@byok-sdk/client 0.12.0 → 0.14.0

package/dist/bin/commands/team-relay.d.ts

@@ -0,0 +1,11 @@
+import type { DaemonConfig } from '../../daemon/create-daemon';
+/** One foreground owner per room. Stale locks are never guessed away or stolen. */
+export declare function acquireTeamRelayLock(storeDir: string, workspaceId: string): Promise<() => Promise<void>>;
+export declare function runTeamRelayCommand(input: {
+    config: DaemonConfig;
+    workspaceId: string;
+    bindingsFile: string;
+    codexBin: string;
+    maxNotifications: number;
+    signal: AbortSignal;
+}): Promise<void>;

package/dist/bin/team-codex-relay.d.ts

@@ -0,0 +1,32 @@
+import { type TeamMemberLease } from '../daemon/team-workspace';
+export interface CodexTeamBinding {
+    readonly context: string;
+    readonly lease: TeamMemberLease;
+    readonly threadId: string;
+    readonly endpoint: string;
+    readonly afterSeq: number;
+}
+export interface TeamNotificationSnapshot {
+    workspaceId: string;
+    memberId: string;
+    registryRevision: string;
+    expiresAt: string;
+    acknowledgedThroughSeq: number;
+    latestPeerSeq: number | null;
+}
+/** Local endpoints only. Never select a default daemon or infer a thread from its name. */
+export declare function validateCodexRelayEndpoint(value: unknown): asserts value is string;
+export declare function parseCodexTeamBinding(binding: unknown, workspaceId: string): CodexTeamBinding;
+export declare function parseCodexTeamBindings(value: unknown, workspaceId: string): readonly CodexTeamBinding[];
+export declare function loadPrivateTeamDocument(file: string): Promise<unknown>;
+export declare function loadCodexTeamBindings(file: string, workspaceId: string): Promise<readonly CodexTeamBinding[]>;
+export declare function codexTeamNotification(workspaceId: string, throughSeq: number): string;
+/** The native queue receipt contract is qualified against this CLI version. */
+export declare function preflightCodexRelay(codexBin: string, signal: AbortSignal): Promise<string>;
+/** Only a confirmed exact-thread queue receipt advances this epoch's notification watermark. */
+export declare function queueCodexTeamNotification(input: {
+    codexBin: string;
+    binding: CodexTeamBinding;
+    throughSeq: number;
+    signal: AbortSignal;
+}): Promise<string>;

package/dist/bin/team-notification-relay.d.ts

@@ -0,0 +1,40 @@
+import type { TeamMemberLease } from '../daemon/team-workspace';
+export interface TeamRelayBinding {
+    readonly context: string;
+    readonly lease: TeamMemberLease;
+    readonly afterSeq: number;
+}
+export type TeamRelayState = 'running' | 'paused' | 'stopped' | 'budget_exhausted' | 'failed';
+export declare class TeamNotificationRelay<T extends TeamRelayBinding> {
+    private readonly options;
+    private state;
+    private attempts;
+    private error;
+    private readonly watermarks;
+    private pending;
+    private readonly abort;
+    constructor(options: {
+        bindings: readonly T[];
+        maxNotifications: number;
+        snapshot: (binding: T, afterSeq: number) => Promise<unknown>;
+        describe: (binding: T) => Record<string, string>;
+        ready?: (binding: T) => Promise<boolean>;
+        enqueue: (binding: T, throughSeq: number, signal: AbortSignal) => Promise<string>;
+    });
+    status(): {
+        state: TeamRelayState;
+        attempts: number;
+        maxNotifications: number;
+        error?: "queue_delivery_unknown" | "snapshot_failed" | undefined;
+        bindings: {
+            workspaceId: string;
+            memberId: string;
+            notifiedThroughSeq: number | undefined;
+        }[];
+    };
+    pause(): void;
+    resume(): void;
+    stop(): void;
+    tick(): Promise<void>;
+    private performTick;
+}

package/dist/bin/team-pi-session.d.ts

@@ -0,0 +1,59 @@
+export interface PiInteractionResponse {
+    sessionId: string;
+    requestId: string;
+    response: {
+        cancelled: true;
+    } | {
+        confirmed: boolean;
+    } | {
+        value: string;
+    };
+}
+export interface PiTeamSessionOptions {
+    workspaceId: string;
+    cwd: string;
+    sessionDir: string;
+    provider: string;
+    model: string;
+    systemPrompt: string;
+    mcpConfig: Record<string, unknown>;
+    extensionPaths?: readonly string[];
+    onEvent: (event: Record<string, unknown>) => void;
+}
+/** One owned RPC child; GUI replies never share a model-controlled tool channel. */
+export declare class PiTeamSession {
+    private readonly options;
+    private client;
+    private sessionId;
+    private revision;
+    private phase;
+    private readonly interactions;
+    private readonly replying;
+    private stopping;
+    private active;
+    private pendingInputs;
+    private readonly privateFiles;
+    private constructor();
+    static start(options: PiTeamSessionOptions): Promise<PiTeamSession>;
+    status(): {
+        sessionId: string | undefined;
+        phase: "closed" | "failed" | "open" | "starting" | "waiting";
+        revision: number;
+        pendingUi: {
+            id: string | undefined;
+            method: unknown;
+            responding: boolean;
+        }[];
+    };
+    private fail;
+    private onFrame;
+    private onInteraction;
+    private request;
+    private state;
+    ready(): Promise<boolean>;
+    notify(throughSeq: number, signal: AbortSignal): Promise<string>;
+    sendInput(message: string): Promise<string>;
+    respond(input: PiInteractionResponse): Promise<void>;
+    drain(signal: AbortSignal): Promise<void>;
+    stop(): Promise<void>;
+}

package/dist/daemon/agent-egress-policy.d.ts

@@ -31,6 +31,14 @@ export declare function resolveAgentEgressPolicy(policy: AgentEgressPolicy | und
  * Default activity projection. Every retained string is SDK-authored; no
  * runtime trajectory, tool, prompt, environment, argv, path, or credential
  * value survives this transformation.
+ *
+ * Each case CONSTRUCTS a fresh event from SDK-authored literals rather than
+ * editing the incoming one, which is what makes the guarantee total rather
+ * than a list of fields someone remembered to strip. `spill` on
+ * `tool_use`/`tool_result` is covered by exactly that: a `BlobRef` is a
+ * readable locator for the omitted tool payload — content, not metadata — so
+ * it never survives a metadata-status projection, and neither do the byte
+ * counts that would leak the payload's size.
  */
 export declare function metadataStatusEvent(event: AgentEvent): AgentEvent;
 export declare function eventBytes(event: AgentEvent): number;

package/dist/daemon/connection-manager.d.ts

@@ -3,18 +3,18 @@ import { AuthManager } from './auth-manager';
 import type { CursorStore } from './cursor-store';
 import { type FleetJitter } from './deterministic-jitter';
 import { ReplayCursorTooOldError } from './replay-cursor';
-import { type BackoffOptions, type ConnectionState, type LivenessOptions } from './ws-transport';
-export type { ConnectionState } from './ws-transport';
 export { ReplayCursorTooOldError } from './replay-cursor';
+/** The lifecycle of the daemon's one long-poll connection. */
+export type ConnectionState = 'connecting' | 'open' | 'closed' | 'revoked';
 export interface ConnectionManagerOptions {
     serverUrl: string;
     deviceId: string;
     productId: string;
     capabilities: CapabilityFlag[];
-    /** U4a Local Agent release version; passed unchanged to both transports. */
+    /** U4a Local Agent release version, sent unchanged in `conn.hello`. */
     clientVersion?: string;
     runtimes: RuntimeInfo[];
-    /** Reads current sorted logical IDs from the validated local registry for every WS hello. */
+    /** Reads current sorted logical IDs from the validated local registry for every `conn.hello`. */
     getConfiguredToolsets?: () => readonly ToolsetId[];
     auth: AuthManager;
     cursorStore: CursorStore;
@@ -25,12 +25,11 @@ export interface ConnectionManagerOptions {
      */
     onEnvelope: (envelope: Envelope) => void | Promise<void>;
     onStateChange?: (state: ConnectionState) => void;
-    backoff?: BackoffOptions;
-    liveness?: LivenessOptions;
-    /** Consecutive never-acked WS connect failures before falling back to long-poll (protocol §8). Default 3. */
-    wsFailureThreshold?: number;
-    /** While long-polling, how often to retry establishing WS (protocol §8, "e.g. every 5 min"). Default 5 minutes. */
-    wsRetryIntervalMs?: number;
+    /** Await durable disposition before retiring the exact accepted/rejected bytes. */
+    onOutboundAccepted?: (envelopes: readonly Envelope[]) => Promise<void>;
+    onOutboundRejected?: (envelope: Envelope) => Promise<void>;
+    onOutboundQueued?: (envelope: Envelope) => void;
+    beforeOutboundPost?: (envelopes: readonly Envelope[]) => void;
     /** Backoff between failed long-poll HTTP attempts. Default 2s. */
     longPollRetryDelayMs?: number;
     /** Minimum delay before the next long-poll request after an empty (no-events) response. Default 250ms. */
@@ -39,33 +38,27 @@ export interface ConnectionManagerOptions {
     onOperationalOutcome?: (outcome: 'success' | 'failure', source: 'reconnect' | 'upload') => void;
     onTerminalError?: (error: ReplayCursorTooOldError) => void;
 }
+export interface RejectedOutboundEnvelope {
+    readonly envelope: Envelope;
+    readonly reason: 'inbound_rejected';
+}
 /**
- * Owns the daemon's one logical connection to the server, which may be
- * backed by either transport the wire protocol defines: WS (the normal
- * path) or long-poll (protocol §8's fallback for environments where an
- * outbound WSS connection isn't viable). Both funnel every received
- * envelope through the same cursor-dedupe/persistence logic (protocol §9),
- * so redelivery is safe regardless of which transport happens to deliver a
- * given envelope — including during the brief overlap window when handing
- * off between them.
+ * Owns the daemon's one authenticated long-poll connection to the server.
+ * Every received envelope passes through the same cursor-dedupe/persistence
+ * logic (protocol §9), so redelivery remains safe after an HTTP retry or a
+ * daemon restart.
  *
  * `send()` (Design B, finding N4) pushes onto a single shared outbox this
- * class owns and drains through whichever transport is currently active —
- * WS raw-sends while acked, `POST /byok/messages` while long-polling
- * (finding F6, long-poll is a full transport, not receive-only; see
- * docs/protocol.md §8) — so a transport switch mid-flight never strands a
- * queued envelope. See `drainOutbox`.
+ * class owns and drains through `POST /byok/messages`; long-poll is a full
+ * bidirectional transport, not a receive-only path. See `drainOutbox`.
  */
 export declare class ConnectionManager {
     private readonly opts;
     private readonly fleetJitter;
-    private readonly ws;
     private readonly longPoll;
-    private mode;
-    private consecutiveFailures;
-    private wsRetryTimer;
-    private wsProbeSequence;
     private uploadRetryAttempt;
+    private started;
+    private connected;
     private cursor;
     /**
      * Finding F3 (at-most-once redelivery): the lowest `task.*` envelope `seq`
@@ -87,10 +80,9 @@ export declare class ConnectionManager {
      * (see `advanceCursor`) — that semantics is unchanged. `deliveredSeq`
      * advances eagerly, the instant a `task.*` envelope is admitted past
      * dedup (see `deliver`/`noteDelivered`), independent of whether its
-     * handler has even started, let alone succeeded. It exists so a
-     * long-poll re-query (`LongPollClient`'s `getCursor`) doesn't re-pull an
-     * envelope that's already been delivered once and is still in flight —
-     * `handleOffer` is NOT idempotent and must never be re-pulled while a
+     * handler has even started, let alone succeeded. It exists so a repeated
+     * read at the durable cursor does not re-dispatch an envelope already in
+     * flight — `handleOffer` must not start a second adapter session while a
      * first attempt is still running. On WS this same field is written the
      * same way, but since a live WS connection only ever pushes a given `seq`
      * once, it never has an observable effect there beyond mirroring
@@ -101,18 +93,18 @@ export declare class ConnectionManager {
     /** Finding F3: serializes `onEnvelope` calls into a per-connection FIFO — one envelope's handler always fully settles before the next one starts. */
     private processingChain;
     /**
-     * Design B (finding N4): the ONE outbound queue both transports drain
-     * from — holds `Envelope` OBJECTS, never re-encoded/rebuilt strings, so a
+     * Design B (finding N4): the ONE outbound queue holds `Envelope` OBJECTS,
+     * never re-encoded/rebuilt strings, so a
      * resend after a failed send attempt is byte-identical to the original
      * (same `id`), which is what lets the server's per-(deviceId,id) dedup
      * (Wave 1) recognize it as a safe no-op retry rather than a second
-     * application (protocol §9). A transport switch (long-poll <-> WS) never
-     * touches this queue — see `drainOutbox` — so nothing queued while one
-     * transport was active is ever stranded when the other takes over.
+     * application (protocol §9).
      */
     private readonly outbox;
+    /** Terminally rejected outbound envelopes, retained as a bounded observable quarantine. */
+    private readonly rejectedOutboundEnvelopes;
     /**
-     * Finding F5(b): how many envelopes `drainOutbox`'s long-poll branch has
+     * Finding F5(b): how many envelopes `drainOutbox` has
      * currently spliced OUT of `this.outbox` for an in-flight (not yet
      * confirmed delivered) `postBatch` call — 0 the rest of the time. See
      * `outboxLength`'s own doc comment for why this needs to be tracked
@@ -165,33 +157,12 @@ export declare class ConnectionManager {
      */
     private cancelPendingDrainRetry;
     /**
-     * The capabilities the CURRENT transport's server advertised — untyped
-     * `string[]` for forward compatibility. WS populates it from `conn.ack`;
-     * long-poll populates it from each successful events response. Empty until
-     * the active transport supplies an advertisement.
-     *
-     * Finding R2 (cross-model re-review — was P1): strictly PER-CONNECTION,
-     * not per-daemon-lifetime. Cleared to `[]` the instant the acked WS
-     * connection ends for ANY reason — an ordinary disconnect (`onWsOutcome`'s
-     * `acked` branch), `stop()`, or a transport switch to long-poll
-     * (`enterLongPoll`) — and only repopulated by a fresh advertisement from
-     * the transport that is still current.
-     * The previous version of this doc comment claimed long-poll mode simply
-     * "stays at whatever the last real WS `conn.ack` said" — that was the bug:
-     * a daemon that once learned e.g. `approval_resolved` from an earlier WS
-     * session kept believing it applied to whatever it's connected to NOW,
-     * even after a disconnect/degrade where nothing has actually confirmed
-     * that's still true (a reconnect could land on a DIFFERENT server behind a
-     * load balancer). Concretely, `TaskRunner.sendApprovalResolved` gates
-     * `task.approval_resolved` on this list — sending it to a server that
-     * doesn't actually understand it over the long-poll path would get a
-     * batch-level 400 from `MessagesSendRequestSchema` (protocol §8.2), which
-     * `drainOutbox`'s retry-the-same-batch-forever loop then head-of-line
-     * blocks EVERY envelope queued behind it on, permanently. Clearing this
-     * eagerly means that gate reliably fails closed (falls back to the
-     * pre-existing implicit-resume inference, unconditionally — see
-     * `sendApprovalResolved`'s own doc comment) the moment the connection that
-     * advertised the capability is no longer the one actually in use.
+     * The capabilities the current server response advertised — untyped
+     * `string[]` for forward compatibility. An advertisement is scoped to the
+     * current long-poll response stream and is cleared after an HTTP failure,
+     * terminal shutdown, or revocation. This keeps capability-gated outbound
+     * messages fail-closed until the current server has explicitly advertised
+     * support.
      */
     private serverCapabilities;
     constructor(opts: ConnectionManagerOptions);
@@ -202,17 +173,10 @@ export declare class ConnectionManager {
      * `drainOutbox`.
      */
     send(envelope: Envelope): void;
+    /** Publish a fresh local configuration snapshot while this daemon is running. */
+    refreshHello(): void;
     /**
-     * Design B (finding N4): drain the shared outbox through whichever
-     * transport is currently active, re-checking `this.mode` fresh on every
-     * iteration so a transport switch mid-drain is picked up immediately
-     * rather than fighting a stale decision made before the switch.
-     *
-     * WS: a synchronous, one-at-a-time `sendNow` per envelope while open+
-     * acked; stops (without dropping anything — the remainder stays queued)
-     * the moment it isn't, and is re-invoked once `onAcked` fires.
-     *
-     * Long-poll: POSTs the outbox in chunks of at most
+     * POSTs the outbox through long-poll in chunks of at most
      * `MAX_MESSAGES_PER_BATCH` (finding P1) — the server hard-caps a single
      * `/byok/messages` batch there (`MessagesSendRequestSchema`, protocol
      * §8.2) and 400s the WHOLE request if it's exceeded, which — before this
@@ -224,14 +188,9 @@ export declare class ConnectionManager {
      * failure that SAME chunk is unshifted back (order-preserving, same
      * Envelope objects/ids — never rebuilt, so a retry is exactly the resend
      * Wave 1's server-side dedup expects) and retried after a short backoff,
-     * re-reading `this.mode` each time so a WS recovery that happens
-     * mid-retry is honored on the very next loop iteration instead of only
-     * after this attempt's backoff chain gives up.
-     *
      * Re-entrancy is guarded by `draining`: a call arriving while a drain is
      * already in progress just returns — the in-progress loop's own
-     * `while (this.outbox.length > 0)` check will pick up anything newly
-     * pushed (or left over after a mode switch) on its very next iteration.
+     * `while (this.outbox.length > 0)` check picks up anything newly pushed.
      */
     private drainOutbox;
     /**
@@ -241,37 +200,29 @@ export declare class ConnectionManager {
      * in-flight wait immediately instead of leaving `drainOutbox` parked here
      * for up to the rest of the delay before it next checks `this.revoked` —
      * and (b) unref'd, so the timer never keeps the Node process alive by
-     * itself while nothing else (a live long-poll GET, an open WS connection)
-     * legitimately is.
+     * itself while nothing else (such as the live long-poll GET) legitimately is.
      */
     private drainRetryDelay;
-    isTransportDegraded(): boolean;
     /**
-     * The capabilities the CURRENT transport's server advertised: from
-     * `conn.ack` on WS, or the latest successful `GET /byok/events` response
-     * on long-poll. Empty before either transport has supplied its current
-     * advertisement, and cleared across disconnect/switch boundaries.
+     * The capabilities the latest successful `GET /byok/events` response
+     * advertised. Empty before a successful response and after a failed one.
      */
     getServerCapabilities(): readonly string[];
     getTerminalError(): ReplayCursorTooOldError | undefined;
-    getMode(): 'ws' | 'long-poll';
     isConnected(): boolean;
     isRevoked(): boolean;
     /**
-     * Resolves once the connection has settled — either a working, acked WS
-     * connection, or the long-poll fallback taking over (protocol §8). This
-     * lets `daemon.start()` return promptly even when WS is unavailable from
-     * the very first attempt, rather than hanging until a WS `conn.ack` that
-     * may never come.
+     * Resolves after the first successful long-poll response establishes the
+     * authenticated connection.
      *
      * Rejects with {@link DeviceRevokedError} — instead of hanging until
      * `timeoutMs` — if the device turns out to be revoked while settling (or
      * already was): a cold `daemon.start()` against an already-revoked device
      * must fail fast, not surface a generic timeout (protocol §6.3).
      */
-    waitForAck(timeoutMs?: number): Promise<void>;
+    waitForConnection(timeoutMs?: number): Promise<void>;
     /**
-     * Stops both transports and waits for every in-flight envelope handler
+     * Stops the long-poll transport and waits for every in-flight envelope handler
      * (the F3 FIFO chain) and the most recent cursor write to actually land on
      * disk — otherwise a `stop()` racing a just-processed envelope's
      * persistence could lose that cursor advance, or leave a handler running
@@ -280,14 +231,14 @@ export declare class ConnectionManager {
      * Finding F5(b) (cross-model adversarial review): `drainTimeoutMs`, when
      * passed, bounds how long this waits for the shared outbox (`this.outbox`
      * — Design B) to actually finish draining BEFORE flipping `this.stopped`
-     * and closing the transports. Before this fix, `stop()` set `stopped`
+     * and stopping the transport. Before this fix, `stop()` set `stopped`
      * synchronously and never waited for `drainOutbox` at all: an envelope
      * `send()` had just pushed moments earlier (e.g. `TaskRunner.shutdownTask`'s
      * own `task.fail`, sent right before `create-daemon.ts`'s
      * `performControlShutdown` calls this) could still be sitting UNSENT in
      * `this.outbox` — mid long-poll retry backoff, or simply not yet picked up
      * by the fire-and-forget `drainOutbox()` `send()` kicked off — and this
-     * method would happily proceed to `stopped = true` / `ws.close()` regardless,
+     * method would happily proceed to `stopped = true` regardless,
      * after which NOTHING ever drains it again: silently lost, even though
      * `TaskRunner` believed it had been sent. `drainTimeoutMs` omitted (the
      * default) preserves the EXACT prior behavior for every other existing
@@ -318,6 +269,8 @@ export declare class ConnectionManager {
      * for the one case (a hung POST) this finding exists to catch honestly.
      */
     outboxLength(): number;
+    /** A bounded terminal quarantine for operator inspection; these entries are never retried. */
+    rejectedOutbox(): readonly RejectedOutboundEnvelope[];
     /**
      * Finding F5(b): polls {@link outboxLength} (not `this.outbox.length`
      * alone — see that method's own doc comment for why a spliced-out,
@@ -325,15 +278,14 @@ export declare class ConnectionManager {
      * a single `drainOutbox()` promise directly — a drain in progress can
      * itself loop through multiple retry/backoff cycles (`drainRetryDelay`)
      * while the server is unreachable, and a fresh, INDEPENDENT
-     * `drainOutbox()` call can also be triggered concurrently (`send()`, a
-     * mode switch's own `void this.drainOutbox()`) — polling the one thing
+     * `drainOutbox()` call can also be triggered concurrently (`send()`) —
+     * polling the one thing
      * that actually matters (is anything still undelivered) can never go
      * stale the way capturing one specific in-flight promise reference
      * could. Kicks off one more `drainOutbox()` attempt itself first
      * (harmless no-op if one is already running — see its own re-entrancy
-     * guard) in case nothing is currently actively retrying (e.g. WS just
-     * dropped and long-poll hasn't taken over yet), so this bounded wait
-     * isn't just passively hoping something else happens to be making
+     * guard) in case nothing is currently actively retrying, so this bounded
+     * wait isn't just passively hoping something else happens to be making
      * progress.
      */
     private waitForOutboxDrained;
@@ -360,9 +312,10 @@ export declare class ConnectionManager {
      */
     private deliver;
     /**
-     * Design A: the watermark `deliver()` dedupes inbound `task.*` envelopes
-     * against, and the same value `LongPollClient` queries the next
-     * `GET /byok/events` cursor with (see the constructor). Normally this is
+     * The local watermark `deliver()` dedupes inbound `task.*` envelopes
+     * against. It is deliberately NOT the long-poll query cursor: that query
+     * is the kernel acknowledgement and uses only the successfully processed
+     * `cursor` (see the constructor). Normally this local watermark is
      * `deliveredSeq` — which is always >= `cursor` (every envelope that
      * reaches `advanceCursor` already passed through `noteDelivered` first,
      * see `deliver`) — so this is the literal `max(cursor, deliveredSeq)` the
@@ -378,132 +331,21 @@ export declare class ConnectionManager {
      * whose outcome wasn't known yet. No separate "reset deliveredSeq on
      * reconnect" step is needed for this to be correct — collapsing to
      * `cursor` exactly while stalled already produces the right answer on
-     * every redelivery path (long-poll re-query AND a WS reconnect's
-     * backlog replay alike), and NOT resetting it unconditionally on every
-     * reconnect is what lets `deliveredSeq` keep doing its job of not
-     * re-pulling/re-dispatching something already in flight across a
-     * reconnect that happens to land while a handler is still running.
+     * every long-poll retry path. NOT resetting it unconditionally on every
+     * retry lets `deliveredSeq` keep doing its job of not re-dispatching
+     * something already in flight while a handler is still running.
      */
     private dedupWatermark;
     /** Design A: eagerly advance the in-memory delivery watermark — called for every `task.*` envelope `deliver()` admits past dedup, regardless of transport or of whether its handler has even started yet. */
     private noteDelivered;
     private process;
-    /**
-     * M4 Phase 4 (version-negotiation drill fix): `LongPollClient` calls this
-     * for a batch entry it could not parse into a known `Envelope` at all (an
-     * unrecognized message type — mirrors `ws-transport.ts`'s identical
-     * per-frame tolerance, see `long-poll-transport.ts`'s own doc comment on
-     * `parseLooseEventsPollResponse`) but which still carried a numeric,
-     * task-class envelope-level `seq` (the caller only invokes this for a
-     * `task.`-prefixed type — see `long-poll-transport.ts`'s own
-     * `extractSkippableSeq`; `conn.*`-shaped or type-less entries never reach
-     * here at all, mirroring F2's "conn.* is never cursor-tracked" rule).
-     * There is no real `Envelope` to hand to a handler — a genuinely
-     * unrecognized type has nothing this build could ever act on.
-     *
-     * GATEKEEPER-CAUGHT REGRESSION (fixed here): this used to call
-     * `advanceCursor(seq)` DIRECTLY, synchronously, the instant a skip was
-     * detected in `LongPollClient.loop()`'s per-entry for-loop. That is NOT
-     * "instantaneous and race-free" the way the previous version of this
-     * comment claimed — the hazard was never the skip racing against itself,
-     * it was the skip racing AHEAD of an EARLIER real envelope in the SAME
-     * batch that is still in flight on `processingChain` (`deliver()`, above,
-     * only ever CHAINS `process()` onto that promise chain — it never awaits
-     * it before returning). Concretely, batch `[real seq1, unknown seq2]`:
-     * `deliver(seq1)` chains `process(seq1)` but returns immediately without
-     * running it; the for-loop then reaches `seq2` and (pre-fix) called
-     * `advanceCursor(2)` synchronously, BEFORE `process(seq1)` had even
-     * started, let alone failed. If `seq1`'s handler then failed,
-     * `stalledAtSeq` became 1 — but the durable cursor was already 2, so
-     * `dedupWatermark()` returned 2, and every future redelivery of seq1 was
-     * dedup-dropped as "already past the cursor" forever: permanent envelope
-     * loss, exactly the F3 bug class the whole `stalledAtSeq`/frozen-watermark
-     * mechanism exists to prevent.
-     *
-     * Fix: the cursor-advancing half is now CHAINED onto `processingChain`
-     * too, exactly like `process()`'s own post-handler bookkeeping — so it
-     * only ever runs once every earlier envelope already queued ahead of it
-     * has fully settled (success or failure), and can observe `stalledAtSeq`'s
-     * REAL, up-to-date value rather than whatever it happened to be at the
-     * instant the skip was first noticed. The guard mirrors `process()`'s own
-     * success-path guard exactly: never advance past a still-unresolved
-     * earlier failure, unless (degenerate, cannot really happen for a skip)
-     * this exact seq IS the stalled one.
-     *
-     * `noteDelivered` (the eager, in-memory watermark) stays UNCHAINED —
-     * called immediately, unconditionally, regardless of `stalledAtSeq` —
-     * matching `deliver()`'s own eager, unconditional call for a real
-     * envelope: its only job is "don't re-pull something already handed off,"
-     * independent of outcome, and that property does not depend on FIFO
-     * ordering the way the DURABLE cursor does.
-     *
-     * Deliberately NO top-level `dedupWatermark() <= seq` early-return before
-     * queuing the chained callback (an earlier draft of this fix had one, and
-     * it was itself subtly wrong): `deliveredSeq` can already reflect a seq
-     * from the FIRST time it was ever seen, while the DURABLE cursor is still
-     * behind it because a stall intervened before that seq's chained
-     * advancement ran — a pre-check keyed on `deliveredSeq` would then
-     * wrongly treat a LATER redelivery of the same seq (arriving once the
-     * stall has since cleared) as "already accounted for" and never queue
-     * another attempt, permanently stranding the cursor one seq short. Always
-     * queuing is safe and cheap: `advanceCursor`'s own `seq <= this.cursor`
-     * guard already makes a genuinely-redundant call a no-op, so there is no
-     * correctness reason to short-circuit earlier, only a (here, unnecessary)
-     * micro-optimization one.
-     */
-    private noteSkippedSeq;
-    /**
-     * Finding R1 (cross-model re-review — was NOT-CLOSED against F1):
-     * `LongPollClient` calls this for a batch entry whose `type` it
-     * recognized but whose payload failed schema validation
-     * ({@link EnvelopeValidationError}) — a genuine delivery failure at that
-     * seq, unlike `noteSkippedSeq`'s forward-compat case. Deliberately mirrors
-     * `process()`'s own catch block (`if (tracked && this.stalledAtSeq ===
-     * undefined) this.stalledAtSeq = envelope.seq;`) as closely as possible:
-     * the SAME "only the lowest unresolved failure holds the stall" rule, the
-     * SAME resulting freeze of `dedupWatermark()` at the durable cursor
-     * (protocol §9 keeps this seq alive), and — because it's the SAME
-     * `stalledAtSeq` field `process()`'s own post-success guard already
-     * checks — anything ELSE delivered after this seq (same batch or a later
-     * one) is automatically held back from advancing the cursor too, with
-     * zero changes needed to `process()` itself.
-     *
-     * Chained onto `processingChain` for exactly the reason `noteSkippedSeq`
-     * documents for its own identical chaining (see that method's sibling
-     * doc comment on `LongPollClient`, "GATEKEEPER-CAUGHT REGRESSION"): an
-     * EARLIER real envelope in the SAME batch may still be in flight on that
-     * FIFO chain when this is called (`deliver()` only ever chains
-     * `process()` onto it, never awaits before returning) — mutating
-     * `stalledAtSeq` synchronously here could race ahead of that still-
-     * unresolved earlier envelope. Chaining instead guarantees this only
-     * takes effect once every earlier-queued envelope has already settled,
-     * and reads `stalledAtSeq`'s real, up-to-date value rather than whatever
-     * it happened to be the instant the failure was first noticed.
-     *
-     * No `noteDelivered` call here (contrast `noteSkippedSeq`, which does
-     * call it): a validation-failed entry never becomes a real `Envelope` and
-     * never reaches `deliver()`, so it was never "delivered" in the eager
-     * in-memory-watermark sense that field tracks — there is nothing for it
-     * to eagerly mark. Once a corrected redelivery of this exact seq DOES
-     * arrive as a real envelope, it flows through the ordinary `deliver()`
-     * path (which calls `noteDelivered` itself) and, on success, clears the
-     * stall via `process()`'s own existing logic — no special-casing needed.
-     */
+    /** Serialized with handler completion, so invalid work cannot be acked by later success. */
     private noteValidationFailure;
     private advanceCursor;
-    /**
-     * Fires the moment a connection attempt reaches `conn.ack` — independent
-     * of whether/when it later closes. This is the ONLY place that can
-     * reliably detect "WS is back up" while long-polling: a healthy
-     * connection stays open indefinitely, so it never reaches `onWsOutcome`
-     * (which is close-only) at all.
-     */
-    private onAcked;
-    private onWsOutcome;
+    private quarantineRejectedOutbound;
     private notifySettled;
-    private enterLongPoll;
+    private noteConnected;
+    private noteDisconnected;
     private enterReplayCursorTooOld;
-    private exitLongPoll;
-    private scheduleWsProbe;
     private enterRevoked;
 }

package/dist/daemon/control-protocol.d.ts

@@ -5,6 +5,7 @@ import type { StoragePressureState } from './journal/storage-policy';
 import type { OperationalHealthSnapshot } from './operational-health';
 import type { LocalAgentReleaseIdentity } from '../release-identity';
 import type { McpToolsetConfig, McpToolsetRegistryStatus } from '../types';
+import type { AgentHomeExecutionStatus } from '../agent-home';
 /**
  * M4 Phase 2: shared local-IPC contract between the daemon's control server
  * (`control-server.ts`) and the CLI's control client (`bin/control-client.ts`)
@@ -252,7 +253,7 @@ export interface ControlStatusResult {
     uptimeMs: number;
     paired: boolean;
     deviceId?: string;
-    /** The connection state machine's own current value (`ws-transport.ts`'s `ConnectionState`) — e.g. `'open'`, `'degraded'` (long-poll fallback), `'revoked'`, `'closed'`, `'connecting'`. */
+    /** The connection state machine's current value: `'open'`, `'revoked'`, `'closed'`, or `'connecting'`. */
     transport: string;
     activeTasks: ControlActiveTask[];
     runtimeIds: string[];
@@ -276,6 +277,12 @@ export interface ControlStatusResult {
     operationalHealth: OperationalHealthSnapshot;
     /** Redacted content-addressed status from the daemon's single local registry. */
     toolsets: McpToolsetRegistryStatus;
+    /**
+     * WP0: per-canonical-Agent-home execution serialization, counts only —
+     * see {@link AgentHomeExecutionStatus}. Absent only for an older control
+     * peer that predates the cap.
+     */
+    agentHomeExecution?: AgentHomeExecutionStatus;
 }
 export interface ToolsetsReloadParams {
     expectedRevision: string;
@@ -458,5 +465,7 @@ export declare function parseTeamWorkspaceJoinParams(value: unknown): TeamWorksp
 export declare function parseTeamContextParams(value: unknown): TeamContextParams | undefined;
 export declare function parseTeamMessagePostParams(value: unknown): TeamMessagePostParams | undefined;
 export declare function parseTeamMessageReadParams(value: unknown): TeamMessageReadParams | undefined;
+/** Exact local operator RPC; the shared read-parameter shape has no model identity fields. */
+export declare function parseTeamNotificationSnapshotParams(value: unknown): TeamMessageReadParams | undefined;
 export declare function parseTeamMessageAckParams(value: unknown): TeamMessageAckParams | undefined;
 export declare function parseTeamMessageInspectParams(value: unknown): TeamMessageInspectParams | undefined;