@byok-sdk/client 0.2.0 → 0.4.0

package/dist/adapters/pi/pi-adapter.d.ts

@@ -1,29 +1,38 @@
-import type { TaskOfferPayload } from '@byok-sdk/protocol';
-import { type RuntimeAdapter, type RuntimeCapabilities, type RuntimeDetectResult, type RuntimeEnvironmentRequirements, type Session, type TaskContext } from '../../types';
+import { type RuntimeAdapter, type RuntimeDetectResult, type RuntimeAdapterPrepareInput, type RuntimeAdapterPrepareResult } from '../../types';
 import { type ResolvedBin } from './resolve-bin';
 import { type SpawnFn } from './rpc-client';
+/**
+ * Known provider credential env var *names* (never values) — see the
+ * credential-isolation rule on `RuntimeAdapter`. `detect()` only checks
+ * whether one of these names is set; it never reads pi's own auth storage
+ * (`~/.pi/...`) or any file contents. Not exhaustive (pi supports ~30
+ * providers); covers the common ones for a useful `authPresent` signal.
+ */
 export interface PiAdapterOptions {
     /** Override bin resolution — tests substitute the fake-pi fixture script. */
     resolveBin?: () => ResolvedBin;
     /** Override process spawning — tests substitute a fake spawn. */
     spawnFn?: SpawnFn;
+    /**
+     * Separate-process BYOK credential boundary. The launcher receives only
+     * non-secret selection/config paths, resolves the OS credential itself,
+     * and transparently proxies the pinned Pi RPC process.
+     */
+    byokLauncher?: PiByokLauncherConfig;
+}
+export interface PiByokLauncherConfig {
+    command: string;
+    /** Optional fixed launcher arguments, before BYOK's required arguments. */
+    args?: string[];
+    profileDbPath: string;
+    sessionDir: string;
+    secretServicePrefix?: string;
 }
 export declare class PiAdapter implements RuntimeAdapter {
     private readonly options;
-    readonly id = "pi";
+    readonly descriptor: import("..").RuntimeAdapterDescriptor;
     constructor(options?: PiAdapterOptions);
     detect(): Promise<RuntimeDetectResult>;
-    capabilities(): RuntimeCapabilities;
-    /**
-     * M5: pi authenticates to its ~30 supported providers via env-var API
-     * keys — `detect()`'s own `authPresent` probe above checks this identical
-     * list — so these MUST keep flowing into pi's spawned process or pi auth
-     * breaks entirely. `KNOWN_PROVIDER_ENV_VARS` above is the single source
-     * of truth, reused here rather than duplicated. No `baseNames`: nothing
-     * in this adapter or `rpc-client.ts` reads a pi-specific config-discovery
-     * variable beyond the platform baseline (`daemon/environment.ts`).
-     */
-    environmentRequirements(): RuntimeEnvironmentRequirements;
-    start(task: TaskOfferPayload, ctx: TaskContext): Promise<Session>;
+    prepare(input: RuntimeAdapterPrepareInput): Promise<RuntimeAdapterPrepareResult>;
     private resolveBin;
 }

package/dist/adapters/pi/rpc-client.d.ts

@@ -39,6 +39,9 @@ export declare class PiRpcClient {
     private readonly eventQueue;
     private closed;
     private exitError;
+    private readonly closedPromise;
+    private resolveClosed;
+    private disposalAttempt;
     /** Bounded tail of recent stderr lines — pi discarded this entirely before (nothing ever read `child.stderr`), which is exactly why finding #1 (`Error: Unknown option: --session-id`, exit 1) had to be root-caused by hand instead of reading it off a thrown error. See `buildExitError`. */
     private readonly stderrRing;
     /** Count of pi RPC message types `PiSession` (pi-adapter.ts) has told us have no `AgentEvent` mapping and aren't routine bookkeeping — see `recordUnmappedFrame`. */
@@ -51,6 +54,8 @@ export declare class PiRpcClient {
     }): Promise<PiRpcMessage>;
     /** Every non-response, non-`extension_ui_request` line — the latter is answered directly by this client (see `respondToExtensionUiRequest`) and never enqueued. */
     get events(): AsyncIterable<PiRpcMessage>;
+    /** Local transport diagnostic retained when the process closes; consumers must classify it explicitly. */
+    get terminalError(): Error | undefined;
     /**
      * Record a pi RPC message `type` that `PiSession` (pi-adapter.ts) decided
      * has no `AgentEvent` mapping and isn't routine bookkeeping (see
@@ -61,8 +66,11 @@ export declare class PiRpcClient {
      * a post-mortem on a failed/hung task has it without separate log scraping.
      */
     recordUnmappedFrame(type: string): void;
-    /** Best-effort teardown. SIGTERM on POSIX; `taskkill /T /F` on Windows to also reap child processes pi itself spawned (e.g. bash). */
+    /** Immediate process-tree termination request. `dispose()` is the settlement receipt. */
     kill(): void;
+    waitClosed(): Promise<void>;
+    dispose(): Promise<void>;
+    private processTreeOptions;
     private onData;
     private onLine;
     /**

package/dist/adapters/process-tree.d.ts

@@ -0,0 +1,19 @@
+import { type ChildProcess, type SpawnOptions } from 'node:child_process';
+export interface OwnedProcessTreeOptions {
+    child: ChildProcess;
+    waitClosed: () => Promise<void>;
+    isClosed: () => boolean;
+    label: string;
+    termGraceMs?: number;
+    killGraceMs?: number;
+}
+/**
+ * Every bundled runtime root is an owned process-group leader on POSIX. Pipes
+ * remain referenced, so `detached` changes ownership topology without making
+ * the runtime outlive the daemon. Windows uses taskkill's `/T` tree authority.
+ */
+export declare function withOwnedProcessTree<T extends SpawnOptions>(options: T): T;
+/** Immediate termination request used by interrupt paths; close remains the receipt. */
+export declare function requestOwnedProcessTreeTermination(options: OwnedProcessTreeOptions): void;
+/** Resolve only after the adapter-owned root and descendants are quiescent. */
+export declare function disposeOwnedProcessTree(options: OwnedProcessTreeOptions): Promise<void>;

package/dist/adapters/provider-credential-environment.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Provider credential names that the daemon may explicitly admit for the
+ * legacy direct-Pi path. Subscription runtimes and the BYOK custody launcher
+ * must not inherit them.
+ *
+ * This list contains names only. Credential values remain owned by the
+ * caller's environment or by the separate keys launcher.
+ */
+export declare const PROVIDER_CREDENTIAL_ENV_NAMES: readonly ['ANTHROPIC_API_KEY', 'ANTHROPIC_OAUTH_TOKEN', 'OPENAI_API_KEY', 'GEMINI_API_KEY', 'AZURE_OPENAI_API_KEY', 'DEEPSEEK_API_KEY', 'GROQ_API_KEY', 'MISTRAL_API_KEY', 'OPENROUTER_API_KEY', 'XAI_API_KEY', 'ZAI_API_KEY'];
+/**
+ * Credential-shaped names stripped at subscription/BYOK custody boundaries.
+ * This is intentionally a superset of the small legacy-Pi allowlist above:
+ * denying a credential is safe, while allowing every cloud credential Pi
+ * could consume would regress the daemon's ambient-environment isolation.
+ */
+export declare const PROVIDER_CREDENTIAL_ENV_DENY_NAMES: readonly ["ANTHROPIC_API_KEY", "ANTHROPIC_OAUTH_TOKEN", "OPENAI_API_KEY", "GEMINI_API_KEY", "AZURE_OPENAI_API_KEY", "DEEPSEEK_API_KEY", "GROQ_API_KEY", "MISTRAL_API_KEY", "OPENROUTER_API_KEY", "XAI_API_KEY", "ZAI_API_KEY", "ANT_LING_API_KEY", "NVIDIA_API_KEY", "CEREBRAS_API_KEY", "CLOUDFLARE_API_KEY", "AI_GATEWAY_API_KEY", "ZAI_CODING_CN_API_KEY", "OPENCODE_API_KEY", "RADIUS_API_KEY", "FIREWORKS_API_KEY", "TOGETHER_API_KEY", "BASETEN_API_KEY", "KIMI_API_KEY", "MINIMAX_API_KEY", "MINIMAX_CN_API_KEY", "QWEN_TOKEN_PLAN_API_KEY", "QWEN_TOKEN_PLAN_CN_API_KEY", "XIAOMI_API_KEY", "XIAOMI_TOKEN_PLAN_CN_API_KEY", "XIAOMI_TOKEN_PLAN_AMS_API_KEY", "XIAOMI_TOKEN_PLAN_SGP_API_KEY", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "GOOGLE_APPLICATION_CREDENTIALS", "PI_PROVIDER_API_KEY"];
+/** Return a copy that cannot pass ambient provider credentials to a child. */
+export declare function withoutProviderCredentials(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;

package/dist/bin/audit-log.d.ts

@@ -118,6 +118,18 @@ export declare const AUDIT_LOG_TRIM_TARGET_LINES = 5000;
  * tail) rather than the file growing without bound.
  */
 export declare const MAX_LIVE_TASK_ANCHORS = 500;
+/**
+ * Git failures are serialized only as this closed, stable category set —
+ * never raw Git errors or command output. Projected from
+ * `daemon/git-workspace.ts`'s `GIT_ERROR_CATEGORIES` (the single source of
+ * truth for the `GitErrorCategory` union) rather than carrying a literal
+ * copy that could drift from it; the runtime half of that guarantee is
+ * `__tests__/git-category-drift.test.ts`.
+ *
+ * @internal Exported for the drift-guard test only (never re-exported from
+ * `index.ts`).
+ */
+export declare const STABLE_GIT_ERROR_CATEGORIES: Set<string>;
 /**
  * Appends one `DaemonEvent` as a single redacted JSON line (finding P1 #3 —
  * see this file's module doc comment) at 0600, and rotates the file if it's