli', 'settings.json'),
+                serverName: JINI_MCP_SERVER_KEY,
+            });
+        }
+        return delivery;
     }
     catch (err) {
         // Spawning a child that cannot authenticate would produce a run whose every bridged tool call
-        // 401s, so a rejecting credential resolver fails the run before spawn instead.
+        // 401s, so a rejecting credential resolver fails the run before spawn instead. Permission setup
+        // failure is fatal for the same reason: the agent would start without its tools.
         await deps.cleanupStagedFiles();
-        return deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: could not resolve the MCP bridge credential for agent "${input.def.id}": ${errorMessage(err)}` });
+        return deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: could not resolve the MCP bridge credential or permissions for agent "${input.def.id}": ${errorMessage(err)}` });
     }
 }
 /** Phase 10: mechanism 1 of 5's one effect — stages this run's own `.mcp.json`, returning the path `cleanupStagedFiles` should later remove (`undefined` for every other mechanism / unconfigured host). */
@@ -783,7 +812,7 @@ export async function writeMcpJsonIfNeeded({ input, deps }) {
         return undefined;
     }
     try {
-        await writeMcpJsonForRun(input.cwd, input.mcpBridge, deps.mcpJsonInjection);
+        await writeMcpJsonForRun(input.cwd, input.mcpBridge, deps.mcpJsonInjection, input.nativeToolAccess !== false && input.nativeCapabilities?.userMcp !== false);
         return input.mcpBridge.mcpJsonPath;
     }
     catch (err) {
@@ -791,6 +820,11 @@ export async function writeMcpJsonIfNeeded({ input, deps }) {
         return deps.failBeforeSpawn({ runId: input.runId, code: 'AGENT_SPAWN_FAILED', message: `AgentExecutor: could not write .mcp.json for agent "${input.def.id}": ${errorMessage(err)}` });
     }
 }
+/** True when a Codex run turns off the operator's personal MCP servers or settings, which only a staged home can do. */
+function codexTurnsOffPersonalConfig(input) {
+    const capabilities = input.nativeCapabilities;
+    return input.def.id === 'codex' && (capabilities?.userMcp === false || capabilities?.userSettings === false);
+}
 /**
  * Phase 10b: mechanism 5 of 5's one effect — stages this run's scratch `CODEX_HOME` directory,
  * returning the prepared handle `cleanupStagedFiles` should later release (`null` for every other
@@ -803,10 +837,16 @@ export async function writeMcpJsonIfNeeded({ input, deps }) {
  */
 export async function prepareCodexHomeIfNeeded({ input, deps }) {
     if (input.mcpBridge?.kind !== 'codex-toml' || deps.mcpJsonInjection === undefined) {
+        if (codexTurnsOffPersonalConfig(input)) {
+            await deps.releaseStagedResources();
+            return deps.failBeforeSpawn({ runId: input.runId, code: 'NATIVE_TOOL_POLICY_UNSUPPORTED',
+                message: 'AgentExecutor: disabling personal Codex configuration requires run-scoped home staging.' });
+        }
         return null;
     }
+    const nativeAllowed = input.nativeToolAccess !== false;
     try {
-        return await prepareCodexHomeForRun(input.runId, input.mcpBridge.serverEntry, resolveSourceCodexHomeDir({ hostEnv: deps.hostEnv }), resolveCodexHomeSeams(deps.mcpJsonInjection));
+        return await prepareCodexHomeForRun(input.runId, input.mcpBridge.serverEntry, resolveSourceCodexHomeDir({ hostEnv: deps.hostEnv }), resolveCodexHomeSeams(deps.mcpJsonInjection), nativeAllowed && input.nativeCapabilities?.userSettings !== false, nativeAllowed && input.nativeCapabilities?.userMcp !== false);
     }
     catch (err) {
         await deps.releaseStagedResources();

package/dist/agent-executor/run-output.d.ts

@@ -0,0 +1,20 @@
+import type { TerminalRunOutcome } from '../close-status.js';
+import type { RunLifecycle } from '../run-lifecycle.js';
+/**
+ * Observe canonical run events, including delegated MCP tools, and reject empty successes.
+ * Diagnostics are bounded to 8 KiB; raw progress and private thinking are not assistant output.
+ * Returns a close-time guard that unsubscribes and emits a readable error before terminal failure.
+ * @complexity O(received bytes), with bounded diagnostic storage.
+ */
+export declare function observeRunOutput({ lifecycle, runId, agentName }: {
+    lifecycle: RunLifecycle;
+    runId: string;
+    agentName: string;
+}, { plainStdout }?: {
+    plainStdout?: boolean;
+}): {
+    settle(input: {
+        status: TerminalRunOutcome;
+    }, options?: Record<string, never>): Promise<TerminalRunOutcome>;
+};
+//# sourceMappingURL=run-output.d.ts.map

package/dist/agent-executor/run-output.js

@@ -0,0 +1,80 @@
+import { redactSecrets } from '@jini-ai/core';
+// Only a terminal-prefixed failure overrides real output; ordinary assistant explanations
+// can mention empty output or headless permissions without being failed runs themselves.
+const DIAGNOSTIC_LINE = /^(?:jetski|agy|error|fatal):\s*(?:no (?:output|response) produced(?:\s*[—–:-]|[.!]\s*$)|(?:error:\s*)?permission denied\b.*headless|headless\b.*auto-denied)/i;
+/** Records whether the event is assistant text, tool activity or a run error. */
+function noteActivity(seen, event) {
+    if (event.kind === 'error')
+        seen.error = true;
+    if (event.kind !== 'agent')
+        return;
+    const payload = event.payload;
+    if (payload.type === 'text_delta' && payload.delta.trim())
+        seen.text = true;
+    if (payload.type === 'tool_use' || payload.type === 'tool_result')
+        seen.tool = true;
+}
+/**
+ * Appends a watched output chunk to its 8 KiB tail and keeps the latest failure line found there.
+ * stderr is always watched; stdout only for plain-stdout agents, whose stdout is the CLI's own text.
+ */
+function noteDiagnostic({ seen, tails, event, plainStdout }) {
+    if (event.kind !== 'stderr' && !(plainStdout && event.kind === 'stdout'))
+        return;
+    const channel = event.kind === 'stderr' ? 'stderr' : 'stdout';
+    tails[channel] = (tails[channel] + event.payload.chunk).slice(-8192);
+    const line = tails[channel].split(/\r?\n/).find(value => DIAGNOSTIC_LINE.test(value.trim()));
+    if (line)
+        seen.diagnostic = line;
+}
+/** True when the run's own outcome stands; false when the observed output turns it into a failure. */
+function keepsOutcome(status, seen) {
+    if (status === 'cancelled')
+        return true;
+    if (seen.diagnostic)
+        return false;
+    return status === 'failed' || (!seen.error && (seen.text || seen.tool));
+}
+/** The readable reason recorded when an apparently finished run is turned into a failure. */
+function failureReason(agentName, seen) {
+    if (seen.diagnostic) {
+        const cause = /headless|permission|auto-denied/i.test(seen.diagnostic) ? 'permission denied in headless mode' : 'no output produced';
+        return `${agentName} failed: ${cause}. ${seen.diagnostic}`;
+    }
+    return seen.error ? `${agentName} ended with an error.` : `${agentName} returned no assistant text or tool activity. Please retry.`;
+}
+/**
+ * Observe canonical run events, including delegated MCP tools, and reject empty successes.
+ * Diagnostics are bounded to 8 KiB; raw progress and private thinking are not assistant output.
+ * Returns a close-time guard that unsubscribes and emits a readable error before terminal failure.
+ * @complexity O(received bytes), with bounded diagnostic storage.
+ */
+export function observeRunOutput({ lifecycle, runId, agentName }, { plainStdout = false } = {}) {
+    const seen = { text: false, tool: false, error: false, diagnostic: undefined };
+    const tails = { stdout: '', stderr: '' };
+    const subscription = lifecycle.stream({ runId, onEvent: event => {
+            noteActivity(seen, event);
+            noteDiagnostic({ seen, tails, event, plainStdout });
+        } }).catch(error => {
+        // An observer failure is a daemon diagnostic, not evidence that the agent failed.
+        // eslint-disable-next-line no-console
+        console.warn(`[@jini-ai/daemon] agent-executor: output observer unavailable for run "${runId}"`, redactSecrets({ input: error instanceof Error ? error.message : String(error) }));
+        return null;
+    });
+    return {
+        async settle({ status }, _options = {}) {
+            const observer = await subscription;
+            // Without observation, missing events cannot prove an empty run; keep its real outcome.
+            if (observer?.kind !== 'ok')
+                return status;
+            observer.unsubscribe();
+            if (keepsOutcome(status, seen))
+                return status;
+            const message = redactSecrets({ input: failureReason(agentName, seen).slice(0, 1200) });
+            // A watchdog can already have settled the run; its terminal state must still win.
+            await lifecycle.emit({ runId, input: { event: 'error', data: { message } } }).catch(() => { });
+            return 'failed';
+        },
+    };
+}
+//# sourceMappingURL=run-output.js.map