@jini-ai/daemon 0.6.9 → 0.6.10

package/CHANGELOG.md

@@ -1,3 +1,147 @@
+## 0.6.10
+
+### Patch Changes
+
+- 4f52784: Stop advertising agents `AgentExecutor` cannot run.
+
+  The built-in `agents` feature scanned every runtime definition, but `AgentExecutor` rejects some of
+  them (`antigravity`, whose deferral is documented in that module). A consumer could therefore offer a
+  user an agent that failed the instant it was selected, with the mismatch visible nowhere.
+
+  - `@jini-ai/daemon` exports `isAgentExecutorSupported(def)` and `assessAgentExecutorCompatibility(def)`.
+    `run()` now consumes the latter instead of re-checking the conditions itself, so the discovery-time
+    answer and the run-time guards cannot drift apart. Error messages are unchanged.
+  - `@jini-ai/server`'s `agents` feature applies the predicate by default, and exports
+    `isExecutableDetectedAgent` for hosts that want it directly.
+
+  `antigravity`'s definition remains in `@jini-ai/agent-runtime` — the predicate is advisory, and a
+  non-`AgentExecutor` launch path can ignore it. An id with no registered def is kept rather than
+  dropped, so a host supplying its own `detector` is unaffected.
+
+  Note for anyone implementing something similar: the predicate deliberately takes the full
+  `RuntimeAgentDef`, not a projected `DetectedAgent`. That projection omits `maxPromptArgBytes`, and the
+  argv-bound defs (`aider`, `deepseek`) qualify solely through it — judging the projection would have
+  dropped two working agents while fixing one broken one.
+
+- 8ff5653: Drive Antigravity (`agy`) — the 24th and last agent definition `AgentExecutor` rejected.
+
+  `AgentExecutor` drove 23 of 24 registered definitions. Antigravity was rejected by an explicit
+  `def.id === 'antigravity'` guard, for two reasons that are real but narrow:
+
+  - **`agy` can print an OAuth sign-in URL to stdout and still exit 0.** Streaming stdout live shows
+    that URL to the user as if it were the model's reply — a URL that carries the daemon operator's
+    `client_id`/`redirect_uri` into a chat transcript, and that is useless to click anyway (`agy -p`
+    print mode has no field to paste the resulting auth code into).
+  - **`agy` has no `--model` flag.** The model choice is written into one process-global
+    `~/.gemini/antigravity-cli/settings.json` that `agy` reads on its own startup, so two concurrent
+    runs race: run A writes model A, A spawns, B writes model B, and only _then_ does A's `agy` read
+    the file — so A silently executes on B's model.
+
+  Both are now met by **declarative `RuntimeAgentDef` fields the executor reads generically**, joining
+  the 14 optional behavior flags (`promptViaFile`, `authProbe`, …) that already work this way. There is
+  no agent-id branch anywhere in the dispatch path — a deliberate divergence from Open Design's own
+  daemon, which hardcodes the id twice.
+
+  New on `@jini-ai/agent-runtime`'s `RuntimeAgentDef`:
+
+  - `needsAgentLogFile?: boolean` — asks the caller to stage a temp path and pass it as
+    `RuntimeContext.agentLogFilePath` before `buildArgs` runs, mirroring `promptViaFile`. Staged by the
+    new `prepareAgentLogFile(def, label)` (the sibling of `preparePromptFileForAgent`; it creates only
+    the `0o700` containing directory, since the log file is output the CLI authors, not input we do).
+  - `stdoutPolicy?: RuntimeStdoutPolicy` — `{buffering: 'live'}` (the default, and every other
+    definition's behavior) or `{buffering: 'until-close', sanitize?}`. A discriminated union rather
+    than two flat fields on purpose: a sanitizer is only meaningful on the buffered path, because the
+    pattern to redact can straddle two `'data'` chunks. Two independent flags would let a definition
+    declare a sanitizer the caller could not honor — a confidentiality gap that _looks_ closed.
+  - `runtimeLock?: RuntimeLock` — a mutex around a process-global side effect `buildArgs` performs.
+    Acquired before `buildArgs`, released on whichever of `waitForHandoff` settling or process exit
+    comes first. Releasing on exit is load-bearing, not a fallback: a watcher that stops polling means
+    "I stopped watching", never "the child definitely didn't read the file".
+
+  All three are stripped from the `DetectedAgent` registry projection. They instruct whoever _spawns_
+  the CLI, not whoever lists agents — and two carry closures, which `JSON.stringify` would flatten into
+  a misleading `{"buffering":"until-close"}` / `{}` rather than omit.
+
+  In `@jini-ai/daemon`, `AgentExecutor` now stages a log file when `needsAgentLogFile` is set (released
+  on every pre-spawn, spawn-failure, and close path alongside the prompt file, through one composed
+  `cleanupStagedFiles` closure), calls `runtimeLock.acquire()` before `buildArgs`, and branches its
+  `streamFormat: 'plain'` stdout handling on `stdoutPolicy`. `assessAgentExecutorCompatibility` no
+  longer rejects anything by id, and `isAgentExecutorSupported` now accepts all 24 definitions.
+
+  **No behavior change for any other agent.** Antigravity is the only definition declaring any of the
+  three fields; the other four `streamFormat: 'plain'` definitions (`grok-build`, `aider`, `deepseek`,
+  `qwen`) keep streaming live, per chunk, which `aider`'s and `deepseek`'s own comments call out as
+  deliberate. That is pinned by an explicit regression test rather than left implied.
+
+  One thing worth knowing if you consume the run event stream: on the buffered path the raw `'stdout'`
+  echo is held back and sanitized too, not just the `'agent'`/`text_delta` copy. Emitting an
+  unsanitized raw echo while withholding the chat copy would leak the exact string the sanitizer exists
+  to remove to any subscriber. The opt-in byte journal still records raw bytes per chunk — that is its
+  documented contract, and it deliberately lives in a separate `EventLog` instance that is never
+  replayed to run-event subscribers.
+
+- 3fe4d14: Store tool-result images once in media, preserve model-facing pixels, and provide opt-in digest-verified echo summaries and bounded image-safe diagnostics. Hosts with exact-byte journaling must inject a separate stdout blob/reference writer.
+
+  Preserve conflicting image representations during digest verification, and keep the required bridge executor authoritative when route dependencies supply optional settings.
+
+- e16a907: Choose reported-cost semantics from agent definition metadata rather than a vendor id; absent metadata retains per-run behavior.
+- 4f52784: Add `createRunScopedContextStore` and widen `ResolvedRunInput` with the executor's optional inputs.
+
+  **`createRunScopedContextStore<T>({ lifecycle })`** — bind/resolve/auto-evict keyed by run id, for
+  host-owned context that must survive the gap between starting a run and a later delegated call that
+  carries only that run's id. `resolve` fails closed (`RunContextNotBoundError`) rather than fabricating a
+  default, and bindings are evicted when the run reaches a terminal state.
+
+  `resolveRunInput` could already decode and stash such context, but it is handed no lifecycle and so
+  cannot register the eviction half — leaving a map that only grows and keeps stale authority resolvable.
+  Owning both halves together is the point. `T` is fully generic: this helper does not decode
+  `contextRef`, does not sign or verify anything, and has no notion of a principal. It is in-memory only,
+  and says so — after a restart every `resolve` fails, which is the correct posture rather than a gap.
+
+  **`ResolvedRunInput` now carries `permissionMode`, `model`, `reasoning`, and `credentialEnv`**, each
+  forwarded to `AgentExecutor.run()` only when present.
+
+  `permissionMode` is the load-bearing one and closes a real trap: every def with an auto-approve flag
+  (`bypassPermissions` / `--yolo` / `--dangerously-skip-permissions`) applies it by default when the field
+  is absent. A host that had been passing `'restricted'` to `AgentExecutor.run()` by hand and then adopted
+  `createDefaultRunStartHandler` would silently have started auto-approving every action — a security
+  regression wearing the clothes of a refactor. Existing behavior is unchanged: omitted fields are omitted
+  from the executor call, never passed as an explicit `undefined`.
+
+- 4f52784: Add a `sidecar-strict` security mode and per-run MCP credential propagation.
+
+  For a daemon whose threat model is **another process running as the same OS user** rather than a
+  remote attacker, the existing `jini-local` mode is a no-op: `registerApiBearerAuthMiddleware`
+  short-circuits for any loopback peer before it reads the `Authorization` header, and a `127.0.0.1`
+  bind keeps remote hosts out while doing nothing about a co-resident process. A consumer that spawns a
+  Jini daemon holding real authority — starting agent runs, executing tools against a real database —
+  previously had to write its own middleware.
+
+  - `@jini-ai/http-kit` gains `requireStrictBearerToken`: fail-closed 503 when the named token env var
+    is unset, 401 on mismatch, **no loopback exemption and no disable flag**. Its `tokenEnvVar` is
+    required with no default, so this package never names a host's secret.
+  - `composeJiniKernel` gains `security: { mode: 'sidecar-strict', host, tokenEnvVar, exemptPaths? }`.
+    Purely additive — `host` and `jini-local` are unchanged by construction, since the modes are arms of
+    a discriminated union. The strict gate mounts ahead of the JSON body parser, so a caller it rejects
+    never has its body parsed.
+  - `@jini-ai/daemon`'s `McpJsonInjectionOptions` gains `credential?: (runId) => string | Promise<string>`
+    — a **resolver, not a string**, because injection options are built once before any run exists and a
+    boot-wide shared secret would defeat the point of scoping a credential to a run. It is delivered to
+    the child as `JINI_DAEMON_TOKEN`.
+  - `@jini-ai/mcp`'s `jini-mcp` reads that variable and attaches `Authorization` to every daemon call.
+    Optional throughout: with no credential, request headers and `.mcp.json` output are byte-identical
+    to before.
+
+  Also generalized: both existing bearer gates now compare tokens in constant time (`timingSafeEqual`)
+  and share one header-parsing helper, closing a timing side channel and removing a duplicated regex.
+
+- Updated dependencies [22f0619]
+- Updated dependencies [82ed2d3]
+- Updated dependencies [3fe4d14]
+- Updated dependencies [5a3de86]
+  - @jini-ai/core@0.6.10
+  - @jini-ai/protocol@0.6.10
+
 ## 0.6.9 — 2026-10-22
 
 - 2026-10-22: Memory fixes (bounded event log and tool-executor audit), chromeIntegration option, provider-plugin registration, coverage.

package/dist/agent-executor/contracts.d.ts

@@ -1,3 +1,5 @@
+import type { DelegatedResultCorrelation } from '../delegated-result-correlation.js';
+import type { StdoutJournalBlobPort } from '../tool-result-diagnostics.js';
 import type { MessageAttachmentImage } from '../attachment-content.js';
 import type { probeMcpBridge } from './mcp-bridge-probe.js';
 import type { spawn as nodeSpawn, ChildProcess } from 'node:child_process';
@@ -600,6 +602,10 @@ export interface FailureClassificationContext {
  */
 export type ClassifyFailure = (context: FailureClassificationContext) => boolean | Promise<boolean>;
 export interface CreateAgentExecutorOptions {
+    /** Negotiated v1 only; share with bridge/lifecycle. Absent preserves legacy diagnostics/echoes. */
+    readonly delegatedResultCorrelation?: DelegatedResultCorrelation;
+    /** Required with correlation + byte journal: exact stdout blobs and durable reference records. */
+    readonly stdoutJournalBlobs?: StdoutJournalBlobPort;
     /** Host environment snapshot; baseline spawn keys and source config paths are allowlisted. */
     readonly hostEnv?: NodeJS.ProcessEnv;
     readonly runtimeState?: AgentRuntimeState;

package/dist/agent-executor/event-translation.js

@@ -101,6 +101,7 @@ function translateToolInputDeltaEvent(rawEvent) {
     };
 }
 export function translateToolResultEvent({ rawEvent }) {
+    const delegatedToolUseId = asOptionalString(rawEvent.delegatedToolUseId);
     const isError = typeof rawEvent.isError === 'boolean' ? rawEvent.isError : undefined;
     return {
         kind: 'agent',
@@ -108,6 +109,7 @@ export function translateToolResultEvent({ rawEvent }) {
             type: 'tool_result',
             toolUseId: asString(rawEvent.toolUseId),
             content: asString(rawEvent.content),
+            ...(delegatedToolUseId !== undefined ? { delegatedToolUseId } : {}),
             ...(isError !== undefined ? { isError } : {}),
         },
     };

package/dist/agent-executor/events.d.ts

@@ -1,3 +1,5 @@
+import type { DelegatedResultCorrelation } from '../delegated-result-correlation.js';
+import type { StdoutJournalBlobPort } from '../tool-result-diagnostics.js';
 import type { probeMcpBridge } from './mcp-bridge-probe.js';
 import type { ModelCatalogSnapshot } from '@jini-ai/agent-runtime';
 import type { ChildProcess } from 'node:child_process';
@@ -24,6 +26,8 @@ export declare function defaultCleanupFailureSink(context: AgentCleanupFailureCo
  */
 export declare const DEFAULT_BUFFERED_STDOUT_MAX_BYTES: number;
 interface WireChildLifecycleContext extends TerminateChildTreeDeps {
+    readonly delegatedResultCorrelation?: DelegatedResultCorrelation;
+    readonly stdoutJournalBlobs?: StdoutJournalBlobPort;
     readonly startingModel?: string;
     readonly modelCatalog?: ModelCatalogSnapshot;
     readonly runId: string;

package/dist/agent-executor/events.js

@@ -1,3 +1,4 @@
+import { createToolResultDiagnosticProjection, projectDiagnosticFrame } from '../tool-result-diagnostics.js';
 import { appendSerialTask } from "@jini-ai/core/primitives";
 import { randomUUID } from 'node:crypto';
 import { createModelReceiptTracker } from './model-receipts.js';
@@ -9,7 +10,7 @@ import { collectProcessTreePids, listProcessSnapshots, stopProcesses, } from '@j
 import { classifyRunCloseStatus, } from '../close-status.js';
 import { resolveContinuationTransport, } from '../continuation/continuation-transport.js';
 import { resultContent, } from '../delegated-tool-bridge.js';
-import { extractResultMedia, } from '../tool-result-media.js';
+import { projectToolResultEvent, } from '../tool-result-media.js';
 import { translateAgentRuntimeEvent, translateAcpError, applyAgentTranslationSideEffects, } from './event-translation.js';
 import { errorMessage, isRecord, } from './values.js';
 import { MCP_BRIDGE_UNAVAILABLE, unavailableJiniBridgeStatus, bridgeUnavailableMessage, } from './mcp-bridge.js';
@@ -202,6 +203,35 @@ export const DEFAULT_BUFFERED_STDOUT_MAX_BYTES = 8 * 1024 * 1024;
 function bufferedStdoutTruncationNotice(droppedBytes, maxBytes) {
     return `\n[jini] agent stdout truncated: ${droppedBytes} byte(s) dropped after the ${maxBytes}-byte buffer limit was reached.\n`;
 }
+/** Keeps exact-byte auditing separate from retained diagnostics on the run's existing FIFO.
+ * Projection retains at most one bounded frame; ordinary stdout keeps its legacy byte journal. */
+function createStdoutDiagnostics({ ctx, enqueueEmit }, _options = {}) {
+    const { runId, lifecycle, journal, stdoutJournalBlobs } = ctx;
+    const projection = ctx.delegatedResultCorrelation && ctx.streamFormat === 'claude-stream-json'
+        ? createToolResultDiagnosticProjection({}) : undefined;
+    function emit({ text }) {
+        if (text)
+            enqueueEmit(() => lifecycle.emit({ runId, input: { event: 'stdout', data: { chunk: text } } }));
+    }
+    return {
+        record({ chunk, text }) {
+            if (!journal)
+                return;
+            if (projection && stdoutJournalBlobs) {
+                enqueueEmit(() => stdoutJournalBlobs.record({ runId, chunk }));
+            }
+            else {
+                enqueueEmit(() => journal.record({ runId, entry: receivedJournalEntry('stdout', text) }));
+            }
+        },
+        feed({ text }) {
+            emit({ text: projection ? projection.feed({ chunk: text }) : text });
+        },
+        flush() {
+            emit({ text: projection?.flush({}) ?? '' });
+        },
+    };
+}
 /**
  * Wires one spawned child's full observable lifecycle: raw stdout/stderr
  * forwarding, structured stream-parser dispatch (translated via
@@ -264,6 +294,7 @@ function bufferedStdoutTruncationNotice(droppedBytes, maxBytes) {
  */
 export function wireChildLifecycle(ctx) {
     const { runId, def, streamFormat, child, lifecycle, journal, continuation, classifyFailure } = ctx;
+    const stdoutDiagnostics = createStdoutDiagnostics({ ctx, enqueueEmit });
     const output = observeRunOutput({ lifecycle, runId, agentName: def.name }, { plainStdout: streamFormat === 'plain' });
     const modelReceipt = createModelReceiptTracker(ctx.startingModel, ctx.modelCatalog?.models);
     let stdinClosed = false;
@@ -478,11 +509,8 @@ export function wireChildLifecycle(ctx) {
             const run = { id: runId };
             let content;
             let isError;
-            // Same extraction `delegated-tool-bridge.ts`'s `execute()` runs, kept consistent per
-            // `resultContent`'s own doc ("both callers share one mapping"). This path never ran
-            // `splitToolResultSurfaces` (it has no `mcp-ui` withhold-from-model concept — the flattened
-            // `content` below already carries the whole raw output, a pre-existing, unrelated gap), so
-            // there is no `remainder` to thread back in — only the extracted blocks are used here.
+            // Event projection removes pixels only from saved content; stdin keeps the original.
+            let eventContent;
             let media = [];
             // Suspend the slow-run watchdog for the duration of this daemon-awaited execution: the daemon
             // knows exactly why the run is quiet here (it dispatched the tool itself and is waiting on it),
@@ -494,11 +522,14 @@ export function wireChildLifecycle(ctx) {
             try {
                 const result = await continuation.toolExecutor.execute({ principal: continuation.principal, run: run, toolId: toolUse.name, input: toolUse.input });
                 content = resultContent({ result: result });
-                isError = result.status !== 'completed';
-                media = extractResultMedia({ output: result.output }).media;
+                const projection = projectToolResultEvent({ result });
+                eventContent = projection.content;
+                isError = projection.isError === true;
+                media = projection.media ?? [];
             }
             catch (error) {
                 content = errorMessage(error);
+                eventContent = content;
                 isError = true;
             }
             finally {
@@ -509,7 +540,7 @@ export function wireChildLifecycle(ctx) {
                     data: {
                         type: 'tool_result',
                         toolUseId: toolUse.id,
-                        content,
+                        content: eventContent,
                         ...(isError ? { isError: true } : {}),
                         ...(media.length > 0 ? { media } : {}),
                     },
@@ -539,7 +570,10 @@ export function wireChildLifecycle(ctx) {
                     } });
                 if (rejectUnavailableBridge({ payload: translation.payload, rawEvent }, {}))
                     return;
-                enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'agent', data: statusWithChildIdentity({ payload: translation.payload, childPid: ctx.child.pid }, {}) } }));
+                enqueueEmit(() => {
+                    const payload = projectEcho({ payload: translation.payload, rawEvent }, {});
+                    return lifecycle.emit({ runId, input: { event: 'agent', data: statusWithChildIdentity({ payload, childPid: ctx.child.pid }, {}) } });
+                });
             }
             else if (translation.kind === 'error') {
                 enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'error', data: translation.payload } }));
@@ -548,6 +582,17 @@ export function wireChildLifecycle(ctx) {
                 handleTurnEnd(translation.stopReason);
             }
         });
+    /** Verify against an already-saved call in this run; unverified metadata preserves all output. */
+    function projectEcho({ payload, rawEvent }, _options = {}) {
+        if (!ctx.delegatedResultCorrelation)
+            return payload;
+        if (payload.type === 'raw')
+            return { ...payload, line: projectDiagnosticFrame({ line: payload.line }) };
+        if (payload.type !== 'tool_result' || !payload.delegatedToolUseId || !Array.isArray(rawEvent.delegatedResultContent))
+            return payload;
+        const matches = ctx.delegatedResultCorrelation.matches({ runId, toolUseId: payload.delegatedToolUseId, content: rawEvent.delegatedResultContent, isError: payload.isError === true });
+        return matches ? { ...payload, content: `Result shown by delegated call ${payload.delegatedToolUseId}.` } : payload;
+    }
     function rejectUnavailableBridge({ payload, rawEvent }, _options = {}) {
         if (!bridgeChecked && payload.type === 'status' && payload.label === 'initializing') {
             bridgeChecked = true;
@@ -616,8 +661,7 @@ export function wireChildLifecycle(ctx) {
     }
     child.stdout?.on('data', (chunk) => {
         const text = chunk.toString('utf8');
-        if (journal)
-            enqueueEmit(() => journal.record({ runId: runId, entry: receivedJournalEntry('stdout', text) }));
+        stdoutDiagnostics.record({ chunk, text });
         if (streamFormat === 'plain') {
             if (text.length > 0)
                 userVisibleOutputSeen = true;
@@ -643,7 +687,7 @@ export function wireChildLifecycle(ctx) {
             enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'agent', data: { type: 'text_delta', delta: text } } }));
             return;
         }
-        enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'stdout', data: { chunk: text } } }));
+        stdoutDiagnostics.feed({ text });
         // Before the parser: an ack and the aborted turn's end can share a chunk, and the turn end must
         // see that no interrupt is still waiting (see `stdinHoldAfterTurnEnd`); a background task
         // starting and the turn's end can share one too.
@@ -686,6 +730,7 @@ export function wireChildLifecycle(ctx) {
             // driver dispatches to. `streamHandler` is null for `'plain'` (no
             // parser, hence nothing to flush) — `?.` skips it cleanly.
             streamHandler?.flush();
+            stdoutDiagnostics.flush();
             // Queued before `await emitQueue` so the flushed text is durably appended ahead of
             // `finish()`'s `'end'` event, exactly like every live-path emit already is.
             flushBufferedStdout();

package/dist/agent-executor/launch.d.ts

@@ -381,6 +381,6 @@ export declare function confirmChildSpawned({ input, deps }: {
  * @complexity `run()`'s own setup is O(1); steady-state cost is the chosen stream parser's.
  * @overallScore 100/100
  */
-export declare function createAgentExecutor(requiredArgs: Pick<CreateAgentExecutorOptions, "lifecycle">, optionalArgs?: Pick<CreateAgentExecutorOptions, "runtimeState" | "codexDisablePlugins" | "piGracefulShutdownMs" | "hostEnv" | "getAgentDef" | "resolveAgentLaunch" | "resolveModelForLaunch" | "ensureAgentCapabilities" | "applyAgentLaunchEnv" | "createCommandInvocation" | "spawn" | "probeMcpBridge" | "attachAcpSession" | "acpPermissionHandler" | "attachPiRpcSession" | "preparePromptFileForAgent" | "prepareAgentLogFile" | "listProcessSnapshots" | "collectProcessTreePids" | "stopProcesses" | "onCleanupFailure" | "journal" | "continuation" | "classifyFailure" | "mcpJsonInjection" | "claudeConfigDirIsolation" | "claudeConfigDirIsolationEnabled" | "bufferedStdoutMaxBytes" | "promptAugmenter">): AgentExecutor;
+export declare function createAgentExecutor(requiredArgs: Pick<CreateAgentExecutorOptions, "lifecycle">, optionalArgs?: Pick<CreateAgentExecutorOptions, "runtimeState" | "codexDisablePlugins" | "piGracefulShutdownMs" | "hostEnv" | "getAgentDef" | "resolveAgentLaunch" | "resolveModelForLaunch" | "ensureAgentCapabilities" | "applyAgentLaunchEnv" | "createCommandInvocation" | "spawn" | "probeMcpBridge" | "attachAcpSession" | "acpPermissionHandler" | "attachPiRpcSession" | "preparePromptFileForAgent" | "prepareAgentLogFile" | "listProcessSnapshots" | "collectProcessTreePids" | "stopProcesses" | "onCleanupFailure" | "journal" | "delegatedResultCorrelation" | "stdoutJournalBlobs" | "continuation" | "classifyFailure" | "mcpJsonInjection" | "claudeConfigDirIsolation" | "claudeConfigDirIsolationEnabled" | "bufferedStdoutMaxBytes" | "promptAugmenter">): AgentExecutor;
 export {};
 //# sourceMappingURL=launch.d.ts.map

package/dist/agent-executor/launch.js

@@ -616,6 +616,12 @@ export async function confirmChildSpawned({ input, deps }) {
 function nativeCapabilityInput({ input }, _options = {}) {
     return { ...(input.nativeCapabilities !== undefined ? { nativeCapabilities: input.nativeCapabilities } : {}) };
 }
+/** Correlation projects retained stdout, so exact-byte journals need a separate blob writer. */
+function validateStdoutJournalOptions(options, _options = {}) {
+    if (options.delegatedResultCorrelation && options.journal && !options.stdoutJournalBlobs) {
+        throw new Error('delegated result correlation with a byte journal requires stdoutJournalBlobs');
+    }
+}
 /** Model discovery consumes the exact spawn environment and caller-supplied settings. */
 function launchModelContext({ input, launch, spawnEnv }, _options = {}) {
     return {
@@ -664,6 +670,7 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
     const { getAgentDef: getAgentDefFn, resolveAgentLaunch: resolveAgentLaunchFn, ensureAgentCapabilities: ensureAgentCapabilitiesFn, applyAgentLaunchEnv: applyAgentLaunchEnvFn, attachAcpSession: attachAcpSessionFn, attachPiRpcSession: attachPiRpcSessionFn, preparePromptFileForAgent: preparePromptFileForAgentFn, prepareAgentLogFile: prepareAgentLogFileFn, } = resolveAgentRuntimeDeps({ ...options, hostEnv });
     const { createCommandInvocation: createCommandInvocationFn, spawn: spawnFn, listProcessSnapshots: listProcessSnapshotsFn, collectProcessTreePids: collectProcessTreePidsFn, stopProcesses: stopProcessesFn, } = resolveProcessDeps(options);
     const { onCleanupFailure: onCleanupFailureFn, bufferedStdoutMaxBytes } = resolveMiscExecutorDeps(options);
+    validateStdoutJournalOptions(options);
     const journal = options.journal;
     const continuation = options.continuation;
     const classifyFailure = options.classifyFailure;
@@ -811,6 +818,8 @@ export function createAgentExecutor(requiredArgs, optionalArgs = {}) {
                 onCleanupFailure: onCleanupFailureFn,
                 cleanupStagedFiles,
                 journal,
+                ...(options.delegatedResultCorrelation ? { delegatedResultCorrelation: options.delegatedResultCorrelation } : {}),
+                ...(options.stdoutJournalBlobs ? { stdoutJournalBlobs: options.stdoutJournalBlobs } : {}),
                 continuation,
                 classifyFailure,
                 bufferedStdoutMaxBytes,

package/dist/delegated-result-correlation.d.ts

@@ -0,0 +1,26 @@
+import type { CredentialCryptoPort } from './run-credentials.js';
+interface ResultIdentity {
+    readonly runId: string;
+    readonly toolUseId: string;
+    readonly content: readonly unknown[];
+    readonly isError: boolean;
+}
+/** Run-scoped proof of a saved bridge result. Implementations retain digests, never pixels. */
+export interface DelegatedResultCorrelation {
+    record(input: ResultIdentity, options?: Record<string, never>): void;
+    matches(input: ResultIdentity, options?: Record<string, never>): boolean;
+    clearRun(input: {
+        runId: string;
+    }, options?: Record<string, never>): void;
+}
+/** Bounded digest store. Eviction only disables summarization, so legacy output remains safe.
+ * Share this instance with bridge/executor/lifecycle; lifecycle eviction clears each run.
+ * @complexity O(n) hashing plus JSON key sorting; O(r*c) retained fixed-size digests. */
+export declare function createDelegatedResultCorrelation({ crypto }: {
+    crypto: Pick<CredentialCryptoPort, 'digest'>;
+}, { maxRuns, maxCallsPerRun }?: {
+    maxRuns?: number;
+    maxCallsPerRun?: number;
+}): DelegatedResultCorrelation;
+export {};
+//# sourceMappingURL=delegated-result-correlation.d.ts.map

package/dist/delegated-result-correlation.js

@@ -0,0 +1,68 @@
+/** Accept only the complete base64 source shape; extra fields must remain part of the digest. */
+function base64ImageSource({ source }, _options = {}) {
+    if (typeof source !== 'object' || source === null)
+        return undefined;
+    const image = source;
+    if (image.type !== 'base64' || typeof image.media_type !== 'string' || typeof image.data !== 'string' || Object.keys(image).length !== 3)
+        return undefined;
+    return { data: image.data, media_type: image.media_type };
+}
+/** Convert only source-only images; dual representations and extra source fields stay in the proof. */
+function normalizeSourceImage({ record }, _options = {}) {
+    if (record.type !== 'image' || 'data' in record || 'mimeType' in record)
+        return record;
+    const image = base64ImageSource({ source: record.source });
+    if (!image)
+        return record;
+    const { source: _source, ...rest } = record;
+    return { ...rest, data: image.data, mimeType: image.media_type };
+}
+/** Normalize unambiguous CLI images and JSON object key order.
+ * @complexity O(n + k log k) for n bytes and k keys per object; inputs are wire JSON. */
+function normalizedJson(_key, value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return value;
+    const record = normalizeSourceImage({ record: value });
+    return Object.fromEntries(Object.keys(record).sort().map(key => [key, record[key]]));
+}
+/** Bounded digest store. Eviction only disables summarization, so legacy output remains safe.
+ * Share this instance with bridge/executor/lifecycle; lifecycle eviction clears each run.
+ * @complexity O(n) hashing plus JSON key sorting; O(r*c) retained fixed-size digests. */
+export function createDelegatedResultCorrelation({ crypto }, { maxRuns = 256, maxCallsPerRun = 2048 } = {}) {
+    if (!Number.isSafeInteger(maxRuns) || maxRuns < 1 || !Number.isSafeInteger(maxCallsPerRun) || maxCallsPerRun < 1)
+        throw new Error('correlation limits must be positive integers');
+    const runs = new Map();
+    // Optional correlation must not turn an otherwise serializable legacy fallback into a failure
+    // (for example, a cyclic in-process tool result handled by serializeDelegatedToolOutput).
+    const digest = (input) => {
+        try {
+            return crypto.digest({ token: JSON.stringify({ isError: input.isError, content: input.content }, normalizedJson) });
+        }
+        catch {
+            return undefined;
+        }
+    };
+    return {
+        record(input) {
+            const fingerprint = digest(input);
+            if (fingerprint === undefined)
+                return;
+            let calls = runs.get(input.runId);
+            if (!calls) {
+                if (runs.size >= maxRuns)
+                    runs.delete(runs.keys().next().value);
+                calls = new Map();
+                runs.set(input.runId, calls);
+            }
+            if (calls.size >= maxCallsPerRun)
+                calls.delete(calls.keys().next().value);
+            calls.set(input.toolUseId, fingerprint);
+        },
+        matches(input) {
+            const expected = runs.get(input.runId)?.get(input.toolUseId);
+            return expected !== undefined && expected === digest(input);
+        },
+        clearRun({ runId }) { runs.delete(runId); },
+    };
+}
+//# sourceMappingURL=delegated-result-correlation.js.map

package/dist/delegated-tool-bridge.d.ts

@@ -8,6 +8,7 @@
  */
 import { type Principal } from '@jini-ai/core';
 import type { RunLifecycle } from './run-lifecycle.js';
+import type { DelegatedResultCorrelation } from './delegated-result-correlation.js';
 import type { ToolExecutionResult, ToolExecutor } from './tool-executor.js';
 /**
  * Run-protocol `type` for a human-only surface withheld from a tool result.
@@ -42,24 +43,15 @@ export interface DelegatedToolBridge {
 export interface CreateDelegatedToolBridgeOptions {
     readonly lifecycle: RunLifecycle;
     readonly toolExecutor: ToolExecutor;
+    /** Share with the executor and lifecycle only after the host negotiates marker v1. */
+    readonly delegatedResultCorrelation?: DelegatedResultCorrelation;
 }
-/** Converts arbitrary registered-tool output into the string-bearing run protocol. */
-export declare function serializeDelegatedToolOutput({ output }: {
-    readonly output: unknown;
-}): string;
-/**
- * Maps a `ToolExecutionResult`'s status to the string a delegated-tool caller (this bridge, or
- * gap 3's stdin-tool-result injector in `agent-executor.ts`) reports back as the tool's visible
- * output/failure reason. Exported so both real callers share one mapping rather than drifting.
- */
-export declare function resultContent({ result }: {
-    readonly result: ToolExecutionResult;
-}): string;
+export { serializeDelegatedToolOutput, resultContent } from './tool-result-media.js';
 /**
  * Creates the transport-neutral bridge used by future ACP-delegate, MCP, or
  * other host protocols. This module does not invent a server transport: a
  * concrete protocol calls this bridge after it has decoded and authenticated a
  * delegated tool request.
  */
-export declare function createDelegatedToolBridge(options: CreateDelegatedToolBridgeOptions): DelegatedToolBridge;
+export declare function createDelegatedToolBridge(requiredArgs: Pick<CreateDelegatedToolBridgeOptions, 'lifecycle' | 'toolExecutor'>, optionalArgs?: Pick<CreateDelegatedToolBridgeOptions, 'delegatedResultCorrelation'>): DelegatedToolBridge;
 //# sourceMappingURL=delegated-tool-bridge.d.ts.map

package/dist/delegated-tool-bridge.js

@@ -6,8 +6,8 @@
  * enforces Jini's registry policy, confirmation, timeout, cancellation, and
  * audit trail before any registered handler runs.
  */
-import { batchOutcomeFor } from '@jini-ai/core';
-import { extractResultMedia } from './tool-result-media.js';
+import {} from '@jini-ai/core';
+import { projectToolResultEvent } from './tool-result-media.js';
 import { splitToolResultSurfaces } from './tool-result-surfaces.js';
 /**
  * Run-protocol `type` for a human-only surface withheld from a tool result.
@@ -38,41 +38,7 @@ function correlationFor(channel, toolUseId) {
 function errorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
-/** Converts arbitrary registered-tool output into the string-bearing run protocol. */
-export function serializeDelegatedToolOutput({ output }) {
-    if (typeof output === 'string')
-        return output;
-    if (output === undefined)
-        return '';
-    try {
-        const serialized = JSON.stringify(output);
-        return serialized === undefined ? String(output) : serialized;
-    }
-    catch {
-        return String(output);
-    }
-}
-/**
- * Maps a `ToolExecutionResult`'s status to the string a delegated-tool caller (this bridge, or
- * gap 3's stdin-tool-result injector in `agent-executor.ts`) reports back as the tool's visible
- * output/failure reason. Exported so both real callers share one mapping rather than drifting.
- */
-export function resultContent({ result }) {
-    switch (result.status) {
-        case 'completed':
-            return serializeDelegatedToolOutput({ output: result.output });
-        case 'denied':
-            return 'Tool execution denied by policy.';
-        case 'confirmation-denied':
-            return 'Tool execution denied during confirmation.';
-        case 'timed-out':
-            return 'Tool execution timed out.';
-        case 'cancelled':
-            return 'Tool execution cancelled.';
-        case 'failed':
-            return result.error ?? 'Tool execution failed.';
-    }
-}
+export { serializeDelegatedToolOutput, resultContent } from './tool-result-media.js';
 /**
  * Builds the abort controller handed to `ToolExecutor`, aborted by either a run cancellation or the
  * invocation's own transport signal. `dispose()` detaches both listeners once the call settles.
@@ -168,21 +134,7 @@ function createSurfaceSeam({ lifecycle, runId, toolUseId }) {
     return { emitSurface, settle, release };
 }
 /** Splits human-only surfaces out of an executed result, emits them, then the matching `tool_result`. */
-async function emitExecutedResult({ lifecycle, runId, toolUseId }, { executed }) {
-    // Recognized media blocks (images) are collected here purely to populate the sibling
-    // `media` field the `tool_result` event carries below, for a UI that wants to render one
-    // inline without re-parsing `content` (`ToolCard`'s `<img>`, per `assistant_demo_image`'s
-    // own doc). This does NOT remove the image block from `executed.output` — `image` is one
-    // of `tool-result-surfaces.ts`'s own `MODEL_VISIBLE_BLOCK_TYPES`, so the split below already
-    // keeps it in `modelOutput` on its own. An image reaching the model IS the point
-    // (`assistant_demo_image`/`admin.capture_screenshot` exist to prove exactly that round
-    // trip) — unlike an `mcp-ui` resource, which is genuinely human-only and must never survive
-    // into `modelOutput`. (Earlier this extraction fed its own de-imaged `remainder` into the
-    // surfaces split below and discarded the image from `output` entirely, on the assumption
-    // that the sibling `media` field was the only channel a caller needed — true for a UI
-    // reading the run's event stream, false for `@jini-ai/mcp`'s `execute_delegated_tool`, which
-    // hands the bridge's RETURN VALUE to the model with no access to that event stream at all.)
-    const { media } = extractResultMedia({ output: executed.output });
+async function emitExecutedResult({ lifecycle, runId, toolUseId, delegatedResultCorrelation }, { executed }) {
     // THE MODEL/HUMAN FORK. A tool call's return value is definitionally what the model
     // receives, so a UI resource left inside it is model-visible context no matter what any
     // downstream layer does — `@jini-ai/mcp`'s `okResult()` JSON.stringifies the whole result
@@ -202,32 +154,41 @@ async function emitExecutedResult({ lifecycle, runId, toolUseId }, { executed })
                 data: { type: MCP_UI_EVENT_TYPE, toolUseId, resource: surface },
             } });
     }
+    // The return keeps model-visible images; only the stored event removes their duplicate.
+    const projection = projectToolResultEvent({ result });
     await lifecycle.emit({ runId: runId, input: {
             event: 'agent',
             data: {
                 type: 'tool_result',
                 toolUseId,
-                content: resultContent({ result }),
-                ...(result.status === 'completed' && (batchOutcomeFor({ output: result.output }) ?? 'completed') === 'completed' ? {} : { isError: true }),
-                ...(media.length > 0 ? { media } : {}),
+                ...projection,
             },
         } });
+    // Record only after the canonical result is saved; failed emission cannot hide an echo.
+    if (result.status === 'completed' && isContentEnvelope(result.output)) {
+        delegatedResultCorrelation?.record({ runId, toolUseId, content: result.output.content, isError: projection.isError === true });
+    }
     return result;
 }
+function isContentEnvelope(output) {
+    return typeof output === 'object' && output !== null && 'content' in output && Array.isArray(output.content);
+}
 /**
  * Creates the transport-neutral bridge used by future ACP-delegate, MCP, or
  * other host protocols. This module does not invent a server transport: a
  * concrete protocol calls this bridge after it has decoded and authenticated a
  * delegated tool request.
  */
-export function createDelegatedToolBridge(options) {
-    const { lifecycle, toolExecutor } = options;
+export function createDelegatedToolBridge(requiredArgs, optionalArgs = {}) {
+    const options = { ...requiredArgs, ...optionalArgs };
+    // A route may pass its broader deps as options; its wrapped executor remains authoritative.
+    const { lifecycle, toolExecutor } = requiredArgs;
     async function execute(requiredArgs, optionalArgs = {}) {
         // Merged rather than read from `optionalArgs` alone: a caller may hand `signal` in the first
         // object (the delegated-tools HTTP route does), and it must still be honoured.
         const invocation = { ...requiredArgs, ...optionalArgs };
         const { runId, toolUseId, toolId, principal, input } = invocation;
-        const call = { lifecycle, runId, toolUseId };
+        const call = { lifecycle, runId, toolUseId, ...(options.delegatedResultCorrelation ? { delegatedResultCorrelation: options.delegatedResultCorrelation } : {}) };
         await lifecycle.emit({ runId: runId, input: {
                 event: 'agent',
                 data: { type: 'tool_use', id: toolUseId, name: toolId, input },

package/dist/http/delegated-tools.d.ts

@@ -1,3 +1,4 @@
+import type { DelegatedResultCorrelation } from '../delegated-result-correlation.js';
 import type { Express } from 'express';
 import { type Principal, type ToolRegistry } from '@jini-ai/core';
 import { type RunLifecycle, type ToolExecutionResult, type ToolExecutor } from '../index.js';
@@ -49,6 +50,8 @@ export interface DelegatedToolsInternalErrorContext {
     readonly status?: 'timed-out' | 'cancelled' | 'failed';
 }
 export interface DelegatedToolsHttpDeps {
+    /** The same negotiated digest store supplied to the run lifecycle and agent executor. */
+    readonly delegatedResultCorrelation?: DelegatedResultCorrelation;
     readonly lifecycle: RunLifecycle;
     readonly toolExecutor: ToolExecutor;
     /** Host-owned: resolves the `Principal` a given delegated-tool-call request executes as. Mandatory — see module doc; there is no safe default identity this package could assume on a host's behalf. */

package/dist/http/delegated-tools.js

@@ -203,7 +203,7 @@ export const delegatedToolExecuteRoute = defineJsonRoute({
         const toolExecutor = input.requireReadOnly === true
             ? readOnlyTools.withReadOnlyToolConstraint({ inner: deps.toolExecutor, registry: deps.toolRegistry, messages: readOnlyTools.defaultDaemonMessages.readOnly, idGenerator: { newId: randomUUID } })
             : deps.toolExecutor;
-        const bridge = createDelegatedToolBridge({ lifecycle: deps.lifecycle, toolExecutor });
+        const bridge = createDelegatedToolBridge({ lifecycle: deps.lifecycle, toolExecutor }, deps);
         try {
             // `signal` carries the caller's HTTP connection dropping — see `mountJsonRoute`
             // (`adapter.ts`). The bridge already combines it with the run's own cancellation

package/dist/index.d.ts

@@ -93,4 +93,6 @@ export * from './run/index.js';
 export * from './continuation/index.js';
 export * from './routines/index.js';
 export * from './attachment-content.js';
+export * from './delegated-result-correlation.js';
+export type { StdoutJournalBlobPort } from './tool-result-diagnostics.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -93,4 +93,5 @@ export * from './run/index.js';
 export * from './continuation/index.js';
 export * from './routines/index.js';
 export * from './attachment-content.js';
+export * from './delegated-result-correlation.js';
 //# sourceMappingURL=index.js.map

package/dist/run-lifecycle.d.ts

@@ -1,3 +1,20 @@
+/**
+ * `RunLifecycle` — start/stream/cancel/resume a run keyed on an opaque
+ * `contextRef` (extraction-plan §2.1: runs key on an opaque `contextRef`,
+ * never a product-record identifier), generalized from OD's `design.runs` service
+ * (`apps/daemon/src/runtimes/runs.ts` + the terminal-decision half of
+ * `apps/daemon/src/runtimes/start-chat-run.ts`, `arch/server-startserver-endgame`
+ * branch — see `archived provenance ledger` for exact line citations).
+ *
+ * Scope boundary: this module owns the run *state machine* and its event
+ * log — create, transition, emit, replay, cancellation-intent propagation,
+ * idempotent start/finish, resume. It does not spawn or signal a subprocess;
+ * that is `@jini-ai/agent-runtime`'s job (extraction-plan task 7). A driver
+ * (today: this package's tests; later: agent-runtime) calls `emit()` for
+ * agent/stdout/stderr/error events, observes cancellation via
+ * `onCancelRequested`, and calls `finish()` once it knows the real outcome.
+ */
+import type { DelegatedResultCorrelation } from './delegated-result-correlation.js';
 import type { RunAgentPayload, RunCancelRequest, RunChunkPayload, RunErrorPayload, RunProtocolEvent, RunStartPayload, RunStatus } from '@jini-ai/protocol';
 import type { EventLog, EventLogEntry, EventLogReplayResult } from './event-log.js';
 import type { InactivityWatchdog, TerminalRunOutcome } from './close-status.js';
@@ -276,6 +293,8 @@ export declare function finishStreamSubscription({ record, subscriber, terminal
     readonly terminal: boolean;
 }): StreamSubscribeResult;
 export interface CreateRunLifecycleInput {
+    /** Share the negotiated bridge/executor digest store so run eviction also releases proofs. */
+    readonly delegatedResultCorrelation?: DelegatedResultCorrelation;
     readonly eventLog: EventLog;
     /** Host-owned sink for asynchronous lifecycle failures that cannot be returned to a caller. Defaults to `console.error`. */
     readonly onInternalError?: (context: RunLifecycleInternalErrorContext) => void;
@@ -319,5 +338,5 @@ export interface RunLifecycleInternalErrorContext {
  * @complexity Per-call complexities documented on each method; the registry itself is a `Map` keyed by `runId` (O(1) lookup). Memory is bounded: non-terminal runs are O(n) in concurrently-live runs, and terminal runs are capped at `maxTerminalRuns` (each additionally bounded in retention time by `terminalRetentionMs`) rather than growing for the life of the process.
  * @overallScore 100/100
  */
-export declare function createRunLifecycle(requiredArgs: Pick<CreateRunLifecycleInput, "eventLog">, optionalArgs?: Pick<CreateRunLifecycleInput, "onInternalError" | "terminalRetentionMs" | "maxTerminalRuns" | "slowRunThresholdMs" | "dropEventsOnEviction">): RunLifecycle;
+export declare function createRunLifecycle(requiredArgs: Pick<CreateRunLifecycleInput, "eventLog">, optionalArgs?: Pick<CreateRunLifecycleInput, "onInternalError" | "terminalRetentionMs" | "maxTerminalRuns" | "slowRunThresholdMs" | "dropEventsOnEviction" | "delegatedResultCorrelation">): RunLifecycle;
 //# sourceMappingURL=run-lifecycle.d.ts.map

package/dist/run-lifecycle.js

@@ -1,19 +1,3 @@
-/**
- * `RunLifecycle` — start/stream/cancel/resume a run keyed on an opaque
- * `contextRef` (extraction-plan §2.1: runs key on an opaque `contextRef`,
- * never a product-record identifier), generalized from OD's `design.runs` service
- * (`apps/daemon/src/runtimes/runs.ts` + the terminal-decision half of
- * `apps/daemon/src/runtimes/start-chat-run.ts`, `arch/server-startserver-endgame`
- * branch — see `archived provenance ledger` for exact line citations).
- *
- * Scope boundary: this module owns the run *state machine* and its event
- * log — create, transition, emit, replay, cancellation-intent propagation,
- * idempotent start/finish, resume. It does not spawn or signal a subprocess;
- * that is `@jini-ai/agent-runtime`'s job (extraction-plan task 7). A driver
- * (today: this package's tests; later: agent-runtime) calls `emit()` for
- * agent/stdout/stderr/error events, observes cancellation via
- * `onCancelRequested`, and calls `finish()` once it knows the real outcome.
- */
 import { randomUUID } from 'node:crypto';
 import { RUN_PROTOCOL_VERSION, isTerminalRunState } from '@jini-ai/protocol';
 import { createInactivityWatchdog } from './close-status.js';
@@ -367,6 +351,7 @@ export function createRunLifecycle(requiredArgs, optionalArgs = {}) {
         }
         catch (error) {
             runs.delete(runId);
+            input.delegatedResultCorrelation?.clearRun({ runId });
             clearIdempotencyIndexEntryIfMatching({ idempotencyIndex: idempotencyIndex, idempotencyKey: startInput.idempotencyKey, runId: runId });
             throw error;
         }
@@ -418,6 +403,7 @@ export function createRunLifecycle(requiredArgs, optionalArgs = {}) {
             return;
         record.retentionTimer = undefined;
         runs.delete(runId);
+        input.delegatedResultCorrelation?.clearRun({ runId });
         clearIdempotencyIndexEntryIfMatching({ idempotencyIndex: idempotencyIndex, idempotencyKey: record.idempotencyKey, runId: runId });
         if (input.dropEventsOnEviction === true)
             void dropEvictedRunEvents(runId);

package/dist/tool-result-diagnostics.d.ts

@@ -0,0 +1,27 @@
+/** Audit writers must store exact chunks in blobs and retain resolvable references separately.
+ * This port deliberately cannot masquerade as the inline RunByteJournal contract. */
+export interface StdoutJournalBlobPort {
+    /** Buffer chunks remain bytes, including UTF-8 characters split at OS read boundaries. */
+    record(input: {
+        runId: string;
+        chunk: string | Uint8Array;
+    }, options?: Record<string, never>): Promise<void>;
+}
+/** Projects one complete diagnostic frame; ordinary non-JSON output remains byte-identical. */
+export declare function projectDiagnosticFrame({ line }: {
+    line: string;
+}, { maxFrameChars }?: {
+    maxFrameChars?: number;
+}): string;
+/** Bounded JSONL framing: split chunks are held until complete, tails flush at close.
+ * Oversized frames produce an explicit notice and are discarded through their newline.
+ * @complexity O(n) total input characters; O(maxFrameChars) retained carry, no per-chunk joins. */
+export declare function createToolResultDiagnosticProjection(_input: Record<string, never>, { maxFrameChars }?: {
+    maxFrameChars?: number;
+}): {
+    feed({ chunk }: {
+        chunk: string;
+    }, _options?: {}): string;
+    flush(_input: Record<string, never>, _options?: {}): string;
+};
+//# sourceMappingURL=tool-result-diagnostics.d.ts.map

package/dist/tool-result-diagnostics.js

@@ -0,0 +1,77 @@
+function imageSummary(value) {
+    if (value.type !== 'image')
+        return undefined;
+    if (typeof value.mimeType === 'string' && typeof value.data === 'string') {
+        return { ...value, data: `[image ${value.mimeType}; ${value.data.length} base64 characters]` };
+    }
+    const source = value.source;
+    if (typeof source !== 'object' || source === null)
+        return undefined;
+    const image = source;
+    if (image.type !== 'base64' || typeof image.data !== 'string' || typeof image.media_type !== 'string')
+        return undefined;
+    return { ...value, source: { ...image, data: `[image ${image.media_type}; ${image.data.length} base64 characters]` } };
+}
+/** Redacts only recognized image fields, including JSON-encoded tool-result content.
+ * @complexity O(n) frame bytes, bounded by the framing limit before parsing. */
+function summarizeImages(_key, value) {
+    if (_key === 'content' && typeof value === 'string')
+        return projectDiagnosticFrame({ line: value });
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return value;
+    return imageSummary(value) ?? value;
+}
+/** Projects one complete diagnostic frame; ordinary non-JSON output remains byte-identical. */
+export function projectDiagnosticFrame({ line }, { maxFrameChars = 16 * 1024 * 1024 } = {}) {
+    if (line.length > maxFrameChars)
+        return '[diagnostic frame exceeded image projection limit]';
+    try {
+        return JSON.stringify(JSON.parse(line), summarizeImages);
+    }
+    catch {
+        return line;
+    }
+}
+/** Bounded JSONL framing: split chunks are held until complete, tails flush at close.
+ * Oversized frames produce an explicit notice and are discarded through their newline.
+ * @complexity O(n) total input characters; O(maxFrameChars) retained carry, no per-chunk joins. */
+export function createToolResultDiagnosticProjection(_input, { maxFrameChars = 16 * 1024 * 1024 } = {}) {
+    if (!Number.isSafeInteger(maxFrameChars) || maxFrameChars < 1)
+        throw new Error('diagnostic frame limit must be a positive integer');
+    let parts = [];
+    let size = 0;
+    let dropping = false;
+    function append(part) {
+        if (dropping || part.length === 0)
+            return;
+        size += part.length;
+        if (size > maxFrameChars) {
+            parts = [];
+            dropping = true;
+            return;
+        }
+        parts.push(part);
+    }
+    function finish() {
+        const line = dropping ? '[diagnostic frame exceeded image projection limit]' : projectDiagnosticFrame({ line: parts.join('') }, { maxFrameChars });
+        parts = [];
+        size = 0;
+        dropping = false;
+        return line;
+    }
+    return {
+        feed({ chunk }, _options = {}) {
+            const completed = [];
+            let start = 0;
+            for (let end = chunk.indexOf('\n'); end !== -1; end = chunk.indexOf('\n', start)) {
+                append(chunk.slice(start, end));
+                completed.push(finish(), '\n');
+                start = end + 1;
+            }
+            append(chunk.slice(start));
+            return completed.join('');
+        },
+        flush(_input, _options = {}) { return size > 0 || dropping ? finish() : ''; },
+    };
+}
+//# sourceMappingURL=tool-result-diagnostics.js.map

package/dist/tool-result-media.d.ts

@@ -1,3 +1,4 @@
+import type { ToolExecutionResult } from './tool-executor.js';
 /**
  * Extracts UI-renderable media blocks from a tool handler's raw MCP-style content envelope
  * (`{ content: [...] }`), for `delegated-tool-bridge.ts` and `agent-executor.ts` to attach to the
@@ -11,18 +12,9 @@
  * and is deliberately narrower: it recognizes exactly one block type today (`image`), and has no
  * withhold-from-model concept of its own.
  *
- * The two DO interact, though not by pipelining: `delegated-tool-bridge.ts`'s `execute()` calls both
- * of them against the SAME raw `executed.output`, not this module's `remainder` into
- * `splitToolResultSurfaces`. That used to be pipelined — this module removed recognized image
- * blocks from `content` before the surfaces pass ran, because `splitToolResultSurfaces`'s whitelist
- * used to recognize only `text`, and an image block left in place would have been swept into
- * `surfaces` and withheld from the model. Now that `image` is itself one of
- * `tool-result-surfaces.ts`'s `MODEL_VISIBLE_BLOCK_TYPES` (a deliberate addition — see that
- * constant's own doc), the surfaces pass classifies an image block correctly on its own, so there is
- * no misclassification left to prevent by removing it first. This module's `remainder` field is
- * therefore no longer read by that caller at all (kept for this module's own tests and any future
- * caller that wants a de-imaged copy); only `media` is used, to populate the `tool_result` event's
- * sibling `media` field for a UI that wants to render inline without re-parsing `content`.
+ * The surface whitelist runs on the original output first. Its model-visible result still
+ * contains images for MCP/model delivery. Only the event projection below serializes this
+ * module's de-imaged remainder, alongside one `media` array for rendering.
  *
  * ## Why only `image`, and why blocks are silently skipped rather than reported
  *
@@ -67,8 +59,7 @@ export interface ExtractResultMedia {
 }
 /**
  * Splits a tool handler's raw return value into its recognized media blocks and the remainder,
- * ready to feed onward into `splitToolResultSurfaces` (see this module's doc for why that order
- * matters).
+ * without modifying the model-facing output. Run the surface whitelist on the original first.
  *
  * @param output - A tool handler's raw return value (`ToolExecutionResult.output` when
  * `status === 'completed'`). Non-envelope values (the overwhelming majority of tools, which return
@@ -78,4 +69,26 @@ export interface ExtractResultMedia {
 export declare function extractResultMedia({ output }: {
     readonly output: unknown;
 }): ExtractResultMedia;
+/** Converts arbitrary registered-tool output into the string-bearing run protocol. */
+export declare function serializeDelegatedToolOutput({ output }: {
+    readonly output: unknown;
+}): string;
+/**
+ * Maps a `ToolExecutionResult`'s status to the string a delegated-tool caller (this bridge, or
+ * gap 3's stdin-tool-result injector in `agent-executor.ts`) reports back as the tool's visible
+ * output/failure reason. Exported so both real callers share one mapping rather than drifting.
+ */
+export declare function resultContent({ result }: {
+    readonly result: ToolExecutionResult;
+}): string;
+/** Projects a model-safe result into the saved event: pixels occur only in `media`.
+ * Uses the existing serializer and status mapping; callers keep the original for the model.
+ * @complexity O(n) output bytes, with O(n) transient serialization space. */
+export declare function projectToolResultEvent({ result }: {
+    result: ToolExecutionResult;
+}, _options?: {}): {
+    content: string;
+    isError?: true;
+    media?: readonly ToolResultMediaBlock[];
+};
 //# sourceMappingURL=tool-result-media.d.ts.map

package/dist/tool-result-media.js

@@ -1,39 +1,4 @@
-/**
- * Extracts UI-renderable media blocks from a tool handler's raw MCP-style content envelope
- * (`{ content: [...] }`), for `delegated-tool-bridge.ts` and `agent-executor.ts` to attach to the
- * `tool_result` wire event's new `media` field (`@jini-ai/protocol`'s `events.ts`).
- *
- * ## Why this is not `tool-result-surfaces.ts`
- *
- * That module's whitelist governs a SECURITY property: which blocks may reach the model versus
- * which are withheld for a human-only UI resource (MCP-UI, still deferred). This module answers a
- * different question — "does this block carry displayable media a chat pane can render inline" —
- * and is deliberately narrower: it recognizes exactly one block type today (`image`), and has no
- * withhold-from-model concept of its own.
- *
- * The two DO interact, though not by pipelining: `delegated-tool-bridge.ts`'s `execute()` calls both
- * of them against the SAME raw `executed.output`, not this module's `remainder` into
- * `splitToolResultSurfaces`. That used to be pipelined — this module removed recognized image
- * blocks from `content` before the surfaces pass ran, because `splitToolResultSurfaces`'s whitelist
- * used to recognize only `text`, and an image block left in place would have been swept into
- * `surfaces` and withheld from the model. Now that `image` is itself one of
- * `tool-result-surfaces.ts`'s `MODEL_VISIBLE_BLOCK_TYPES` (a deliberate addition — see that
- * constant's own doc), the surfaces pass classifies an image block correctly on its own, so there is
- * no misclassification left to prevent by removing it first. This module's `remainder` field is
- * therefore no longer read by that caller at all (kept for this module's own tests and any future
- * caller that wants a de-imaged copy); only `media` is used, to populate the `tool_result` event's
- * sibling `media` field for a UI that wants to render inline without re-parsing `content`.
- *
- * ## Why only `image`, and why blocks are silently skipped rather than reported
- *
- * `text` blocks already reach the model (and the UI, via `content`) through the existing flattened
- * string — duplicating them into `media` would be redundant, not additive, so this module leaves
- * them in `remainder` and never collects them. A block claiming `type: 'image'` without a string
- * `mimeType`/`data` is dropped rather than surfaced as a malformed-block error: a handler's return
- * value is untrusted input to this module (it may come from an external MCP server), and the
- * contract is "render what is well-formed, ignore what isn't" — the same fail-quiet posture
- * `serializeDelegatedToolOutput` already takes on a non-serializable output.
- */
+import { batchOutcomeFor } from '@jini-ai/core';
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
@@ -50,8 +15,7 @@ function asImageBlock(block) {
 }
 /**
  * Splits a tool handler's raw return value into its recognized media blocks and the remainder,
- * ready to feed onward into `splitToolResultSurfaces` (see this module's doc for why that order
- * matters).
+ * without modifying the model-facing output. Run the surface whitelist on the original first.
  *
  * @param output - A tool handler's raw return value (`ToolExecutionResult.output` when
  * `status === 'completed'`). Non-envelope values (the overwhelming majority of tools, which return
@@ -77,4 +41,53 @@ export function extractResultMedia({ output }) {
         return { remainder: output, media: [] };
     return { remainder: { ...output, content: kept }, media };
 }
+/** Converts arbitrary registered-tool output into the string-bearing run protocol. */
+export function serializeDelegatedToolOutput({ output }) {
+    if (typeof output === 'string')
+        return output;
+    if (output === undefined)
+        return '';
+    try {
+        const serialized = JSON.stringify(output);
+        return serialized === undefined ? String(output) : serialized;
+    }
+    catch {
+        return String(output);
+    }
+}
+/**
+ * Maps a `ToolExecutionResult`'s status to the string a delegated-tool caller (this bridge, or
+ * gap 3's stdin-tool-result injector in `agent-executor.ts`) reports back as the tool's visible
+ * output/failure reason. Exported so both real callers share one mapping rather than drifting.
+ */
+export function resultContent({ result }) {
+    switch (result.status) {
+        case 'completed':
+            return serializeDelegatedToolOutput({ output: result.output });
+        case 'denied':
+            return 'Tool execution denied by policy.';
+        case 'confirmation-denied':
+            return 'Tool execution denied during confirmation.';
+        case 'timed-out':
+            return 'Tool execution timed out.';
+        case 'cancelled':
+            return 'Tool execution cancelled.';
+        case 'failed':
+            return result.error ?? 'Tool execution failed.';
+    }
+}
+/** Projects a model-safe result into the saved event: pixels occur only in `media`.
+ * Uses the existing serializer and status mapping; callers keep the original for the model.
+ * @complexity O(n) output bytes, with O(n) transient serialization space. */
+export function projectToolResultEvent({ result }, _options = {}) {
+    const { remainder, media } = extractResultMedia({ output: result.output });
+    const isError = result.status !== 'completed'
+        || (batchOutcomeFor({ output: result.output }) ?? 'completed') !== 'completed'
+        || (isRecord(result.output) && result.output.isError === true);
+    return {
+        content: resultContent({ result: { ...result, output: remainder } }),
+        ...(isError ? { isError: true } : {}),
+        ...(media.length > 0 ? { media } : {}),
+    };
+}
 //# sourceMappingURL=tool-result-media.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/daemon",
-  "version": "0.6.9",
+  "version": "0.6.10",
   "description": "The stateful agent daemon runtime: run lifecycle, durable event-log port, the tool-execution boundary, agent executor, terminal sessions, and routines.",
   "license": "Apache-2.0",
   "repository": {
@@ -139,29 +139,29 @@
     "@types/pg": "8.23.1",
     "express": "^4.21.0",
     "@types/express": "^4.17.21",
-    "@jini-ai/db": "0.3.6",
-    "@jini-ai/http-kit": "0.4.3",
-    "@jini-ai/agent-runtime": "^0.4.12",
-    "@jini-ai/core": "^0.4.9",
-    "@jini-ai/protocol": "^0.4.5",
-    "@jini-ai/platform": "^0.5.10",
-    "@jini-ai/chat": "0.6.7"
+    "@jini-ai/http-kit": "0.6.10",
+    "@jini-ai/db": "0.6.10",
+    "@jini-ai/chat": "0.6.10",
+    "@jini-ai/core": "^0.6.10",
+    "@jini-ai/agent-runtime": "^0.6.10",
+    "@jini-ai/protocol": "^0.6.10",
+    "@jini-ai/platform": "^0.6.10"
   },
   "dependencies": {
-    "@jini-ai/core": "^0.4.9",
-    "@jini-ai/protocol": "^0.4.5"
+    "@jini-ai/protocol": "^0.6.10",
+    "@jini-ai/core": "^0.6.10"
   },
   "peerDependencies": {
     "node-pty": "^1.1.0",
-    "@jini-ai/db": "^0.3.2",
+    "@jini-ai/db": "^0.6.10",
     "kysely": "^0.29.6",
     "better-sqlite3": "^13.0.0",
     "@electric-sql/pglite": "0.5.8",
     "pg": "^8.23.0",
-    "@jini-ai/http-kit": "^0.4.0",
+    "@jini-ai/http-kit": "^0.6.10",
     "express": "^4.21.0 || ^5.0.0",
-    "@jini-ai/agent-runtime": "^0.4.10",
-    "@jini-ai/platform": "^0.5.5"
+    "@jini-ai/agent-runtime": "^0.6.10",
+    "@jini-ai/platform": "^0.6.10"
   },
   "peerDependenciesMeta": {
     "node-pty": {