@byok-sdk/client 0.14.0 → 0.16.0

package/dist/bin/byok-mcp-env.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+import { spawn } from 'child_process';
+
+async function runMcpEnvLauncher() {
+  const key = process.env.BYOK_MCP_ENV_KEY;
+  if (!key || !/^BYOK_MCP_PAYLOAD_[A-F0-9]{32}$/.test(key)) throw new Error("invalid MCP environment binding");
+  const encoded = process.env[key];
+  if (!encoded) throw new Error("missing sealed MCP environment");
+  let config;
+  try {
+    config = JSON.parse(encoded);
+    if (!config || typeof config.command !== "string" || !config.command || config.args !== void 0 && (!Array.isArray(config.args) || config.args.some((value) => typeof value !== "string")) || config.env !== void 0 && (typeof config.env !== "object" || config.env === null || Array.isArray(config.env) || Object.values(config.env).some((value) => typeof value !== "string"))) throw new Error();
+  } catch {
+    throw new Error("invalid sealed MCP environment");
+  }
+  const env = { ...process.env };
+  delete env.BYOK_MCP_ENV_KEY;
+  for (const name of Object.keys(env)) if (name.startsWith("BYOK_MCP_PAYLOAD_")) delete env[name];
+  Object.assign(env, config.env);
+  await new Promise((resolve, reject) => {
+    const child = spawn(config.command, config.args ?? [], { env, stdio: "inherit", windowsHide: true });
+    child.once("error", () => reject(new Error("MCP child could not be spawned")));
+    child.once("close", (code) => {
+      if (code === 0) resolve();
+      else reject(new Error("MCP child exited unsuccessfully"));
+    });
+  });
+}
+
+// src/bin/byok-mcp-env.ts
+runMcpEnvLauncher().catch(() => {
+  process.stderr.write("byok-mcp-env: MCP launch failed\n");
+  process.exitCode = 1;
+});
+//# sourceMappingURL=byok-mcp-env.js.map
+//# sourceMappingURL=byok-mcp-env.js.map

package/dist/bin/byok-mcp-env.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/bin/mcp-env-launcher.ts","../../src/bin/byok-mcp-env.ts"],"names":[],"mappings":";;;AAMA,eAAsB,iBAAA,GAAmC;AACvD,EAAA,MAAM,GAAA,GAAM,QAAQ,GAAA,CAAI,gBAAA;AACxB,EAAA,IAAI,CAAC,GAAA,IAAO,CAAC,iCAAA,CAAkC,IAAA,CAAK,GAAG,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,iCAAiC,CAAA;AAC3G,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC/B,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAC9D,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,OAAO,CAAA;AAC3B,IAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,CAAO,OAAA,KAAY,YAAY,CAAC,MAAA,CAAO,OAAA,IACvD,MAAA,CAAO,IAAA,KAAS,KAAA,CAAA,KAAc,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,IAAI,CAAA,IAAK,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,CAAA,KAAA,KAAS,OAAO,KAAA,KAAU,QAAQ,CAAA,CAAA,IAChH,MAAA,CAAO,QAAQ,KAAA,CAAA,KAAc,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,IAAY,MAAA,CAAO,QAAQ,IAAA,IAAQ,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,GAAG,CAAA,IAC7G,OAAO,MAAA,CAAO,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,CAAA,KAAA,KAAS,OAAO,KAAA,KAAU,QAAQ,CAAA,CAAA,EAAK,MAAM,IAAI,KAAA,EAAM;AAAA,EAC/F,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,EAClD;AACA,EAAA,MAAM,GAAA,GAAM,EAAE,GAAG,OAAA,CAAQ,GAAA,EAAI;AAC7B,EAAA,OAAO,GAAA,CAAI,gBAAA;AACX,EAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,EAAG,IAAI,IAAA,CAAK,UAAA,CAAW,mBAAmB,CAAA,EAAG,OAAO,GAAA,CAAI,IAAI,CAAA;AAC9F,EAAA,MAAA,CAAO,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,GAAG,CAAA;AAC7B,EAAA,MAAM,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AAC3C,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,MAAA,CAAO,OAAA,EAAS,OAAO,IAAA,IAAQ,EAAC,EAAG,EAAE,GAAA,EAAK,KAAA,EAAO,SAAA,EAAW,WAAA,EAAa,MAAM,CAAA;AACnG,IAAA,KAAA,CAAM,IAAA,CAAK,SAAS,MAAM,MAAA,CAAO,IAAI,KAAA,CAAM,gCAAgC,CAAC,CAAC,CAAA;AAC7E,IAAA,KAAA,CAAM,IAAA,CAAK,SAAS,CAAA,IAAA,KAAQ;AAC1B,MAAA,IAAI,IAAA,KAAS,GAAG,OAAA,EAAQ;AAAA,WACnB,MAAA,CAAO,IAAI,KAAA,CAAM,iCAAiC,CAAC,CAAA;AAAA,IAC1D,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AACH;;;AC9BA,iBAAA,EAAkB,CAAE,MAAM,MAAM;AAC9B,EAAA,OAAA,CAAQ,MAAA,CAAO,MAAM,mCAAmC,CAAA;AACxD,EAAA,OAAA,CAAQ,QAAA,GAAW,CAAA;AACrB,CAAC,CAAA","file":"byok-mcp-env.js","sourcesContent":["import { spawn } from 'node:child_process';\n\n/** Project one sealed server's env through Codex's documented env_vars channel.\n * No secret or original server argument is carried in the launcher argv.\n * The child remains in Codex's owned process group / Windows Job Object.\n */\nexport async function runMcpEnvLauncher(): Promise<void> {\n  const key = process.env.BYOK_MCP_ENV_KEY;\n  if (!key || !/^BYOK_MCP_PAYLOAD_[A-F0-9]{32}$/.test(key)) throw new Error('invalid MCP environment binding');\n  const encoded = process.env[key];\n  if (!encoded) throw new Error('missing sealed MCP environment');\n  let config: { command: string; args?: string[]; env?: Record<string, string> };\n  try {\n    config = JSON.parse(encoded);\n    if (!config || typeof config.command !== 'string' || !config.command\n      || (config.args !== undefined && (!Array.isArray(config.args) || config.args.some(value => typeof value !== 'string')))\n      || (config.env !== undefined && (typeof config.env !== 'object' || config.env === null || Array.isArray(config.env)\n        || Object.values(config.env).some(value => typeof value !== 'string')))) throw new Error();\n  } catch {\n    throw new Error('invalid sealed MCP environment');\n  }\n  const env = { ...process.env };\n  delete env.BYOK_MCP_ENV_KEY;\n  for (const name of Object.keys(env)) if (name.startsWith('BYOK_MCP_PAYLOAD_')) delete env[name];\n  Object.assign(env, config.env);\n  await new Promise<void>((resolve, reject) => {\n    const child = spawn(config.command, config.args ?? [], { env, stdio: 'inherit', windowsHide: true });\n    child.once('error', () => reject(new Error('MCP child could not be spawned')));\n    child.once('close', code => {\n      if (code === 0) resolve();\n      else reject(new Error('MCP child exited unsuccessfully'));\n    });\n  });\n}\n","#!/usr/bin/env node\nimport { runMcpEnvLauncher } from './mcp-env-launcher';\n\nrunMcpEnvLauncher().catch(() => {\n  process.stderr.write('byok-mcp-env: MCP launch failed\\n');\n  process.exitCode = 1;\n});\n"]}

package/dist/bin/commands/doctor.d.ts

@@ -3,6 +3,9 @@ import { type CollectDiagnosticsOptions } from '../../diagnostics/diagnostics';
 export interface DoctorOptions extends CollectDiagnosticsOptions {
     json?: boolean;
     fix?: boolean;
+    repair?: string;
+    expectedDeviceId?: string;
+    expectedTenantId?: string;
     confirmed?: boolean;
     log?: (line: string) => void;
 }

package/dist/bin/mcp-env-launcher.d.ts

@@ -0,0 +1,5 @@
+/** Project one sealed server's env through Codex's documented env_vars channel.
+ * No secret or original server argument is carried in the launcher argv.
+ * The child remains in Codex's owned process group / Windows Job Object.
+ */
+export declare function runMcpEnvLauncher(): Promise<void>;

package/dist/bin/runtime-probe.d.ts

@@ -1,3 +1,4 @@
+import type { RuntimeDetectResult } from '../types';
 import { type RuntimeAdapter } from '../index';
 export declare const RUNTIME_PROBE_TIMEOUT_MS = 5000;
 /** The bundled adapter set `byok-agent status`/`byok-agent runtimes` probe by default — same unset-vs-set allowlist contract as `createDaemon` itself. */
@@ -13,7 +14,9 @@ export declare function defaultRuntimeAdapters(runtimeAllowlist: string[] | unde
  */
 export interface ProbedRuntime {
     id: string;
+    /** Deterministic projection of outcome, never adapter-authored. */
     present: boolean;
+    outcome: RuntimeDetectResult['kind'];
     version?: string;
     authPresent?: boolean;
     steer: boolean;
@@ -21,13 +24,9 @@ export interface ProbedRuntime {
     permissionModes: string[];
 }
 /**
- * Runs `detect()` and reads each adapter's frozen descriptor, in parallel. Every
- * bundled adapter's own `detect()` already catches its own failures (e.g.
- * `pi-adapter.ts`'s `detect()` wraps its version probe in try/catch and
- * resolves `{present: false}` rather than rejecting) — the catch here is a
- * defensive backstop for a `RuntimeAdapter` that doesn't hold that
- * convention, not a workaround for an observed failure in the bundled
- * three.
+ * Fresh, parallel local observations. A custom adapter timeout is an observation
+ * deadline only: detect() has no cancellation contract. Never expose arbitrary
+ * adapter errors or interpret an old/malformed result as available.
  */
 export declare function probeRuntimes(adapters: readonly RuntimeAdapter[], options?: {
     timeoutMs?: number;

package/dist/daemon/admission-wait.d.ts

@@ -0,0 +1,2 @@
+/** Only for side-effect-free admission. Never abandon an owned lease/session. */
+export declare function awaitAdmission<T>(operation: () => Promise<T>, signal: AbortSignal): Promise<T>;

package/dist/daemon/agent-egress-spool.d.ts

@@ -70,6 +70,7 @@ export declare class AgentReliableSpool {
     readonly homeDir: string;
     readonly spoolPath: string;
     private readonly pending;
+    private readonly file;
     private nextCursor;
     private logEntries;
     private writeTail;

package/dist/daemon/agent-message-outbox.d.ts

@@ -20,12 +20,14 @@ export interface AgentMessageOutboxRecord {
 export declare class AgentMessageOutboxError extends Error {
     constructor(message: string);
 }
-/** Agent-local, append-before-send outbox. Only exact accepted disposition retires bytes. */
+/** Agent-local append-before-send authority. Only acceptance or explicit terminal archival retires bytes. */
 export declare class AgentMessageOutbox {
     readonly homeDir: string;
     readonly outboxPath: string;
     private readonly pendingByTask;
+    private readonly revokedTasks;
     private readonly dispositionByTask;
+    private readonly file;
     private nextCursor;
     private logEntries;
     private writeTail;
@@ -34,7 +36,7 @@ export declare class AgentMessageOutbox {
     /** Re-open every existing Agent-local message outbox without following Agent-home symlinks. */
     static recover(agentsRoot: string, tenantId: string): Promise<readonly AgentMessageOutbox[]>;
     records(): readonly AgentMessageOutboxRecord[];
-    /** Activated records with no exact disposition yet; only these may be transport-replayed. */
+    /** Records without disposition or local revoke; transport replay additionally requires session binding. */
     retryableRecords(): readonly AgentMessageOutboxRecord[];
     get(taskId: string): AgentMessageOutboxRecord | undefined;
     appendDraft(input: {
@@ -48,11 +50,23 @@ export declare class AgentMessageOutbox {
         readonly maxPendingEvents: number;
         readonly maxPendingBytes: number;
     }): Promise<AgentMessageOutboxRecord>;
-    activate(taskId: string, sessionRef: string): Promise<AgentMessageOutboxRecord | undefined>;
+    activate(taskId: string, sessionRef: string, isCurrent?: () => boolean): Promise<AgentMessageOutboxRecord | undefined>;
+    /** Local lifecycle cancellation, never a synthesized consumer disposition. */
+    revoke(taskId: string): Promise<void>;
+    /** The same terminal classification used by operator receipts and archival. */
+    terminalRecords(): readonly AgentMessageOutboxRecord[];
+    private isTerminalEvidence;
     publishPayload(record: AgentMessageOutboxRecord): AgentMessagePublishPayload;
     applyDisposition(taskId: string, input: unknown): Promise<'accepted' | 'held' | 'refused' | 'mismatch' | 'unknown'>;
     private load;
     private appendEntry;
+    /**
+     * Explicit operator maintenance under the Agent-home single-writer lease.
+     * Copy complete terminal evidence durably before removing it from the live log.
+     * Archives are audit artifacts, never another replay input. held remains live.
+     */
+    archiveTerminalRecords(archiveDirectory: string): Promise<string | undefined>;
+    private snapshotEntries;
     private compact;
     private exclusive;
 }

package/dist/daemon/artifact-read.d.ts

@@ -0,0 +1,7 @@
+import type { FileHandle } from 'node:fs/promises';
+export declare const DEFAULT_ARTIFACT_LIMITS: Readonly<{
+    maxFileBytes: number;
+    maxTaskBytes: number;
+}>;
+/** The caller retains fd ownership; no pathname is reopened. */
+export declare function readArtifactBytes(handle: FileHandle, maxBytes: number, signal: AbortSignal, account: (bytes: number) => void): Promise<Buffer>;

package/dist/daemon/connection-manager.d.ts

@@ -1,3 +1,4 @@
+import type { HarnessInfo } from '@byok-sdk/protocol';
 import { type CapabilityFlag, type Envelope, type RuntimeInfo, type ToolsetId } from '@byok-sdk/protocol';
 import { AuthManager } from './auth-manager';
 import type { CursorStore } from './cursor-store';
@@ -14,6 +15,7 @@ export interface ConnectionManagerOptions {
     /** U4a Local Agent release version, sent unchanged in `conn.hello`. */
     clientVersion?: string;
     runtimes: RuntimeInfo[];
+    harnesses?: HarnessInfo[];
     /** Reads current sorted logical IDs from the validated local registry for every `conn.hello`. */
     getConfiguredToolsets?: () => readonly ToolsetId[];
     auth: AuthManager;
@@ -73,25 +75,11 @@ export declare class ConnectionManager {
      * guarantees in docs/protocol.md §9.
      */
     private stalledAtSeq;
-    /**
-     * Design A (Wave 2, F3-on-long-poll): the second, in-memory watermark
-     * alongside the durable `cursor`. `cursor` only ever advances AFTER a
-     * `task.*` handler's side effects resolve successfully, and is persisted
-     * (see `advanceCursor`) — that semantics is unchanged. `deliveredSeq`
-     * advances eagerly, the instant a `task.*` envelope is admitted past
-     * dedup (see `deliver`/`noteDelivered`), independent of whether its
-     * handler has even started, let alone succeeded. It exists so a repeated
-     * read at the durable cursor does not re-dispatch an envelope already in
-     * flight — `handleOffer` must not start a second adapter session while a
-     * first attempt is still running. On WS this same field is written the
-     * same way, but since a live WS connection only ever pushes a given `seq`
-     * once, it never has an observable effect there beyond mirroring
-     * `cursor` (see `dedupWatermark`'s doc comment for why redelivery
-     * correctness doesn't depend on resetting it anywhere).
-     */
-    private deliveredSeq;
-    /** Finding F3: serializes `onEnvelope` calls into a per-connection FIFO — one envelope's handler always fully settles before the next one starts. */
+    /** Drain barrier for independently running handlers; not an admission lock. */
     private processingChain;
+    private cursorInitialization;
+    private completionTail;
+    private readonly controlTails;
     /**
      * Design B (finding N4): the ONE outbound queue holds `Envelope` OBJECTS,
      * never re-encoded/rebuilt strings, so a
@@ -117,38 +105,13 @@ export declare class ConnectionManager {
     private terminalError;
     private settledWaiters;
     private pendingCursorSave;
-    /**
-     * Finding P2 (Fix 2b): seqs currently admitted into `processingChain` but
-     * not yet settled — added in `deliver()` the moment a `task.*` envelope is
-     * accepted past the ordinary watermark check, removed in `process()`'s
-     * `finally` once that specific attempt resolves (success OR failure).
-     * While stalled, `dedupWatermark()` deliberately stays frozen below
-     * already-delivered seqs (see its own doc comment) so the failed seq's own
-     * redelivery can get through — but that same frozen watermark also means
-     * every OTHER seq above it rides along on every re-poll too. Without this,
-     * a seq already mid-flight (e.g. a `task.offer` whose prepared operation start()
-     * hasn't resolved yet) would be re-enqueued into `processingChain` on
-     * every such re-poll, piling up duplicate copies that — once the first
-     * finally resolves and the chain unwinds through them — run its handler
-     * again; for `task.offer` specifically, a second adapter session
-     * orphaning the first (`TaskRunner`'s own `this.tasks.has` guard, finding
-     * P2c, is the second, independent layer against exactly that).
-     */
+    /** Admission dedup while an individual handler is running. */
     private readonly inFlightSeqs;
-    /**
-     * Finding P2 (Fix 2b): seqs whose handler has already resolved
-     * successfully at least once this session, tracked only while a stall is
-     * in effect — cleared the moment `stalledAtSeq` itself clears (see
-     * `process()`), since once unstalled the ordinary watermark check via
-     * `deliveredSeq` already covers everything delivered so far, making this
-     * redundant. Needed because the stall-gap-prevention rule in `process()`
-     * deliberately does NOT advance `cursor` past a seq above the
-     * still-unresolved `stalledAtSeq`, even once that seq's own handler
-     * succeeds — so `dedupWatermark()` alone can't distinguish "already
-     * succeeded, don't re-run" from "never yet attempted" for anything in
-     * that gap.
-     */
+    /** Successful side effects retained until their durable acknowledgement. */
     private readonly processedSeqs;
+    private readonly failedEnvelopes;
+    /** Received work lacking a successful handler receipt, including malformed frames. */
+    private readonly unresolvedSeqs;
     /**
      * Finding P3: the pending `drainOutbox` long-poll retry backoff, if any —
      * cancellable so `enterRevoked()` can unblock it immediately instead of
@@ -303,43 +266,21 @@ export declare class ConnectionManager {
      * - F3 (at-most-once): the old code persisted the cursor advance BEFORE
      *   `onEnvelope` even ran (fire-and-forget) — a handler that then failed
      *   left a redelivery-proof envelope permanently marked processed. Inbound
-     *   envelopes are now serialized through `processingChain` (one handler
-     *   fully settles before the next starts) and the cursor only advances
+     *   handlers may run independently; their receipt commits are serialized.
+     *   The cursor only advances
      *   AFTER the handler resolves successfully; a rejection leaves the
      *   cursor where it was (see `stalledAtSeq`), so a future reconnect's
      *   redelivery re-attempts it — safe because every server->daemon type is
      *   documented idempotent (protocol §9).
      */
     private deliver;
-    /**
-     * The local watermark `deliver()` dedupes inbound `task.*` envelopes
-     * against. It is deliberately NOT the long-poll query cursor: that query
-     * is the kernel acknowledgement and uses only the successfully processed
-     * `cursor` (see the constructor). Normally this local watermark is
-     * `deliveredSeq` — which is always >= `cursor` (every envelope that
-     * reaches `advanceCursor` already passed through `noteDelivered` first,
-     * see `deliver`) — so this is the literal `max(cursor, deliveredSeq)` the
-     * design calls for, just expressed via that invariant rather than an
-     * explicit `Math.max`.
-     *
-     * While `stalledAtSeq` is set, this collapses to the durable `cursor`
-     * alone, deliberately ignoring however far `deliveredSeq` had already run
-     * ahead before the failure was known: that's what lets the stalled
-     * envelope's own redelivery (and everything after it, right up to a
-     * fresh success) get past this same dedup check instead of being
-     * self-deduped by the client's own earlier eager tracking of envelopes
-     * whose outcome wasn't known yet. No separate "reset deliveredSeq on
-     * reconnect" step is needed for this to be correct — collapsing to
-     * `cursor` exactly while stalled already produces the right answer on
-     * every long-poll retry path. NOT resetting it unconditionally on every
-     * retry lets `deliveredSeq` keep doing its job of not re-dispatching
-     * something already in flight while a handler is still running.
-     */
+    /** A committed terminal can settle a failed offer receipt even if cloud
+     * cancellation has since filtered that offer from mailbox replay. */
+    retryTaskReceipts(taskId: string): void;
+    /** Only a durable acknowledgement can deduplicate a whole prefix. */
     private dedupWatermark;
-    /** Design A: eagerly advance the in-memory delivery watermark — called for every `task.*` envelope `deliver()` admits past dedup, regardless of transport or of whether its handler has even started yet. */
-    private noteDelivered;
     private process;
-    /** Serialized with handler completion, so invalid work cannot be acked by later success. */
+    /** Recorded synchronously at receive, before a later successful receipt can commit. */
     private noteValidationFailure;
     private advanceCursor;
     private quarantineRejectedOutbound;

package/dist/daemon/create-daemon.d.ts

@@ -307,6 +307,13 @@ export interface DaemonConfig {
      * explicitly instead to opt out of enforcement altogether.
      */
     maxTaskOutputBytes?: number;
+    /** Legacy artifact bytes only: default 16 MiB/file and 64 MiB/task, independent of event output limits. */
+    artifactLimits?: {
+        maxFileBytes: number;
+        maxTaskBytes: number;
+    };
+    /** Admission and startup deadline, including pure detect/prepare waits; unresolved process owners remain quarantined. Default 30 seconds. */
+    startupTimeoutMs?: number;
     /**
      * Per-EVENT inline ceiling (default {@link DEFAULT_MAX_INLINE_EVENT_BYTES},
      * 64 KiB) for the two `AgentEvent` fields a runtime authors freely:
@@ -528,6 +535,8 @@ export interface DaemonStatus {
     revoked: boolean;
     deviceId?: string;
     activeTaskCount: number;
+    /** Exact terminal results retained for journal retry; nonzero requires recovery. */
+    pendingTerminalCommits: number;
     /** Passthrough of `DaemonConfig.branding` — `undefined` when the product configured none. See `DaemonBranding`. */
     branding?: DaemonBranding;
     /** Local lifecycle/retry budget, separate from transport fallback state. */
@@ -587,7 +596,8 @@ export interface Daemon {
     /** M3-2a: same as {@link approve} but rejects — see that method's doc comment. */
     reject(taskId: string, reason?: string): Promise<void>;
 }
-/** Internal seam so tests can substitute stub adapters / faster batch and long-poll timing. `createDaemonWithAdapters` (which takes this) is also the real entry point for products supplying a hand-built adapter set `createDaemon` can't construct on its own — e.g. custom adapter options, or an adapter that REPLACES a bundled runtime's implementation under the same id. Honest limit: an adapter id outside `pi`/`claude`/`codex` cannot pass wire validation today — `RuntimeIdSchema` (`@byok-sdk/protocol`) is a closed `z.enum(['pi', 'claude', 'codex'])`, and `isRuntimeId` filtering below (see `detectRuntimes`) drops any detected adapter outside that set before it ever reaches a wire-visible field. A genuinely fourth/namespaced runtime id is a future protocol change, not something this seam enables today. */
+/** Custom adapter composition. Available custom descriptors are published through
+ * the capability-gated harness inventory; built-in RuntimeId remains closed. */
 export interface DaemonOverrides {
     /** Test-only synchronous kill points; never supplied by production configuration. */
     executionRecoveryFault?: (step: 'terminal:before-send' | 'terminal:queued' | 'outbound:before-post' | 'outbound:after-ack') => void;

package/dist/daemon/runtime-start.d.ts

@@ -0,0 +1,3 @@
+import type { RuntimeOperationStartInput, Session } from '../types';
+/** A deadline withdraws admission; it never invents a quiescence receipt. */
+export declare function startOwnedRuntime(start: (input: RuntimeOperationStartInput) => Promise<Session>, input: RuntimeOperationStartInput, signal: AbortSignal, timeoutMs: number): Promise<Session>;

package/dist/daemon/store.d.ts

@@ -72,6 +72,8 @@ export declare class DeviceStore {
      * identifiable until the synchronous pathname check and unlink complete.
      */
     remove(): Promise<DeviceMetadata | undefined>;
+    /** Rebuild only the non-secret projection, while the caller owns the store lease. */
+    reconcileMetadata(authority: DeviceMetadata): Promise<boolean>;
     save(record: DeviceMetadata): Promise<void>;
     private openBounded;
 }

package/dist/daemon/task-runner.d.ts

@@ -228,6 +228,7 @@ export interface TaskRunnerDeps {
     agentSessionHandoffs?: AgentSessionHandoffStore;
     deviceId: string;
     send: (envelope: Envelope) => void;
+    awaitTerminalCommit?: (taskId: string) => Promise<void>;
     /** Fsync the execution commitment before claim/runtime side effects. */
     beforeClaim?: (taskId: string, runtime: string) => Promise<void>;
     blobClient: BlobResolver;
@@ -323,6 +324,7 @@ export interface TaskRunnerDeps {
     onApprovalDispatched?: (taskId: string, approvalId: string) => void;
     /** Overrides the bounded soft-interrupt window before authoritative `Session.close()` disposal begins. */
     shutdownInterruptTimeoutMs?: number;
+    startupTimeoutMs?: number;
     /**
      * M5 batch-3 (workstream 2): overrides {@link DEFAULT_MAX_TASK_OUTPUT_BYTES}
      * — see that constant's own doc comment and `DaemonConfig.maxTaskOutputBytes`
@@ -332,6 +334,10 @@ export interface TaskRunnerDeps {
      * interface (`shutdownInterruptTimeoutMs`, `approvalTimeoutMs`).
      */
     maxTaskOutputBytes?: number;
+    artifactLimits?: {
+        maxFileBytes: number;
+        maxTaskBytes: number;
+    };
     /**
      * Per-event inline ceiling for `tool_use.input` / `tool_result.output` —
      * see `DaemonConfig.maxInlineEventBytes` (`create-daemon.ts`) for the full
@@ -627,8 +633,13 @@ export declare class TaskRunner {
     /** Restore activated, unaccepted message drafts before transport admission on daemon restart. */
     recoverAgentMessageOutboxes(agentsRoot: string): Promise<void>;
     private agentMessageOutbox;
+    /** A recovery terminal must not close first-message admission before this durable draft has a disposition. */
+    hasPendingRecoveredAgentMessage(taskId: string): boolean;
     /** Retry stable recovered records after a transport handshake/re-handshake. */
     retryRecoveredAgentMessages(): void;
+    private canPublishAgentMessage;
+    /** All authors and startup use the same queue-time and post-I/O authority check. */
+    private activateAgentMessage;
     private sendAgentMessageRecord;
     private handleAgentMessageDisposition;
     /** M4 Phase 2: stop claiming any FUTURE `task.offer` — see `stoppingOffers`'s own doc comment. Idempotent. */
@@ -670,6 +681,14 @@ export declare class TaskRunner {
      * ahead of this method — see `daemon-control-socket.test.ts`'s dedicated
      * regression test for the exact scenario.
      */
+    /** Startup resources have an owner even before a Session can become active. */
+    private startupRetryTimer;
+    private readonly claimedHarnesses;
+    private readonly homeReservations;
+    private readonly startupOwners;
+    private readonly startupDisposals;
+    private disposeStartupOwner;
+    private disposeStartupOwnerOnce;
     shutdownActiveTasks(reason: string): Promise<void>;
     /**
      * M5 batch-3 (workstream 2): the ONE shared per-task teardown sequence —
@@ -701,6 +720,7 @@ export declare class TaskRunner {
      * a genuine protocol bug, not a benign race — mirrors `pump()`'s own
      * identity-check guard for the same class of race.
      */
+    private interruptBounded;
     private teardownActiveTask;
     /** Graceful-shutdown caller of {@link teardownActiveTask} — see `shutdownActiveTasks`'s own doc comment. `retryable: true`: nothing about the task/policy itself was ever at fault, only this device's own availability right now. */
     private shutdownTask;
@@ -1151,7 +1171,10 @@ export declare class TaskRunner {
     private persistAgentTerminalEvidence;
     private retryAgentTerminalEvidence;
     private reportAgentTerminalEvidenceFailure;
+    retryTerminalFinalization(taskId: string): Promise<void>;
+    private readonly finalizationAttempts;
     private finish;
+    private finishOnce;
     private reserveSemanticTerminal;
     /** M3-B: bounded insert for `finishedTaskIds` — see its class-level doc comment and `MAX_TRACKED_TASK_IDS`. Evicts the oldest (first-inserted) entry once over cap, same idiom as `ConnectionHub.checkAndRecordDuplicate` (packages/server/src/hub.ts). */
     private addFinishedTaskId;

package/dist/daemon/terminal-commit-queue.d.ts

@@ -0,0 +1,21 @@
+/** Volatile ownership of exact terminal bytes until the journal accepts them.
+ * The journal remains the sole durable authority. Failed receipts stay rejected;
+ * only the internal scheduling tail recovers so another task can make progress.
+ */
+export declare class TerminalCommitQueue {
+    private readonly committed;
+    private readonly pending;
+    private tail;
+    private timer;
+    private stopped;
+    constructor(committed: (taskId: string) => void);
+    get pendingCount(): number;
+    hasPending(taskId: string): boolean;
+    enqueue(taskId: string, commit: () => Promise<void>): void;
+    receipt(taskId: string): Promise<void>;
+    retry(taskId: string): Promise<void>;
+    resume(): void;
+    stop(): Promise<void>;
+    private attempt;
+    private armRetry;
+}

package/dist/daemon/terminal-identity.d.ts

@@ -0,0 +1,6 @@
+import { type AgentRef } from '@byok-sdk/protocol';
+/** Project sealed execution facts, never the offer's requested harness. */
+export declare function terminalIdentity(runtimeId: string | undefined, agentRef?: AgentRef): {
+    harnessId?: string;
+    agentRef?: AgentRef;
+};

package/dist/diagnostics/device-doctor.d.ts

@@ -0,0 +1,46 @@
+import type { DaemonConfig } from '../daemon/create-daemon';
+import type { RuntimeAdapter } from '../types';
+import type { DiagnosticsSnapshot } from './types';
+export type { DiagnosticsSnapshot, DiagnosticCheck, DiagnosticStatus } from './types';
+export interface DiagnoseDeviceOptions {
+    /** The same adapters used by an embedded host; omitted uses bundled adapters. */
+    adapters?: RuntimeAdapter[];
+    runtimeProbeTimeoutMs?: number;
+}
+/** Read-only device observation; does not read OS credentials or prove Agent readiness. */
+export declare function diagnoseDevice(config: DaemonConfig, options?: DiagnoseDeviceOptions): Promise<DiagnosticsSnapshot>;
+export interface RepairDeviceEnrollmentMetadataInput {
+    confirmed: true;
+    /** Obtain both from the host's authorized enrollment target, never from a guessed default. */
+    expectedDeviceId: string;
+    expectedTenantId: string;
+}
+export interface DeviceMetadataRepairResult {
+    action: 'restore-enrollment-metadata';
+    scope: 'device';
+    /** Metadata readback only; does not imply renewed credentials or a running daemon. */
+    status: 'repaired' | 'not-needed';
+}
+declare const MESSAGES: {
+    readonly 'confirmation-required': 'Explicit confirmation is required for enrollment metadata repair.';
+    readonly 'invalid-target': 'An explicit expected tenant and device are required.';
+    readonly 'daemon-running': 'Stop the daemon before enrollment metadata repair.';
+    readonly 'store-busy': 'The store is owned by another operation; enrollment metadata repair refused.';
+    readonly 'authority-unavailable': 'The OS enrollment authority could not be read.';
+    readonly 'authority-missing': 'No complete OS enrollment exists; use explicit authenticated pairing.';
+    readonly 'target-mismatch': 'The OS enrollment does not match the expected tenant and device.';
+    readonly 'projection-unavailable': 'The enrollment metadata could not be read safely; repair refused.';
+    readonly 'repair-failed': 'Enrollment metadata repair did not complete; inspect the state before retrying.';
+};
+export type DeviceMetadataRepairErrorCode = keyof typeof MESSAGES;
+/** Closed diagnostics only: no OS stderr, local paths, authority bytes or nested cause. */
+export declare class DeviceMetadataRepairError extends Error {
+    readonly code: DeviceMetadataRepairErrorCode;
+    constructor(code: DeviceMetadataRepairErrorCode);
+}
+/**
+ * Explicitly restore missing/valid-stale device.json from its existing OS authority.
+ * Does not instantiate AuthManager, renew credentials, pair, or start a runtime.
+ * Ordinary doctor remains credential-blind; only this confirmed action opens the OS store.
+ */
+export declare function repairDeviceEnrollmentMetadata(config: DaemonConfig, input: RepairDeviceEnrollmentMetadataInput): Promise<DeviceMetadataRepairResult>;

package/dist/diagnostics/diagnostics.d.ts

@@ -1,106 +1,21 @@
+import type { DiagnosticsSnapshot } from './types';
 import type { DaemonConfig, RuntimeAdapter } from '../index';
 import { connectControlClient } from '../bin/control-client';
-import type { ControlStatusResult } from '../daemon/control-protocol';
-import { type OperationalHealthFileInspection, OPERATIONAL_HEALTH_FILENAME } from '../daemon/operational-health';
+import { OPERATIONAL_HEALTH_FILENAME } from '../daemon/operational-health';
 export declare const MAX_QUARANTINE_ENTRIES = 100;
 export declare const MAX_QUARANTINE_SCAN_ENTRIES: number;
 export declare const MAX_QUARANTINE_READ_BYTES: number;
 export declare const MAX_DEVICE_RECORD_BYTES: number;
 export declare const MAX_JOURNAL_COPY_BYTES: number;
-export type DiagnosticStatus = 'pass' | 'warn' | 'fail';
-export interface DiagnosticCheck {
-    id: 'config' | 'device' | 'runtimes' | 'control' | 'health' | 'journal' | 'workspace' | 'quarantine';
-    status: DiagnosticStatus;
-    summary: string;
-}
-export interface DiagnosticsSnapshot {
-    version: 1;
-    generatedAt: string;
-    product: {
-        nameHash: string;
-        idHash: string;
-    };
-    system: {
-        node: string;
-        platform: NodeJS.Platform;
-        arch: string;
-        sqliteAvailable: boolean;
-    };
-    config: {
-        serverProtocol: 'http' | 'https' | 'ws' | 'wss' | 'invalid' | 'unsupported';
-        customStoreDir: boolean;
-        hostedJournal: boolean;
-        runtimeAllowlistCount?: number;
-    };
-    device: {
-        status: 'paired' | 'unpaired' | 'unavailable';
-        deviceIdHash?: string;
-    };
-    runtimes: Array<{
-        idHash: string;
-        present: boolean;
-        versionPresent: boolean;
-        authPresent?: boolean;
-        steer: boolean;
-        resume: boolean;
-        permissionModeCount: number;
-    }>;
-    control: {
-        status: 'offline';
-        reason: string;
-    } | {
-        status: 'online';
-        pid: number;
-        uptimeMs: number;
-        transport: string;
-        activeTaskCount: number;
-        pendingApprovalCount: number;
-        operationalHealth: ControlStatusResult['operationalHealth'];
-        storage?: ControlStatusResult['storage'];
-    };
-    health: OperationalHealthFileInspection;
-    journal: {
-        status: 'missing' | 'present' | 'corrupt' | 'unavailable';
-        sizeBytes?: number;
-        walBytes?: number;
-        integrity?: 'ok' | 'not-checked';
-        reason?: string;
-    };
-    workspace: {
-        status: 'available' | 'missing' | 'unavailable';
-        writable?: boolean;
-        reason?: string;
-    };
-    quarantine: {
-        status: 'available' | 'missing' | 'unavailable';
-        count: number;
-        scannedCount: number;
-        truncated: boolean;
-        entries: Array<{
-            nameHash: string;
-            sizeBytes: number;
-            modifiedAt: string;
-        }>;
-        reason?: string;
-    };
-    checks: DiagnosticCheck[];
-}
+export type { DiagnosticStatus, DiagnosticCheck, DiagnosticsSnapshot } from './types';
 export interface CollectDiagnosticsOptions {
     clock?: () => Date;
     adapters?: RuntimeAdapter[];
     connectControl?: typeof connectControlClient;
     runtimeProbeTimeoutMs?: number;
 }
-export type OperationalHealthFixResult = {
-    status: 'not-needed';
-    reason: 'missing' | 'valid';
-} | {
-    status: 'quarantined';
-    evidenceName: string;
-    manifestName: string;
-    sha256: string;
-    sizeBytes: number;
-};
+import type { OperationalHealthFixResult } from './types';
+export type { OperationalHealthFixResult } from './types';
 export declare function collectDiagnostics(config: DaemonConfig, storeDir: string, options?: CollectDiagnosticsOptions): Promise<DiagnosticsSnapshot>;
 export declare function stableIdentifierHash(value: string): string;
 /**