letagents 0.12.12 → 0.12.13

package/dist/mcp/server/runtime/agent-sessions.js

@@ -1,4 +1,4 @@
-import { getStoredAgentSession, isLocalRoomStorageEnabled, saveAgentSession, } from "../../local-state.js";
+import { getStoredAgentSession, isLocalRoomStorageEnabled, replaceLocalWorkerAgentSession, saveAgentSession, } from "../../local-state.js";
 import { getGitCurrentBranch } from "../../git-remote.js";
 import { randomUUID } from "node:crypto";
 import { normalizeAgentBaseName } from "../../../shared/codenames.js";
@@ -7,6 +7,7 @@ import { LETAGENTS_AGENT_SESSION_ID_HEADER, LETAGENTS_AGENT_SESSION_TOKEN_HEADER
 import { AGENT_INSTANCE_UUID, detectAgentIdeLabel, detectAgentRuntimeLabel, ensureAgentIdentity, } from "./identity.js";
 import { isSupervisedBoundedTurn, requireValidWorkerBearerRuntime } from "./worker-bearer.js";
 import { resolveCurrentSupervisedWorkerSession } from "./supervisor-bridge.js";
+import { getDaemonToolExecutionContext, getRuntimeWorkingDirectory } from "./daemon-tool-context.js";
 // A worker bearer already represents a server-side worker session. This local
 // marker lets the MCP tool contract stay session-shaped without persisting or
 // transmitting a second set of credentials.
@@ -119,7 +120,12 @@ export function requireWorkerAgentSession(roomId, sessionId) {
 export async function resolveWorkerToolIdentity(input) {
     const runtimeMode = requireValidWorkerBearerRuntime().mode;
     if (runtimeMode === "supervised") {
-        const agentSession = await resolveCurrentSupervisedWorkerSession(input.roomId);
+        const daemonContext = getDaemonToolExecutionContext();
+        const agentSession = daemonContext?.agentSession
+            ?? await resolveCurrentSupervisedWorkerSession(input.roomId);
+        if (input.roomId && input.roomId !== agentSession.room_id) {
+            throw new Error(`Daemon-supervised worker session is registered for ${agentSession.room_id}, not ${input.roomId}.`);
+        }
         if (input.agentSessionId
             && input.agentSessionId !== WORKER_BEARER_AGENT_SESSION_ID
             && input.agentSessionId !== agentSession.session_id) {
@@ -173,7 +179,7 @@ export async function ensureLocalWorkerAgentSession(roomId, input = {}) {
     const now = new Date().toISOString();
     const runtime = input.runtime?.trim() || detectAgentRuntimeLabel();
     const displayName = input.displayName?.trim() || identity.display_name;
-    return saveAgentSession({
+    const session = {
         session_id: `local_${randomUUID()}`,
         session_token: `local_${randomUUID()}`,
         room_id: roomId,
@@ -195,10 +201,13 @@ export async function ensureLocalWorkerAgentSession(roomId, input = {}) {
         updated_at: now,
         last_seen_at: now,
         ended_at: null,
-    });
+    };
+    return session.session_kind === "worker"
+        ? replaceLocalWorkerAgentSession(session)
+        : saveAgentSession(session);
 }
 export function getAgentSessionRepoBranch(cwd) {
-    const workingDir = cwd?.trim() || process.cwd();
+    const workingDir = cwd?.trim() || getRuntimeWorkingDirectory();
     return getGitCurrentBranch(workingDir);
 }
 export function agentSessionCredentials(agentSession) {

package/dist/mcp/server/runtime/api.js

@@ -1,4 +1,5 @@
 import { clearAuthenticatedAccountCache } from "./auth-cache.js";
+import { getDaemonToolExecutionContext } from "./daemon-tool-context.js";
 import { requireValidWorkerBearerRuntime } from "./worker-bearer.js";
 import { borrowCurrentSupervisedWorkerCredential, } from "./supervisor-bridge.js";
 let ownerAuthStoreLoader = () => import("../../local-state.js");
@@ -20,12 +21,18 @@ export class SupervisedWorkerCredentialError extends Error {
     }
 }
 async function getSupervisedCredential() {
+    const daemonContext = getDaemonToolExecutionContext();
+    if (daemonContext)
+        return daemonContext.bearer;
     const result = await supervisedCredentialBorrower();
     if (result.state === "available")
         return result.credential;
     throw new SupervisedWorkerCredentialError(result.state === "deferred" ? "SUPERVISED_CREDENTIAL_UNAVAILABLE" : "SUPERVISED_CREDENTIAL_STALE");
 }
 export const API_URL = (process.env.LETAGENTS_API_URL || "http://localhost:3001").replace(/\/+$/, "");
+export function getApiUrl() {
+    return getDaemonToolExecutionContext()?.apiUrl.replace(/\/+$/, "") ?? API_URL;
+}
 export class ApiError extends Error {
     status;
     body;
@@ -76,8 +83,9 @@ export function resolveApiPath(urlOrPath) {
         return "/auth/device/start";
     }
     try {
-        const parsed = new URL(urlOrPath, `${API_URL}/`);
-        const apiBase = new URL(`${API_URL}/`);
+        const apiUrl = getApiUrl();
+        const parsed = new URL(urlOrPath, `${apiUrl}/`);
+        const apiBase = new URL(`${apiUrl}/`);
         if (parsed.origin !== apiBase.origin) {
             return "/auth/device/start";
         }
@@ -109,7 +117,7 @@ export async function apiCall(path, options) {
             headers.set("Authorization", authorizationHeader);
         }
     }
-    const res = await fetch(`${API_URL}${path}`, {
+    const res = await fetch(`${getApiUrl()}${path}`, {
         ...options,
         headers,
     });

package/dist/mcp/server/runtime/daemon-tool-context.js

@@ -0,0 +1,11 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+const daemonToolContext = new AsyncLocalStorage();
+export function getDaemonToolExecutionContext() {
+    return daemonToolContext.getStore() ?? null;
+}
+export function runWithDaemonToolExecutionContext(context, callback) {
+    return daemonToolContext.run(context, callback);
+}
+export function getRuntimeWorkingDirectory() {
+    return getDaemonToolExecutionContext()?.cwd ?? process.cwd();
+}

package/dist/mcp/server/runtime/messages.js

@@ -151,6 +151,61 @@ export function toAgentReadableMessages(messages, contextMessages = []) {
     const summaries = buildThreadSummaries(records, recordsById);
     return (messages ?? []).map((message) => toAgentReadableMessage(message, recordsById, summaries));
 }
+export const AGENT_MESSAGE_OUTPUT_MAX_BYTES = 4 * 1024 * 1024;
+export const AGENT_MESSAGE_BODY_MAX_BYTES = AGENT_MESSAGE_OUTPUT_MAX_BYTES / 2;
+function jsonUtf8Bytes(value) {
+    const serialized = JSON.stringify(value);
+    return Buffer.byteLength(serialized === undefined ? "null" : serialized, "utf8");
+}
+function compactOversizedAgentMessage(message) {
+    if (!isRecord(message)) {
+        return { content_truncated: true, value_type: typeof message };
+    }
+    const text = typeof message.text === "string" ? message.text : "";
+    return {
+        ...(typeof message.id === "string" ? { id: message.id } : {}),
+        ...(typeof message.sender === "string" ? { sender: message.sender } : {}),
+        ...(typeof message.source === "string" ? { source: message.source } : {}),
+        ...(typeof message.timestamp === "string" ? { timestamp: message.timestamp } : {}),
+        ...(typeof message.thread_root_id === "string"
+            ? { thread_root_id: message.thread_root_id }
+            : {}),
+        ...(typeof message.thread_reply_to_id === "string"
+            ? { thread_reply_to_id: message.thread_reply_to_id }
+            : {}),
+        text: text.slice(0, 16 * 1024),
+        content_truncated: true,
+        original_utf8_bytes: jsonUtf8Bytes(message),
+    };
+}
+export function boundAgentMessageOutput(messages, options = {}) {
+    const direction = options.direction ?? "prefix";
+    const maxBytes = Math.max(1024, Math.floor(options.maxBytes ?? AGENT_MESSAGE_OUTPUT_MAX_BYTES));
+    const ordered = direction === "suffix" ? [...messages].reverse() : [...messages];
+    const selected = [];
+    let outputBytes = 2; // JSON array brackets.
+    for (const message of ordered) {
+        let candidate = message;
+        let candidateBytes = jsonUtf8Bytes(candidate);
+        if (candidateBytes + 2 > maxBytes) {
+            candidate = compactOversizedAgentMessage(candidate);
+            candidateBytes = jsonUtf8Bytes(candidate);
+        }
+        const separatorBytes = selected.length > 0 ? 1 : 0;
+        if (outputBytes + separatorBytes + candidateBytes > maxBytes)
+            break;
+        selected.push(candidate);
+        outputBytes += separatorBytes + candidateBytes;
+    }
+    if (direction === "suffix")
+        selected.reverse();
+    return {
+        messages: selected,
+        truncated: selected.length < messages.length,
+        omittedMessageCount: messages.length - selected.length,
+        outputBytes,
+    };
+}
 export function appendIncludePromptOnly(path) {
     return `${path}${path.includes("?") ? "&" : "?"}include_prompt_only=1`;
 }

package/dist/mcp/server/runtime/room-state.js

@@ -1,7 +1,7 @@
 import { SseClient } from "../../sse-client.js";
 import { getStoredAgentIdentity, saveRoomSession, touchRoomSession, } from "../../local-state.js";
 import { getCanonicalRoomWebPath, } from "../../room-id.js";
-import { API_URL, getLetagentsToken } from "./api.js";
+import { getApiUrl, getLetagentsToken } from "./api.js";
 import { AGENT_INSTANCE_UUID, currentAgentIdentity, currentAgentIdentityKey, } from "./identity.js";
 import { isSupervisedBoundedTurn } from "./worker-bearer.js";
 import { getCurrentSupervisedRoomAuthority, runWithSupervisedRoomAuthority, } from "./supervised-room-authority.js";
@@ -15,7 +15,7 @@ export function shutdownRuntime() {
     sseClient?.unsubscribeAll();
 }
 function getSseClient() {
-    sseClient ??= new SseClient(API_URL, () => getLetagentsToken());
+    sseClient ??= new SseClient(getApiUrl(), () => getLetagentsToken());
     return sseClient;
 }
 function getCurrentStreamAgentIdentity() {
@@ -32,6 +32,7 @@ function getCurrentStreamAgentIdentity() {
 export function toRoomState(input) {
     return {
         room_id: input.room_id,
+        navigation_locator: input.navigation_locator ?? null,
         project_id: input.project_id ?? null,
         code: input.code ?? null,
         display_name: input.display_name ?? null,
@@ -40,8 +41,12 @@ export function toRoomState(input) {
         is_local: input.is_local ?? false,
     };
 }
+export function currentRoomMatchesLocator(locator) {
+    const value = locator?.trim();
+    return Boolean(value && currentRoom && (currentRoom.room_id === value || currentRoom.navigation_locator === value));
+}
 function getCanonicalRoomWebUrl(roomId) {
-    return new URL(getCanonicalRoomWebPath(roomId), `${API_URL}/`).toString();
+    return new URL(getCanonicalRoomWebPath(roomId), `${getApiUrl()}/`).toString();
 }
 export function withCanonicalRoomLink(roomId, payload) {
     return {
@@ -109,6 +114,11 @@ export function rememberRoom(state, lastMessageId) {
     }, (_message) => {
         touchRoomSession(state.room_id);
         mcpServer?.server.sendResourceListChanged();
+    }, () => {
+        // The SSE cursor crossed a broker/bridge loss boundary. MCP resources
+        // are pull-based, so invalidating the list is the full-state repair.
+        touchRoomSession(state.room_id);
+        mcpServer?.server.sendResourceListChanged();
     });
     return state;
 }

package/dist/mcp/server/runtime/rooms.js

@@ -20,7 +20,7 @@ function isNotFoundApiError(error) {
     return error instanceof ApiError && error.status === 404;
 }
 function parseGeneratedGitRefRoomIdentifier(identifier) {
-    const match = /^git-room:github\.com:([^/:\s]+\/[^/:\s]+):(branch|tag):[A-Za-z0-9_-]+$/.exec(identifier.trim());
+    const match = /^github\.com\/([^/\s]+\/[^/\s]+)\/focus\/git:(branch|tag):[A-Za-z0-9_-]+$/.exec(identifier.trim());
     if (!match) {
         return null;
     }
@@ -67,6 +67,7 @@ export async function joinRoomIdentifier(identifier, joinedVia, options = {}) {
         const agentIdentity = await ensureAgentIdentity();
         const room = rememberRoom(toRoomState({
             room_id: joinedRoomId,
+            navigation_locator: joinedRoomId === roomId ? null : roomId,
             project_id: typeof response.project_id === "string" ? response.project_id : null,
             code: typeof response.code === "string"
                 ? response.code
@@ -260,7 +261,27 @@ export async function joinNamedRoom(name, sessionMode) {
         session_mode: sessionMode,
     });
 }
-function bindWorkerRoomFromContext() {
+async function bindWorkerRoomLocator(roomLocator, source) {
+    const response = await apiCall(`/rooms/resolve/${encodeURIComponent(roomLocator)}`);
+    if (response.room_exists !== true) {
+        throw new ApiError(404, JSON.stringify({ error: "Room not found", code: "ROOM_NOT_FOUND" }));
+    }
+    const roomId = typeof response.canonical_room_id === "string"
+        ? response.canonical_room_id
+        : roomLocator;
+    return {
+        room: rememberRoom(toRoomState({
+            room_id: roomId,
+            navigation_locator: roomId === roomLocator ? null : roomLocator,
+            project_id: roomId,
+            display_name: roomId,
+            git_room: response.git_room ?? null,
+            joined_via: source === ".letagents.json" ? "config" : "git-remote",
+        })),
+        source,
+    };
+}
+async function bindWorkerRoomFromContext() {
     const configRoom = getRoomFromConfig();
     if (configRoom) {
         const gitContext = buildActiveGitRoomContext({
@@ -268,26 +289,26 @@ function bindWorkerRoomFromContext() {
             currentBranch: getGitCurrentBranch(),
             defaultBranch: getGitDefaultBranch(),
         });
-        const roomId = gitContext.activeRoom ?? configRoom;
-        return {
-            room: rememberRoom(toRoomState({
-                room_id: roomId,
-                display_name: roomId,
-                joined_via: "config",
-            })),
-            source: ".letagents.json",
-        };
+        const roomId = gitContext.activeRoomLocator ?? configRoom;
+        try {
+            return await bindWorkerRoomLocator(roomId, ".letagents.json");
+        }
+        catch (error) {
+            if (roomId === configRoom || !isNotFoundApiError(error))
+                throw error;
+            return bindWorkerRoomLocator(configRoom, ".letagents.json");
+        }
     }
     const gitContext = getGitRoomContext();
-    if (gitContext.activeRoom) {
-        return {
-            room: rememberRoom(toRoomState({
-                room_id: gitContext.activeRoom,
-                display_name: gitContext.activeRoom,
-                joined_via: "git-remote",
-            })),
-            source: "git remote",
-        };
+    if (gitContext.activeRoomLocator) {
+        try {
+            return await bindWorkerRoomLocator(gitContext.activeRoomLocator, "git remote");
+        }
+        catch (error) {
+            if (!gitContext.repoRoom || !isNotFoundApiError(error))
+                throw error;
+            return bindWorkerRoomLocator(gitContext.repoRoom, "git remote");
+        }
     }
     const savedCurrentRoom = getStoredCurrentRoom();
     if (!savedCurrentRoom) {
@@ -316,9 +337,9 @@ export async function autoJoinFromContext() {
             return;
         }
         if (workerRuntime.mode === "worker") {
-            const bound = bindWorkerRoomFromContext();
+            const bound = await bindWorkerRoomFromContext();
             if (bound) {
-                console.error(`🏠 Bound worker bearer to room '${bound.room.room_id}' (from ${bound.source}; no join/create request).`);
+                console.error(`🏠 Bound worker bearer to existing room '${bound.room.room_id}' (from ${bound.source}).`);
             }
             else {
                 console.error("ℹ️ Worker bearer has no .letagents.json, git remote, or saved room to bind locally.");
@@ -332,17 +353,17 @@ export async function autoJoinFromContext() {
                 currentBranch: getGitCurrentBranch(),
                 defaultBranch: getGitDefaultBranch(),
             });
-            if (gitContext.activeRefRoom && gitContext.currentBranch) {
-                const joinedBranchRoom = await joinExistingRoomIdentifier(gitContext.activeRefRoom, "config");
+            if (gitContext.activeRefRoomLocator && gitContext.currentBranch) {
+                const joinedBranchRoom = await joinExistingRoomIdentifier(gitContext.activeRefRoomLocator, "config");
                 if (joinedBranchRoom) {
                     await ensureAgentIdentity();
-                    console.error(`🏠 Auto-joined existing branch room '${gitContext.activeRefRoom}' (from .letagents.json + branch '${gitContext.currentBranch}')`);
+                    console.error(`🏠 Auto-joined existing branch room '${gitContext.activeRefRoomLocator}' (from .letagents.json + branch '${gitContext.currentBranch}')`);
                     return;
                 }
             }
             await joinRoomIdentifier(configRoom, "config");
             await ensureAgentIdentity();
-            const branchNote = gitContext.activeRefRoom && gitContext.currentBranch
+            const branchNote = gitContext.activeRefRoomLocator && gitContext.currentBranch
                 ? `; branch '${gitContext.currentBranch}' has no existing Git Room`
                 : "";
             console.error(`🏠 Auto-joined room '${configRoom}' (from .letagents.json${branchNote})`);
@@ -350,17 +371,17 @@ export async function autoJoinFromContext() {
         }
         const gitContext = getGitRoomContext();
         if (gitContext.repoRoom) {
-            if (gitContext.activeRefRoom && gitContext.currentBranch) {
-                const joinedBranchRoom = await joinExistingRoomIdentifier(gitContext.activeRefRoom, "git-remote");
+            if (gitContext.activeRefRoomLocator && gitContext.currentBranch) {
+                const joinedBranchRoom = await joinExistingRoomIdentifier(gitContext.activeRefRoomLocator, "git-remote");
                 if (joinedBranchRoom) {
                     await ensureAgentIdentity();
-                    console.error(`🏠 Auto-joined existing branch room '${gitContext.activeRefRoom}' (inferred from git remote and branch '${gitContext.currentBranch}' — consider adding a .letagents.json)`);
+                    console.error(`🏠 Auto-joined existing branch room '${gitContext.activeRefRoomLocator}' (inferred from git remote and branch '${gitContext.currentBranch}' — consider adding a .letagents.json)`);
                     return;
                 }
             }
             await joinRoomIdentifier(gitContext.repoRoom, "git-remote");
             await ensureAgentIdentity();
-            const branchNote = gitContext.activeRefRoom && gitContext.currentBranch
+            const branchNote = gitContext.activeRefRoomLocator && gitContext.currentBranch
                 ? `; branch '${gitContext.currentBranch}' has no existing Git Room`
                 : "";
             console.error(`🏠 Auto-joined room '${gitContext.repoRoom}' (inferred from git remote${branchNote} — consider adding a .letagents.json)`);

package/dist/mcp/server/runtime/supervisor-bridge.js

@@ -3,6 +3,7 @@ import { lstat, readFile, realpath } from "node:fs/promises";
 import { createConnection } from "node:net";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { parsePositivePgIntegerScopedId } from "../../../../shared/message-contracts.mjs";
 import { getCurrentSupervisedRoomAuthority } from "./supervised-room-authority.js";
 const NEGOTIATION_PROTOCOL_VERSION = 1;
 const SUPPORTED_SUPERVISOR_PROTOCOL_VERSIONS = new Set([1, 2]);
@@ -18,6 +19,42 @@ const pendingCursorCheckpoints = new Map();
 const activeCursorCheckpointDrains = new Set();
 const cursorCheckpointRetryTimers = new Map();
 const CURSOR_CHECKPOINT_RETRY_DELAYS_MS = [250, 1_000, 3_000];
+export async function executeCurrentSupervisedTool(input, env = process.env, options = {}) {
+    const coordinates = await requireCurrentSupervisedCoordinates(env, options);
+    const timeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+    const negotiated = await negotiateSupervisor(coordinates.socketPath, timeoutMs);
+    if (negotiated.generation === null)
+        throw new Error("The supervised daemon generation is unavailable.");
+    const response = await supervisorRequest(coordinates.socketPath, {
+        version: negotiated.protocolVersion,
+        id: randomUUID(),
+        method: "supervisor.execute_bounded_tool",
+        params: {
+            entry_id: coordinates.entryId,
+            work_attempt_id: coordinates.workAttemptId,
+            execution_generation_id: coordinates.executionGenerationId,
+            ...(coordinates.providerTurnId ? { provider_turn_id: coordinates.providerTurnId } : {}),
+            daemon_generation: negotiated.generation,
+            mcp_request_id: input.mcpRequestId,
+            tool_name: input.toolName,
+            input: input.input,
+        },
+    }, null);
+    if (!response.ok) {
+        if (/Unsupported daemon method:\s*supervisor\.execute_bounded_tool/i.test(response.error ?? "")) {
+            return { state: "unsupported" };
+        }
+        throw new Error(response.error || "The daemon-owned supervised tool was rejected.");
+    }
+    const result = response.result && typeof response.result === "object"
+        ? response.result
+        : {};
+    const roomId = typeof result.room_id === "string" ? result.room_id.trim() : "";
+    if (!roomId || roomId.length > 1_024 || /[\u0000-\u001f\u007f]/.test(roomId)) {
+        throw new Error("The supervised daemon did not return valid exact room authority.");
+    }
+    return { state: "completed", roomId, result: result.result };
+}
 export async function prepareCurrentSupervisedEffect(input, env = process.env, options = {}) {
     const coordinates = await requireCurrentSupervisedCoordinates(env, options);
     const timeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
@@ -412,6 +449,8 @@ export function scheduleSupervisedWorkerCursorCheckpoint(session, roomCursor, en
     });
 }
 async function enqueueSupervisedWorkerCursorCheckpoint(session, roomCursor, env, options) {
+    if (parseRoomMessageNumber(roomCursor) === null)
+        return;
     const coordinates = await resolveSupervisorCoordinates(session, env, options);
     if (!coordinates)
         return;
@@ -509,13 +548,14 @@ function isNewerRoomCursor(candidate, current) {
         return false;
     const candidateNumber = parseRoomMessageNumber(candidate);
     const currentNumber = parseRoomMessageNumber(current);
-    if (candidateNumber !== null && currentNumber !== null)
-        return candidateNumber > currentNumber;
-    return true;
+    if (candidateNumber === null)
+        return false;
+    if (currentNumber === null)
+        return true;
+    return candidateNumber > currentNumber;
 }
 function parseRoomMessageNumber(cursor) {
-    const match = /^msg_(\d+)$/.exec(cursor.trim());
-    return match ? BigInt(match[1]) : null;
+    return parsePositivePgIntegerScopedId(cursor, "msg");
 }
 /** Transport failures are retryable bookkeeping failures, not worker failures. */
 export function isRetryableSupervisorBridgeError(error) {
@@ -695,16 +735,17 @@ function supervisorRequest(socketPath, request, timeoutMs) {
         const socket = createConnection(socketPath);
         let buffer = "";
         let finished = false;
-        const timer = setTimeout(() => {
+        const timer = timeoutMs === null ? null : setTimeout(() => {
             socket.destroy();
             finish(() => reject(new Error("Timed out communicating with the supervisor daemon.")));
         }, timeoutMs);
-        timer.unref();
+        timer?.unref();
         const finish = (operation) => {
             if (finished)
                 return;
             finished = true;
-            clearTimeout(timer);
+            if (timer)
+                clearTimeout(timer);
             operation();
         };
         socket.setEncoding("utf8");

package/dist/mcp/server/runtime/worker-bearer.js

@@ -1,3 +1,4 @@
+import { getDaemonToolExecutionContext } from "./daemon-tool-context.js";
 export const LETAGENTS_AGENT_SESSION_BEARER_ENV = "LETAGENTS_AGENT_SESSION_BEARER";
 export const LETAGENTS_SUPERVISED_BOUNDED_TURNS_ENV = "LETAGENTS_SUPERVISED_BOUNDED_TURNS";
 export class WorkerBearerRuntimeConfigurationError extends Error {
@@ -7,6 +8,8 @@ export class WorkerBearerRuntimeConfigurationError extends Error {
     }
 }
 export function getWorkerBearerRuntime() {
+    if (getDaemonToolExecutionContext())
+        return { mode: "supervised" };
     const bearer = process.env.LETAGENTS_AGENT_SESSION_BEARER?.trim();
     const supervised = process.env.LETAGENTS_SUPERVISED_BOUNDED_TURNS?.trim() === "1";
     const profile = process.env.LETAGENTS_EXECUTION_PROFILE?.trim();
@@ -90,7 +93,8 @@ export function workerModeDisabledToolResult(toolDescription = "This owner-auth
  * asks it to do so.
  */
 export function supervisedBoundedDeliveryDisabledToolResult(toolName = "wait_for_messages") {
-    if (process.env.LETAGENTS_SUPERVISED_BOUNDED_TURNS?.trim() !== "1") {
+    if (!getDaemonToolExecutionContext()
+        && process.env.LETAGENTS_SUPERVISED_BOUNDED_TURNS?.trim() !== "1") {
         return null;
     }
     return {

package/dist/mcp/server/runtime.js

@@ -16,10 +16,10 @@ export { clearAuthenticatedAccountCache, getAuthenticatedAccountCache, setAuthen
 export { RepoRoomAuthRequiredError, maybeHandleRepoRoomAuthRequired, startPendingDeviceAuth, toRepoRoomAuthRequiredResult, } from "./runtime/device-auth.js";
 export { AGENT_INSTANCE_UUID, currentAgentIdentity, currentAgentIdentityKey, detectAgentIdeLabel, detectAgentRuntimeLabel, ensureAgentIdentity, getConversationIdentity, getSessionLivenessRegistration, resolveOwnerContext, setConversationIdentity, storeCurrentAgentIdentity, toPublicAgentIdentity, withAgentIdentity, } from "./runtime/identity.js";
 export { agentSessionCredentials, buildAgentDeliveryHeaders, ensureLocalWorkerAgentSession, getAgentSessionRepoBranch, identityFromAgentSession, requireWorkerAgentSession, resolveAgentSession, resolveClientRequestedBase, resolveWorkerToolIdentity, toPublicAgentSession, WORKER_BEARER_AGENT_SESSION_ID, } from "./runtime/agent-sessions.js";
-export { appendIncludePromptOnly, getLastMessageId, normalizeOptionalToolString, toAgentReadableMessages, withJoinRoomAgentPrompt, } from "./runtime/messages.js";
-export { currentRoom, attachMcpServer, getCurrentSupervisedRoomAuthority, getFallbackProjectId, getTargetRoomId, rememberRoom, runWithCurrentSupervisedRoom, shutdownRuntime, toPublicRoomResponse, toPublicCurrentRoomState, toPublicRoomState, toPublicStoredRoomSession, toRoomState, touchCurrentRoom, withCanonicalRoomLink, } from "./runtime/room-state.js";
+export { appendIncludePromptOnly, AGENT_MESSAGE_BODY_MAX_BYTES, AGENT_MESSAGE_OUTPUT_MAX_BYTES, boundAgentMessageOutput, getLastMessageId, normalizeOptionalToolString, toAgentReadableMessages, withJoinRoomAgentPrompt, } from "./runtime/messages.js";
+export { currentRoom, currentRoomMatchesLocator, attachMcpServer, getCurrentSupervisedRoomAuthority, getFallbackProjectId, getTargetRoomId, rememberRoom, runWithCurrentSupervisedRoom, shutdownRuntime, toPublicRoomResponse, toPublicCurrentRoomState, toPublicRoomState, toPublicStoredRoomSession, toRoomState, touchCurrentRoom, withCanonicalRoomLink, } from "./runtime/room-state.js";
 export { getRememberedRoomPresence, heartbeatRoomPresence, syncRoomPresence, } from "./runtime/presence.js";
 export { roomScopedApiCall } from "./runtime/room-api.js";
 export { borrowSupervisedWorkerCredential, borrowCurrentSupervisedWorkerCredential, bindSupervisedWorkerSession, checkpointSupervisedWorkerCursor, isRetryableSupervisorBridgeError, scheduleSupervisedWorkerCursorCheckpoint, resolveCurrentSupervisedWorkerSession, } from "./runtime/supervisor-bridge.js";
 export { autoJoinFromContext, buildJoinResponse, createInviteRoom, getCurrentLiveSessionPayload, joinInviteCode, joinNamedRoom, joinRoomIdentifier, joinRoomIdentifierWithoutImplicitGitRefCreate, normalizeJoinSessionMode, } from "./runtime/rooms.js";
-export { clearPendingDeviceAuth, clearStoredAuth, clearStoredAuth as clearStoredAuthorization, endStoredAgentSession, getCurrentAgentSession, getLocalStatePath, getPendingDeviceAuth, getStoredAgentIdentity, getStoredAgentSession, getStoredAgentSessionsForRoomIdentity, getStoredAuth, getStoredCurrentRoom, getStoredRoomSession, listStoredCodexLiveSessions, saveAgentSession, setPendingDeviceAuth, setStoredAuth, setStoredAgentIdentity, addLocalChatMessage, addLocalTask, claimLocalTaskReviewLease, getLatestLocalChatMessages, getLocalChatMessages, getLocalTask, listLocalTasks, isLocalChatStorageEnabled, resolveLocalRoomStorageIdentifiers, releaseLocalTaskReviewLease, updateLocalTask, waitForLocalChatMessages, } from "../local-state.js";
+export { clearPendingDeviceAuth, clearStoredAuth, clearStoredAuth as clearStoredAuthorization, endStoredAgentSession, getCurrentAgentSession, getLocalStatePath, getPendingDeviceAuth, getStoredAgentIdentity, getStoredAgentSession, getCurrentAgentSessionSnapshot, getStoredAgentSessionsForRoomIdentity, getStoredActiveAgentSessionsForRoom, getStoredAgentRoutingStateSnapshot, getStoredAuth, getStoredCurrentRoom, getStoredRoomSession, listStoredCodexLiveSessions, saveAgentSession, setPendingDeviceAuth, setStoredAuth, setStoredAgentIdentity, addLocalChatMessage, addLocalTask, claimLocalTaskReviewLease, getLatestLocalChatMessages, getLocalImportedRoutingAuthority, getLocalChatMessages, getLocalChatThreadRoutingMembership, getLocalTask, listLocalActiveTaskOwnerLeases, listLocalTasks, isLocalChatStorageEnabled, resolveLocalRoomStorageIdentifiers, releaseLocalTaskReviewLease, updateLocalTask, waitForLocalChatMessages, } from "../local-state.js";

package/dist/mcp/server/supervised-tool-facade.js

@@ -1,5 +1,5 @@
 import { runWithCurrentSupervisedRoom } from "./runtime/room-state.js";
-import { completeCurrentSupervisedEffect, prepareCurrentSupervisedEffect, } from "./runtime/supervisor-bridge.js";
+import { completeCurrentSupervisedEffect, executeCurrentSupervisedTool, prepareCurrentSupervisedEffect, } from "./runtime/supervisor-bridge.js";
 const READ_TOOLS = new Set([
     "get_current_room",
     "check_repo",
@@ -15,6 +15,13 @@ const READ_TOOLS = new Set([
     "status_local_codex_session",
     "rental_list_requests",
 ]);
+export function supervisedToolIsMutation(toolName) {
+    return !READ_TOOLS.has(toolName);
+}
+// The desktop daemon's local control protocol intentionally uses small bounded
+// frames. A read result can be returned live to the provider without copying
+// the entire payload into the durable effect journal.
+const MAX_DURABLE_READ_RESULT_BYTES = 16 * 1024;
 function instruction(text, data = {}) {
     const payload = { ...data, instruction: text };
     return {
@@ -22,7 +29,19 @@ function instruction(text, data = {}) {
         structuredContent: payload,
     };
 }
+export function durableCompletionResult(result, mutation) {
+    if (mutation)
+        return result;
+    const serializedBytes = Buffer.byteLength(JSON.stringify(result), "utf8");
+    if (serializedBytes <= MAX_DURABLE_READ_RESULT_BYTES)
+        return result;
+    return instruction("The read completed, but its large result was returned live instead of being copied into the durable journal. Issue a fresh read request if this exact request is replayed after a restart.", {
+        code: "SUPERVISED_READ_RESULT_NOT_RETAINED",
+        serialized_bytes: serializedBytes,
+    });
+}
 const productionDependencies = {
+    executeTool: executeCurrentSupervisedTool,
     prepareEffect: prepareCurrentSupervisedEffect,
     completeEffect: completeCurrentSupervisedEffect,
     withRoom: runWithCurrentSupervisedRoom,
@@ -37,6 +56,7 @@ export function profileAwareToolServer(server, profile, dependencies = productio
                 return typeof value === "function" ? value.bind(target) : value;
             }
             return (name, ...registration) => {
+                const mutation = supervisedToolIsMutation(name);
                 const callback = registration.at(-1);
                 if (typeof callback !== "function")
                     throw new Error(`Tool ${name} has no callback.`);
@@ -46,12 +66,18 @@ export function profileAwareToolServer(server, profile, dependencies = productio
                     if (extra.requestId === undefined || extra.requestId === null || String(extra.requestId).trim() === "") {
                         throw new Error(`Supervised tool ${name} is missing its MCP request id; refusing an effect that cannot be deduplicated safely.`);
                     }
-                    const prepared = await dependencies.prepareEffect({
+                    const executionRequest = {
                         toolName: name,
                         input,
                         mcpRequestId: String(extra.requestId),
-                        mutation: !READ_TOOLS.has(name),
-                    });
+                    };
+                    if (dependencies.executeTool) {
+                        const executed = await dependencies.executeTool(executionRequest);
+                        if (executed.state === "completed") {
+                            return dependencies.withRoom(executed.roomId, () => executed.result);
+                        }
+                    }
+                    const prepared = await dependencies.prepareEffect({ ...executionRequest, mutation });
                     return dependencies.withRoom(prepared.roomId, async () => {
                         if (prepared.state === "completed")
                             return prepared.result;
@@ -94,7 +120,10 @@ export function profileAwareToolServer(server, profile, dependencies = productio
                         }
                         // Completion transport is deliberately outside the callback catch.
                         // A reporting failure must never relabel a successful action failed.
-                        await dependencies.completeEffect({ effectId: prepared.effectId, result });
+                        await dependencies.completeEffect({
+                            effectId: prepared.effectId,
+                            result: durableCompletionResult(result, mutation),
+                        });
                         return result;
                     });
                 };