@jini-ai/daemon 0.6.9 → 0.6.11

package/dist/core/read-only-tools.js

@@ -60,14 +60,15 @@ export function readOnlyToolRefusalMessage({ toolId, messages }, _optional = {})
 /**
  * Single read-only registration decision, shared by routes and inner dispatch.
  * @returns Null for an explicitly read-only registration, otherwise host refusal text.
+ * @complexity O(n) for known tools; unknown-tool diagnostics add bounded name scoring and O(n log n) sorting.
  */
-export function checkReadOnlyTool({ toolId, registry, messages }, _optional = {}) {
+export function checkReadOnlyTool({ toolId, input, registry, messages }, _optional = {}) {
     if (registry === undefined)
         return messages.unverifiableMessage;
     const tools = registry.list({});
     const descriptor = tools.find((candidate) => candidate.id === toolId);
     if (!descriptor)
-        return messages.unknownToolMessage({ toolId, candidates: toolCandidates({ toolId, tools }) });
+        return messages.unknownToolMessage({ toolId, candidates: toolCandidates({ toolId, tools, input }) });
     if (isReadOnlyTool({ descriptor }))
         return null;
     return readOnlyToolRefusalMessage({ toolId, messages });
@@ -86,8 +87,9 @@ export function checkReadOnlyTool({ toolId, registry, messages }, _optional = {}
  * @param required.registry - Descriptors to resolve `toolId` against; `undefined` ⇒ refuse (an
  *   unverifiable constrained dispatch is refused, never waived, matching `checkReadOnlyTool`).
  * @returns `null` when the dispatch may proceed, otherwise the refusal text to report.
- * @complexity O(1) for an unconstrained principal; O(n) in registered tool count for a constrained
- *   one, since `ToolRegistry` exposes enumeration rather than lookup by id.
+ * @complexity O(1) for an unconstrained principal; O(n) in registered tool count for a known tool,
+ *   since `ToolRegistry` exposes enumeration rather than lookup by id. Unknown ids also incur
+ *   the bounded similarity scoring and sorting cost documented by `toolCandidates`.
  */
 export function refuseNonReadOnlyDispatch(required, _optional = {}) {
     if (!principalIsReadOnlyConstrained({ principal: required.principal }))
@@ -127,13 +129,14 @@ export function readOnlyRemedyRefusalMessage({ refusal, formatMessage }, _option
  *
  * @returns A drop-in `ToolExecutor`; `resumeConfirmation`/`cancel`/`getAuditRecord` delegate
  *   straight through.
- * @complexity One extra property read per unconstrained call; one registry scan per constrained one.
+ * @complexity One extra property read per unconstrained call; one registry scan per constrained one,
+ *   plus bounded similarity scoring and sorting for an unknown id.
  */
 export function withReadOnlyToolConstraint({ inner, registry, idGenerator, messages }, _optional = {}) {
     return {
         execute: async (requiredArgs, optionalArgs = {}) => {
-            const { principal, toolId } = requiredArgs;
-            const refusal = refuseNonReadOnlyDispatch({ principal, toolId, registry, messages });
+            const { principal, toolId, input } = requiredArgs;
+            const refusal = refuseNonReadOnlyDispatch({ principal, toolId, input, registry, messages });
             // Deny before inner: no handler or kernel audit record exists. Use the authorization result
             // union instead of throwing, and mint a denial ID because there is no inner execution ID.
             if (refusal !== null)

package/dist/core/tool-candidates.d.ts

@@ -1,8 +1,13 @@
 import type { ToolDescriptor } from '@jini-ai/core';
-/** Registered prefix matches for unknown-tool diagnostics, in catalog order, capped at eight.
- * @complexity O(n) time and space over n registered tools. */
-export declare function toolCandidates({ toolId, tools }: {
+/** Registered prefix/near-name suggestions, closest first and capped at eight. Equal scores keep
+ * catalog order; an exact content_read.<resource> takes priority even beyond the old cutoff.
+ * Suggestions grant no execution authority; the caller must retry through the existing gates.
+ * @example toolCandidates({ toolId: 'content_read', input: { resource: 'theme' }, tools });
+ * @complexity O(n*l*r + n log n) time, O(n + r) space; scoring lengths capped at 128.
+ */
+export declare function toolCandidates({ toolId, tools, input }: {
     toolId: string;
     tools: readonly Pick<ToolDescriptor, 'id'>[];
+    input?: unknown;
 }, _optional?: Record<string, never>): string[];
 //# sourceMappingURL=tool-candidates.d.ts.map

package/dist/core/tool-candidates.js

@@ -1,6 +1,41 @@
-/** Registered prefix matches for unknown-tool diagnostics, in catalog order, capped at eight.
- * @complexity O(n) time and space over n registered tools. */
-export function toolCandidates({ toolId, tools }, _optional = {}) {
-    return tools.map((tool) => tool.id).filter((id) => id.startsWith(toolId)).slice(0, 8);
+/** Bounded Levenshtein distance for diagnostic ranking; oversized names retain prefix discovery.
+ * @returns Edit count, or Infinity above the 128-character scoring limit (no effects).
+ * @complexity O(l*r) time and O(r) space, with both name lengths capped at 128.
+ */
+function nameDistance({ left, right }, _options = {}) {
+    if (left.length > 128 || right.length > 128)
+        return Infinity;
+    let previous = Array.from({ length: right.length + 1 }, (_, index) => index);
+    for (let row = 1; row <= left.length; row++) {
+        const current = [row];
+        for (let column = 1; column <= right.length; column++) {
+            current[column] = Math.min(current[column - 1] + 1, previous[column] + 1, previous[column - 1] + Number(left[row - 1] !== right[column - 1]));
+        }
+        previous = current;
+    }
+    return previous[right.length];
+}
+/** Use content_read's explicit resource selector only as a diagnostic hint, never a dispatch.
+ * @returns The target spelling to rank against; malformed selectors use the original tool id.
+ * @complexity O(r) to join an r-character selector; no mutation or effects. Name scoring is bounded separately.
+ */
+function candidateTarget({ toolId, input }, _options = {}) {
+    if (toolId !== 'content_read' || typeof input !== 'object' || input === null || Array.isArray(input))
+        return toolId;
+    const resource = input.resource;
+    return typeof resource === 'string' && resource.length > 0 ? `${toolId}.${resource}` : toolId;
+}
+/** Registered prefix/near-name suggestions, closest first and capped at eight. Equal scores keep
+ * catalog order; an exact content_read.<resource> takes priority even beyond the old cutoff.
+ * Suggestions grant no execution authority; the caller must retry through the existing gates.
+ * @example toolCandidates({ toolId: 'content_read', input: { resource: 'theme' }, tools });
+ * @complexity O(n*l*r + n log n) time, O(n + r) space; scoring lengths capped at 128.
+ */
+export function toolCandidates({ toolId, tools, input }, _optional = {}) {
+    const target = candidateTarget({ toolId, input });
+    return tools.map(({ id }) => ({ id, distance: nameDistance({ left: target, right: id }) }))
+        .filter(({ id, distance }) => id === target || id.startsWith(toolId) || distance <= 2)
+        .sort((left, right) => Number(right.id === target) - Number(left.id === target) || left.distance - right.distance)
+        .slice(0, 8).map(({ id }) => id);
 }
 //# sourceMappingURL=tool-candidates.js.map

package/dist/delegated-result-correlation.d.ts

@@ -0,0 +1,26 @@
+import type { CredentialCryptoPort } from './run-credentials.js';
+interface ResultIdentity {
+    readonly runId: string;
+    readonly toolUseId: string;
+    readonly content: readonly unknown[];
+    readonly isError: boolean;
+}
+/** Run-scoped proof of a saved bridge result. Implementations retain digests, never pixels. */
+export interface DelegatedResultCorrelation {
+    record(input: ResultIdentity, options?: Record<string, never>): void;
+    matches(input: ResultIdentity, options?: Record<string, never>): boolean;
+    clearRun(input: {
+        runId: string;
+    }, options?: Record<string, never>): void;
+}
+/** Bounded digest store. Eviction only disables summarization, so legacy output remains safe.
+ * Share this instance with bridge/executor/lifecycle; lifecycle eviction clears each run.
+ * @complexity O(n) hashing plus JSON key sorting; O(r*c) retained fixed-size digests. */
+export declare function createDelegatedResultCorrelation({ crypto }: {
+    crypto: Pick<CredentialCryptoPort, 'digest'>;
+}, { maxRuns, maxCallsPerRun }?: {
+    maxRuns?: number;
+    maxCallsPerRun?: number;
+}): DelegatedResultCorrelation;
+export {};
+//# sourceMappingURL=delegated-result-correlation.d.ts.map

package/dist/delegated-result-correlation.js

@@ -0,0 +1,68 @@
+/** Accept only the complete base64 source shape; extra fields must remain part of the digest. */
+function base64ImageSource({ source }, _options = {}) {
+    if (typeof source !== 'object' || source === null)
+        return undefined;
+    const image = source;
+    if (image.type !== 'base64' || typeof image.media_type !== 'string' || typeof image.data !== 'string' || Object.keys(image).length !== 3)
+        return undefined;
+    return { data: image.data, media_type: image.media_type };
+}
+/** Convert only source-only images; dual representations and extra source fields stay in the proof. */
+function normalizeSourceImage({ record }, _options = {}) {
+    if (record.type !== 'image' || 'data' in record || 'mimeType' in record)
+        return record;
+    const image = base64ImageSource({ source: record.source });
+    if (!image)
+        return record;
+    const { source: _source, ...rest } = record;
+    return { ...rest, data: image.data, mimeType: image.media_type };
+}
+/** Normalize unambiguous CLI images and JSON object key order.
+ * @complexity O(n + k log k) for n bytes and k keys per object; inputs are wire JSON. */
+function normalizedJson(_key, value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return value;
+    const record = normalizeSourceImage({ record: value });
+    return Object.fromEntries(Object.keys(record).sort().map(key => [key, record[key]]));
+}
+/** Bounded digest store. Eviction only disables summarization, so legacy output remains safe.
+ * Share this instance with bridge/executor/lifecycle; lifecycle eviction clears each run.
+ * @complexity O(n) hashing plus JSON key sorting; O(r*c) retained fixed-size digests. */
+export function createDelegatedResultCorrelation({ crypto }, { maxRuns = 256, maxCallsPerRun = 2048 } = {}) {
+    if (!Number.isSafeInteger(maxRuns) || maxRuns < 1 || !Number.isSafeInteger(maxCallsPerRun) || maxCallsPerRun < 1)
+        throw new Error('correlation limits must be positive integers');
+    const runs = new Map();
+    // Optional correlation must not turn an otherwise serializable legacy fallback into a failure
+    // (for example, a cyclic in-process tool result handled by serializeDelegatedToolOutput).
+    const digest = (input) => {
+        try {
+            return crypto.digest({ token: JSON.stringify({ isError: input.isError, content: input.content }, normalizedJson) });
+        }
+        catch {
+            return undefined;
+        }
+    };
+    return {
+        record(input) {
+            const fingerprint = digest(input);
+            if (fingerprint === undefined)
+                return;
+            let calls = runs.get(input.runId);
+            if (!calls) {
+                if (runs.size >= maxRuns)
+                    runs.delete(runs.keys().next().value);
+                calls = new Map();
+                runs.set(input.runId, calls);
+            }
+            if (calls.size >= maxCallsPerRun)
+                calls.delete(calls.keys().next().value);
+            calls.set(input.toolUseId, fingerprint);
+        },
+        matches(input) {
+            const expected = runs.get(input.runId)?.get(input.toolUseId);
+            return expected !== undefined && expected === digest(input);
+        },
+        clearRun({ runId }) { runs.delete(runId); },
+    };
+}
+//# sourceMappingURL=delegated-result-correlation.js.map

package/dist/delegated-tool-bridge.d.ts

@@ -8,6 +8,7 @@
  */
 import { type Principal } from '@jini-ai/core';
 import type { RunLifecycle } from './run-lifecycle.js';
+import type { DelegatedResultCorrelation } from './delegated-result-correlation.js';
 import type { ToolExecutionResult, ToolExecutor } from './tool-executor.js';
 /**
  * Run-protocol `type` for a human-only surface withheld from a tool result.
@@ -42,24 +43,15 @@ export interface DelegatedToolBridge {
 export interface CreateDelegatedToolBridgeOptions {
     readonly lifecycle: RunLifecycle;
     readonly toolExecutor: ToolExecutor;
+    /** Share with the executor and lifecycle only after the host negotiates marker v1. */
+    readonly delegatedResultCorrelation?: DelegatedResultCorrelation;
 }
-/** Converts arbitrary registered-tool output into the string-bearing run protocol. */
-export declare function serializeDelegatedToolOutput({ output }: {
-    readonly output: unknown;
-}): string;
-/**
- * Maps a `ToolExecutionResult`'s status to the string a delegated-tool caller (this bridge, or
- * gap 3's stdin-tool-result injector in `agent-executor.ts`) reports back as the tool's visible
- * output/failure reason. Exported so both real callers share one mapping rather than drifting.
- */
-export declare function resultContent({ result }: {
-    readonly result: ToolExecutionResult;
-}): string;
+export { serializeDelegatedToolOutput, resultContent } from './tool-result-media.js';
 /**
  * Creates the transport-neutral bridge used by future ACP-delegate, MCP, or
  * other host protocols. This module does not invent a server transport: a
  * concrete protocol calls this bridge after it has decoded and authenticated a
  * delegated tool request.
  */
-export declare function createDelegatedToolBridge(options: CreateDelegatedToolBridgeOptions): DelegatedToolBridge;
+export declare function createDelegatedToolBridge(requiredArgs: Pick<CreateDelegatedToolBridgeOptions, 'lifecycle' | 'toolExecutor'>, optionalArgs?: Pick<CreateDelegatedToolBridgeOptions, 'delegatedResultCorrelation'>): DelegatedToolBridge;
 //# sourceMappingURL=delegated-tool-bridge.d.ts.map

package/dist/delegated-tool-bridge.js

@@ -6,8 +6,8 @@
  * enforces Jini's registry policy, confirmation, timeout, cancellation, and
  * audit trail before any registered handler runs.
  */
-import { batchOutcomeFor } from '@jini-ai/core';
-import { extractResultMedia } from './tool-result-media.js';
+import {} from '@jini-ai/core';
+import { projectToolResultEvent } from './tool-result-media.js';
 import { splitToolResultSurfaces } from './tool-result-surfaces.js';
 /**
  * Run-protocol `type` for a human-only surface withheld from a tool result.
@@ -38,41 +38,7 @@ function correlationFor(channel, toolUseId) {
 function errorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
-/** Converts arbitrary registered-tool output into the string-bearing run protocol. */
-export function serializeDelegatedToolOutput({ output }) {
-    if (typeof output === 'string')
-        return output;
-    if (output === undefined)
-        return '';
-    try {
-        const serialized = JSON.stringify(output);
-        return serialized === undefined ? String(output) : serialized;
-    }
-    catch {
-        return String(output);
-    }
-}
-/**
- * Maps a `ToolExecutionResult`'s status to the string a delegated-tool caller (this bridge, or
- * gap 3's stdin-tool-result injector in `agent-executor.ts`) reports back as the tool's visible
- * output/failure reason. Exported so both real callers share one mapping rather than drifting.
- */
-export function resultContent({ result }) {
-    switch (result.status) {
-        case 'completed':
-            return serializeDelegatedToolOutput({ output: result.output });
-        case 'denied':
-            return 'Tool execution denied by policy.';
-        case 'confirmation-denied':
-            return 'Tool execution denied during confirmation.';
-        case 'timed-out':
-            return 'Tool execution timed out.';
-        case 'cancelled':
-            return 'Tool execution cancelled.';
-        case 'failed':
-            return result.error ?? 'Tool execution failed.';
-    }
-}
+export { serializeDelegatedToolOutput, resultContent } from './tool-result-media.js';
 /**
  * Builds the abort controller handed to `ToolExecutor`, aborted by either a run cancellation or the
  * invocation's own transport signal. `dispose()` detaches both listeners once the call settles.
@@ -168,21 +134,7 @@ function createSurfaceSeam({ lifecycle, runId, toolUseId }) {
     return { emitSurface, settle, release };
 }
 /** Splits human-only surfaces out of an executed result, emits them, then the matching `tool_result`. */
-async function emitExecutedResult({ lifecycle, runId, toolUseId }, { executed }) {
-    // Recognized media blocks (images) are collected here purely to populate the sibling
-    // `media` field the `tool_result` event carries below, for a UI that wants to render one
-    // inline without re-parsing `content` (`ToolCard`'s `<img>`, per `assistant_demo_image`'s
-    // own doc). This does NOT remove the image block from `executed.output` — `image` is one
-    // of `tool-result-surfaces.ts`'s own `MODEL_VISIBLE_BLOCK_TYPES`, so the split below already
-    // keeps it in `modelOutput` on its own. An image reaching the model IS the point
-    // (`assistant_demo_image`/`admin.capture_screenshot` exist to prove exactly that round
-    // trip) — unlike an `mcp-ui` resource, which is genuinely human-only and must never survive
-    // into `modelOutput`. (Earlier this extraction fed its own de-imaged `remainder` into the
-    // surfaces split below and discarded the image from `output` entirely, on the assumption
-    // that the sibling `media` field was the only channel a caller needed — true for a UI
-    // reading the run's event stream, false for `@jini-ai/mcp`'s `execute_delegated_tool`, which
-    // hands the bridge's RETURN VALUE to the model with no access to that event stream at all.)
-    const { media } = extractResultMedia({ output: executed.output });
+async function emitExecutedResult({ lifecycle, runId, toolUseId, delegatedResultCorrelation }, { executed }) {
     // THE MODEL/HUMAN FORK. A tool call's return value is definitionally what the model
     // receives, so a UI resource left inside it is model-visible context no matter what any
     // downstream layer does — `@jini-ai/mcp`'s `okResult()` JSON.stringifies the whole result
@@ -202,32 +154,41 @@ async function emitExecutedResult({ lifecycle, runId, toolUseId }, { executed })
                 data: { type: MCP_UI_EVENT_TYPE, toolUseId, resource: surface },
             } });
     }
+    // The return keeps model-visible images; only the stored event removes their duplicate.
+    const projection = projectToolResultEvent({ result });
     await lifecycle.emit({ runId: runId, input: {
             event: 'agent',
             data: {
                 type: 'tool_result',
                 toolUseId,
-                content: resultContent({ result }),
-                ...(result.status === 'completed' && (batchOutcomeFor({ output: result.output }) ?? 'completed') === 'completed' ? {} : { isError: true }),
-                ...(media.length > 0 ? { media } : {}),
+                ...projection,
             },
         } });
+    // Record only after the canonical result is saved; failed emission cannot hide an echo.
+    if (result.status === 'completed' && isContentEnvelope(result.output)) {
+        delegatedResultCorrelation?.record({ runId, toolUseId, content: result.output.content, isError: projection.isError === true });
+    }
     return result;
 }
+function isContentEnvelope(output) {
+    return typeof output === 'object' && output !== null && 'content' in output && Array.isArray(output.content);
+}
 /**
  * Creates the transport-neutral bridge used by future ACP-delegate, MCP, or
  * other host protocols. This module does not invent a server transport: a
  * concrete protocol calls this bridge after it has decoded and authenticated a
  * delegated tool request.
  */
-export function createDelegatedToolBridge(options) {
-    const { lifecycle, toolExecutor } = options;
+export function createDelegatedToolBridge(requiredArgs, optionalArgs = {}) {
+    const options = { ...requiredArgs, ...optionalArgs };
+    // A route may pass its broader deps as options; its wrapped executor remains authoritative.
+    const { lifecycle, toolExecutor } = requiredArgs;
     async function execute(requiredArgs, optionalArgs = {}) {
         // Merged rather than read from `optionalArgs` alone: a caller may hand `signal` in the first
         // object (the delegated-tools HTTP route does), and it must still be honoured.
         const invocation = { ...requiredArgs, ...optionalArgs };
         const { runId, toolUseId, toolId, principal, input } = invocation;
-        const call = { lifecycle, runId, toolUseId };
+        const call = { lifecycle, runId, toolUseId, ...(options.delegatedResultCorrelation ? { delegatedResultCorrelation: options.delegatedResultCorrelation } : {}) };
         await lifecycle.emit({ runId: runId, input: {
                 event: 'agent',
                 data: { type: 'tool_use', id: toolUseId, name: toolId, input },

package/dist/http/attachments.d.ts

@@ -33,6 +33,19 @@ export interface AttachmentClaim {
     /** Absent only for an empty claim — there is no directory to grant when nothing was claimed. */
     batchDirectory?: string;
 }
+/** Copy an already authenticated claim into the host's filesystem boundary. Keep the original
+ * store records intact for promotion/read-back; the caller owns cleanup after the run ends.
+ * Only claimed files are copied, never batch sidecars or another upload's capability ids.
+ * O(b) I/O for b claimed bytes, bounded by the attachment store's batch limits. Partial copies
+ * are removed before rejection. The temporary directory is private and directly under real root.
+ */
+export declare function stageAttachmentClaim(required: {
+    claim: AttachmentClaim;
+    filesystemRoot: string;
+}, _optional?: {}): Promise<{
+    claim: AttachmentClaim;
+    cleanup: () => Promise<void>;
+}>;
 /** Why an attachment operation was refused. Maps to an HTTP status in `statusForRejection`. */
 export type AttachmentRejectionReason = 
 /** The batch id is missing or not of the accepted shape. */

package/dist/http/attachments.js

@@ -99,13 +99,39 @@
  * correlation-id-bearing generic `INTERNAL_ERROR`, with the real error reaching a host-owned sink —
  * the same `reportInternalError` shape `media.ts`/`delegated-tools.ts` use.
  */
-import { chmod, lstat, mkdir, open, readFile, readdir, realpath, rm, rmdir, writeFile } from 'node:fs/promises';
+import { chmod, copyFile, lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rm, rmdir, writeFile } from 'node:fs/promises';
 import { randomUUID } from 'node:crypto';
 import { basename, dirname, extname, resolve } from 'node:path';
 import { createApiError } from '@jini-ai/protocol';
 import { guardSameOrigin } from '@jini-ai/http-kit';
 import { sendApiError, sendJson } from '@jini-ai/http-kit';
 import { writeJsonFileAtomicAsync } from '@jini-ai/platform/fs';
+/** Copy an already authenticated claim into the host's filesystem boundary. Keep the original
+ * store records intact for promotion/read-back; the caller owns cleanup after the run ends.
+ * Only claimed files are copied, never batch sidecars or another upload's capability ids.
+ * O(b) I/O for b claimed bytes, bounded by the attachment store's batch limits. Partial copies
+ * are removed before rejection. The temporary directory is private and directly under real root.
+ */
+export async function stageAttachmentClaim(required, _optional = {}) {
+    const root = await realpath(required.filesystemRoot);
+    const directory = await mkdtemp(resolve(root, '.agent-attachments-'));
+    const cleanup = () => rm(directory, { recursive: true, force: true });
+    try {
+        await chmod(directory, 0o700);
+        const attachments = [];
+        for (const attachment of required.claim.attachments) {
+            const target = resolve(directory, basename(attachment.path));
+            await copyFile(attachment.path, target);
+            await chmod(target, 0o600);
+            attachments.push({ ...attachment, path: target });
+        }
+        return { claim: { attachments, batchDirectory: directory }, cleanup };
+    }
+    catch (error) {
+        await cleanup();
+        throw error;
+    }
+}
 /**
  * A refusal this module classified itself, as opposed to an unexpected filesystem/programming
  * error. The route pack turns the `reason` into a status code and lets the `message` through only

package/dist/http/delegated-tools.d.ts

@@ -1,3 +1,4 @@
+import type { DelegatedResultCorrelation } from '../delegated-result-correlation.js';
 import type { Express } from 'express';
 import { type Principal, type ToolRegistry } from '@jini-ai/core';
 import { type RunLifecycle, type ToolExecutionResult, type ToolExecutor } from '../index.js';
@@ -49,6 +50,8 @@ export interface DelegatedToolsInternalErrorContext {
     readonly status?: 'timed-out' | 'cancelled' | 'failed';
 }
 export interface DelegatedToolsHttpDeps {
+    /** The same negotiated digest store supplied to the run lifecycle and agent executor. */
+    readonly delegatedResultCorrelation?: DelegatedResultCorrelation;
     readonly lifecycle: RunLifecycle;
     readonly toolExecutor: ToolExecutor;
     /** Host-owned: resolves the `Principal` a given delegated-tool-call request executes as. Mandatory — see module doc; there is no safe default identity this package could assume on a host's behalf. */

package/dist/http/delegated-tools.js

@@ -36,7 +36,7 @@ function checkReadOnlyConstraint(deps, input) {
     if (input.requireReadOnly !== true)
         return null;
     const refusal = readOnlyTools.checkReadOnlyTool({
-        toolId: input.toolId, registry: deps.toolRegistry, messages: readOnlyTools.defaultDaemonMessages.readOnly,
+        toolId: input.toolId, input: input.input, registry: deps.toolRegistry, messages: readOnlyTools.defaultDaemonMessages.readOnly,
     });
     if (refusal === null)
         return null;
@@ -203,7 +203,7 @@ export const delegatedToolExecuteRoute = defineJsonRoute({
         const toolExecutor = input.requireReadOnly === true
             ? readOnlyTools.withReadOnlyToolConstraint({ inner: deps.toolExecutor, registry: deps.toolRegistry, messages: readOnlyTools.defaultDaemonMessages.readOnly, idGenerator: { newId: randomUUID } })
             : deps.toolExecutor;
-        const bridge = createDelegatedToolBridge({ lifecycle: deps.lifecycle, toolExecutor });
+        const bridge = createDelegatedToolBridge({ lifecycle: deps.lifecycle, toolExecutor }, deps);
         try {
             // `signal` carries the caller's HTTP connection dropping — see `mountJsonRoute`
             // (`adapter.ts`). The bridge already combines it with the run's own cancellation

package/dist/http/index.d.ts

@@ -1,4 +1,5 @@
 /** Daemon route packs; generic transport primitives live in @jini-ai/http-kit. */
+export { createMessageRelayClaimHandler, registerMessageRelayRoutes, type MessageRelayHttpDeps } from './message-relay.js';
 export type { ResolveWorkspaceRootOptions, WorkspaceRootRequest, WorkspaceRootResolver, } from './workspace-root.js';
 export { denyAllWorkspaceRoots, resolveWorkspaceRoot, WorkspaceRootDeniedError } from './workspace-root.js';
 export type { RunCancellationService } from './cancel-owned-runs.js';
@@ -45,7 +46,7 @@ export { createResearchSearchRoute, registerResearchRoutes, researchSearchRoute
 export type { MediaGenerateResponse, MediaHttpDeps, MediaInternalErrorContext, MediaTaskDeleteResponse, MediaTaskListResponse, MediaTaskResponse, } from './media.js';
 export { mediaGenerateRoute, mediaTaskDeleteRoute, mediaTaskGetRoute, mediaTaskListRoute, registerMediaRoutes, } from './media.js';
 export type { AttachmentClaim, AttachmentRejectionReason, AttachmentsHttpDeps, AttachmentsInternalErrorContext, AttachmentStore, AttachmentUploadResponse, CreateDiskAttachmentStoreOptions, ObservedAttachmentIdentity, PendingAttachmentSummary, RecordedAttachmentIdentity, StoredAttachment, } from './attachments.js';
-export { ATTACHMENTS_ROUTE_PATH, AttachmentRejectedError, createDiskAttachmentStore, detectAttachmentKind, handleAttachmentCleanup, handleAttachmentUpload, isUnchangedAttachment, registerAttachmentRoutes, sanitizeAttachmentName, writeBoundedAttachmentBody, } from './attachments.js';
+export { ATTACHMENTS_ROUTE_PATH, AttachmentRejectedError, createDiskAttachmentStore, detectAttachmentKind, handleAttachmentCleanup, handleAttachmentUpload, isUnchangedAttachment, registerAttachmentRoutes, sanitizeAttachmentName, stageAttachmentClaim, writeBoundedAttachmentBody, } from './attachments.js';
 export type { XaiAuthStatusResponse, XaiHttpDeps, XaiInternalErrorContext, XaiOauthStartResponse, XaiOkResponse, XaiSearchResponse, } from './xai.js';
 export { registerXaiRoutes, xaiAuthStatusRoute, xaiOauthCancelRoute, xaiOauthCompleteRoute, xaiOauthDisconnectRoute, xaiOauthStartRoute, xaiSearchRoute, } from './xai.js';
 export * from './run-credentials.js';

package/dist/http/index.js

@@ -1,3 +1,5 @@
+/** Daemon route packs; generic transport primitives live in @jini-ai/http-kit. */
+export { createMessageRelayClaimHandler, registerMessageRelayRoutes } from './message-relay.js';
 export { denyAllWorkspaceRoots, resolveWorkspaceRoot, WorkspaceRootDeniedError } from './workspace-root.js';
 export { cancelRunsOwnedBy } from './cancel-owned-runs.js';
 export { ACTIVE_CONTEXT_TTL_MS, getActiveRoute, registerActiveContextRoutes, setActiveRoute, } from './active-context.js';
@@ -21,7 +23,7 @@ export { apiHealthRoute, apiReadyRoute, apiVersionInfoRoute, healthRoute, readyR
 export { connectorsAuthSessionRoute, connectorsAuthSignInRoute, connectorsAuthSignOutRoute, connectorsAuthSignUpRoute, connectorsDbDeleteRoute, connectorsDbGetRoute, connectorsDbInsertRoute, connectorsDbQueryRoute, connectorsDbUpdateRoute, connectorsRealtimePublishRoute, connectorsStorageDeleteRoute, connectorsStorageGetRoute, connectorsStorageListRoute, connectorsStoragePutRoute, registerConnectorsRoutes, } from './connectors.js';
 export { createResearchSearchRoute, registerResearchRoutes, researchSearchRoute } from './research.js';
 export { mediaGenerateRoute, mediaTaskDeleteRoute, mediaTaskGetRoute, mediaTaskListRoute, registerMediaRoutes, } from './media.js';
-export { ATTACHMENTS_ROUTE_PATH, AttachmentRejectedError, createDiskAttachmentStore, detectAttachmentKind, handleAttachmentCleanup, handleAttachmentUpload, isUnchangedAttachment, registerAttachmentRoutes, sanitizeAttachmentName, writeBoundedAttachmentBody, } from './attachments.js';
+export { ATTACHMENTS_ROUTE_PATH, AttachmentRejectedError, createDiskAttachmentStore, detectAttachmentKind, handleAttachmentCleanup, handleAttachmentUpload, isUnchangedAttachment, registerAttachmentRoutes, sanitizeAttachmentName, stageAttachmentClaim, writeBoundedAttachmentBody, } from './attachments.js';
 export { registerXaiRoutes, xaiAuthStatusRoute, xaiOauthCancelRoute, xaiOauthCompleteRoute, xaiOauthDisconnectRoute, xaiOauthStartRoute, xaiSearchRoute, } from './xai.js';
 export * from './run-credentials.js';
 export { createTavilyResearchProvider } from './research-tavily.adapter.js';

package/dist/http/message-relay.d.ts

@@ -0,0 +1,21 @@
+import type { Express, RequestHandler } from 'express';
+import type { RunScopedCallerResolver } from '../run-credentials.js';
+import type { AgentExecutor } from '../agent-executor/contracts.js';
+export interface MessageRelayHttpDeps {
+    readonly agentExecutor: Pick<AgentExecutor, 'claimUserMessages'>;
+    /** The same live credential registry used to issue JINI_DAEMON_TOKEN at spawn.
+     * Explicit undefined opts into the host's existing unauthenticated loopback trust: any local
+     * process can claim messages. Authenticated hosts must supply their resolver, never proxy identity. */
+    readonly runScopedCallers: RunScopedCallerResolver | undefined;
+}
+/** Claim a FIFO prefix without I/O. A run credential determines scope; the URL only checks it.
+ * Body-supplied scope is refused. A proxy credential or another run's token cannot claim.
+ * @returns Express handler; errors go to the host's existing error boundary.
+ * @complexity O(claimed text bytes); no storage or network work outside the existing event FIFO.
+ */
+export declare function createMessageRelayClaimHandler({ agentExecutor, runScopedCallers }: MessageRelayHttpDeps, _options?: {}): RequestHandler;
+/** Mount behind the host's existing daemon gate; allow this POST for live run credentials there. */
+export declare function registerMessageRelayRoutes({ app, ...deps }: {
+    app: Express;
+} & MessageRelayHttpDeps, _options?: {}): void;
+//# sourceMappingURL=message-relay.d.ts.map

package/dist/http/message-relay.js

@@ -0,0 +1,44 @@
+import { bearerTokenFromHeader } from '@jini-ai/http-kit';
+/** Claim a FIFO prefix without I/O. A run credential determines scope; the URL only checks it.
+ * Body-supplied scope is refused. A proxy credential or another run's token cannot claim.
+ * @returns Express handler; errors go to the host's existing error boundary.
+ * @complexity O(claimed text bytes); no storage or network work outside the existing event FIFO.
+ */
+export function createMessageRelayClaimHandler({ agentExecutor, runScopedCallers }, _options = {}) {
+    return (req, res, next) => {
+        try {
+            const token = bearerTokenFromHeader({ header: req.get('authorization') });
+            const caller = token ? runScopedCallers?.resolveCaller({ token }) : undefined;
+            if (runScopedCallers && !caller) {
+                res.status(401).json({ error: { code: 'UNAUTHENTICATED', message: 'a live run credential is required' } });
+                return;
+            }
+            const runId = caller?.runId ?? req.params.runId;
+            if (!runId || runId !== req.params.runId) {
+                res.status(404).json({ error: { code: 'NOT_FOUND', message: 'run was not found' } });
+                return;
+            }
+            const body = req.body;
+            if (!validClaim(body)) {
+                res.status(400).json({ error: { code: 'BAD_REQUEST', message: 'body must contain only via: tool-result or check_messages' } });
+                return;
+            }
+            res.json({ messages: agentExecutor.claimUserMessages({ runId, via: body.via }) });
+        }
+        catch (error) {
+            next(error);
+        }
+    };
+}
+/** Strict receipt-channel validation; no caller-selected run or principal is accepted. */
+function validClaim(body) {
+    if (body === null || typeof body !== 'object' || Array.isArray(body))
+        return false;
+    const value = body;
+    return Object.keys(value).length === 1 && (value.via === 'tool-result' || value.via === 'check_messages');
+}
+/** Mount behind the host's existing daemon gate; allow this POST for live run credentials there. */
+export function registerMessageRelayRoutes({ app, ...deps }, _options = {}) {
+    app.post('/api/runs/:runId/messages/claim', createMessageRelayClaimHandler(deps));
+}
+//# sourceMappingURL=message-relay.js.map

package/dist/http/runs.d.ts

@@ -55,12 +55,15 @@ export interface RunCancelResponse {
     readonly run: RunStatus;
 }
 export interface RunMessageRequest {
+    /** Generated at intake and passed unchanged to the executor's queue/consumption events. */
+    readonly id?: string;
     readonly runId: string;
     readonly text: string;
     /** Opaque upload capabilities; the host must authorize and prepare every ref before delivery. */
     readonly attachmentIds?: readonly string[];
 }
 export interface RunMessageResponse {
+    readonly id: string;
     readonly delivery: 'delivered';
 }
 /** Ceiling on one mid-run message, matching what a person can reasonably type or paste into a composer. */
@@ -81,8 +84,8 @@ export declare const runCancelRoute: import("@jini-ai/http-kit").JsonRouteSpec<{
 /**
  * `POST /api/runs/:runId/messages` — a message the human sent while the run is going. `202` when it
  * reached the live agent; `409 CONFLICT` with `details.delivery` (`'unsupported'` or
- * `'not-running'`) when it did not, which tells the client whether to interrupt the run and send the
- * text as the next turn, or simply send it next because the run is already ending.
+ * `'not-running'`) when it did not, which tells the client to retain the next-turn queue without canceling live work.
+ * Acceptance is distinct from the UUID-attributed consumption receipt in the run stream.
  */
 export declare const runMessageRoute: import("@jini-ai/http-kit").JsonRouteSpec<RunMessageRequest, RunMessageResponse, RunHttpDeps, undefined>;
 /**