Changelog

1.1.0 (2026-09-26)

• test(apparmor): build the #1305 space-in-path workspace under tmp_path
• feat: keep a daemon-resolved app:// credential through the secret scrub (#1228)
• Revert "Let a profile-less workspace exempt GH_TOKEN from secret scrubbing"
• Let a profile-less workspace exempt GH_TOKEN from secret scrubbing
• Quote workspace_path in every AppArmor rule (#1305)
• docs(scaffold): name a profile-set after what varies, not who selects it
• server: tool_class, diff fields and auto_allow_housekeeping (jaato/#1304 §2 prerequisites)
• file_edit: steer writeNewFile/updateFile/removeFile over shell equivalents
• Fix WS sessions running unconfined: JaatoWSServer had no _event_loop
• Treat reasoning tokens as one quantity inside the output (#1047)
• Fix complexity ratchet violations from the #1294 diagnostics command
• Add self-service session diagnostics live view (#1294)
• Add observability to the WS AppArmor pre-init hook's silent exits (#1296)
• Fix stale WS-server reference and CREATE-path config_root gap (#1293)
• Persist reasoning parts instead of replaying them as text (#1290)
• fix(scaffold): Pi follow-ups after adopting #1093
• Re-anchor two reversions Phase 3 moved in session_manager.py
• Session group messaging phase 3: files on a message
• Session group messaging phase 2: the durable inbox
• fix: one attachment decoder for session.wake and session.message
• feat: session group messaging via the courier plugin (phase 1)
• Memories rail in the web client, backed by quiet daemon verbs (#1232)
• fix(runner): thread the managed workspace root through the SessionManager spawn path (#1280)
• fix(sandbox): fail closed on the SessionManager spawn path when confinement is required (#1253)
• notebook: detect, diagnose, and recover from a crashed subprocess kernel (#1275)
• Model subprocesses: jaato tools and installed tools on PATH, managed tool venv
• Staging: a file over 1 MiB closed the socket and hung for 120 s
• chore(release): jaato-sdk 0.28.0 — the cut absorbs #1263's protocol 1.21
• Web coder: bootstrap the jaato-sdk skill into every workspace (#1263)
• chore(release): cut jaato-sdk 0.27.1, jaato-server 1.1.0, jaato-tui 1.0.1, jaato-eval 0.3.3
• integration: add --refresh (overwrite only when nothing local is lost)
• Frame prompt-library skills as reference, list with descriptions (#1262)
• Co-locate #1253 WS reversions with the tests they name (#1065)
• fix(sandbox): WS session must be confined before its runner serves work (#1253)
• fix: recover double-JSON-encoded tool-call arguments (#1242)
• fix(sandbox): revived runner denies cli exec of /bin/sh and gh (#1251)
• feat(scaffold): add Pi skill integration

jaato-server

The runtime and daemon behind jaato — a multi-provider agentic tool orchestrator. This package holds the session runtime, the plugin system, ~24 model-provider adapters, and the daemon that clients connect to over a Unix socket or WebSocket.

You install this on the machine where agents should run. To talk to it from Python, install jaato-sdk; for a terminal client, jaato-tui.

Installation

pip install jaato-server
# or:  uv pip install jaato-server

The base install carries the daemon, the session runtime and the plugins that need no third-party SDK. Provider SDKs and the heavier tool plugins are extras, so you install only the ones you use:

pip install 'jaato-server[all]'

Anthropic's SDK, mcp, websockets and jaato-sdk are base dependencies — Claude, MCP servers and the WebSocket transport work out of the box. Requires Python 3.12+.

Quick start

Start the daemon:

# Local clients over a Unix domain socket
jaato-server --ipc-socket /tmp/jaato.sock --daemon

# Add a WebSocket port for remote or browser clients.  A bearer token is
# generated at ~/.jaato/ws.token on first WS start if you supply none.
jaato-server --ipc-socket /tmp/jaato.sock --web-socket :8080 --daemon

jaato-server --status
jaato-server --stop

Then drive it from Python:

import asyncio
import jaato          # from jaato-sdk

async def main():
    async with jaato.session(mode="ipc", profile="researcher") as s:
        print(await s.ask("What changed in this repo last week?"))

asyncio.run(main())

The same code runs against an embedded runtime (mode="in_process", no daemon), a local daemon ("ipc"), or a remote one ("ws").

Model providers

One session interface over every backend below; a profile picks the provider and model, and enter_tier can switch bindings mid-session.

Several ship an interactive auth command (anthropic-auth login, github-auth login, openrouter-auth key …) so a credential need never be pasted into a shell profile.

Plugins

Tools reach the model through plugins, discovered from this package and from any installed distribution declaring a jaato.plugins entry point. Built-ins include:

• Execution — cli (shell), interactive_shell (PTY sessions for REPLs, debuggers, wizards), notebook, mcp (any stdio MCP server)
• Code and files — file_edit, filesystem_query, ast_search, lsp, references
• Web — web_fetch, web_search, webmcp, service_connector (call an OpenAPI service by alias), webhook (inbound events)
• Orchestration — subagent, todo, clarification, waypoint, reliability, template
• Context management — four GC strategies (gc_truncate, gc_summarize, gc_hybrid, gc_budget) plus provider prompt-caching plugins
• Control — permission, sandbox_manager, telemetry

Agent profiles

A profile is a YAML file in .jaato/profiles/ binding a model, a provider, a plugin set, a GC strategy and resource ceilings:

name: researcher
description: Deep research profile
provider: anthropic
model: claude-sonnet-4-20250514
plugins: [cli, web_search, memory, todo(preload)]
default_agent: researcher        # the persona in .jaato/agents/researcher.md
runtime_limits:
  max_parallel_tools: 2
  max_orphan_seconds: 300
budget_control:
  limits: {usd: 5.0, tool_calls: 200}
  degrade:
    - {at: 95,  action: finalize}
    - {at: 100, action: abort}

jaato-scaffold interrogates the installed framework rather than a copy of the docs, so it cannot go stale:

jaato-scaffold explain profile         # every profile key, with its vocabulary
jaato-scaffold explain providers       # providers, their knobs and caveats
jaato-scaffold explain plugins         # what is installed, and where it came from
jaato-scaffold validate                # check a workspace before you run it
jaato-scaffold new client --profile researcher

explain covers 20-odd scopes — env, tiers, completion, runtime, paths, services among them.

Isolation and secrets

Sessions run in a subprocess runner, and the daemon confines it where the host allows:

• AppArmor — a per-boundary profile confines the runner to its workspace when the LSM is available. Opt in per client, or require it with JAATO_REQUIRE_APPARMOR=1 so an unconfined host refuses to start rather than degrading silently.
• cgroup v2 — runtime_limits caps memory, pids and CPU; tool timeouts, output size, tool-pool width and two wall-clock bounds are enforced by the framework itself.
• Secret scrubbing — provider keys and tokens are stripped from the environment handed to every model-driven subprocess by default; scrub_secret_env narrows or waives it, and waiving is announced.
• Permissions — every tool call passes a policy that can allow, deny or ask, per session, with the decision recorded.

Configuration

Workspace configuration lives under .jaato/ (profiles, agents, GC settings, permissions) with ~/.jaato/ as the fallback tier. MCP servers are declared in .mcp.json. Credentials resolve from a profile knob, then the environment, then a stored auth file — pass:// and vault:// URIs are resolved daemon-side so a secret never sits on disk in the clear.

jaato-scaffold explain env prints every environment variable the installed tree reads, each tagged with its scope and the typed profile key that supersedes it.

Documentation

• Project README
• Architecture · Sequence diagrams
• Design philosophy
• Permission system
• AppArmor setup
• OpenTelemetry
• Issues

License

BUSL-1.1. See LICENSE.