@byok-sdk/client 0.13.0 → 0.14.0

package/dist/bin/commands/team-relay.d.ts

@@ -0,0 +1,11 @@
+import type { DaemonConfig } from '../../daemon/create-daemon';
+/** One foreground owner per room. Stale locks are never guessed away or stolen. */
+export declare function acquireTeamRelayLock(storeDir: string, workspaceId: string): Promise<() => Promise<void>>;
+export declare function runTeamRelayCommand(input: {
+    config: DaemonConfig;
+    workspaceId: string;
+    bindingsFile: string;
+    codexBin: string;
+    maxNotifications: number;
+    signal: AbortSignal;
+}): Promise<void>;

package/dist/bin/team-codex-relay.d.ts

@@ -0,0 +1,32 @@
+import { type TeamMemberLease } from '../daemon/team-workspace';
+export interface CodexTeamBinding {
+    readonly context: string;
+    readonly lease: TeamMemberLease;
+    readonly threadId: string;
+    readonly endpoint: string;
+    readonly afterSeq: number;
+}
+export interface TeamNotificationSnapshot {
+    workspaceId: string;
+    memberId: string;
+    registryRevision: string;
+    expiresAt: string;
+    acknowledgedThroughSeq: number;
+    latestPeerSeq: number | null;
+}
+/** Local endpoints only. Never select a default daemon or infer a thread from its name. */
+export declare function validateCodexRelayEndpoint(value: unknown): asserts value is string;
+export declare function parseCodexTeamBinding(binding: unknown, workspaceId: string): CodexTeamBinding;
+export declare function parseCodexTeamBindings(value: unknown, workspaceId: string): readonly CodexTeamBinding[];
+export declare function loadPrivateTeamDocument(file: string): Promise<unknown>;
+export declare function loadCodexTeamBindings(file: string, workspaceId: string): Promise<readonly CodexTeamBinding[]>;
+export declare function codexTeamNotification(workspaceId: string, throughSeq: number): string;
+/** The native queue receipt contract is qualified against this CLI version. */
+export declare function preflightCodexRelay(codexBin: string, signal: AbortSignal): Promise<string>;
+/** Only a confirmed exact-thread queue receipt advances this epoch's notification watermark. */
+export declare function queueCodexTeamNotification(input: {
+    codexBin: string;
+    binding: CodexTeamBinding;
+    throughSeq: number;
+    signal: AbortSignal;
+}): Promise<string>;

package/dist/bin/team-notification-relay.d.ts

@@ -0,0 +1,40 @@
+import type { TeamMemberLease } from '../daemon/team-workspace';
+export interface TeamRelayBinding {
+    readonly context: string;
+    readonly lease: TeamMemberLease;
+    readonly afterSeq: number;
+}
+export type TeamRelayState = 'running' | 'paused' | 'stopped' | 'budget_exhausted' | 'failed';
+export declare class TeamNotificationRelay<T extends TeamRelayBinding> {
+    private readonly options;
+    private state;
+    private attempts;
+    private error;
+    private readonly watermarks;
+    private pending;
+    private readonly abort;
+    constructor(options: {
+        bindings: readonly T[];
+        maxNotifications: number;
+        snapshot: (binding: T, afterSeq: number) => Promise<unknown>;
+        describe: (binding: T) => Record<string, string>;
+        ready?: (binding: T) => Promise<boolean>;
+        enqueue: (binding: T, throughSeq: number, signal: AbortSignal) => Promise<string>;
+    });
+    status(): {
+        state: TeamRelayState;
+        attempts: number;
+        maxNotifications: number;
+        error?: "queue_delivery_unknown" | "snapshot_failed" | undefined;
+        bindings: {
+            workspaceId: string;
+            memberId: string;
+            notifiedThroughSeq: number | undefined;
+        }[];
+    };
+    pause(): void;
+    resume(): void;
+    stop(): void;
+    tick(): Promise<void>;
+    private performTick;
+}

package/dist/bin/team-pi-session.d.ts

@@ -0,0 +1,59 @@
+export interface PiInteractionResponse {
+    sessionId: string;
+    requestId: string;
+    response: {
+        cancelled: true;
+    } | {
+        confirmed: boolean;
+    } | {
+        value: string;
+    };
+}
+export interface PiTeamSessionOptions {
+    workspaceId: string;
+    cwd: string;
+    sessionDir: string;
+    provider: string;
+    model: string;
+    systemPrompt: string;
+    mcpConfig: Record<string, unknown>;
+    extensionPaths?: readonly string[];
+    onEvent: (event: Record<string, unknown>) => void;
+}
+/** One owned RPC child; GUI replies never share a model-controlled tool channel. */
+export declare class PiTeamSession {
+    private readonly options;
+    private client;
+    private sessionId;
+    private revision;
+    private phase;
+    private readonly interactions;
+    private readonly replying;
+    private stopping;
+    private active;
+    private pendingInputs;
+    private readonly privateFiles;
+    private constructor();
+    static start(options: PiTeamSessionOptions): Promise<PiTeamSession>;
+    status(): {
+        sessionId: string | undefined;
+        phase: "closed" | "failed" | "open" | "starting" | "waiting";
+        revision: number;
+        pendingUi: {
+            id: string | undefined;
+            method: unknown;
+            responding: boolean;
+        }[];
+    };
+    private fail;
+    private onFrame;
+    private onInteraction;
+    private request;
+    private state;
+    ready(): Promise<boolean>;
+    notify(throughSeq: number, signal: AbortSignal): Promise<string>;
+    sendInput(message: string): Promise<string>;
+    respond(input: PiInteractionResponse): Promise<void>;
+    drain(signal: AbortSignal): Promise<void>;
+    stop(): Promise<void>;
+}

package/dist/daemon/agent-egress-policy.d.ts

@@ -31,6 +31,14 @@ export declare function resolveAgentEgressPolicy(policy: AgentEgressPolicy | und
  * Default activity projection. Every retained string is SDK-authored; no
  * runtime trajectory, tool, prompt, environment, argv, path, or credential
  * value survives this transformation.
+ *
+ * Each case CONSTRUCTS a fresh event from SDK-authored literals rather than
+ * editing the incoming one, which is what makes the guarantee total rather
+ * than a list of fields someone remembered to strip. `spill` on
+ * `tool_use`/`tool_result` is covered by exactly that: a `BlobRef` is a
+ * readable locator for the omitted tool payload — content, not metadata — so
+ * it never survives a metadata-status projection, and neither do the byte
+ * counts that would leak the payload's size.
  */
 export declare function metadataStatusEvent(event: AgentEvent): AgentEvent;
 export declare function eventBytes(event: AgentEvent): number;

package/dist/daemon/connection-manager.d.ts

@@ -25,6 +25,11 @@ export interface ConnectionManagerOptions {
      */
     onEnvelope: (envelope: Envelope) => void | Promise<void>;
     onStateChange?: (state: ConnectionState) => void;
+    /** Await durable disposition before retiring the exact accepted/rejected bytes. */
+    onOutboundAccepted?: (envelopes: readonly Envelope[]) => Promise<void>;
+    onOutboundRejected?: (envelope: Envelope) => Promise<void>;
+    onOutboundQueued?: (envelope: Envelope) => void;
+    beforeOutboundPost?: (envelopes: readonly Envelope[]) => void;
     /** Backoff between failed long-poll HTTP attempts. Default 2s. */
     longPollRetryDelayMs?: number;
     /** Minimum delay before the next long-poll request after an empty (no-events) response. Default 250ms. */
@@ -334,106 +339,7 @@ export declare class ConnectionManager {
     /** Design A: eagerly advance the in-memory delivery watermark — called for every `task.*` envelope `deliver()` admits past dedup, regardless of transport or of whether its handler has even started yet. */
     private noteDelivered;
     private process;
-    /**
-     * M4 Phase 4 (version-negotiation drill fix): `LongPollClient` calls this
-     * for a batch entry it could not parse into a known `Envelope` at all (an
-     * unrecognized message type (see `long-poll-transport.ts`'s own doc
-     * comment on `parseLooseEventsPollResponse`) but which still carried a numeric,
-     * task-class envelope-level `seq` (the caller only invokes this for a
-     * `task.`-prefixed type — see `long-poll-transport.ts`'s own
-     * `extractSkippableSeq`; `conn.*`-shaped or type-less entries never reach
-     * here at all, mirroring F2's "conn.* is never cursor-tracked" rule).
-     * There is no real `Envelope` to hand to a handler — a genuinely
-     * unrecognized type has nothing this build could ever act on.
-     *
-     * GATEKEEPER-CAUGHT REGRESSION (fixed here): this used to call
-     * `advanceCursor(seq)` DIRECTLY, synchronously, the instant a skip was
-     * detected in `LongPollClient.loop()`'s per-entry for-loop. That is NOT
-     * "instantaneous and race-free" the way the previous version of this
-     * comment claimed — the hazard was never the skip racing against itself,
-     * it was the skip racing AHEAD of an EARLIER real envelope in the SAME
-     * batch that is still in flight on `processingChain` (`deliver()`, above,
-     * only ever CHAINS `process()` onto that promise chain — it never awaits
-     * it before returning). Concretely, batch `[real seq1, unknown seq2]`:
-     * `deliver(seq1)` chains `process(seq1)` but returns immediately without
-     * running it; the for-loop then reaches `seq2` and (pre-fix) called
-     * `advanceCursor(2)` synchronously, BEFORE `process(seq1)` had even
-     * started, let alone failed. If `seq1`'s handler then failed,
-     * `stalledAtSeq` became 1 — but the durable cursor was already 2, so
-     * `dedupWatermark()` returned 2, and every future redelivery of seq1 was
-     * dedup-dropped as "already past the cursor" forever: permanent envelope
-     * loss, exactly the F3 bug class the whole `stalledAtSeq`/frozen-watermark
-     * mechanism exists to prevent.
-     *
-     * Fix: the cursor-advancing half is now CHAINED onto `processingChain`
-     * too, exactly like `process()`'s own post-handler bookkeeping — so it
-     * only ever runs once every earlier envelope already queued ahead of it
-     * has fully settled (success or failure), and can observe `stalledAtSeq`'s
-     * REAL, up-to-date value rather than whatever it happened to be at the
-     * instant the skip was first noticed. The guard mirrors `process()`'s own
-     * success-path guard exactly: never advance past a still-unresolved
-     * earlier failure, unless (degenerate, cannot really happen for a skip)
-     * this exact seq IS the stalled one.
-     *
-     * `noteDelivered` (the eager, in-memory watermark) stays UNCHAINED —
-     * called immediately, unconditionally, regardless of `stalledAtSeq` —
-     * matching `deliver()`'s own eager, unconditional call for a real
-     * envelope: its only job is "don't re-dispatch something already handed off,"
-     * independent of outcome, and that property does not depend on FIFO
-     * ordering the way the DURABLE cursor does.
-     *
-     * Deliberately NO top-level `dedupWatermark() <= seq` early-return before
-     * queuing the chained callback (an earlier draft of this fix had one, and
-     * it was itself subtly wrong): `deliveredSeq` can already reflect a seq
-     * from the FIRST time it was ever seen, while the DURABLE cursor is still
-     * behind it because a stall intervened before that seq's chained
-     * advancement ran — a pre-check keyed on `deliveredSeq` would then
-     * wrongly treat a LATER redelivery of the same seq (arriving once the
-     * stall has since cleared) as "already accounted for" and never queue
-     * another attempt, permanently stranding the cursor one seq short. Always
-     * queuing is safe and cheap: `advanceCursor`'s own `seq <= this.cursor`
-     * guard already makes a genuinely-redundant call a no-op, so there is no
-     * correctness reason to short-circuit earlier, only a (here, unnecessary)
-     * micro-optimization one.
-     */
-    private noteSkippedSeq;
-    /**
-     * Finding R1 (cross-model re-review — was NOT-CLOSED against F1):
-     * `LongPollClient` calls this for a batch entry whose `type` it
-     * recognized but whose payload failed schema validation
-     * ({@link EnvelopeValidationError}) — a genuine delivery failure at that
-     * seq, unlike `noteSkippedSeq`'s forward-compat case. Deliberately mirrors
-     * `process()`'s own catch block (`if (tracked && this.stalledAtSeq ===
-     * undefined) this.stalledAtSeq = envelope.seq;`) as closely as possible:
-     * the SAME "only the lowest unresolved failure holds the stall" rule, the
-     * SAME resulting freeze of `dedupWatermark()` at the durable cursor
-     * (protocol §9 keeps this seq alive), and — because it's the SAME
-     * `stalledAtSeq` field `process()`'s own post-success guard already
-     * checks — anything ELSE delivered after this seq (same batch or a later
-     * one) is automatically held back from advancing the cursor too, with
-     * zero changes needed to `process()` itself.
-     *
-     * Chained onto `processingChain` for exactly the reason `noteSkippedSeq`
-     * documents for its own identical chaining (see that method's sibling
-     * doc comment on `LongPollClient`, "GATEKEEPER-CAUGHT REGRESSION"): an
-     * EARLIER real envelope in the SAME batch may still be in flight on that
-     * FIFO chain when this is called (`deliver()` only ever chains
-     * `process()` onto it, never awaits before returning) — mutating
-     * `stalledAtSeq` synchronously here could race ahead of that still-
-     * unresolved earlier envelope. Chaining instead guarantees this only
-     * takes effect once every earlier-queued envelope has already settled,
-     * and reads `stalledAtSeq`'s real, up-to-date value rather than whatever
-     * it happened to be the instant the failure was first noticed.
-     *
-     * No `noteDelivered` call here (contrast `noteSkippedSeq`, which does
-     * call it): a validation-failed entry never becomes a real `Envelope` and
-     * never reaches `deliver()`, so it was never "delivered" in the eager
-     * in-memory-watermark sense that field tracks — there is nothing for it
-     * to eagerly mark. Once a corrected redelivery of this exact seq DOES
-     * arrive as a real envelope, it flows through the ordinary `deliver()`
-     * path (which calls `noteDelivered` itself) and, on success, clears the
-     * stall via `process()`'s own existing logic — no special-casing needed.
-     */
+    /** Serialized with handler completion, so invalid work cannot be acked by later success. */
     private noteValidationFailure;
     private advanceCursor;
     private quarantineRejectedOutbound;

package/dist/daemon/control-protocol.d.ts

@@ -465,5 +465,7 @@ export declare function parseTeamWorkspaceJoinParams(value: unknown): TeamWorksp
 export declare function parseTeamContextParams(value: unknown): TeamContextParams | undefined;
 export declare function parseTeamMessagePostParams(value: unknown): TeamMessagePostParams | undefined;
 export declare function parseTeamMessageReadParams(value: unknown): TeamMessageReadParams | undefined;
+/** Exact local operator RPC; the shared read-parameter shape has no model identity fields. */
+export declare function parseTeamNotificationSnapshotParams(value: unknown): TeamMessageReadParams | undefined;
 export declare function parseTeamMessageAckParams(value: unknown): TeamMessageAckParams | undefined;
 export declare function parseTeamMessageInspectParams(value: unknown): TeamMessageInspectParams | undefined;

package/dist/daemon/create-daemon.d.ts

@@ -307,6 +307,36 @@ export interface DaemonConfig {
      * explicitly instead to opt out of enforcement altogether.
      */
     maxTaskOutputBytes?: number;
+    /**
+     * Per-EVENT inline ceiling (default {@link DEFAULT_MAX_INLINE_EVENT_BYTES},
+     * 64 KiB) for the two `AgentEvent` fields a runtime authors freely:
+     * `tool_use.input` and `tool_result.output`. An event whose serialization
+     * exceeds this leaves `TaskRunner.pump` with that field replaced by a
+     * UTF-8-safe head/tail preview (`{ preview: { head, tail } }`) and an
+     * additive `spill` descriptor; the full JSON serialization is uploaded to
+     * the blob plane under an idempotent, content-addressed key, and
+     * `spill.blob` is where a consumer reads it back. If the upload fails the
+     * preview still ships, carrying `spill.unstoredReason` instead — omission
+     * is always described, never silent.
+     *
+     * This is a per-event bound, orthogonal to `maxTaskOutputBytes` (a
+     * whole-task total, counted AFTER spilling) and to
+     * `progressBatch.maxBatchBytes` (a per-batch wire budget).
+     *
+     * **Consumer contract:** `spill`'s presence is the only signal that the
+     * inline field is a preview. A consumer that renders `tool_result.output`
+     * without checking `spill` renders a truncation as the whole result.
+     *
+     * Must be a positive safe integer of at least
+     * {@link MIN_MAX_INLINE_EVENT_BYTES} (4096) — below that a legitimate
+     * `spill` descriptor no longer fits inside the cap it exists to enforce.
+     * Anything else (0, negative, non-integer, `NaN`,
+     * `Number.POSITIVE_INFINITY`) is a config validation error thrown
+     * synchronously from `createDaemonWithAdapters`/`createDaemon`; there is
+     * no opt-out, because "unbounded event" is exactly the state this exists
+     * to prevent.
+     */
+    maxInlineEventBytes?: number;
     /**
      * Host-owned batching policy for normalized `task.progress` events.
      * `maxBatchBytes`, when set, measures exactly the UTF-8 bytes of
@@ -559,6 +589,8 @@ export interface Daemon {
 }
 /** Internal seam so tests can substitute stub adapters / faster batch and long-poll timing. `createDaemonWithAdapters` (which takes this) is also the real entry point for products supplying a hand-built adapter set `createDaemon` can't construct on its own — e.g. custom adapter options, or an adapter that REPLACES a bundled runtime's implementation under the same id. Honest limit: an adapter id outside `pi`/`claude`/`codex` cannot pass wire validation today — `RuntimeIdSchema` (`@byok-sdk/protocol`) is a closed `z.enum(['pi', 'claude', 'codex'])`, and `isRuntimeId` filtering below (see `detectRuntimes`) drops any detected adapter outside that set before it ever reaches a wire-visible field. A genuinely fourth/namespaced runtime id is a future protocol change, not something this seam enables today. */
 export interface DaemonOverrides {
+    /** Test-only synchronous kill points; never supplied by production configuration. */
+    executionRecoveryFault?: (step: 'terminal:before-send' | 'terminal:queued' | 'outbound:before-post' | 'outbound:after-ack') => void;
     /** M4 Phase 3: overrides `TaskRunner`'s default out-of-band approval wait (`DEFAULT_APPROVAL_TIMEOUT_MS`, 10 minutes) before an unanswered `requestApproval` force-resolves as a fail-closed rejection. */
     approvalTimeoutMs?: number;
     /** Finding F5: overrides for the control-socket shutdown path's own bounded waits — see `TaskRunner.shutdownTask`'s and `ConnectionManager.stop`'s own doc comments. Both default to 5s; neither affects an ordinary (non-shutdown-RPC) `daemon.stop()` call. */

package/dist/daemon/event-spill.d.ts

@@ -0,0 +1,90 @@
+import type { AgentEvent } from '@byok-sdk/protocol';
+import type { BlobResolver } from './blob-client';
+/**
+ * Default per-event inline ceiling (64 KiB) for the two `AgentEvent` variants
+ * that carry runtime-authored payloads (`tool_use.input`,
+ * `tool_result.output`) — see `DaemonConfig.maxInlineEventBytes`
+ * (`create-daemon.ts`) for the host-facing contract.
+ *
+ * 64 KiB is the same threshold `sendArtifact` already uses to decide inline
+ * vs. blob for an artifact (`MAX_INLINE_ARTIFACT_BYTES`): one number for "a
+ * payload this daemon is willing to put on the activity wire".
+ */
+export declare const DEFAULT_MAX_INLINE_EVENT_BYTES: number;
+/**
+ * Smallest accepted `maxInlineEventBytes`. Below this a legitimate spill
+ * descriptor (`field` + byte counts + a `BlobRef` whose `blobId` is chosen by
+ * the server, plus the event's own `type`/`tool`/`toolCallId`) stops fitting
+ * inside the cap it is supposed to keep the event under, which would turn a
+ * host's configuration mistake into a per-event runtime invariant failure.
+ * Enforced up front at `DaemonConfig` validation, never here.
+ */
+export declare const MIN_MAX_INLINE_EVENT_BYTES = 4096;
+/**
+ * Worst-case JSON cost of the `,"spill":{…}` fragment when the descriptor
+ * carries an `unstoredReason` rather than a server-chosen `BlobRef`.
+ *
+ * Every part is bounded by construction, which a `BlobRef` is not — its
+ * `blobId` is an arbitrary-length server-chosen string:
+ *
+ * ```
+ *   ,"spill":                                  9
+ *   {                                          1
+ *   "field":"output",                         17   ("output" is the longer of the two)
+ *   "totalBytes":<=16 digits>,                30
+ *   "omittedBytes":<=16 digits>,              32   (never exceeds totalBytes)
+ *   "contentType":"application/json",         33   (a module constant)
+ *   "unstoredReason":                         17
+ *   "<=512 bytes of escaped reason>"         514   (MAX_UNSTORED_REASON_BYTES + 2 quotes)
+ *   }                                          1
+ *                                           ----
+ *                                            654
+ * ```
+ *
+ * Rounded up to 768 so digit-count growth cannot invalidate it. Because the
+ * event is spread first and `spill` written last, a bounded event is EXACTLY
+ * the empty-preview skeleton plus this fragment — so refusing to spill unless
+ * `skeleton + MAX_SPILL_DESCRIPTOR_BYTES <= maxInlineBytes` is what makes the
+ * final cap check unreachable rather than merely unlikely. `event-spill.test.ts`
+ * asserts this against a maximally escaping reason instead of trusting the
+ * comment.
+ */
+export declare const MAX_SPILL_DESCRIPTOR_BYTES = 768;
+export interface EventSpillDeps {
+    /** Effective inline ceiling for this daemon; already validated at the `DaemonConfig` layer. */
+    maxInlineBytes: number;
+    /** Only the upload half of `BlobResolver` is needed, so a test double stays minimal. */
+    blobClient: Pick<BlobResolver, 'uploadArtifact'>;
+    /** Scopes the upload's idempotency key to the task that produced the event. */
+    taskId: string;
+    /** Task lifecycle authority — aborting it stops the spill upload with the rest of the task's blob I/O. */
+    signal?: AbortSignal;
+    /** Diagnostic seam. Called only on a path that loses information (upload failure, or an event this policy cannot bound). */
+    log?: (message: string) => void;
+}
+/**
+ * Bound one normalized `AgentEvent` at the daemon's ingestion boundary
+ * (`TaskRunner.pump`).
+ *
+ * An event whose serialized form already fits `maxInlineBytes` is returned
+ * **as the same object reference** — the overwhelming majority of events pay
+ * exactly one `JSON.stringify` and nothing else, and no downstream identity
+ * comparison changes meaning.
+ *
+ * An oversized `tool_use` / `tool_result` has its runtime-authored field
+ * (`input` / `output`) uploaded to the blob plane in full and REPLACED inline
+ * by `{ preview: { head, tail } }`, with an additive `spill` descriptor
+ * carrying either the resulting `BlobRef` or a bounded `unstoredReason`. The
+ * replacement is *measured* against the cap, never assumed to fit: the
+ * preview budget is whatever is left after the rest of the event and the
+ * real descriptor, and it is shrunk until `JSON.stringify(result)` actually
+ * fits (JSON escaping can cost several bytes per source character, so the
+ * byte budget alone is not a bound).
+ *
+ * Storage failure is never silent and never fatal: the preview still ships,
+ * `unstoredReason` says why the omitted bytes are unreadable, and `log` is
+ * called. The runtime's own transcript still holds the content, so failing
+ * the task over a telemetry upload would trade a real result for an
+ * observability problem.
+ */
+export declare function spillOversizedEvent(event: AgentEvent, deps: EventSpillDeps): Promise<AgentEvent>;

package/dist/daemon/journal/journal.d.ts

@@ -124,18 +124,21 @@ export interface LocalTransitionRecord {
 /** Whether the cloud has confirmed the terminal this daemon produced (§12.7.3's "terminal 生成后、truth 写入前" window). */
 export type TerminalTruthState = 'pending' | 'confirmed' | 'failed';
 /**
- * A task's terminal, as it exists locally. The PAYLOAD is not stored — only
- * its hash, plus enough retry state to know whether the cloud has taken it.
+ * One immutable canonical terminal and its delivery projection. Bytes are the
+ * replay authority; the hash is checked against them, never used as a substitute.
  */
 export interface LocalTerminalRecord {
     readonly taskId: string;
-    readonly terminalType: 'complete' | 'failed' | 'cancelled';
+    readonly terminalType: 'complete' | 'failed' | 'cancelled' | 'declined';
+    readonly bytes: string;
     readonly payloadHash: string;
     readonly truthState: TerminalTruthState;
     /** How many times delivery to the cloud has been attempted. */
     readonly attempt: number;
     readonly lastError?: string;
     readonly recordedAt: string;
+    /** Committed atomically with the original interruption report. */
+    readonly recovery?: RecoveryOutcome;
 }
 /** A task the journal knows about that has no terminal and no recovery marker — i.e. one this daemon was in the middle of when it stopped. */
 export interface RecoverableTask {
@@ -147,6 +150,7 @@ export interface RecoverableTask {
     readonly claimedRuntime?: string;
     readonly workspaceRef?: string;
     readonly updatedAt: string;
+    readonly envelopeBytes: string;
 }
 /**
  * What recovery decided about a task. `interrupted` is the honest default for
@@ -262,6 +266,14 @@ export interface LocalTaskJournal {
     recordTransition(record: LocalTransitionRecord): Promise<void>;
     /** Record (or update the retry state of) a task's terminal. Idempotent by task id: a replay with the same payload hash is a no-op beyond retry bookkeeping. */
     recordTerminal(record: LocalTerminalRecord): Promise<void>;
+    /** Exact original terminal bytes, including rejected records, until acknowledged. */
+    listPendingTerminals(identity: JournalIdentity): Promise<LocalTerminalRecord[]>;
+    /** A successful authenticated transport disposition, bound to the original bytes. */
+    confirmTerminal(taskId: string, payloadHash: string): Promise<void>;
+    rejectTerminal(taskId: string, payloadHash: string, reason: string): Promise<void>;
+    /** Includes old interruption markers without reports; they must not hide pending work. */
+    listRecoveryTasks(identity: JournalIdentity): Promise<RecoverableTask[]>;
+    readTask(taskId: string, identity: JournalIdentity): Promise<RecoverableTask | undefined>;
     /** Tasks with no terminal and no recovery marker — what this daemon was in the middle of when it last stopped. */
     listRecoverable(): Promise<RecoverableTask[]>;
     /** Close out one recoverable task by writing its recovery marker. Never deletes; a marked row is on §12.7.2.1's never-auto-delete list. */

package/dist/daemon/journal/sqlite-journal.d.ts

@@ -1,4 +1,4 @@
-import { type AdmissionRecord, type CategoryUsage, type CleanableCategory, type CleanupCandidate, type CleanupResult, type CompactOptions, type CompactResult, type JournalReceipt, type LocalStorageUsage, type LocalTaskJournal, type LocalTerminalRecord, type LocalTransitionRecord, type RecoverableTask, type RecoveryOutcome, type ReceivedEnvelopeRecord, type StorageCategory } from './journal';
+import { type JournalIdentity, type AdmissionRecord, type CategoryUsage, type CleanableCategory, type CleanupCandidate, type CleanupResult, type CompactOptions, type CompactResult, type JournalReceipt, type LocalStorageUsage, type LocalTaskJournal, type LocalTerminalRecord, type LocalTransitionRecord, type RecoverableTask, type RecoveryOutcome, type ReceivedEnvelopeRecord, type StorageCategory } from './journal';
 import { JournalHandleCleanupError, type JournalOpenFaultSeam } from './sqlite-support';
 export { JournalHandleCleanupError };
 /** The single database file, per §12.7.2's "建议单库 `<storeDir>/daemon.db`". */
@@ -24,7 +24,7 @@ export declare const DEFAULT_JOURNAL_BUSY_TIMEOUT_MS = 5000;
  * (`util/secure-dir.ts`): a seam the production path never supplies, exercised
  * from any host.
  */
-export type JournalFaultStep = 'append:before-begin' | 'append:after-envelope' | 'append:after-task' | 'append:after-receipt' | 'append:before-commit' | 'admission:before-commit' | 'transition:before-commit' | 'terminal:before-commit' | 'recovery:before-commit' | 'cleanup:before-commit' | 'prune:before-commit';
+export type JournalFaultStep = 'append:before-begin' | 'append:after-envelope' | 'append:after-task' | 'append:after-receipt' | 'append:before-commit' | 'append:after-commit' | 'admission:before-commit' | 'transition:before-commit' | 'terminal:before-commit' | 'terminal:after-commit' | 'recovery:after-commit' | 'confirm:before-commit' | 'confirm:after-commit' | 'recovery:before-commit' | 'cleanup:before-commit' | 'prune:before-commit';
 export interface JournalFaultSeam {
     /** Throw to simulate a crash or IO error at exactly this step. Return normally to proceed. */
     onStep?(step: JournalFaultStep): void;
@@ -79,6 +79,11 @@ export declare class SqliteLocalTaskJournal implements LocalTaskJournal {
      * first fact stands.
      */
     recordTerminal(record: LocalTerminalRecord): Promise<void>;
+    readTask(taskId: string, identity: JournalIdentity): Promise<RecoverableTask | undefined>;
+    listRecoveryTasks(identity: JournalIdentity): Promise<RecoverableTask[]>;
+    listPendingTerminals(identity: JournalIdentity): Promise<LocalTerminalRecord[]>;
+    confirmTerminal(taskId: string, payloadHash: string): Promise<void>;
+    rejectTerminal(taskId: string, payloadHash: string, reason: string): Promise<void>;
     /**
      * What this daemon was in the middle of: a task whose offer envelope is
      * durable, that has no terminal, that was not declined, and that recovery

package/dist/daemon/long-poll-transport.d.ts

@@ -49,56 +49,8 @@ export interface LongPollClientOptions {
     onRevoked?: () => void;
     /** Called when the server cannot replay the durable cursor supplied to this poll. */
     onReplayCursorTooOld?: (error: ReplayCursorTooOldError) => void;
-    /**
-     * M4 Phase 4 (version-negotiation drill fix), scope narrowed by finding F1:
-     * called ONLY for a batch entry that failed to parse because its `type`
-     * is entirely unrecognized (`parseMessage` throwing
-     * {@link UnknownMessageTypeError}) and which still carries a
-     * numeric envelope-level `seq` AND a recognizably task-class `type` (a
-     * `task.` prefix — see `extractSkippableSeq`'s own doc comment for why a
-     * `conn.*`-shaped or type-less entry is deliberately excluded, mirroring
-     * F2's "conn.* is never cursor-tracked" rule), so the caller can advance
-     * its cursor/watermark past it even though there is no real `Envelope` to
-     * hand to `onEnvelope`. Without this, a persistently-redelivered
-     * unrecognized-type entry (the real server retains and redelivers an
-     * un-acked envelope, protocol §9) would keep reappearing at the same
-     * cursor position forever.
-     *
-     * Finding F1: a RECOGNIZED type that fails schema validation
-     * ({@link EnvelopeValidationError} — e.g. a `task.offer` whose
-     * `PermissionPolicy` rejects an unknown constraint) is deliberately NOT
-     * reported here. That failure is a genuinely malformed control message,
-     * not forward-compat tolerance — forwarding its `seq` here would
-     * permanently ack a message the daemon never actually understood (the
-     * server would stop redelivering it, silently stranding whatever it was
-     * offering). This callback being scoped to `UnknownMessageTypeError` only
-     * preserves the no-silent-permanent-ack property. Optional
-     * only for constructor/test convenience — `ConnectionManager` always
-     * supplies it.
-     */
-    onSkippedSeq?: (seq: number) => void;
-    /**
-     * Finding R1 (cross-model re-review — the F1 fix alone was NOT-CLOSED):
-     * called for a batch entry whose `type` WAS recognized but whose payload
-     * failed schema validation ({@link EnvelopeValidationError}) — a genuine
-     * delivery failure at that specific seq, not forward-compat tolerance
-     * (contrast {@link onSkippedSeq}, which is scoped to the opposite case,
-     * an entirely unrecognized type). F1's own fix — simply not forwarding
-     * this seq to `onSkippedSeq` — turned out to be insufficient on its own:
-     * a LATER valid envelope in the same or a later batch would still
-     * silently advance the durable cursor PAST this seq once its own handler
-     * succeeded, since nothing had told `ConnectionManager` this seq needed
-     * the same stall treatment a thrown handler failure already gets — an
-     * INDIRECT permanent ack, one hop removed from the exact bug F1 set out
-     * to fix. `ConnectionManager` (`noteValidationFailure`) engages
-     * `stalledAtSeq` for this seq the same way `process()`'s own catch block
-     * does for a real thrown handler — freezing `dedupWatermark()` at the
-     * durable cursor (so the server's retain-and-redeliver semantics,
-     * protocol §9, keep this seq alive) and, via that SAME existing
-     * machinery, holding back the cursor for anything else delivered after it
-     * in the same batch too, exactly as a real handler failure already would.
-     * Optional only for constructor/test convenience — `ConnectionManager`
-     * always supplies it.
+    /** Unknown or malformed executable messages have no durable disposition.
+     * Freeze their sequence; a later valid message must not acknowledge them.
      */
     onValidationFailedSeq?: (seq: number) => void;
     /**

package/dist/daemon/task-runner.d.ts

@@ -228,6 +228,8 @@ export interface TaskRunnerDeps {
     agentSessionHandoffs?: AgentSessionHandoffStore;
     deviceId: string;
     send: (envelope: Envelope) => void;
+    /** Fsync the execution commitment before claim/runtime side effects. */
+    beforeClaim?: (taskId: string, runtime: string) => Promise<void>;
     blobClient: BlobResolver;
     batcherOptions?: ProgressBatcherOptions;
     /**
@@ -330,6 +332,15 @@ export interface TaskRunnerDeps {
      * interface (`shutdownInterruptTimeoutMs`, `approvalTimeoutMs`).
      */
     maxTaskOutputBytes?: number;
+    /**
+     * Per-event inline ceiling for `tool_use.input` / `tool_result.output` —
+     * see `DaemonConfig.maxInlineEventBytes` (`create-daemon.ts`) for the full
+     * contract and {@link DEFAULT_MAX_INLINE_EVENT_BYTES} for the default.
+     * Validated (positive safe integer, at least
+     * `MIN_MAX_INLINE_EVENT_BYTES`) at the `DaemonConfig` layer, not here —
+     * this seam trusts its caller, same as `maxTaskOutputBytes` above.
+     */
+    maxInlineEventBytes?: number;
     /**
      * M4 (additive-minor, `task.approval_resolved`): the capabilities advertised
      * by the CURRENT transport's server (`conn.ack` on WS, the latest successful
@@ -569,6 +580,8 @@ export declare class TaskRunner {
     usesAgentEgress(taskId: string): boolean;
     /** M5 batch-3 (workstream 2): effective `maxTaskOutputBytes` cap for this daemon — see {@link DEFAULT_MAX_TASK_OUTPUT_BYTES}'s own doc comment. */
     private get maxTaskOutputBytes();
+    /** Effective per-event inline ceiling for this daemon — see `DaemonConfig.maxInlineEventBytes`. */
+    private get maxInlineEventBytes();
     /** WP0: effective per-canonical-Agent-home Attempt cap — see {@link DEFAULT_MAX_CONCURRENT_MUTABLE_SESSIONS_PER_AGENT_HOME}. */
     private get maxConcurrentMutableSessionsPerAgentHome();
     /**

package/dist/daemon/team-workspace.d.ts

@@ -191,6 +191,15 @@ export declare class LocalTeamWorkspace {
         expiresAt: string;
     }>>;
     postMessage(input: TeamPostMessageInput): Promise<TeamMessageAcceptedReceipt>;
+    /** Metadata-only operator notification view. Never advances delivery or acknowledgement. */
+    notificationSnapshot(input: TeamReadMessagesInput): Promise<{
+        workspaceId: string;
+        memberId: string;
+        registryRevision: TeamWorkspaceRevision;
+        expiresAt: string;
+        acknowledgedThroughSeq: number;
+        latestPeerSeq: number | null;
+    }>;
     readMessages(input: TeamReadMessagesInput): Promise<TeamReadMessagesResult>;
     ackMessages(input: TeamAckMessagesInput): Promise<TeamAckReceipt>;
     private resolveLease;