@byok-sdk/client 0.13.0 → 0.15.0

package/dist/bin/byok-mcp-env.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+import { spawn } from 'child_process';
+
+async function runMcpEnvLauncher() {
+  const key = process.env.BYOK_MCP_ENV_KEY;
+  if (!key || !/^BYOK_MCP_PAYLOAD_[A-F0-9]{32}$/.test(key)) throw new Error("invalid MCP environment binding");
+  const encoded = process.env[key];
+  if (!encoded) throw new Error("missing sealed MCP environment");
+  let config;
+  try {
+    config = JSON.parse(encoded);
+    if (!config || typeof config.command !== "string" || !config.command || config.args !== void 0 && (!Array.isArray(config.args) || config.args.some((value) => typeof value !== "string")) || config.env !== void 0 && (typeof config.env !== "object" || config.env === null || Array.isArray(config.env) || Object.values(config.env).some((value) => typeof value !== "string"))) throw new Error();
+  } catch {
+    throw new Error("invalid sealed MCP environment");
+  }
+  const env = { ...process.env };
+  delete env.BYOK_MCP_ENV_KEY;
+  for (const name of Object.keys(env)) if (name.startsWith("BYOK_MCP_PAYLOAD_")) delete env[name];
+  Object.assign(env, config.env);
+  await new Promise((resolve, reject) => {
+    const child = spawn(config.command, config.args ?? [], { env, stdio: "inherit", windowsHide: true });
+    child.once("error", () => reject(new Error("MCP child could not be spawned")));
+    child.once("close", (code) => {
+      if (code === 0) resolve();
+      else reject(new Error("MCP child exited unsuccessfully"));
+    });
+  });
+}
+
+// src/bin/byok-mcp-env.ts
+runMcpEnvLauncher().catch(() => {
+  process.stderr.write("byok-mcp-env: MCP launch failed\n");
+  process.exitCode = 1;
+});
+//# sourceMappingURL=byok-mcp-env.js.map
+//# sourceMappingURL=byok-mcp-env.js.map

package/dist/bin/byok-mcp-env.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/bin/mcp-env-launcher.ts","../../src/bin/byok-mcp-env.ts"],"names":[],"mappings":";;;AAMA,eAAsB,iBAAA,GAAmC;AACvD,EAAA,MAAM,GAAA,GAAM,QAAQ,GAAA,CAAI,gBAAA;AACxB,EAAA,IAAI,CAAC,GAAA,IAAO,CAAC,iCAAA,CAAkC,IAAA,CAAK,GAAG,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,iCAAiC,CAAA;AAC3G,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC/B,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAC9D,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,OAAO,CAAA;AAC3B,IAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,CAAO,OAAA,KAAY,YAAY,CAAC,MAAA,CAAO,OAAA,IACvD,MAAA,CAAO,IAAA,KAAS,KAAA,CAAA,KAAc,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,IAAI,CAAA,IAAK,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,CAAA,KAAA,KAAS,OAAO,KAAA,KAAU,QAAQ,CAAA,CAAA,IAChH,MAAA,CAAO,QAAQ,KAAA,CAAA,KAAc,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,IAAY,MAAA,CAAO,QAAQ,IAAA,IAAQ,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,GAAG,CAAA,IAC7G,OAAO,MAAA,CAAO,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,CAAA,KAAA,KAAS,OAAO,KAAA,KAAU,QAAQ,CAAA,CAAA,EAAK,MAAM,IAAI,KAAA,EAAM;AAAA,EAC/F,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,EAClD;AACA,EAAA,MAAM,GAAA,GAAM,EAAE,GAAG,OAAA,CAAQ,GAAA,EAAI;AAC7B,EAAA,OAAO,GAAA,CAAI,gBAAA;AACX,EAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,EAAG,IAAI,IAAA,CAAK,UAAA,CAAW,mBAAmB,CAAA,EAAG,OAAO,GAAA,CAAI,IAAI,CAAA;AAC9F,EAAA,MAAA,CAAO,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,GAAG,CAAA;AAC7B,EAAA,MAAM,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AAC3C,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,MAAA,CAAO,OAAA,EAAS,OAAO,IAAA,IAAQ,EAAC,EAAG,EAAE,GAAA,EAAK,KAAA,EAAO,SAAA,EAAW,WAAA,EAAa,MAAM,CAAA;AACnG,IAAA,KAAA,CAAM,IAAA,CAAK,SAAS,MAAM,MAAA,CAAO,IAAI,KAAA,CAAM,gCAAgC,CAAC,CAAC,CAAA;AAC7E,IAAA,KAAA,CAAM,IAAA,CAAK,SAAS,CAAA,IAAA,KAAQ;AAC1B,MAAA,IAAI,IAAA,KAAS,GAAG,OAAA,EAAQ;AAAA,WACnB,MAAA,CAAO,IAAI,KAAA,CAAM,iCAAiC,CAAC,CAAA;AAAA,IAC1D,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AACH;;;AC9BA,iBAAA,EAAkB,CAAE,MAAM,MAAM;AAC9B,EAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,mCAAmC,CAAA;AACxD,EAAA,OAAA,CAAQ,QAAA,GAAW,CAAA;AACrB,CAAC,CAAA","file":"byok-mcp-env.js","sourcesContent":["import { spawn } from 'node:child_process';\n\n/** Project one sealed server's env through Codex's documented env_vars channel.\n * No secret or original server argument is carried in the launcher argv.\n * The child remains in Codex's owned process group / Windows Job Object.\n */\nexport async function runMcpEnvLauncher(): Promise<void> {\n  const key = process.env.BYOK_MCP_ENV_KEY;\n  if (!key || !/^BYOK_MCP_PAYLOAD_[A-F0-9]{32}$/.test(key)) throw new Error('invalid MCP environment binding');\n  const encoded = process.env[key];\n  if (!encoded) throw new Error('missing sealed MCP environment');\n  let config: { command: string; args?: string[]; env?: Record<string, string> };\n  try {\n    config = JSON.parse(encoded);\n    if (!config || typeof config.command !== 'string' || !config.command\n      || (config.args !== undefined && (!Array.isArray(config.args) || config.args.some(value => typeof value !== 'string')))\n      || (config.env !== undefined && (typeof config.env !== 'object' || config.env === null || Array.isArray(config.env)\n        || Object.values(config.env).some(value => typeof value !== 'string')))) throw new Error();\n  } catch {\n    throw new Error('invalid sealed MCP environment');\n  }\n  const env = { ...process.env };\n  delete env.BYOK_MCP_ENV_KEY;\n  for (const name of Object.keys(env)) if (name.startsWith('BYOK_MCP_PAYLOAD_')) delete env[name];\n  Object.assign(env, config.env);\n  await new Promise<void>((resolve, reject) => {\n    const child = spawn(config.command, config.args ?? [], { env, stdio: 'inherit', windowsHide: true });\n    child.once('error', () => reject(new Error('MCP child could not be spawned')));\n    child.once('close', code => {\n      if (code === 0) resolve();\n      else reject(new Error('MCP child exited unsuccessfully'));\n    });\n  });\n}\n","#!/usr/bin/env node\nimport { runMcpEnvLauncher } from './mcp-env-launcher';\n\nrunMcpEnvLauncher().catch(() => {\n  process.stderr.write('byok-mcp-env: MCP launch failed\\n');\n  process.exitCode = 1;\n});\n"]}

package/dist/bin/commands/doctor.d.ts

@@ -3,6 +3,9 @@ import { type CollectDiagnosticsOptions } from '../../diagnostics/diagnostics';
 export interface DoctorOptions extends CollectDiagnosticsOptions {
     json?: boolean;
     fix?: boolean;
+    repair?: string;
+    expectedDeviceId?: string;
+    expectedTenantId?: string;
     confirmed?: boolean;
     log?: (line: string) => void;
 }

package/dist/bin/commands/team-pi-relay.d.ts

@@ -0,0 +1,24 @@
+import type { DaemonConfig } from '../../daemon/create-daemon';
+import { type CodexTeamBinding } from '../team-codex-relay';
+export declare function parsePiRelayBindings(value: unknown, workspaceId: string): {
+    codex: CodexTeamBinding;
+    pi: {
+        context: string;
+        lease: import("../..").TeamMemberLease;
+        afterSeq: number;
+        cwd: string;
+        sessionDir: string;
+        provider: string;
+        model: string;
+        systemPrompt: string;
+        extensionPaths: string[];
+    };
+};
+export declare function runTeamPiRelayCommand(input: {
+    config: DaemonConfig;
+    workspaceId: string;
+    bindingsFile: string;
+    codexBin: string;
+    maxNotifications: number;
+    signal: AbortSignal;
+}): Promise<void>;

package/dist/bin/commands/team-relay.d.ts

@@ -0,0 +1,11 @@
+import type { DaemonConfig } from '../../daemon/create-daemon';
+/** One foreground owner per room. Stale locks are never guessed away or stolen. */
+export declare function acquireTeamRelayLock(storeDir: string, workspaceId: string): Promise<() => Promise<void>>;
+export declare function runTeamRelayCommand(input: {
+    config: DaemonConfig;
+    workspaceId: string;
+    bindingsFile: string;
+    codexBin: string;
+    maxNotifications: number;
+    signal: AbortSignal;
+}): Promise<void>;

package/dist/bin/mcp-env-launcher.d.ts

@@ -0,0 +1,5 @@
+/** Project one sealed server's env through Codex's documented env_vars channel.
+ * No secret or original server argument is carried in the launcher argv.
+ * The child remains in Codex's owned process group / Windows Job Object.
+ */
+export declare function runMcpEnvLauncher(): Promise<void>;

package/dist/bin/runtime-probe.d.ts

@@ -1,3 +1,4 @@
+import type { RuntimeDetectResult } from '../types';
 import { type RuntimeAdapter } from '../index';
 export declare const RUNTIME_PROBE_TIMEOUT_MS = 5000;
 /** The bundled adapter set `byok-agent status`/`byok-agent runtimes` probe by default — same unset-vs-set allowlist contract as `createDaemon` itself. */
@@ -13,7 +14,9 @@ export declare function defaultRuntimeAdapters(runtimeAllowlist: string[] | unde
  */
 export interface ProbedRuntime {
     id: string;
+    /** Deterministic projection of outcome, never adapter-authored. */
     present: boolean;
+    outcome: RuntimeDetectResult['kind'];
     version?: string;
     authPresent?: boolean;
     steer: boolean;
@@ -21,13 +24,9 @@ export interface ProbedRuntime {
     permissionModes: string[];
 }
 /**
- * Runs `detect()` and reads each adapter's frozen descriptor, in parallel. Every
- * bundled adapter's own `detect()` already catches its own failures (e.g.
- * `pi-adapter.ts`'s `detect()` wraps its version probe in try/catch and
- * resolves `{present: false}` rather than rejecting) — the catch here is a
- * defensive backstop for a `RuntimeAdapter` that doesn't hold that
- * convention, not a workaround for an observed failure in the bundled
- * three.
+ * Fresh, parallel local observations. A custom adapter timeout is an observation
+ * deadline only: detect() has no cancellation contract. Never expose arbitrary
+ * adapter errors or interpret an old/malformed result as available.
  */
 export declare function probeRuntimes(adapters: readonly RuntimeAdapter[], options?: {
     timeoutMs?: number;

package/dist/bin/team-codex-relay.d.ts

@@ -0,0 +1,32 @@
+import { type TeamMemberLease } from '../daemon/team-workspace';
+export interface CodexTeamBinding {
+    readonly context: string;
+    readonly lease: TeamMemberLease;
+    readonly threadId: string;
+    readonly endpoint: string;
+    readonly afterSeq: number;
+}
+export interface TeamNotificationSnapshot {
+    workspaceId: string;
+    memberId: string;
+    registryRevision: string;
+    expiresAt: string;
+    acknowledgedThroughSeq: number;
+    latestPeerSeq: number | null;
+}
+/** Local endpoints only. Never select a default daemon or infer a thread from its name. */
+export declare function validateCodexRelayEndpoint(value: unknown): asserts value is string;
+export declare function parseCodexTeamBinding(binding: unknown, workspaceId: string): CodexTeamBinding;
+export declare function parseCodexTeamBindings(value: unknown, workspaceId: string): readonly CodexTeamBinding[];
+export declare function loadPrivateTeamDocument(file: string): Promise<unknown>;
+export declare function loadCodexTeamBindings(file: string, workspaceId: string): Promise<readonly CodexTeamBinding[]>;
+export declare function codexTeamNotification(workspaceId: string, throughSeq: number): string;
+/** The native queue receipt contract is qualified against this CLI version. */
+export declare function preflightCodexRelay(codexBin: string, signal: AbortSignal): Promise<string>;
+/** Only a confirmed exact-thread queue receipt advances this epoch's notification watermark. */
+export declare function queueCodexTeamNotification(input: {
+    codexBin: string;
+    binding: CodexTeamBinding;
+    throughSeq: number;
+    signal: AbortSignal;
+}): Promise<string>;

package/dist/bin/team-notification-relay.d.ts

@@ -0,0 +1,40 @@
+import type { TeamMemberLease } from '../daemon/team-workspace';
+export interface TeamRelayBinding {
+    readonly context: string;
+    readonly lease: TeamMemberLease;
+    readonly afterSeq: number;
+}
+export type TeamRelayState = 'running' | 'paused' | 'stopped' | 'budget_exhausted' | 'failed';
+export declare class TeamNotificationRelay<T extends TeamRelayBinding> {
+    private readonly options;
+    private state;
+    private attempts;
+    private error;
+    private readonly watermarks;
+    private pending;
+    private readonly abort;
+    constructor(options: {
+        bindings: readonly T[];
+        maxNotifications: number;
+        snapshot: (binding: T, afterSeq: number) => Promise<unknown>;
+        describe: (binding: T) => Record<string, string>;
+        ready?: (binding: T) => Promise<boolean>;
+        enqueue: (binding: T, throughSeq: number, signal: AbortSignal) => Promise<string>;
+    });
+    status(): {
+        state: TeamRelayState;
+        attempts: number;
+        maxNotifications: number;
+        error?: "queue_delivery_unknown" | "snapshot_failed" | undefined;
+        bindings: {
+            workspaceId: string;
+            memberId: string;
+            notifiedThroughSeq: number | undefined;
+        }[];
+    };
+    pause(): void;
+    resume(): void;
+    stop(): void;
+    tick(): Promise<void>;
+    private performTick;
+}

package/dist/bin/team-pi-session.d.ts

@@ -0,0 +1,59 @@
+export interface PiInteractionResponse {
+    sessionId: string;
+    requestId: string;
+    response: {
+        cancelled: true;
+    } | {
+        confirmed: boolean;
+    } | {
+        value: string;
+    };
+}
+export interface PiTeamSessionOptions {
+    workspaceId: string;
+    cwd: string;
+    sessionDir: string;
+    provider: string;
+    model: string;
+    systemPrompt: string;
+    mcpConfig: Record<string, unknown>;
+    extensionPaths?: readonly string[];
+    onEvent: (event: Record<string, unknown>) => void;
+}
+/** One owned RPC child; GUI replies never share a model-controlled tool channel. */
+export declare class PiTeamSession {
+    private readonly options;
+    private client;
+    private sessionId;
+    private revision;
+    private phase;
+    private readonly interactions;
+    private readonly replying;
+    private stopping;
+    private active;
+    private pendingInputs;
+    private readonly privateFiles;
+    private constructor();
+    static start(options: PiTeamSessionOptions): Promise<PiTeamSession>;
+    status(): {
+        sessionId: string | undefined;
+        phase: "closed" | "failed" | "open" | "starting" | "waiting";
+        revision: number;
+        pendingUi: {
+            id: string | undefined;
+            method: unknown;
+            responding: boolean;
+        }[];
+    };
+    private fail;
+    private onFrame;
+    private onInteraction;
+    private request;
+    private state;
+    ready(): Promise<boolean>;
+    notify(throughSeq: number, signal: AbortSignal): Promise<string>;
+    sendInput(message: string): Promise<string>;
+    respond(input: PiInteractionResponse): Promise<void>;
+    drain(signal: AbortSignal): Promise<void>;
+    stop(): Promise<void>;
+}

package/dist/daemon/admission-wait.d.ts

@@ -0,0 +1,2 @@
+/** Only for side-effect-free admission. Never abandon an owned lease/session. */
+export declare function awaitAdmission<T>(operation: () => Promise<T>, signal: AbortSignal): Promise<T>;

package/dist/daemon/agent-egress-policy.d.ts

@@ -31,6 +31,14 @@ export declare function resolveAgentEgressPolicy(policy: AgentEgressPolicy | und
  * Default activity projection. Every retained string is SDK-authored; no
  * runtime trajectory, tool, prompt, environment, argv, path, or credential
  * value survives this transformation.
+ *
+ * Each case CONSTRUCTS a fresh event from SDK-authored literals rather than
+ * editing the incoming one, which is what makes the guarantee total rather
+ * than a list of fields someone remembered to strip. `spill` on
+ * `tool_use`/`tool_result` is covered by exactly that: a `BlobRef` is a
+ * readable locator for the omitted tool payload — content, not metadata — so
+ * it never survives a metadata-status projection, and neither do the byte
+ * counts that would leak the payload's size.
  */
 export declare function metadataStatusEvent(event: AgentEvent): AgentEvent;
 export declare function eventBytes(event: AgentEvent): number;

package/dist/daemon/agent-egress-spool.d.ts

@@ -70,6 +70,7 @@ export declare class AgentReliableSpool {
     readonly homeDir: string;
     readonly spoolPath: string;
     private readonly pending;
+    private readonly file;
     private nextCursor;
     private logEntries;
     private writeTail;

package/dist/daemon/agent-message-outbox.d.ts

@@ -20,12 +20,14 @@ export interface AgentMessageOutboxRecord {
 export declare class AgentMessageOutboxError extends Error {
     constructor(message: string);
 }
-/** Agent-local, append-before-send outbox. Only exact accepted disposition retires bytes. */
+/** Agent-local append-before-send authority. Only acceptance or explicit terminal archival retires bytes. */
 export declare class AgentMessageOutbox {
     readonly homeDir: string;
     readonly outboxPath: string;
     private readonly pendingByTask;
+    private readonly revokedTasks;
     private readonly dispositionByTask;
+    private readonly file;
     private nextCursor;
     private logEntries;
     private writeTail;
@@ -34,7 +36,7 @@ export declare class AgentMessageOutbox {
     /** Re-open every existing Agent-local message outbox without following Agent-home symlinks. */
     static recover(agentsRoot: string, tenantId: string): Promise<readonly AgentMessageOutbox[]>;
     records(): readonly AgentMessageOutboxRecord[];
-    /** Activated records with no exact disposition yet; only these may be transport-replayed. */
+    /** Records without disposition or local revoke; transport replay additionally requires session binding. */
     retryableRecords(): readonly AgentMessageOutboxRecord[];
     get(taskId: string): AgentMessageOutboxRecord | undefined;
     appendDraft(input: {
@@ -48,11 +50,21 @@ export declare class AgentMessageOutbox {
         readonly maxPendingEvents: number;
         readonly maxPendingBytes: number;
     }): Promise<AgentMessageOutboxRecord>;
-    activate(taskId: string, sessionRef: string): Promise<AgentMessageOutboxRecord | undefined>;
+    activate(taskId: string, sessionRef: string, isCurrent?: () => boolean): Promise<AgentMessageOutboxRecord | undefined>;
+    /** Local lifecycle cancellation, never a synthesized consumer disposition. */
+    revoke(taskId: string): Promise<void>;
+    private isTerminalEvidence;
     publishPayload(record: AgentMessageOutboxRecord): AgentMessagePublishPayload;
     applyDisposition(taskId: string, input: unknown): Promise<'accepted' | 'held' | 'refused' | 'mismatch' | 'unknown'>;
     private load;
     private appendEntry;
+    /**
+     * Explicit operator maintenance under the Agent-home single-writer lease.
+     * Copy complete terminal evidence durably before removing it from the live log.
+     * Archives are audit artifacts, never another replay input. held remains live.
+     */
+    archiveTerminalRecords(archiveDirectory: string): Promise<string | undefined>;
+    private snapshotEntries;
     private compact;
     private exclusive;
 }

package/dist/daemon/artifact-read.d.ts

@@ -0,0 +1,7 @@
+import type { FileHandle } from 'node:fs/promises';
+export declare const DEFAULT_ARTIFACT_LIMITS: Readonly<{
+    maxFileBytes: number;
+    maxTaskBytes: number;
+}>;
+/** The caller retains fd ownership; no pathname is reopened. */
+export declare function readArtifactBytes(handle: FileHandle, maxBytes: number, signal: AbortSignal, account: (bytes: number) => void): Promise<Buffer>;

package/dist/daemon/connection-manager.d.ts

@@ -1,3 +1,4 @@
+import type { HarnessInfo } from '@byok-sdk/protocol';
 import { type CapabilityFlag, type Envelope, type RuntimeInfo, type ToolsetId } from '@byok-sdk/protocol';
 import { AuthManager } from './auth-manager';
 import type { CursorStore } from './cursor-store';
@@ -14,6 +15,7 @@ export interface ConnectionManagerOptions {
     /** U4a Local Agent release version, sent unchanged in `conn.hello`. */
     clientVersion?: string;
     runtimes: RuntimeInfo[];
+    harnesses?: HarnessInfo[];
     /** Reads current sorted logical IDs from the validated local registry for every `conn.hello`. */
     getConfiguredToolsets?: () => readonly ToolsetId[];
     auth: AuthManager;
@@ -25,6 +27,11 @@ export interface ConnectionManagerOptions {
      */
     onEnvelope: (envelope: Envelope) => void | Promise<void>;
     onStateChange?: (state: ConnectionState) => void;
+    /** Await durable disposition before retiring the exact accepted/rejected bytes. */
+    onOutboundAccepted?: (envelopes: readonly Envelope[]) => Promise<void>;
+    onOutboundRejected?: (envelope: Envelope) => Promise<void>;
+    onOutboundQueued?: (envelope: Envelope) => void;
+    beforeOutboundPost?: (envelopes: readonly Envelope[]) => void;
     /** Backoff between failed long-poll HTTP attempts. Default 2s. */
     longPollRetryDelayMs?: number;
     /** Minimum delay before the next long-poll request after an empty (no-events) response. Default 250ms. */
@@ -68,25 +75,11 @@ export declare class ConnectionManager {
      * guarantees in docs/protocol.md §9.
      */
     private stalledAtSeq;
-    /**
-     * Design A (Wave 2, F3-on-long-poll): the second, in-memory watermark
-     * alongside the durable `cursor`. `cursor` only ever advances AFTER a
-     * `task.*` handler's side effects resolve successfully, and is persisted
-     * (see `advanceCursor`) — that semantics is unchanged. `deliveredSeq`
-     * advances eagerly, the instant a `task.*` envelope is admitted past
-     * dedup (see `deliver`/`noteDelivered`), independent of whether its
-     * handler has even started, let alone succeeded. It exists so a repeated
-     * read at the durable cursor does not re-dispatch an envelope already in
-     * flight — `handleOffer` must not start a second adapter session while a
-     * first attempt is still running. On WS this same field is written the
-     * same way, but since a live WS connection only ever pushes a given `seq`
-     * once, it never has an observable effect there beyond mirroring
-     * `cursor` (see `dedupWatermark`'s doc comment for why redelivery
-     * correctness doesn't depend on resetting it anywhere).
-     */
-    private deliveredSeq;
-    /** Finding F3: serializes `onEnvelope` calls into a per-connection FIFO — one envelope's handler always fully settles before the next one starts. */
+    /** Drain barrier for independently running handlers; not an admission lock. */
     private processingChain;
+    private cursorInitialization;
+    private completionTail;
+    private readonly controlTails;
     /**
      * Design B (finding N4): the ONE outbound queue holds `Envelope` OBJECTS,
      * never re-encoded/rebuilt strings, so a
@@ -112,38 +105,13 @@ export declare class ConnectionManager {
     private terminalError;
     private settledWaiters;
     private pendingCursorSave;
-    /**
-     * Finding P2 (Fix 2b): seqs currently admitted into `processingChain` but
-     * not yet settled — added in `deliver()` the moment a `task.*` envelope is
-     * accepted past the ordinary watermark check, removed in `process()`'s
-     * `finally` once that specific attempt resolves (success OR failure).
-     * While stalled, `dedupWatermark()` deliberately stays frozen below
-     * already-delivered seqs (see its own doc comment) so the failed seq's own
-     * redelivery can get through — but that same frozen watermark also means
-     * every OTHER seq above it rides along on every re-poll too. Without this,
-     * a seq already mid-flight (e.g. a `task.offer` whose prepared operation start()
-     * hasn't resolved yet) would be re-enqueued into `processingChain` on
-     * every such re-poll, piling up duplicate copies that — once the first
-     * finally resolves and the chain unwinds through them — run its handler
-     * again; for `task.offer` specifically, a second adapter session
-     * orphaning the first (`TaskRunner`'s own `this.tasks.has` guard, finding
-     * P2c, is the second, independent layer against exactly that).
-     */
+    /** Admission dedup while an individual handler is running. */
     private readonly inFlightSeqs;
-    /**
-     * Finding P2 (Fix 2b): seqs whose handler has already resolved
-     * successfully at least once this session, tracked only while a stall is
-     * in effect — cleared the moment `stalledAtSeq` itself clears (see
-     * `process()`), since once unstalled the ordinary watermark check via
-     * `deliveredSeq` already covers everything delivered so far, making this
-     * redundant. Needed because the stall-gap-prevention rule in `process()`
-     * deliberately does NOT advance `cursor` past a seq above the
-     * still-unresolved `stalledAtSeq`, even once that seq's own handler
-     * succeeds — so `dedupWatermark()` alone can't distinguish "already
-     * succeeded, don't re-run" from "never yet attempted" for anything in
-     * that gap.
-     */
+    /** Successful side effects retained until their durable acknowledgement. */
     private readonly processedSeqs;
+    private readonly failedEnvelopes;
+    /** Received work lacking a successful handler receipt, including malformed frames. */
+    private readonly unresolvedSeqs;
     /**
      * Finding P3: the pending `drainOutbox` long-poll retry backoff, if any —
      * cancellable so `enterRevoked()` can unblock it immediately instead of
@@ -298,142 +266,21 @@ export declare class ConnectionManager {
      * - F3 (at-most-once): the old code persisted the cursor advance BEFORE
      *   `onEnvelope` even ran (fire-and-forget) — a handler that then failed
      *   left a redelivery-proof envelope permanently marked processed. Inbound
-     *   envelopes are now serialized through `processingChain` (one handler
-     *   fully settles before the next starts) and the cursor only advances
+     *   handlers may run independently; their receipt commits are serialized.
+     *   The cursor only advances
      *   AFTER the handler resolves successfully; a rejection leaves the
      *   cursor where it was (see `stalledAtSeq`), so a future reconnect's
      *   redelivery re-attempts it — safe because every server->daemon type is
      *   documented idempotent (protocol §9).
      */
     private deliver;
-    /**
-     * The local watermark `deliver()` dedupes inbound `task.*` envelopes
-     * against. It is deliberately NOT the long-poll query cursor: that query
-     * is the kernel acknowledgement and uses only the successfully processed
-     * `cursor` (see the constructor). Normally this local watermark is
-     * `deliveredSeq` — which is always >= `cursor` (every envelope that
-     * reaches `advanceCursor` already passed through `noteDelivered` first,
-     * see `deliver`) — so this is the literal `max(cursor, deliveredSeq)` the
-     * design calls for, just expressed via that invariant rather than an
-     * explicit `Math.max`.
-     *
-     * While `stalledAtSeq` is set, this collapses to the durable `cursor`
-     * alone, deliberately ignoring however far `deliveredSeq` had already run
-     * ahead before the failure was known: that's what lets the stalled
-     * envelope's own redelivery (and everything after it, right up to a
-     * fresh success) get past this same dedup check instead of being
-     * self-deduped by the client's own earlier eager tracking of envelopes
-     * whose outcome wasn't known yet. No separate "reset deliveredSeq on
-     * reconnect" step is needed for this to be correct — collapsing to
-     * `cursor` exactly while stalled already produces the right answer on
-     * every long-poll retry path. NOT resetting it unconditionally on every
-     * retry lets `deliveredSeq` keep doing its job of not re-dispatching
-     * something already in flight while a handler is still running.
-     */
+    /** A committed terminal can settle a failed offer receipt even if cloud
+     * cancellation has since filtered that offer from mailbox replay. */
+    retryTaskReceipts(taskId: string): void;
+    /** Only a durable acknowledgement can deduplicate a whole prefix. */
     private dedupWatermark;
-    /** Design A: eagerly advance the in-memory delivery watermark — called for every `task.*` envelope `deliver()` admits past dedup, regardless of transport or of whether its handler has even started yet. */
-    private noteDelivered;
     private process;
-    /**
-     * M4 Phase 4 (version-negotiation drill fix): `LongPollClient` calls this
-     * for a batch entry it could not parse into a known `Envelope` at all (an
-     * unrecognized message type (see `long-poll-transport.ts`'s own doc
-     * comment on `parseLooseEventsPollResponse`) but which still carried a numeric,
-     * task-class envelope-level `seq` (the caller only invokes this for a
-     * `task.`-prefixed type — see `long-poll-transport.ts`'s own
-     * `extractSkippableSeq`; `conn.*`-shaped or type-less entries never reach
-     * here at all, mirroring F2's "conn.* is never cursor-tracked" rule).
-     * There is no real `Envelope` to hand to a handler — a genuinely
-     * unrecognized type has nothing this build could ever act on.
-     *
-     * GATEKEEPER-CAUGHT REGRESSION (fixed here): this used to call
-     * `advanceCursor(seq)` DIRECTLY, synchronously, the instant a skip was
-     * detected in `LongPollClient.loop()`'s per-entry for-loop. That is NOT
-     * "instantaneous and race-free" the way the previous version of this
-     * comment claimed — the hazard was never the skip racing against itself,
-     * it was the skip racing AHEAD of an EARLIER real envelope in the SAME
-     * batch that is still in flight on `processingChain` (`deliver()`, above,
-     * only ever CHAINS `process()` onto that promise chain — it never awaits
-     * it before returning). Concretely, batch `[real seq1, unknown seq2]`:
-     * `deliver(seq1)` chains `process(seq1)` but returns immediately without
-     * running it; the for-loop then reaches `seq2` and (pre-fix) called
-     * `advanceCursor(2)` synchronously, BEFORE `process(seq1)` had even
-     * started, let alone failed. If `seq1`'s handler then failed,
-     * `stalledAtSeq` became 1 — but the durable cursor was already 2, so
-     * `dedupWatermark()` returned 2, and every future redelivery of seq1 was
-     * dedup-dropped as "already past the cursor" forever: permanent envelope
-     * loss, exactly the F3 bug class the whole `stalledAtSeq`/frozen-watermark
-     * mechanism exists to prevent.
-     *
-     * Fix: the cursor-advancing half is now CHAINED onto `processingChain`
-     * too, exactly like `process()`'s own post-handler bookkeeping — so it
-     * only ever runs once every earlier envelope already queued ahead of it
-     * has fully settled (success or failure), and can observe `stalledAtSeq`'s
-     * REAL, up-to-date value rather than whatever it happened to be at the
-     * instant the skip was first noticed. The guard mirrors `process()`'s own
-     * success-path guard exactly: never advance past a still-unresolved
-     * earlier failure, unless (degenerate, cannot really happen for a skip)
-     * this exact seq IS the stalled one.
-     *
-     * `noteDelivered` (the eager, in-memory watermark) stays UNCHAINED —
-     * called immediately, unconditionally, regardless of `stalledAtSeq` —
-     * matching `deliver()`'s own eager, unconditional call for a real
-     * envelope: its only job is "don't re-dispatch something already handed off,"
-     * independent of outcome, and that property does not depend on FIFO
-     * ordering the way the DURABLE cursor does.
-     *
-     * Deliberately NO top-level `dedupWatermark() <= seq` early-return before
-     * queuing the chained callback (an earlier draft of this fix had one, and
-     * it was itself subtly wrong): `deliveredSeq` can already reflect a seq
-     * from the FIRST time it was ever seen, while the DURABLE cursor is still
-     * behind it because a stall intervened before that seq's chained
-     * advancement ran — a pre-check keyed on `deliveredSeq` would then
-     * wrongly treat a LATER redelivery of the same seq (arriving once the
-     * stall has since cleared) as "already accounted for" and never queue
-     * another attempt, permanently stranding the cursor one seq short. Always
-     * queuing is safe and cheap: `advanceCursor`'s own `seq <= this.cursor`
-     * guard already makes a genuinely-redundant call a no-op, so there is no
-     * correctness reason to short-circuit earlier, only a (here, unnecessary)
-     * micro-optimization one.
-     */
-    private noteSkippedSeq;
-    /**
-     * Finding R1 (cross-model re-review — was NOT-CLOSED against F1):
-     * `LongPollClient` calls this for a batch entry whose `type` it
-     * recognized but whose payload failed schema validation
-     * ({@link EnvelopeValidationError}) — a genuine delivery failure at that
-     * seq, unlike `noteSkippedSeq`'s forward-compat case. Deliberately mirrors
-     * `process()`'s own catch block (`if (tracked && this.stalledAtSeq ===
-     * undefined) this.stalledAtSeq = envelope.seq;`) as closely as possible:
-     * the SAME "only the lowest unresolved failure holds the stall" rule, the
-     * SAME resulting freeze of `dedupWatermark()` at the durable cursor
-     * (protocol §9 keeps this seq alive), and — because it's the SAME
-     * `stalledAtSeq` field `process()`'s own post-success guard already
-     * checks — anything ELSE delivered after this seq (same batch or a later
-     * one) is automatically held back from advancing the cursor too, with
-     * zero changes needed to `process()` itself.
-     *
-     * Chained onto `processingChain` for exactly the reason `noteSkippedSeq`
-     * documents for its own identical chaining (see that method's sibling
-     * doc comment on `LongPollClient`, "GATEKEEPER-CAUGHT REGRESSION"): an
-     * EARLIER real envelope in the SAME batch may still be in flight on that
-     * FIFO chain when this is called (`deliver()` only ever chains
-     * `process()` onto it, never awaits before returning) — mutating
-     * `stalledAtSeq` synchronously here could race ahead of that still-
-     * unresolved earlier envelope. Chaining instead guarantees this only
-     * takes effect once every earlier-queued envelope has already settled,
-     * and reads `stalledAtSeq`'s real, up-to-date value rather than whatever
-     * it happened to be the instant the failure was first noticed.
-     *
-     * No `noteDelivered` call here (contrast `noteSkippedSeq`, which does
-     * call it): a validation-failed entry never becomes a real `Envelope` and
-     * never reaches `deliver()`, so it was never "delivered" in the eager
-     * in-memory-watermark sense that field tracks — there is nothing for it
-     * to eagerly mark. Once a corrected redelivery of this exact seq DOES
-     * arrive as a real envelope, it flows through the ordinary `deliver()`
-     * path (which calls `noteDelivered` itself) and, on success, clears the
-     * stall via `process()`'s own existing logic — no special-casing needed.
-     */
+    /** Recorded synchronously at receive, before a later successful receipt can commit. */
     private noteValidationFailure;
     private advanceCursor;
     private quarantineRejectedOutbound;

package/dist/daemon/control-protocol.d.ts

@@ -465,5 +465,7 @@ export declare function parseTeamWorkspaceJoinParams(value: unknown): TeamWorksp
 export declare function parseTeamContextParams(value: unknown): TeamContextParams | undefined;
 export declare function parseTeamMessagePostParams(value: unknown): TeamMessagePostParams | undefined;
 export declare function parseTeamMessageReadParams(value: unknown): TeamMessageReadParams | undefined;
+/** Exact local operator RPC; the shared read-parameter shape has no model identity fields. */
+export declare function parseTeamNotificationSnapshotParams(value: unknown): TeamMessageReadParams | undefined;
 export declare function parseTeamMessageAckParams(value: unknown): TeamMessageAckParams | undefined;
 export declare function parseTeamMessageInspectParams(value: unknown): TeamMessageInspectParams | undefined;