@jini-ai/daemon 0.6.9 → 0.6.11

package/dist/agent-executor/events.js

@@ -1,4 +1,7 @@
+import { createToolResultDiagnosticProjection, projectDiagnosticFrame } from '../tool-result-diagnostics.js';
 import { appendSerialTask } from "@jini-ai/core/primitives";
+import { createLiveSessionState } from './live-session-state.js';
+import { acceptsMidRunUserMessages, createMessageRelay } from './message-relay.js';
 import { randomUUID } from 'node:crypto';
 import { createModelReceiptTracker } from './model-receipts.js';
 import { observeRunOutput } from './run-output.js';
@@ -9,7 +12,7 @@ import { collectProcessTreePids, listProcessSnapshots, stopProcesses, } from '@j
 import { classifyRunCloseStatus, } from '../close-status.js';
 import { resolveContinuationTransport, } from '../continuation/continuation-transport.js';
 import { resultContent, } from '../delegated-tool-bridge.js';
-import { extractResultMedia, } from '../tool-result-media.js';
+import { projectToolResultEvent, } from '../tool-result-media.js';
 import { translateAgentRuntimeEvent, translateAcpError, applyAgentTranslationSideEffects, } from './event-translation.js';
 import { errorMessage, isRecord, } from './values.js';
 import { MCP_BRIDGE_UNAVAILABLE, unavailableJiniBridgeStatus, bridgeUnavailableMessage, } from './mcp-bridge.js';
@@ -202,6 +205,45 @@ export const DEFAULT_BUFFERED_STDOUT_MAX_BYTES = 8 * 1024 * 1024;
 function bufferedStdoutTruncationNotice(droppedBytes, maxBytes) {
     return `\n[jini] agent stdout truncated: ${droppedBytes} byte(s) dropped after the ${maxBytes}-byte buffer limit was reached.\n`;
 }
+/** Install once on a driver's FIFO; close synchronously before any terminal handler yields.
+ * Native runs omit registration, so they allocate no relay and emit only CLI receipts. */
+function attachMessageRelay({ register, emit, child }) {
+    if (!register)
+        return undefined;
+    const relay = createMessageRelay({ emit });
+    register(relay);
+    child.once('close', () => relay.close());
+    return relay;
+}
+/** Keeps exact-byte auditing separate from retained diagnostics on the run's existing FIFO.
+ * Projection retains at most one bounded frame; ordinary stdout keeps its legacy byte journal. */
+function createStdoutDiagnostics({ ctx, enqueueEmit }, _options = {}) {
+    const { runId, lifecycle, journal, stdoutJournalBlobs } = ctx;
+    const projection = ctx.delegatedResultCorrelation && ctx.streamFormat === 'claude-stream-json'
+        ? createToolResultDiagnosticProjection({}) : undefined;
+    function emit({ text }) {
+        if (text)
+            enqueueEmit(() => lifecycle.emit({ runId, input: { event: 'stdout', data: { chunk: text } } }));
+    }
+    return {
+        record({ chunk, text }) {
+            if (!journal)
+                return;
+            if (projection && stdoutJournalBlobs) {
+                enqueueEmit(() => stdoutJournalBlobs.record({ runId, chunk }));
+            }
+            else {
+                enqueueEmit(() => journal.record({ runId, entry: receivedJournalEntry('stdout', text) }));
+            }
+        },
+        feed({ text }) {
+            emit({ text: projection ? projection.feed({ chunk: text }) : text });
+        },
+        flush() {
+            emit({ text: projection?.flush({}) ?? '' });
+        },
+    };
+}
 /**
  * Wires one spawned child's full observable lifecycle: raw stdout/stderr
  * forwarding, structured stream-parser dispatch (translated via
@@ -264,6 +306,7 @@ function bufferedStdoutTruncationNotice(droppedBytes, maxBytes) {
  */
 export function wireChildLifecycle(ctx) {
     const { runId, def, streamFormat, child, lifecycle, journal, continuation, classifyFailure } = ctx;
+    const stdoutDiagnostics = createStdoutDiagnostics({ ctx, enqueueEmit });
     const output = observeRunOutput({ lifecycle, runId, agentName: def.name }, { plainStdout: streamFormat === 'plain' });
     const modelReceipt = createModelReceiptTracker(ctx.startingModel, ctx.modelCatalog?.models);
     let stdinClosed = false;
@@ -283,9 +326,8 @@ export function wireChildLifecycle(ctx) {
     // only ever acted on when a host has explicitly allowlisted the tool's name.
     let pendingToolUse;
     // Observe the canonical lifecycle, including delegated calls that bypass the CLI parser.
-    // A single latest tool_use cannot represent parallel tools at an interrupt boundary.
+    // A single latest tool_use cannot represent all parallel calls at explicit cancellation.
     const unresolvedToolCalls = new Set();
-    const interruptedToolCalls = new Set();
     const toolSubscription = lifecycle.stream({ runId, onEvent: (event) => {
             if (event.kind !== 'agent')
                 return;
@@ -301,9 +343,9 @@ export function wireChildLifecycle(ctx) {
     });
     /** Run on the same FIFO as parsed results, after the aborted segment has drained.
      * O(t) in unresolved calls; completed results are never replaced with cancellation. */
-    async function cancelUnresolvedToolCalls(ids) {
+    async function cancelUnresolvedToolCalls() {
         await toolSubscription;
-        for (const toolUseId of ids ?? [...unresolvedToolCalls]) {
+        for (const toolUseId of [...unresolvedToolCalls]) {
             if (!unresolvedToolCalls.has(toolUseId))
                 continue;
             await lifecycle.emit({ runId, input: { event: 'agent', data: {
@@ -342,71 +384,46 @@ export function wireChildLifecycle(ctx) {
         stdinClosed = true;
         child.stdin?.end();
     }
-    // Mid-run interrupts (see `sendUserMessage` below): each sent `interrupt` control request waits
-    // here, by request id, for the CLI's `control_response`. Settled with `true` on the ack, `false`
-    // when the process exits first. Bounded by the mid-run messages in flight on this one run.
-    const pendingInterruptAcks = new Map();
-    // Set once this run has interrupted its agent: from then on a turn the interrupt aborted
-    // (`aborted_*` stop reason) is not the run's last — the message that follows starts a new one.
-    let interruptSent = false;
-    // Claude Code's background tasks still running (a subagent or shell it started in the
-    // background), from its latest `background_tasks_changed` line, which lists them all. While any
-    // runs, an `end_turn` is not the run's end: the CLI keeps going until they finish and reports on
-    // them, so stdin must stay open for mid-run messages. Closing it there (2026-10-10, plannie chat)
-    // made every message sent while two subagents worked come back 'not-running' and wait for the run
-    // to end — and at EOF the CLI stops background tasks at its own wait ceiling (10 minutes).
-    let backgroundTaskCount = 0;
-    // Set when a turn ended and stdin stayed open only for background tasks: no turn is running, so a
-    // mid-run message has nothing to interrupt, and the last task finishing closes stdin (below).
+    // Unanswered UUIDs and the CLI's queued_turn_count keep stdin open across intermediate turn ends.
+    // Consumption is confirmed by CLI reply/result attribution, never by HTTP delivery or an echo.
+    const emitInput = (data) => enqueueEmit(() => lifecycle.emit({ runId, input: { event: 'agent', data } }));
+    const session = createLiveSessionState({ emit: emitInput });
+    const relay = attachMessageRelay({ register: ctx.registerMessageRelay, emit: emitInput, child });
+    // Claude's background tasks can outlive a parent turn. Keep the existing hold until the last
+    // task finishes; closing stdin early stops them at the CLI's background-wait ceiling.
+    // 2026-10-10 (plannie chat): closing at the parent's end_turn made messages return
+    // 'not-running' for ten minutes, then EOF killed the still-working subagents at that ceiling.
     let heldForBackgroundTasks = false;
-    // stdout carry-over for the control lines below; holds at most the current partial line.
+    let heldForQueuedInput = false;
     let controlScanBuffer = '';
-    /** Resolves the waiting interrupt this `control_response` line acknowledges, if any. @complexity O(line length). */
-    function settleInterruptAck(line) {
-        const requestId = controlResponseRequestId({ line: line });
-        const settle = requestId === undefined ? undefined : pendingInterruptAcks.get(requestId);
-        if (!settle)
-            return;
-        pendingInterruptAcks.delete(requestId);
-        settle(true);
-    }
-    /**
-     * Tracks a `background_tasks_changed` line. The last background task finishing while stdin is
-     * held only for them closes it, exactly as the turn end would have: the CLI then answers what it
-     * still owes (the tasks' report) and exits. @complexity O(line length).
-     */
-    function updateBackgroundTasks(line) {
-        const count = backgroundTaskListLength({ line: line });
-        if (count === undefined)
-            return;
-        backgroundTaskCount = count;
-        if (count === 0 && heldForBackgroundTasks) {
-            heldForBackgroundTasks = false;
-            closeStdinOnce();
-        }
-    }
-    /**
-     * Reads the stdout lines a mid-run message depends on: interrupt acks and background-task
-     * changes. Only agents that take mid-run messages are scanned. A chunk with no newline is only
-     * appended, so a long line split across many chunks is split once, not once per chunk.
-     * @complexity O(chunk length) amortized.
-     */
+    /** Scan and parse in wire order: a receipt later in a chunk cannot affect an earlier turn end.
+     * O(chunk length) amortized; only the partial line remains buffered. */
     function scanControlLines(text) {
-        if (!acceptsMidRunUserMessages({ def: def }))
-            return;
         controlScanBuffer += text;
         if (!text.includes('\n'))
             return;
-        // `text` holds a newline, so the buffer does: split off the complete lines, keep the partial tail.
         const lastNewline = controlScanBuffer.lastIndexOf('\n');
         const lines = controlScanBuffer.slice(0, lastNewline).split('\n');
         controlScanBuffer = controlScanBuffer.slice(lastNewline + 1);
-        for (const line of lines) {
-            // Both checked: either word can also appear inside the other kind of line's text.
-            if (line.includes('"control_response"'))
-                settleInterruptAck(line);
-            if (line.includes('"background_tasks_changed"'))
-                updateBackgroundTasks(line);
+        for (const line of lines)
+            feedSessionLine(line);
+    }
+    function feedSessionLine(line) {
+        const observed = session.observe({ line });
+        if (observed.startedInput)
+            heldForQueuedInput = false;
+        streamHandler.feed({ chunk: `${line}\n` });
+        if (session.hasPendingInput())
+            return;
+        if (heldForBackgroundTasks && session.backgroundTaskCount() === 0) {
+            heldForBackgroundTasks = false;
+            closeStdinOnce();
+        }
+        // A result can lower queued_turn_count after the assistant end already held stdin open.
+        // Re-evaluate that held end after parsing the result (the parser deduplicates turn ends).
+        if (observed.result && heldForQueuedInput && session.backgroundTaskCount() === 0) {
+            heldForQueuedInput = false;
+            closeStdinOnce();
         }
     }
     /**
@@ -428,25 +445,15 @@ export function wireChildLifecycle(ctx) {
         if (journal)
             enqueueEmit(() => journal.record({ runId: runId, entry: sentJournalEntry(content) }));
     }
-    /**
-     * Whether a `turn_end` leaves stdin open for a live agent that takes mid-run messages — and why:
-     * `'background-tasks'` when only background tasks keep the run going (no turn runs until the next
-     * message or task report), `'turn-continues'` for the reasons below, `'close'` otherwise. Open
-     * because the run is not over: a `tool_use` stop (the CLI runs the tool itself and carries on, and a
-     * message sent while the tool runs must still reach it), any end while an interrupt still waits
-     * for its ack (the message is about to be written), and the end of a turn an interrupt aborted
-     * (the message written after it starts the next turn), and any end while background tasks still
-     * run (see `backgroundTaskCount`). Every other end closes stdin, so the CLI exits once it has
-     * answered everything written before EOF.
-     */
+    /** A tool_use end is intermediate: the CLI executes that batch itself and carries on.
+     * Pending input and background tasks also owe work. Every other end closes stdin so the CLI
+     * exits once it has answered everything written before EOF. */
     function stdinHoldAfterTurnEnd(stopReason) {
-        if (!acceptsMidRunUserMessages({ def: def }))
+        if (!acceptsMidRunUserMessages({ def }))
             return 'close';
-        if (stopReason === 'tool_use' || pendingInterruptAcks.size > 0)
-            return 'turn-continues';
-        if (interruptSent && stopReason !== undefined && stopReason.startsWith('aborted'))
+        if (stopReason === 'tool_use' || session.hasPendingInput())
             return 'turn-continues';
-        return backgroundTaskCount > 0 ? 'background-tasks' : 'close';
+        return session.backgroundTaskCount() > 0 ? 'background-tasks' : 'close';
     }
     /**
      * Decides, per `turn_end`, whether to auto-resolve a pending tool_use through the injected
@@ -455,11 +462,6 @@ export function wireChildLifecycle(ctx) {
      * unconfigured or the pending tool isn't allowlisted).
      */
     function handleTurnEnd(stopReason) {
-        if (stopReason?.startsWith('aborted'))
-            enqueueEmit(async () => {
-                await cancelUnresolvedToolCalls([...interruptedToolCalls]);
-                interruptedToolCalls.clear();
-            });
         const toolUse = pendingToolUse;
         const shouldInject = stopReason === 'tool_use' &&
             toolUse !== undefined &&
@@ -469,6 +471,7 @@ export function wireChildLifecycle(ctx) {
         if (!shouldInject) {
             const hold = stdinHoldAfterTurnEnd(stopReason);
             heldForBackgroundTasks = hold === 'background-tasks';
+            heldForQueuedInput = hold === 'turn-continues' && stopReason !== 'tool_use';
             if (hold === 'close')
                 closeStdinOnce();
             return;
@@ -478,11 +481,8 @@ export function wireChildLifecycle(ctx) {
             const run = { id: runId };
             let content;
             let isError;
-            // Same extraction `delegated-tool-bridge.ts`'s `execute()` runs, kept consistent per
-            // `resultContent`'s own doc ("both callers share one mapping"). This path never ran
-            // `splitToolResultSurfaces` (it has no `mcp-ui` withhold-from-model concept — the flattened
-            // `content` below already carries the whole raw output, a pre-existing, unrelated gap), so
-            // there is no `remainder` to thread back in — only the extracted blocks are used here.
+            // Event projection removes pixels only from saved content; stdin keeps the original.
+            let eventContent;
             let media = [];
             // Suspend the slow-run watchdog for the duration of this daemon-awaited execution: the daemon
             // knows exactly why the run is quiet here (it dispatched the tool itself and is waiting on it),
@@ -494,11 +494,14 @@ export function wireChildLifecycle(ctx) {
             try {
                 const result = await continuation.toolExecutor.execute({ principal: continuation.principal, run: run, toolId: toolUse.name, input: toolUse.input });
                 content = resultContent({ result: result });
-                isError = result.status !== 'completed';
-                media = extractResultMedia({ output: result.output }).media;
+                const projection = projectToolResultEvent({ result });
+                eventContent = projection.content;
+                isError = projection.isError === true;
+                media = projection.media ?? [];
             }
             catch (error) {
                 content = errorMessage(error);
+                eventContent = content;
                 isError = true;
             }
             finally {
@@ -509,7 +512,7 @@ export function wireChildLifecycle(ctx) {
                     data: {
                         type: 'tool_result',
                         toolUseId: toolUse.id,
-                        content,
+                        content: eventContent,
                         ...(isError ? { isError: true } : {}),
                         ...(media.length > 0 ? { media } : {}),
                     },
@@ -539,7 +542,10 @@ export function wireChildLifecycle(ctx) {
                     } });
                 if (rejectUnavailableBridge({ payload: translation.payload, rawEvent }, {}))
                     return;
-                enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'agent', data: statusWithChildIdentity({ payload: translation.payload, childPid: ctx.child.pid }, {}) } }));
+                enqueueEmit(() => {
+                    const payload = projectEcho({ payload: translation.payload, rawEvent }, {});
+                    return lifecycle.emit({ runId, input: { event: 'agent', data: statusWithChildIdentity({ payload, childPid: ctx.child.pid }, {}) } });
+                });
             }
             else if (translation.kind === 'error') {
                 enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'error', data: translation.payload } }));
@@ -548,6 +554,17 @@ export function wireChildLifecycle(ctx) {
                 handleTurnEnd(translation.stopReason);
             }
         });
+    /** Verify against an already-saved call in this run; unverified metadata preserves all output. */
+    function projectEcho({ payload, rawEvent }, _options = {}) {
+        if (!ctx.delegatedResultCorrelation)
+            return payload;
+        if (payload.type === 'raw')
+            return { ...payload, line: projectDiagnosticFrame({ line: payload.line }) };
+        if (payload.type !== 'tool_result' || !payload.delegatedToolUseId || !Array.isArray(rawEvent.delegatedResultContent))
+            return payload;
+        const matches = ctx.delegatedResultCorrelation.matches({ runId, toolUseId: payload.delegatedToolUseId, content: rawEvent.delegatedResultContent, isError: payload.isError === true });
+        return matches ? { ...payload, content: `Result shown by delegated call ${payload.delegatedToolUseId}.` } : payload;
+    }
     function rejectUnavailableBridge({ payload, rawEvent }, _options = {}) {
         if (!bridgeChecked && payload.type === 'status' && payload.label === 'initializing') {
             bridgeChecked = true;
@@ -616,8 +633,7 @@ export function wireChildLifecycle(ctx) {
     }
     child.stdout?.on('data', (chunk) => {
         const text = chunk.toString('utf8');
-        if (journal)
-            enqueueEmit(() => journal.record({ runId: runId, entry: receivedJournalEntry('stdout', text) }));
+        stdoutDiagnostics.record({ chunk, text });
         if (streamFormat === 'plain') {
             if (text.length > 0)
                 userVisibleOutputSeen = true;
@@ -643,14 +659,13 @@ export function wireChildLifecycle(ctx) {
             enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'agent', data: { type: 'text_delta', delta: text } } }));
             return;
         }
-        enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'stdout', data: { chunk: text } } }));
-        // Before the parser: an ack and the aborted turn's end can share a chunk, and the turn end must
-        // see that no interrupt is still waiting (see `stdinHoldAfterTurnEnd`); a background task
-        // starting and the turn's end can share one too.
-        scanControlLines(text);
-        // Non-null: `streamHandler` is only ever null when `streamFormat === 'plain'` (see its
-        // construction above), the branch this statement is provably unreachable from.
-        streamHandler.feed({ chunk: text });
+        stdoutDiagnostics.feed({ text });
+        // Receipts, background membership and turn ends must be processed in the same wire order.
+        // streamHandler is non-null here: the plain-format branch returned above.
+        if (acceptsMidRunUserMessages({ def }))
+            scanControlLines(text);
+        else
+            streamHandler.feed({ chunk: text });
     });
     child.stderr?.on('data', (chunk) => {
         const text = chunk.toString('utf8');
@@ -673,9 +688,7 @@ export function wireChildLifecycle(ctx) {
             void terminateChildTreeBestEffort(ctx, child, runId, 'cancel', ctx.onCleanupFailure);
         } });
     child.on('close', (code, signal) => {
-        for (const settle of pendingInterruptAcks.values())
-            settle(false);
-        pendingInterruptAcks.clear();
+        stdinClosed = true;
         void (async () => {
             // Not wrapped in try/catch: all 4 supported parser factories'
             // flush() implementations already internally guard their own
@@ -685,7 +698,13 @@ export function wireChildLifecycle(ctx) {
             // here would be dead code for the fixed, closed set of parsers this
             // driver dispatches to. `streamHandler` is null for `'plain'` (no
             // parser, hence nothing to flush) — `?.` skips it cleanly.
+            if (controlScanBuffer) {
+                feedSessionLine(controlScanBuffer);
+                controlScanBuffer = '';
+            }
             streamHandler?.flush();
+            session.endSession();
+            stdoutDiagnostics.flush();
             // Queued before `await emitQueue` so the flushed text is durably appended ahead of
             // `finish()`'s `'end'` event, exactly like every live-path emit already is.
             flushBufferedStdout();
@@ -716,63 +735,27 @@ export function wireChildLifecycle(ctx) {
             })
             : false;
     }
-    /**
-     * A mid-run message: first an `interrupt` control request on the still-open stdin, so the agent
-     * stops generating (or abandons the tool it is running) at once instead of finishing its whole
-     * reply; then, once the CLI acknowledges, the message as the next user line, which the CLI
-     * answers straight away in the same session; then the run's own `user_message` event through the
-     * same FIFO as the agent's output, so the message sits in the stream where it took effect.
-     * An ack that never comes (an agent that ignores control requests) only delays the write by
-     * {@link INTERRUPT_ACK_TIMEOUT_MS}: the CLI then folds the line in at its next step. Once
-     * `turn_end` has closed stdin, or the process exits before the ack, there is no session left to
-     * reach — `'not-running'`. Between turns, while stdin is held only for background tasks, there is
-     * no generation to stop: the line is written at once and starts the next turn.
-     * Host-prepared images use the same content blocks as the initial stdin turn; no file tools
-     * or new directory grants are needed to see these pixels.
-     */
-    async function sendUserMessage(text, images = []) {
-        if (!acceptsMidRunUserMessages({ def: def }))
-            return 'unsupported';
+    /** Queue into the existing Claude session without interrupting parallel tools or subagents.
+     * Images use the idle-send encoder without file tools or new directory grants; journals keep
+     * text without base64. HTTP acceptance only
+     * confirms the write; UUID-attributed CLI receipts separately confirm consumption. */
+    async function sendUserMessage({ text, id = randomUUID(), attachmentIds }, { imageContents: images = [] } = {}) {
+        if (!acceptsMidRunUserMessages({ def }))
+            return relay?.enqueue({ id, text, hasAttachments: images.length > 0 || (attachmentIds?.length ?? 0) > 0 }) ?? 'unsupported';
         const stdin = child.stdin;
         if (stdinClosed || !stdin)
             return 'not-running';
-        if (heldForBackgroundTasks) {
-            heldForBackgroundTasks = false;
-            writeUserMessage(stdin, text, images);
-            return 'delivered';
-        }
-        const requestId = `jini-interrupt-${randomUUID()}`;
-        interruptSent = true;
-        // Capture before requesting the interrupt. Its result can precede the acknowledgement, or
-        // arrive after the next segment starts: neither ordering may cancel that segment's new tools.
-        enqueueEmit(async () => {
-            await toolSubscription;
-            for (const id of interruptedToolCalls)
-                if (!unresolvedToolCalls.has(id))
-                    interruptedToolCalls.delete(id);
-            for (const id of unresolvedToolCalls)
-                interruptedToolCalls.add(id);
-        });
-        const acked = new Promise((resolve) => pendingInterruptAcks.set(requestId, resolve));
-        stdin.write(`${JSON.stringify({ type: 'control_request', request_id: requestId, request: { subtype: 'interrupt' } })}\n`, 'utf8');
-        let timer;
-        const timedOut = new Promise((resolve) => {
-            timer = setTimeout(() => resolve(true), INTERRUPT_ACK_TIMEOUT_MS);
-        });
-        const processAlive = await Promise.race([acked, timedOut]);
-        clearTimeout(timer);
-        pendingInterruptAcks.delete(requestId);
-        if (!processAlive || stdinClosed)
-            return 'not-running';
-        writeUserMessage(stdin, text, images);
+        heldForBackgroundTasks = false;
+        writeUserMessage(stdin, text, images, id);
         return 'delivered';
     }
-    /** Writes a complete mid-run turn using the idle image encoder; journals text without base64. */
-    function writeUserMessage(stdin, text, images) {
-        stdin.write(`${JSON.stringify(streamJsonUserMessage({ content: messageContentWithImages({ prompt: text, images }, {}) }))}\n`, 'utf8');
+    /** Writes a complete mid-run turn using the idle image encoder; journals text without base64.
+     * The same UUID identifies stdin, queue acceptance and subsequent consumption receipts. */
+    function writeUserMessage(stdin, text, images, id) {
+        session.queue({ id, text });
+        stdin.write(`${JSON.stringify({ ...streamJsonUserMessage({ content: messageContentWithImages({ prompt: text, images }, {}) }), uuid: id })}\n`, 'utf8');
         if (journal)
-            enqueueEmit(() => journal.record({ runId: runId, entry: sentJournalEntry(text) }));
-        enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'agent', data: { type: 'user_message', id: randomUUID(), text: text } } }));
+            enqueueEmit(() => journal.record({ runId, entry: sentJournalEntry(text) }));
     }
     return {
         closeStdinOnce,
@@ -783,45 +766,6 @@ export function wireChildLifecycle(ctx) {
         sendUserMessage,
     };
 }
-/**
- * Whether a def's live process can take another user message mid-run: only a stream-json stdin
- * transport keeps stdin open for more JSONL user lines (see `RuntimeAgentDef.promptInputFormat`).
- * Deliberately not `resolveContinuationTransport`: that answers how a tool result gets back, and
- * reports `'mcp-callback'` for Claude even though its stdin takes user lines all the same.
- */
-export function acceptsMidRunUserMessages({ def }) {
-    return def.promptViaStdin === true && def.promptInputFormat === 'stream-json';
-}
-/**
- * How long a mid-run message waits for the CLI to acknowledge its interrupt before being written
- * anyway. Claude Code acks within milliseconds (it answers before the aborted turn's own result);
- * the ceiling only bounds an agent that ignores control requests.
- */
-export const INTERRUPT_ACK_TIMEOUT_MS = 5_000;
-/** The `request_id` of a stream-json `control_response` line, or `undefined` for anything else. */
-function controlResponseRequestId({ line }) {
-    try {
-        const parsed = JSON.parse(line);
-        if (!isRecord(parsed) || parsed.type !== 'control_response' || !isRecord(parsed.response))
-            return undefined;
-        return typeof parsed.response.request_id === 'string' ? parsed.response.request_id : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-/** How many tasks a `background_tasks_changed` line lists, or `undefined` for any other line. */
-function backgroundTaskListLength({ line }) {
-    try {
-        const parsed = JSON.parse(line);
-        if (!isRecord(parsed) || parsed.type !== 'system' || parsed.subtype !== 'background_tasks_changed')
-            return undefined;
-        return Array.isArray(parsed.tasks) ? parsed.tasks.length : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
 /** The stream-json stdin envelope for one user message — the initial prompt and every mid-run one. */
 function streamJsonUserMessage({ content }) {
     return { type: 'user', message: { role: 'user', content: content } };
@@ -865,6 +809,9 @@ function wireAcpLifecycle(ctx) {
     function enqueueEmit(task) {
         emitQueue = appendSerialTask({ previous: emitQueue, task, onError: reportDroppedEmit });
     }
+    attachMessageRelay({ register: ctx.registerMessageRelay, child,
+        emit: data => enqueueEmit(() => lifecycle.emit({ runId, input: { event: 'agent', data } })),
+    });
     if (ctx.model)
         enqueueEmit(() => lifecycle.emit({ runId, input: { event: 'agent', data: { type: 'status', label: 'starting_model', model: ctx.model } } }));
     child.stdout?.on('data', (chunk) => {
@@ -1064,6 +1011,7 @@ export function writePromptToStdin(def, child, prompt, handle) {
 export async function runAcpDispatch({ input, deps }) {
     try {
         wireAcpLifecycle({
+            ...(deps.registerMessageRelay ? { registerMessageRelay: deps.registerMessageRelay } : {}),
             runId: input.runId,
             agentId: input.agentId,
             child: input.child,

package/dist/agent-executor/launch.d.ts

@@ -186,10 +186,16 @@ export declare function computeRuntimeContext({ preparedPromptFile, preparedLogF
     readonly resumeSessionId?: string | null;
     readonly newSessionId?: string;
 }): RuntimeContext | undefined;
+type AgentBuildInput = Parameters<typeof buildAgentBuildArgsOptions>[0]['input'];
 /** Phase 9a: the def's `buildArgs` 4th argument. Historically omitted when every override was absent;
  * that let defs silently enable auto-approval. Always supply the validated restricted default now. Pure. */
 export declare function buildAgentBuildArgsOptions({ input, systemPromptOverlay }: {
-    readonly input: Pick<AgentExecutorRunInput, 'model' | 'reasoning' | 'permissionMode' | 'nativeToolAccess' | 'nativeCapabilities' | 'cliParity' | 'disallowedTools' | 'allowedTools' | 'settingSources' | 'settings' | 'chromeIntegration'>;
+    readonly input: Pick<AgentExecutorRunInput, 'filesystemRoot' | 'model' | 'reasoning' | 'permissionMode' | 'nativeToolAccess' | 'nativeCapabilities' | 'cliParity' | 'disallowedTools' | 'allowedTools' | 'settingSources' | 'settings' | 'chromeIntegration'> & {
+        filesystemRuntimeReadPaths?: readonly string[];
+        filesystemTempDir?: string;
+        filesystemSharedTempRoots?: readonly string[];
+        filesystemNotice?: string;
+    };
     readonly systemPromptOverlay: string | null | undefined;
 }): RuntimeBuildOptions;
 /**
@@ -262,7 +268,7 @@ export declare function buildRunArgs({ input, deps }: {
         readonly def: RuntimeAgentDef;
         readonly imageDelivery: ImagePromptDelivery;
         readonly imagePaths: readonly string[] | undefined;
-        readonly runInput: Pick<AgentExecutorRunInput, 'model' | 'reasoning' | 'permissionMode'>;
+        readonly runInput: AgentBuildInput;
         readonly systemPromptOverlay: string | null | undefined;
         readonly overlayDelivery: SystemPromptOverlayDelivery;
         readonly runtimeContext: RuntimeContext | undefined;
@@ -381,6 +387,6 @@ export declare function confirmChildSpawned({ input, deps }: {
  * @complexity `run()`'s own setup is O(1); steady-state cost is the chosen stream parser's.
  * @overallScore 100/100
  */
-export declare function createAgentExecutor(requiredArgs: Pick<CreateAgentExecutorOptions, "lifecycle">, optionalArgs?: Pick<CreateAgentExecutorOptions, "runtimeState" | "codexDisablePlugins" | "piGracefulShutdownMs" | "hostEnv" | "getAgentDef" | "resolveAgentLaunch" | "resolveModelForLaunch" | "ensureAgentCapabilities" | "applyAgentLaunchEnv" | "createCommandInvocation" | "spawn" | "probeMcpBridge" | "attachAcpSession" | "acpPermissionHandler" | "attachPiRpcSession" | "preparePromptFileForAgent" | "prepareAgentLogFile" | "listProcessSnapshots" | "collectProcessTreePids" | "stopProcesses" | "onCleanupFailure" | "journal" | "continuation" | "classifyFailure" | "mcpJsonInjection" | "claudeConfigDirIsolation" | "claudeConfigDirIsolationEnabled" | "bufferedStdoutMaxBytes" | "promptAugmenter">): AgentExecutor;
+export declare function createAgentExecutor(requiredArgs: Pick<CreateAgentExecutorOptions, "lifecycle">, optionalArgs?: Pick<CreateAgentExecutorOptions, "runtimeState" | "codexDisablePlugins" | "piGracefulShutdownMs" | "hostEnv" | "getAgentDef" | "resolveAgentLaunch" | "resolveModelForLaunch" | "ensureAgentCapabilities" | "assertClaudeFilesystemSupport" | "applyAgentLaunchEnv" | "createCommandInvocation" | "spawn" | "probeMcpBridge" | "attachAcpSession" | "acpPermissionHandler" | "attachPiRpcSession" | "preparePromptFileForAgent" | "prepareAgentLogFile" | "listProcessSnapshots" | "collectProcessTreePids" | "stopProcesses" | "onCleanupFailure" | "journal" | "delegatedResultCorrelation" | "stdoutJournalBlobs" | "continuation" | "classifyFailure" | "mcpJsonInjection" | "claudeConfigDirIsolation" | "claudeConfigDirIsolationEnabled" | "bufferedStdoutMaxBytes" | "promptAugmenter">): AgentExecutor;
 export {};
 //# sourceMappingURL=launch.d.ts.map