@byok-sdk/client 0.5.0 → 0.6.1

package/dist/daemon/create-daemon.d.ts

@@ -1,6 +1,9 @@
-import type { RuntimeId } from '@byok-sdk/protocol';
+import type { AgentEgressPolicy, RuntimeId } from '@byok-sdk/protocol';
 import type { PermissionPolicy } from '@byok-sdk/protocol';
-import type { RuntimeAdapter, GitWorkspaceConfig, McpToolsetConfig } from '../types';
+import type { RuntimeAdapter, GitWorkspaceConfig, McpToolsetConfig, McpToolsetObservation, McpToolsetRegistryStatus, McpToolsetReloadReceipt } from '../types';
+import { type AgentHomeProjection } from '../agent-home';
+import type { AgentRef } from '../agent-home';
+import { type LocalAgentReleaseIdentity } from '../release-identity';
 import type { BackoffOptions, LivenessOptions } from './ws-transport';
 import { type OperationalHealthSnapshot } from './operational-health';
 import { type DaemonEventListener, type DaemonTaskInfo, type Unsubscribe } from './observer';
@@ -12,6 +15,10 @@ import { type JournalOpenFaultSeam } from './journal/sqlite-support';
 import { LocalStoragePressureEngine, type LocalStoragePolicyInput } from './journal/storage-policy';
 import { type ResultDocumentExtractor } from './task-runner';
 import { type ProgressBatcherOptions } from './progress-batcher';
+import { type AgentEgressReliableAppendResult } from './agent-egress-controller';
+import { type AgentEgressStatus } from './agent-egress-policy';
+import { type AgentEgressSanitizer } from './agent-egress-sanitizer';
+import { type AgentContentReadRoot } from './agent-content-read';
 /**
  * Optional white-label product display info — purely opaque passthrough
  * (never interpreted, validated, or rendered by the daemon itself). Carried
@@ -83,12 +90,34 @@ export interface HostedJournalConfig {
     storagePolicy?: LocalStoragePolicyInput;
 }
 export interface DaemonConfig {
+    /** Distribution-owned application release; observability only, never a protocol/capability gate. */
+    localAgentRelease: LocalAgentReleaseIdentity;
     productName: string;
     productId: string;
     serverUrl: string;
     deviceName?: string;
     workspaceRoot: string;
-    /** Disabled by default. Enables local-only Git checkpoint repositories. */
+    /**
+     * Strict Agent execution boundary. The host selects one absolute branded
+     * storage root; the SDK alone composes `agents/<agentId>`, initializes the
+     * durable home, and binds it as runtime cwd. `projection` may write opaque,
+     * redacted host content into the canonical home supplied by the SDK.
+     */
+    agentHome?: {
+        hostStorageRoot: string;
+        projection?: AgentHomeProjection;
+    };
+    /**
+     * Explicit Agent-local/cloud egress selection. Omission still enforces the
+     * SDK metadata/status projection, but does not advertise or admit the new
+     * policy/reliable protocol surface.
+     */
+    agentEgress?: AgentEgressConfig;
+    /**
+     * Disabled by default. Enables local-only Git checkpoint repositories for
+     * legacy task workspaces. Mutually exclusive with `agentHome`: strict Agent
+     * execution has one canonical workspace authority.
+     */
     gitWorkspace?: GitWorkspaceConfig;
     /** Disabled by default. Enables the durable local task journal — see {@link HostedJournalConfig}. */
     hostedJournal?: HostedJournalConfig;
@@ -317,6 +346,45 @@ export interface DaemonConfig {
      */
     deviceAssertion?: DeviceAssertionConfig;
 }
+export interface AgentEgressConfig {
+    /** Authenticated deployment tenant bound into every local reliable record. */
+    tenantId: string;
+    /** Exact policy the daemon is willing to consume from an Agent offer. */
+    policy: AgentEgressPolicy;
+    /** Named redaction hook for explicit contentful trajectory only. */
+    sanitizer?: AgentEgressSanitizer;
+    /**
+     * Device-local additions required to make one server-selected transfer
+     * policy executable. These values only supplement `policy.transfers`: a
+     * locally configured surface never enables a server-disabled transfer, and
+     * cannot widen its maxBytes or MIME authority.
+     */
+    contentRead?: AgentContentReadConfig;
+}
+/** Local root and text handling authority for one independently-gated surface. */
+export interface AgentContentReadSurfaceConfig {
+    readonly root: AgentContentReadRoot;
+    readonly maxTextBytes: number;
+    readonly textMimeTypes: readonly string[];
+    readonly sensitiveNames?: readonly string[];
+}
+/**
+ * Host-local portions of the content-read contract. The audit ledger has no
+ * host path option: SDK composition fixes it per Agent home.
+ */
+export interface AgentContentReadConfig {
+    readonly workspace?: AgentContentReadSurfaceConfig;
+    readonly transcript?: AgentContentReadSurfaceConfig;
+    readonly artifact?: AgentContentReadSurfaceConfig;
+    readonly runtimeAllowlistedRoots?: readonly string[];
+}
+export interface AgentReliableEgressInput {
+    agentRef: AgentRef;
+    sessionRef: string;
+    payload: unknown;
+    taskId?: string;
+    eventId?: string;
+}
 /**
  * Plan `device-assertion-broker`. Two fields, both about what this daemon will
  * refuse.
@@ -366,6 +434,8 @@ export interface PresenceConfig {
     minimumIntervalMs?: number;
 }
 export interface DaemonStatus {
+    /** Process-immutable Local Agent application release captured at construction. */
+    localAgentRelease: Readonly<LocalAgentReleaseIdentity>;
     paired: boolean;
     connected: boolean;
     /** True once the connection has fallen back to long-poll (protocol §8) — transport info only (finding F6): long-poll is a full transport, so work still proceeds normally while this holds; outbound envelopes POST to /byok/messages instead of going out over WS. */
@@ -378,12 +448,22 @@ export interface DaemonStatus {
     branding?: DaemonBranding;
     /** Local lifecycle/retry budget, separate from transport fallback state. */
     operationalHealth: OperationalHealthSnapshot;
+    /** Redacted, content-addressed device-local MCP registry status. */
+    toolsets: McpToolsetRegistryStatus;
+    /** Content-free egress lane watermarks and typed last-drop facts. */
+    egress: AgentEgressStatus;
 }
 export interface Daemon {
     pair(pairingCode: string): Promise<DeviceRecord>;
     start(): Promise<void>;
     stop(): Promise<void>;
     status(): DaemonStatus;
+    /** Append one sanitized reliable record before its first transport attempt. */
+    publishReliableAgentEgress?(input: AgentReliableEgressInput): Promise<AgentEgressReliableAppendResult>;
+    /** Atomically replace the local registry when its current revision matches. */
+    reloadMcpToolsets(mcpToolsets: Record<string, McpToolsetConfig> | undefined, expectedRevision: string): McpToolsetReloadReceipt;
+    /** Record one explicit host-owned lifecycle observation for a configured toolset. */
+    reportMcpToolsetObservation(toolsetId: string, expectedDefinitionRevision: string, observation: McpToolsetObservation): void;
     /**
      * M3-2a: local observability — subscribe to live `DaemonEvent`s (task
      * feed, connection/pairing state changes, runtime-detection results) as

package/dist/daemon/long-poll-transport.d.ts

@@ -1,5 +1,33 @@
 import { type Envelope } from '@byok-sdk/protocol';
 import { AuthManager } from './auth-manager';
+import { type TransportEndpoint } from './url';
+/**
+ * A long-poll request failed in a way that today told the caller only
+ * `false`/"retry in 2s" — this names WHICH of the transport's two routes it
+ * was and what the server said, so a stuck fallback loop is diagnosable
+ * without a packet capture.
+ *
+ * Scope (review finding — honest attribution): this type represents ONLY an
+ * actual route request/response cycle failing. Anything that happens BEFORE
+ * the request exists — in practice credential acquisition
+ * (`AuthManager.getValidAccessToken`) — is not a route failure and is never
+ * reported as one; neither is {@link DeviceRevokedError}, which is a device
+ * lifecycle fact rather than something the route did. See
+ * `LongPollClient.loop`/`postBatch` for where that boundary is drawn.
+ *
+ * `status` is the HTTP status of the response the route produced, INCLUDING
+ * the case where the response arrived intact and its body then failed to read
+ * or parse (a 200 whose payload is malformed is still a 200 — the parse error
+ * rides in `cause`). `undefined` means no response was ever produced: the
+ * `fetch` itself rejected (DNS/TLS/connection failure, abort). The underlying
+ * error is kept in `cause` rather than flattened into the message, so nothing
+ * about the original failure is lost.
+ */
+export declare class LongPollRouteError extends Error {
+    readonly endpoint: TransportEndpoint;
+    readonly status: number | undefined;
+    constructor(endpoint: TransportEndpoint, status: number | undefined, cause: unknown);
+}
 export interface LongPollClientOptions {
     serverUrl: string;
     auth: AuthManager;
@@ -131,7 +159,39 @@ export declare class LongPollClient {
      * eviction bookkeeping for a case this unlikely.
      */
     private readonly warnedValidationFailureSeqs;
+    /**
+     * `path:status` keys this loop has already warned about — same one-warn-per-key
+     * discipline (and same rare-path soft-cap reset) as
+     * {@link warnedValidationFailureSeqs}, and for the same reason: an
+     * unreachable or misconfigured route fails again every `retryDelayMs` (2s
+     * by default) for as long as the fallback is engaged, so an unguarded warn
+     * would bury every other line in the log within a minute. Keyed by route
+     * AND status so a route that starts failing differently (503 -> 401) still
+     * warns once for the new condition.
+     */
+    private readonly warnedRouteFailures;
+    /**
+     * Both routes this transport can fail against, built once (see
+     * {@link describeEndpoint} for why constructing them in one place is what
+     * keeps credentials out of every diagnostic derived from them).
+     */
+    private readonly eventsEndpoint;
+    private readonly messagesEndpoint;
     constructor(opts: LongPollClientOptions);
+    /**
+     * One warn per `path:status`, carrying the typed {@link LongPollRouteError}
+     * as the second argument so a caller inspecting the log (or a test) reads
+     * the route off the error rather than re-parsing the message.
+     */
+    private warnRouteFailure;
+    /**
+     * {@link DeviceRevokedError} is a device lifecycle fact, not a route
+     * failure: it stops this loop outright (retrying cannot help) and is
+     * deliberately reported through `onRevoked` ONLY — never additionally as a
+     * {@link LongPollRouteError}. Returns whether the error was that case, so
+     * each call site can skip its route-failure warn for it.
+     */
+    private noteRevoked;
     start(): void;
     stop(): void;
     /**

package/dist/daemon/presence-publisher.d.ts

@@ -24,7 +24,7 @@
  * publisher permanently — there is no recourse but a fresh `pair()`, so
  * retrying would be a pure spin.
  */
-import { type ToolsetId } from '@byok-sdk/protocol';
+import { type RuntimeInfo, type ToolsetId } from '@byok-sdk/protocol';
 import type { AuthManager } from './auth-manager';
 /**
  * Client-side defaults, chosen against the hosted defaults
@@ -57,8 +57,14 @@ export declare function assertPresenceHeartbeatCadence(cadence: {
 export interface PresencePublisherOptions {
     serverUrl: string;
     auth: AuthManager;
-    /** Sorted logical IDs only. Executable MCP definitions and credentials remain device-local. */
-    configuredToolsets?: readonly ToolsetId[];
+    /** Reads current sorted logical IDs only; executable definitions and credentials remain device-local. */
+    getConfiguredToolsets?: () => readonly ToolsetId[];
+    /** U4a Local Agent release version; never inferred from the host package. */
+    clientVersion?: string;
+    /** The same runtime/auth snapshot sent in `conn.hello`. */
+    runtimes?: readonly RuntimeInfo[];
+    /** The same protocol-version snapshot sent in `conn.hello`. */
+    protocolVersions?: readonly number[];
     /** Heartbeat cadence. Must sit strictly between {@link PresencePublisherOptions.minimumIntervalMs} and {@link PresencePublisherOptions.ttlMs}. */
     intervalMs?: number;
     /** The deployment's presence hint TTL, as this daemon understands it. Only used to validate the cadence. */

package/dist/daemon/task-runner.d.ts

@@ -1,13 +1,17 @@
-import { type Envelope, type PermissionPolicy, type RuntimeId, type TaskOfferPayload, type TaskOfferWithToolsetsPayload } from '@byok-sdk/protocol';
+import { type AgentEgressPolicy, type Envelope, type PermissionPolicy, type RuntimeId, type TaskOfferPayload, type TaskOfferForAgentPayload, type TaskOfferForAgentWithEgressPayload, type TaskOfferWithToolsetsPayload } from '@byok-sdk/protocol';
 import { type McpToolsetConfig, type RuntimeAdapter } from '../types';
+import { AgentHomeManager, type AgentRef } from '../agent-home';
+import { AgentSessionHandoffStore, type AgentTerminalCause } from './agent-session-handoff-store';
 import { type RuntimeDisposalStage } from '../runtime-failure';
 import { type ApprovalDecision, type ApprovalOrigin, type ApprovalRegistry } from './approvals';
 import type { BlobResolver } from './blob-client';
 import type { TaskQueueWatermark } from './control-protocol';
+import type { LocalAgentReleaseIdentity } from '../release-identity';
 import { type ProgressBatcherOptions } from './progress-batcher';
 import type { SessionWorkspaceStore } from './session-workspace-store';
 import type { GitWorkspaceManager, GitWorkspaceObservation } from './git-workspace';
 import type { GitWorkspaceStore, GitWorkspacePhase } from './git-workspace-store';
+import type { AgentEgressController } from './agent-egress-controller';
 /**
  * M4 Phase 3: default wait for `requestApproval` (see its own doc comment)
  * before force-resolving an unanswered out-of-band approval as a fail-closed
@@ -40,6 +44,8 @@ export declare const DEFAULT_APPROVAL_TIMEOUT_MS: number;
  * `DaemonOverrides.shutdown.taskInterruptTimeoutMs` — see `create-daemon.ts`).
  */
 export declare const DEFAULT_SHUTDOWN_INTERRUPT_TIMEOUT_MS = 5000;
+/** Bounded retry before terminal publication degrades observably. */
+export declare const AGENT_TERMINAL_EVIDENCE_MAX_ATTEMPTS = 3;
 /**
  * M4 Phase 4 (fold-in from the P3 gate): bound on how many `requestApproval`
  * calls may sit QUEUED (not yet dispatched — see that method's own doc
@@ -183,10 +189,18 @@ export interface TaskRunnerDeps {
     runtimeEnvironment?: Record<string, {
         allow?: string[];
     }>;
-    /** Validated, device-local registry keyed by wire-level logical toolset id. */
-    mcpToolsets?: ReadonlyMap<string, McpToolsetConfig>;
+    /** Reads the daemon's current validated device-local registry once per offer. */
+    getMcpToolsets?: () => ReadonlyMap<string, McpToolsetConfig>;
     permissionDefaults?: PermissionPolicy;
     workspaceRoot: string;
+    /** Strict Agent offer authority. Absent means legacy offers never resolve an Agent home. */
+    agentHome?: AgentHomeManager;
+    /** Exact host-selected policy accepted by `task.offer_for_agent_with_egress`. */
+    agentEgressPolicy?: Readonly<AgentEgressPolicy>;
+    /** Always-present projection/sanitizer consumer; it defaults to metadata-only. */
+    agentEgress?: AgentEgressController;
+    /** Durable exact-match Agent session handoff authority. */
+    agentSessionHandoffs?: AgentSessionHandoffStore;
     deviceId: string;
     send: (envelope: Envelope) => void;
     blobClient: BlobResolver;
@@ -215,6 +229,22 @@ export interface TaskRunnerDeps {
         stage: RuntimeDisposalStage;
         reason: string;
     }) => void;
+    /**
+     * Local audit signal emitted only after bounded Agent-home terminal
+     * evidence retries are exhausted. The wire terminal still proceeds so a
+     * cloud task cannot remain Claimed/Running forever behind auxiliary local
+     * storage failure.
+     */
+    onAgentTerminalEvidenceFailure?: (event: {
+        taskId: string;
+        agentRef: AgentRef;
+        runtimeId: string;
+        cwd: string;
+        cause: AgentTerminalCause;
+        reason?: string;
+        attempts: number;
+        error: string;
+    }) => void;
     /**
      * M4 Phase 3: this daemon's control-socket identity + the shared registry
      * backing the control socket's own `approvals.list`/`approvals.resolve`
@@ -226,6 +256,14 @@ export interface TaskRunnerDeps {
     approvalRegistry: ApprovalRegistry;
     storeDir: string;
     productId: string;
+    /**
+     * The already-resolved, process-immutable U4a Local Agent release identity.
+     * `TaskRunner` only consumes this value; it never creates, normalizes, or
+     * revalidates a second version authority. It remains optional for direct
+     * internal harnesses and old embedders: absence omits terminal usage rather
+     * than fabricating a client version.
+     */
+    localAgentRelease?: Readonly<LocalAgentReleaseIdentity>;
     /** Default `requestApproval` timeout — see {@link DEFAULT_APPROVAL_TIMEOUT_MS}. */
     approvalTimeoutMs?: number;
     /**
@@ -328,7 +366,7 @@ export type AdmissionGuardDecision = {
     readonly reason: string;
     readonly retryable: boolean;
 };
-type AcceptedOfferPayload = TaskOfferPayload | TaskOfferWithToolsetsPayload;
+type AcceptedOfferPayload = TaskOfferPayload | TaskOfferWithToolsetsPayload | TaskOfferForAgentPayload | TaskOfferForAgentWithEgressPayload;
 /**
  * Per-connection task orchestration: offer -> (decline | prepare -> seal ->
  * claim -> prepared operation -> started) -> seq-ordered progress batches -> complete/fail/
@@ -453,6 +491,12 @@ export declare class TaskRunner {
     private stoppingOffers;
     constructor(deps: TaskRunnerDeps);
     get activeTaskCount(): number;
+    /**
+     * Transport-boundary classification for the currently active task. Legacy
+     * tasks and plain Agent-home offers are deliberately false: the additive
+     * egress contract must never reclassify their existing wire semantics.
+     */
+    usesAgentEgress(taskId: string): boolean;
     /** M5 batch-3 (workstream 2): effective `maxTaskOutputBytes` cap for this daemon — see {@link DEFAULT_MAX_TASK_OUTPUT_BYTES}'s own doc comment. */
     private get maxTaskOutputBytes();
     /**
@@ -888,6 +932,27 @@ export declare class TaskRunner {
     /** Pre-claim, fail-closed rejection (protocol §3.2) — never claims first. */
     private decline;
     private fail;
+    /**
+     * Claimed Agent failures before ActiveTask registration still carry the
+     * exact AgentRef and normally have Agent-local, fsynced terminal evidence
+     * first. A bounded storage failure degrades observably but cannot strand
+     * the already-claimed cloud task forever; the exact terminal still goes on
+     * the wire and handleOffer's finally block releases the lease.
+     */
+    private failClaimedAgent;
+    /**
+     * Build the optional terminal observation from facts this running daemon
+     * actually has. No offered `dispatchSelection` is echoed here: it is a
+     * requested execution target, not an adapter-reported provider/model fact.
+     * The bundled adapter event contracts currently expose token observations
+     * (Codex and Claude) but no provider/model observation, so those keys stay
+     * absent. Pi exposes no native usage observation, so its terminal payload
+     * omits this optional block rather than fabricating a usage observation from
+     * independently known runtime, elapsed duration, or Local Agent version.
+     */
+    private terminalInferenceUsagePayload;
+    /** Exact Agent identity projection for claim/terminal wire payloads. */
+    private agentTerminalPayload;
     /**
      * additive-minor (`task.complete.document`): the whole daemon-side gate
      * between a configured {@link ResultDocumentExtractor} and the wire —
@@ -946,6 +1011,10 @@ export declare class TaskRunner {
     private hasResultDocumentCapability;
     private observeGit;
     private updateGitPhaseBestEffort;
+    /** Persist Agent terminal truth before wire when local storage is available. */
+    private persistAgentTerminalEvidence;
+    private retryAgentTerminalEvidence;
+    private reportAgentTerminalEvidenceFailure;
     private finish;
     private reserveSemanticTerminal;
     /** M3-B: bounded insert for `finishedTaskIds` — see its class-level doc comment and `MAX_TRACKED_TASK_IDS`. Evicts the oldest (first-inserted) entry once over cap, same idiom as `ConnectionHub.checkAndRecordDuplicate` (packages/server/src/hub.ts). */

package/dist/daemon/toolset-registry.d.ts

@@ -0,0 +1,30 @@
+import { type ToolsetId } from '@byok-sdk/protocol';
+import type { McpToolsetConfig, McpToolsetObservation, McpToolsetRegistryStatus, McpToolsetReloadReceipt } from '../types';
+export type McpToolsetConfigInput = Record<string, McpToolsetConfig> | undefined;
+export interface McpToolsetRegistrySnapshot {
+    revision: string;
+    toolsets: ReadonlyMap<string, McpToolsetConfig>;
+    configuredToolsets: readonly ToolsetId[];
+}
+export declare class McpToolsetRevisionConflictError extends Error {
+    readonly expectedRevision: string;
+    readonly actualRevision: string;
+    constructor(expectedRevision: string, actualRevision: string);
+}
+export declare class McpToolsetDefinitionRevisionConflictError extends Error {
+    readonly toolsetId: string;
+    readonly expectedRevision: string;
+    readonly actualRevision: string;
+    constructor(toolsetId: string, expectedRevision: string, actualRevision: string);
+}
+/** Single mutable owner of immutable-at-a-time device-local toolset snapshots. */
+export declare class McpToolsetRegistry {
+    private state;
+    private observations;
+    constructor(configured?: McpToolsetConfigInput);
+    snapshot(): McpToolsetRegistrySnapshot;
+    status(): McpToolsetRegistryStatus;
+    reload(configured: McpToolsetConfigInput, expectedRevision: string): McpToolsetReloadReceipt;
+    report(toolsetId: string, expectedDefinitionRevision: string, observation: McpToolsetObservation): void;
+    private statusRows;
+}

package/dist/daemon/url.d.ts

@@ -2,6 +2,27 @@
 export declare function toHttpBase(serverUrl: string): string;
 /** Derive the `/byok/ws` WebSocket URL from a configured `serverUrl`. */
 export declare function toWsUrl(serverUrl: string): string;
+/**
+ * Which route a transport diagnostic is about, in the only two fields that
+ * are safe to keep: the host (with port) and the path.
+ *
+ * Both are read off a parsed `URL` in {@link describeEndpoint}, so the
+ * redaction is STRUCTURAL rather than a scrub pass — userinfo, query and
+ * fragment are the only places a bearer token or a presigned signature ever
+ * travels in this SDK, and none of the three survive the projection onto
+ * these two fields. There is exactly one construction site, so a future
+ * diagnostic cannot accidentally reintroduce a credential-bearing component
+ * by formatting a raw URL of its own.
+ */
+export interface TransportEndpoint {
+    readonly transport: 'ws' | 'long-poll';
+    /** `URL.host` — hostname plus port when non-default. Never userinfo. */
+    readonly host: string;
+    /** `URL.pathname` — no query, no fragment. */
+    readonly path: string;
+}
+/** The single construction site for {@link TransportEndpoint} — see that interface's own doc comment for why it is the only one. */
+export declare function describeEndpoint(transport: TransportEndpoint['transport'], url: string | URL): TransportEndpoint;
 /**
  * M5: thrown by {@link assertServerUrlAllowed} — see that function's own doc
  * comment for the full allow/deny rule this names. Deliberately ONE error

package/dist/daemon/ws-transport.d.ts

@@ -1,9 +1,22 @@
 import { type CapabilityFlag, type Envelope, type RuntimeInfo, type ToolsetId } from '@byok-sdk/protocol';
+import { type TransportEndpoint } from './url';
 export type ConnectionState = 'connecting' | 'open' | 'closed' | 'degraded' | 'revoked';
-/** The WS upgrade itself was rejected with a non-101 HTTP status (e.g. 401 for an expired/invalid bearer token). Surfaced via `onConnectOutcome` so `ConnectionManager` can force a reactive token renewal before the next attempt (protocol §6.2, "reactively on 401"). */
+/**
+ * The WS upgrade itself was rejected with a non-101 HTTP status (e.g. 401 for
+ * an expired/invalid bearer token). Surfaced via `onConnectOutcome` so
+ * `ConnectionManager` can force a reactive token renewal before the next
+ * attempt (protocol §6.2, "reactively on 401").
+ *
+ * Carries the {@link TransportEndpoint} the rejected upgrade was aimed at, so
+ * a 401 in a log names WHICH server and path refused it instead of leaving
+ * the reader to guess between a stale `serverUrl` and a genuinely expired
+ * token. The endpoint's own construction is what keeps the bearer token out
+ * of this message — see {@link describeEndpoint}.
+ */
 export declare class WsUnexpectedStatusError extends Error {
     readonly status: number;
-    constructor(status: number);
+    readonly endpoint: TransportEndpoint;
+    constructor(status: number, endpoint: TransportEndpoint);
 }
 export interface BackoffOptions {
     baseMs?: number;
@@ -23,10 +36,12 @@ export interface WsTransportOptions {
     deviceId: string;
     productId: string;
     capabilities: CapabilityFlag[];
+    /** U4a Local Agent release version; the sole client-version authority. */
+    clientVersion?: string;
     /** Detected runtimes, sent on every `conn.hello` (protocol §10 gap #4/#11). */
     runtimes?: RuntimeInfo[];
-    /** Sorted logical IDs configured locally; no MCP executable definition crosses the wire. */
-    configuredToolsets?: readonly ToolsetId[];
+    /** Reads current sorted logical IDs for every hello; no executable definition crosses the wire. */
+    getConfiguredToolsets?: () => readonly ToolsetId[];
     /** The redelivery cursor to send as `conn.hello.cursor` (protocol §9) — read fresh on every connect so a value learned mid-connection is used on the next reconnect. */
     getCursor?: () => number | undefined;
     onEnvelope: (envelope: Envelope) => void;
@@ -49,13 +64,25 @@ export interface WsTransportOptions {
      * and the causing error when the attempt failed before a socket even
      * opened (e.g. `getToken()` rejecting). Used by `ConnectionManager` to
      * count consecutive failures for the long-poll fallback (protocol §8).
+     *
+     * `endpoint` names the route this attempt was aimed at (computed once per
+     * `openSocket()`, so every outcome site reports the same one) — a
+     * consecutive-failure count in a log is only actionable once it says WHICH
+     * server kept refusing.
      */
-    onConnectOutcome?: (acked: boolean, err?: unknown) => void;
+    onConnectOutcome?: (acked: boolean, err: unknown, endpoint: TransportEndpoint) => void;
     backoff?: BackoffOptions;
     liveness?: LivenessOptions;
     /** Deterministic automatic reconnect delay. Manual `connect({auto:false})` never reaches this scheduler. */
     reconnectDelayMs?: (attempt: number, baseDelayMs: number) => number;
 }
+/**
+ * One canonical authenticated capability snapshot for both transports.
+ * Long-poll sends this envelope through `POST /byok/messages`; WS sends the
+ * same shape as its opening frame. Keeping construction here prevents one
+ * transport from silently omitting a newly added daemon capability.
+ */
+export declare function createConnectionHelloEnvelope(opts: Pick<WsTransportOptions, 'deviceId' | 'productId' | 'capabilities' | 'clientVersion' | 'runtimes' | 'getConfiguredToolsets' | 'getCursor'>): Envelope;
 /**
  * The daemon's outbound-only WS connection: opens, sends `conn.hello`, waits
  * for `conn.ack`, and reconnects with capped exponential backoff + jitter on

package/dist/index.d.ts

@@ -1,6 +1,13 @@
-export type { RuntimeAdapter, RuntimeAdapterDescriptor, RuntimeAdapterPrepareInput, RuntimeAdapterPrepareResult, RuntimeAdapterRejectedOperation, RuntimeAdapterPreparedOperation, PreparedRuntimeOperation, RuntimeOperationManifest, RuntimeOperationStartInput, RuntimeCapabilities, RuntimeDetectResult, Session, GitWorkspaceConfig, McpStdioServerConfig, McpToolsetConfig, } from './types';
+export type { RuntimeAdapter, RuntimeAdapterDescriptor, RuntimeAdapterPrepareInput, RuntimeAdapterPrepareResult, RuntimeAdapterRejectedOperation, RuntimeAdapterPreparedOperation, PreparedRuntimeOperation, RuntimeOperationManifest, RuntimeOperationStartInput, RuntimeCapabilities, RuntimeDetectResult, Session, GitWorkspaceConfig, McpStdioServerConfig, McpToolsetConfig, McpToolsetLifecycleState, McpToolsetObservation, McpToolsetStatus, McpToolsetRegistryStatus, McpToolsetReloadReceipt, AgentEgressPolicy, } from './types';
+export type { AgentRef } from './agent-home';
+export { AgentHomeError, AgentRefValidationError, AgentHomeResolutionError, AgentHomeCollisionError, AgentHomeBusyError, AgentHomeLeaseCorruptError, AgentHomeLayout, AgentHomeLeaseManager, AgentHomeManager, createAgentHomeProjection, stableAgentHomeOwnerId, validateAgentRef, } from './agent-home';
+export { AgentSessionHandoffStore, AgentSessionHandoffStoreError, AgentSessionHandoffCorruptError, AgentSessionHandoffMismatchError, } from './daemon/agent-session-handoff-store';
+export type { AgentSessionHandoff, AgentSessionHandoffMatch, AgentTaskTerminalEvidence, AgentTaskTerminalMatch, AgentTerminalCause, } from './daemon/agent-session-handoff-store';
+export type { AgentHomeResolution, AgentHomeProjection, AgentHomeProjectionInput, AgentHomeProjectionFunction, AgentHomeLease, AgentHomeBinding, } from './agent-home';
 export { PolicyUnsupportedError, SteerUnsupportedError, freezeRuntimeAdapterDescriptor, sealRuntimeOperationManifest } from './types';
 export type { RuntimeEnvironmentRequirements } from './daemon/environment';
+export { resolveLocalAgentReleaseIdentity } from './release-identity';
+export type { LocalAgentReleaseIdentity } from './release-identity';
 export { RuntimeExecutionFailure, RuntimeDisposalFailure, RUNTIME_ADAPTER_CONTRACT_VIOLATION_REASON, isRuntimeDisposalFailure, isRuntimeExecutionFailure, projectRuntimeBoundaryFailure, projectRuntimeExecutionFailure, } from './runtime-failure';
 export type { RuntimeExecutionFailureInput, RuntimeDisposalFailureInput, RuntimeDisposalStage, RuntimeFailureCategory, RuntimeFailurePhase, RuntimeFailureProjection, RuntimeRetryDisposition, } from './runtime-failure';
 export { GitWorkspaceManager, GitWorkspaceError, isGitWorkspaceConfig, prependGitWorkspaceGuidance } from './daemon/git-workspace';
@@ -8,7 +15,12 @@ export type { GitWorkspaceObservation, GitWorkspaceLease, GitWorkspaceOptions, G
 export { GitWorkspaceStore } from './daemon/git-workspace-store';
 export type { GitWorkspaceLedger, GitWorkspaceLedgerRecord, GitWorkspacePhase } from './daemon/git-workspace-store';
 export { createDaemon, createDaemonWithAdapters } from './daemon/create-daemon';
-export type { Daemon, DaemonConfig, DaemonStatus, DaemonOverrides, DaemonBranding, HostedJournalConfig, DeviceAssertionConfig } from './daemon/create-daemon';
+export type { Daemon, DaemonConfig, DaemonStatus, DaemonOverrides, DaemonBranding, HostedJournalConfig, DeviceAssertionConfig, AgentEgressConfig, AgentContentReadConfig, AgentContentReadSurfaceConfig, AgentReliableEgressInput, } from './daemon/create-daemon';
+export type { AgentEgressDropReceipt, AgentEgressLaneStatus, AgentEgressStatus, } from './daemon/agent-egress-policy';
+export type { AgentEgressSanitizer, AgentEgressSanitizerContext } from './daemon/agent-egress-sanitizer';
+export { AGENT_CONTENT_READ_CAPABILITIES, AGENT_CONTENT_READ_CAPABILITY_WORKSPACE, AGENT_CONTENT_READ_CAPABILITY_TRANSCRIPT, AGENT_CONTENT_READ_CAPABILITY_ARTIFACT, } from './daemon/agent-content-read';
+export type { AgentContentReadSurface, AgentContentReadDecision, AgentContentReadReason, AgentContentReadRoot, AgentContentReadPolicy, AgentContentReadPolicySelection, AgentContentReadRequest, AgentContentReadResult, AgentContentReadAllowed, AgentContentReadDenied, AgentContentSessionIdentity, AgentContentAuditReceipt, } from './daemon/agent-content-read';
+export { McpToolsetRevisionConflictError, McpToolsetDefinitionRevisionConflictError, } from './daemon/toolset-registry';
 export type { ProgressBatcherOptions } from './daemon/progress-batcher';
 /**
  * Plan `device-assertion-broker`: the ONLY control-socket capability this