@robota-sdk/agent-session 3.0.0-beta.94 → 3.0.0-beta.96

package/CHANGELOG.md

@@ -1,5 +1,157 @@
 # @robota-sdk/agent-session
 
+## 3.0.0-beta.96
+### Patch Changes
+
+  - @robota-sdk/agent-core@3.0.0-beta.96
+  - @robota-sdk/agent-file-authority@3.0.0-beta.96
+  - @robota-sdk/agent-interface-execution@3.0.0-beta.96
+  - @robota-sdk/agent-interface-session@3.0.0-beta.96
+
+## 3.0.0-beta.95
+### Minor Changes
+
+- 04719a9: **A permission request names the tool call it is about.**
+
+  `IPermissionRequestEvent` gains an optional `executionId`: the same id the call's `tool_start` and
+  `tool_end` carry, so a surface can hold one row from the request to the call's end. The session's
+  permission path carries the call's id from the tool wrapper to the prompt (`IPermissionAskContext.executionId`)
+  and the framework's prompt registry stamps it on the event, so it reaches every client that receives
+  the event, the WebSocket and HTTP `permission_request` frames included. It is present whenever the
+  session reports that call (its own, or an in-process background agent's) and absent for a
+  child-process agent's forwarded request.
+
+  The ACP agent transport keys its permission rows by that id: the request's `toolCallId` is the
+  call's execution id, its start and end address the same row, a denial the session decides on its
+  own while the editor's dialog is open closes that one row, and two same-named calls each follow
+  their own row whatever order the editor answers in. A request that names no call gets a row that
+  closes with the answer, and is closed at the end of the turn if no answer came. The name-ordered
+  matching is gone.
+- 04a6de4: **Reasoning text a provider streams now reaches the editor as an ACP `agent_thought_chunk`, through a new `thinking_delta` session event.**
+
+  `IChatOptions.onThinkingDelta`, `IRunOptions.onThinkingDelta` and `IResumeExecutionOptions.onThinkingDelta`
+  (typed `TThinkingDeltaCallback`) carry reasoning text from a provider through the run, and the session
+  options (`ISessionOptions.onThinkingDelta`, `ICreateSessionOptions.onThinkingDelta`) hand it to the
+  session's owner. `InteractiveSession` emits it as `thinking_delta(delta)`, beside `text_delta`. The
+  text is never part of the reply: it is not appended to the conversation, not streamed through
+  `onTextDelta`, and the core adds no record of its own for it (no text-delta log entry, no
+  `provider_stream_raw_delta`); a provider's own native payload capture and response metadata keep
+  what the provider sent, as before. A reasoning delta counts as provider activity for the idle
+  timeout whether or not anyone listens to it, so a model that is only thinking is not cut off. The
+  existing `thinking(isThinking)` event is unchanged and remains the busy indicator. Where a provider
+  sends no reasoning text, nothing is emitted and nothing new is switched on.
+
+  `@robota-sdk/agent-interface-session` is a major change because a new session event name makes an
+  exhaustive map over the event names stop compiling until it classifies the event.
+
+  `@robota-sdk/agent-transport-acp` sends each non-empty `thinking_delta` to the editor as an
+  `agent_thought_chunk`, in order with the message chunks, so `robota acp` shows the model's reasoning
+  in the editor. A turn that streamed only thoughts still shows its result text, because only reply
+  text marks a turn as streamed. The WebSocket wire, the HTTP stream, headless stream-json, `query()`
+  and the terminal UI do not carry the new event in this change (`@robota-sdk/agent-transport` and
+  `@robota-sdk/agent-ui-terminal` classify it as non-surface). A forked skill and an in-process subagent
+  pass their reply text up but not their reasoning.
+
+  Two providers already receive reasoning text and now report it. `@robota-sdk/agent-provider-openai`
+  passes `response.reasoning_summary_text.delta` events of a streamed Responses call to
+  `onThinkingDelta`; the API sends them only when the provider profile asks for a reasoning summary, and
+  no request option changed; a summary streamed in several parts, and the summary of a later reasoning
+  item, each start on a new paragraph (`\n\n`) so the parts do not run together.
+  `@robota-sdk/agent-provider-openai-compatible` reports the text of Gemma's thought channel, which the
+  provider already removed from the reply, as it streams across chunk boundaries, with each later
+  channel of one reply on a new paragraph; the reply text is unchanged. No other provider reports
+  reasoning, and Anthropic thinking is not enabled. A model fallback chain still moves to the next model when only reasoning had streamed.
+
+  The scripted test provider (`@robota-sdk/agent-core/testing`) accepts an optional `thinking` string on
+  a turn and delivers it through `onThinkingDelta` before the turn's text; the scripted session harness
+  collects `thinking_delta` and now keeps a scripted tool-call turn's `usage`, which it used to drop.
+- 0ba247b: A tool result can now carry a view its source declared (an MCP app), and a surface can invoke a
+  runtime tool through the session's permission gate with a prompt. This is the contract and wiring
+  layer: nothing produces a view yet, and the GUI does not yet host one.
+
+  - `agent-core` — `IToolResult.view` carries an `IToolAppView` (source, `ui://` resource, mime type,
+    HTML, structured content, callable tools, the call's input). `view` is now a typed key of
+    `IToolResult`, so an extension that already used a `view` key with another type must rename it.
+    The view is display data: it never enters model context or the size that decides a spill, and a
+    result replaced by its reference keeps it.
+  - `agent-interface-session` — `invokeRuntimeTool` takes `permissionInteraction` (`'interactive'` or
+    the default `'deny'`), a `driverId` (a host that attributes prompts names it as the requester) and
+    an `executionId` its events carry. A finished model call's `tool_end` names its view with
+    `IToolState.appView` (`viewId`, source, resource), and the new
+    `ISessionToolAppViews.readToolAppView(viewId)` reads the document. A permission handler may take
+    `{ signal }`, and aborting it withdraws the prompt.
+  - `agent-session` — a direct call asks a person only when its caller says so, and the handler is
+    given the call's own signal; the tool end event carries the view, never in the logged result data.
+  - `agent-framework` — the view of a model's call is kept under a `viewId` the session mints, in a
+    bounded per-session store (16 views, 4 MiB each, 16 MiB in all, measured on the whole serialized
+    view), and read on demand, so the document never rides `tool_end` to every surface, never enters
+    the recorded history, and a repeated provider tool-call id cannot overwrite another turn's view.
+    A malformed view is dropped. A direct call keeps and names no view, recognised by the id it was
+    started with. A submission or agent wakeup that arrives while a direct call holds the session is
+    queued behind it, as during a turn, instead of refused. A direct call acting for a driver
+    attributes its permission prompt and tool events to that driver, and aborting its signal withdraws
+    an open prompt from every surface.
+  - `agent-transport` — a driving connection sends `call-app-tool` (answered by `app_tool_result`) and
+    `read-app-view` (answered by `app_view`). A call names its view and reaches only the tools that
+    view's source declared; a call or read that decodes but cannot be served answers `protocol_error`
+    echoing the `requestId`, while an observer's attempt is refused like any non-read. A call still
+    waiting on its prompt is cancelled when its connection goes away (for the resume bridge, when the
+    bridge is disposed). `maxFrameBytes` bounds an app answer to what a carrier's channel carries;
+    the WebRTC carrier uses a history page's worth. `IProtocolSession` now includes the runtime-tool
+    and app-view roles.
+  - `agent-ui-web` — the two new server messages are recorded as not rendered until the app-view host
+    consumes them.
+
+  An implementation of `IInteractiveSession` or `IProtocolSession` outside this repository must add
+  `readToolAppView` (and, for `IProtocolSession`, `listRuntimeTools` and `invokeRuntimeTool`); the
+  members are required so a host cannot silently lack them.
+
+### Patch Changes
+
+- 60f3965: **`robota mcp serve --ask-client` puts a caller's permission and ask prompts to the calling MCP client through elicitation instead of failing them.**
+
+  `@robota-sdk/agent-transport-mcp`: `createMcpTransport`, `createMcpHttpHost`,
+  `createMcpRemoteHttpHost` and `createAgentMcpServer` take `askClient`. Off by default, every prompt
+  is a tool error as before. On, and when the client declared form-mode elicitation, a permission or
+  ask prompt raised by that client's own call is put to it: a permission offers allow once or deny
+  only, never a remembered grant; an ask becomes a form (choice, multiple choice, free text); a masked
+  ask is never sent; deny, decline, cancel, a client error or an answer naming nothing offered keeps
+  today's outcome. stdio asks during the call. The HTTP hosts keep no session state, so they ask only
+  a client on the 2026-07-28 revision, through input-required rounds whose `requestState` is a
+  single-use random token naming one parked call; a 2025-era HTTP client keeps the tool error.
+  A call listens for prompts only while its own work drives the session, so a submission waiting
+  in the queue never holds another caller's prompt that it cannot answer.
+  Breaking for hand-written sessions: `IMcpTransportSession` now also requires `ISessionEvents`
+  (`on`/`off`), `ISessionPromptResolution` (`resolvePermission`/`resolveAsk`) and
+  `ISessionDriverAttribution` (`getActiveDriverId`), which `InteractiveSession` and the published
+  test double already implement.
+
+  `@robota-sdk/agent-interface-session` / `@robota-sdk/agent-session` / `@robota-sdk/agent-framework`:
+  `ISessionRuntimeTools.invokeRuntimeTool` (and `Session.invokeRuntimeTool`) accept
+  `options.permissionInteraction` and `options.driverId`. A direct call still denies a decision that
+  would need a person, and finds no one to ask a question, unless its caller passes
+  `permissionInteraction: 'interactive'`; then it asks the session's permission handler and its
+  tools get the session's ask port. `InteractiveSession` makes `driverId` the active driver while
+  the direct call runs, so a prompt the call raises carries it as `requesterDriverId`. With
+  `askClient` on, an MCP call runs under its own `mcp:<n>` driver id; a submission made that way is
+  attributed to it rather than to the owner.
+
+  `@robota-sdk/agent-transport`: exports `permissionSummaryArgument`, the argument a person recognises
+  a tool call by (`filePath` for the built-in file tools), for every transport that puts a permission
+  request to a person in its own wire form.
+
+  `@robota-sdk/agent-cli`: `mcp serve --ask-client` turns this on for whichever carrier the run serves.
+- Updated dependencies [60f3965]
+- Updated dependencies [115e104]
+- Updated dependencies [04719a9]
+- Updated dependencies [04a6de4]
+- Updated dependencies [0ba247b]
+- Updated dependencies [02053ec]
+  - @robota-sdk/agent-interface-session@3.0.0-beta.95
+  - @robota-sdk/agent-core@3.0.0-beta.95
+  - @robota-sdk/agent-interface-execution@3.0.0-beta.95
+  - @robota-sdk/agent-file-authority@3.0.0-beta.95
+
 ## 3.0.0-beta.94
 ### Patch Changes