@byok-sdk/client 0.2.0 → 0.3.0

package/dist/index.js

@@ -1,16 +1,16 @@
 import { execFile, spawn, spawnSync } from 'child_process';
-import { createHash, randomUUID, sign, createPrivateKey, generateKeyPairSync, randomBytes, createHmac, timingSafeEqual } from 'crypto';
+import { createHash, randomUUID, sign, createPrivateKey, generateKeyPairSync, randomBytes, timingSafeEqual, createHmac } from 'crypto';
 import { promises, mkdirSync, existsSync, renameSync, writeFileSync, chmodSync, statSync, readdirSync, linkSync, fstatSync, lstatSync, unlinkSync, constants, readFileSync, realpathSync } from 'fs';
-import path16, { join, isAbsolute } from 'path';
-import os6 from 'os';
-import { partitionAgentEvents, TASK_TRANSITIONS, encodeEnvelope, createEnvelope, MAX_MESSAGES_PER_BATCH, RuntimeIdSchema, PROTOCOL_VERSION, decodeEnvelope, MessagesSendResponseSchema, parseMessage, UnknownMessageTypeError } from '@byok-sdk/protocol';
+import path17, { join, isAbsolute } from 'path';
+import os5 from 'os';
+import { parseDeviceAssertionEnvelope, tenantId, DeviceProofProtectedClaimsSchema, deviceProofSigningInput, DEVICE_PROOF_SCHEMA_ID, SKILL_PACK_MAX_BYTES, hasCapability, parseSkillPackManifest, checkSkillPackManifest, skillPackContentHashInput, checkSkillPackFileContent, SKILL_PACK_ENTRY_PATH, checkSkillPackEntry, isSkillPackPathSafe, DEVICE_PROOF_HEADER, contentHash, TRUTH_RECORD_KINDS, nonceSigningBytes, DEVICE_ASSERTION_AUDIENCE_MAX_BYTES, DEVICE_ASSERTION_DEFAULT_TTL_MS, DEVICE_ASSERTION_MAX_TTL_MS, CONTENT_HASH_PATTERN, CapabilityDeclarationSchema, DeviceAssertionClaimsSchema, deviceAssertionSigningInput, DEVICE_ASSERTION_SCHEMA_ID } from '@byok-sdk/core';
+import { BYOK_PAIR_PATH, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, byokBlobUrlPath, BYOK_BLOBS_PATH, byokBlobFinalizePath, partitionAgentEvents, BYOK_SKILL_PACKS_PATH, byokSkillPackFilePath, BYOK_RECORDS_PATH, byokRecordPath, TASK_TRANSITIONS, ToolsetIdSchema, encodeEnvelope, createEnvelope, checkResultDocument, MAX_MESSAGES_PER_BATCH, BYOK_CAPABILITIES_PATH, BYOK_PRESENCE_PATH, RuntimeIdSchema, RESULT_DOCUMENT_MAX_BYTES, PROTOCOL_VERSION, decodeEnvelope, BYOK_MESSAGES_PATH, MessagesSendResponseSchema, BYOK_EVENTS_PATH, parseMessage, UnknownMessageTypeError, BYOK_WS_PATH } from '@byok-sdk/protocol';
 import { promisify } from 'util';
 import { fileURLToPath } from 'url';
 import 'readline';
 import net, { createServer, createConnection } from 'net';
 import { WebSocket } from 'ws';
 import { createRequire } from 'module';
-import { tenantId, DeviceProofProtectedClaimsSchema, deviceProofSigningInput, DEVICE_PROOF_SCHEMA_ID, contentHash, TRUTH_RECORD_KINDS } from '@byok-sdk/core';
 
 // src/types.ts
 var PolicyUnsupportedError = class extends Error {
@@ -71,7 +71,7 @@ function gitEnvironment(readOnly) {
   return env;
 }
 function stableGitWorkspaceOwnerId(storeDir, productId) {
-  const identity = `${path16.resolve(storeDir)}\\0${productId}`;
+  const identity = `${path17.resolve(storeDir)}\\0${productId}`;
   return `store-product:${createHash("sha256").update(identity).digest("hex")}`;
 }
 var GUIDANCE = [
@@ -83,11 +83,11 @@ var GUIDANCE = [
   "Leave incomplete work visible for recovery."
 ].join("\n");
 function canonical(value) {
-  return path16.resolve(value);
+  return path17.resolve(value);
 }
 function isContained(root, candidate) {
-  const relative = path16.relative(root, candidate);
-  return relative === "" || !relative.startsWith(`..${path16.sep}`) && !path16.isAbsolute(relative);
+  const relative = path17.relative(root, candidate);
+  return relative === "" || !relative.startsWith(`..${path17.sep}`) && !path17.isAbsolute(relative);
 }
 function bounded(value, max) {
   return Buffer.byteLength(value, "utf8") <= max ? value : value.slice(0, max);
@@ -192,7 +192,7 @@ var GitWorkspaceManager = class {
     await this.ensureOwnerMarker();
   }
   async ensureOwnerMarker() {
-    const markerPath = path16.join(this.workspaceRoot, OWNER_MARKER);
+    const markerPath = path17.join(this.workspaceRoot, OWNER_MARKER);
     let existing;
     try {
       existing = JSON.parse(await promises.readFile(markerPath, "utf8"));
@@ -351,7 +351,7 @@ ${instruction}`;
         if (error instanceof GitWorkspaceError || code !== "ENOENT" && code !== "ENOTDIR") {
           throw new GitWorkspaceError("workspace-root-invalid", "workspace directory is invalid");
         }
-        const parent = path16.dirname(current);
+        const parent = path17.dirname(current);
         if (parent === current) {
           throw new GitWorkspaceError("workspace-root-invalid", "workspace directory is invalid");
         }
@@ -416,7 +416,7 @@ async function atomicWriteFile(filePath, data, options = {}) {
       await target.close();
     }
     if (process.platform !== "win32") {
-      const directory = await promises.open(path16.dirname(filePath), "r");
+      const directory = await promises.open(path17.dirname(filePath), "r");
       try {
         await directory.sync();
       } finally {
@@ -508,7 +508,7 @@ async function ensureSecureDir(dir, opts = {}) {
   await promises.chmod(dir, 448).catch(() => {
   });
   if (platform !== "win32") return;
-  const { username } = os6.userInfo();
+  const { username } = os5.userInfo();
   let result;
   try {
     result = await run("icacls", buildIcaclsArgs(dir, username));
@@ -541,7 +541,7 @@ function isProtected(record) {
 var GitWorkspaceStore = class {
   constructor(storeDir, options = {}) {
     this.storeDir = storeDir;
-    this.filePath = path16.join(storeDir, FILE_NAME);
+    this.filePath = path17.join(storeDir, FILE_NAME);
     this.maxRecords = Math.max(1, Math.floor(options.maxRecords ?? MAX_RECORDS));
   }
   storeDir;
@@ -673,7 +673,7 @@ var GitWorkspaceStore = class {
 };
 var PI_PACKAGE_NAME = "@earendil-works/pi-coding-agent";
 function readPackageJson(dir) {
-  const candidate = path16.join(dir, "package.json");
+  const candidate = path17.join(dir, "package.json");
   if (!existsSync(candidate)) return void 0;
   try {
     return JSON.parse(readFileSync(candidate, "utf8"));
@@ -688,17 +688,17 @@ function resolvePiBin() {
   }
   try {
     const mainEntryUrl = import.meta.resolve(PI_PACKAGE_NAME);
-    let dir = path16.dirname(fileURLToPath(mainEntryUrl));
+    let dir = path17.dirname(fileURLToPath(mainEntryUrl));
     for (let depth = 0; depth < 6; depth++) {
       const pkg = readPackageJson(dir);
       if (pkg?.name === PI_PACKAGE_NAME) {
         const binRel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.pi;
         if (binRel) {
-          return { command: path16.join(dir, binRel), source: "package" };
+          return { command: path17.join(dir, binRel), source: "package" };
         }
         break;
       }
-      const parent = path16.dirname(dir);
+      const parent = path17.dirname(dir);
       if (parent === dir) break;
       dir = parent;
     }
@@ -1088,13 +1088,8 @@ var PiRpcClient = class {
   }
 };
 
-// src/adapters/pi/pi-adapter.ts
-var execFileAsync = promisify(execFile);
-var DETECT_TIMEOUT_MS = 5e3;
-function errorMessage(err) {
-  return err instanceof Error ? err.message : String(err);
-}
-var KNOWN_PROVIDER_ENV_VARS = [
+// src/adapters/provider-credential-environment.ts
+var PROVIDER_CREDENTIAL_ENV_NAMES = [
   "ANTHROPIC_API_KEY",
   "ANTHROPIC_OAUTH_TOKEN",
   "OPENAI_API_KEY",
@@ -1105,24 +1100,66 @@ var KNOWN_PROVIDER_ENV_VARS = [
   "MISTRAL_API_KEY",
   "OPENROUTER_API_KEY",
   "XAI_API_KEY",
-  // Confirmed against the installed pi's own docs/providers.md ("ZAI |
-  // `ZAI_API_KEY` | `zai`") and exercised live against real GLM traffic
-  // during this task's acceptance run — omitting it made `authPresent`
-  // silently false for a perfectly valid, working z.ai/GLM setup.
   "ZAI_API_KEY"
 ];
+var PROVIDER_CREDENTIAL_ENV_DENY_NAMES = [
+  ...PROVIDER_CREDENTIAL_ENV_NAMES,
+  "ANT_LING_API_KEY",
+  "NVIDIA_API_KEY",
+  "CEREBRAS_API_KEY",
+  "CLOUDFLARE_API_KEY",
+  "AI_GATEWAY_API_KEY",
+  "ZAI_CODING_CN_API_KEY",
+  "OPENCODE_API_KEY",
+  "RADIUS_API_KEY",
+  "FIREWORKS_API_KEY",
+  "TOGETHER_API_KEY",
+  "BASETEN_API_KEY",
+  "KIMI_API_KEY",
+  "MINIMAX_API_KEY",
+  "MINIMAX_CN_API_KEY",
+  "QWEN_TOKEN_PLAN_API_KEY",
+  "QWEN_TOKEN_PLAN_CN_API_KEY",
+  "XIAOMI_API_KEY",
+  "XIAOMI_TOKEN_PLAN_CN_API_KEY",
+  "XIAOMI_TOKEN_PLAN_AMS_API_KEY",
+  "XIAOMI_TOKEN_PLAN_SGP_API_KEY",
+  "AWS_ACCESS_KEY_ID",
+  "AWS_SECRET_ACCESS_KEY",
+  "AWS_SESSION_TOKEN",
+  "GOOGLE_APPLICATION_CREDENTIALS",
+  // Reserved by the keys-owned Pi projection. It must never be inherited
+  // from the daemon; the launcher deletes any ambient copy and injects only
+  // the exact credential it just resolved from OS custody.
+  "PI_PROVIDER_API_KEY"
+];
+function withoutProviderCredentials(env) {
+  const sanitized = { ...env };
+  for (const name of PROVIDER_CREDENTIAL_ENV_DENY_NAMES) {
+    delete sanitized[name];
+  }
+  return sanitized;
+}
+
+// src/adapters/pi/pi-adapter.ts
+var execFileAsync = promisify(execFile);
+var DETECT_TIMEOUT_MS = 5e3;
+function errorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
 var PiAdapter = class {
   constructor(options = {}) {
     this.options = options;
   }
   options;
   id = "pi";
+  supportsDispatchSelection = true;
   async detect() {
     try {
       const bin = this.resolveBin();
       const { stdout, stderr } = await execFileAsync(bin.command, ["--version"], { timeout: DETECT_TIMEOUT_MS });
       const version = stdout.trim() || stderr.trim();
-      const authPresent = KNOWN_PROVIDER_ENV_VARS.some((name) => process.env[name] !== void 0);
+      const authPresent = PROVIDER_CREDENTIAL_ENV_NAMES.some((name) => process.env[name] !== void 0);
       return { present: true, version, authPresent };
     } catch {
       return { present: false };
@@ -1141,7 +1178,7 @@ var PiAdapter = class {
    * variable beyond the platform baseline (`daemon/environment.ts`).
    */
   environmentRequirements() {
-    return { credentialNames: KNOWN_PROVIDER_ENV_VARS };
+    return { credentialNames: PROVIDER_CREDENTIAL_ENV_NAMES };
   }
   async start(task, ctx) {
     if (typeof task.instruction !== "string") {
@@ -1153,12 +1190,45 @@ var PiAdapter = class {
     }
     const bin = this.resolveBin();
     const resumeSessionId = task.sessionRef;
-    const args = ["--mode", "rpc", ...resumeSessionId ? ["--session", resumeSessionId] : [], ...mapping.args];
+    const piArgs = ["--mode", "rpc", ...resumeSessionId ? ["--session", resumeSessionId] : [], ...mapping.args];
+    const selection = task.dispatchSelection;
+    let command = bin.command;
+    let args = piArgs;
+    if (selection !== void 0) {
+      if (selection.lane !== "byok" || selection.runtimeId !== "pi") {
+        throw new PolicyUnsupportedError(
+          `pi adapter cannot execute ${selection.lane} selection for runtime ${selection.runtimeId}`
+        );
+      }
+      const launcher = this.options.byokLauncher;
+      if (launcher === void 0) {
+        throw new PolicyUnsupportedError(
+          "pi BYOK selection requires a configured credential-custody launcher"
+        );
+      }
+      command = launcher.command;
+      args = [
+        ...launcher.args ?? [],
+        "--pi-bin",
+        bin.command,
+        "--profile-db",
+        launcher.profileDbPath,
+        "--session-dir",
+        launcher.sessionDir,
+        ...launcher.secretServicePrefix ? ["--secret-service-prefix", launcher.secretServicePrefix] : [],
+        "--provider",
+        selection.providerId,
+        "--model",
+        selection.modelId,
+        "--",
+        ...piArgs
+      ];
+    }
     const rpc = new PiRpcClient({
-      command: bin.command,
+      command,
       args,
       cwd: ctx.workspaceDir,
-      env: ctx.env,
+      env: selection === void 0 ? ctx.env : withoutProviderCredentials(ctx.env),
       spawnFn: this.options.spawnFn
     });
     const response = await rpc.send({ type: "prompt", message: task.instruction });
@@ -1177,7 +1247,7 @@ var PiAdapter = class {
         throw err;
       }
     }
-    return new PiSession(sessionRef, rpc);
+    return new PiSession(sessionRef, rpc, selection);
   }
   resolveBin() {
     return (this.options.resolveBin ?? resolvePiBin)();
@@ -1205,12 +1275,14 @@ async function resolveFreshSessionId(rpc) {
   );
 }
 var PiSession = class {
-  constructor(sessionRef, rpc) {
+  constructor(sessionRef, rpc, selection) {
     this.sessionRef = sessionRef;
     this.rpc = rpc;
+    this.selection = selection;
   }
   sessionRef;
   rpc;
+  selection;
   get events() {
     const rpc = this.rpc;
     return {
@@ -1239,6 +1311,12 @@ var PiSession = class {
     if (typeof task.instruction !== "string") {
       throw new PolicyUnsupportedError("pi adapter only supports string instructions in M0 (no blob-ref fetch yet)");
     }
+    const requestedSelection = task.dispatchSelection;
+    if (requestedSelection !== void 0 && (this.selection?.lane !== "byok" || requestedSelection.lane !== "byok" || requestedSelection.runtimeId !== "pi" || requestedSelection.providerId !== this.selection.providerId || requestedSelection.modelId !== this.selection.modelId)) {
+      throw new PolicyUnsupportedError(
+        "pi persistent session cannot change its authoritative BYOK provider/model selection"
+      );
+    }
     await this.rpc.send({ type: "prompt", message: task.instruction, streamingBehavior: "followUp" });
   }
   async interrupt() {
@@ -1265,7 +1343,7 @@ function resolveApprovalMcpBin() {
   if (override) {
     return { command: override, args: [], source: "env" };
   }
-  const distBin = path16.join(path16.dirname(fileURLToPath(import.meta.url)), "bin", "byok-approval-mcp.js");
+  const distBin = path17.join(path17.dirname(fileURLToPath(import.meta.url)), "bin", "byok-approval-mcp.js");
   return { command: process.execPath, args: [distBin], source: "dist" };
 }
 
@@ -1345,7 +1423,7 @@ var EXTENSION_CONTENT_TYPES = {
   ".yml": "application/yaml"
 };
 function guessContentType(filePath) {
-  const ext = path16.extname(filePath).toLowerCase();
+  const ext = path17.extname(filePath).toLowerCase();
   return EXTENSION_CONTENT_TYPES[ext] ?? "application/octet-stream";
 }
 function mapAssistant(msg, correlation) {
@@ -1417,11 +1495,11 @@ function tryBuildArtifactEvent(msg, workspaceDir) {
   const filePath = toolUseResult && typeof toolUseResult.filePath === "string" ? toolUseResult.filePath : void 0;
   if (!filePath) return void 0;
   const realWorkspaceDir = tryRealpath(workspaceDir) ?? workspaceDir;
-  const fileDir = path16.dirname(filePath);
+  const fileDir = path17.dirname(filePath);
   const realFileDir = tryRealpath(fileDir) ?? fileDir;
-  const realFilePath = path16.join(realFileDir, path16.basename(filePath));
-  const relative = path16.relative(realWorkspaceDir, realFilePath);
-  if (relative === "" || relative.startsWith("..") || path16.isAbsolute(relative)) {
+  const realFilePath = path17.join(realFileDir, path17.basename(filePath));
+  const relative = path17.relative(realWorkspaceDir, realFilePath);
+  if (relative === "" || relative.startsWith("..") || path17.isAbsolute(relative)) {
     return void 0;
   }
   return { type: "artifact", name: relative, contentType: guessContentType(filePath) };
@@ -1663,7 +1741,7 @@ var APPROVAL_TOOL_NAME = "approval_prompt";
 var APPROVAL_MCP_SERVER_NAME = "byokapproval";
 var execFileAsync2 = promisify(execFile);
 var DETECT_TIMEOUT_MS2 = 5e3;
-async function cleanupApprovalMcpConfigDir(dir) {
+async function cleanupMcpConfigDir(dir) {
   if (!dir) return;
   await promises.rm(dir, { recursive: true, force: true }).catch(() => {
   });
@@ -1673,6 +1751,7 @@ var ClaudeAdapter = class {
     this.options = options;
   }
   options;
+  supportsDispatchSelection = true;
   id = "claude";
   async detect() {
     const bin = this.resolveBin();
@@ -1686,7 +1765,13 @@ var ClaudeAdapter = class {
     }
   }
   capabilities() {
-    return { steer: false, resume: true, approvalInteractive: true, permissionModes: ["auto", "readonly", "plan", "confirm"] };
+    return {
+      steer: false,
+      resume: true,
+      approvalInteractive: true,
+      mcpToolsets: true,
+      permissionModes: ["auto", "readonly", "plan", "confirm"]
+    };
   }
   /**
    * M5: deliberate product-boundary decision, not an oversight — byok's
@@ -1712,42 +1797,51 @@ var ClaudeAdapter = class {
     if (!mapping.ok) {
       throw new PolicyUnsupportedError(mapping.reason ?? "policy rejected by claude adapter");
     }
-    let approvalMcpConfigDir;
+    const modelId = subscriptionModel(task, "claude");
+    let mcpConfigDir;
+    const taskMcpServers = ctx.mcpServers ?? {};
+    const needsMcpConfig = mapping.needsApprovalMcp || Object.keys(taskMcpServers).length > 0;
     if (mapping.needsApprovalMcp) {
       if (!ctx.approvalChannel) {
         throw new PolicyUnsupportedError(
           'claude adapter requires policy.mode "confirm" to be started with an approval channel (TaskContext.approvalChannel) \u2014 none was provided'
         );
       }
-      const approvalMcpBin = (this.options.resolveApprovalMcpBin ?? resolveApprovalMcpBin)();
-      approvalMcpConfigDir = await promises.mkdtemp(path16.join(os6.tmpdir(), "byok-approval-mcp-"));
-      await promises.chmod(approvalMcpConfigDir, 448).catch(() => {
+      if (Object.prototype.hasOwnProperty.call(taskMcpServers, APPROVAL_MCP_SERVER_NAME)) {
+        throw new PolicyUnsupportedError(
+          `MCP server name "${APPROVAL_MCP_SERVER_NAME}" is reserved by the claude approval channel`
+        );
+      }
+    }
+    if (needsMcpConfig) {
+      mcpConfigDir = await promises.mkdtemp(path17.join(os5.tmpdir(), "byok-mcp-"));
+      await promises.chmod(mcpConfigDir, 448).catch(() => {
       });
-      const mcpConfigPath = path16.join(approvalMcpConfigDir, "mcp-config.json");
-      const mcpConfig = {
-        mcpServers: {
-          [APPROVAL_MCP_SERVER_NAME]: {
-            command: approvalMcpBin.command,
-            args: approvalMcpBin.args,
-            env: {
-              BYOK_STORE_DIR: ctx.approvalChannel.storeDir,
-              BYOK_PRODUCT_ID: ctx.approvalChannel.productId,
-              BYOK_TASK_ID: ctx.approvalChannel.taskId,
-              BYOK_APPROVAL_TIMEOUT_MS: String(ctx.approvalChannel.timeoutMs)
-            }
+      const mcpConfigPath = path17.join(mcpConfigDir, "mcp-config.json");
+      const mcpServers = { ...taskMcpServers };
+      if (mapping.needsApprovalMcp) {
+        const approvalChannel = ctx.approvalChannel;
+        if (!approvalChannel) throw new Error("unreachable: approval channel checked above");
+        const approvalMcpBin = (this.options.resolveApprovalMcpBin ?? resolveApprovalMcpBin)();
+        mcpServers[APPROVAL_MCP_SERVER_NAME] = {
+          command: approvalMcpBin.command,
+          args: approvalMcpBin.args,
+          env: {
+            BYOK_STORE_DIR: approvalChannel.storeDir,
+            BYOK_PRODUCT_ID: approvalChannel.productId,
+            BYOK_TASK_ID: approvalChannel.taskId,
+            BYOK_APPROVAL_TIMEOUT_MS: String(approvalChannel.timeoutMs)
           }
-        }
-      };
-      await promises.writeFile(mcpConfigPath, JSON.stringify(mcpConfig), { mode: 384 });
+        };
+      }
+      await promises.writeFile(mcpConfigPath, JSON.stringify({ mcpServers }), { mode: 384 });
       mapping.args = [
         ...mapping.args,
-        "--permission-prompt-tool",
-        `mcp__${APPROVAL_MCP_SERVER_NAME}__${APPROVAL_TOOL_NAME}`,
+        ...mapping.needsApprovalMcp ? ["--permission-prompt-tool", `mcp__${APPROVAL_MCP_SERVER_NAME}__${APPROVAL_TOOL_NAME}`] : [],
         "--mcp-config",
         mcpConfigPath,
-        // Never let this task's confirm-mode run pick up some OTHER MCP
-        // server from ambient project/user config — the approval channel is
-        // the only MCP server this invocation should ever see.
+        // The generated file is the complete task-scoped MCP authority.
+        // Never merge ambient user/project MCP configuration into it.
         "--strict-mcp-config"
       ];
     }
@@ -1764,6 +1858,7 @@ var ClaudeAdapter = class {
       // "Error: When using --print, --output-format=stream-json requires
       // --verbose", before spawning any model call.
       "--verbose",
+      ...modelId ? ["--model", modelId] : [],
       ...resumeSessionId ? ["--resume", resumeSessionId] : [],
       ...mapping.args
     ];
@@ -1771,7 +1866,7 @@ var ClaudeAdapter = class {
       command: bin.command,
       args,
       cwd: ctx.workspaceDir,
-      env: ctx.env,
+      env: withoutProviderCredentials(ctx.env),
       spawnFn: this.options.spawnFn
     });
     client.writeUserMessage(task.instruction);
@@ -1780,17 +1875,24 @@ var ClaudeAdapter = class {
       sessionRef = await client.waitForInit();
     } catch (err) {
       client.kill();
-      await cleanupApprovalMcpConfigDir(approvalMcpConfigDir);
+      await cleanupMcpConfigDir(mcpConfigDir);
       throw err;
     }
     if (resumeSessionId !== void 0 && sessionRef !== resumeSessionId) {
       client.kill();
-      await cleanupApprovalMcpConfigDir(approvalMcpConfigDir);
+      await cleanupMcpConfigDir(mcpConfigDir);
       throw new Error(
         `claude --resume echoed a different session id than requested (requested ${resumeSessionId}, got ${sessionRef}) \u2014 refusing to continue in a possibly-wrong session (fail-closed)`
       );
     }
-    return new ClaudeSession(sessionRef, client, ctx.workspaceDir, ctx.approvalChannel, approvalMcpConfigDir);
+    return new ClaudeSession(
+      sessionRef,
+      client,
+      ctx.workspaceDir,
+      ctx.approvalChannel,
+      mcpConfigDir,
+      modelId
+    );
   }
   /**
    * `claude auth status --json` is claude's OWN non-secret login-state
@@ -1824,19 +1926,31 @@ var ClaudeAdapter = class {
     return (this.options.resolveBin ?? resolveClaudeBin)();
   }
 };
+function subscriptionModel(task, runtimeId) {
+  const selection = task.dispatchSelection;
+  if (selection === void 0) return void 0;
+  if (selection.lane !== "subscription" || selection.runtimeId !== runtimeId) {
+    throw new PolicyUnsupportedError(
+      `claude adapter cannot execute ${selection.lane} selection for runtime ${selection.runtimeId}`
+    );
+  }
+  return selection.modelId;
+}
 var ClaudeSession = class {
-  constructor(sessionRef, client, workspaceDir, approvalChannel, approvalMcpConfigDir) {
+  constructor(sessionRef, client, workspaceDir, approvalChannel, mcpConfigDir, modelId) {
     this.sessionRef = sessionRef;
     this.client = client;
     this.workspaceDir = workspaceDir;
     this.approvalChannel = approvalChannel;
-    this.approvalMcpConfigDir = approvalMcpConfigDir;
+    this.mcpConfigDir = mcpConfigDir;
+    this.modelId = modelId;
   }
   sessionRef;
   client;
   workspaceDir;
   approvalChannel;
-  approvalMcpConfigDir;
+  mcpConfigDir;
+  modelId;
   correlation = createToolUseCorrelation();
   get events() {
     const client = this.client;
@@ -1887,6 +2001,12 @@ var ClaudeSession = class {
     if (typeof task.instruction !== "string") {
       throw new PolicyUnsupportedError("claude adapter only supports string instructions in M2 (no blob-ref fetch yet)");
     }
+    const requestedModel = subscriptionModel(task, "claude");
+    if (requestedModel !== void 0 && requestedModel !== this.modelId) {
+      throw new PolicyUnsupportedError(
+        `claude persistent session cannot change model from ${this.modelId ?? "(legacy default)"} to ${requestedModel}`
+      );
+    }
     this.client.writeUserMessage(task.instruction);
   }
   /**
@@ -1906,7 +2026,7 @@ var ClaudeSession = class {
   }
   async close() {
     this.client.kill();
-    await cleanupApprovalMcpConfigDir(this.approvalMcpConfigDir);
+    await cleanupMcpConfigDir(this.mcpConfigDir);
   }
   /**
    * M4 Phase 3: routes into the out-of-band approval channel `start()`
@@ -2070,8 +2190,8 @@ function extractArtifactEvents(changes, workspaceDir) {
     const absolutePath = typeof change.path === "string" ? change.path : void 0;
     const kind = typeof change.kind === "string" ? change.kind : void 0;
     if (!absolutePath || kind === "delete") continue;
-    const relative = path16.relative(workspaceDir, absolutePath);
-    if (relative.length === 0 || relative.startsWith("..") || path16.isAbsolute(relative)) continue;
+    const relative = path17.relative(workspaceDir, absolutePath);
+    if (relative.length === 0 || relative.startsWith("..") || path17.isAbsolute(relative)) continue;
     events.push({ type: "artifact", name: relative, contentType: guessContentType2(relative) });
   }
   return events;
@@ -2092,7 +2212,7 @@ var CONTENT_TYPE_BY_EXTENSION = {
   ".csv": "text/csv"
 };
 function guessContentType2(relativePath) {
-  return CONTENT_TYPE_BY_EXTENSION[path16.extname(relativePath).toLowerCase()] ?? "application/octet-stream";
+  return CONTENT_TYPE_BY_EXTENSION[path17.extname(relativePath).toLowerCase()] ?? "application/octet-stream";
 }
 function extractErrorMessage(rawError) {
   if (typeof rawError === "string") return rawError;
@@ -2230,6 +2350,7 @@ var CodexAdapter = class {
     this.options = options;
   }
   options;
+  supportsDispatchSelection = true;
   id = "codex";
   async detect() {
     const bin = this.resolveBin();
@@ -2302,17 +2423,20 @@ ${withStreams.stderr ?? ""}`);
     if (!mapping.ok) {
       throw new PolicyUnsupportedError(mapping.reason ?? "policy rejected by codex adapter");
     }
+    const modelId = subscriptionModel2(task);
     const bin = this.resolveBin();
     const queue = new AsyncQueue();
     const recordUnmapped = makeUnmappedFrameRecorder(/* @__PURE__ */ new Map());
     const workspaceDir = await resolveRealWorkspaceDir(ctx.workspaceDir);
+    const runtimeEnv = withoutProviderCredentials(ctx.env);
     const { sessionRef, runner } = await runCodexTurn({
       command: bin.command,
       resumeRef: task.sessionRef,
       instruction: task.instruction,
+      modelId,
       policyArgs: mapping.args,
       cwd: ctx.workspaceDir,
-      env: ctx.env,
+      env: runtimeEnv,
       spawnFn: this.options.spawnFn,
       workspaceDir,
       queue,
@@ -2329,7 +2453,8 @@ ${withStreams.stderr ?? ""}`);
       queue,
       recordUnmapped,
       initialRunner: runner,
-      preparedGit: ctx.gitWorkspace !== void 0
+      preparedGit: ctx.gitWorkspace !== void 0,
+      modelId
     });
   }
   resolveBin() {
@@ -2350,12 +2475,25 @@ function makeUnmappedFrameRecorder(counts) {
     }
   };
 }
-function buildArgv(resumeRef, policyArgs, instruction, preparedGit = false) {
+function buildArgv(resumeRef, policyArgs, instruction, modelId, preparedGit = false) {
   const base = resumeRef !== void 0 ? ["exec", "resume", resumeRef] : ["exec"];
-  return [...base, "--json", ...preparedGit ? [] : ["--skip-git-repo-check"], ...policyArgs, instruction];
+  return [
+    ...base,
+    "--json",
+    ...modelId ? ["--model", modelId] : [],
+    ...preparedGit ? [] : ["--skip-git-repo-check"],
+    ...policyArgs,
+    instruction
+  ];
 }
 async function runCodexTurn(params) {
-  const argv = buildArgv(params.resumeRef, params.policyArgs, params.instruction, params.preparedGit);
+  const argv = buildArgv(
+    params.resumeRef,
+    params.policyArgs,
+    params.instruction,
+    params.modelId,
+    params.preparedGit
+  );
   let firstLineSettled = false;
   let resolveFirstLine;
   let rejectFirstLine;
@@ -2456,6 +2594,7 @@ var CodexSession = class {
   queue;
   recordUnmapped;
   preparedGit;
+  modelId;
   currentRunner;
   closed = false;
   constructor(options) {
@@ -2467,6 +2606,7 @@ var CodexSession = class {
     this.queue = options.queue;
     this.recordUnmapped = options.recordUnmapped;
     this.preparedGit = options.preparedGit;
+    this.modelId = options.modelId;
     this.currentRunner = options.initialRunner;
     void this.forgetRunnerOnceClosed(options.initialRunner);
   }
@@ -2527,6 +2667,13 @@ var CodexSession = class {
     if (!mapping.ok) {
       throw new PolicyUnsupportedError(mapping.reason ?? "policy rejected by codex adapter");
     }
+    const requestedModel = subscriptionModel2(task);
+    if (requestedModel !== void 0 && requestedModel !== this.modelId) {
+      throw new PolicyUnsupportedError(
+        `codex persistent session cannot change model from ${this.modelId ?? "(legacy default)"} to ${requestedModel}`
+      );
+    }
+    const modelId = this.modelId;
     const resumeRef = this.sessionRef;
     let sessionRef;
     let runner;
@@ -2535,9 +2682,10 @@ var CodexSession = class {
         command: this.command,
         resumeRef,
         instruction: task.instruction,
+        modelId,
         policyArgs: mapping.args,
         cwd: this.workspaceDir,
-        env: this.env,
+        env: withoutProviderCredentials(this.env),
         spawnFn: this.spawnFn,
         workspaceDir: this.workspaceDir,
         queue: this.queue,
@@ -2597,6 +2745,16 @@ var CodexSession = class {
     );
   }
 };
+function subscriptionModel2(task) {
+  const selection = task.dispatchSelection;
+  if (selection === void 0) return void 0;
+  if (selection.lane !== "subscription" || selection.runtimeId !== "codex") {
+    throw new PolicyUnsupportedError(
+      `codex adapter cannot execute ${selection.lane} selection for runtime ${selection.runtimeId}`
+    );
+  }
+  return selection.modelId;
+}
 
 // src/daemon/approvals.ts
 var ApprovalNotFoundError = class extends Error {
@@ -2699,12 +2857,12 @@ var DeviceStore = class _DeviceStore {
    */
   constructor(storeDir, secureDirOptions) {
     this.secureDirOptions = secureDirOptions;
-    this.filePath = path16.join(storeDir, "device.json");
+    this.filePath = path17.join(storeDir, "device.json");
   }
   secureDirOptions;
   filePath;
   static defaultDir(productId) {
-    return path16.join(os6.homedir(), ".byok", productId);
+    return path17.join(os5.homedir(), ".byok", productId);
   }
   /**
    * Resolve the one store pathname every daemon/CLI component must share.
@@ -2713,7 +2871,7 @@ var DeviceStore = class _DeviceStore {
    * cwd to pin a quarantine directory inode.
    */
   static resolveDir(productId, configured) {
-    return path16.resolve(configured ?? _DeviceStore.defaultDir(productId));
+    return path17.resolve(configured ?? _DeviceStore.defaultDir(productId));
   }
   async load() {
     const opened = await this.openBounded();
@@ -2754,7 +2912,7 @@ var DeviceStore = class _DeviceStore {
     }
   }
   async save(record) {
-    const storeDir = path16.dirname(this.filePath);
+    const storeDir = path17.dirname(this.filePath);
     await ensureSecureDir(storeDir, this.secureDirOptions);
     await atomicWriteFile(this.filePath, JSON.stringify(record, null, 2), { mode: 384 });
   }
@@ -2821,13 +2979,10 @@ function exportPrivateKeyPem(privateKey) {
 function importPrivateKeyPem(pem) {
   return createPrivateKey(pem);
 }
-var NONCE_SIGNING_DOMAIN = "byok-nonce-v1\n";
 function signNonce(privateKey, nonce) {
-  const signature = sign(null, Buffer.from(NONCE_SIGNING_DOMAIN + nonce, "utf8"), privateKey);
+  const signature = sign(null, nonceSigningBytes(nonce), privateKey);
   return signature.toString("base64url");
 }
-
-// src/daemon/url.ts
 function toHttpBase(serverUrl) {
   const url = new URL(serverUrl);
   if (url.protocol === "ws:") url.protocol = "http:";
@@ -2837,7 +2992,7 @@ function toHttpBase(serverUrl) {
   return url.toString();
 }
 function toWsUrl(serverUrl) {
-  const url = new URL("/byok/ws", toHttpBase(serverUrl));
+  const url = new URL(BYOK_WS_PATH, toHttpBase(serverUrl));
   url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
   return url.toString();
 }
@@ -2925,13 +3080,13 @@ var AuthManager = class {
       return await this.runCredentialMutation(async () => {
         const existing = this.record ?? await this.opts.store.load();
         const keyPair = existing ? { privateKey: importPrivateKeyPem(existing.devicePrivateKeyPem), publicKeyBase64Url: existing.devicePublicKey } : generateDeviceKeyPair();
-        const url = new URL("/byok/pair", toHttpBase(this.opts.serverUrl));
+        const url = new URL(BYOK_PAIR_PATH, toHttpBase(this.opts.serverUrl));
         const res = await fetch(url, {
           method: "POST",
           headers: { "content-type": "application/json" },
           body: JSON.stringify({
             pairingCode,
-            deviceName: this.opts.deviceName ?? os6.hostname(),
+            deviceName: this.opts.deviceName ?? os5.hostname(),
             devicePublicKey: keyPair.publicKeyBase64Url
           })
         });
@@ -2959,6 +3114,7 @@ var AuthManager = class {
   async getValidAccessToken() {
     if (!this.record) throw new Error("device is not paired yet; call pair(pairingCode) first");
     if (this.revoked) throw new DeviceRevokedError();
+    if (this.renewing) return this.renewing;
     if (msUntilExpiry(this.record.expiresAt) > RENEW_MARGIN_MS) return this.record.accessToken;
     return this.renew();
   }
@@ -2987,7 +3143,7 @@ var AuthManager = class {
     const record = this.record;
     const base = toHttpBase(this.opts.serverUrl);
     const privateKey = importPrivateKeyPem(record.devicePrivateKeyPem);
-    const challengeRes = await fetch(new URL("/byok/challenge", base), {
+    const challengeRes = await fetch(new URL(BYOK_CHALLENGE_PATH, base), {
       method: "POST",
       headers: { "content-type": "application/json" },
       body: JSON.stringify({ deviceId: record.deviceId })
@@ -3000,7 +3156,7 @@ var AuthManager = class {
     }
     const { nonce } = await challengeRes.json();
     const signature = signNonce(privateKey, nonce);
-    const tokenRes = await fetch(new URL("/byok/token", base), {
+    const tokenRes = await fetch(new URL(BYOK_TOKEN_PATH, base), {
       method: "POST",
       headers: { "content-type": "application/json" },
       body: JSON.stringify({ deviceId: record.deviceId, nonce, signature })
@@ -3098,7 +3254,7 @@ var BlobClient = class {
   async resolveInstruction(blobRef) {
     const base = toHttpBase(this.serverUrl);
     const urlRes = await authedFetch(
-      new URL(`/byok/blobs/${encodeURIComponent(blobRef.blobId)}/url`, base),
+      new URL(byokBlobUrlPath(blobRef.blobId), base),
       { method: "GET" },
       this.auth
     );
@@ -3122,18 +3278,18 @@ var BlobClient = class {
   /** `POST /byok/blobs` (declares size/contentType/contentHash) -> PUT the bytes to the presigned upload URL -> a `BlobRef` for `task.artifact.blobRef`. */
   async uploadArtifact(content, contentType) {
     const bytes = typeof content === "string" ? new TextEncoder().encode(content) : content;
-    const contentHash2 = `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+    const contentHash3 = `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
     const base = toHttpBase(this.serverUrl);
     const reservationId = `blob_${randomUUID()}`;
     const createRes = await authedFetch(
-      new URL("/byok/blobs", base),
+      new URL(BYOK_BLOBS_PATH, base),
       {
         method: "POST",
         headers: {
           "content-type": "application/json",
           "idempotency-key": reservationId
         },
-        body: JSON.stringify({ size: bytes.length, contentType, contentHash: contentHash2 })
+        body: JSON.stringify({ size: bytes.length, contentType, contentHash: contentHash3 })
       },
       this.auth
     );
@@ -3150,7 +3306,7 @@ var BlobClient = class {
       throw new Error(`failed to upload blob content: HTTP ${putRes.status}`);
     }
     await this.#finalize(base, blobId, reservationId);
-    return { blobId, contentHash: contentHash2, size: bytes.length, contentType };
+    return { blobId, contentHash: contentHash3, size: bytes.length, contentType };
   }
   async #finalize(base, blobId, reservationId) {
     let lastFailure;
@@ -3158,7 +3314,7 @@ var BlobClient = class {
       let response;
       try {
         response = await authedFetch(
-          new URL(`/byok/blobs/${encodeURIComponent(blobId)}/finalize`, base),
+          new URL(byokBlobFinalizePath(blobId), base),
           {
             method: "POST",
             headers: { "idempotency-key": reservationId }
@@ -3181,26 +3337,187 @@ var BlobClient = class {
     throw lastFailure;
   }
 };
+var PRESENCE_HINTS_CAPABILITY = "presence.hints";
+var CapabilityDiscoveryError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "CapabilityDiscoveryError";
+  }
+};
+async function fetchCapabilityDeclaration(serverUrl, options = {}) {
+  const url = new URL(BYOK_CAPABILITIES_PATH, toHttpBase(serverUrl));
+  let response;
+  try {
+    response = await fetch(url, {
+      method: "GET",
+      ...options.signal === void 0 ? {} : { signal: options.signal }
+    });
+  } catch (err) {
+    throw new CapabilityDiscoveryError(
+      `failed to read the capability declaration from ${url.toString()}: ${err instanceof Error ? err.message : String(err)}`,
+      { cause: err }
+    );
+  }
+  if (!response.ok) {
+    throw new CapabilityDiscoveryError(
+      `failed to read the capability declaration from ${url.toString()}: HTTP ${response.status}`
+    );
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch (err) {
+    throw new CapabilityDiscoveryError(
+      `the capability declaration at ${url.toString()} is not JSON: ${err instanceof Error ? err.message : String(err)}`,
+      { cause: err }
+    );
+  }
+  const parsed = CapabilityDeclarationSchema.safeParse(body);
+  if (!parsed.success) {
+    throw new CapabilityDiscoveryError(
+      `the capability declaration at ${url.toString()} is not a valid ADR-010 declaration: ${parsed.error.issues.map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.message}`).join("; ")}`,
+      { cause: parsed.error }
+    );
+  }
+  return parsed.data;
+}
+function declares(declaration, capability) {
+  return hasCapability(declaration, capability);
+}
+var DEFAULT_PRESENCE_HEARTBEAT_INTERVAL_MS = 3e4;
+var DEFAULT_PRESENCE_TTL_MS = 9e4;
+var DEFAULT_PRESENCE_MINIMUM_INTERVAL_MS = 5e3;
+function assertPresenceHeartbeatCadence(cadence) {
+  const { intervalMs, ttlMs, minimumIntervalMs } = cadence;
+  if (!(minimumIntervalMs < intervalMs && intervalMs < ttlMs)) {
+    throw new Error(
+      `presence heartbeat interval must satisfy minimumIntervalMs < intervalMs < ttlMs \u2014 got ${minimumIntervalMs} < ${intervalMs} < ${ttlMs}`
+    );
+  }
+}
+var PresencePublisher = class {
+  constructor(opts) {
+    this.opts = opts;
+    const intervalMs = opts.intervalMs ?? DEFAULT_PRESENCE_HEARTBEAT_INTERVAL_MS;
+    const ttlMs = opts.ttlMs ?? DEFAULT_PRESENCE_TTL_MS;
+    const minimumIntervalMs = opts.minimumIntervalMs ?? DEFAULT_PRESENCE_MINIMUM_INTERVAL_MS;
+    assertPresenceHeartbeatCadence({ intervalMs, ttlMs, minimumIntervalMs });
+    this.intervalMs = intervalMs;
+    this.url = new URL(BYOK_PRESENCE_PATH, toHttpBase(opts.serverUrl));
+  }
+  opts;
+  url;
+  intervalMs;
+  timer;
+  running = false;
+  /** Set once a revoked device is observed. Terminal: `start()` will not restart this instance. */
+  stoppedPermanently = false;
+  /** Publishes immediately, then every `intervalMs`. Idempotent; a no-op after a permanent stop. */
+  start() {
+    if (this.running || this.stoppedPermanently) return;
+    this.running = true;
+    void this.beat();
+  }
+  /** Stops the cadence. Idempotent, and the only "offline" signal this producer emits — the hint's TTL does the rest. */
+  stop() {
+    this.running = false;
+    if (this.timer !== void 0) {
+      clearTimeout(this.timer);
+      this.timer = void 0;
+    }
+  }
+  schedule() {
+    if (!this.running) return;
+    this.timer = setTimeout(() => {
+      this.timer = void 0;
+      void this.beat();
+    }, this.intervalMs);
+    this.timer.unref?.();
+  }
+  async beat() {
+    if (!this.running) return;
+    try {
+      const response = await authedFetch(
+        this.url,
+        {
+          method: "PUT",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ level: "online" })
+        },
+        this.opts.auth
+      );
+      if (!response.ok) {
+        if (response.status === 401) {
+          this.stopPermanently(`presence heartbeat unauthorized after token renewal (HTTP 401)`);
+          return;
+        }
+        this.opts.onDegraded?.(`presence heartbeat failed: HTTP ${response.status}`);
+      }
+    } catch (err) {
+      if (err instanceof DeviceRevokedError) {
+        this.stopPermanently("presence heartbeat stopped: device has been revoked; re-pair required");
+        return;
+      }
+      this.opts.onDegraded?.(`presence heartbeat failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    this.schedule();
+  }
+  stopPermanently(reason) {
+    this.stoppedPermanently = true;
+    this.stop();
+    this.opts.onDegraded?.(reason);
+  }
+};
+function freshJti() {
+  return randomBytes(16).toString("base64url");
+}
+function mintDeviceAssertion(input) {
+  const issuedAtMs = input.now.getTime();
+  const expiresAt = new Date(issuedAtMs + input.ttlMs).toISOString();
+  const claims = DeviceAssertionClaimsSchema.parse({
+    version: 1,
+    issuer: input.issuer,
+    productId: input.productId,
+    deviceId: input.record.deviceId,
+    audience: input.audience,
+    jti: freshJti(),
+    issuedAt: new Date(issuedAtMs).toISOString(),
+    expiresAt
+  });
+  const privateKey = importPrivateKeyPem(input.record.devicePrivateKeyPem);
+  const signature = sign(null, deviceAssertionSigningInput(claims), privateKey).toString("base64url");
+  return {
+    envelope: {
+      schema: DEVICE_ASSERTION_SCHEMA_ID,
+      algorithm: "ed25519",
+      protected: claims,
+      signature
+    },
+    claims,
+    expiresAt
+  };
+}
 var CONTROL_PROTOCOL_VERSION = 1;
 var HANDSHAKE_TIMEOUT_MS = 3e3;
 var UNIX_SOCKET_PATH_SOFT_LIMIT = 100;
+var CONTROL_SOCKET_FALLBACK_ROOT = "/tmp";
 function shortHash(input) {
   return createHash("sha256").update(input, "utf8").digest("hex").slice(0, 16);
 }
 function controlSocketPath(storeDir) {
-  const candidate = path16.join(storeDir, "control.sock");
+  const candidate = path17.join(storeDir, "control.sock");
   if (Buffer.byteLength(candidate, "utf8") <= UNIX_SOCKET_PATH_SOFT_LIMIT) return candidate;
-  return path16.join(os6.tmpdir(), `byok-${shortHash(storeDir)}`, "sock");
+  return path17.join(CONTROL_SOCKET_FALLBACK_ROOT, `byok-${shortHash(storeDir)}`, "sock");
 }
 function controlPipeName(productId, storeDir) {
-  const id = shortHash(`${productId}|${path16.resolve(storeDir)}`);
+  const id = shortHash(`${productId}|${path17.resolve(storeDir)}`);
   return `\\\\.\\pipe\\byok-${id}`;
 }
 function controlEndpointPath(productId, storeDir, platform = process.platform) {
   return platform === "win32" ? controlPipeName(productId, storeDir) : controlSocketPath(storeDir);
 }
 function controlTokenPath(storeDir) {
-  return path16.join(storeDir, "control.token");
+  return path17.join(storeDir, "control.token");
 }
 var SERVER_PROOF_LABEL = "byok-control-server|";
 var CLIENT_AUTH_LABEL = "byok-control-client|";
@@ -3230,11 +3547,23 @@ function parseClientHello(value) {
   if (value.v !== CONTROL_PROTOCOL_VERSION || value.hello !== "client" || typeof value.nonce !== "string") return void 0;
   return { v: CONTROL_PROTOCOL_VERSION, hello: "client", nonce: value.nonce };
 }
+function parseServerHello(value) {
+  if (!isRecord2(value)) return void 0;
+  if (value.v !== CONTROL_PROTOCOL_VERSION || value.hello !== "server" || typeof value.proof !== "string" || typeof value.nonce !== "string") {
+    return void 0;
+  }
+  return { v: CONTROL_PROTOCOL_VERSION, hello: "server", proof: value.proof, nonce: value.nonce };
+}
 function parseClientAuth(value) {
   if (!isRecord2(value)) return void 0;
   if (value.v !== CONTROL_PROTOCOL_VERSION || typeof value.auth !== "string") return void 0;
   return { v: CONTROL_PROTOCOL_VERSION, auth: value.auth };
 }
+function parseServerReady(value) {
+  if (!isRecord2(value)) return void 0;
+  if (value.v !== CONTROL_PROTOCOL_VERSION || value.ready !== true) return void 0;
+  return { v: CONTROL_PROTOCOL_VERSION, ready: true };
+}
 function parseRawControlRequest(value) {
   if (!isRecord2(value)) return void 0;
   if (typeof value.id !== "string" || typeof value.method !== "string") return void 0;
@@ -3284,6 +3613,16 @@ function parseApprovalsRequestParams(value) {
   if (typeof value.summary !== "string") return void 0;
   return { taskId: value.taskId, summary: value.summary };
 }
+var ASSERTION_AUDIENCE_MAX_BYTES = 256;
+function parseAssertionIssueParams(value) {
+  if (!isRecord2(value)) return void 0;
+  const keys = Object.keys(value);
+  if (keys.length !== 1 || keys[0] !== "audience") return void 0;
+  const { audience } = value;
+  if (typeof audience !== "string" || audience.length === 0) return void 0;
+  if (Buffer.byteLength(audience, "utf8") > ASSERTION_AUDIENCE_MAX_BYTES) return void 0;
+  return { audience };
+}
 function parseShutdownParams(value) {
   if (!isRecord2(value)) return {};
   return value.reason === "unpair" || value.reason === "operator" ? { reason: value.reason } : {};
@@ -3345,7 +3684,7 @@ async function assertOwnedPrivateDir(dir) {
 }
 async function bindControlEndpoint(server, endpoint) {
   if (process.platform !== "win32") {
-    const endpointDir = path16.dirname(endpoint);
+    const endpointDir = path17.dirname(endpoint);
     await promises.mkdir(endpointDir, { recursive: true, mode: 448 });
     await promises.chmod(endpointDir, 448).catch(() => {
     });
@@ -3616,7 +3955,7 @@ var LongPollClient = class {
     try {
       const base = toHttpBase(this.opts.serverUrl);
       const res = await authedFetch(
-        new URL("/byok/messages", base),
+        new URL(BYOK_MESSAGES_PATH, base),
         {
           method: "POST",
           headers: { "content-type": "application/json" },
@@ -3640,7 +3979,7 @@ var LongPollClient = class {
     while (this.running) {
       try {
         const base = toHttpBase(this.opts.serverUrl);
-        const url = new URL("/byok/events", base);
+        const url = new URL(BYOK_EVENTS_PATH, base);
         const cursor = this.opts.getCursor();
         if (cursor !== void 0) url.searchParams.set("cursor", String(cursor));
         const res = await authedFetch(url, { method: "GET" }, this.opts.auth);
@@ -4626,7 +4965,7 @@ function sameFileState2(left, right) {
   return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs;
 }
 async function openOperationalHealthFile(storeDir) {
-  const filePath = path16.join(storeDir, OPERATIONAL_HEALTH_FILENAME);
+  const filePath = path17.join(storeDir, OPERATIONAL_HEALTH_FILENAME);
   let namedBefore;
   try {
     namedBefore = await promises.lstat(filePath, { bigint: true });
@@ -4668,7 +5007,7 @@ var OperationalHealthTracker = class {
   #writeTail = Promise.resolve();
   #started = false;
   constructor(storeDir, options = {}) {
-    this.#filePath = path16.join(storeDir, OPERATIONAL_HEALTH_FILENAME);
+    this.#filePath = path17.join(storeDir, OPERATIONAL_HEALTH_FILENAME);
     this.#windowMs = options.windowMs ?? 6e4;
     this.#failureThreshold = options.failureThreshold ?? 3;
     this.#maxFailures = options.maxFailures ?? 128;
@@ -4755,7 +5094,7 @@ var OperationalHealthTracker = class {
   async #load() {
     let opened;
     try {
-      opened = await openOperationalHealthFile(path16.dirname(this.#filePath));
+      opened = await openOperationalHealthFile(path17.dirname(this.#filePath));
     } catch (err) {
       throw new Error("operational health state could not be read");
     }
@@ -4791,7 +5130,7 @@ var OperationalHealthTracker = class {
     if (!this.#state) return;
     const body = JSON.stringify(this.#state, null, 2);
     this.#writeTail = this.#writeTail.then(async () => {
-      await ensureSecureDir(path16.dirname(this.#filePath));
+      await ensureSecureDir(path17.dirname(this.#filePath));
       await atomicWriteFile(this.#filePath, body, { mode: 384, fsync: true });
     });
     try {
@@ -4866,19 +5205,19 @@ var RECLAIM_FILENAME = `${DAEMON_OWNER_FILENAME}.reclaim`;
 var MAX_OWNER_BYTES = 4096;
 var RECLAIM_MALFORMED_GRACE_MS = 3e4;
 var SELF_PROCESS_STARTED_AT = new Date(Date.now() - process.uptime() * 1e3).toISOString();
-var STORE_MUTEX_PORT_BASE = 1e4;
-var STORE_MUTEX_PORT_COUNT = 2e4;
-var STORE_MUTEX_PORT_CANDIDATES = 32;
 var STORE_MUTEX_ID_PREFIX = "byok-store-mutex-v1:";
 var STORE_MUTEX_PROBE_TIMEOUT_MS = 1e3;
+var STORE_MUTEX_SOCKET_FILENAME = "mutex.sock";
+var UNIX_SOCKET_PATH_SOFT_LIMIT2 = 100;
+var STORE_MUTEX_FALLBACK_ROOT = "/tmp";
 function storeMutexIdentity(canonicalStoreDir) {
   return createHash("sha256").update(canonicalStoreDir).digest("hex");
 }
-function storeMutexPort(identity, attempt) {
-  const digest = Buffer.from(identity, "hex");
-  const start = digest.readUInt32BE(0) % STORE_MUTEX_PORT_COUNT;
-  const step = 1 + digest.readUInt32BE(4) % (STORE_MUTEX_PORT_COUNT - 1);
-  return STORE_MUTEX_PORT_BASE + (start + attempt * step) % STORE_MUTEX_PORT_COUNT;
+function storeMutexEndpoint(canonicalStoreDir, identity, platform = process.platform) {
+  if (platform === "win32") return `\\\\.\\pipe\\byok-store-mutex-${identity.slice(0, 16)}`;
+  const candidate = path17.join(canonicalStoreDir, STORE_MUTEX_SOCKET_FILENAME);
+  if (Buffer.byteLength(candidate, "utf8") <= UNIX_SOCKET_PATH_SOFT_LIMIT2) return candidate;
+  return path17.join(STORE_MUTEX_FALLBACK_ROOT, `byok-store-mutex-${identity.slice(0, 16)}`, "sock");
 }
 var DaemonOwnerActiveError = class extends Error {
   constructor(role) {
@@ -4999,70 +5338,90 @@ async function createLivenessListener() {
     })
   };
 }
-async function probeStoreMutex(port) {
+async function probeStoreMutex(endpoint, identity) {
   return new Promise((resolve) => {
-    const socket = createConnection({ host: "127.0.0.1", port });
+    const socket = createConnection(endpoint);
     let settled = false;
     let raw = "";
     const finish = (result) => {
       if (settled) return;
       settled = true;
+      clearTimeout(timer);
+      socket.removeAllListeners();
       socket.destroy();
       resolve(result);
     };
+    const timer = setTimeout(() => finish({ kind: "occupied" }), STORE_MUTEX_PROBE_TIMEOUT_MS);
     socket.setEncoding("utf8");
-    socket.setTimeout(STORE_MUTEX_PROBE_TIMEOUT_MS, () => finish({ kind: "uncertain" }));
     socket.on("data", (chunk) => {
       raw += chunk;
-      if (raw.length > STORE_MUTEX_ID_PREFIX.length + 64 + 1) finish({ kind: "foreign-or-gone" });
-    });
-    socket.once("end", () => {
-      const line = raw.trimEnd();
-      const identity = line.startsWith(STORE_MUTEX_ID_PREFIX) ? line.slice(STORE_MUTEX_ID_PREFIX.length) : void 0;
-      finish(
-        identity && /^[a-f0-9]{64}$/.test(identity) ? { kind: "identity", identity } : { kind: "foreign-or-gone" }
-      );
+      if (raw.length > STORE_MUTEX_ID_PREFIX.length + 64 + 1) finish({ kind: "occupied" });
     });
-    socket.once("error", () => finish({ kind: "foreign-or-gone" }));
+    socket.once("end", () => finish(raw.trimEnd() === `${STORE_MUTEX_ID_PREFIX}${identity}` ? { kind: "holder" } : { kind: "occupied" }));
+    socket.once(
+      "error",
+      (err) => finish(err.code === "ECONNREFUSED" || err.code === "ENOENT" ? { kind: "unbound" } : { kind: "occupied" })
+    );
   });
 }
+async function clearStaleStoreMutexSocket(endpoint, identity) {
+  let stat;
+  try {
+    stat = await promises.lstat(endpoint);
+  } catch (err) {
+    if (err.code === "ENOENT") return;
+    throw err;
+  }
+  if (!stat.isSocket()) throw new Error("store mutation lock path exists but is not a socket");
+  if ((await probeStoreMutex(endpoint, identity)).kind !== "unbound") throw new DaemonOwnerActiveError("unknown");
+  await promises.rm(endpoint, { force: true });
+}
+async function assertOwnedPrivateDir2(dir) {
+  const uid = process.getuid?.();
+  if (uid === void 0) return;
+  const stat = await promises.lstat(dir);
+  if (stat.isSymbolicLink() || stat.uid !== uid) {
+    throw new Error(`refusing to bind the store mutation lock under "${dir}": not a real directory owned by this process's own uid`);
+  }
+}
 async function acquireStoreMutex(canonicalStoreDir) {
   const identity = storeMutexIdentity(canonicalStoreDir);
-  for (let attempt = 0; attempt < STORE_MUTEX_PORT_CANDIDATES; attempt += 1) {
-    const server = createServer((socket) => socket.end(`${STORE_MUTEX_ID_PREFIX}${identity}
+  const endpoint = storeMutexEndpoint(canonicalStoreDir, identity);
+  const isPipe = process.platform === "win32";
+  if (!isPipe) {
+    const endpointDir = path17.dirname(endpoint);
+    if (endpointDir !== canonicalStoreDir) {
+      await ensureSecureDir(endpointDir);
+      await assertOwnedPrivateDir2(endpointDir);
+    }
+    await clearStaleStoreMutexSocket(endpoint, identity);
+  }
+  const server = createServer((socket) => socket.end(`${STORE_MUTEX_ID_PREFIX}${identity}
 `));
-    const port = storeMutexPort(identity, attempt);
-    try {
-      await new Promise((resolve, reject) => {
-        server.once("error", reject);
-        server.listen({ host: "127.0.0.1", port, exclusive: true }, () => {
-          server.removeListener("error", reject);
-          resolve();
-        });
+  try {
+    await new Promise((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(endpoint, () => {
+        server.removeListener("error", reject);
+        resolve();
       });
-    } catch (err) {
-      if (err.code !== "EADDRINUSE") throw err;
-      const probe = await probeStoreMutex(port);
-      if (probe.kind === "uncertain" || probe.kind === "identity" && probe.identity === identity) {
-        throw new DaemonOwnerActiveError("unknown");
-      }
-      continue;
-    }
-    server.unref();
-    let closed = false;
-    return {
-      port,
-      close: () => new Promise((resolve, reject) => {
-        if (closed) {
-          resolve();
-          return;
-        }
-        closed = true;
-        server.close((err) => err ? reject(err) : resolve());
-      })
-    };
+    });
+  } catch (err) {
+    if (err.code === "EADDRINUSE") throw new DaemonOwnerActiveError("unknown");
+    throw err;
   }
-  throw new DaemonOwnerActiveError("unknown");
+  if (!isPipe) await promises.chmod(endpoint, 384).catch(() => void 0);
+  server.unref();
+  let closed = false;
+  return {
+    endpoint,
+    close: async () => {
+      if (closed) return;
+      closed = true;
+      await new Promise((resolve, reject) => server.close((err) => err ? reject(err) : resolve()));
+      if (!isPipe) await promises.rm(endpoint, { force: true }).catch(() => void 0);
+    }
+  };
 }
 async function reclaimExistsAndIsActive(reclaimPath) {
   let stat;
@@ -5110,8 +5469,8 @@ async function acquireDaemonOwner(storeDir, role, clock = () => /* @__PURE__ */
     await mutex.close().catch(() => void 0);
     throw err;
   }
-  const ownerPath = path16.join(storeDir, DAEMON_OWNER_FILENAME);
-  const reclaimPath = path16.join(storeDir, RECLAIM_FILENAME);
+  const ownerPath = path17.join(storeDir, DAEMON_OWNER_FILENAME);
+  const reclaimPath = path17.join(storeDir, RECLAIM_FILENAME);
   const record = {
     version: 2,
     pid: process.pid,
@@ -5178,6 +5537,7 @@ function toRuntimeInfoCapabilities(caps) {
     steer: caps.steer,
     resume: caps.resume,
     approvalInteractive: caps.approvalInteractive,
+    ...caps.mcpToolsets === void 0 ? {} : { mcpToolsets: caps.mcpToolsets },
     permissionModes: caps.permissionModes
   };
 }
@@ -5188,7 +5548,7 @@ var CursorStore = class {
   storeDir;
   fileFor(serverUrl, deviceId) {
     const key = createHash("sha256").update(`${serverUrl}::${deviceId}`).digest("hex").slice(0, 32);
-    return path16.join(this.storeDir, `cursor-${key}.json`);
+    return path17.join(this.storeDir, `cursor-${key}.json`);
   }
   async load(serverUrl, deviceId) {
     let raw;
@@ -5208,7 +5568,7 @@ var CursorStore = class {
   }
   async save(serverUrl, deviceId, cursor) {
     const file = this.fileFor(serverUrl, deviceId);
-    await promises.mkdir(path16.dirname(file), { recursive: true, mode: 448 });
+    await promises.mkdir(path17.dirname(file), { recursive: true, mode: 448 });
     await atomicWriteFile(file, JSON.stringify({ cursor }));
   }
   /** Remove any persisted cursor for (serverUrl, deviceId) — a no-op if none exists. Called from `pair()` (finding F5) so a device that's about to be replaced never leaves a cursor a future, unrelated device could somehow inherit. */
@@ -5251,7 +5611,7 @@ var DaemonObserver = class {
   }
   /**
    * Feed a raw INBOUND (server -> daemon) envelope. Deliberately narrow: only
-   * `task.offer` produces a local event here — every other inbound type
+   * either offer variant produces a local event here — every other inbound type
    * (`task.cancel`/`task.steer`/`task.approve`/`task.reject`) is a
    * best-effort notification whose OWN observable effect already surfaces
    * through the daemon's outbound envelopes (`task.cancelled`, `task.progress`
@@ -5259,7 +5619,7 @@ var DaemonObserver = class {
    * where those are actually reported from.
    */
   handleInboundEnvelope(envelope) {
-    if (envelope.type !== "task.offer") return;
+    if (envelope.type !== "task.offer" && envelope.type !== "task.offer_with_toolsets") return;
     const taskId = envelope.task_id;
     if (this.taskInfo.has(taskId)) return;
     this.upsertTask(taskId, { state: "Offered", runtime: envelope.payload.runtime });
@@ -5380,6 +5740,37 @@ var DaemonObserver = class {
   noteShutdownComplete(reason, undeliveredOutboxCount) {
     this.emit({ kind: "shutdown-complete", ts: nowIso(), reason, undeliveredOutboxCount });
   }
+  /**
+   * Plan `device-assertion-broker`: see the `device-assertion` `DaemonEvent`
+   * variant's own doc comment. The parameter type is what keeps the signature
+   * out — there is no field to pass one through.
+   *
+   * codex round-2 F4: the DENIED caller can pass its raw `audience` here, but
+   * it is converted to a byte SIZE the instant the event is constructed and the
+   * raw string is dropped — it is never placed on the emitted `DaemonEvent`, so
+   * it cannot reach a subscriber, `format.ts`, stdout, or the audit file. The
+   * ISSUED `audience` came from the allowlist and is kept verbatim.
+   */
+  noteDeviceAssertion(event) {
+    if (event.result === "issued") {
+      this.emit({
+        kind: "device-assertion",
+        ts: nowIso(),
+        result: "issued",
+        audience: event.audience,
+        jti: event.jti,
+        expiresAt: event.expiresAt
+      });
+      return;
+    }
+    this.emit({
+      kind: "device-assertion",
+      ts: nowIso(),
+      result: "denied",
+      reason: event.reason,
+      audienceSize: event.audience === void 0 ? void 0 : Buffer.byteLength(event.audience, "utf8")
+    });
+  }
   /** M4 Phase 3 hardening: see the `stale-approval-decision` `DaemonEvent` variant's own doc comment. */
   noteStaleApprovalDecision(taskId, decision, reason) {
     this.emit({ kind: "stale-approval-decision", ts: nowIso(), taskId, decision, reason });
@@ -5504,7 +5895,7 @@ var SessionWorkspaceStore = class {
    */
   queue = Promise.resolve();
   constructor(storeDir) {
-    this.filePath = path16.join(storeDir, "session-workspaces.json");
+    this.filePath = path17.join(storeDir, "session-workspaces.json");
   }
   async get(sessionRef) {
     return this.enqueue(async () => {
@@ -5562,7 +5953,7 @@ var SessionWorkspaceStore = class {
     }
   }
   async save(all) {
-    const dir = path16.dirname(this.filePath);
+    const dir = path17.dirname(this.filePath);
     await promises.mkdir(dir, { recursive: true, mode: 448 });
     const tmpPath = `${this.filePath}.${process.pid}-${tmpSeq2++}.tmp`;
     try {
@@ -5667,9 +6058,9 @@ function isSqliteAvailable() {
   }
 }
 var SECURE_FILE_MODE = 384;
-function openJournalDatabase(path20, busyTimeoutMs, faults) {
+function openJournalDatabase(path21, busyTimeoutMs, faults) {
   const { DatabaseSync } = loadSqliteModule();
-  const db = new DatabaseSync(path20, { timeout: busyTimeoutMs });
+  const db = new DatabaseSync(path21, { timeout: busyTimeoutMs });
   try {
     faults?.onStep?.("after-open");
     db.exec("PRAGMA auto_vacuum = INCREMENTAL;");
@@ -5812,9 +6203,9 @@ var RECEIVED_STATE = "received";
 function byteLength(value) {
   return Buffer.byteLength(value, "utf8");
 }
-function fileBytes(path20) {
+function fileBytes(path21) {
   try {
-    return statSync(path20).size;
+    return statSync(path21).size;
   } catch {
     return 0;
   }
@@ -7021,6 +7412,21 @@ var MAX_INLINE_ARTIFACT_BYTES = 64 * 1024;
 var MAX_TRACKED_TASK_IDS = 2e3;
 var MAX_DURATION_EXCEEDED_REASON_PREFIX = "resource limit exceeded: maxDurationMs";
 var MAX_OUTPUT_BYTES_EXCEEDED_REASON_PREFIX = "resource limit exceeded: maxTaskOutputBytes";
+var RESULT_DOCUMENT_UNDELIVERABLE_REASON_PREFIX = "result document undeliverable";
+function resultDocumentRejectionDetail(check) {
+  switch (check.reason) {
+    case "over-cap":
+      return `${check.bytes} bytes as canonical JSON, over the ${RESULT_DOCUMENT_MAX_BYTES}-byte limit (it is never truncated \u2014 a truncated JSON document is not valid JSON; use artifactRefs for a result this size)`;
+    case "not-serializable":
+      return "not JSON-serializable (JSON.stringify threw, or produced no output at all)";
+    case "not-plain-json":
+      return "not plain JSON data: it does not equal its own JSON round trip, so serializing it would silently change it (an undefined-valued key, NaN, a function or symbol value, a Date, a toJSON that rewrites the value, or a getter that answers differently on a second read)";
+    default: {
+      const exhaustive = check;
+      throw new Error(`unhandled result document rejection: ${JSON.stringify(exhaustive)}`);
+    }
+  }
+}
 var DEFAULT_MAX_TASK_OUTPUT_BYTES = 64 * 1024 * 1024;
 function isKnownRuntimeId(id) {
   return RuntimeIdSchema.safeParse(id).success;
@@ -7033,6 +7439,14 @@ function orderByPreference(candidates, preference) {
 function adapterSupportsMode(adapter, mode) {
   return adapter.capabilities().permissionModes.includes(mode);
 }
+function adapterSupportsMcpToolsets(adapter) {
+  return adapter.capabilities().mcpToolsets === true;
+}
+function withoutRequiredToolsets(payload) {
+  if (!("requiredToolsets" in payload)) return payload;
+  const { requiredToolsets, ...offer } = payload;
+  return offer;
+}
 function errorMessage3(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -7068,8 +7482,8 @@ function estimateEventBytes(event) {
 }
 async function openArtifact(workspaceDir, name) {
   const realWorkspaceDir = await promises.realpath(workspaceDir).catch(() => workspaceDir);
-  const candidate = path16.resolve(realWorkspaceDir, name);
-  const prefix = realWorkspaceDir.endsWith(path16.sep) ? realWorkspaceDir : realWorkspaceDir + path16.sep;
+  const candidate = path17.resolve(realWorkspaceDir, name);
+  const prefix = realWorkspaceDir.endsWith(path17.sep) ? realWorkspaceDir : realWorkspaceDir + path17.sep;
   if (candidate !== realWorkspaceDir && !candidate.startsWith(prefix)) {
     return { ok: false, reason: `artifact name "${name}" resolves outside the task workspace \u2014 rejected` };
   }
@@ -7388,6 +7802,9 @@ var TaskRunner = class {
       case "task.offer":
         await this.handleOffer(envelope.task_id, envelope.payload);
         return;
+      case "task.offer_with_toolsets":
+        await this.handleOffer(envelope.task_id, envelope.payload);
+        return;
       case "task.cancel":
         await this.handleCancel(envelope.task_id, envelope.payload.reason);
         return;
@@ -7441,7 +7858,22 @@ var TaskRunner = class {
         );
         return;
       }
-      const pick = await this.pickAdapter(payload.runtime, payload.policy.mode);
+      if (payload.dispatchSelection !== void 0 && payload.runtime !== void 0 && payload.runtime !== payload.dispatchSelection.runtimeId) {
+        this.decline(
+          taskId,
+          `offer runtime ${payload.runtime} does not match dispatchSelection.runtimeId ${payload.dispatchSelection.runtimeId}`,
+          false
+        );
+        return;
+      }
+      const requiredToolsets = "requiredToolsets" in payload ? payload.requiredToolsets : void 0;
+      const resolvedMcp = requiredToolsets ? this.resolveMcpServers(requiredToolsets) : void 0;
+      if (resolvedMcp && !resolvedMcp.ok) {
+        this.decline(taskId, resolvedMcp.reason, true);
+        return;
+      }
+      const requestedRuntime = payload.dispatchSelection?.runtimeId ?? payload.runtime;
+      const pick = await this.pickAdapter(requestedRuntime, payload.policy.mode, requiredToolsets !== void 0);
       if (!pick.ok) {
         this.decline(taskId, pick.reason, pick.retryable);
         return;
@@ -7467,7 +7899,7 @@ var TaskRunner = class {
           const sameProtocolTask = ledger?.taskId === taskId;
           const interruptedOldTask = ledger?.phase === "interrupted" && sameProtocolTask;
           const activeDifferentTask = ledger !== void 0 && ledger.taskId !== taskId && (ledger.phase === "preparing" || ledger.phase === "active");
-          if (!known || known.workspaceKind !== "git" || !known.gitWorkspaceId || !ledger || ledger.workspaceId !== known.gitWorkspaceId || ledger.sessionRef !== payload.sessionRef || path16.resolve(ledger.workspaceDir) !== path16.resolve(known.workspaceDir) || interruptedOldTask || activeDifferentTask) {
+          if (!known || known.workspaceKind !== "git" || !known.gitWorkspaceId || !ledger || ledger.workspaceId !== known.gitWorkspaceId || ledger.sessionRef !== payload.sessionRef || path17.resolve(ledger.workspaceDir) !== path17.resolve(known.workspaceDir) || interruptedOldTask || activeDifferentTask) {
             this.decline(taskId, "session is incompatible with Git workspace mode", true);
             return;
           }
@@ -7482,7 +7914,7 @@ var TaskRunner = class {
             return;
           }
         } else {
-          workspaceDir = path16.join(this.deps.workspaceRoot, taskId);
+          workspaceDir = path17.join(this.deps.workspaceRoot, taskId);
         }
         try {
           gitLease = await gitManager.acquireLease(workspaceDir, payload.sessionRef);
@@ -7492,7 +7924,7 @@ var TaskRunner = class {
         }
       } else if (!this.deps.gitWorkspaceManager && !this.deps.gitWorkspaceStore) {
         known = payload.sessionRef ? await this.deps.sessionWorkspaces.get(payload.sessionRef) : void 0;
-        workspaceDir = known?.workspaceDir ?? path16.join(this.deps.workspaceRoot, taskId);
+        workspaceDir = known?.workspaceDir ?? path17.join(this.deps.workspaceRoot, taskId);
         plainWorkspaceNeedsResolve = true;
       } else {
         this.decline(taskId, "workspace mode is unavailable", true);
@@ -7604,6 +8036,7 @@ var TaskRunner = class {
       const ctx = {
         workspaceDir,
         policy: decision.policy,
+        ...resolvedMcp?.ok ? { mcpServers: resolvedMcp.servers } : {},
         ...gitWorkspaceId ? { gitWorkspace: { workspaceId: gitWorkspaceId, baseline: gitBaseline } } : {},
         // M5: no longer `process.env` verbatim (see `environment.ts`'s own
         // module doc comment for the credential-leak gap that closed) —
@@ -7640,7 +8073,7 @@ var TaskRunner = class {
         }
       };
       const effectiveOffer = {
-        ...payload,
+        ...withoutRequiredToolsets(payload),
         instruction: gitWorkspaceId ? prependGitWorkspaceGuidance(resolvedInstruction) : resolvedInstruction,
         // Never forward a sessionRef this device has no recorded workspace
         // for (stale, from another device, or simply made up) — an adapter
@@ -7718,6 +8151,36 @@ var TaskRunner = class {
     if (typeof instruction === "string") return instruction;
     return this.deps.blobClient.resolveInstruction(instruction.blobRef);
   }
+  /** Resolve every requested logical id locally and reject missing/colliding server authority before claim. */
+  resolveMcpServers(requiredToolsets) {
+    const registry = this.deps.mcpToolsets;
+    if (!registry) {
+      return { ok: false, reason: "offer requires MCP toolsets, but this device has no local mcpToolsets registry" };
+    }
+    const servers = /* @__PURE__ */ Object.create(null);
+    for (const toolsetId of requiredToolsets) {
+      const toolset = registry.get(toolsetId);
+      if (!toolset) {
+        return { ok: false, reason: `required MCP toolset "${toolsetId}" is not configured on this device` };
+      }
+      for (const [serverName, server] of Object.entries(toolset.mcpServers)) {
+        if (Object.prototype.hasOwnProperty.call(servers, serverName)) {
+          return {
+            ok: false,
+            reason: `required MCP toolsets collide on server name "${serverName}"; refusing ambiguous projection`
+          };
+        }
+        servers[serverName] = Object.freeze({
+          command: server.command,
+          ...server.args ? { args: Object.freeze([...server.args]) } : {}
+        });
+      }
+    }
+    if (Object.keys(servers).length === 0) {
+      return { ok: false, reason: "required MCP toolsets resolved to no servers; refusing to run without tools" };
+    }
+    return { ok: true, servers: Object.freeze(servers) };
+  }
   async pump(active) {
     try {
       for await (const event of active.session.events) {
@@ -7751,11 +8214,38 @@ var TaskRunner = class {
         if (event.type === "turn_end") {
           active.batcher.push(event);
           active.batcher.flush();
+          const finalOutput = active.summaryParts.join("");
+          const outcome = await this.resolveResultDocument(active, finalOutput);
+          if (!outcome.deliver) return;
           await this.observeGit(active, "completed");
+          if (outcome.document !== void 0 && !this.hasResultDocumentCapability()) {
+            await this.fail(
+              active.taskId,
+              `${RESULT_DOCUMENT_UNDELIVERABLE_REASON_PREFIX}: the connected server stopped advertising the result-document capability before this completion could be sent (a reconnect to an older server), so it would silently discard this document`,
+              false
+            );
+            return;
+          }
           this.deps.send(
             createEnvelope(
               "task.complete",
-              { summary: active.summaryParts.join(""), sessionRef: active.session.sessionRef },
+              {
+                summary: finalOutput,
+                sessionRef: active.session.sessionRef,
+                // Spread rather than `document: outcome.document`, so a
+                // completion with no document is the exact same payload it
+                // was before this field existed — not one carrying an
+                // explicit `document: undefined` key.
+                //
+                // `outcome.document` is the protocol's CANONICAL SNAPSHOT
+                // (`checkResultDocument`), never the object the extractor
+                // returned: pure data serializes identically at the root
+                // (where it was measured) and nested inside this payload
+                // (where the codec actually serializes it), so a contextual
+                // `toJSON(key)` or an unstable getter cannot make the wire
+                // bytes differ from what the cap gate approved.
+                ...outcome.document !== void 0 ? { document: outcome.document } : {}
+              },
               { taskId: active.taskId, sessionRef: active.session.sessionRef }
             )
           );
@@ -8293,6 +8783,102 @@ var TaskRunner = class {
     this.deps.send(createEnvelope("task.fail", { reason, retryable }, { taskId }));
     await this.finish(taskId);
   }
+  /**
+   * additive-minor (`task.complete.document`): the whole daemon-side gate
+   * between a configured {@link ResultDocumentExtractor} and the wire —
+   * called once, from the `turn_end` completion path, immediately before
+   * `task.complete` is built.
+   *
+   * `{deliver: true}` means "go on and send `task.complete`", carrying the
+   * document when there is one. `{deliver: false}` means this method has
+   * ALREADY reported `task.fail` and finished the task; the caller must
+   * return without sending anything further.
+   *
+   * Four fail-closed branches, all `retryable: false` (see
+   * {@link RESULT_DOCUMENT_UNDELIVERABLE_REASON_PREFIX} for why none of them
+   * can succeed on a retry):
+   *
+   *   1. The extractor threw — its error is surfaced, never swallowed.
+   *   2. The extractor returned a thenable, violating the synchronous
+   *      contract in the one way that would otherwise ship a wrong answer.
+   *   3. The document is over the cap, not JSON-serializable, or not plain
+   *      JSON data, per `checkResultDocument` — the protocol's OWN check,
+   *      imported rather than reimplemented, so this gate and the server's
+   *      schema validation can never disagree about what is legal.
+   *   4. The connected server never advertised `result-document`. Its
+   *      tolerant `z.object()` would silently strip the field on arrival
+   *      (`version.ts`'s own flag doc comment), so "send anyway" is not a
+   *      degraded-but-working path — it is the task's primary structured
+   *      result being deleted in transit with nothing reported anywhere.
+   *
+   * The capability is checked LAST, deliberately: a document that is itself
+   * invalid is the host's own bug and is worth reporting as such even when
+   * the connected server could not have accepted any document at all. It is
+   * then re-checked once more by the caller after its own last await, since
+   * a reconnect can invalidate this answer in between (F3).
+   *
+   * **Residual window (bounded, deliberately not hacked around).** Even the
+   * caller's re-check happens before `ConnectionManager.send` hands the
+   * envelope to a transport, and a queued envelope can outlive the
+   * connection it was queued for: a reconnect between `send()` and the
+   * outbox actually draining could still deliver this `task.complete` to a
+   * rolled-back N-1 server that strips the document. Closing that would
+   * mean teaching the transport outbox to inspect payload semantics and
+   * mint a substitute `task.fail` for a task this runner already finished —
+   * a second authority over terminal outcomes living in the queue, which is
+   * worse than the window it closes. Documented instead, here and in
+   * docs/protocol.md §7.2.
+   */
+  async resolveResultDocument(active, finalOutput) {
+    const extract = this.deps.resultDocument?.extract;
+    if (!extract) return { deliver: true };
+    let document;
+    try {
+      document = extract(finalOutput, { taskId: active.taskId, sessionRef: active.session.sessionRef });
+    } catch (err) {
+      await this.fail(
+        active.taskId,
+        `${RESULT_DOCUMENT_UNDELIVERABLE_REASON_PREFIX}: the configured resultDocument.extract threw: ${errorMessage3(err)}`,
+        false
+      );
+      return { deliver: false };
+    }
+    if (typeof document?.then === "function") {
+      await this.fail(
+        active.taskId,
+        `${RESULT_DOCUMENT_UNDELIVERABLE_REASON_PREFIX}: the configured resultDocument.extract returned a promise; the contract is synchronous (an awaited value is never read, and a promise encodes to an empty document)`,
+        false
+      );
+      return { deliver: false };
+    }
+    if (document === void 0) return { deliver: true };
+    const check = checkResultDocument(document);
+    if (!check.ok) {
+      const detail = resultDocumentRejectionDetail(check);
+      await this.fail(active.taskId, `${RESULT_DOCUMENT_UNDELIVERABLE_REASON_PREFIX}: ${detail}`, false);
+      return { deliver: false };
+    }
+    if (!this.hasResultDocumentCapability()) {
+      await this.fail(
+        active.taskId,
+        `${RESULT_DOCUMENT_UNDELIVERABLE_REASON_PREFIX}: the connected server did not advertise the result-document capability, so it would silently discard this ${check.bytes}-byte document`,
+        false
+      );
+      return { deliver: false };
+    }
+    return { deliver: true, document: check.canonical };
+  }
+  /**
+   * Whether the CURRENTLY connected server advertised `result-document` —
+   * read fresh on every call, never captured, because the answer changes
+   * across a reconnect (`ConnectionManager.getServerCapabilities` returns
+   * `[]` from the moment an acked connection closes until a fresh
+   * `conn.ack` repopulates it). An absent `getServerCapabilities` seam is
+   * "no capabilities", the fail-closed reading.
+   */
+  hasResultDocumentCapability() {
+    return (this.deps.getServerCapabilities?.() ?? []).includes("result-document");
+  }
   async observeGit(active, phase) {
     if (!active.gitWorkspaceId || !this.deps.gitWorkspaceManager || !this.deps.gitWorkspaceStore) return;
     try {
@@ -8364,7 +8950,7 @@ var TaskRunner = class {
   }
   /** `reuseDir`, when set (a known sessionRef's recorded workspace), is used verbatim instead of a fresh `workspaceRoot/<taskId>` directory — `mkdir recursive` is idempotent either way, so ensuring-exists is safe to do unconditionally. */
   async resolveWorkspaceDir(taskId, reuseDir) {
-    const dir = reuseDir ?? path16.join(this.deps.workspaceRoot, taskId);
+    const dir = reuseDir ?? path17.join(this.deps.workspaceRoot, taskId);
     await promises.mkdir(dir, { recursive: true });
     return dir;
   }
@@ -8395,7 +8981,7 @@ var TaskRunner = class {
    * is device-specific (which runtimes happen to be installed here), so a
    * different device's installed runtime set might satisfy it.
    */
-  async pickAdapter(requestedRuntime, policyMode) {
+  async pickAdapter(requestedRuntime, policyMode, requiresMcpToolsets) {
     const allowlist = this.deps.runtimeAllowlist;
     if (requestedRuntime) {
       if (allowlist && !allowlist.includes(requestedRuntime)) {
@@ -8416,6 +9002,13 @@ var TaskRunner = class {
           retryable: false
         };
       }
+      if (requiresMcpToolsets && !adapterSupportsMcpToolsets(adapter)) {
+        return {
+          ok: false,
+          reason: `runtime "${requestedRuntime}" cannot project required MCP toolsets`,
+          retryable: false
+        };
+      }
       const detected = await adapter.detect();
       if (!detected.present) {
         return {
@@ -8430,12 +9023,13 @@ var TaskRunner = class {
     const candidates = orderByPreference(eligible, this.deps.runtimePreference ?? DEFAULT_RUNTIME_PREFERENCE);
     for (const adapter of candidates) {
       if (!adapterSupportsMode(adapter, policyMode)) continue;
+      if (requiresMcpToolsets && !adapterSupportsMcpToolsets(adapter)) continue;
       const detected = await adapter.detect();
       if (detected.present) return { ok: true, adapter };
     }
     return {
       ok: false,
-      reason: `no available runtime on this device can express permission mode "${policyMode}"`,
+      reason: requiresMcpToolsets ? `no available runtime on this device can express permission mode "${policyMode}" with required MCP toolsets` : `no available runtime on this device can express permission mode "${policyMode}"`,
       retryable: true
     };
   }
@@ -8466,7 +9060,7 @@ function toJournalEnvelopeRecord(envelope, identity) {
     bytes,
     bytesHash: journalHash(bytes),
     receivedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    opensTask: envelope.type === "task.offer"
+    opensTask: envelope.type === "task.offer" || envelope.type === "task.offer_with_toolsets"
   };
 }
 function isRuntimeId(id) {
@@ -8490,48 +9084,235 @@ function computeCapabilities(adapters) {
   if (adapters.some((adapter) => adapter.capabilities().steer)) flags.push("steer");
   flags.push("blob-upload");
   flags.push("approval-targeting");
+  const selectionAdapters = adapters.filter(
+    (adapter) => ALL_RUNTIME_IDS.includes(adapter.id)
+  );
+  if (selectionAdapters.length > 0 && selectionAdapters.every((adapter) => adapter.supportsDispatchSelection === true)) {
+    flags.push("dispatch-selection");
+  }
+  if (adapters.some((adapter) => adapter.capabilities().mcpToolsets === true)) {
+    flags.push("toolset-selection");
+  }
   return flags;
 }
 var ALL_RUNTIME_IDS = ["pi", "claude", "codex"];
-function buildAdapter(id) {
+function buildAdapter(id, config) {
   switch (id) {
     case "pi":
-      return new PiAdapter();
+      return new PiAdapter({ byokLauncher: config.piByokLauncher });
     case "claude":
       return new ClaudeAdapter();
     case "codex":
       return new CodexAdapter();
   }
 }
-function buildDefaultAdapters(runtimeAllowlist) {
-  const ids = runtimeAllowlist ? ALL_RUNTIME_IDS.filter((id) => runtimeAllowlist.includes(id)) : ALL_RUNTIME_IDS;
-  return ids.map(buildAdapter);
+function buildDefaultAdapters(config) {
+  const ids = config.runtimeAllowlist ? ALL_RUNTIME_IDS.filter((id) => config.runtimeAllowlist?.includes(id)) : ALL_RUNTIME_IDS;
+  return ids.map((id) => buildAdapter(id, config));
 }
-function createDaemonWithAdapters(config, adapters, overrides = {}) {
-  if (config.maxTaskOutputBytes !== void 0 && !(config.maxTaskOutputBytes > 0)) {
+function validatePiByokLauncherConfig(launcher) {
+  for (const [field, value] of [
+    ["command", launcher.command],
+    ["profileDbPath", launcher.profileDbPath],
+    ["sessionDir", launcher.sessionDir]
+  ]) {
+    if (value.trim().length === 0 || /[\u0000\r\n]/u.test(value)) {
+      throw new Error(`DaemonConfig.piByokLauncher.${field} must be a non-empty single-line string`);
+    }
+  }
+  if (!isAbsolute(launcher.profileDbPath) || !isAbsolute(launcher.sessionDir)) {
     throw new Error(
-      `DaemonConfig.maxTaskOutputBytes must be a positive number (or omitted to use the ${DEFAULT_MAX_TASK_OUTPUT_BYTES}-byte default) \u2014 got ${config.maxTaskOutputBytes}. Pass Number.POSITIVE_INFINITY to explicitly disable the cap; 0 or a negative number is rejected rather than silently treated as "disabled".`
+      "DaemonConfig.piByokLauncher profileDbPath and sessionDir must be absolute paths"
     );
   }
-  const storeDir = DeviceStore.resolveDir(config.productId, config.storeDir);
-  const store = new DeviceStore(storeDir);
-  const operationalHealth = new OperationalHealthTracker(storeDir);
-  let fleetJitter;
-  let maintenanceSequence = 0;
-  const cursorStore = new CursorStore(storeDir);
-  const sessionWorkspaces = new SessionWorkspaceStore(storeDir);
-  const gitWorkspaceManager = config.gitWorkspace ? overrides.gitWorkspace?.manager ?? new GitWorkspaceManager(config.workspaceRoot, { ownerId: stableGitWorkspaceOwnerId(storeDir, config.productId) }) : void 0;
-  const gitWorkspaceStore = config.gitWorkspace ? overrides.gitWorkspace?.store ?? new GitWorkspaceStore(storeDir) : void 0;
-  let resolvedStoragePolicy;
-  if (config.hostedJournal) {
-    if (config.hostedJournal.mode !== "sqlite") {
-      throw new Error(`DaemonConfig.hostedJournal.mode must be "sqlite" \u2014 got ${JSON.stringify(config.hostedJournal.mode)}`);
-    }
-    if (typeof config.hostedJournal.tenantId !== "string" || config.hostedJournal.tenantId.trim() === "") {
-      throw new Error(
-        "DaemonConfig.hostedJournal.tenantId must be a non-empty tenant id \u2014 a hosted journal row with no tenant is durable evidence nobody can act on"
-      );
-    }
+  if (launcher.secretServicePrefix !== void 0 && (launcher.secretServicePrefix.trim().length === 0 || /[\u0000\r\n]/u.test(launcher.secretServicePrefix))) {
+    throw new Error(
+      "DaemonConfig.piByokLauncher.secretServicePrefix must be a non-empty single-line string"
+    );
+  }
+  const reserved = /* @__PURE__ */ new Set([
+    "--",
+    "--pi-bin",
+    "--profile-db",
+    "--session-dir",
+    "--secret-service-prefix",
+    "--provider",
+    "--model"
+  ]);
+  const conflicting = launcher.args?.find((arg) => reserved.has(arg));
+  if (conflicting !== void 0) {
+    throw new Error(
+      `DaemonConfig.piByokLauncher.args must not override reserved launcher argument ${conflicting}`
+    );
+  }
+  const invalidArg = launcher.args?.find((arg) => arg.length === 0 || /[\u0000\r\n]/u.test(arg));
+  if (invalidArg !== void 0) {
+    throw new Error("DaemonConfig.piByokLauncher.args must contain only non-empty single-line strings");
+  }
+}
+var MAX_LOCAL_MCP_TOOLSETS = 64;
+var MAX_LOCAL_MCP_SERVERS_PER_TOOLSET = 16;
+var MAX_LOCAL_MCP_ARGS = 64;
+var MAX_LOCAL_MCP_TOKEN_CHARS = 4096;
+function isNonEmptySingleLine(value) {
+  return typeof value === "string" && value.trim().length > 0 && value.length <= MAX_LOCAL_MCP_TOKEN_CHARS && !/[\u0000\r\n]/u.test(value);
+}
+function resolveMcpToolsets(configured) {
+  if (configured === void 0) return void 0;
+  if (configured === null || typeof configured !== "object" || Array.isArray(configured)) {
+    throw new Error("DaemonConfig.mcpToolsets must be an object keyed by logical toolset id");
+  }
+  const toolsetEntries = Object.entries(configured);
+  if (toolsetEntries.length > MAX_LOCAL_MCP_TOOLSETS) {
+    throw new Error(`DaemonConfig.mcpToolsets may contain at most ${MAX_LOCAL_MCP_TOOLSETS} toolsets`);
+  }
+  const resolved = /* @__PURE__ */ new Map();
+  for (const [toolsetId, rawToolset] of toolsetEntries) {
+    const parsedId = ToolsetIdSchema.safeParse(toolsetId);
+    if (!parsedId.success) {
+      throw new Error(`DaemonConfig.mcpToolsets contains invalid toolset id ${JSON.stringify(toolsetId)}`);
+    }
+    if (rawToolset === null || typeof rawToolset !== "object" || Array.isArray(rawToolset)) {
+      throw new Error(`DaemonConfig.mcpToolsets.${toolsetId} must be an object`);
+    }
+    const toolsetKeys = Object.keys(rawToolset);
+    if (toolsetKeys.some((key) => key !== "mcpServers")) {
+      throw new Error(`DaemonConfig.mcpToolsets.${toolsetId} accepts only the mcpServers field`);
+    }
+    const rawServers = rawToolset.mcpServers;
+    if (rawServers === null || typeof rawServers !== "object" || Array.isArray(rawServers)) {
+      throw new Error(`DaemonConfig.mcpToolsets.${toolsetId}.mcpServers must be an object`);
+    }
+    const serverEntries = Object.entries(rawServers);
+    if (serverEntries.length === 0 || serverEntries.length > MAX_LOCAL_MCP_SERVERS_PER_TOOLSET) {
+      throw new Error(
+        `DaemonConfig.mcpToolsets.${toolsetId}.mcpServers must contain 1-${MAX_LOCAL_MCP_SERVERS_PER_TOOLSET} servers`
+      );
+    }
+    const servers = {};
+    for (const [serverName, rawServer] of serverEntries) {
+      if (!ToolsetIdSchema.safeParse(serverName).success) {
+        throw new Error(
+          `DaemonConfig.mcpToolsets.${toolsetId}.mcpServers contains invalid server name ${JSON.stringify(serverName)}`
+        );
+      }
+      if (serverName === APPROVAL_MCP_SERVER_NAME) {
+        throw new Error(
+          `DaemonConfig.mcpToolsets.${toolsetId}.mcpServers.${serverName} uses a server name reserved by the daemon`
+        );
+      }
+      if (rawServer === null || typeof rawServer !== "object" || Array.isArray(rawServer)) {
+        throw new Error(`DaemonConfig.mcpToolsets.${toolsetId}.mcpServers.${serverName} must be an object`);
+      }
+      const serverKeys = Object.keys(rawServer);
+      if (serverKeys.some((key) => key !== "command" && key !== "args")) {
+        throw new Error(
+          `DaemonConfig.mcpToolsets.${toolsetId}.mcpServers.${serverName} accepts only command and args; env, headers, and remote task data are not supported`
+        );
+      }
+      const server = rawServer;
+      if (!isNonEmptySingleLine(server.command)) {
+        throw new Error(
+          `DaemonConfig.mcpToolsets.${toolsetId}.mcpServers.${serverName}.command must be a non-empty single-line string no longer than ${MAX_LOCAL_MCP_TOKEN_CHARS} characters`
+        );
+      }
+      if (server.args !== void 0 && !Array.isArray(server.args)) {
+        throw new Error(`DaemonConfig.mcpToolsets.${toolsetId}.mcpServers.${serverName}.args must be an array`);
+      }
+      const args = server.args ?? [];
+      if (args.length > MAX_LOCAL_MCP_ARGS || args.some((arg) => !isNonEmptySingleLine(arg))) {
+        throw new Error(
+          `DaemonConfig.mcpToolsets.${toolsetId}.mcpServers.${serverName}.args must contain at most ${MAX_LOCAL_MCP_ARGS} non-empty single-line strings`
+        );
+      }
+      servers[serverName] = Object.freeze({
+        command: server.command,
+        ...args.length > 0 ? { args: Object.freeze([...args]) } : {}
+      });
+    }
+    resolved.set(toolsetId, Object.freeze({ mcpServers: Object.freeze(servers) }));
+  }
+  return resolved;
+}
+function resolveDeviceAssertionAudiences(config) {
+  if (config === void 0) return void 0;
+  if (!Array.isArray(config.audiences)) {
+    throw new Error(
+      `DaemonConfig.deviceAssertion.audiences must be an array of exact audience strings \u2014 got ${JSON.stringify(config.audiences)}. Omit the deviceAssertion section (or pass an empty array) to leave the assertion broker disabled.`
+    );
+  }
+  if (config.audiences.length === 0) return void 0;
+  const audiences = /* @__PURE__ */ new Set();
+  for (const audience of config.audiences) {
+    if (typeof audience !== "string" || audience.length === 0) {
+      throw new Error(
+        `DaemonConfig.deviceAssertion.audiences entries must be non-empty strings \u2014 got ${JSON.stringify(audience)}`
+      );
+    }
+    if (Buffer.byteLength(audience, "utf8") > DEVICE_ASSERTION_AUDIENCE_MAX_BYTES) {
+      throw new Error(
+        `DaemonConfig.deviceAssertion.audiences entry ${JSON.stringify(audience)} exceeds ${DEVICE_ASSERTION_AUDIENCE_MAX_BYTES} UTF-8 bytes`
+      );
+    }
+    if (audiences.has(audience)) {
+      throw new Error(
+        `DaemonConfig.deviceAssertion.audiences contains ${JSON.stringify(audience)} twice \u2014 rejected rather than de-duplicated, because a duplicate is usually a copy-paste that hid a typo in the entry that was meant to be different`
+      );
+    }
+    audiences.add(audience);
+  }
+  return audiences;
+}
+function resolveDeviceAssertionTtlMs(config) {
+  const ttlMs = config?.ttlMs ?? DEVICE_ASSERTION_DEFAULT_TTL_MS;
+  if (!Number.isSafeInteger(ttlMs) || ttlMs <= 0 || ttlMs > DEVICE_ASSERTION_MAX_TTL_MS) {
+    throw new Error(
+      `DaemonConfig.deviceAssertion.ttlMs must be a positive integer no greater than ${DEVICE_ASSERTION_MAX_TTL_MS} ms \u2014 got ${JSON.stringify(config?.ttlMs)}`
+    );
+  }
+  return ttlMs;
+}
+function createDaemonWithAdapters(config, adapters, overrides = {}) {
+  return buildDaemonWithAdapters(config, adapters, overrides);
+}
+function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProbe) {
+  const mcpToolsets = resolveMcpToolsets(config.mcpToolsets);
+  if (config.piByokLauncher !== void 0) {
+    validatePiByokLauncherConfig(config.piByokLauncher);
+  }
+  if (config.maxTaskOutputBytes !== void 0 && !(config.maxTaskOutputBytes > 0)) {
+    throw new Error(
+      `DaemonConfig.maxTaskOutputBytes must be a positive number (or omitted to use the ${DEFAULT_MAX_TASK_OUTPUT_BYTES}-byte default) \u2014 got ${config.maxTaskOutputBytes}. Pass Number.POSITIVE_INFINITY to explicitly disable the cap; 0 or a negative number is rejected rather than silently treated as "disabled".`
+    );
+  }
+  const presenceCadence = {
+    intervalMs: config.presence?.intervalMs ?? DEFAULT_PRESENCE_HEARTBEAT_INTERVAL_MS,
+    ttlMs: config.presence?.ttlMs ?? DEFAULT_PRESENCE_TTL_MS,
+    minimumIntervalMs: config.presence?.minimumIntervalMs ?? DEFAULT_PRESENCE_MINIMUM_INTERVAL_MS
+  };
+  assertPresenceHeartbeatCadence(presenceCadence);
+  const deviceAssertionAudiences = resolveDeviceAssertionAudiences(config.deviceAssertion);
+  const deviceAssertionTtlMs = resolveDeviceAssertionTtlMs(config.deviceAssertion);
+  let shuttingDown = false;
+  const storeDir = DeviceStore.resolveDir(config.productId, config.storeDir);
+  const store = new DeviceStore(storeDir);
+  const operationalHealth = new OperationalHealthTracker(storeDir);
+  let fleetJitter;
+  let maintenanceSequence = 0;
+  const cursorStore = new CursorStore(storeDir);
+  const sessionWorkspaces = new SessionWorkspaceStore(storeDir);
+  const gitWorkspaceManager = config.gitWorkspace ? overrides.gitWorkspace?.manager ?? new GitWorkspaceManager(config.workspaceRoot, { ownerId: stableGitWorkspaceOwnerId(storeDir, config.productId) }) : void 0;
+  const gitWorkspaceStore = config.gitWorkspace ? overrides.gitWorkspace?.store ?? new GitWorkspaceStore(storeDir) : void 0;
+  let resolvedStoragePolicy;
+  if (config.hostedJournal) {
+    if (config.hostedJournal.mode !== "sqlite") {
+      throw new Error(`DaemonConfig.hostedJournal.mode must be "sqlite" \u2014 got ${JSON.stringify(config.hostedJournal.mode)}`);
+    }
+    if (typeof config.hostedJournal.tenantId !== "string" || config.hostedJournal.tenantId.trim() === "") {
+      throw new Error(
+        "DaemonConfig.hostedJournal.tenantId must be a non-empty tenant id \u2014 a hosted journal row with no tenant is durable evidence nobody can act on"
+      );
+    }
     if (config.hostedJournal.storagePolicy) {
       resolvedStoragePolicy = resolveLocalStoragePolicy(config.hostedJournal.storagePolicy);
     }
@@ -8603,6 +9384,9 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
   let runner;
   let controlServerHandle;
   let daemonOwnerLease;
+  let presencePublisher;
+  let presenceDiscovery;
+  let presenceDiscoveryInFlight = false;
   let shutdownPromise;
   const pendingLateMutationBarriers = /* @__PURE__ */ new Set();
   let startedAt;
@@ -8775,6 +9559,7 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
         deviceId: record.deviceId,
         // M5: see `DaemonConfig.runtimeEnvironment`'s own doc comment above.
         runtimeEnvironment: config.runtimeEnvironment,
+        ...mcpToolsets ? { mcpToolsets } : {},
         // M3-2a: `send` is already this file's OWN closure (not something
         // `TaskRunner` builds) — every `task.claim`/`task.started`/
         // `task.progress`/`task.artifact`/`task.await_approval`/
@@ -8814,6 +9599,11 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
         shutdownInterruptTimeoutMs: overrides.shutdown?.taskInterruptTimeoutMs,
         // M5 batch-3 (workstream 2): see DaemonConfig.maxTaskOutputBytes's own doc comment — already validated above.
         maxTaskOutputBytes: config.maxTaskOutputBytes,
+        // additive-minor (`task.complete.document`): passed through verbatim,
+        // absent when unconfigured — see `DaemonConfig.resultDocument`'s own
+        // doc comment. Spread rather than assigned so an unconfigured daemon
+        // builds the exact `deps` object it did before this seam existed.
+        ...config.resultDocument ? { resultDocument: config.resultDocument } : {},
         // M4 Phase 3 hardening: bridges TaskRunner's stale-approval-race
         // finding out to the SAME local observability seam every other
         // daemon-local event already uses (see observer.ts's own module doc
@@ -8889,8 +9679,10 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
           return runner?.handleEnvelope(envelope) ?? Promise.resolve();
         },
         onStateChange: (state) => {
+          const wasSettled = connectionState === "open" || connectionState === "degraded";
           connectionState = state;
           observer.noteConnectionState(state);
+          if (!wasSettled && (state === "open" || state === "degraded")) runPresenceDiscovery();
         },
         backoff: overrides.backoff,
         liveness: overrides.liveness,
@@ -8908,6 +9700,7 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
       });
       await connection.start();
       await connection.waitForAck();
+      startPresenceProducer();
     } catch (err) {
       try {
         await runShutdownSequence("startup failed", { drainTimeoutMs: 0 });
@@ -8917,7 +9710,41 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
       throw err;
     }
   }
+  function startPresenceProducer() {
+    presenceDiscovery = new AbortController();
+    runPresenceDiscovery();
+  }
+  function runPresenceDiscovery() {
+    const discovery = presenceDiscovery;
+    if (!discovery || presenceDiscoveryInFlight) return;
+    presenceDiscoveryInFlight = true;
+    void (async () => {
+      try {
+        const declaration = await fetchCapabilityDeclaration(config.serverUrl, { signal: discovery.signal });
+        if (discovery.signal.aborted) return;
+        if (declares(declaration, PRESENCE_HINTS_CAPABILITY)) {
+          presencePublisher ??= new PresencePublisher({
+            serverUrl: config.serverUrl,
+            auth,
+            ...presenceCadence,
+            onDegraded: (reason) => console.warn(`[byok/client] ${reason}`)
+          });
+          presencePublisher.start();
+        } else {
+          presencePublisher?.stop();
+        }
+      } catch (err) {
+        if (discovery.signal.aborted) return;
+        console.warn(
+          `[byok/client] capability discovery failed; presence publishing stays off until the next reconnect: ${err instanceof Error ? err.message : String(err)}`
+        );
+      } finally {
+        presenceDiscoveryInFlight = false;
+      }
+    })();
+  }
   async function runShutdownSequence(reason, opts = {}) {
+    shuttingDown = true;
     const errors = [];
     let mutationBarrierComplete = hostedStorageInitializationBarrierComplete;
     if (!hostedStorageInitializationBarrierComplete) {
@@ -8946,6 +9773,11 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
         errors.push(new Error("a prior active task teardown remains unsettled; ownership lease retained"));
       }
     }
+    presenceDiscovery?.abort();
+    presenceDiscovery = void 0;
+    presenceDiscoveryInFlight = false;
+    presencePublisher?.stop();
+    presencePublisher = void 0;
     const stoppingOwnedPressureEngine = ownedPressureEngine;
     const stoppingOwnedJournal = ownedJournal;
     const maintenanceStopped = stoppingOwnedPressureEngine?.stop() ?? Promise.resolve();
@@ -9006,6 +9838,7 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
     }
   }
   async function stop(opts = {}) {
+    shuttingDown = true;
     await requestShutdown(opts.reason ?? "operator", { drainTimeoutMs: opts.drainTimeoutMs });
   }
   function requestShutdown(reason, opts = {}) {
@@ -9018,6 +9851,7 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
     return current;
   }
   async function unpair() {
+    shuttingDown = true;
     await runLifecycleMutation(unpairUnderLease);
   }
   async function unpairUnderLease() {
@@ -9096,6 +9930,7 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
   }
   async function performControlShutdown(reason) {
     const effectiveReason = reason ?? "operator";
+    shuttingDown = true;
     observer.noteShutdownRequested(effectiveReason);
     try {
       await requestShutdown(`control socket shutdown (${effectiveReason})`);
@@ -9133,7 +9968,107 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
         if (!runner) throw new ControlError("not_found", "daemon is not started");
         return runner.requestApproval(parsed.taskId, parsed.summary);
       },
+      /**
+       * Plan `device-assertion-broker`: mint one short-lived, audience-scoped
+       * device assertion for a sibling local process.
+       *
+       * SIX fail-closed gates, in this exact order, none of which signs
+       * anything on the way out. The order is part of the contract, not an
+       * implementation detail:
+       *
+       * 1. `assertion_disabled` — before anything else, because a daemon that
+       *    was never configured for this must not reveal, by answering
+       *    differently for different inputs, that it even validates params.
+       * 2. `bad_request` — shape/length, checked before the allowlist so a
+       *    malformed request cannot be used to probe membership.
+       * 3. `audience_denied` — EXACT `Set.has`, never a prefix/suffix rule
+       *    (`salesko-api.evil.com` and `salesko-ap` both fail against an entry
+       *    of `salesko-api`). The message deliberately does not echo the
+       *    allowlist: a refusal must not be an enumeration oracle.
+       * 4. `shutting_down` — see `performControlShutdown`'s own comment for
+       *    the minting window this closes.
+       * 5. `revoked` — the server-side revocation this daemon already knows
+       *    about.
+       * 6. `not_paired` — the on-disk record, re-read on EVERY call (never
+       *    cached), so clearing `device.json` removes local signing authority
+       *    immediately.
+       *
+       * Only after all six does the private key get imported, used once, and
+       * dropped (`device-assertion-signer.ts`).
+       *
+       * Honest limit, and it must stay in the docs as well as here: gates 4-6
+       * are only HALF of revocation. They make this daemon stop minting
+       * promptly, but an assertion already in a caller's hands is not recalled
+       * by any of them. The other half is the host's own recheck at exchange
+       * time, which is why core's `verifyDeviceAssertion` makes the device
+       * row's `revoked` state a REQUIRED parameter. Nothing here entitles
+       * anyone to claim this daemon delivers synchronous invalidation on its
+       * own.
+       */
+      "assertion.issue": async (params) => {
+        if (deviceAssertionAudiences === void 0) {
+          observer.noteDeviceAssertion({ result: "denied", reason: "assertion_disabled" });
+          throw new ControlError(
+            "assertion_disabled",
+            "this daemon is not configured to issue device assertions (DaemonConfig.deviceAssertion.audiences is absent or empty)"
+          );
+        }
+        const parsed = parseAssertionIssueParams(params);
+        if (!parsed) {
+          const rawAudience = typeof params === "object" && params !== null && typeof params.audience === "string" ? params.audience : void 0;
+          observer.noteDeviceAssertion({ result: "denied", reason: "bad_request", audience: rawAudience });
+          throw new ControlError(
+            "bad_request",
+            `assertion.issue requires exactly {audience} where audience is a non-empty string of at most ${DEVICE_ASSERTION_AUDIENCE_MAX_BYTES} UTF-8 bytes`
+          );
+        }
+        if (!deviceAssertionAudiences.has(parsed.audience)) {
+          observer.noteDeviceAssertion({ result: "denied", reason: "audience_denied", audience: parsed.audience });
+          throw new ControlError("audience_denied", "the requested audience is not allowed by this daemon");
+        }
+        if (shuttingDown) {
+          observer.noteDeviceAssertion({ result: "denied", reason: "shutting_down", audience: parsed.audience });
+          throw new ControlError("shutting_down", "this daemon is shutting down and will not issue new assertions");
+        }
+        if (auth.isRevoked()) {
+          observer.noteDeviceAssertion({ result: "denied", reason: "revoked", audience: parsed.audience });
+          throw new ControlError("revoked", "this device has been revoked by the server; re-pair required");
+        }
+        const record = await store.load();
+        if (record === void 0) {
+          observer.noteDeviceAssertion({ result: "denied", reason: "not_paired", audience: parsed.audience });
+          throw new ControlError("not_paired", "this device is not paired; nothing can be asserted about it");
+        }
+        if (shuttingDown) {
+          observer.noteDeviceAssertion({ result: "denied", reason: "shutting_down", audience: parsed.audience });
+          throw new ControlError("shutting_down", "this daemon is shutting down and will not issue new assertions");
+        }
+        if (auth.isRevoked()) {
+          observer.noteDeviceAssertion({ result: "denied", reason: "revoked", audience: parsed.audience });
+          throw new ControlError("revoked", "this device has been revoked by the server; re-pair required");
+        }
+        const minted = mintDeviceAssertion({
+          record,
+          // `toHttpBase` is the one place a configured serverUrl is normalized
+          // (ws:->http:, wss:->https:, path stripped), so an operator who
+          // configured the websocket spelling and one who configured the HTTP
+          // spelling of the same deployment produce the same issuer.
+          issuer: new URL(toHttpBase(config.serverUrl)).origin,
+          productId: config.productId,
+          audience: parsed.audience,
+          ttlMs: deviceAssertionTtlMs,
+          now: /* @__PURE__ */ new Date()
+        });
+        observer.noteDeviceAssertion({
+          result: "issued",
+          audience: minted.claims.audience,
+          jti: minted.claims.jti,
+          expiresAt: minted.expiresAt
+        });
+        return { assertion: minted.envelope, expiresAt: minted.expiresAt };
+      },
       shutdown: (params) => {
+        shuttingDown = true;
         const { reason } = parseShutdownParams(params);
         setImmediate(() => {
           void performControlShutdown(reason).catch((err) => {
@@ -9178,7 +10113,275 @@ function createDaemonWithAdapters(config, adapters, overrides = {}) {
   return { pair, start, stop, status, subscribe, tasks, unpair, approve, reject };
 }
 function createDaemon(config) {
-  return createDaemonWithAdapters(config, buildDefaultAdapters(config.runtimeAllowlist));
+  return createDaemonWithAdapters(config, buildDefaultAdapters(config));
+}
+var MAX_CONTROL_TOKEN_BYTES = 256;
+function errorMessage4(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function sameFileState3(left, right) {
+  return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs;
+}
+async function readControlToken(tokenPath) {
+  let namedBefore;
+  try {
+    namedBefore = await promises.lstat(tokenPath, { bigint: true });
+  } catch (err) {
+    if (err.code === "ENOENT") return void 0;
+    throw err;
+  }
+  if (!namedBefore.isFile() || namedBefore.isSymbolicLink()) {
+    throw new Error("control token is not a real regular file");
+  }
+  const handle = await promises.open(
+    tokenPath,
+    constants.O_RDONLY | (constants.O_NONBLOCK ?? 0) | (constants.O_NOFOLLOW ?? 0)
+  );
+  try {
+    const opened = await handle.stat({ bigint: true });
+    const namedAfterOpen = await promises.lstat(tokenPath, { bigint: true });
+    if (!opened.isFile() || !namedAfterOpen.isFile() || namedAfterOpen.isSymbolicLink() || !sameFileState3(namedBefore, opened) || !sameFileState3(opened, namedAfterOpen)) {
+      throw new Error("control token pathname changed before safe open");
+    }
+    if (opened.size < 0 || opened.size > BigInt(MAX_CONTROL_TOKEN_BYTES)) {
+      throw new Error("control token exceeds the bounded read limit");
+    }
+    const size = Number(opened.size);
+    const bytes = Buffer.alloc(size);
+    const { bytesRead } = await handle.read(bytes, 0, size, 0);
+    const afterRead = await handle.stat({ bigint: true });
+    const namedAfterRead = await promises.lstat(tokenPath, { bigint: true });
+    if (bytesRead !== size || namedAfterRead.isSymbolicLink() || !sameFileState3(opened, afterRead) || !sameFileState3(afterRead, namedAfterRead)) {
+      throw new Error("control token changed during bounded read");
+    }
+    return bytes.toString("utf8").trim();
+  } finally {
+    await handle.close();
+  }
+}
+async function connectControlClient(opts) {
+  const tokenPath = controlTokenPath(opts.storeDir);
+  let token;
+  try {
+    const read = await readControlToken(tokenPath);
+    if (read === void 0) {
+      return { ok: false, reason: "daemon is not running (no control.token found)" };
+    }
+    token = read;
+  } catch (err) {
+    return { ok: false, reason: `could not read the control token: ${errorMessage4(err)}` };
+  }
+  if (!token) {
+    return { ok: false, reason: "control token file is empty" };
+  }
+  const endpoint = controlEndpointPath(opts.productId, opts.storeDir);
+  try {
+    const client = await connectAndHandshake(endpoint, token, opts);
+    return { ok: true, client };
+  } catch (err) {
+    return { ok: false, reason: `daemon control socket not reachable: ${errorMessage4(err)}` };
+  }
+}
+function connectAndHandshake(endpoint, token, opts) {
+  return new Promise((resolve, reject) => {
+    const socket = net.createConnection(endpoint);
+    const reader = new NdjsonLineReader();
+    let phase = "server-hello";
+    let settled = false;
+    const clientNonce = randomNonceHex();
+    const timer = setTimeout(() => {
+      fail(new Error("handshake timed out"));
+    }, opts.handshakeTimeoutMs ?? HANDSHAKE_TIMEOUT_MS);
+    timer.unref?.();
+    function fail(err) {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.removeAllListeners();
+      socket.destroy();
+      reject(err instanceof Error ? err : new Error(String(err)));
+    }
+    function succeed() {
+      settled = true;
+      clearTimeout(timer);
+      socket.removeListener("error", onError);
+      socket.removeListener("data", onData);
+      resolve(createControlClient(socket, reader, opts));
+    }
+    function onData(chunk) {
+      let lines;
+      try {
+        lines = reader.push(chunk);
+      } catch (err) {
+        fail(err);
+        return;
+      }
+      for (const line of lines) {
+        let parsed;
+        try {
+          parsed = JSON.parse(line);
+        } catch {
+          fail(new Error("malformed handshake frame"));
+          return;
+        }
+        if (phase === "server-hello") {
+          const hello = parseServerHello(parsed);
+          if (!hello) {
+            fail(new Error("malformed or unexpected server hello"));
+            return;
+          }
+          if (!timingSafeEqualHex(hello.proof, computeServerProof(token, clientNonce))) {
+            fail(new Error("server failed to prove it holds the control token"));
+            return;
+          }
+          socket.write(encodeFrame({ v: CONTROL_PROTOCOL_VERSION, auth: computeClientAuth(token, hello.nonce) }));
+          phase = "ready";
+          continue;
+        }
+        if (!parseServerReady(parsed)) {
+          fail(new Error("server did not confirm readiness"));
+          return;
+        }
+        succeed();
+        return;
+      }
+    }
+    function onError(err) {
+      fail(err);
+    }
+    socket.once("error", onError);
+    socket.once("connect", () => {
+      socket.write(encodeFrame({ v: CONTROL_PROTOCOL_VERSION, hello: "client", nonce: clientNonce }));
+      socket.on("data", onData);
+    });
+  });
+}
+function withTimeout(promise, ms, message) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error(message)), ms);
+    timer.unref?.();
+    promise.then(
+      (value) => {
+        clearTimeout(timer);
+        resolve(value);
+      },
+      (err) => {
+        clearTimeout(timer);
+        reject(err);
+      }
+    );
+  });
+}
+function createControlClient(socket, reader, opts) {
+  const pending = /* @__PURE__ */ new Map();
+  let idSeq = 0;
+  let closed = false;
+  function handleFrame(parsed) {
+    if (!isRecord2(parsed) || typeof parsed.id !== "string") return;
+    const entry = pending.get(parsed.id);
+    if (!entry) return;
+    if ("event" in parsed) {
+      entry.onEvent?.(parsed.event);
+      return;
+    }
+    if (parsed.ok === true) {
+      pending.delete(parsed.id);
+      entry.resolve(parsed.done === true ? void 0 : parsed.result);
+      return;
+    }
+    pending.delete(parsed.id);
+    const shape = parsed.error;
+    entry.reject(
+      new ControlError(
+        typeof shape?.code === "string" ? shape.code : "internal_error",
+        typeof shape?.message === "string" ? shape.message : "unknown control error"
+      )
+    );
+  }
+  socket.on("data", (chunk) => {
+    let lines;
+    try {
+      lines = reader.push(chunk);
+    } catch {
+      socket.destroy();
+      return;
+    }
+    for (const line of lines) {
+      let parsed;
+      try {
+        parsed = JSON.parse(line);
+      } catch {
+        continue;
+      }
+      handleFrame(parsed);
+    }
+  });
+  socket.on("close", () => {
+    closed = true;
+    for (const entry of pending.values()) entry.reject(new Error("control connection closed"));
+    pending.clear();
+  });
+  socket.on("error", () => {
+  });
+  function send(method, params, onEvent) {
+    const id = `c${++idSeq}`;
+    const promise = new Promise((resolve, reject) => {
+      pending.set(id, { resolve, reject, onEvent });
+    });
+    socket.write(encodeFrame({ v: CONTROL_PROTOCOL_VERSION, id, method, params }));
+    return { id, promise };
+  }
+  return {
+    async request(method, params) {
+      if (closed) throw new Error("control connection is closed");
+      const { promise } = send(method, params);
+      const result = await withTimeout(promise, opts.requestTimeoutMs ?? 1e4, `control request "${method}" timed out`);
+      return result;
+    },
+    subscribe(method, params, onEvent) {
+      const { id, promise } = send(method, params, onEvent);
+      promise.catch(() => {
+      });
+      return {
+        close: () => {
+          pending.delete(id);
+          socket.destroy();
+        }
+      };
+    },
+    close() {
+      socket.destroy();
+    }
+  };
+}
+
+// src/daemon/assertion-client.ts
+function errorMessage5(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+async function requestDeviceAssertion(options) {
+  const storeDir = DeviceStore.resolveDir(options.productId, options.storeDir);
+  const connected = await connectControlClient({
+    storeDir,
+    productId: options.productId,
+    ...options.timeoutMs === void 0 ? {} : { requestTimeoutMs: options.timeoutMs }
+  });
+  if (!connected.ok) return { ok: false, code: "unavailable", reason: connected.reason };
+  try {
+    const result = await connected.client.request("assertion.issue", {
+      audience: options.audience
+    });
+    if (result === null || typeof result !== "object" || typeof result.expiresAt !== "string") {
+      return { ok: false, code: "bad_response", reason: "daemon returned a malformed assertion.issue result" };
+    }
+    const assertion = parseDeviceAssertionEnvelope(result.assertion);
+    return { ok: true, assertion, expiresAt: result.expiresAt };
+  } catch (err) {
+    if (err instanceof ControlError) return { ok: false, code: err.code, reason: err.message };
+    return { ok: false, code: "bad_response", reason: errorMessage5(err) };
+  } finally {
+    connected.client.close();
+  }
 }
 var StoredDeviceProofSigner = class {
   constructor(options) {
@@ -9237,9 +10440,359 @@ function requireNonEmpty(name, value) {
 function sha256(bytes) {
   return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
 }
+var SKILL_PACKS_CAPABILITY = "skills.pack";
+var SKILL_PACKS_DIRNAME = "skill-packs";
+var SKILL_PACK_LOCK_FILENAME = "lock.json";
+var SKILL_PACK_AUDIT_FILENAME = "audit.jsonl";
+var SKILL_PACK_LOCK_SCHEMA = "byok-skill-pack-lock-v1";
+var DIR_MODE = 448;
+var FILE_MODE = 384;
+var SKILL_PACK_RESPONSE_MAX_BYTES = SKILL_PACK_MAX_BYTES * 2;
+var SKILL_PACK_INSTALL_ERROR_CODES = [
+  "capability_unavailable",
+  "transport_failed",
+  "response_invalid",
+  "response_too_large",
+  "manifest_invalid",
+  "content_rejected",
+  "store_unsafe"
+];
+var SkillPackInstallError = class extends Error {
+  code;
+  packName;
+  constructor(code, message, options = {}) {
+    super(message, options.cause === void 0 ? void 0 : { cause: options.cause });
+    this.name = "SkillPackInstallError";
+    this.code = code;
+    this.packName = options.packName;
+  }
+};
+function hashBytes(bytes) {
+  return contentHash(`sha256:${createHash("sha256").update(bytes).digest("hex")}`);
+}
+function originOf(serverUrl) {
+  return new URL(toHttpBase(serverUrl)).origin;
+}
+async function readBoundedJson(response, what) {
+  const declaredLength = response.headers.get("content-length");
+  if (declaredLength !== null) {
+    const parsed = Number(declaredLength);
+    if (Number.isSafeInteger(parsed) && parsed > SKILL_PACK_RESPONSE_MAX_BYTES) {
+      throw new SkillPackInstallError(
+        "response_too_large",
+        `${what} declared ${parsed} bytes, over the ${SKILL_PACK_RESPONSE_MAX_BYTES} byte response limit.`
+      );
+    }
+  }
+  const bytes = new Uint8Array(await response.arrayBuffer());
+  if (bytes.byteLength > SKILL_PACK_RESPONSE_MAX_BYTES) {
+    throw new SkillPackInstallError(
+      "response_too_large",
+      `${what} delivered ${bytes.byteLength} bytes, over the ${SKILL_PACK_RESPONSE_MAX_BYTES} byte response limit.`
+    );
+  }
+  try {
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  } catch (cause) {
+    throw new SkillPackInstallError("response_invalid", `${what} is not valid JSON.`, { cause });
+  }
+}
+async function getJson(url, auth, signal, what) {
+  let response;
+  try {
+    response = await authedFetch(url, { method: "GET", ...signal === void 0 ? {} : { signal } }, auth);
+  } catch (cause) {
+    throw new SkillPackInstallError("transport_failed", `${what} could not be fetched from ${url.toString()}.`, {
+      cause
+    });
+  }
+  if (!response.ok) {
+    throw new SkillPackInstallError("transport_failed", `${what} answered HTTP ${response.status}.`);
+  }
+  return readBoundedJson(response, what);
+}
+function skillPacksRoot(dataDir) {
+  return path17.join(dataDir, SKILL_PACKS_DIRNAME);
+}
+function resolveInside(baseDir, relative) {
+  if (!isSkillPackPathSafe(relative)) {
+    throw new SkillPackInstallError("store_unsafe", `${JSON.stringify(relative)} is not a safe pack-relative path.`);
+  }
+  const resolved = path17.resolve(baseDir, relative);
+  const prefix = path17.resolve(baseDir) + path17.sep;
+  if (!resolved.startsWith(prefix)) {
+    throw new SkillPackInstallError(
+      "store_unsafe",
+      `${JSON.stringify(relative)} resolves outside ${baseDir}.`
+    );
+  }
+  return resolved;
+}
+async function assertNotSymlink(target) {
+  let stats;
+  try {
+    stats = await promises.lstat(target);
+  } catch (err) {
+    if (err.code === "ENOENT") return;
+    throw err;
+  }
+  if (stats.isSymbolicLink()) {
+    throw new SkillPackInstallError("store_unsafe", `${target} is a symbolic link; refusing to follow it.`);
+  }
+}
+async function appendAuditLine(dataDir, record) {
+  const root = skillPacksRoot(dataDir);
+  await promises.mkdir(root, { recursive: true, mode: DIR_MODE });
+  await promises.chmod(root, DIR_MODE).catch(() => {
+  });
+  const filePath = path17.join(root, SKILL_PACK_AUDIT_FILENAME);
+  const handle = await promises.open(filePath, "a", FILE_MODE);
+  try {
+    await handle.chmod(FILE_MODE);
+    await handle.appendFile(`${JSON.stringify(record)}
+`, "utf8");
+  } finally {
+    await handle.close();
+  }
+}
+async function installSkillPacks(options) {
+  if (!hasCapability(options.declaration, SKILL_PACKS_CAPABILITY)) {
+    throw new SkillPackInstallError(
+      "capability_unavailable",
+      `This deployment does not declare ${SKILL_PACKS_CAPABILITY}; refusing to fetch skill packs.`
+    );
+  }
+  const base = toHttpBase(options.serverUrl);
+  const source = originOf(options.serverUrl);
+  const body = await getJson(
+    new URL(BYOK_SKILL_PACKS_PATH, base),
+    options.auth,
+    options.signal,
+    "the skill pack manifest list"
+  );
+  const rawPacks = body?.packs;
+  if (!Array.isArray(rawPacks)) {
+    throw new SkillPackInstallError("response_invalid", "the skill pack manifest list has no `packs` array.");
+  }
+  const installed = [];
+  const unchanged = [];
+  for (const raw of rawPacks) {
+    const manifest = parseManifest(raw);
+    const existing = await readLock(options.dataDir, manifest.name);
+    if (existing?.lock.content_hash === manifest.contentHash) {
+      unchanged.push(manifest.name);
+      continue;
+    }
+    installed.push(await installOne(options, manifest, source, base));
+  }
+  return { installed, unchanged };
+}
+function parseManifest(raw) {
+  let manifest;
+  try {
+    manifest = parseSkillPackManifest(raw);
+  } catch (cause) {
+    throw new SkillPackInstallError("manifest_invalid", "a published skill pack manifest is not valid.", { cause });
+  }
+  const structural = checkSkillPackManifest(manifest);
+  if (!structural.ok) {
+    throw new SkillPackInstallError(
+      "manifest_invalid",
+      `skill pack ${JSON.stringify(manifest.name)} was refused: ${structural.reason} \u2014 ${structural.detail}`,
+      { packName: manifest.name }
+    );
+  }
+  return manifest;
+}
+async function installOne(options, manifest, source, base) {
+  const refuse = async (code, message) => {
+    await appendAuditLine(options.dataDir, {
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      event: "skill-pack-rejected",
+      name: manifest.name,
+      contentHash: manifest.contentHash,
+      source,
+      code,
+      reason: message
+    });
+    throw new SkillPackInstallError(code, message, { packName: manifest.name });
+  };
+  const expectedPackHash = hashBytes(new TextEncoder().encode(skillPackContentHashInput(manifest)));
+  if (expectedPackHash !== manifest.contentHash) {
+    await refuse(
+      "manifest_invalid",
+      `skill pack ${JSON.stringify(manifest.name)} declares ${manifest.contentHash} but its file rows address ${expectedPackHash}.`
+    );
+  }
+  const bodies = /* @__PURE__ */ new Map();
+  let totalBytes = 0;
+  for (const declared of manifest.files) {
+    const url = new URL(byokSkillPackFilePath(manifest.name, declared.path), base);
+    const raw = await getJson(url, options.auth, options.signal, `skill pack file ${JSON.stringify(declared.path)}`);
+    const content = raw?.content;
+    if (typeof content !== "string") {
+      await refuse("response_invalid", `skill pack file ${JSON.stringify(declared.path)} carried no string content.`);
+    }
+    const bytes = new TextEncoder().encode(content);
+    const check = checkSkillPackFileContent(declared, {
+      byteSize: bytes.byteLength,
+      contentHash: hashBytes(bytes)
+    });
+    if (!check.ok) {
+      await refuse("content_rejected", `skill pack ${JSON.stringify(manifest.name)}: ${check.reason} \u2014 ${check.detail}`);
+    }
+    totalBytes += bytes.byteLength;
+    bodies.set(declared.path, content);
+  }
+  const entryText = bodies.get(SKILL_PACK_ENTRY_PATH);
+  if (entryText === void 0) {
+    await refuse("content_rejected", `skill pack ${JSON.stringify(manifest.name)}: entry-missing \u2014 ${SKILL_PACK_ENTRY_PATH} was not delivered.`);
+  }
+  let entryCheck;
+  try {
+    entryCheck = checkSkillPackEntry(manifest, entryText);
+  } catch (cause) {
+    await refuse(
+      "content_rejected",
+      `skill pack ${JSON.stringify(manifest.name)}: ${SKILL_PACK_ENTRY_PATH} frontmatter was refused (${cause instanceof Error ? cause.message : String(cause)}).`
+    );
+  }
+  if (!entryCheck.ok) {
+    await refuse("content_rejected", `skill pack ${JSON.stringify(manifest.name)}: ${entryCheck.reason} \u2014 ${entryCheck.detail}`);
+  }
+  const packRoot = path17.join(skillPacksRoot(options.dataDir), manifest.name);
+  const revisionDir = path17.join(packRoot, manifest.contentHash.slice("sha256:".length));
+  await promises.mkdir(revisionDir, { recursive: true, mode: DIR_MODE });
+  for (const [relative, content] of bodies) {
+    const target = resolveInside(revisionDir, relative);
+    await promises.mkdir(path17.dirname(target), { recursive: true, mode: DIR_MODE });
+    await assertNotSymlink(target);
+    await atomicWriteFile(target, content, { mode: FILE_MODE });
+  }
+  const lock = {
+    schema: SKILL_PACK_LOCK_SCHEMA,
+    name: manifest.name,
+    version: manifest.version,
+    description: manifest.description,
+    content_hash: manifest.contentHash,
+    source,
+    installed_at: (/* @__PURE__ */ new Date()).toISOString(),
+    files: manifest.files.map((file) => ({
+      path: file.path,
+      sha256: file.contentHash,
+      bytes: file.byteSize
+    }))
+  };
+  await atomicWriteFile(path17.join(packRoot, SKILL_PACK_LOCK_FILENAME), `${JSON.stringify(lock, null, 2)}
+`, {
+    mode: FILE_MODE
+  });
+  await appendAuditLine(options.dataDir, {
+    ts: lock.installed_at,
+    event: "skill-pack-installed",
+    name: lock.name,
+    version: lock.version,
+    contentHash: lock.content_hash,
+    source: lock.source,
+    files: lock.files.length,
+    bytes: totalBytes
+  });
+  return { name: manifest.name, lock, directory: revisionDir };
+}
+function isLockShaped(value) {
+  const lock = value;
+  return lock !== null && typeof lock === "object" && lock.schema === SKILL_PACK_LOCK_SCHEMA && typeof lock.name === "string" && typeof lock.content_hash === "string" && CONTENT_HASH_PATTERN.test(lock.content_hash) && Array.isArray(lock.files);
+}
+async function readLock(dataDir, name) {
+  if (!isSkillPackPathSafe(name)) return void 0;
+  const packRoot = path17.join(skillPacksRoot(dataDir), name);
+  let raw;
+  try {
+    raw = await promises.readFile(path17.join(packRoot, SKILL_PACK_LOCK_FILENAME), "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return void 0;
+    throw err;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+  if (!isLockShaped(parsed) || parsed.name !== name) return void 0;
+  return {
+    name,
+    lock: parsed,
+    directory: path17.join(packRoot, parsed.content_hash.slice("sha256:".length))
+  };
+}
+async function listInstalledSkillPacks(dataDir) {
+  let entries;
+  try {
+    entries = await promises.readdir(skillPacksRoot(dataDir), { withFileTypes: true });
+  } catch (err) {
+    if (err.code === "ENOENT") return [];
+    throw err;
+  }
+  const packs = [];
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const installed = await readLock(dataDir, entry.name);
+    if (installed !== void 0) packs.push(installed);
+  }
+  packs.sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
+  return packs;
+}
+async function projectSkillPack(dataDir, name, targetDir) {
+  const installed = await readLock(dataDir, name);
+  if (installed === void 0) {
+    throw new SkillPackInstallError("store_unsafe", `no installed skill pack named ${JSON.stringify(name)}.`, {
+      packName: name
+    });
+  }
+  const copied = [];
+  for (const file of installed.lock.files) {
+    const sourcePath = resolveInside(installed.directory, file.path);
+    await assertNotSymlink(sourcePath);
+    let bytes;
+    try {
+      bytes = await promises.readFile(sourcePath);
+    } catch (cause) {
+      throw new SkillPackInstallError(
+        "store_unsafe",
+        `installed skill pack ${JSON.stringify(name)} is missing ${JSON.stringify(file.path)}.`,
+        { cause, packName: name }
+      );
+    }
+    if (hashBytes(bytes) !== file.sha256 || bytes.byteLength !== file.bytes) {
+      throw new SkillPackInstallError(
+        "store_unsafe",
+        `installed skill pack ${JSON.stringify(name)} no longer matches its lock at ${JSON.stringify(file.path)}.`,
+        { packName: name }
+      );
+    }
+    const destination = resolveInside(targetDir, file.path);
+    await promises.mkdir(path17.dirname(destination), { recursive: true, mode: DIR_MODE });
+    await assertNotSymlink(destination);
+    await atomicWriteFile(destination, bytes, { mode: FILE_MODE });
+    copied.push(file.path);
+  }
+  await appendAuditLine(dataDir, {
+    ts: (/* @__PURE__ */ new Date()).toISOString(),
+    event: "skill-pack-projected",
+    name: installed.name,
+    contentHash: installed.lock.content_hash,
+    files: copied.length
+  });
+  return {
+    name: installed.name,
+    contentHash: installed.lock.content_hash,
+    targetDir: path17.resolve(targetDir),
+    files: copied
+  };
+}
 var EMPTY_BODY = new Uint8Array();
 var LARGE_SNAPSHOT_THRESHOLD_BYTES = 1024 * 1024;
-var DEVICE_PROOF_HEADER = "x-byok-device-proof";
 var TruthMemoryClientError = class extends Error {
   constructor(code, message, status) {
     super(message);
@@ -9266,8 +10819,8 @@ var TruthMemoryClient = class {
   #requestId;
   #allowedObjectDownloadOrigins;
   async listManifest(query = {}) {
-    const path20 = manifestPath(query);
-    const response = await this.#proofFetch(path20, {
+    const path21 = manifestPath(query);
+    const response = await this.#proofFetch(path21, {
       method: "GET",
       operation: "truth.list",
       resource: "records",
@@ -9374,9 +10927,9 @@ var TruthMemoryClient = class {
   }
   async #write(kind, recordKey, requestId, payload, expectedPrimary, expectedSnapshots) {
     assertDistinctExpectedWrites([expectedPrimary, ...expectedSnapshots]);
-    const path20 = recordPath(kind, recordKey);
+    const path21 = recordPath(kind, recordKey);
     const body = new TextEncoder().encode(JSON.stringify(payload));
-    const response = await this.#proofFetch(path20, {
+    const response = await this.#proofFetch(path21, {
       method: "PUT",
       operation: "truth.write",
       resource: `${kind}/${recordKey}`,
@@ -9402,8 +10955,8 @@ var TruthMemoryClient = class {
     };
   }
   async #readVerified(listed) {
-    const path20 = recordPath(listed.kind, listed.recordKey);
-    const response = await this.#proofFetch(path20, {
+    const path21 = recordPath(listed.kind, listed.recordKey);
+    const response = await this.#proofFetch(path21, {
       method: "GET",
       operation: "truth.read",
       resource: `${listed.kind}/${listed.recordKey}`,
@@ -9464,16 +11017,16 @@ var TruthMemoryClient = class {
     }
     return { ...listed, bytes };
   }
-  async #proofFetch(path20, request) {
+  async #proofFetch(path21, request) {
     const proof = await this.options.signer.sign({
       method: request.method,
-      path: path20,
+      path: path21,
       operation: request.operation,
       resource: request.resource,
       requestId: request.requestId,
       body: request.body
     });
-    const response = await this.#fetch(new URL(path20, this.#base), {
+    const response = await this.#fetch(new URL(path21, this.#base), {
       method: request.method,
       headers: {
         ...request.headers,
@@ -9484,7 +11037,7 @@ var TruthMemoryClient = class {
     if (!response.ok) {
       throw new TruthMemoryClientError(
         "truth_http_failed",
-        `truth request ${request.method} ${path20} failed with HTTP ${response.status}`,
+        `truth request ${request.method} ${path21} failed with HTTP ${response.status}`,
         response.status
       );
     }
@@ -9497,10 +11050,10 @@ function manifestPath(query) {
   if (query.keyPrefix !== void 0) search.set("prefix", query.keyPrefix);
   if (query.limit !== void 0) search.set("limit", String(query.limit));
   const encoded = search.toString();
-  return encoded.length === 0 ? "/byok/records" : `/byok/records?${encoded}`;
+  return encoded.length === 0 ? BYOK_RECORDS_PATH : `${BYOK_RECORDS_PATH}?${encoded}`;
 }
 function recordPath(kind, recordKey) {
-  return `/byok/records/${encodeURIComponent(kind)}/${encodeURIComponent(recordKey)}`;
+  return byokRecordPath(kind, recordKey);
 }
 function prepareTransportBody(body) {
   if (body.kind === "inline") {
@@ -9742,9 +11295,9 @@ function plistString(value) {
 function generateLaunchdPlist(def) {
   const { label, program, logDir } = def;
   const args = [program.command, ...program.args];
-  const cwd = program.cwd ?? os6.homedir();
-  const outLog = path16.join(logDir, `${label}.out.log`);
-  const errLog = path16.join(logDir, `${label}.err.log`);
+  const cwd = program.cwd ?? os5.homedir();
+  const outLog = path17.join(logDir, `${label}.out.log`);
+  const errLog = path17.join(logDir, `${label}.err.log`);
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -9776,8 +11329,8 @@ ${args.map((a) => `    ${plistString(a)}`).join("\n")}
 }
 function createLaunchdLifecycle(def, deps = {}) {
   const run = deps.run ?? defaultRunner;
-  const fs15 = deps.fs ?? promises;
-  const homedir = deps.homedir ?? (() => os6.homedir());
+  const fs17 = deps.fs ?? promises;
+  const homedir = deps.homedir ?? (() => os5.homedir());
   const getuid = deps.getuid ?? (() => {
     if (typeof process.getuid !== "function") {
       throw new Error("launchd lifecycle requires a POSIX uid (process.getuid unavailable) \u2014 this module only runs on macOS");
@@ -9785,12 +11338,12 @@ function createLaunchdLifecycle(def, deps = {}) {
     return process.getuid();
   });
   const label = sanitizeServiceName(def.name);
-  const plistPath = () => path16.join(homedir(), "Library", "LaunchAgents", `${label}.plist`);
+  const plistPath = () => path17.join(homedir(), "Library", "LaunchAgents", `${label}.plist`);
   const domainTarget = () => `gui/${getuid()}`;
   const serviceTarget = () => `${domainTarget()}/${label}`;
   async function fileExists(p) {
     try {
-      await fs15.stat(p);
+      await fs17.stat(p);
       return true;
     } catch {
       return false;
@@ -9798,9 +11351,9 @@ function createLaunchdLifecycle(def, deps = {}) {
   }
   async function writePlist(program) {
     const xml = generateLaunchdPlist({ label, program, logDir: def.logDir });
-    await fs15.mkdir(path16.dirname(plistPath()), { recursive: true });
-    await fs15.mkdir(def.logDir, { recursive: true });
-    await fs15.writeFile(plistPath(), xml, "utf8");
+    await fs17.mkdir(path17.dirname(plistPath()), { recursive: true });
+    await fs17.mkdir(def.logDir, { recursive: true });
+    await fs17.writeFile(plistPath(), xml, "utf8");
   }
   async function install(opts = {}) {
     await writePlist(opts.program ?? def.program);
@@ -9811,7 +11364,7 @@ function createLaunchdLifecycle(def, deps = {}) {
   }
   async function uninstall() {
     await runIdempotent(run, "launchctl", ["bootout", serviceTarget()], "launchctl bootout", LAUNCHD_NOT_LOADED);
-    await fs15.rm(plistPath(), { force: true });
+    await fs17.rm(plistPath(), { force: true });
   }
   async function start() {
     if (!await fileExists(plistPath())) {
@@ -9870,10 +11423,10 @@ function generateSystemdUnit(def) {
   const { name, displayName, program, logDir } = def;
   assertNoControlChars(name, "name");
   assertNoControlChars(displayName, "displayName");
-  const cwd = program.cwd ?? os6.homedir();
+  const cwd = program.cwd ?? os5.homedir();
   assertNoControlChars(cwd, "program.cwd");
-  const outLog = path16.join(logDir, `${name}.out.log`);
-  const errLog = path16.join(logDir, `${name}.err.log`);
+  const outLog = path17.join(logDir, `${name}.out.log`);
+  const errLog = path17.join(logDir, `${name}.err.log`);
   assertNoControlChars(outLog, "logDir");
   assertNoControlChars(errLog, "logDir");
   const execStart = [program.command, ...program.args].map(quoteSystemdArg).join(" ");
@@ -9895,14 +11448,14 @@ WantedBy=default.target
 }
 function createSystemdLifecycle(def, deps = {}) {
   const run = deps.run ?? defaultRunner;
-  const fs15 = deps.fs ?? promises;
-  const homedir = deps.homedir ?? (() => os6.homedir());
+  const fs17 = deps.fs ?? promises;
+  const homedir = deps.homedir ?? (() => os5.homedir());
   const name = sanitizeServiceName(def.name);
   const unitName = `${name}.service`;
-  const unitPath = () => path16.join(homedir(), ".config", "systemd", "user", unitName);
+  const unitPath = () => path17.join(homedir(), ".config", "systemd", "user", unitName);
   async function fileExists(p) {
     try {
-      await fs15.stat(p);
+      await fs17.stat(p);
       return true;
     } catch {
       return false;
@@ -9910,9 +11463,9 @@ function createSystemdLifecycle(def, deps = {}) {
   }
   async function writeUnit(program) {
     const unit = generateSystemdUnit({ name, displayName: def.displayName ?? def.name, program, logDir: def.logDir });
-    await fs15.mkdir(path16.dirname(unitPath()), { recursive: true });
-    await fs15.mkdir(def.logDir, { recursive: true });
-    await fs15.writeFile(unitPath(), unit, "utf8");
+    await fs17.mkdir(path17.dirname(unitPath()), { recursive: true });
+    await fs17.mkdir(def.logDir, { recursive: true });
+    await fs17.writeFile(unitPath(), unit, "utf8");
   }
   async function install(opts = {}) {
     await writeUnit(opts.program ?? def.program);
@@ -9921,7 +11474,7 @@ function createSystemdLifecycle(def, deps = {}) {
   }
   async function uninstall() {
     await runIdempotent(run, "systemctl", ["--user", "disable", "--now", unitName], "systemctl disable --now", SYSTEMD_NOT_LOADED);
-    await fs15.rm(unitPath(), { force: true });
+    await fs17.rm(unitPath(), { force: true });
     await run("systemctl", ["--user", "daemon-reload"]);
   }
   async function start() {
@@ -9984,7 +11537,7 @@ ${argXml}${cwdXml}
 }
 function createWinswLifecycle(def, deps = {}) {
   const run = deps.run ?? defaultRunner;
-  const fs15 = deps.fs ?? promises;
+  const fs17 = deps.fs ?? promises;
   const windows = def.windows;
   if (!windows) {
     throw new Error("WinSW service lifecycle requires `ServiceDefinition.windows.winswBin` (the product-bundled WinSW executable path)");
@@ -9992,11 +11545,11 @@ function createWinswLifecycle(def, deps = {}) {
   const winswBin = windows.winswBin;
   const id = sanitizeServiceName(def.name);
   const installDir = windows.installDir ?? def.logDir;
-  const exePath = path16.join(installDir, `${id}.exe`);
-  const xmlPath = path16.join(installDir, `${id}.xml`);
+  const exePath = path17.join(installDir, `${id}.exe`);
+  const xmlPath = path17.join(installDir, `${id}.xml`);
   async function fileExists(p) {
     try {
-      await fs15.stat(p);
+      await fs17.stat(p);
       return true;
     } catch {
       return false;
@@ -10004,10 +11557,10 @@ function createWinswLifecycle(def, deps = {}) {
   }
   async function writeFiles(program) {
     const xml = generateWinswXml({ id, displayName: def.displayName ?? def.name, program, logDir: def.logDir });
-    await fs15.mkdir(installDir, { recursive: true });
-    await fs15.mkdir(def.logDir, { recursive: true });
-    await fs15.copyFile(winswBin, exePath);
-    await fs15.writeFile(xmlPath, xml, "utf8");
+    await fs17.mkdir(installDir, { recursive: true });
+    await fs17.mkdir(def.logDir, { recursive: true });
+    await fs17.copyFile(winswBin, exePath);
+    await fs17.writeFile(xmlPath, xml, "utf8");
   }
   async function install(opts = {}) {
     await writeFiles(opts.program ?? def.program);
@@ -10017,8 +11570,8 @@ function createWinswLifecycle(def, deps = {}) {
   async function uninstall() {
     await runIdempotent(run, exePath, ["stop"], "winsw stop", WINSW_NOT_INSTALLED);
     await runIdempotent(run, exePath, ["uninstall"], "winsw uninstall", WINSW_NOT_INSTALLED);
-    await fs15.rm(exePath, { force: true });
-    await fs15.rm(xmlPath, { force: true });
+    await fs17.rm(exePath, { force: true });
+    await fs17.rm(xmlPath, { force: true });
   }
   async function start() {
     if (!await fileExists(xmlPath)) {
@@ -10061,6 +11614,6 @@ function createServiceLifecycle(def, opts = {}) {
   }
 }
 
-export { AuthManager, BlobClient, ClaudeAdapter, CodexAdapter, DEFAULT_ACK_CRITICAL_RESERVE_BYTES, DEFAULT_CLEANUP_BATCH_LIMIT, DEFAULT_HARD_BUDGET_RATIO, DEFAULT_INCREMENTAL_VACUUM_PAGES, DEFAULT_LOG_ROTATION, DEFAULT_NORMAL_COMPACTION_INTERVAL_MS, DEFAULT_PRESSURE_COMPACTION_INTERVAL_MS, DEFAULT_RETENTION_MS, DEFAULT_SOFT_BUDGET_RATIO, DaemonObserver, DeviceRevokedError, GitWorkspaceError, GitWorkspaceManager, GitWorkspaceStore, JOURNAL_DB_FILENAME, JOURNAL_QUARANTINE_DIRNAME, JOURNAL_TASK_REF_PREFIX, JournalClosedError, JournalCorruptError, JournalRecordTooLargeError, JournalUnavailableError, JournalUnknownTaskError, LocalStorageEmergencyError, LocalStoragePolicyError, LocalStoragePressureEngine, PI_PACKAGE_NAME, PiAdapter, PolicyUnsupportedError, SecureDirHardeningError, SqliteLocalTaskJournal, SteerUnsupportedError, StoredDeviceProofSigner, TruthMemoryClient, TruthMemoryClientError, UnsupportedServicePlatformError, buildIcaclsArgs, cleanupEligibleAt, cleanupOrderFor, computePressureState, createDaemon, createDaemonWithAdapters, createFilesystemCleanupExecutor, createServiceLifecycle, createStatfsFreeBytesProvider, ensureSecureDir, generateLaunchdPlist, generateSystemdUnit, generateWinswXml, isGitWorkspaceConfig, journalHash, nodeAgentProgram, prependGitWorkspaceGuidance, resolveLocalStoragePolicy, sanitizeServiceName };
+export { AuthManager, BlobClient, ClaudeAdapter, CodexAdapter, DEFAULT_ACK_CRITICAL_RESERVE_BYTES, DEFAULT_CLEANUP_BATCH_LIMIT, DEFAULT_HARD_BUDGET_RATIO, DEFAULT_INCREMENTAL_VACUUM_PAGES, DEFAULT_LOG_ROTATION, DEFAULT_NORMAL_COMPACTION_INTERVAL_MS, DEFAULT_PRESSURE_COMPACTION_INTERVAL_MS, DEFAULT_RETENTION_MS, DEFAULT_SOFT_BUDGET_RATIO, DaemonObserver, DeviceRevokedError, GitWorkspaceError, GitWorkspaceManager, GitWorkspaceStore, JOURNAL_DB_FILENAME, JOURNAL_QUARANTINE_DIRNAME, JOURNAL_TASK_REF_PREFIX, JournalClosedError, JournalCorruptError, JournalRecordTooLargeError, JournalUnavailableError, JournalUnknownTaskError, LocalStorageEmergencyError, LocalStoragePolicyError, LocalStoragePressureEngine, PI_PACKAGE_NAME, PiAdapter, PolicyUnsupportedError, SKILL_PACKS_CAPABILITY, SKILL_PACKS_DIRNAME, SKILL_PACK_AUDIT_FILENAME, SKILL_PACK_INSTALL_ERROR_CODES, SKILL_PACK_LOCK_FILENAME, SKILL_PACK_LOCK_SCHEMA, SKILL_PACK_RESPONSE_MAX_BYTES, SecureDirHardeningError, SkillPackInstallError, SqliteLocalTaskJournal, SteerUnsupportedError, StoredDeviceProofSigner, TruthMemoryClient, TruthMemoryClientError, UnsupportedServicePlatformError, buildIcaclsArgs, cleanupEligibleAt, cleanupOrderFor, computePressureState, createDaemon, createDaemonWithAdapters, createFilesystemCleanupExecutor, createServiceLifecycle, createStatfsFreeBytesProvider, ensureSecureDir, generateLaunchdPlist, generateSystemdUnit, generateWinswXml, installSkillPacks, isGitWorkspaceConfig, journalHash, listInstalledSkillPacks, nodeAgentProgram, prependGitWorkspaceGuidance, projectSkillPack, requestDeviceAssertion, resolveLocalStoragePolicy, sanitizeServiceName, skillPacksRoot };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map