@jini-ai/daemon 0.6.9 → 0.6.11

package/CHANGELOG.md

@@ -1,3 +1,160 @@
+## 0.6.11
+
+### Patch Changes
+
+- Mid-run message relay for MCP-bridged engines (Codex, ACP, Antigravity): `registerMessageRelayRoutes` on `@jini-ai/daemon/http`; mid-run messages queue instead of interrupting, and recovery waits on an uncertain probe.
+- Site agents are confined to the site folder: Claude file tools are bounded to the site root and private temp dir, and attachments are staged inside the site (`stageAttachmentClaim`).
+- Tool inputs apply a sole near-miss and declared input aliases; plugin-load outcomes are reported; `web_fetch` reads SVG/JS as text; `content_read` suggests its resource first; the browser falls back to system Chrome.
+- Updated dependencies
+- Updated dependencies
+- Updated dependencies
+  - @jini-ai/core@0.6.11
+  - @jini-ai/protocol@0.6.11
+
+## 0.6.10
+
+### Patch Changes
+
+- 4f52784: Stop advertising agents `AgentExecutor` cannot run.
+
+  The built-in `agents` feature scanned every runtime definition, but `AgentExecutor` rejects some of
+  them (`antigravity`, whose deferral is documented in that module). A consumer could therefore offer a
+  user an agent that failed the instant it was selected, with the mismatch visible nowhere.
+
+  - `@jini-ai/daemon` exports `isAgentExecutorSupported(def)` and `assessAgentExecutorCompatibility(def)`.
+    `run()` now consumes the latter instead of re-checking the conditions itself, so the discovery-time
+    answer and the run-time guards cannot drift apart. Error messages are unchanged.
+  - `@jini-ai/server`'s `agents` feature applies the predicate by default, and exports
+    `isExecutableDetectedAgent` for hosts that want it directly.
+
+  `antigravity`'s definition remains in `@jini-ai/agent-runtime` — the predicate is advisory, and a
+  non-`AgentExecutor` launch path can ignore it. An id with no registered def is kept rather than
+  dropped, so a host supplying its own `detector` is unaffected.
+
+  Note for anyone implementing something similar: the predicate deliberately takes the full
+  `RuntimeAgentDef`, not a projected `DetectedAgent`. That projection omits `maxPromptArgBytes`, and the
+  argv-bound defs (`aider`, `deepseek`) qualify solely through it — judging the projection would have
+  dropped two working agents while fixing one broken one.
+
+- 8ff5653: Drive Antigravity (`agy`) — the 24th and last agent definition `AgentExecutor` rejected.
+
+  `AgentExecutor` drove 23 of 24 registered definitions. Antigravity was rejected by an explicit
+  `def.id === 'antigravity'` guard, for two reasons that are real but narrow:
+
+  - **`agy` can print an OAuth sign-in URL to stdout and still exit 0.** Streaming stdout live shows
+    that URL to the user as if it were the model's reply — a URL that carries the daemon operator's
+    `client_id`/`redirect_uri` into a chat transcript, and that is useless to click anyway (`agy -p`
+    print mode has no field to paste the resulting auth code into).
+  - **`agy` has no `--model` flag.** The model choice is written into one process-global
+    `~/.gemini/antigravity-cli/settings.json` that `agy` reads on its own startup, so two concurrent
+    runs race: run A writes model A, A spawns, B writes model B, and only _then_ does A's `agy` read
+    the file — so A silently executes on B's model.
+
+  Both are now met by **declarative `RuntimeAgentDef` fields the executor reads generically**, joining
+  the 14 optional behavior flags (`promptViaFile`, `authProbe`, …) that already work this way. There is
+  no agent-id branch anywhere in the dispatch path — a deliberate divergence from Open Design's own
+  daemon, which hardcodes the id twice.
+
+  New on `@jini-ai/agent-runtime`'s `RuntimeAgentDef`:
+
+  - `needsAgentLogFile?: boolean` — asks the caller to stage a temp path and pass it as
+    `RuntimeContext.agentLogFilePath` before `buildArgs` runs, mirroring `promptViaFile`. Staged by the
+    new `prepareAgentLogFile(def, label)` (the sibling of `preparePromptFileForAgent`; it creates only
+    the `0o700` containing directory, since the log file is output the CLI authors, not input we do).
+  - `stdoutPolicy?: RuntimeStdoutPolicy` — `{buffering: 'live'}` (the default, and every other
+    definition's behavior) or `{buffering: 'until-close', sanitize?}`. A discriminated union rather
+    than two flat fields on purpose: a sanitizer is only meaningful on the buffered path, because the
+    pattern to redact can straddle two `'data'` chunks. Two independent flags would let a definition
+    declare a sanitizer the caller could not honor — a confidentiality gap that _looks_ closed.
+  - `runtimeLock?: RuntimeLock` — a mutex around a process-global side effect `buildArgs` performs.
+    Acquired before `buildArgs`, released on whichever of `waitForHandoff` settling or process exit
+    comes first. Releasing on exit is load-bearing, not a fallback: a watcher that stops polling means
+    "I stopped watching", never "the child definitely didn't read the file".
+
+  All three are stripped from the `DetectedAgent` registry projection. They instruct whoever _spawns_
+  the CLI, not whoever lists agents — and two carry closures, which `JSON.stringify` would flatten into
+  a misleading `{"buffering":"until-close"}` / `{}` rather than omit.
+
+  In `@jini-ai/daemon`, `AgentExecutor` now stages a log file when `needsAgentLogFile` is set (released
+  on every pre-spawn, spawn-failure, and close path alongside the prompt file, through one composed
+  `cleanupStagedFiles` closure), calls `runtimeLock.acquire()` before `buildArgs`, and branches its
+  `streamFormat: 'plain'` stdout handling on `stdoutPolicy`. `assessAgentExecutorCompatibility` no
+  longer rejects anything by id, and `isAgentExecutorSupported` now accepts all 24 definitions.
+
+  **No behavior change for any other agent.** Antigravity is the only definition declaring any of the
+  three fields; the other four `streamFormat: 'plain'` definitions (`grok-build`, `aider`, `deepseek`,
+  `qwen`) keep streaming live, per chunk, which `aider`'s and `deepseek`'s own comments call out as
+  deliberate. That is pinned by an explicit regression test rather than left implied.
+
+  One thing worth knowing if you consume the run event stream: on the buffered path the raw `'stdout'`
+  echo is held back and sanitized too, not just the `'agent'`/`text_delta` copy. Emitting an
+  unsanitized raw echo while withholding the chat copy would leak the exact string the sanitizer exists
+  to remove to any subscriber. The opt-in byte journal still records raw bytes per chunk — that is its
+  documented contract, and it deliberately lives in a separate `EventLog` instance that is never
+  replayed to run-event subscribers.
+
+- 3fe4d14: Store tool-result images once in media, preserve model-facing pixels, and provide opt-in digest-verified echo summaries and bounded image-safe diagnostics. Hosts with exact-byte journaling must inject a separate stdout blob/reference writer.
+
+  Preserve conflicting image representations during digest verification, and keep the required bridge executor authoritative when route dependencies supply optional settings.
+
+- e16a907: Choose reported-cost semantics from agent definition metadata rather than a vendor id; absent metadata retains per-run behavior.
+- 4f52784: Add `createRunScopedContextStore` and widen `ResolvedRunInput` with the executor's optional inputs.
+
+  **`createRunScopedContextStore<T>({ lifecycle })`** — bind/resolve/auto-evict keyed by run id, for
+  host-owned context that must survive the gap between starting a run and a later delegated call that
+  carries only that run's id. `resolve` fails closed (`RunContextNotBoundError`) rather than fabricating a
+  default, and bindings are evicted when the run reaches a terminal state.
+
+  `resolveRunInput` could already decode and stash such context, but it is handed no lifecycle and so
+  cannot register the eviction half — leaving a map that only grows and keeps stale authority resolvable.
+  Owning both halves together is the point. `T` is fully generic: this helper does not decode
+  `contextRef`, does not sign or verify anything, and has no notion of a principal. It is in-memory only,
+  and says so — after a restart every `resolve` fails, which is the correct posture rather than a gap.
+
+  **`ResolvedRunInput` now carries `permissionMode`, `model`, `reasoning`, and `credentialEnv`**, each
+  forwarded to `AgentExecutor.run()` only when present.
+
+  `permissionMode` is the load-bearing one and closes a real trap: every def with an auto-approve flag
+  (`bypassPermissions` / `--yolo` / `--dangerously-skip-permissions`) applies it by default when the field
+  is absent. A host that had been passing `'restricted'` to `AgentExecutor.run()` by hand and then adopted
+  `createDefaultRunStartHandler` would silently have started auto-approving every action — a security
+  regression wearing the clothes of a refactor. Existing behavior is unchanged: omitted fields are omitted
+  from the executor call, never passed as an explicit `undefined`.
+
+- 4f52784: Add a `sidecar-strict` security mode and per-run MCP credential propagation.
+
+  For a daemon whose threat model is **another process running as the same OS user** rather than a
+  remote attacker, the existing `jini-local` mode is a no-op: `registerApiBearerAuthMiddleware`
+  short-circuits for any loopback peer before it reads the `Authorization` header, and a `127.0.0.1`
+  bind keeps remote hosts out while doing nothing about a co-resident process. A consumer that spawns a
+  Jini daemon holding real authority — starting agent runs, executing tools against a real database —
+  previously had to write its own middleware.
+
+  - `@jini-ai/http-kit` gains `requireStrictBearerToken`: fail-closed 503 when the named token env var
+    is unset, 401 on mismatch, **no loopback exemption and no disable flag**. Its `tokenEnvVar` is
+    required with no default, so this package never names a host's secret.
+  - `composeJiniKernel` gains `security: { mode: 'sidecar-strict', host, tokenEnvVar, exemptPaths? }`.
+    Purely additive — `host` and `jini-local` are unchanged by construction, since the modes are arms of
+    a discriminated union. The strict gate mounts ahead of the JSON body parser, so a caller it rejects
+    never has its body parsed.
+  - `@jini-ai/daemon`'s `McpJsonInjectionOptions` gains `credential?: (runId) => string | Promise<string>`
+    — a **resolver, not a string**, because injection options are built once before any run exists and a
+    boot-wide shared secret would defeat the point of scoping a credential to a run. It is delivered to
+    the child as `JINI_DAEMON_TOKEN`.
+  - `@jini-ai/mcp`'s `jini-mcp` reads that variable and attaches `Authorization` to every daemon call.
+    Optional throughout: with no credential, request headers and `.mcp.json` output are byte-identical
+    to before.
+
+  Also generalized: both existing bearer gates now compare tokens in constant time (`timingSafeEqual`)
+  and share one header-parsing helper, closing a timing side channel and removing a duplicated regex.
+
+- Updated dependencies [22f0619]
+- Updated dependencies [82ed2d3]
+- Updated dependencies [3fe4d14]
+- Updated dependencies [5a3de86]
+  - @jini-ai/core@0.6.10
+  - @jini-ai/protocol@0.6.10
+
 ## 0.6.9 — 2026-10-22
 
 - 2026-10-22: Memory fixes (bounded event log and tool-executor audit), chromeIntegration option, provider-plugin registration, coverage.

package/dist/agent-executor/contracts.d.ts

@@ -1,9 +1,11 @@
+import type { DelegatedResultCorrelation } from '../delegated-result-correlation.js';
+import type { StdoutJournalBlobPort } from '../tool-result-diagnostics.js';
 import type { MessageAttachmentImage } from '../attachment-content.js';
 import type { probeMcpBridge } from './mcp-bridge-probe.js';
 import type { spawn as nodeSpawn, ChildProcess } from 'node:child_process';
 import type { Principal } from '@jini-ai/core';
-import type { RunAgentPayload, RunErrorPayload } from '@jini-ai/protocol';
-import type { AgentRuntimeState, applyAgentLaunchEnv, ensureAgentCapabilities, resolveModelForLaunch, getAgentDef, resolveAgentLaunch, attachAcpSession, attachPiRpcSession, prepareAgentLogFile, preparePromptFileForAgent, AcpMcpServerInput, AcpPermissionHandler, PromptAugmenter } from '@jini-ai/agent-runtime';
+import type { RunAgentPayload, RunErrorPayload, MessageRelayVia, RelayedUserMessage } from '@jini-ai/protocol';
+import type { AgentRuntimeState, applyAgentLaunchEnv, ensureAgentCapabilities, assertClaudeFilesystemSupport, resolveModelForLaunch, getAgentDef, resolveAgentLaunch, attachAcpSession, attachPiRpcSession, prepareAgentLogFile, preparePromptFileForAgent, AcpMcpServerInput, AcpPermissionHandler, PromptAugmenter } from '@jini-ai/agent-runtime';
 import type { createCommandInvocation } from '@jini-ai/platform/command';
 import type { listProcessSnapshots, ProcessSnapshot, StopProcessesResult } from '@jini-ai/platform/process';
 import type { RunByteJournal } from '../continuation/journal.js';
@@ -92,7 +94,7 @@ export type AgentRuntimeEventTranslation = {
     readonly kind: 'ignored';
 };
 /** Machine-readable failure reasons `run()` can reject with — every one is preceded by a `lifecycle.finish({status:'failed'})` call (see index.ts module doc's Invariant section). */
-export type AgentExecutorErrorCode = 'NATIVE_TOOL_POLICY_UNSUPPORTED' | 'AGENT_MODEL_UNRESOLVED' | 'AGENT_PERMISSION_MODE_INVALID' | 'AGENT_NOT_FOUND' | 'AGENT_RUNTIME_UNSUPPORTED' | 'AGENT_BINARY_NOT_RESOLVED' | 'AGENT_SPAWN_FAILED' | 'AGENT_PROMPT_TOO_LARGE';
+export type AgentExecutorErrorCode = 'FILESYSTEM_POLICY_UNSUPPORTED' | 'FILESYSTEM_POLICY_INVALID' | 'NATIVE_TOOL_POLICY_UNSUPPORTED' | 'AGENT_MODEL_UNRESOLVED' | 'AGENT_PERMISSION_MODE_INVALID' | 'AGENT_NOT_FOUND' | 'AGENT_RUNTIME_UNSUPPORTED' | 'AGENT_BINARY_NOT_RESOLVED' | 'AGENT_SPAWN_FAILED' | 'AGENT_PROMPT_TOO_LARGE';
 /** Thrown by `AgentExecutor.run()` on every failure path — never a bare `Error`, so callers can branch on `.code` instead of parsing `.message`. */
 export declare class AgentExecutorError extends Error {
     readonly code: AgentExecutorErrorCode;
@@ -102,6 +104,8 @@ export declare class AgentExecutorError extends Error {
     });
 }
 export interface AgentExecutorRunInput {
+    /** Host-selected mandatory filesystem boundary; no user grant may widen it. */
+    readonly filesystemRoot?: string;
     readonly runId: string;
     readonly agentId: string;
     readonly prompt: string;
@@ -203,28 +207,35 @@ export interface AgentExecutor {
      * underlying run is always already transitioned to `'failed'` via
      * `lifecycle.finish()` before this rejects (see index.ts module doc's Invariant).
      */
-    run(requiredArgs: Pick<AgentExecutorRunInput, "runId" | "agentId" | "prompt" | "cwd">, optionalArgs?: Pick<AgentExecutorRunInput, "model" | "reasoning" | "nativeToolAccess" | "nativeCapabilities" | "cliParity" | "permissionMode" | "imagePaths" | "imageContents" | "extraAllowedDirs" | "uploadRoot" | "credentialEnv" | "env" | "resumeSessionId" | "newSessionId" | "disallowedTools" | "allowedTools" | "settingSources" | "settings" | "chromeIntegration">): Promise<void>;
+    run(requiredArgs: Pick<AgentExecutorRunInput, "runId" | "agentId" | "prompt" | "cwd">, optionalArgs?: Pick<AgentExecutorRunInput, "filesystemRoot" | "model" | "reasoning" | "nativeToolAccess" | "nativeCapabilities" | "cliParity" | "permissionMode" | "imagePaths" | "imageContents" | "extraAllowedDirs" | "uploadRoot" | "credentialEnv" | "env" | "resumeSessionId" | "newSessionId" | "disallowedTools" | "allowedTools" | "settingSources" | "settings" | "chromeIntegration">): Promise<void>;
     /**
      * Delivers a message the human sent while `runId` is going straight into its live agent process
-     * (see {@link UserMessageDelivery} for each outcome). A stream-json agent is interrupted first and
-     * gets the message once the CLI acknowledges the interrupt, so this settles in milliseconds (at
-     * most `INTERRUPT_ACK_TIMEOUT_MS`); it never waits on the agent's reply.
+     * (see {@link UserMessageDelivery} for each outcome). A stream-json agent queues the message
+     * directly without interrupting tools. This settles on write acceptance; consumption is reported
+     * separately by UUID receipts. It never waits on the agent's reply.
      * Optional `imageContents` contains host-authorized pixels, encoded exactly as in an idle send.
      */
     sendUserMessage(requiredArgs: {
         readonly runId: string;
         readonly text: string;
+        readonly id?: string;
+        readonly attachmentIds?: readonly string[];
     }, optionalArgs?: {
         readonly imageContents?: readonly MessageAttachmentImage[];
     }): Promise<UserMessageDelivery>;
+    /** Trusted transport supplies the credential-bound run, never model arguments. No I/O or waiting. */
+    claimUserMessages(input: {
+        readonly runId: string;
+        readonly via: MessageRelayVia;
+    }, options?: Record<string, never>): readonly RelayedUserMessage[];
 }
 /**
  * What {@link AgentExecutor.sendUserMessage} did with a mid-run message:
- * - `'delivered'` — the running turn was interrupted and the message written into the live
+ * - `'delivered'` — the message was queued without interruption into the live
  *   session; the agent answers it next, in the same process and session.
  * - `'unsupported'` — the run is live, but its agent has no way to take input mid-run (its prompt
  *   is plain text or an RPC request). Queue attachment turns intact after the reply; text-only
- *   turns may retain the interrupt-and-resume fallback.
+ *   turns retain the next-turn queue fallback.
  * - `'not-running'` — no live process will accept it: an unknown run, a finished one, or one whose
  *   last turn already ended and closed stdin. The run is ending; the host should send it next.
  */
@@ -271,8 +282,14 @@ export interface StdinCloseHandle {
     closeStdinOnce(): void;
     /** Journals a sent-to-stdin byte chunk, queued through the same FIFO {@link wireChildLifecycle} already uses for emitted events. No-op when no journal was configured (see `CreateAgentExecutorOptions.journal`). */
     recordSentBytes(content: string): void;
-    /** Interrupts this child's turn, then writes a mid-run user message into its open stdin — see {@link AgentExecutor.sendUserMessage}. */
-    sendUserMessage(text: string, imageContents?: readonly MessageAttachmentImage[]): Promise<UserMessageDelivery>;
+    /** Queues a mid-run user message into this child's open stdin — see {@link AgentExecutor.sendUserMessage}. */
+    sendUserMessage(input: {
+        text: string;
+        id?: string;
+        attachmentIds?: readonly string[];
+    }, options?: {
+        imageContents?: readonly MessageAttachmentImage[];
+    }): Promise<UserMessageDelivery>;
 }
 /**
  * Gap 3 (capability-routed continuation transport) — host-owned config for the
@@ -600,6 +617,10 @@ export interface FailureClassificationContext {
  */
 export type ClassifyFailure = (context: FailureClassificationContext) => boolean | Promise<boolean>;
 export interface CreateAgentExecutorOptions {
+    /** Negotiated v1 only; share with bridge/lifecycle. Absent preserves legacy diagnostics/echoes. */
+    readonly delegatedResultCorrelation?: DelegatedResultCorrelation;
+    /** Required with correlation + byte journal: exact stdout blobs and durable reference records. */
+    readonly stdoutJournalBlobs?: StdoutJournalBlobPort;
     /** Host environment snapshot; baseline spawn keys and source config paths are allowlisted. */
     readonly hostEnv?: NodeJS.ProcessEnv;
     readonly runtimeState?: AgentRuntimeState;
@@ -616,6 +637,8 @@ export interface CreateAgentExecutorOptions {
     readonly resolveAgentLaunch?: typeof resolveAgentLaunch;
     /** @default the real `@jini-ai/agent-runtime` once-per-binary `--help` capability probe */
     readonly ensureAgentCapabilities?: typeof ensureAgentCapabilities;
+    /** Bounded version/enforcement probe; replaceable for offline host tests. */
+    readonly assertClaudeFilesystemSupport?: typeof assertClaudeFilesystemSupport;
     /** @default the real `@jini-ai/agent-runtime` PATH-env composer */
     readonly applyAgentLaunchEnv?: typeof applyAgentLaunchEnv;
     /** @default the real `@jini-ai/platform` cross-platform invocation builder */

package/dist/agent-executor/event-translation.js

@@ -101,6 +101,7 @@ function translateToolInputDeltaEvent(rawEvent) {
     };
 }
 export function translateToolResultEvent({ rawEvent }) {
+    const delegatedToolUseId = asOptionalString(rawEvent.delegatedToolUseId);
     const isError = typeof rawEvent.isError === 'boolean' ? rawEvent.isError : undefined;
     return {
         kind: 'agent',
@@ -108,6 +109,7 @@ export function translateToolResultEvent({ rawEvent }) {
             type: 'tool_result',
             toolUseId: asString(rawEvent.toolUseId),
             content: asString(rawEvent.content),
+            ...(delegatedToolUseId !== undefined ? { delegatedToolUseId } : {}),
             ...(isError !== undefined ? { isError } : {}),
         },
     };

package/dist/agent-executor/events.d.ts

@@ -1,3 +1,6 @@
+import type { DelegatedResultCorrelation } from '../delegated-result-correlation.js';
+import type { StdoutJournalBlobPort } from '../tool-result-diagnostics.js';
+import { type RunMessageRelay } from './message-relay.js';
 import type { probeMcpBridge } from './mcp-bridge-probe.js';
 import type { ModelCatalogSnapshot } from '@jini-ai/agent-runtime';
 import type { ChildProcess } from 'node:child_process';
@@ -24,6 +27,9 @@ export declare function defaultCleanupFailureSink(context: AgentCleanupFailureCo
  */
 export declare const DEFAULT_BUFFERED_STDOUT_MAX_BYTES: number;
 interface WireChildLifecycleContext extends TerminateChildTreeDeps {
+    readonly registerMessageRelay?: (relay: RunMessageRelay) => void;
+    readonly delegatedResultCorrelation?: DelegatedResultCorrelation;
+    readonly stdoutJournalBlobs?: StdoutJournalBlobPort;
     readonly startingModel?: string;
     readonly modelCatalog?: ModelCatalogSnapshot;
     readonly runId: string;
@@ -121,21 +127,6 @@ interface WireChildLifecycleContext extends TerminateChildTreeDeps {
  * @overallScore 100/100
  */
 export declare function wireChildLifecycle(ctx: WireChildLifecycleContext): StdinCloseHandle;
-/**
- * Whether a def's live process can take another user message mid-run: only a stream-json stdin
- * transport keeps stdin open for more JSONL user lines (see `RuntimeAgentDef.promptInputFormat`).
- * Deliberately not `resolveContinuationTransport`: that answers how a tool result gets back, and
- * reports `'mcp-callback'` for Claude even though its stdin takes user lines all the same.
- */
-export declare function acceptsMidRunUserMessages({ def }: {
-    readonly def: RuntimeAgentDef;
-}): boolean;
-/**
- * How long a mid-run message waits for the CLI to acknowledge its interrupt before being written
- * anyway. Claude Code acks within milliseconds (it answers before the aborted turn's own result);
- * the ceiling only bounds an agent that ignores control requests.
- */
-export declare const INTERRUPT_ACK_TIMEOUT_MS = 5000;
 /**
  * Writes the initial user turn to the child's stdin per `def.promptInputFormat`
  * (both branches only run for `promptViaStdin: true` defs — the only shape
@@ -170,6 +161,7 @@ interface RunAcpDispatchInput {
     readonly mcpBridge: McpBridgeDelivery | null;
 }
 interface RunAcpDispatchDeps extends TerminateChildTreeDeps {
+    readonly registerMessageRelay?: (relay: RunMessageRelay) => void;
     readonly lifecycle: RunLifecycle;
     readonly attachAcpSession: typeof attachAcpSession;
     readonly onPermissionRequest: AcpPermissionHandler | undefined;