@byok-sdk/client 0.11.0 → 0.12.0

package/dist/index.js

@@ -2,7 +2,7 @@ import { randomUUID, createHash, randomBytes, createPrivateKey, generateKeyPairS
 import { promises, mkdirSync, constants, existsSync, linkSync, fstatSync, lstatSync, unlinkSync, renameSync, writeFileSync, chmodSync, statSync, readdirSync, readFileSync, realpathSync } from 'fs';
 import * as path3 from 'path';
 import path3__default, { join, isAbsolute } from 'path';
-import { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, AgentRefSchema, AgentHomeProjectionPayloadSchema, byokBlobUrlPath, BYOK_BLOBS_PATH, byokBlobFinalizePath, partitionAgentEvents, BYOK_SKILL_PACKS_PATH, byokSkillPackFilePath, BYOK_RECORDS_PATH, byokRecordPath, TASK_TRANSITIONS, AgentEgressPolicySchema, BYOK_PAIR_PATH, PairResponseSchema, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, CONFIGURED_TOOLSETS_MAX_ITEMS, ToolsetIdSchema, AgentContentReceiptPayloadSchema, encodeEnvelope, PROTOCOL_VERSION, createEnvelope, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, TERMINAL_PROJECTION_SELECTION_CAPABILITY, STRICT_AGENT_ONLY_CAPABILITY, AGENT_HOME_PROJECTION_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AGENT_MESSAGE_EGRESS_CAPABILITY, AgentHomeProjectionCompletionRequestSchema, byokAgentHomeProjectionCompletionPath, AgentHomeProjectionReadbackSchema, parseMessage, checkResultDocument, MAX_MESSAGES_PER_BATCH, BYOK_CAPABILITIES_PATH, BYOK_PRESENCE_PATH, AgentMessagePublishPayloadSchema, AgentMessageDispositionPayloadSchema, RuntimeIdSchema, AGENT_MEMORY_PROJECTION_CAPABILITY, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, RESULT_DOCUMENT_MAX_BYTES, decodeEnvelope, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendResponseSchema, UnknownMessageTypeError, AGENT_MEMORY_PROJECTION_MAX_ORDERING_VALUE, AgentMemoryProjectionMutationSchema, AGENT_MEMORY_PROJECTION_MAX_REDACTED_BYTES, BYOK_WS_PATH } from '@byok-sdk/protocol';
+import { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, AgentRefSchema, AgentHomeProjectionPayloadSchema, byokBlobUrlPath, BYOK_BLOBS_PATH, byokBlobFinalizePath, partitionAgentEvents, BYOK_SKILL_PACKS_PATH, byokSkillPackFilePath, BYOK_RECORDS_PATH, byokRecordPath, TASK_TRANSITIONS, AgentEgressPolicySchema, BYOK_PAIR_PATH, PairResponseSchema, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, CONFIGURED_TOOLSETS_MAX_ITEMS, ToolsetIdSchema, AgentContentReceiptPayloadSchema, encodeEnvelope, PROTOCOL_VERSION, createEnvelope, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, TERMINAL_PROJECTION_SELECTION_CAPABILITY, STRICT_AGENT_ONLY_CAPABILITY, AGENT_HOME_PROJECTION_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AGENT_MESSAGE_EGRESS_CAPABILITY, AgentHomeProjectionCompletionRequestSchema, byokAgentHomeProjectionCompletionPath, AgentHomeProjectionReadbackSchema, parseMessage, checkResultDocument, MAX_MESSAGES_PER_BATCH, BYOK_CAPABILITIES_PATH, BYOK_PRESENCE_PATH, AgentMessagePublishPayloadSchema, AgentMessageDispositionPayloadSchema, RuntimeIdSchema, AGENT_MEMORY_PROJECTION_CAPABILITY, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, RESULT_DOCUMENT_MAX_BYTES, decodeEnvelope, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendResponseSchema, UnknownMessageTypeError, BYOK_WS_PATH, AGENT_MEMORY_PROJECTION_MAX_ORDERING_VALUE, AgentMemoryProjectionMutationSchema, AGENT_MEMORY_PROJECTION_MAX_REDACTED_BYTES } from '@byok-sdk/protocol';
 import net2, { createServer, createConnection } from 'net';
 import * as os4 from 'os';
 import os4__default from 'os';
@@ -746,6 +746,120 @@ var AgentHomeLeaseManager = class _AgentHomeLeaseManager {
     }
   }
 };
+function executionKey(input) {
+  const value = input.sessionRef === void 0 ? input.taskId : input.sessionRef;
+  const label = input.sessionRef === void 0 ? "taskId" : "sessionRef";
+  if (typeof value !== "string" || value.length === 0 || /[\u0000\r\n]/u.test(value)) {
+    throw new AgentHomeResolutionError(`Agent execution ${label} must be a non-empty single-line string`);
+  }
+  return `${input.sessionRef === void 0 ? "task" : "session"}\0${value}`;
+}
+var AgentHomeExecutionLeaseManager = class _AgentHomeExecutionLeaseManager {
+  constructor(manager) {
+    this.manager = manager;
+  }
+  manager;
+  static groups = /* @__PURE__ */ new Map();
+  static queues = /* @__PURE__ */ new Map();
+  async acquire(resolution, input) {
+    const initialKey = executionKey(input);
+    return this.exclusive(resolution.canonicalHome, async () => {
+      let group = _AgentHomeExecutionLeaseManager.groups.get(resolution.canonicalHome);
+      if (group === void 0) {
+        const baseLease = await this.manager.acquire(resolution);
+        group = {
+          manager: this.manager,
+          baseLease,
+          agentId: resolution.agentRef.agentId,
+          leasesByKey: /* @__PURE__ */ new Map()
+        };
+        _AgentHomeExecutionLeaseManager.groups.set(resolution.canonicalHome, group);
+      } else if (group.manager !== this.manager || group.agentId !== resolution.agentRef.agentId) {
+        throw new AgentHomeBusyError(`Agent home ${resolution.canonicalHome} is active under another execution owner`);
+      }
+      if (group.leasesByKey.has(initialKey)) {
+        throw new AgentHomeBusyError(`Agent session already has an active execution lease in ${resolution.canonicalHome}`);
+      }
+      const leaseId = randomUUID();
+      group.leasesByKey.set(initialKey, leaseId);
+      let currentKey = initialKey;
+      let sessionBound = input.sessionRef !== void 0;
+      let released = false;
+      return Object.freeze({
+        leaseId,
+        agentRef: resolution.agentRef,
+        canonicalHome: resolution.canonicalHome,
+        cwd: resolution.canonicalHome,
+        homeIdentity: group.baseLease.homeIdentity,
+        bindSession: async (sessionRef) => {
+          const nextKey = executionKey({ taskId: input.taskId, sessionRef });
+          await this.exclusive(resolution.canonicalHome, async () => {
+            if (released) throw new AgentHomeBusyError(`Agent execution lease ${leaseId} is already released`);
+            const currentGroup = _AgentHomeExecutionLeaseManager.groups.get(resolution.canonicalHome);
+            if (currentGroup !== group || currentGroup.leasesByKey.get(currentKey) !== leaseId) {
+              throw new AgentHomeBusyError(`Agent execution lease ${leaseId} is no longer owned by this process`);
+            }
+            if (nextKey === currentKey) return;
+            if (sessionBound) {
+              throw new AgentHomeBusyError(
+                `Agent session execution lease ${leaseId} cannot rebind to a different runtime session`
+              );
+            }
+            if (currentGroup.leasesByKey.has(nextKey)) {
+              throw new AgentHomeBusyError(`Agent session already has an active execution lease in ${resolution.canonicalHome}`);
+            }
+            currentGroup.leasesByKey.set(nextKey, leaseId);
+            currentGroup.leasesByKey.delete(currentKey);
+            currentKey = nextKey;
+            sessionBound = true;
+          });
+        },
+        release: async () => {
+          await this.exclusive(resolution.canonicalHome, async () => {
+            if (released) return;
+            const currentGroup = _AgentHomeExecutionLeaseManager.groups.get(resolution.canonicalHome);
+            if (currentGroup !== group || currentGroup.leasesByKey.get(currentKey) !== leaseId) {
+              released = true;
+              throw new AgentHomeBusyError(`Agent execution lease ${leaseId} is no longer owned by this process`);
+            }
+            currentGroup.leasesByKey.delete(currentKey);
+            released = true;
+            if (currentGroup.leasesByKey.size === 0) {
+              _AgentHomeExecutionLeaseManager.groups.delete(resolution.canonicalHome);
+              await currentGroup.baseLease.release();
+            }
+          });
+        }
+      });
+    });
+  }
+  async mutate(binding, operation) {
+    return this.exclusive(binding.resolution.canonicalHome, async () => {
+      const group = _AgentHomeExecutionLeaseManager.groups.get(binding.resolution.canonicalHome);
+      if (group === void 0 || group.manager !== this.manager || ![...group.leasesByKey.values()].includes(binding.lease.leaseId)) {
+        throw new AgentHomeBusyError("Agent execution lease does not own this home mutation");
+      }
+      return operation();
+    });
+  }
+  async exclusive(canonicalHome, operation) {
+    const prior = _AgentHomeExecutionLeaseManager.queues.get(canonicalHome) ?? Promise.resolve();
+    let release;
+    const tail = new Promise((resolve) => {
+      release = resolve;
+    });
+    _AgentHomeExecutionLeaseManager.queues.set(canonicalHome, tail);
+    await prior;
+    try {
+      return await operation();
+    } finally {
+      release();
+      if (_AgentHomeExecutionLeaseManager.queues.get(canonicalHome) === tail) {
+        _AgentHomeExecutionLeaseManager.queues.delete(canonicalHome);
+      }
+    }
+  }
+};
 async function initializeAgentHome(resolution) {
   await ensureDirectoryNoSymlink(
     resolution.canonicalHome,
@@ -821,10 +935,12 @@ var AgentHomeManager = class {
   layout;
   projection;
   leaseManager;
+  executionLeaseManager;
   constructor(options) {
     this.layout = new AgentHomeLayout(options.hostStorageRoot);
     this.projection = options.projection;
     this.leaseManager = options.leaseManager ?? new AgentHomeLeaseManager();
+    this.executionLeaseManager = new AgentHomeExecutionLeaseManager(this.leaseManager);
   }
   async prepare(agentRef) {
     const binding = await this.acquire(agentRef);
@@ -851,12 +967,25 @@ var AgentHomeManager = class {
     const lease = await this.leaseManager.acquire(resolution);
     return Object.freeze({ resolution, lease });
   }
+  async acquireExecution(agentRef, input) {
+    const resolution = await this.layout.resolve(agentRef);
+    const lease = await this.executionLeaseManager.acquire(resolution, input);
+    return Object.freeze({ resolution, lease });
+  }
   /** Initialize only after any requested session exact-match has succeeded. */
   async initialize(binding) {
-    const { resolution, lease } = binding;
+    await this.initializeResolved(binding.resolution, binding.lease.cwd);
+  }
+  async initializeExecution(binding) {
+    await this.mutateExecution(binding, () => this.initializeResolved(binding.resolution, binding.lease.cwd));
+  }
+  async mutateExecution(binding, operation) {
+    return this.executionLeaseManager.mutate(binding, operation);
+  }
+  async initializeResolved(resolution, cwd) {
     await initializeAgentHome(resolution);
     const prepare = this.projection?.prepare;
-    if (prepare !== void 0) await prepare({ ...resolution, cwd: lease.cwd });
+    if (prepare !== void 0) await prepare({ ...resolution, cwd });
     if (await promises.realpath(resolution.homeDir) !== resolution.canonicalHome) {
       throw new AgentHomeResolutionError("Agent projection changed the canonical home path");
     }
@@ -6983,9 +7112,18 @@ function assertRecord(value) {
     throw new DeviceCredentialStoreError("OS credential entry has an incomplete device credential");
   }
 }
-function encode(record3) {
-  assertRecord(record3);
-  const encoded = Buffer.from(JSON.stringify(record3), "utf8").toString("base64");
+function isFirstPairingAttempt(value) {
+  return "kind" in value && value.kind === "first-pairing-attempt-v1";
+}
+function assertFirstPairingAttempt(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value) || value.kind !== "first-pairing-attempt-v1" || typeof value.deviceName !== "string" || typeof value.devicePublicKey !== "string" || typeof value.devicePrivateKeyPem !== "string" || value.machineId !== void 0 && typeof value.machineId !== "string" || value.deviceName.length === 0 || value.devicePublicKey.length === 0 || value.devicePrivateKeyPem.length === 0) {
+    throw new DeviceCredentialStoreError("OS credential entry has an invalid first-pairing attempt shape");
+  }
+}
+function encode(authority) {
+  if (isFirstPairingAttempt(authority)) assertFirstPairingAttempt(authority);
+  else assertRecord(authority);
+  const encoded = Buffer.from(JSON.stringify(authority), "utf8").toString("base64");
   const value = `${ENCODED_PREFIX}${encoded}`;
   if (Buffer.byteLength(value, "utf8") > 2400) {
     throw new DeviceCredentialStoreError("device credential exceeds the OS credential entry bound");
@@ -7014,6 +7152,16 @@ function decode(value) {
   } catch {
     throw new DeviceCredentialStoreError("OS credential entry is not valid JSON");
   }
+  if (typeof parsed === "object" && parsed !== null && parsed.kind === "first-pairing-attempt-v1") {
+    assertFirstPairingAttempt(parsed);
+    return Object.freeze({
+      kind: parsed.kind,
+      deviceName: parsed.deviceName,
+      devicePublicKey: parsed.devicePublicKey,
+      devicePrivateKeyPem: parsed.devicePrivateKeyPem,
+      ...parsed.machineId === void 0 ? {} : { machineId: parsed.machineId }
+    });
+  }
   assertRecord(parsed);
   return Object.freeze({
     deviceId: parsed.deviceId,
@@ -7044,6 +7192,18 @@ var DeviceCredentialStore = class {
     this.#run = options.commandRunner ?? runDeviceCommand;
   }
   async read() {
+    const authority = await this.#readAuthority();
+    return authority === void 0 || isFirstPairingAttempt(authority) ? void 0 : authority;
+  }
+  async readFirstPairingAttempt() {
+    const authority = await this.#readAuthority();
+    return authority !== void 0 && isFirstPairingAttempt(authority) ? authority : void 0;
+  }
+  async saveFirstPairingAttempt(attempt) {
+    assertFirstPairingAttempt(attempt);
+    await this.#replaceAuthority(attempt);
+  }
+  async #readAuthority() {
     const result = await this.#invoke("read");
     if (result.exitCode === NOT_FOUND || this.#platform === "linux" && result.exitCode === 1 && result.stderr.trim().length === 0) return void 0;
     if (result.exitCode === 127) throw new DeviceCredentialStoreUnavailableError();
@@ -7056,6 +7216,12 @@ var DeviceCredentialStore = class {
   }
   async replace(record3) {
     const encoded = encode(record3);
+    await this.#replaceEncoded(encoded);
+  }
+  async #replaceAuthority(authority) {
+    await this.#replaceEncoded(encode(authority));
+  }
+  async #replaceEncoded(encoded) {
     const result = await this.#invoke("replace", encoded);
     if (result.exitCode === 127) throw new DeviceCredentialStoreUnavailableError();
     if (result.exitCode !== 0) {
@@ -7066,7 +7232,7 @@ var DeviceCredentialStore = class {
   }
   /** Returns true only after the sole secret authority is confirmed absent. */
   async clear() {
-    const before = await this.read();
+    const before = await this.#readAuthority();
     if (before === void 0) return false;
     const result = await this.#invoke("clear");
     if (result.exitCode === 127) throw new DeviceCredentialStoreUnavailableError();
@@ -7075,7 +7241,7 @@ var DeviceCredentialStore = class {
         `operating-system credential provider could not clear device credentials${providerDiagnostic(result.stderr)}`
       );
     }
-    if (await this.read() !== void 0) {
+    if (await this.#readAuthority() !== void 0) {
       throw new DeviceCredentialStoreError("operating-system credential provider reported deletion but device credentials remain");
     }
     return true;
@@ -7150,17 +7316,24 @@ var DeviceCredentialStore = class {
   }
 };
 var InMemoryDeviceCredentialStore = class {
-  #record;
+  #authority;
   async read() {
-    return this.#record === void 0 ? void 0 : Object.freeze({ ...this.#record });
+    return this.#authority === void 0 || isFirstPairingAttempt(this.#authority) ? void 0 : Object.freeze({ ...this.#authority });
+  }
+  async readFirstPairingAttempt() {
+    return this.#authority !== void 0 && isFirstPairingAttempt(this.#authority) ? Object.freeze({ ...this.#authority }) : void 0;
+  }
+  async saveFirstPairingAttempt(attempt) {
+    assertFirstPairingAttempt(attempt);
+    this.#authority = Object.freeze({ ...attempt });
   }
   async replace(record3) {
     assertRecord(record3);
-    this.#record = Object.freeze({ ...record3 });
+    this.#authority = Object.freeze({ ...record3 });
   }
   async clear() {
-    const had = this.#record !== void 0;
-    this.#record = void 0;
+    const had = this.#authority !== void 0;
+    this.#authority = void 0;
     return had;
   }
 };
@@ -7447,6 +7620,10 @@ function describeEndpoint(transport, url) {
   const parsed = typeof url === "string" ? new URL(url) : url;
   return { transport, host: parsed.host, path: parsed.pathname };
 }
+function formatServerUrl(value) {
+  const url = typeof value === "string" ? new URL(value) : value;
+  return `${url.protocol}//${url.host}${url.pathname}`;
+}
 var InsecureServerUrlError = class extends Error {
   constructor(message) {
     super(message);
@@ -7465,9 +7642,10 @@ function assertServerUrlAllowed(rawUrl, opts = {}) {
   let url;
   try {
     url = new URL(rawUrl);
-  } catch (err) {
-    throw new InsecureServerUrlError(`invalid server URL "${rawUrl}": ${err instanceof Error ? err.message : String(err)}`);
+  } catch {
+    throw new InsecureServerUrlError("invalid server URL");
   }
+  const endpoint = formatServerUrl(url);
   switch (url.protocol) {
     case "https:":
     case "wss:":
@@ -7476,11 +7654,11 @@ function assertServerUrlAllowed(rawUrl, opts = {}) {
     case "ws:":
       if (opts.dangerouslyAllowInsecureRemote || isLoopbackHostname(url.hostname)) return;
       throw new InsecureServerUrlError(
-        `refusing to connect to "${rawUrl}" over plaintext ${url.protocol.replace(":", "")} \u2014 "${url.hostname}" is not a loopback host. Use wss:/https: for any non-loopback server, or pass { dangerouslyAllowInsecureRemote: true } (DaemonConfig) if you understand and accept the risk of sending device credentials over an unencrypted connection.`
+        `refusing to connect to "${endpoint}" over plaintext ${url.protocol.replace(":", "")} \u2014 "${url.hostname}" is not a loopback host. Use wss:/https: for any non-loopback server, or pass { dangerouslyAllowInsecureRemote: true } (DaemonConfig) if you understand and accept the risk of sending device credentials over an unencrypted connection.`
       );
     default:
       throw new InsecureServerUrlError(
-        `refusing to connect to "${rawUrl}" \u2014 unsupported scheme "${url.protocol}" (expected http:, https:, ws:, or wss:).`
+        `refusing to connect to "${endpoint}" \u2014 unsupported scheme "${url.protocol}" (expected http:, https:, ws:, or wss:).`
       );
   }
 }
@@ -7492,12 +7670,22 @@ var DeviceRevokedError = class extends Error {
     this.name = "DeviceRevokedError";
   }
 };
+var AuthRequestAbortedError = class extends Error {
+  constructor(reason) {
+    super(reason === "deadline" ? "authentication request exceeded its deadline" : "authentication request was cancelled during shutdown");
+    this.reason = reason;
+    this.name = "AuthRequestAbortedError";
+  }
+  reason;
+};
 var ASSUMED_PAIR_TOKEN_TTL_MS = 45 * 60 * 1e3;
 var RENEW_MARGIN_MS = 60 * 1e3;
+var DEFAULT_AUTH_REQUEST_DEADLINE_MS = 15e3;
 var AuthManager = class {
   constructor(opts) {
     this.opts = opts;
     this.credentials = opts.credentials ?? opts.store.credentials;
+    this.requestDeadlineMs = resolveRequestDeadlineMs(opts.authRequestDeadlineMs);
   }
   opts;
   record;
@@ -7507,7 +7695,10 @@ var AuthManager = class {
   stopped = false;
   pairing = false;
   credentialMutationTail = Promise.resolve();
+  /** The sole cancellation authority for the request currently inside the serialized credential mutation. */
+  activeRequest;
   credentials;
+  requestDeadlineMs;
   get deviceId() {
     return this.record?.deviceId;
   }
@@ -7543,23 +7734,51 @@ var AuthManager = class {
             if (!(error instanceof DeviceRecordRePairRequiredError)) throw error;
           }
         }
-        const keyPair = existing ? { privateKey: importPrivateKeyPem(existing.devicePrivateKeyPem), publicKeyBase64Url: existing.devicePublicKey } : generateDeviceKeyPair();
+        const observedDeviceName = this.opts.deviceName ?? os4__default.hostname();
+        const observedMachineId = await this.opts.machineId?.();
+        let keyPair;
+        let pairingDeviceName = observedDeviceName;
+        let pairingMachineId = observedMachineId;
+        if (existing) {
+          keyPair = { privateKey: importPrivateKeyPem(existing.devicePrivateKeyPem), publicKeyBase64Url: existing.devicePublicKey };
+        } else {
+          const firstAttempt = await this.credentials.readFirstPairingAttempt();
+          if (firstAttempt) {
+            keyPair = {
+              privateKey: importPrivateKeyPem(firstAttempt.devicePrivateKeyPem),
+              publicKeyBase64Url: firstAttempt.devicePublicKey
+            };
+            pairingDeviceName = firstAttempt.deviceName;
+            pairingMachineId = firstAttempt.machineId;
+          } else {
+            keyPair = generateDeviceKeyPair();
+            await this.credentials.saveFirstPairingAttempt({
+              kind: "first-pairing-attempt-v1",
+              deviceName: pairingDeviceName,
+              devicePublicKey: keyPair.publicKeyBase64Url,
+              devicePrivateKeyPem: exportPrivateKeyPem(keyPair.privateKey),
+              ...pairingMachineId === void 0 ? {} : { machineId: pairingMachineId }
+            });
+          }
+        }
         const url = new URL(BYOK_PAIR_PATH, toHttpBase(this.opts.serverUrl));
-        const machineId = await this.opts.machineId?.();
-        const res = await fetch(url, {
-          method: "POST",
-          headers: { "content-type": "application/json" },
-          body: JSON.stringify({
-            pairingCode,
-            deviceName: this.opts.deviceName ?? os4__default.hostname(),
-            devicePublicKey: keyPair.publicKeyBase64Url,
-            ...machineId === void 0 ? {} : { machineId }
-          })
+        const body = await this.runRequest(async (signal) => {
+          const res = await fetch(url, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+              pairingCode,
+              deviceName: pairingDeviceName,
+              devicePublicKey: keyPair.publicKeyBase64Url,
+              ...pairingMachineId === void 0 ? {} : { machineId: pairingMachineId }
+            }),
+            signal
+          });
+          if (!res.ok) {
+            throw new Error(`pairing failed: HTTP ${res.status} ${await safeErrorText(res)}`.trimEnd());
+          }
+          return PairResponseSchema.parse(await res.json());
         });
-        if (!res.ok) {
-          throw new Error(`pairing failed: HTTP ${res.status} ${await safeErrorText(res)}`.trimEnd());
-        }
-        const body = PairResponseSchema.parse(await res.json());
         const metadata = {
           deviceId: body.deviceId,
           tenantId: body.tenantId,
@@ -7598,6 +7817,7 @@ var AuthManager = class {
     this.stopped = true;
     if (this.proactiveTimer) clearTimeout(this.proactiveTimer);
     this.proactiveTimer = void 0;
+    this.activeRequest?.abort();
     await this.credentialMutationTail;
   }
   async renew() {
@@ -7614,29 +7834,35 @@ var AuthManager = class {
     const record3 = this.record;
     const base = toHttpBase(this.opts.serverUrl);
     const privateKey = importPrivateKeyPem(record3.devicePrivateKeyPem);
-    const challengeRes = await fetch(new URL(BYOK_CHALLENGE_PATH, base), {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ deviceId: record3.deviceId })
+    const { nonce } = await this.runRequest(async (signal) => {
+      const challengeRes = await fetch(new URL(BYOK_CHALLENGE_PATH, base), {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ deviceId: record3.deviceId }),
+        signal
+      });
+      if (challengeRes.status === 401) this.markRevoked();
+      if (!challengeRes.ok) {
+        throw new Error(
+          `token renewal (challenge) failed: HTTP ${challengeRes.status} ${await safeErrorText(challengeRes)}`.trimEnd()
+        );
+      }
+      return await challengeRes.json();
     });
-    if (challengeRes.status === 401) this.markRevoked();
-    if (!challengeRes.ok) {
-      throw new Error(
-        `token renewal (challenge) failed: HTTP ${challengeRes.status} ${await safeErrorText(challengeRes)}`.trimEnd()
-      );
-    }
-    const { nonce } = await challengeRes.json();
     const signature = signNonce(privateKey, nonce);
-    const tokenRes = await fetch(new URL(BYOK_TOKEN_PATH, base), {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ deviceId: record3.deviceId, nonce, signature })
+    const body = await this.runRequest(async (signal) => {
+      const tokenRes = await fetch(new URL(BYOK_TOKEN_PATH, base), {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ deviceId: record3.deviceId, nonce, signature }),
+        signal
+      });
+      if (tokenRes.status === 401) this.markRevoked();
+      if (!tokenRes.ok) {
+        throw new Error(`token renewal (token) failed: HTTP ${tokenRes.status} ${await safeErrorText(tokenRes)}`.trimEnd());
+      }
+      return await tokenRes.json();
     });
-    if (tokenRes.status === 401) this.markRevoked();
-    if (!tokenRes.ok) {
-      throw new Error(`token renewal (token) failed: HTTP ${tokenRes.status} ${await safeErrorText(tokenRes)}`.trimEnd());
-    }
-    const body = await tokenRes.json();
     const updated = {
       ...record3,
       accessToken: body.accessToken,
@@ -7666,6 +7892,37 @@ var AuthManager = class {
     timer.unref?.();
     this.proactiveTimer = timer;
   }
+  /**
+   * Bounds one complete auth exchange rather than fetch alone. Keeping the
+   * controller active through `json()`/`text()` makes a non-cooperative or
+   * partial response body cancellable by the same authority that owns fetch.
+   */
+  async runRequest(operation) {
+    if (this.stopped) throw new AuthRequestAbortedError("stopped");
+    const controller = new AbortController();
+    this.activeRequest = controller;
+    let deadlineElapsed = false;
+    const deadline = setTimeout(() => {
+      deadlineElapsed = true;
+      controller.abort();
+    }, this.requestDeadlineMs);
+    let rejectOnAbort;
+    const aborted = new Promise((_, reject) => {
+      rejectOnAbort = reject;
+    });
+    const onAbort = () => rejectOnAbort(new AuthRequestAbortedError(deadlineElapsed ? "deadline" : "stopped"));
+    controller.signal.addEventListener("abort", onAbort, { once: true });
+    try {
+      return await Promise.race([operation(controller.signal), aborted]);
+    } catch (error) {
+      if (controller.signal.aborted) throw new AuthRequestAbortedError(deadlineElapsed ? "deadline" : "stopped");
+      throw error;
+    } finally {
+      clearTimeout(deadline);
+      controller.signal.removeEventListener("abort", onAbort);
+      if (this.activeRequest === controller) this.activeRequest = void 0;
+    }
+  }
   async runCredentialMutation(operation) {
     const predecessor = this.credentialMutationTail;
     let release;
@@ -7708,6 +7965,13 @@ function resolvePairExpiry(refreshHint) {
   }
   return new Date(Date.now() + ASSUMED_PAIR_TOKEN_TTL_MS).toISOString();
 }
+function resolveRequestDeadlineMs(value) {
+  const deadline = value ?? DEFAULT_AUTH_REQUEST_DEADLINE_MS;
+  if (!Number.isSafeInteger(deadline) || deadline <= 0) {
+    throw new Error("authRequestDeadlineMs must be a positive safe integer");
+  }
+  return deadline;
+}
 async function safeErrorText(res) {
   try {
     return await res.text();
@@ -7729,37 +7993,48 @@ function withAuth(init, token) {
 }
 
 // src/daemon/blob-client.ts
-async function safeErrorText2(res) {
-  try {
-    return await res.text();
-  } catch {
-    return "";
+var BlobRequestAbortedError = class extends Error {
+  constructor(reason) {
+    super(reason === "deadline" ? "blob request deadline elapsed" : "blob request cancelled");
+    this.reason = reason;
+    this.name = "BlobRequestAbortedError";
   }
-}
+  reason;
+};
 var BlobClient = class {
-  constructor(serverUrl, auth) {
+  constructor(serverUrl, auth, options = {}) {
     this.serverUrl = serverUrl;
     this.auth = auth;
+    this.options = options;
+    const requestDeadlineMs = options.requestDeadlineMs ?? 15e3;
+    if (!Number.isSafeInteger(requestDeadlineMs) || requestDeadlineMs <= 0) {
+      throw new Error("BlobClient requestDeadlineMs must be a positive safe integer");
+    }
+    this.requestDeadlineMs = requestDeadlineMs;
   }
   serverUrl;
   auth;
+  options;
+  requestDeadlineMs;
   /** `blobRef` -> `GET /byok/blobs/:id/url` -> fetch the presigned download URL -> text content. Always resolves fresh rather than trusting any inlined `BlobRef.url`, per docs/protocol.md §7. */
-  async resolveInstruction(blobRef) {
+  async resolveInstruction(blobRef, options = {}) {
     const base = toHttpBase(this.serverUrl);
-    const urlRes = await authedFetch(
-      new URL(byokBlobUrlPath(blobRef.blobId), base),
-      { method: "GET" },
-      this.auth
+    const urlRes = await this.#request(
+      (signal) => authedFetch(new URL(byokBlobUrlPath(blobRef.blobId), base), { method: "GET", signal }, this.auth),
+      options.signal
     );
     if (!urlRes.ok) {
-      throw new Error(`failed to resolve blob download url: HTTP ${urlRes.status} ${await safeErrorText2(urlRes)}`.trimEnd());
+      throw new Error(`failed to resolve blob download url: HTTP ${urlRes.status} ${await this.#safeErrorText(urlRes, options.signal)}`.trimEnd());
+    }
+    const { downloadUrl } = await this.#readJson(urlRes, options.signal);
+    if (typeof downloadUrl !== "string" || downloadUrl.length === 0) {
+      throw new Error("failed to resolve blob download url: response omitted downloadUrl");
     }
-    const { downloadUrl } = await urlRes.json();
-    const contentRes = await fetch(new URL(downloadUrl, base));
+    const contentRes = await this.#request((signal) => fetch(new URL(downloadUrl, base), { signal }), options.signal);
     if (!contentRes.ok) {
       throw new Error(`failed to download blob content: HTTP ${contentRes.status}`);
     }
-    const bytes = new Uint8Array(await contentRes.arrayBuffer());
+    const bytes = await this.#readBody(contentRes, options.signal);
     const observedHash = `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
     if (observedHash !== blobRef.contentHash || bytes.length !== blobRef.size) {
       throw new Error(
@@ -7768,63 +8043,71 @@ var BlobClient = class {
     }
     return new TextDecoder().decode(bytes);
   }
-  /** `POST /byok/blobs` (declares size/contentType/contentHash) -> PUT the bytes to the presigned upload URL -> a `BlobRef` for `task.artifact.blobRef`. */
+  /** `POST /byok/blobs` -> PUT the bytes to the presigned URL -> finalize into a `BlobRef`. */
   async uploadArtifact(content, contentType, options = {}) {
     const bytes = typeof content === "string" ? new TextEncoder().encode(content) : content;
     const contentHash4 = `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
     const base = toHttpBase(this.serverUrl);
     const reservationId = options.idempotencyKey ?? `blob_${randomUUID()}`;
-    const createRes = await authedFetch(
-      new URL(BYOK_BLOBS_PATH, base),
-      {
-        method: "POST",
-        headers: {
-          "content-type": "application/json",
-          "idempotency-key": reservationId
+    const createRes = await this.#request(
+      (signal) => authedFetch(
+        new URL(BYOK_BLOBS_PATH, base),
+        {
+          method: "POST",
+          headers: { "content-type": "application/json", "idempotency-key": reservationId },
+          body: JSON.stringify({ size: bytes.length, contentType, contentHash: contentHash4 }),
+          signal
         },
-        body: JSON.stringify({ size: bytes.length, contentType, contentHash: contentHash4 })
-      },
-      this.auth
+        this.auth
+      ),
+      options.signal
     );
     if (!createRes.ok) {
-      throw new Error(`failed to create blob: HTTP ${createRes.status} ${await safeErrorText2(createRes)}`.trimEnd());
+      throw new Error(`failed to create blob: HTTP ${createRes.status} ${await this.#safeErrorText(createRes, options.signal)}`.trimEnd());
+    }
+    const { blobId, uploadUrl } = await this.#readJson(createRes, options.signal);
+    if (typeof blobId !== "string" || blobId.length === 0 || typeof uploadUrl !== "string" || uploadUrl.length === 0) {
+      throw new Error("failed to create blob: response omitted blobId or uploadUrl");
     }
-    const { blobId, uploadUrl } = await createRes.json();
     const blobRef = { blobId, contentHash: contentHash4, size: bytes.length, contentType };
-    if (options.idempotencyKey !== void 0 && await this.#hasExactCommittedBlob(base, blobRef)) {
+    if (options.idempotencyKey !== void 0 && await this.#hasExactCommittedBlob(base, blobRef, options.signal)) {
       return blobRef;
     }
-    const putRes = await fetch(new URL(uploadUrl, base), {
-      method: "PUT",
-      headers: { "content-type": contentType },
-      body: bytes
-    });
+    const putRes = await this.#request(
+      (signal) => fetch(new URL(uploadUrl, base), {
+        method: "PUT",
+        headers: { "content-type": contentType },
+        body: bytes,
+        signal
+      }),
+      options.signal
+    );
     if (!putRes.ok) {
       throw new Error(`failed to upload blob content: HTTP ${putRes.status}`);
     }
-    await this.#finalize(base, blobId, reservationId);
+    this.#throwIfAborted(options.signal);
+    await this.#finalize(base, blobId, reservationId, options.signal);
     return blobRef;
   }
-  async #hasExactCommittedBlob(base, blobRef) {
-    const urlRes = await authedFetch(
-      new URL(byokBlobUrlPath(blobRef.blobId), base),
-      { method: "GET" },
-      this.auth
+  async #hasExactCommittedBlob(base, blobRef, signal) {
+    const urlRes = await this.#request(
+      (requestSignal) => authedFetch(new URL(byokBlobUrlPath(blobRef.blobId), base), { method: "GET", signal: requestSignal }, this.auth),
+      signal
     );
     if (urlRes.status === 404) return false;
     if (!urlRes.ok) {
-      throw new Error(`failed to read back idempotent blob: HTTP ${urlRes.status} ${await safeErrorText2(urlRes)}`.trimEnd());
+      throw new Error(`failed to read back idempotent blob: HTTP ${urlRes.status} ${await this.#safeErrorText(urlRes, signal)}`.trimEnd());
     }
-    const { downloadUrl } = await urlRes.json();
+    const { downloadUrl } = await this.#readJson(urlRes, signal);
     if (typeof downloadUrl !== "string" || downloadUrl.length === 0) {
       throw new Error("failed to read back idempotent blob: response omitted downloadUrl");
     }
-    const contentRes = await fetch(new URL(downloadUrl, base));
+    const contentRes = await this.#request((requestSignal) => fetch(new URL(downloadUrl, base), { signal: requestSignal }), signal);
     if (contentRes.status === 404) return false;
     if (!contentRes.ok) {
       throw new Error(`failed to read back idempotent blob content: HTTP ${contentRes.status}`);
     }
-    const bytes = new Uint8Array(await contentRes.arrayBuffer());
+    const bytes = await this.#readBody(contentRes, signal);
     const observedHash = `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
     if (observedHash !== blobRef.contentHash || bytes.length !== blobRef.size) {
       throw new Error(
@@ -7833,18 +8116,19 @@ var BlobClient = class {
     }
     return true;
   }
-  async #finalize(base, blobId, reservationId) {
+  async #finalize(base, blobId, reservationId, signal) {
     let lastFailure;
     for (let attempt = 1; attempt <= 2; attempt += 1) {
+      this.#throwIfAborted(signal);
       let response;
       try {
-        response = await authedFetch(
-          new URL(byokBlobFinalizePath(blobId), base),
-          {
-            method: "POST",
-            headers: { "idempotency-key": reservationId }
-          },
-          this.auth
+        response = await this.#request(
+          (requestSignal) => authedFetch(
+            new URL(byokBlobFinalizePath(blobId), base),
+            { method: "POST", headers: { "idempotency-key": reservationId }, signal: requestSignal },
+            this.auth
+          ),
+          signal
         );
       } catch (error) {
         lastFailure = error;
@@ -7854,13 +8138,105 @@ var BlobClient = class {
       if (response.ok) return;
       if (response.status < 500 || attempt === 2) {
         throw new Error(
-          `failed to finalize blob: HTTP ${response.status} ${await safeErrorText2(response)}`.trimEnd()
+          `failed to finalize blob: HTTP ${response.status} ${await this.#safeErrorText(response, signal)}`.trimEnd()
         );
       }
       lastFailure = new Error(`failed to finalize blob: HTTP ${response.status}`);
     }
     throw lastFailure;
   }
+  async #readJson(res, signal) {
+    return JSON.parse(await this.#readText(res, signal));
+  }
+  async #safeErrorText(res, signal) {
+    try {
+      return await this.#readText(res, signal);
+    } catch (error) {
+      if (error instanceof BlobRequestAbortedError) throw error;
+      return "";
+    }
+  }
+  async #readText(res, signal) {
+    return new TextDecoder().decode(await this.#readBody(res, signal));
+  }
+  /**
+   * `Response.arrayBuffer()` only leaves cancellation observable through the
+   * Fetch implementation. Read the body directly so our lifecycle/deadline
+   * authority cancels the actual stream even when a fetch implementation has
+   * already resolved at headers.
+   */
+  async #readBody(res, signal) {
+    return this.#request(async (requestSignal) => {
+      if (res.body === null) return new Uint8Array();
+      const reader = res.body.getReader();
+      const cancelBody = () => {
+        void reader.cancel().catch(() => void 0);
+      };
+      requestSignal.addEventListener("abort", cancelBody, { once: true });
+      try {
+        const chunks = [];
+        let length = 0;
+        for (; ; ) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          chunks.push(value);
+          length += value.byteLength;
+        }
+        const bytes = new Uint8Array(length);
+        let offset = 0;
+        for (const chunk of chunks) {
+          bytes.set(chunk, offset);
+          offset += chunk.byteLength;
+        }
+        return bytes;
+      } finally {
+        requestSignal.removeEventListener("abort", cancelBody);
+        reader.releaseLock();
+      }
+    }, signal);
+  }
+  #throwIfAborted(signal) {
+    if (this.options.signal?.aborted || signal?.aborted) {
+      throw new BlobRequestAbortedError("cancelled");
+    }
+  }
+  async #request(request, signal) {
+    this.#throwIfAborted(signal);
+    const controller = new AbortController();
+    let abortReason = "cancelled";
+    const abort = (reason) => {
+      if (controller.signal.aborted) return;
+      abortReason = reason;
+      controller.abort();
+    };
+    const inheritedSignals = [this.options.signal, signal].filter((value) => value !== void 0);
+    const abortForCancellation = () => abort("cancelled");
+    for (const inheritedSignal of inheritedSignals) {
+      inheritedSignal.addEventListener("abort", abortForCancellation, { once: true });
+    }
+    const deadline = setTimeout(() => abort("deadline"), this.requestDeadlineMs);
+    deadline.unref?.();
+    let rejectAbort = () => {
+    };
+    const aborted = new Promise((_resolve, reject) => {
+      rejectAbort = reject;
+    });
+    const rejectOnAbort = () => rejectAbort(new BlobRequestAbortedError(abortReason));
+    controller.signal.addEventListener("abort", rejectOnAbort, { once: true });
+    try {
+      return await Promise.race([request(controller.signal), aborted]);
+    } catch (error) {
+      if (error instanceof BlobRequestAbortedError) throw error;
+      if (controller.signal.aborted) throw new BlobRequestAbortedError(abortReason);
+      throw error;
+    } finally {
+      clearTimeout(deadline);
+      controller.signal.removeEventListener("abort", rejectOnAbort);
+      for (const inheritedSignal of inheritedSignals) {
+        inheritedSignal.removeEventListener("abort", abortForCancellation);
+      }
+    }
+  }
 };
 var DEFAULT_TIMEOUT_MS2 = 2e3;
 var DARWIN_UUID_RE = /"IOPlatformUUID"\s*=\s*"([^"]+)"/u;
@@ -8107,6 +8483,7 @@ var AnotherControlServerRunningError = class extends Error {
   }
 };
 var MAX_HALF_OPEN_CONNECTIONS = 8;
+var MAX_OUTBOUND_QUEUE_BYTES = 1024 * 1024;
 function errorMessage5(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -8183,11 +8560,12 @@ async function bindControlEndpoint(server, endpoint) {
 }
 function handleConnection(socket, token, methods, handshakeTimeoutMs, onHandshakeSettled) {
   const reader = new NdjsonLineReader();
-  const activeStreams = /* @__PURE__ */ new Map();
+  const activeRequests = /* @__PURE__ */ new Map();
   let phase = "client-hello";
   let serverNonce = "";
   let destroyed = false;
   let handshakeSettled = false;
+  let disposeOutboundWriter;
   function settleHandshake() {
     if (handshakeSettled) return;
     handshakeSettled = true;
@@ -8197,8 +8575,83 @@ function handleConnection(socket, token, methods, handshakeTimeoutMs, onHandshak
     if (phase !== "ready") socket.destroy();
   }, handshakeTimeoutMs);
   handshakeTimer.unref?.();
+  function terminateConnection() {
+    if (destroyed) return;
+    destroyed = true;
+    clearTimeout(handshakeTimer);
+    settleHandshake();
+    disposeOutboundWriter?.();
+    const requests = [...activeRequests.values()];
+    activeRequests.clear();
+    for (const request of requests) {
+      if (request.kind === "stream" && !request.controller.signal.aborted) request.controller.abort();
+    }
+    if (!socket.destroyed) socket.destroy();
+  }
+  const queuedFrames = [];
+  let queuedBytes = 0;
+  let blocked = false;
+  let terminal = false;
+  let drainListening = false;
+  function disposeQueuedFrames() {
+    terminal = true;
+    blocked = false;
+    queuedFrames.length = 0;
+    queuedBytes = 0;
+    if (drainListening) {
+      socket.removeListener("drain", onDrain);
+      drainListening = false;
+    }
+  }
+  function waitForDrain() {
+    if (drainListening || terminal) return;
+    drainListening = true;
+    socket.once("drain", onDrain);
+  }
+  function writeEncodedFrame(encoded) {
+    if (terminal) return;
+    if (!socket.writable) {
+      terminateConnection();
+      return;
+    }
+    try {
+      if (!socket.write(encoded)) {
+        blocked = true;
+        waitForDrain();
+      }
+    } catch {
+      terminateConnection();
+    }
+  }
+  function onDrain() {
+    drainListening = false;
+    if (terminal) return;
+    blocked = false;
+    while (!blocked && queuedFrames.length > 0) {
+      const frame = queuedFrames.shift();
+      queuedBytes -= frame.bytes;
+      writeEncodedFrame(frame.encoded);
+    }
+  }
+  disposeOutboundWriter = disposeQueuedFrames;
   function sendFrame(frame) {
-    if (!destroyed && socket.writable) socket.write(encodeFrame(frame));
+    if (destroyed || terminal) return;
+    const encoded = encodeFrame(frame);
+    const bytes = Buffer.byteLength(encoded);
+    if (bytes > MAX_OUTBOUND_QUEUE_BYTES) {
+      terminateConnection();
+      return;
+    }
+    if (blocked) {
+      if (queuedBytes + bytes > MAX_OUTBOUND_QUEUE_BYTES) {
+        terminateConnection();
+        return;
+      }
+      queuedFrames.push({ encoded, bytes });
+      queuedBytes += bytes;
+      return;
+    }
+    writeEncodedFrame(encoded);
   }
   function handleClientHello(parsed) {
     const hello = parseClientHello(parsed);
@@ -8221,21 +8674,51 @@ function handleConnection(socket, token, methods, handshakeTimeoutMs, onHandshak
     settleHandshake();
     sendFrame({ v: 1, ready: true });
   }
+  function rejectDuplicateRequest(id) {
+    sendFrame({
+      v: 1,
+      id,
+      ok: false,
+      error: { code: "duplicate_request_id", message: `request id "${id}" is already active` }
+    });
+  }
+  function registerRequest(id, record3) {
+    if (activeRequests.has(id)) {
+      rejectDuplicateRequest(id);
+      return false;
+    }
+    activeRequests.set(id, record3);
+    return true;
+  }
+  function releaseRequest(id, record3) {
+    if (activeRequests.get(id) !== record3) return false;
+    activeRequests.delete(id);
+    return true;
+  }
   function dispatch(id, method, params) {
     const unary = methods.unary[method];
     if (unary) {
-      Promise.resolve().then(() => unary(params)).then((result) => sendFrame({ v: 1, id, ok: true, result })).catch((err) => sendFrame({ v: 1, id, ok: false, error: toControlErrorShape(err) }));
+      const record3 = { kind: "unary" };
+      if (!registerRequest(id, record3)) return;
+      Promise.resolve().then(() => unary(params)).then((result) => {
+        if (!releaseRequest(id, record3)) return;
+        sendFrame({ v: 1, id, ok: true, result });
+      }).catch((err) => {
+        if (!releaseRequest(id, record3)) return;
+        sendFrame({ v: 1, id, ok: false, error: toControlErrorShape(err) });
+      });
       return;
     }
     const stream = methods.stream[method];
     if (stream) {
       const controller = new AbortController();
-      activeStreams.set(id, controller);
-      stream(params, { emit: (event) => sendFrame({ v: 1, id, event }), signal: controller.signal }).then(() => {
-        activeStreams.delete(id);
+      const record3 = { kind: "stream", controller };
+      if (!registerRequest(id, record3)) return;
+      Promise.resolve().then(() => stream(params, { emit: (event) => sendFrame({ v: 1, id, event }), signal: controller.signal })).then(() => {
+        if (!releaseRequest(id, record3)) return;
         if (!controller.signal.aborted) sendFrame({ v: 1, id, ok: true, done: true });
       }).catch((err) => {
-        activeStreams.delete(id);
+        if (!releaseRequest(id, record3)) return;
         sendFrame({ v: 1, id, ok: false, error: toControlErrorShape(err) });
       });
       return;
@@ -8277,13 +8760,10 @@ function handleConnection(socket, token, methods, handshakeTimeoutMs, onHandshak
     for (const line of lines) handleLine(line);
   });
   socket.on("error", () => {
+    terminateConnection();
   });
   socket.on("close", () => {
-    destroyed = true;
-    clearTimeout(handshakeTimer);
-    settleHandshake();
-    for (const controller of activeStreams.values()) controller.abort();
-    activeStreams.clear();
+    terminateConnection();
   });
 }
 async function startControlServer(opts) {
@@ -9201,6 +9681,20 @@ function createFleetJitter(productId, deviceId) {
     delay: (domain, sequence, baseMs) => deterministicJitterMs({ seed, domain, sequence, baseMs })
   };
 }
+
+// src/daemon/replay-cursor.ts
+var ReplayCursorTooOldError = class extends Error {
+  constructor(recoverableFrom) {
+    super(
+      recoverableFrom === void 0 ? "server cannot replay the acknowledged cursor; re-pair or operator recovery is required" : `server cannot replay the acknowledged cursor; retained history starts at ${recoverableFrom}`
+    );
+    this.recoverableFrom = recoverableFrom;
+    this.name = "ReplayCursorTooOldError";
+  }
+  recoverableFrom;
+};
+
+// src/daemon/long-poll-transport.ts
 var LongPollRouteError = class extends Error {
   constructor(endpoint, status, cause) {
     super(
@@ -9380,6 +9874,12 @@ var LongPollClient = class {
           throw err;
         }
         if (!res.ok) {
+          const replayCursorTooOld = await parseReplayCursorTooOld(res);
+          if (replayCursorTooOld) {
+            this.running = false;
+            this.opts.onReplayCursorTooOld?.(replayCursorTooOld);
+            return;
+          }
           this.warnRouteFailure(this.eventsEndpoint, res.status, void 0);
           this.opts.onServerCapabilities?.([]);
           this.opts.onOperationalOutcome?.("failure");
@@ -9448,6 +9948,21 @@ var LongPollClient = class {
     }
   }
 };
+async function parseReplayCursorTooOld(res) {
+  if (res.status !== 409) return void 0;
+  let body;
+  try {
+    body = await res.json();
+  } catch {
+    return void 0;
+  }
+  if (typeof body !== "object" || body === null) return void 0;
+  const { error, recoverableFrom } = body;
+  if (error !== "cursor_too_old" || typeof recoverableFrom !== "number" || !Number.isSafeInteger(recoverableFrom) || recoverableFrom < 0) {
+    return void 0;
+  }
+  return new ReplayCursorTooOldError(recoverableFrom);
+}
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -9592,16 +10107,17 @@ var WsTransport = class {
       }
       this.opts.onEnvelope(envelope);
     });
-    socket.on("close", () => {
+    socket.on("close", (code, reason) => {
       this.socket = void 0;
       this.stopLivenessCheck();
       this.opts.onStateChange?.("closed");
       const acked = this.everAckedThisAttempt;
       const status = this.lastUnexpectedStatus;
       this.lastUnexpectedStatus = void 0;
+      const replayCursorTooOld = code === 1008 && reason.toString("utf8") === "cursor_too_old" ? new ReplayCursorTooOldError() : void 0;
       this.opts.onConnectOutcome?.(
         acked,
-        status !== void 0 ? new WsUnexpectedStatusError(status, endpoint) : void 0,
+        replayCursorTooOld ?? (status !== void 0 ? new WsUnexpectedStatusError(status, endpoint) : void 0),
         endpoint
       );
       if (!this.closedByUser && this.autoReconnect) this.scheduleReconnect();
@@ -9687,6 +10203,7 @@ var ConnectionManager = class {
         if (this.mode === "long-poll") this.serverCapabilities = capabilities;
       },
       onRevoked: () => this.enterRevoked(),
+      onReplayCursorTooOld: (error) => this.enterReplayCursorTooOld(error),
       // M4 Phase 4 (version-negotiation drill fix): a batch entry
       // LongPollClient couldn't parse into a known Envelope at all (an
       // unrecognized message type) still needs its cursor/watermark
@@ -9775,6 +10292,7 @@ var ConnectionManager = class {
   draining = false;
   stopped = false;
   revoked = false;
+  terminalError;
   settledWaiters = [];
   pendingCursorSave = Promise.resolve();
   /**
@@ -9847,6 +10365,7 @@ var ConnectionManager = class {
    */
   serverCapabilities = [];
   async start() {
+    if (this.terminalError) throw this.terminalError;
     this.cursor = await this.opts.cursorStore.load(this.opts.serverUrl, this.opts.deviceId);
     this.ws.connect({ auto: true });
   }
@@ -9962,6 +10481,12 @@ var ConnectionManager = class {
   getServerCapabilities() {
     return this.serverCapabilities;
   }
+  getTerminalError() {
+    return this.terminalError;
+  }
+  getMode() {
+    return this.mode;
+  }
   isConnected() {
     return this.mode === "ws" && this.ws.isOpen;
   }
@@ -9982,6 +10507,7 @@ var ConnectionManager = class {
    */
   waitForAck(timeoutMs = 1e4) {
     if (this.ws.isOpen || this.mode === "long-poll") return Promise.resolve();
+    if (this.terminalError) return Promise.reject(this.terminalError);
     if (this.revoked) return Promise.reject(new DeviceRevokedError());
     return new Promise((resolve, reject) => {
       let settle = () => {
@@ -10310,6 +10836,7 @@ var ConnectionManager = class {
    * (which is close-only) at all.
    */
   onAcked(capabilities) {
+    if (this.terminalError) return;
     this.serverCapabilities = capabilities;
     this.consecutiveFailures = 0;
     this.notifySettled();
@@ -10318,6 +10845,10 @@ var ConnectionManager = class {
     void this.drainOutbox();
   }
   onWsOutcome(acked, err) {
+    if (err instanceof ReplayCursorTooOldError) {
+      this.enterReplayCursorTooOld(err);
+      return;
+    }
     if (this.stopped || this.revoked) return;
     if (acked) this.serverCapabilities = [];
     if (err instanceof WsUnexpectedStatusError && err.status === 401) {
@@ -10354,6 +10885,20 @@ var ConnectionManager = class {
     void this.drainOutbox();
     this.scheduleWsProbe();
   }
+  enterReplayCursorTooOld(error) {
+    if (this.terminalError) return;
+    this.terminalError = error;
+    this.stopped = true;
+    this.serverCapabilities = [];
+    if (this.wsRetryTimer) clearInterval(this.wsRetryTimer);
+    this.longPoll.stop();
+    this.ws.stopAutoReconnect();
+    this.ws.close();
+    this.cancelPendingDrainRetry?.();
+    this.notifySettled(error);
+    this.opts.onStateChange?.("closed");
+    this.opts.onTerminalError?.(error);
+  }
   exitLongPoll() {
     if (this.wsRetryTimer) {
       clearInterval(this.wsRetryTimer);
@@ -13083,21 +13628,28 @@ async function recordAuditWarning(context, kind, values) {
   }
 }
 var agentMemoryHomeQueues = /* @__PURE__ */ new Map();
-async function exclusiveAgentMemoryHome(home, fn) {
-  const previous = agentMemoryHomeQueues.get(home) ?? Promise.resolve();
+var agentMemoryProjectionTransactionQueues = /* @__PURE__ */ new Map();
+async function exclusiveAgentMemoryHomeQueue(queues2, home, fn) {
+  const previous = queues2.get(home) ?? Promise.resolve();
   let release;
   const next = new Promise((resolve) => {
     release = resolve;
   });
-  agentMemoryHomeQueues.set(home, next);
+  queues2.set(home, next);
   await previous;
   try {
     return await fn();
   } finally {
     release();
-    if (agentMemoryHomeQueues.get(home) === next) agentMemoryHomeQueues.delete(home);
+    if (queues2.get(home) === next) queues2.delete(home);
   }
 }
+async function exclusiveAgentMemoryHome(home, fn) {
+  return exclusiveAgentMemoryHomeQueue(agentMemoryHomeQueues, home, fn);
+}
+async function exclusiveAgentMemoryProjectionTransaction(home, fn) {
+  return exclusiveAgentMemoryHomeQueue(agentMemoryProjectionTransactionQueues, home, fn);
+}
 var AgentMemoryService = class {
   constructor(input) {
     this.input = input;
@@ -13401,13 +13953,16 @@ var AgentMemoryRedactedOutbox = class _AgentMemoryRedactedOutbox {
 async function snapshotAndProjectAgentMemory(input, projection) {
   if (projection?.capability !== AGENT_MEMORY_PROJECTION_CAPABILITY || !projection.grant || !projection.redactor || !projection.port) return;
   const context = taskContext(input);
-  const outbox = await AgentMemoryRedactedOutbox.open(context, projection.grant);
-  const initialReplay = await outbox.replay(projection.port);
-  if (initialReplay.status === "pending") throw new AgentMemoryProjectionReplayPendingError(initialReplay);
-  const snapshot = await captureAgentMemorySnapshot(context);
-  await outbox.append(redactedBytes(snapshot, await projection.redactor.redact(snapshot)));
-  const trailingReplay = await outbox.replay(projection.port);
-  if (trailingReplay.status === "pending") throw new AgentMemoryProjectionReplayPendingError(trailingReplay);
+  const { grant, redactor, port } = projection;
+  await exclusiveAgentMemoryProjectionTransaction(context.canonicalHome, async () => {
+    const outbox = await AgentMemoryRedactedOutbox.open(context, grant);
+    const initialReplay = await outbox.replay(port);
+    if (initialReplay.status === "pending") throw new AgentMemoryProjectionReplayPendingError(initialReplay);
+    const snapshot = await captureAgentMemorySnapshot(context);
+    await outbox.append(redactedBytes(snapshot, await redactor.redact(snapshot)));
+    const trailingReplay = await outbox.replay(port);
+    if (trailingReplay.status === "pending") throw new AgentMemoryProjectionReplayPendingError(trailingReplay);
+  });
 }
 var AGENT_MEMORY_FILESYSTEM_HELPER_PROTOCOL = 2;
 var AGENT_MEMORY_FILESYSTEM_HELPER_VERSION = "2";
@@ -13815,6 +14370,7 @@ var TaskRunner = class {
   deps;
   tasks = /* @__PURE__ */ new Map();
   pendingMessageTasks = /* @__PURE__ */ new Map();
+  messageOutboxesByHome = /* @__PURE__ */ new Map();
   messageContextByToken = /* @__PURE__ */ new Map();
   messageContextByTask = /* @__PURE__ */ new Map();
   memoryContextByToken = /* @__PURE__ */ new Map();
@@ -13875,6 +14431,8 @@ var TaskRunner = class {
    * costs nothing.
    */
   inFlightOffers = /* @__PURE__ */ new Set();
+  /** Blob I/O before an offer becomes an active task still belongs to that offer's cancellation authority. */
+  inFlightBlobAborts = /* @__PURE__ */ new Map();
   /**
    * Finding P2 (Fix 2c): taskIds that have reached a terminal outcome
    * (Complete/Failed/Cancelled) this session — populated in `finish()`.
@@ -14001,6 +14559,7 @@ var TaskRunner = class {
   async recoverAgentMessageOutboxes(agentsRoot) {
     if (this.deps.tenantId === void 0) throw new Error("Agent message recovery requires authenticated tenant enrollment");
     for (const outbox of await AgentMessageOutbox.recover(agentsRoot, this.deps.tenantId)) {
+      this.messageOutboxesByHome.set(outbox.homeDir, Promise.resolve(outbox));
       for (const record3 of outbox.retryableRecords()) {
         if (record3.sessionRef === void 0) continue;
         const existing = this.recoveredMessageOutboxes.get(record3.taskId);
@@ -14009,6 +14568,16 @@ var TaskRunner = class {
       }
     }
   }
+  agentMessageOutbox(homeDir) {
+    const existing = this.messageOutboxesByHome.get(homeDir);
+    if (existing !== void 0) return existing;
+    const opened = AgentMessageOutbox.open(homeDir);
+    this.messageOutboxesByHome.set(homeDir, opened);
+    void opened.catch(() => {
+      if (this.messageOutboxesByHome.get(homeDir) === opened) this.messageOutboxesByHome.delete(homeDir);
+    });
+    return opened;
+  }
   /** Retry stable recovered records after a transport handshake/re-handshake. */
   retryRecoveredAgentMessages() {
     for (const [taskId, outbox] of this.recoveredMessageOutboxes) {
@@ -14164,6 +14733,7 @@ var TaskRunner = class {
     if (active.finalizationStarted) return this.finish(active.taskId);
     if (!this.reserveSemanticTerminal(active)) return active.semanticTerminalSettled ?? false;
     active.beingTornDown = true;
+    active.blobAbort.abort();
     await this.observeGit(active, "salvage");
     const timeoutMs = this.deps.shutdownInterruptTimeoutMs ?? DEFAULT_SHUTDOWN_INTERRUPT_TIMEOUT_MS;
     await raceSettleFirst(() => active.session.interrupt(), timeoutMs);
@@ -14310,6 +14880,8 @@ var TaskRunner = class {
       return;
     }
     this.inFlightOffers.add(taskId);
+    const blobAbort = new AbortController();
+    this.inFlightBlobAborts.set(taskId, blobAbort);
     let agentBinding;
     let agentLeaseTransferred = false;
     try {
@@ -14468,7 +15040,7 @@ var TaskRunner = class {
       }
       if (agentRef !== void 0) {
         try {
-          agentBinding = await this.deps.agentHome.acquire(agentRef);
+          agentBinding = await this.deps.agentHome.acquireExecution(agentRef, { taskId, sessionRef });
         } catch (error) {
           decline(
             `Agent home admission failed: ${errorMessage6(error)}`,
@@ -14503,7 +15075,7 @@ var TaskRunner = class {
           }
         }
         try {
-          await this.deps.agentHome.initialize(agentBinding);
+          await this.deps.agentHome.initializeExecution(agentBinding);
         } catch (error) {
           await agentBinding.lease.release().catch(() => {
           });
@@ -14513,7 +15085,7 @@ var TaskRunner = class {
         }
         if (messageRequirement !== void 0) {
           try {
-            const outbox = await AgentMessageOutbox.open(agentBinding.resolution.canonicalHome);
+            const outbox = await this.agentMessageOutbox(agentBinding.resolution.canonicalHome);
             this.pendingMessageTasks.set(taskId, {
               taskId,
               agentRef: agentBinding.resolution.agentRef,
@@ -14632,7 +15204,7 @@ var TaskRunner = class {
       );
       let resolvedInstruction;
       try {
-        resolvedInstruction = await this.resolveInstruction(payload.instruction);
+        resolvedInstruction = await this.resolveInstruction(payload.instruction, blobAbort.signal);
         if (plainWorkspaceNeedsResolve) workspaceDir = await this.resolveWorkspaceDir(taskId, known?.workspaceDir);
       } catch (err) {
         gitLease?.release();
@@ -14745,9 +15317,29 @@ var TaskRunner = class {
         }
         return;
       }
+      if (agentBinding !== void 0) {
+        try {
+          await agentBinding.lease.bindSession(session.sessionRef);
+        } catch (error) {
+          await session.close().catch(() => {
+          });
+          await this.failClaimedAgent(
+            taskId,
+            `Agent session execution lease could not bind the runtime session: ${errorMessage6(error)}`,
+            false,
+            {
+              binding: agentBinding,
+              runtimeId: pick.descriptor.id,
+              sessionRef: session.sessionRef
+            }
+          );
+          return;
+        }
+      }
       let active;
       active = {
         taskId,
+        blobAbort,
         egressEnabled: "egressPolicy" in payload,
         adapter: pick.adapter,
         session,
@@ -14788,15 +15380,16 @@ var TaskRunner = class {
         ...terminalProjection === void 0 ? {} : { terminalProjection }
       };
       if (agentBinding !== void 0) {
+        const binding = agentBinding;
         try {
-          await this.deps.agentSessionHandoffs.record({
-            agentRef: agentBinding.resolution.agentRef,
+          await this.deps.agentHome.mutateExecution(binding, () => this.deps.agentSessionHandoffs.record({
+            agentRef: binding.resolution.agentRef,
             taskId,
             sessionRef: session.sessionRef,
             runtimeId: pick.descriptor.id,
             cwd: workspaceDir,
-            leaseId: agentBinding.lease.leaseId
-          });
+            leaseId: binding.lease.leaseId
+          }));
         } catch (error) {
           await session.close().catch(() => {
           });
@@ -14838,6 +15431,7 @@ var TaskRunner = class {
       }
       this.deps.send(createEnvelope("task.started", {}, { taskId }));
       agentLeaseTransferred = agentBinding !== void 0;
+      this.inFlightBlobAborts.delete(taskId);
       this.tasks.set(taskId, active);
       this.pendingMessageTasks.delete(taskId);
       if (active.messageOutbox !== void 0 && activatedMessageRecord !== void 0) {
@@ -14869,6 +15463,7 @@ var TaskRunner = class {
         await agentBinding.lease.release().catch(() => {
         });
       }
+      this.inFlightBlobAborts.delete(taskId);
       this.inFlightOffers.delete(taskId);
     }
   }
@@ -15020,9 +15615,9 @@ var TaskRunner = class {
     void this.closeAgentMemoryFilesystem(taskId);
   }
   /** Protocol §7: an instruction too large to inline arrives as a `blobRef` — resolve it via the blob client rather than failing closed. */
-  async resolveInstruction(instruction) {
+  async resolveInstruction(instruction, signal) {
     if (typeof instruction === "string") return instruction;
-    return this.deps.blobClient.resolveInstruction(instruction.blobRef);
+    return this.deps.blobClient.resolveInstruction(instruction.blobRef, { signal });
   }
   /** Resolve every requested logical id locally and reject missing/colliding server authority before claim. */
   resolveMcpServers(requiredToolsets) {
@@ -15254,7 +15849,9 @@ var TaskRunner = class {
       }
     }
     try {
-      const blobRef = await this.deps.blobClient.uploadArtifact(bytes, contentType);
+      const blobRef = await this.deps.blobClient.uploadArtifact(bytes, contentType, {
+        signal: active.blobAbort.signal
+      });
       this.deps.send(createEnvelope("task.artifact", { name, contentType, blobRef }, { taskId: active.taskId }));
     } catch (err) {
       this.reportArtifactError(active, name, `failed to upload artifact "${name}": ${errorMessage6(err)}`);
@@ -15269,6 +15866,7 @@ var TaskRunner = class {
     const active = this.tasks.get(taskId);
     if (!active) {
       this.setPendingCancelled(taskId, reason);
+      this.inFlightBlobAborts.get(taskId)?.abort();
       return;
     }
     if (active.finalizationStarted) {
@@ -15279,6 +15877,7 @@ var TaskRunner = class {
       await active.semanticTerminalSettled;
       return;
     }
+    active.blobAbort.abort();
     try {
       await active.session.interrupt();
     } catch {
@@ -15778,7 +16377,7 @@ var TaskRunner = class {
   async failClaimedAgent(taskId, reason, retryable, context) {
     const agentRef = context.binding.resolution.agentRef;
     const result = await this.retryAgentTerminalEvidence(
-      () => this.deps.agentSessionHandoffs.recordTaskTerminal({
+      () => this.deps.agentHome.mutateExecution(context.binding, () => this.deps.agentSessionHandoffs.recordTaskTerminal({
         agentRef,
         taskId,
         runtimeId: context.runtimeId,
@@ -15786,7 +16385,7 @@ var TaskRunner = class {
         leaseId: context.binding.lease.leaseId,
         ...context.sessionRef === void 0 ? {} : { sessionRef: context.sessionRef },
         terminalReason: reason
-      })
+      }))
     );
     if (!result.ok) {
       this.reportAgentTerminalEvidenceFailure({
@@ -16775,6 +17374,8 @@ var AgentEgressController = class {
   options;
   latest = new AgentLatestValueState();
   spools = /* @__PURE__ */ new Map();
+  spoolOpens = /* @__PURE__ */ new Map();
+  reliableAppendTail = Promise.resolve();
   latestStatus = emptyLane();
   reliableStatus = emptyLane();
   drops = [];
@@ -16829,7 +17430,8 @@ var AgentEgressController = class {
     return latest === void 0 ? [] : Object.freeze([latest]);
   }
   async appendReliable(input) {
-    if (!this.active || this.options.tenantId === void 0) {
+    const tenantId = this.options.tenantId;
+    if (!this.active || tenantId === void 0) {
       this.noteDrop("reliable", "policy_denied", input.agentRef);
       return { ok: false, reason: "policy_denied" };
     }
@@ -16844,17 +17446,21 @@ var AgentEgressController = class {
       return { ok: false, reason: "sanitizer_rejected" };
     }
     try {
-      const spool = await this.spoolFor(input.homeDir, input.agentRef);
-      const record3 = await spool.append({
-        agentRef: input.agentRef,
-        tenantId: this.options.tenantId,
-        policyRevision: this.options.policy.policyRevision,
-        payload,
-        sessionRef: input.sessionRef,
-        ...input.taskId === void 0 ? {} : { taskId: input.taskId },
-        ...input.eventId === void 0 ? {} : { eventId: input.eventId }
-      }, this.options.policy, this.tenantPendingBytes());
-      return { ok: true, record: record3 };
+      const spoolOpen = this.spoolFor(input.homeDir, input.agentRef);
+      return await this.withAppendTail(async () => {
+        const spool = await spoolOpen;
+        this.bindSpool(input.agentRef, spool, spoolOpen);
+        const record3 = await spool.append({
+          agentRef: input.agentRef,
+          tenantId,
+          policyRevision: this.options.policy.policyRevision,
+          payload,
+          sessionRef: input.sessionRef,
+          ...input.taskId === void 0 ? {} : { taskId: input.taskId },
+          ...input.eventId === void 0 ? {} : { eventId: input.eventId }
+        }, this.options.policy, this.tenantPendingBytes());
+        return { ok: true, record: record3 };
+      });
     } catch (error) {
       const reason = error instanceof AgentReliableQuotaError ? error.reason : "backpressure";
       this.noteDrop("reliable", reason, input.agentRef);
@@ -16867,21 +17473,26 @@ var AgentEgressController = class {
    * with `wireType: agent.content.receipt` before any transport attempt.
    */
   async appendContentReceipt(input) {
-    if (!this.active || this.options.tenantId === void 0) {
+    const tenantId = this.options.tenantId;
+    if (!this.active || tenantId === void 0) {
       this.noteDrop("reliable", "policy_denied", input.agentRef);
       return { ok: false, reason: "policy_denied" };
     }
     try {
-      const spool = await this.spoolFor(input.homeDir, input.agentRef);
-      const record3 = await spool.appendContentReceipt({
-        agentRef: input.agentRef,
-        tenantId: this.options.tenantId,
-        policyRevision: this.options.policy.policyRevision,
-        sessionRef: input.payload.sessionRef,
-        payload: input.payload,
-        ...input.taskId === void 0 ? {} : { taskId: input.taskId }
-      }, this.options.policy, this.tenantPendingBytes());
-      return { ok: true, record: record3 };
+      const spoolOpen = this.spoolFor(input.homeDir, input.agentRef);
+      return await this.withAppendTail(async () => {
+        const spool = await spoolOpen;
+        this.bindSpool(input.agentRef, spool, spoolOpen);
+        const record3 = await spool.appendContentReceipt({
+          agentRef: input.agentRef,
+          tenantId,
+          policyRevision: this.options.policy.policyRevision,
+          sessionRef: input.payload.sessionRef,
+          payload: input.payload,
+          ...input.taskId === void 0 ? {} : { taskId: input.taskId }
+        }, this.options.policy, this.tenantPendingBytes());
+        return { ok: true, record: record3 };
+      });
     } catch (error) {
       const reason = error instanceof AgentReliableQuotaError ? error.reason : "backpressure";
       this.noteDrop("reliable", reason, input.agentRef);
@@ -16956,20 +17567,59 @@ var AgentEgressController = class {
     }
     return this.reliableRecords();
   }
-  async spoolFor(homeDir, agentRef) {
+  spoolFor(homeDir, agentRef) {
     const key = agentKey(agentRef);
     const existing = this.spools.get(key);
-    if (existing) return existing;
-    const spool = await AgentReliableSpool.open(homeDir);
-    if (spool.records().some((record3) => !sameAgent(record3.agentRef, agentRef))) {
-      throw new Error("Agent-local reliable spool has a different AgentRef");
+    if (existing) {
+      if (existing.homeDir !== homeDir) throw new Error("Agent reliable spool is already bound to a different home");
+      return Promise.resolve(existing);
+    }
+    const inFlight = this.spoolOpens.get(key);
+    if (inFlight !== void 0) {
+      if (inFlight.homeDir !== homeDir) throw new Error("Agent reliable spool opening is already bound to a different home");
+      return inFlight.promise;
+    }
+    const opened = (async () => {
+      const spool = await AgentReliableSpool.open(homeDir);
+      if (spool.records().some((record3) => !sameAgent(record3.agentRef, agentRef))) {
+        throw new Error("Agent-local reliable spool has a different AgentRef");
+      }
+      return spool;
+    })();
+    const slot = { homeDir, promise: opened };
+    this.spoolOpens.set(key, slot);
+    void opened.catch(() => {
+      if (this.spoolOpens.get(key) === slot) this.spoolOpens.delete(key);
+    });
+    return opened;
+  }
+  bindSpool(agentRef, spool, spoolOpen) {
+    const key = agentKey(agentRef);
+    const existing = this.spools.get(key);
+    try {
+      if (existing && existing !== spool) throw new Error("multiple Agent egress spools claim the same AgentRef");
+      this.spools.set(key, spool);
+    } finally {
+      const slot = this.spoolOpens.get(key);
+      if (slot?.promise === spoolOpen) this.spoolOpens.delete(key);
     }
-    this.spools.set(key, spool);
-    return spool;
   }
   tenantPendingBytes() {
     return this.reliableRecords().reduce((total, record3) => total + record3.byteCount, 0);
   }
+  async withAppendTail(operation) {
+    const previous = this.reliableAppendTail;
+    let release;
+    this.reliableAppendTail = new Promise((resolve) => {
+      release = resolve;
+    });
+    try {
+      await previous;
+      return await operation();
+    } finally {
+      release();
+    }
+  }
   noteDrop(lane, reason, agentRef, countDrop = true) {
     const laneStatus = lane === "latest-value" ? this.latestStatus : this.reliableStatus;
     if (countDrop) laneStatus.dropped += 1;
@@ -18241,6 +18891,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
   const observer = new DaemonObserver();
   const approvalRegistry = new ApprovalRegistry();
   let connection;
+  let blobLifecycleAbort;
   let connectionState = "closed";
   let daemonStarted = false;
   let tenantRebinding = false;
@@ -18259,6 +18910,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
   function buildAuthManager() {
     return new AuthManager({
       serverUrl: config.serverUrl,
+      authRequestDeadlineMs: config.authRequestDeadlineMs,
       store,
       deviceName: config.deviceName,
       machineId: config.machineId ?? (() => resolveMachineId({ productId: config.productId })),
@@ -18276,7 +18928,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       assertServerUrlAllowed(config.serverUrl, { dangerouslyAllowInsecureRemote: true });
       const reason = err instanceof Error ? err.message : String(err);
       console.warn(
-        `[byok/client] WARNING: dangerouslyAllowInsecureRemote is set \u2014 proceeding with an insecure server URL (${config.serverUrl}). Device credentials and task data will be sent in the clear to a non-loopback host. This should never be used in a real deployment. (${reason})`
+        `[byok/client] WARNING: dangerouslyAllowInsecureRemote is set \u2014 proceeding with an insecure server URL (${formatServerUrl(config.serverUrl)}). Device credentials and task data will be sent in the clear to a non-loopback host. This should never be used in a real deployment. (${reason})`
       );
     }
   }
@@ -18436,9 +19088,10 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         await gitWorkspaceStore?.initialize();
         await gitWorkspaceStore?.reconcile();
       }
+      blobLifecycleAbort = new AbortController();
       const [runtimes, blobClient] = await Promise.all([
         detectRuntimes(adapters),
-        Promise.resolve(new BlobClient(config.serverUrl, auth))
+        Promise.resolve(new BlobClient(config.serverUrl, auth, { signal: blobLifecycleAbort.signal }))
       ]);
       observer.noteRuntimesDetected(runtimes);
       detectedRuntimeFacts = runtimes;
@@ -18867,6 +19520,8 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
   }
   async function runShutdownSequence(reason, opts = {}) {
     shuttingDown = true;
+    blobLifecycleAbort?.abort();
+    blobLifecycleAbort = void 0;
     const errors = [];
     let mutationBarrierComplete = hostedStorageInitializationBarrierComplete;
     if (!hostedStorageInitializationBarrierComplete) {
@@ -20687,6 +21342,6 @@ function createServiceLifecycle(def, opts = {}) {
   }
 }
 
-export { AGENT_CONTENT_READ_CAPABILITIES, AGENT_CONTENT_READ_CAPABILITY_ARTIFACT, AGENT_CONTENT_READ_CAPABILITY_TRANSCRIPT, AGENT_CONTENT_READ_CAPABILITY_WORKSPACE, AGENT_HOME_PROJECTION_STATE_FILE, AGENT_MEMORY_AUDIT_FILENAME, AGENT_MEMORY_OUTBOX_FILENAME, AgentHomeBusyError, AgentHomeCollisionError, AgentHomeError, AgentHomeLayout, AgentHomeLeaseCorruptError, AgentHomeLeaseManager, AgentHomeManager, AgentHomeResolutionError, AgentMemoryError, AgentMemoryRevisionConflictError, AgentRefValidationError, AgentSessionHandoffCorruptError, AgentSessionHandoffMismatchError, AgentSessionHandoffStore, AgentSessionHandoffStoreError, BYOK_SDK_HELPER_SUBCOMMAND, BlobClient, ClaudeAdapter, CodexAdapter, DEFAULT_ACK_CRITICAL_RESERVE_BYTES, DEFAULT_CLEANUP_BATCH_LIMIT, DEFAULT_HARD_BUDGET_RATIO, DEFAULT_INCREMENTAL_VACUUM_PAGES, DEFAULT_LOG_ROTATION, DEFAULT_NORMAL_COMPACTION_INTERVAL_MS, DEFAULT_PRESSURE_COMPACTION_INTERVAL_MS, DEFAULT_RETENTION_MS, DEFAULT_SOFT_BUDGET_RATIO, DaemonObserver, GitWorkspaceError, GitWorkspaceManager, GitWorkspaceStore, JOURNAL_DB_FILENAME, JOURNAL_QUARANTINE_DIRNAME, JOURNAL_TASK_REF_PREFIX, JournalClosedError, JournalCorruptError, JournalRecordTooLargeError, JournalUnavailableError, JournalUnknownTaskError, LocalStateRelocationBusyError, LocalStateRelocationError, LocalStateRelocationIntegrityError, LocalStorageEmergencyError, LocalStoragePolicyError, LocalStoragePressureEngine, LocalTeamWorkspace, LocalTeamWorkspace as LocalTeamWorkspaceService, McpToolsetDefinitionRevisionConflictError, McpToolsetRevisionConflictError, PI_PACKAGE_NAME, PiAdapter, PolicyUnsupportedError, RUNTIME_ADAPTER_CONTRACT_VIOLATION_REASON, RuntimeDisposalFailure, RuntimeExecutionFailure, SKILL_PACKS_CAPABILITY, SKILL_PACKS_DIRNAME, SKILL_PACK_AUDIT_FILENAME, SKILL_PACK_INSTALL_ERROR_CODES, SKILL_PACK_LOCK_FILENAME, SKILL_PACK_LOCK_SCHEMA, SKILL_PACK_RESPONSE_MAX_BYTES, SecureDirHardeningError, SkillPackInstallError, SqliteLocalTaskJournal, SteerUnsupportedError, TeamTmuxViewError, TeamWorkspaceConflictError, TeamWorkspaceCorruptError, TeamWorkspaceError, TeamWorkspaceLeaseError, TeamWorkspaceNotFoundError, TeamWorkspaceQuotaError, TeamWorkspaceReceiptError, TeamWorkspaceValidationError, TruthMemoryClient, TruthMemoryClientError, UnsupportedServicePlatformError, buildIcaclsArgs, cleanupEligibleAt, cleanupOrderFor, computePressureState, createAgentHomeProjection, createAgentHomeProjectionConsumer, createDaemon, createDaemonWithAdapters, createFilesystemCleanupExecutor, createServiceLifecycle, createStatfsFreeBytesProvider, decodeTeamMemberContext, encodeTeamMemberContext, ensureSecureDir, freezeRuntimeAdapterDescriptor, generateLaunchdPlist, generateSystemdUnit, generateWinswXml, installSkillPacks, isAgentMemorySecureFilesystemAvailable, isGitWorkspaceConfig, isRuntimeDisposalFailure, isRuntimeExecutionFailure, journalHash, listInstalledSkillPacks, localStateRelocation, nodeAgentProgram, openTeamTmuxView, prependGitWorkspaceGuidance, projectRuntimeBoundaryFailure, projectRuntimeExecutionFailure, projectSkillPack, readDeviceEnrollmentStatus, requestDeviceAssertion, resolveLocalAgentReleaseIdentity, resolveLocalStoragePolicy, resolveSdkReservedHelperBin, runSdkReservedHelperCommand, sanitizeServiceName, sealRuntimeOperationManifest, skillPacksRoot, stableAgentHomeOwnerId, validateAgentRef };
+export { AGENT_CONTENT_READ_CAPABILITIES, AGENT_CONTENT_READ_CAPABILITY_ARTIFACT, AGENT_CONTENT_READ_CAPABILITY_TRANSCRIPT, AGENT_CONTENT_READ_CAPABILITY_WORKSPACE, AGENT_HOME_PROJECTION_STATE_FILE, AGENT_MEMORY_AUDIT_FILENAME, AGENT_MEMORY_OUTBOX_FILENAME, AgentHomeBusyError, AgentHomeCollisionError, AgentHomeError, AgentHomeLayout, AgentHomeLeaseCorruptError, AgentHomeLeaseManager, AgentHomeManager, AgentHomeResolutionError, AgentMemoryError, AgentMemoryRevisionConflictError, AgentRefValidationError, AgentSessionHandoffCorruptError, AgentSessionHandoffMismatchError, AgentSessionHandoffStore, AgentSessionHandoffStoreError, BYOK_SDK_HELPER_SUBCOMMAND, BlobClient, BlobRequestAbortedError, ClaudeAdapter, CodexAdapter, DEFAULT_ACK_CRITICAL_RESERVE_BYTES, DEFAULT_CLEANUP_BATCH_LIMIT, DEFAULT_HARD_BUDGET_RATIO, DEFAULT_INCREMENTAL_VACUUM_PAGES, DEFAULT_LOG_ROTATION, DEFAULT_NORMAL_COMPACTION_INTERVAL_MS, DEFAULT_PRESSURE_COMPACTION_INTERVAL_MS, DEFAULT_RETENTION_MS, DEFAULT_SOFT_BUDGET_RATIO, DaemonObserver, GitWorkspaceError, GitWorkspaceManager, GitWorkspaceStore, JOURNAL_DB_FILENAME, JOURNAL_QUARANTINE_DIRNAME, JOURNAL_TASK_REF_PREFIX, JournalClosedError, JournalCorruptError, JournalRecordTooLargeError, JournalUnavailableError, JournalUnknownTaskError, LocalStateRelocationBusyError, LocalStateRelocationError, LocalStateRelocationIntegrityError, LocalStorageEmergencyError, LocalStoragePolicyError, LocalStoragePressureEngine, LocalTeamWorkspace, LocalTeamWorkspace as LocalTeamWorkspaceService, McpToolsetDefinitionRevisionConflictError, McpToolsetRevisionConflictError, PI_PACKAGE_NAME, PiAdapter, PolicyUnsupportedError, RUNTIME_ADAPTER_CONTRACT_VIOLATION_REASON, ReplayCursorTooOldError, RuntimeDisposalFailure, RuntimeExecutionFailure, SKILL_PACKS_CAPABILITY, SKILL_PACKS_DIRNAME, SKILL_PACK_AUDIT_FILENAME, SKILL_PACK_INSTALL_ERROR_CODES, SKILL_PACK_LOCK_FILENAME, SKILL_PACK_LOCK_SCHEMA, SKILL_PACK_RESPONSE_MAX_BYTES, SecureDirHardeningError, SkillPackInstallError, SqliteLocalTaskJournal, SteerUnsupportedError, TeamTmuxViewError, TeamWorkspaceConflictError, TeamWorkspaceCorruptError, TeamWorkspaceError, TeamWorkspaceLeaseError, TeamWorkspaceNotFoundError, TeamWorkspaceQuotaError, TeamWorkspaceReceiptError, TeamWorkspaceValidationError, TruthMemoryClient, TruthMemoryClientError, UnsupportedServicePlatformError, buildIcaclsArgs, cleanupEligibleAt, cleanupOrderFor, computePressureState, createAgentHomeProjection, createAgentHomeProjectionConsumer, createDaemon, createDaemonWithAdapters, createFilesystemCleanupExecutor, createServiceLifecycle, createStatfsFreeBytesProvider, decodeTeamMemberContext, encodeTeamMemberContext, ensureSecureDir, freezeRuntimeAdapterDescriptor, generateLaunchdPlist, generateSystemdUnit, generateWinswXml, installSkillPacks, isAgentMemorySecureFilesystemAvailable, isGitWorkspaceConfig, isRuntimeDisposalFailure, isRuntimeExecutionFailure, journalHash, listInstalledSkillPacks, localStateRelocation, nodeAgentProgram, openTeamTmuxView, prependGitWorkspaceGuidance, projectRuntimeBoundaryFailure, projectRuntimeExecutionFailure, projectSkillPack, readDeviceEnrollmentStatus, requestDeviceAssertion, resolveLocalAgentReleaseIdentity, resolveLocalStoragePolicy, resolveSdkReservedHelperBin, runSdkReservedHelperCommand, sanitizeServiceName, sealRuntimeOperationManifest, skillPacksRoot, stableAgentHomeOwnerId, validateAgentRef };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map