@byok-sdk/client 0.4.1 → 0.5.0

package/dist/bin/byok-agent.js

@@ -931,6 +931,24 @@ function mapPermissionPolicyToPiArgs(policy) {
 }
 
 // src/adapters/pi/events.ts
+function requireToolCallId(msg) {
+  if (typeof msg.toolCallId === "string" && msg.toolCallId.trim().length > 0) return msg.toolCallId;
+  throw new RuntimeExecutionFailure({
+    phase: "run",
+    category: "authority",
+    retry: "non-retryable",
+    reason: `pi ${msg.type} frame had no authoritative tool call id`
+  });
+}
+function requireToolResultOutcome(msg) {
+  if (typeof msg.isError === "boolean") return msg.isError;
+  throw new RuntimeExecutionFailure({
+    phase: "run",
+    category: "authority",
+    retry: "non-retryable",
+    reason: "pi tool_execution_end frame had no authoritative isError outcome"
+  });
+}
 function mapPiMessageToAgentEvent(msg) {
   switch (msg.type) {
     case "message_update": {
@@ -941,16 +959,22 @@ function mapPiMessageToAgentEvent(msg) {
       return void 0;
     }
     case "tool_execution_start": {
+      const toolCallId = requireToolCallId(msg);
       if (typeof msg.toolName !== "string") return void 0;
-      return { type: "tool_use", tool: msg.toolName, input: msg.args };
+      return { type: "tool_use", tool: msg.toolName, input: msg.args, toolCallId };
     }
     case "tool_execution_end": {
+      const toolCallId = requireToolCallId(msg);
+      const isError = requireToolResultOutcome(msg);
       if (typeof msg.toolName !== "string") return void 0;
-      return {
+      const event = {
         type: "tool_result",
         tool: msg.toolName,
-        output: { result: msg.result, isError: msg.isError === true }
+        output: { result: msg.result },
+        toolCallId,
+        isError
       };
+      return event;
     }
     case "agent_settled":
       return { type: "turn_end" };
@@ -1962,6 +1986,17 @@ function subtractDenied(tools, denyTools) {
 function createToolUseCorrelation() {
   return { toolNameByUseId: /* @__PURE__ */ new Map() };
 }
+function missingToolCallIdFailure(frame) {
+  return new RuntimeExecutionFailure({
+    phase: "run",
+    category: "authority",
+    retry: "non-retryable",
+    reason: `claude ${frame} frame had no authoritative tool call id`
+  });
+}
+function isAuthoritativeToolCallId(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
 var ROUTINE_CLAUDE_SYSTEM_SUBTYPES = /* @__PURE__ */ new Set([
   "init",
   "hook_started",
@@ -2005,9 +2040,12 @@ function mapAssistant(msg, correlation) {
         }
         break;
       case "tool_use":
-        if (typeof block.id === "string" && typeof block.name === "string") {
+        if (!isAuthoritativeToolCallId(block.id)) {
+          return { events: [], terminalFailure: missingToolCallIdFailure("tool_use") };
+        }
+        if (typeof block.name === "string") {
           correlation.toolNameByUseId.set(block.id, block.name);
-          events.push({ type: "tool_use", tool: block.name, input: block.input });
+          events.push({ type: "tool_use", tool: block.name, input: block.input, toolCallId: block.id });
         }
         break;
       // Deliberately NOT mapped to `progress` — mirrors pi's own choice to
@@ -2043,11 +2081,20 @@ function mapUser(msg, correlation, options) {
       unmappedLabel = unmappedLabel ?? `user-block:${String(block.type)}`;
       continue;
     }
-    const toolUseId = typeof block.tool_use_id === "string" ? block.tool_use_id : void 0;
-    const tool = toolUseId && correlation.toolNameByUseId.get(toolUseId) || "unknown";
-    const isError = block.is_error === true;
-    events.push({ type: "tool_result", tool, output: { content: block.content, isError } });
-    if (!isError && FILE_WRITING_TOOLS.has(tool)) {
+    if (!isAuthoritativeToolCallId(block.tool_use_id)) {
+      return { events: [], terminalFailure: missingToolCallIdFailure("tool_result") };
+    }
+    const tool = correlation.toolNameByUseId.get(block.tool_use_id) ?? "unknown";
+    const isError = typeof block.is_error === "boolean" ? block.is_error : void 0;
+    const event = {
+      type: "tool_result",
+      tool,
+      output: { content: block.content },
+      toolCallId: block.tool_use_id
+    };
+    if (isError !== void 0) event.isError = isError;
+    events.push(event);
+    if (isError === false && FILE_WRITING_TOOLS.has(tool)) {
       const artifact = tryBuildArtifactEvent(msg, options.workspaceDir);
       if (artifact) events.push(artifact);
     }
@@ -2670,8 +2717,8 @@ var ClaudeSession = class {
             for (; ; ) {
               const buffered = pending.shift();
               if (buffered) return { value: buffered, done: false };
+              if (terminalFailure) throw terminalFailure;
               if (turnSettled) {
-                if (terminalFailure) throw terminalFailure;
                 return { value: void 0, done: true };
               }
               let raw;
@@ -2873,6 +2920,15 @@ function extractCodexUsageEvent(rawUsage) {
 function toNonNegativeInt2(value) {
   return typeof value === "number" && Number.isInteger(value) && value >= 0 ? value : void 0;
 }
+function requireToolCallId2(item) {
+  if (typeof item.id === "string" && item.id.trim().length > 0) return item.id;
+  throw new RuntimeExecutionFailure({
+    phase: "run",
+    category: "authority",
+    retry: "non-retryable",
+    reason: "codex tool item had no authoritative tool call id"
+  });
+}
 function mapItem(rawItem, phase, workspaceDir) {
   if (!rawItem || typeof rawItem !== "object") return [];
   const item = rawItem;
@@ -2883,9 +2939,10 @@ function mapItem(rawItem, phase, workspaceDir) {
       return typeof item.text === "string" ? [{ type: "progress", text: item.text }] : [];
     }
     case "command_execution": {
+      const toolCallId = requireToolCallId2(item);
       const command = typeof item.command === "string" ? item.command : void 0;
       if (phase === "started") {
-        return command !== void 0 ? [{ type: "tool_use", tool: "command_execution", input: { command } }] : [];
+        return command !== void 0 ? [{ type: "tool_use", tool: "command_execution", input: { command }, toolCallId }] : [];
       }
       return [
         {
@@ -2896,17 +2953,19 @@ function mapItem(rawItem, phase, workspaceDir) {
             aggregatedOutput: item.aggregated_output,
             exitCode: item.exit_code,
             status: item.status
-          }
+          },
+          toolCallId
         }
       ];
     }
     case "file_change": {
+      const toolCallId = requireToolCallId2(item);
       const changes = Array.isArray(item.changes) ? item.changes : [];
       if (phase === "started") {
-        return [{ type: "tool_use", tool: "file_change", input: { changes } }];
+        return [{ type: "tool_use", tool: "file_change", input: { changes }, toolCallId }];
       }
       return [
-        { type: "tool_result", tool: "file_change", output: { changes, status: item.status } },
+        { type: "tool_result", tool: "file_change", output: { changes, status: item.status }, toolCallId },
         ...extractArtifactEvents(changes, workspaceDir)
       ];
     }
@@ -3329,7 +3388,15 @@ async function runCodexTurn(params) {
           }
           return;
         }
-        const mapped = mapCodexEventToAgentEvents(evt, params.workspaceDir);
+        let mapped;
+        try {
+          mapped = mapCodexEventToAgentEvents(evt, params.workspaceDir);
+        } catch (cause) {
+          if (!isRuntimeExecutionFailure(cause)) throw cause;
+          params.terminal.failure = cause;
+          params.queue.end();
+          return;
+        }
         for (const agentEvent of mapped) {
           if (agentEvent.type === "turn_end") turnEnded = true;
           params.queue.push(agentEvent);
@@ -8208,6 +8275,11 @@ function createStatfsFreeBytesProvider(dir) {
 var BASE_PLATFORM_ALLOWLIST = [
   "PATH",
   "HOME",
+  // macOS credential-store discovery used by subscription-authenticated
+  // agent CLIs depends on the login account name as well as HOME. Omitting
+  // USER makes `claude auth status` report logged out under the filtered
+  // child environment even when the host CLI is logged in.
+  "USER",
   "USERPROFILE",
   "TMPDIR",
   "TEMP",
@@ -8315,11 +8387,37 @@ function computeEffectivePolicy(offered, ceiling) {
 }
 
 // src/daemon/progress-batcher.ts
+var ProgressEventTooLargeError = class extends Error {
+  constructor(actualBytes, maxBatchBytes) {
+    super(`Progress event requires ${actualBytes} UTF-8 bytes, exceeding maxBatchBytes ${maxBatchBytes}.`);
+    this.actualBytes = actualBytes;
+    this.maxBatchBytes = maxBatchBytes;
+    this.name = "ProgressEventTooLargeError";
+  }
+  actualBytes;
+  maxBatchBytes;
+};
+var encoder = new TextEncoder();
+function assertPositiveSafeInteger(value, name) {
+  if (value !== void 0 && (!Number.isSafeInteger(value) || value <= 0)) {
+    throw new TypeError(`${name} must be a positive safe integer when configured.`);
+  }
+}
+function validateProgressBatcherOptions(options = {}) {
+  assertPositiveSafeInteger(options.maxBatchSize, "maxBatchSize");
+  assertPositiveSafeInteger(options.flushIntervalMs, "flushIntervalMs");
+  assertPositiveSafeInteger(options.maxBatchBytes, "maxBatchBytes");
+}
+function encodedEventsBytes(events) {
+  return encoder.encode(JSON.stringify(events)).length;
+}
 var ProgressBatcher = class {
   constructor(emit, options = {}) {
     this.emit = emit;
+    validateProgressBatcherOptions(options);
     this.maxBatchSize = options.maxBatchSize ?? 10;
     this.flushIntervalMs = options.flushIntervalMs ?? 250;
+    this.maxBatchBytes = options.maxBatchBytes;
   }
   emit;
   buffer = [];
@@ -8327,7 +8425,17 @@ var ProgressBatcher = class {
   timer;
   maxBatchSize;
   flushIntervalMs;
+  maxBatchBytes;
   push(event) {
+    if (this.maxBatchBytes !== void 0) {
+      const eventBytes = encodedEventsBytes([event]);
+      if (eventBytes > this.maxBatchBytes) {
+        throw new ProgressEventTooLargeError(eventBytes, this.maxBatchBytes);
+      }
+      if (this.buffer.length > 0 && encodedEventsBytes([...this.buffer, event]) > this.maxBatchBytes) {
+        this.flush();
+      }
+    }
     this.buffer.push(event);
     if (this.buffer.length >= this.maxBatchSize) {
       this.flush();
@@ -8380,6 +8488,7 @@ var MAX_INLINE_ARTIFACT_BYTES = 64 * 1024;
 var MAX_TRACKED_TASK_IDS = 2e3;
 var MAX_DURATION_EXCEEDED_REASON_PREFIX = "resource limit exceeded: maxDurationMs";
 var MAX_OUTPUT_BYTES_EXCEEDED_REASON_PREFIX = "resource limit exceeded: maxTaskOutputBytes";
+var MAX_PROGRESS_BATCH_BYTES_EXCEEDED_REASON_PREFIX = "resource limit exceeded: progressBatch.maxBatchBytes";
 var RESULT_DOCUMENT_UNDELIVERABLE_REASON_PREFIX = "result document undeliverable";
 function resultDocumentRejectionDetail(check) {
   switch (check.reason) {
@@ -9236,6 +9345,13 @@ var TaskRunner = class {
     } catch (err) {
       if (this.tasks.get(active.taskId) !== active || active.beingTornDown) return;
       active.batcher.flush();
+      if (err instanceof ProgressEventTooLargeError) {
+        await this.failActiveTaskForResourceLimit(
+          active.taskId,
+          `${MAX_PROGRESS_BATCH_BYTES_EXCEEDED_REASON_PREFIX}: event requires ${err.actualBytes} UTF-8 bytes, exceeding the configured limit of ${err.maxBatchBytes} bytes`
+        );
+        return;
+      }
       const failure = projectRuntimeBoundaryFailure(err, "run");
       if (failure.contractViolation) {
         console.error("[byok/client] runtime adapter events iterable returned an untyped failure", err);
@@ -10322,6 +10438,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       `DaemonConfig.maxTaskOutputBytes must be a positive number (or omitted to use the ${DEFAULT_MAX_TASK_OUTPUT_BYTES}-byte default) \u2014 got ${config.maxTaskOutputBytes}. Pass Number.POSITIVE_INFINITY to explicitly disable the cap; 0 or a negative number is rejected rather than silently treated as "disabled".`
     );
   }
+  validateProgressBatcherOptions(config.progressBatch);
   const presenceCadence = {
     intervalMs: config.presence?.intervalMs ?? DEFAULT_PRESENCE_HEARTBEAT_INTERVAL_MS,
     ttlMs: config.presence?.ttlMs ?? DEFAULT_PRESENCE_TTL_MS,
@@ -10607,7 +10724,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         // untouched. See `observer.ts`'s module doc comment.
         send: sendEnvelope,
         blobClient,
-        batcherOptions: overrides.batch,
+        batcherOptions: config.progressBatch,
         sessionWorkspaces,
         gitWorkspaceManager,
         gitWorkspaceStore,