@byok-sdk/client 0.5.0 → 0.6.1

package/README.md

@@ -14,7 +14,11 @@ the separately installed `byok-pi-provider-launcher`, the local non-secret
 profile database path, and a stable Pi session directory. The client passes
 only those paths plus provider/model ids; the launcher alone reads the OS
 credential when required and spawns Pi. Both custody paths must be absolute;
-missing launcher configuration fails closed.
+missing launcher configuration fails closed. A macOS host running under an
+isolated `HOME` can additionally set `piByokLauncher.macosKeychainPath` to one
+absolute keychain file. The client projects it as the launcher's reserved
+`--macos-keychain-path` flag; it does not search a second credential authority
+or widen the Pi child environment.
 
 Claude Code and Codex remain user-installed runtimes and use their own login
 state. Hosts that only need runtime detection/composition can import the
@@ -81,6 +85,92 @@ createDaemon({
 The value is intentionally host-owned and has no SDK default because it is a
 deployment/read-model policy, not a frozen protocol limit.
 
+## Durable Agent homes
+
+An Agent-capable daemon receives one absolute branded storage root. The SDK,
+not the host, composes `agents/<agentId>`, validates canonical containment,
+creates missing `MEMORY.md` and `notes/` without overwriting existing bytes,
+and binds the resulting Agent home as runtime cwd.
+
+```ts
+import { createAgentHomeProjection, createDaemon } from '@byok-sdk/client';
+
+createDaemon({
+  // ...normal device and transport configuration
+  agentHome: {
+    hostStorageRoot: '/Users/alice/.salesko',
+    projection: createAgentHomeProjection(async ({ agentRef, cwd }) => {
+      // Host code receives the canonical home. It supplies redacted profile
+      // content but never joins `agents/<agentId>` and never writes secrets.
+      await profileProjection.write({ agentRef, canonicalAgentHome: cwd });
+    }),
+  },
+});
+```
+
+Startup materializes and write-probes the canonical root before publishing
+`agent-home-contract`. `agentHome` and `gitWorkspace` are mutually exclusive;
+strict Agent execution has one workspace authority and never falls back to a
+task-scoped Git workspace.
+
+Successful startup with this configuration advertises `agent-home-contract`. Agent offers are distinct
+from legacy task offers and fail closed when identity, profile revision,
+session/runtime/cwd evidence, or the one-writer lease does not match. Agent
+files other than the SDK-reserved `.byok` namespace are opaque; there is no
+required `artifacts/` directory and the client does not parse or index their
+contents.
+
+## Agent egress and explicit content reads
+
+`agentEgress` is consumed configuration, not a profile projection. The host
+must select one exact policy revision and an authenticated tenant id. Omitting
+contentful mode keeps runtime activity metadata/status-only; enabling it is an
+explicit product decision and requires the server capability. Reliable events
+are fsynced under the canonical Agent home and retire only after an exact ack.
+
+```ts
+createDaemon({
+  // ...normal device, transport and agentHome configuration
+  agentEgress: {
+    tenantId: 'tenant-authority-from-salesko',
+    policy: {
+      policyRevision: 'salesko-agent-egress-r1',
+      activity: { mode: 'metadata-status', delivery: 'latest-value' },
+      reliable: {
+        maxPendingEventsPerAgent: 256,
+        maxPendingBytesPerAgent: 4 * 1024 * 1024,
+        maxPendingBytesPerTenant: 16 * 1024 * 1024,
+      },
+      transfers: {
+        workspace: { maxBytes: 1024 * 1024, allowedMimeTypes: ['text/plain'] },
+        transcript: 'disabled',
+        artifact: 'disabled',
+      },
+    },
+    contentRead: {
+      workspace: {
+        root: { kind: 'agent-home' },
+        maxTextBytes: 1024 * 1024,
+        textMimeTypes: ['text/plain'],
+      },
+    },
+  },
+});
+```
+
+Each content surface requires both the matching non-disabled wire policy and
+its local supplement. The local supplement can only narrow root, text, MIME,
+size and sensitive-name behavior; it cannot enable a wire-disabled surface.
+The SDK derives `agents/<agentId>`, `.byok/egress`, runtime-session evidence and
+the per-Agent content-read audit path. Salesko must not compose those paths.
+Tenant/device identity comes from authenticated host state; a request cannot
+override it. Transcript reads additionally require the exact persisted
+AgentRef/session/runtime/cwd handoff. Allowed content is uploaded through the
+authenticated blob channel. The content-free receipt is fsynced into the
+Agent-local reliable spool with stable event/cursor identity before send and
+retires only after an exact ack; an allowed receipt carries the exact
+`BlobRef`. No API recursively mirrors an Agent home.
+
 For a concrete private host composition, see the
 [`examples/salesko-connector-broker`](../../examples/salesko-connector-broker)
 reference. It keeps `@byok-sdk/client` credential-blind while combining

package/dist/adapters/index.js

@@ -1,9 +1,9 @@
 import { execFile, spawn } from 'child_process';
-import { promisify } from 'util';
 import { promises, existsSync, readFileSync, realpathSync } from 'fs';
-import path3 from 'path';
-import { fileURLToPath } from 'url';
 import os from 'os';
+import path5, { isAbsolute } from 'path';
+import { promisify } from 'util';
+import { fileURLToPath } from 'url';
 import 'readline';
 
 // src/runtime-failure.ts
@@ -95,9 +95,12 @@ var SteerUnsupportedError = class extends Error {
     this.runtimeId = runtimeId;
   }
 };
+
+// src/adapters/pi/mcp-config.ts
+var BYOK_PI_MCP_CONFIG_PATH = "BYOK_PI_MCP_CONFIG_PATH";
 var PI_PACKAGE_NAME = "@earendil-works/pi-coding-agent";
 function readPackageJson(dir) {
-  const candidate = path3.join(dir, "package.json");
+  const candidate = path5.join(dir, "package.json");
   if (!existsSync(candidate)) return void 0;
   try {
     return JSON.parse(readFileSync(candidate, "utf8"));
@@ -112,17 +115,17 @@ function resolvePiBin() {
   }
   try {
     const mainEntryUrl = import.meta.resolve(PI_PACKAGE_NAME);
-    let dir = path3.dirname(fileURLToPath(mainEntryUrl));
+    let dir = path5.dirname(fileURLToPath(mainEntryUrl));
     for (let depth = 0; depth < 6; depth++) {
       const pkg = readPackageJson(dir);
       if (pkg?.name === PI_PACKAGE_NAME) {
         const binRel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.pi;
         if (binRel) {
-          return { command: path3.join(dir, binRel), source: "package" };
+          return { command: path5.join(dir, binRel), source: "package" };
         }
         break;
       }
-      const parent = path3.dirname(dir);
+      const parent = path5.dirname(dir);
       if (parent === dir) break;
       dir = parent;
     }
@@ -136,6 +139,13 @@ function resolvePiBin() {
     `Required ${PI_PACKAGE_NAME} does not expose the pi CLI; reinstall the pinned dependency or set BYOK_PI_BIN to a Node 22.22+ pi sidecar`
   );
 }
+function resolvePiExtensions() {
+  const clientManifest = fileURLToPath(import.meta.resolve("@byok-sdk/client/package.json"));
+  return {
+    webAccess: fileURLToPath(import.meta.resolve("pi-web-access/index.ts")),
+    mcpAdapter: path5.join(path5.dirname(clientManifest), "dist", "adapters", "pi", "mcp-extension.js")
+  };
+}
 
 // src/adapters/pi/permission-mapping.ts
 var READONLY_TOOLS = ["read", "grep", "find", "ls"];
@@ -888,9 +898,73 @@ var DETECT_TIMEOUT_MS = 5e3;
 function errorMessage(err) {
   return err instanceof Error ? err.message : String(err);
 }
+async function cleanupMcpConfigDir(dir) {
+  if (!dir) return;
+  try {
+    await promises.rm(dir, { recursive: true, force: true });
+  } catch (cause) {
+    throw new RuntimeDisposalFailure({
+      stage: "cleanup",
+      reason: "pi task-scoped MCP configuration could not be removed"
+    }, { cause });
+  }
+}
+function validatePiByokLauncherConfig(launcher) {
+  if (launcher === void 0) return;
+  for (const [field, value] of [
+    ["command", launcher.command],
+    ["profileDbPath", launcher.profileDbPath],
+    ["sessionDir", launcher.sessionDir]
+  ]) {
+    if (value.trim().length === 0 || /[\u0000\r\n]/u.test(value)) {
+      throw new Error(`DaemonConfig.piByokLauncher.${field} must be a non-empty single-line string`);
+    }
+  }
+  if (!isAbsolute(launcher.profileDbPath) || !isAbsolute(launcher.sessionDir)) {
+    throw new Error(
+      "DaemonConfig.piByokLauncher profileDbPath and sessionDir must be absolute paths"
+    );
+  }
+  if (launcher.macosKeychainPath !== void 0 && (launcher.macosKeychainPath.trim().length === 0 || /[\u0000\r\n]/u.test(launcher.macosKeychainPath))) {
+    throw new Error(
+      "DaemonConfig.piByokLauncher.macosKeychainPath must be a non-empty single-line string"
+    );
+  }
+  if (launcher.macosKeychainPath !== void 0 && !isAbsolute(launcher.macosKeychainPath)) {
+    throw new Error(
+      "DaemonConfig.piByokLauncher.macosKeychainPath must be an absolute path"
+    );
+  }
+  if (launcher.secretServicePrefix !== void 0 && (launcher.secretServicePrefix.trim().length === 0 || /[\u0000\r\n]/u.test(launcher.secretServicePrefix))) {
+    throw new Error(
+      "DaemonConfig.piByokLauncher.secretServicePrefix must be a non-empty single-line string"
+    );
+  }
+  const reserved = /* @__PURE__ */ new Set([
+    "--",
+    "--pi-bin",
+    "--profile-db",
+    "--session-dir",
+    "--macos-keychain-path",
+    "--secret-service-prefix",
+    "--provider",
+    "--model"
+  ]);
+  const conflicting = launcher.args?.find((arg) => reserved.has(arg));
+  if (conflicting !== void 0) {
+    throw new Error(
+      `DaemonConfig.piByokLauncher.args must not override reserved launcher argument ${conflicting}`
+    );
+  }
+  const invalidArg = launcher.args?.find((arg) => arg.length === 0 || /[\u0000\r\n]/u.test(arg));
+  if (invalidArg !== void 0) {
+    throw new Error("DaemonConfig.piByokLauncher.args must contain only non-empty single-line strings");
+  }
+}
 var PiAdapter = class {
   constructor(options = {}) {
     this.options = options;
+    validatePiByokLauncherConfig(options.byokLauncher);
   }
   options;
   descriptor = freezeRuntimeAdapterDescriptor({
@@ -899,6 +973,7 @@ var PiAdapter = class {
     capabilities: {
       steer: true,
       resume: true,
+      mcpToolsets: true,
       approvalInteractive: false,
       permissionModes: ["auto", "readonly"]
     },
@@ -920,7 +995,15 @@ var PiAdapter = class {
     if (!mapping.ok) {
       return { kind: "reject", reason: mapping.reason ?? "policy rejected by pi adapter", retryable: false };
     }
+    if (input.requiredToolsetIds.length > 0 && input.policy.mode !== "auto") {
+      return {
+        kind: "reject",
+        reason: 'pi MCP toolsets require permission mode "auto" because pi-mcp-adapter exposes one proxy across read and mutation tools',
+        retryable: false
+      };
+    }
     const bin = this.resolveBin();
+    const extensions = (this.options.resolveExtensions ?? resolvePiExtensions)();
     const selection = input.offer.dispatchSelection;
     const pinnedSelection = selection === void 0 ? void 0 : Object.freeze({ ...selection });
     let command = bin.command;
@@ -942,6 +1025,7 @@ var PiAdapter = class {
         launcher.profileDbPath,
         "--session-dir",
         launcher.sessionDir,
+        ...launcher.macosKeychainPath !== void 0 ? ["--macos-keychain-path", launcher.macosKeychainPath] : [],
         ...launcher.secretServicePrefix ? ["--secret-service-prefix", launcher.secretServicePrefix] : [],
         "--provider",
         pinnedSelection.providerId,
@@ -971,18 +1055,48 @@ var PiAdapter = class {
             });
           }
           const resumeSessionId = startInput.manifest.sessionRef;
-          const piArgs = ["--mode", "rpc", ...resumeSessionId ? ["--session", resumeSessionId] : [], ...mapping.args];
+          const manifestCwd = startInput.manifest.cwd;
+          if (manifestCwd === void 0) {
+            throw new RuntimeExecutionFailure({
+              phase: "start",
+              category: "authority",
+              retry: "non-retryable",
+              reason: "prepared pi operation received a manifest without a sealed cwd"
+            });
+          }
+          let mcpConfigDir;
+          let runtimeEnv = manifestSelection === void 0 ? startInput.env : withoutProviderCredentials(startInput.env);
+          const taskMcpServers = startInput.mcpServers ?? {};
+          const hasMcpServers = Object.keys(taskMcpServers).length > 0;
+          if (hasMcpServers) {
+            mcpConfigDir = await promises.mkdtemp(path5.join(os.tmpdir(), "byok-pi-mcp-"));
+            await promises.chmod(mcpConfigDir, 448).catch(() => {
+            });
+            const mcpConfigPath = path5.join(mcpConfigDir, "mcp-config.json");
+            await promises.writeFile(mcpConfigPath, JSON.stringify({ mcpServers: taskMcpServers }), { mode: 384 });
+            runtimeEnv = { ...runtimeEnv, [BYOK_PI_MCP_CONFIG_PATH]: mcpConfigPath };
+          }
+          const piArgs = [
+            "--mode",
+            "rpc",
+            "--extension",
+            extensions.webAccess,
+            ...hasMcpServers ? ["--extension", extensions.mcpAdapter] : [],
+            ...resumeSessionId ? ["--session", resumeSessionId] : [],
+            ...mapping.args
+          ];
           const args = launcherArgs === void 0 ? piArgs : [...launcherArgs, "--", ...piArgs];
           let rpc;
           try {
             rpc = new PiRpcClient({
               command,
               args,
-              cwd: startInput.manifest.workspace.workspaceDir,
-              env: manifestSelection === void 0 ? startInput.env : withoutProviderCredentials(startInput.env),
+              cwd: manifestCwd,
+              env: runtimeEnv,
               spawnFn: this.options.spawnFn
             });
           } catch (cause) {
+            await cleanupMcpConfigDir(mcpConfigDir);
             throw new RuntimeExecutionFailure({
               phase: "start",
               category: "infrastructure",
@@ -995,6 +1109,7 @@ var PiAdapter = class {
             response = await rpc.send({ type: "prompt", message: startInput.instruction });
           } catch (cause) {
             rpc.kill();
+            await cleanupMcpConfigDir(mcpConfigDir);
             throw new RuntimeExecutionFailure({
               phase: "start",
               category: "infrastructure",
@@ -1004,6 +1119,7 @@ var PiAdapter = class {
           }
           if (response.success === false) {
             rpc.kill();
+            await cleanupMcpConfigDir(mcpConfigDir);
             throw new RuntimeExecutionFailure({
               phase: "start",
               category: "semantic",
@@ -1016,10 +1132,12 @@ var PiAdapter = class {
             sessionRef = await resolveAuthoritativeSessionId(rpc);
           } catch (err) {
             rpc.kill();
+            await cleanupMcpConfigDir(mcpConfigDir);
             throw err;
           }
           if (resumeSessionId !== void 0 && sessionRef !== resumeSessionId) {
             rpc.kill();
+            await cleanupMcpConfigDir(mcpConfigDir);
             throw new RuntimeExecutionFailure({
               phase: "start",
               category: "authority",
@@ -1027,7 +1145,7 @@ var PiAdapter = class {
               reason: "pi resumed a different authoritative session than requested"
             });
           }
-          return new PiSession(sessionRef, rpc, manifestSelection);
+          return new PiSession(sessionRef, rpc, manifestSelection, mcpConfigDir);
         }
       }
     };
@@ -1076,14 +1194,17 @@ async function resolveAuthoritativeSessionId(rpc) {
   });
 }
 var PiSession = class {
-  constructor(sessionRef, rpc, selection) {
+  constructor(sessionRef, rpc, selection, mcpConfigDir) {
     this.sessionRef = sessionRef;
     this.rpc = rpc;
     this.selection = selection;
+    this.mcpConfigDir = mcpConfigDir;
   }
   sessionRef;
   rpc;
   selection;
+  mcpConfigDir;
+  closeAttempt;
   get events() {
     const rpc = this.rpc;
     return {
@@ -1152,7 +1273,17 @@ var PiSession = class {
     await this.rpc.send({ type: "abort" });
   }
   async close() {
-    await this.rpc.dispose();
+    if (!this.closeAttempt) {
+      const attempt = (async () => {
+        await this.rpc.dispose();
+        await cleanupMcpConfigDir(this.mcpConfigDir);
+      })();
+      this.closeAttempt = attempt.catch((error) => {
+        this.closeAttempt = void 0;
+        throw error;
+      });
+    }
+    await this.closeAttempt;
   }
   async resolveApproval() {
     throw new Error("pi adapter does not support approval resume: pi never emits needs_approval in M0/M1");
@@ -1172,7 +1303,7 @@ function resolveApprovalMcpBin() {
   if (override) {
     return { command: override, args: [], source: "env" };
   }
-  const distBin = path3.join(path3.dirname(fileURLToPath(import.meta.url)), "bin", "byok-approval-mcp.js");
+  const distBin = path5.join(path5.dirname(fileURLToPath(import.meta.url)), "bin", "byok-approval-mcp.js");
   return { command: process.execPath, args: [distBin], source: "dist" };
 }
 
@@ -1263,7 +1394,7 @@ var EXTENSION_CONTENT_TYPES = {
   ".yml": "application/yaml"
 };
 function guessContentType(filePath) {
-  const ext = path3.extname(filePath).toLowerCase();
+  const ext = path5.extname(filePath).toLowerCase();
   return EXTENSION_CONTENT_TYPES[ext] ?? "application/octet-stream";
 }
 function mapAssistant(msg, correlation) {
@@ -1347,11 +1478,11 @@ function tryBuildArtifactEvent(msg, workspaceDir) {
   const filePath = toolUseResult && typeof toolUseResult.filePath === "string" ? toolUseResult.filePath : void 0;
   if (!filePath) return void 0;
   const realWorkspaceDir = tryRealpath(workspaceDir) ?? workspaceDir;
-  const fileDir = path3.dirname(filePath);
+  const fileDir = path5.dirname(filePath);
   const realFileDir = tryRealpath(fileDir) ?? fileDir;
-  const realFilePath = path3.join(realFileDir, path3.basename(filePath));
-  const relative = path3.relative(realWorkspaceDir, realFilePath);
-  if (relative === "" || relative.startsWith("..") || path3.isAbsolute(relative)) {
+  const realFilePath = path5.join(realFileDir, path5.basename(filePath));
+  const relative = path5.relative(realWorkspaceDir, realFilePath);
+  if (relative === "" || relative.startsWith("..") || path5.isAbsolute(relative)) {
     return void 0;
   }
   return { type: "artifact", name: relative, contentType: guessContentType(filePath) };
@@ -1637,7 +1768,7 @@ var DETECT_TIMEOUT_MS2 = 5e3;
 function errorMessage2(err) {
   return err instanceof Error ? err.message : String(err);
 }
-async function cleanupMcpConfigDir(dir) {
+async function cleanupMcpConfigDir2(dir) {
   if (!dir) return;
   try {
     await promises.rm(dir, { recursive: true, force: true });
@@ -1745,10 +1876,10 @@ var ClaudeAdapter = class {
       });
     }
     if (needsMcpConfig) {
-      mcpConfigDir = await promises.mkdtemp(path3.join(os.tmpdir(), "byok-mcp-"));
+      mcpConfigDir = await promises.mkdtemp(path5.join(os.tmpdir(), "byok-mcp-"));
       await promises.chmod(mcpConfigDir, 448).catch(() => {
       });
-      const mcpConfigPath = path3.join(mcpConfigDir, "mcp-config.json");
+      const mcpConfigPath = path5.join(mcpConfigDir, "mcp-config.json");
       const mcpServers = { ...taskMcpServers };
       if (mapping.needsApprovalMcp) {
         const approvalChannel = startInput.approvalChannel;
@@ -1807,6 +1938,15 @@ var ClaudeAdapter = class {
         reason: "prepared claude operation received a manifest with different runtime selection"
       });
     }
+    const manifestCwd = startInput.manifest.cwd;
+    if (manifestCwd === void 0) {
+      throw new RuntimeExecutionFailure({
+        phase: "start",
+        category: "authority",
+        retry: "non-retryable",
+        reason: "prepared claude operation received a manifest without a sealed cwd"
+      });
+    }
     const args = [
       "-p",
       "--input-format",
@@ -1827,12 +1967,12 @@ var ClaudeAdapter = class {
       client = new ClaudeProcessClient({
         command: bin.command,
         args,
-        cwd: startInput.manifest.workspace.workspaceDir,
+        cwd: manifestCwd,
         env: withoutProviderCredentials(startInput.env),
         spawnFn: this.options.spawnFn
       });
     } catch (cause) {
-      await cleanupMcpConfigDir(mcpConfigDir);
+      await cleanupMcpConfigDir2(mcpConfigDir);
       throw new RuntimeExecutionFailure({
         phase: "start",
         category: "infrastructure",
@@ -1844,7 +1984,7 @@ var ClaudeAdapter = class {
       client.writeUserMessage(startInput.instruction);
     } catch (cause) {
       client.kill();
-      await cleanupMcpConfigDir(mcpConfigDir);
+      await cleanupMcpConfigDir2(mcpConfigDir);
       throw new RuntimeExecutionFailure({
         phase: "start",
         category: "infrastructure",
@@ -1857,7 +1997,7 @@ var ClaudeAdapter = class {
       sessionRef = await client.waitForInit();
     } catch (err) {
       client.kill();
-      await cleanupMcpConfigDir(mcpConfigDir);
+      await cleanupMcpConfigDir2(mcpConfigDir);
       if (isRuntimeExecutionFailure(err)) throw err;
       throw new RuntimeExecutionFailure({
         phase: "start",
@@ -1868,7 +2008,7 @@ var ClaudeAdapter = class {
     }
     if (resumeSessionId !== void 0 && sessionRef !== resumeSessionId) {
       client.kill();
-      await cleanupMcpConfigDir(mcpConfigDir);
+      await cleanupMcpConfigDir2(mcpConfigDir);
       throw new RuntimeExecutionFailure({
         phase: "start",
         category: "authority",
@@ -1879,7 +2019,7 @@ var ClaudeAdapter = class {
     return new ClaudeSession(
       sessionRef,
       client,
-      startInput.manifest.workspace.workspaceDir,
+      manifestCwd,
       startInput.approvalChannel,
       mcpConfigDir,
       manifestModelId
@@ -2042,7 +2182,7 @@ var ClaudeSession = class {
     if (!this.closeAttempt) {
       const attempt = (async () => {
         await this.client.dispose();
-        await cleanupMcpConfigDir(this.mcpConfigDir);
+        await cleanupMcpConfigDir2(this.mcpConfigDir);
       })();
       this.closeAttempt = attempt.catch((error) => {
         this.closeAttempt = void 0;
@@ -2225,8 +2365,8 @@ function extractArtifactEvents(changes, workspaceDir) {
     const absolutePath = typeof change.path === "string" ? change.path : void 0;
     const kind = typeof change.kind === "string" ? change.kind : void 0;
     if (!absolutePath || kind === "delete") continue;
-    const relative = path3.relative(workspaceDir, absolutePath);
-    if (relative.length === 0 || relative.startsWith("..") || path3.isAbsolute(relative)) continue;
+    const relative = path5.relative(workspaceDir, absolutePath);
+    if (relative.length === 0 || relative.startsWith("..") || path5.isAbsolute(relative)) continue;
     events.push({ type: "artifact", name: relative, contentType: guessContentType2(relative) });
   }
   return events;
@@ -2247,7 +2387,7 @@ var CONTENT_TYPE_BY_EXTENSION = {
   ".csv": "text/csv"
 };
 function guessContentType2(relativePath) {
-  return CONTENT_TYPE_BY_EXTENSION[path3.extname(relativePath).toLowerCase()] ?? "application/octet-stream";
+  return CONTENT_TYPE_BY_EXTENSION[path5.extname(relativePath).toLowerCase()] ?? "application/octet-stream";
 }
 function extractErrorMessage(rawError) {
   if (typeof rawError === "string") return rawError;
@@ -2497,9 +2637,18 @@ ${withStreams.stderr ?? ""}`);
     const queue = new AsyncQueue();
     const terminal = {};
     const recordUnmapped = makeUnmappedFrameRecorder(/* @__PURE__ */ new Map());
+    const manifestCwd = startInput.manifest.cwd;
+    if (manifestCwd === void 0) {
+      throw new RuntimeExecutionFailure({
+        phase: "start",
+        category: "authority",
+        retry: "non-retryable",
+        reason: "prepared codex operation received a manifest without a sealed cwd"
+      });
+    }
     let workspaceDir;
     try {
-      workspaceDir = await resolveRealWorkspaceDir(startInput.manifest.workspace.workspaceDir);
+      workspaceDir = await resolveRealWorkspaceDir(manifestCwd);
     } catch (cause) {
       throw new RuntimeExecutionFailure({
         phase: "start",
@@ -2534,7 +2683,7 @@ ${withStreams.stderr ?? ""}`);
       instruction: startInput.instruction,
       modelId: manifestModelId,
       policyArgs: [...policyArgs],
-      cwd: startInput.manifest.workspace.workspaceDir,
+      cwd: manifestCwd,
       env: runtimeEnv,
       spawnFn: this.options.spawnFn,
       workspaceDir,