@byok-sdk/client 0.10.1 → 0.11.0

package/dist/sdk-reserved-helper-host.d.ts

@@ -0,0 +1,25 @@
+export declare const BYOK_SDK_HELPER_SUBCOMMAND = "__byok_sdk_helper";
+export type SdkReservedHelperKind = 'agent-message-mcp' | 'agent-memory-mcp' | 'approval-mcp' | 'agent-team-mcp';
+export interface SdkHelperHostConfig {
+    /**
+     * Run SDK-reserved helpers by re-entering the product's single-file/SEA
+     * executable. The product entrypoint must call
+     * {@link runSdkReservedHelperCommand} before its own argument parser.
+     */
+    readonly mode: 'self-executable';
+    /** Absolute product executable path. Defaults to this process's executable. */
+    readonly executable?: string;
+}
+export interface ResolvedSdkReservedHelperBin {
+    readonly command: string;
+    readonly args: readonly string[];
+    readonly source: 'dist-script' | 'self-executable';
+}
+/** SDK-owned launcher shape used by every reserved stdio helper. */
+export declare function resolveSdkReservedHelperBin(kind: SdkReservedHelperKind, host?: SdkHelperHostConfig): ResolvedSdkReservedHelperBin;
+/**
+ * Product entrypoint seam for single-file/SEA hosts. Returns `false` without
+ * side effects for normal product commands; a reserved command is handled to
+ * stdio EOF before this resolves `true`.
+ */
+export declare function runSdkReservedHelperCommand(argv?: readonly string[]): Promise<boolean>;

package/dist/sdk-reserved-mcp.d.ts

@@ -0,0 +1,23 @@
+/** SDK-owned names shared by daemon injection, adapter policy, and MCP helpers. */
+export declare const AGENT_MESSAGE_MCP_SERVER_NAME = "byokagentmessage";
+export declare const AGENT_MESSAGE_TOOL_NAME = "send_agent_message";
+export declare const AGENT_MEMORY_MCP_SERVER_NAME = "byokagentmemory";
+export declare const AGENT_TEAM_MCP_SERVER_NAME = "byokagentteam";
+/** The MCP server NAME the claude adapter registers `byok-approval-mcp` under in its generated `--mcp-config` — combined with `APPROVAL_TOOL_NAME` (single-sourced from `bin/approval-mcp-server.ts`) to form the `mcp__<server>__<tool>` identifier `--permission-prompt-tool` expects. Lives here, beside the other reserved names, so `toolset-registry.ts`'s host-config rejection and the adapters' own "never treat a reserved server as a projected toolset server" rule read from one list. */
+export declare const APPROVAL_MCP_SERVER_NAME = "byokapproval";
+/**
+ * Every MCP server name the SDK owns. A server under one of these names is
+ * never a projected host toolset server: `toolset-registry.ts` refuses to
+ * configure one, and the adapters grant each reserved server exactly the
+ * fixed tool its own protocol needs rather than anything observed.
+ *
+ * A frozen tuple rather than a `Set`: `Object.freeze` on a `Set` freezes the
+ * object's own properties and leaves `add`/`delete` fully functional, so the
+ * previous shape advertised an immutability it did not have. Three entries
+ * make `includes` the same cost as a hash lookup, and the array really is
+ * immutable. Use {@link isReservedMcpServerName} rather than reaching for
+ * membership directly.
+ */
+export declare const RESERVED_MCP_SERVER_NAMES: readonly ["byokagentmessage", "byokagentmemory", "byokapproval", "byokagentteam"];
+/** Whether `name` is one of the SDK-owned MCP server names above. */
+export declare function isReservedMcpServerName(name: string): boolean;

package/dist/types.d.ts

@@ -172,6 +172,26 @@ export interface RuntimeAdapterDescriptor {
     readonly environmentRequirements: RuntimeEnvironmentRequirements;
     /** Explicit opt-in to authoritative `task.offer.dispatchSelection` semantics. */
     readonly supportsDispatchSelection: boolean;
+    /**
+     * Whether this adapter actually CONSUMES
+     * {@link RuntimeAdapterPrepareInput.mcpToolsetTools} — i.e. whether it
+     * pre-grants each projected toolset server's tools in the runtime's own
+     * grant surface (claude's `--allowedTools`, codex's `enabled_tools` +
+     * per-tool `approval_mode`) and therefore needs the daemon to observe
+     * them first.
+     *
+     * The daemon uses this, and only this, to decide whether to pay for the
+     * pre-admission `tools/list` probe of every projected server
+     * (`daemon/mcp-tools-probe.ts`). An adapter that projects toolsets through
+     * its own proxy and grants them itself (the pi adapter) declares nothing
+     * here and never makes an offer wait on a probe it has no use for.
+     *
+     * Omission is fail-closed in the direction that matters: no probe means no
+     * observation, and an adapter that does consume the observation rejects a
+     * projected server it has no tool names for (`adapters/mcp-tool-grants.ts`).
+     * A grant is never widened by a missing declaration.
+     */
+    readonly requiresMcpToolsetToolObservation?: boolean;
 }
 /** The pure input to one adapter admission decision. It contains no credential values or workspace resources. */
 export interface RuntimeAdapterPrepareInput {
@@ -181,7 +201,21 @@ export interface RuntimeAdapterPrepareInput {
     requiredToolsetIds: readonly string[];
     /** Locally resolved MCP authority; available for pure admission validation only. */
     mcpServers?: Readonly<Record<string, McpStdioServerConfig>>;
+    /** {@link McpToolsetToolObservation} for exactly the projected toolset servers in `mcpServers`. */
+    mcpToolsetTools?: McpToolsetToolObservation;
 }
+/**
+ * Tool names observed by starting each projected toolset MCP server and
+ * reading its own `tools/list` answer (`daemon/mcp-tools-probe.ts`), keyed by
+ * the projected server name. SDK-reserved servers are never keyed here — they
+ * carry their own fixed, single-tool grants inside the adapters.
+ *
+ * This is the ONLY set of names an adapter may pre-grant to a runtime. Device
+ * toolset configuration carries `command`/`args` only, so a configured value
+ * could never be an authority on what a server exposes; a name absent from
+ * this observation is a name the runtime is never told to allow.
+ */
+export type McpToolsetToolObservation = Readonly<Record<string, readonly string[]>>;
 /** A permanent or currently-unavailable pre-claim admission rejection. */
 export interface RuntimeAdapterRejectedOperation {
     kind: 'reject';
@@ -233,6 +267,8 @@ export interface RuntimeOperationStartInput {
     readonly env: NodeJS.ProcessEnv;
     /** Local MCP authority resolved from logical wire ids. */
     readonly mcpServers?: Readonly<Record<string, McpStdioServerConfig>>;
+    /** {@link McpToolsetToolObservation} for exactly the projected toolset servers in `mcpServers`. */
+    readonly mcpToolsetTools?: McpToolsetToolObservation;
     /** Optional, adapter-agnostic out-of-band approval channel. */
     readonly approvalChannel?: ApprovalChannel;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@byok-sdk/client",
-  "version": "0.10.1",
+  "version": "0.11.0",
   "description": "BYOK SDK client daemon: runs on the end user's machine, pairs with a SaaS server, and drives a local coding-agent runtime",
   "type": "module",
   "license": "MIT",
@@ -24,7 +24,8 @@
     "byok-agent": "./dist/bin/byok-agent.js",
     "byok-approval-mcp": "./dist/bin/byok-approval-mcp.js",
     "byok-agent-message-mcp": "./dist/bin/byok-agent-message-mcp.js",
-    "byok-agent-memory-mcp": "./dist/bin/byok-agent-memory-mcp.js"
+    "byok-agent-memory-mcp": "./dist/bin/byok-agent-memory-mcp.js",
+    "byok-agent-team-mcp": "./dist/bin/byok-agent-team-mcp.js"
   },
   "exports": {
     ".": {
@@ -56,21 +57,25 @@
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit",
     "smoke:adapters": "node scripts/adapter-task-smoke.mjs",
+    "smoke:claude-toolset-permission": "node scripts/claude-toolset-permission-smoke.mjs",
+    "smoke:codex-toolset-permission": "node scripts/codex-toolset-permission-smoke.mjs",
     "audit:adapter-task-smoke": "node scripts/adapter-task-smoke.mjs",
     "audit:credentials": "node scripts/linux-credential-audit.mjs",
     "clean": "rm -rf dist"
   },
   "dependencies": {
-    "@byok-sdk/core": "0.10.1",
-    "@byok-sdk/protocol": "0.10.1",
+    "@byok-sdk/core": "0.11.0",
+    "@byok-sdk/protocol": "0.11.0",
     "@earendil-works/pi-coding-agent": "0.84.2",
+    "@juicesharp/rpiv-todo": "2.8.0",
     "pi-mcp-adapter": "2.27.0",
+    "pi-subagents": "0.60.0",
     "pi-web-access": "0.24.1",
     "ws": "^8.21.1"
   },
   "devDependencies": {
     "@types/ws": "^8.18.1",
-    "@byok-sdk/server": "0.10.1",
+    "@byok-sdk/server": "0.11.0",
     "@hono/node-server": "^2.0.10"
   }
 }