@byok-sdk/client 0.16.0 → 0.18.0

package/dist/bin/byok-agent.js

@@ -2379,7 +2379,7 @@ function resolveLocalAgentReleaseIdentity(input) {
 
 // src/bin/official-release.ts
 var OFFICIAL_LOCAL_AGENT_RELEASE = resolveLocalAgentReleaseIdentity({
-  version: "0.16.0"
+  version: "0.18.0"
 });
 
 // src/bin/config.ts
@@ -5875,13 +5875,13 @@ function classifyDetectError(error) {
   if (code === "EACCES" || code === "EPERM" || code === "ENOEXEC") return { kind: "not-executable" };
   return { kind: "probe-failed" };
 }
-async function probeRuntimeVersion(command, timeoutMs) {
+async function probeRuntimeVersion(command, timeoutMs, prefixArgs = []) {
   if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) throw new TypeError("invalid runtime probe timeout");
   return new Promise((resolve) => {
     let timer;
     let timedOut = false;
     try {
-      const child = execFile(command, ["--version"], { encoding: "utf8" }, (error, stdout, stderr) => {
+      const child = execFile(command, [...prefixArgs, "--version"], { encoding: "utf8" }, (error, stdout, stderr) => {
         if (timer) clearTimeout(timer);
         if (error?.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER") resolve({ kind: "probe-failed" });
         else if (timedOut) resolve({ kind: "timeout" });
@@ -6138,6 +6138,9 @@ function withoutProviderCredentials(env) {
 // src/adapters/pi/pi-adapter.ts
 var execFileAsync = promisify(execFile);
 var DETECT_TIMEOUT_MS = 5e3;
+function piInvocation(bin) {
+  return bin.source === "package" ? { command: process.execPath, entry: bin.command } : { command: bin.command };
+}
 function errorMessage2(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -6186,6 +6189,7 @@ function validatePiByokLauncherConfig(launcher) {
   const reserved = /* @__PURE__ */ new Set([
     "--",
     "--pi-bin",
+    "--pi-entry",
     "--profile-db",
     "--session-dir",
     "--macos-keychain-path",
@@ -6234,7 +6238,12 @@ var PiAdapter = class {
   async detect() {
     try {
       const bin = this.resolveBin();
-      const probe = await probeRuntimeVersion(bin.command, DETECT_TIMEOUT_MS);
+      const invocation = piInvocation(bin);
+      const probe = await probeRuntimeVersion(
+        invocation.command,
+        DETECT_TIMEOUT_MS,
+        invocation.entry === void 0 ? [] : [invocation.entry]
+      );
       if (probe.kind !== "available") return probe;
       const version = probe.stdout.trim() || probe.stderr.trim();
       const authPresent = PROVIDER_CREDENTIAL_ENV_NAMES.some((name) => process.env[name] !== void 0);
@@ -6265,7 +6274,8 @@ var PiAdapter = class {
         requiredCapabilities: Object.freeze([...selection.providerProfile.requiredCapabilities])
       })
     }) : Object.freeze({ ...selection });
-    let command = bin.command;
+    const invocation = piInvocation(bin);
+    let command = invocation.command;
     let launcherArgs;
     if (pinnedSelection !== void 0) {
       if (pinnedSelection.lane !== "byok" && pinnedSelection.lane !== "byok-profile" || pinnedSelection.runtimeId !== "pi") {
@@ -6294,7 +6304,8 @@ var PiAdapter = class {
       launcherArgs = [
         ...launcher.args ?? [],
         "--pi-bin",
-        bin.command,
+        invocation.command,
+        ...invocation.entry === void 0 ? [] : ["--pi-entry", invocation.entry],
         "--profile-db",
         launcher.profileDbPath,
         "--session-dir",
@@ -6388,7 +6399,7 @@ var PiAdapter = class {
             ...resumeSessionId ? ["--session", resumeSessionId] : [],
             ...mapping.args
           ];
-          const args = launcherArgs === void 0 ? piArgs : [...launcherArgs, "--", ...piArgs];
+          const args = launcherArgs === void 0 ? [...invocation.entry === void 0 ? [] : [invocation.entry], ...piArgs] : [...launcherArgs, "--", ...piArgs];
           let rpc;
           try {
             rpc = new PiRpcClient({
@@ -15592,6 +15603,10 @@ var TaskRunner = class {
   usesAgentEgress(taskId) {
     return this.tasks.get(taskId)?.egressEnabled === true;
   }
+  /** Frozen offer authority for the outbound result-document lane. */
+  selectsResultDocument(taskId) {
+    return this.tasks.get(taskId)?.terminalProjection?.mode === "result-document";
+  }
   /** M5 batch-3 (workstream 2): effective `maxTaskOutputBytes` cap for this daemon — see {@link DEFAULT_MAX_TASK_OUTPUT_BYTES}'s own doc comment. */
   get maxTaskOutputBytes() {
     return this.deps.maxTaskOutputBytes ?? DEFAULT_MAX_TASK_OUTPUT_BYTES;
@@ -18695,7 +18710,7 @@ function cloneJson(value) {
 function asRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
-function contentlessPayload(envelope) {
+function contentlessPayload(envelope, resultDocumentSelected) {
   const payload = cloneJson(envelope.payload);
   const record4 = asRecord(payload);
   if (!record4) return payload;
@@ -18709,7 +18724,7 @@ function contentlessPayload(envelope) {
     }
     case "task.complete":
       if (typeof record4.summary === "string") record4.summary = "[content omitted]";
-      delete record4.document;
+      if (!resultDocumentSelected) delete record4.document;
       return record4;
     case "task.fail":
     case "task.decline":
@@ -18740,7 +18755,7 @@ function applyHostSanitizer(value, sanitizer, context) {
 }
 function sanitizeEgressEnvelope(envelope, policy, sanitizer, context = {}) {
   try {
-    const payload = policy.activity.mode === "metadata-status" ? contentlessPayload(envelope) : cloneJson(envelope.payload);
+    const payload = policy.activity.mode === "metadata-status" ? contentlessPayload(envelope, context.resultDocumentSelected === true) : cloneJson(envelope.payload);
     if (payload === void 0) return { ok: false, reason: "policy_denied" };
     const sanitizedPayload = applyHostSanitizer(payload, sanitizer, {
       lane: context.lane ?? "latest-value",
@@ -20640,7 +20655,9 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
           sendSanitizedEnvelope(candidate);
           return;
         }
-        const sanitized = sanitizeEgressEnvelope(candidate, egressPolicy, config.agentEgress?.sanitizer);
+        const sanitized = sanitizeEgressEnvelope(candidate, egressPolicy, config.agentEgress?.sanitizer, {
+          resultDocumentSelected: runner.selectsResultDocument(candidate.task_id)
+        });
         if (!sanitized.ok) {
           agentEgress.noteTransportDrop(sanitized.reason);
           return;