@byok-sdk/client 0.6.0 → 0.6.1

package/dist/daemon/task-runner.d.ts

@@ -1,5 +1,7 @@
-import { type Envelope, type PermissionPolicy, type RuntimeId, type TaskOfferPayload, type TaskOfferWithToolsetsPayload } from '@byok-sdk/protocol';
+import { type AgentEgressPolicy, type Envelope, type PermissionPolicy, type RuntimeId, type TaskOfferPayload, type TaskOfferForAgentPayload, type TaskOfferForAgentWithEgressPayload, type TaskOfferWithToolsetsPayload } from '@byok-sdk/protocol';
 import { type McpToolsetConfig, type RuntimeAdapter } from '../types';
+import { AgentHomeManager, type AgentRef } from '../agent-home';
+import { AgentSessionHandoffStore, type AgentTerminalCause } from './agent-session-handoff-store';
 import { type RuntimeDisposalStage } from '../runtime-failure';
 import { type ApprovalDecision, type ApprovalOrigin, type ApprovalRegistry } from './approvals';
 import type { BlobResolver } from './blob-client';
@@ -9,6 +11,7 @@ import { type ProgressBatcherOptions } from './progress-batcher';
 import type { SessionWorkspaceStore } from './session-workspace-store';
 import type { GitWorkspaceManager, GitWorkspaceObservation } from './git-workspace';
 import type { GitWorkspaceStore, GitWorkspacePhase } from './git-workspace-store';
+import type { AgentEgressController } from './agent-egress-controller';
 /**
  * M4 Phase 3: default wait for `requestApproval` (see its own doc comment)
  * before force-resolving an unanswered out-of-band approval as a fail-closed
@@ -41,6 +44,8 @@ export declare const DEFAULT_APPROVAL_TIMEOUT_MS: number;
  * `DaemonOverrides.shutdown.taskInterruptTimeoutMs` — see `create-daemon.ts`).
  */
 export declare const DEFAULT_SHUTDOWN_INTERRUPT_TIMEOUT_MS = 5000;
+/** Bounded retry before terminal publication degrades observably. */
+export declare const AGENT_TERMINAL_EVIDENCE_MAX_ATTEMPTS = 3;
 /**
  * M4 Phase 4 (fold-in from the P3 gate): bound on how many `requestApproval`
  * calls may sit QUEUED (not yet dispatched — see that method's own doc
@@ -184,10 +189,18 @@ export interface TaskRunnerDeps {
     runtimeEnvironment?: Record<string, {
         allow?: string[];
     }>;
-    /** Validated, device-local registry keyed by wire-level logical toolset id. */
-    mcpToolsets?: ReadonlyMap<string, McpToolsetConfig>;
+    /** Reads the daemon's current validated device-local registry once per offer. */
+    getMcpToolsets?: () => ReadonlyMap<string, McpToolsetConfig>;
     permissionDefaults?: PermissionPolicy;
     workspaceRoot: string;
+    /** Strict Agent offer authority. Absent means legacy offers never resolve an Agent home. */
+    agentHome?: AgentHomeManager;
+    /** Exact host-selected policy accepted by `task.offer_for_agent_with_egress`. */
+    agentEgressPolicy?: Readonly<AgentEgressPolicy>;
+    /** Always-present projection/sanitizer consumer; it defaults to metadata-only. */
+    agentEgress?: AgentEgressController;
+    /** Durable exact-match Agent session handoff authority. */
+    agentSessionHandoffs?: AgentSessionHandoffStore;
     deviceId: string;
     send: (envelope: Envelope) => void;
     blobClient: BlobResolver;
@@ -216,6 +229,22 @@ export interface TaskRunnerDeps {
         stage: RuntimeDisposalStage;
         reason: string;
     }) => void;
+    /**
+     * Local audit signal emitted only after bounded Agent-home terminal
+     * evidence retries are exhausted. The wire terminal still proceeds so a
+     * cloud task cannot remain Claimed/Running forever behind auxiliary local
+     * storage failure.
+     */
+    onAgentTerminalEvidenceFailure?: (event: {
+        taskId: string;
+        agentRef: AgentRef;
+        runtimeId: string;
+        cwd: string;
+        cause: AgentTerminalCause;
+        reason?: string;
+        attempts: number;
+        error: string;
+    }) => void;
     /**
      * M4 Phase 3: this daemon's control-socket identity + the shared registry
      * backing the control socket's own `approvals.list`/`approvals.resolve`
@@ -337,7 +366,7 @@ export type AdmissionGuardDecision = {
     readonly reason: string;
     readonly retryable: boolean;
 };
-type AcceptedOfferPayload = TaskOfferPayload | TaskOfferWithToolsetsPayload;
+type AcceptedOfferPayload = TaskOfferPayload | TaskOfferWithToolsetsPayload | TaskOfferForAgentPayload | TaskOfferForAgentWithEgressPayload;
 /**
  * Per-connection task orchestration: offer -> (decline | prepare -> seal ->
  * claim -> prepared operation -> started) -> seq-ordered progress batches -> complete/fail/
@@ -462,6 +491,12 @@ export declare class TaskRunner {
     private stoppingOffers;
     constructor(deps: TaskRunnerDeps);
     get activeTaskCount(): number;
+    /**
+     * Transport-boundary classification for the currently active task. Legacy
+     * tasks and plain Agent-home offers are deliberately false: the additive
+     * egress contract must never reclassify their existing wire semantics.
+     */
+    usesAgentEgress(taskId: string): boolean;
     /** M5 batch-3 (workstream 2): effective `maxTaskOutputBytes` cap for this daemon — see {@link DEFAULT_MAX_TASK_OUTPUT_BYTES}'s own doc comment. */
     private get maxTaskOutputBytes();
     /**
@@ -897,6 +932,14 @@ export declare class TaskRunner {
     /** Pre-claim, fail-closed rejection (protocol §3.2) — never claims first. */
     private decline;
     private fail;
+    /**
+     * Claimed Agent failures before ActiveTask registration still carry the
+     * exact AgentRef and normally have Agent-local, fsynced terminal evidence
+     * first. A bounded storage failure degrades observably but cannot strand
+     * the already-claimed cloud task forever; the exact terminal still goes on
+     * the wire and handleOffer's finally block releases the lease.
+     */
+    private failClaimedAgent;
     /**
      * Build the optional terminal observation from facts this running daemon
      * actually has. No offered `dispatchSelection` is echoed here: it is a
@@ -908,6 +951,8 @@ export declare class TaskRunner {
      * independently known runtime, elapsed duration, or Local Agent version.
      */
     private terminalInferenceUsagePayload;
+    /** Exact Agent identity projection for claim/terminal wire payloads. */
+    private agentTerminalPayload;
     /**
      * additive-minor (`task.complete.document`): the whole daemon-side gate
      * between a configured {@link ResultDocumentExtractor} and the wire —
@@ -966,6 +1011,10 @@ export declare class TaskRunner {
     private hasResultDocumentCapability;
     private observeGit;
     private updateGitPhaseBestEffort;
+    /** Persist Agent terminal truth before wire when local storage is available. */
+    private persistAgentTerminalEvidence;
+    private retryAgentTerminalEvidence;
+    private reportAgentTerminalEvidenceFailure;
     private finish;
     private reserveSemanticTerminal;
     /** M3-B: bounded insert for `finishedTaskIds` — see its class-level doc comment and `MAX_TRACKED_TASK_IDS`. Evicts the oldest (first-inserted) entry once over cap, same idiom as `ConnectionHub.checkAndRecordDuplicate` (packages/server/src/hub.ts). */

package/dist/daemon/toolset-registry.d.ts

@@ -0,0 +1,30 @@
+import { type ToolsetId } from '@byok-sdk/protocol';
+import type { McpToolsetConfig, McpToolsetObservation, McpToolsetRegistryStatus, McpToolsetReloadReceipt } from '../types';
+export type McpToolsetConfigInput = Record<string, McpToolsetConfig> | undefined;
+export interface McpToolsetRegistrySnapshot {
+    revision: string;
+    toolsets: ReadonlyMap<string, McpToolsetConfig>;
+    configuredToolsets: readonly ToolsetId[];
+}
+export declare class McpToolsetRevisionConflictError extends Error {
+    readonly expectedRevision: string;
+    readonly actualRevision: string;
+    constructor(expectedRevision: string, actualRevision: string);
+}
+export declare class McpToolsetDefinitionRevisionConflictError extends Error {
+    readonly toolsetId: string;
+    readonly expectedRevision: string;
+    readonly actualRevision: string;
+    constructor(toolsetId: string, expectedRevision: string, actualRevision: string);
+}
+/** Single mutable owner of immutable-at-a-time device-local toolset snapshots. */
+export declare class McpToolsetRegistry {
+    private state;
+    private observations;
+    constructor(configured?: McpToolsetConfigInput);
+    snapshot(): McpToolsetRegistrySnapshot;
+    status(): McpToolsetRegistryStatus;
+    reload(configured: McpToolsetConfigInput, expectedRevision: string): McpToolsetReloadReceipt;
+    report(toolsetId: string, expectedDefinitionRevision: string, observation: McpToolsetObservation): void;
+    private statusRows;
+}

package/dist/daemon/url.d.ts

@@ -2,6 +2,27 @@
 export declare function toHttpBase(serverUrl: string): string;
 /** Derive the `/byok/ws` WebSocket URL from a configured `serverUrl`. */
 export declare function toWsUrl(serverUrl: string): string;
+/**
+ * Which route a transport diagnostic is about, in the only two fields that
+ * are safe to keep: the host (with port) and the path.
+ *
+ * Both are read off a parsed `URL` in {@link describeEndpoint}, so the
+ * redaction is STRUCTURAL rather than a scrub pass — userinfo, query and
+ * fragment are the only places a bearer token or a presigned signature ever
+ * travels in this SDK, and none of the three survive the projection onto
+ * these two fields. There is exactly one construction site, so a future
+ * diagnostic cannot accidentally reintroduce a credential-bearing component
+ * by formatting a raw URL of its own.
+ */
+export interface TransportEndpoint {
+    readonly transport: 'ws' | 'long-poll';
+    /** `URL.host` — hostname plus port when non-default. Never userinfo. */
+    readonly host: string;
+    /** `URL.pathname` — no query, no fragment. */
+    readonly path: string;
+}
+/** The single construction site for {@link TransportEndpoint} — see that interface's own doc comment for why it is the only one. */
+export declare function describeEndpoint(transport: TransportEndpoint['transport'], url: string | URL): TransportEndpoint;
 /**
  * M5: thrown by {@link assertServerUrlAllowed} — see that function's own doc
  * comment for the full allow/deny rule this names. Deliberately ONE error

package/dist/daemon/ws-transport.d.ts

@@ -1,9 +1,22 @@
 import { type CapabilityFlag, type Envelope, type RuntimeInfo, type ToolsetId } from '@byok-sdk/protocol';
+import { type TransportEndpoint } from './url';
 export type ConnectionState = 'connecting' | 'open' | 'closed' | 'degraded' | 'revoked';
-/** The WS upgrade itself was rejected with a non-101 HTTP status (e.g. 401 for an expired/invalid bearer token). Surfaced via `onConnectOutcome` so `ConnectionManager` can force a reactive token renewal before the next attempt (protocol §6.2, "reactively on 401"). */
+/**
+ * The WS upgrade itself was rejected with a non-101 HTTP status (e.g. 401 for
+ * an expired/invalid bearer token). Surfaced via `onConnectOutcome` so
+ * `ConnectionManager` can force a reactive token renewal before the next
+ * attempt (protocol §6.2, "reactively on 401").
+ *
+ * Carries the {@link TransportEndpoint} the rejected upgrade was aimed at, so
+ * a 401 in a log names WHICH server and path refused it instead of leaving
+ * the reader to guess between a stale `serverUrl` and a genuinely expired
+ * token. The endpoint's own construction is what keeps the bearer token out
+ * of this message — see {@link describeEndpoint}.
+ */
 export declare class WsUnexpectedStatusError extends Error {
     readonly status: number;
-    constructor(status: number);
+    readonly endpoint: TransportEndpoint;
+    constructor(status: number, endpoint: TransportEndpoint);
 }
 export interface BackoffOptions {
     baseMs?: number;
@@ -27,8 +40,8 @@ export interface WsTransportOptions {
     clientVersion?: string;
     /** Detected runtimes, sent on every `conn.hello` (protocol §10 gap #4/#11). */
     runtimes?: RuntimeInfo[];
-    /** Sorted logical IDs configured locally; no MCP executable definition crosses the wire. */
-    configuredToolsets?: readonly ToolsetId[];
+    /** Reads current sorted logical IDs for every hello; no executable definition crosses the wire. */
+    getConfiguredToolsets?: () => readonly ToolsetId[];
     /** The redelivery cursor to send as `conn.hello.cursor` (protocol §9) — read fresh on every connect so a value learned mid-connection is used on the next reconnect. */
     getCursor?: () => number | undefined;
     onEnvelope: (envelope: Envelope) => void;
@@ -51,13 +64,25 @@ export interface WsTransportOptions {
      * and the causing error when the attempt failed before a socket even
      * opened (e.g. `getToken()` rejecting). Used by `ConnectionManager` to
      * count consecutive failures for the long-poll fallback (protocol §8).
+     *
+     * `endpoint` names the route this attempt was aimed at (computed once per
+     * `openSocket()`, so every outcome site reports the same one) — a
+     * consecutive-failure count in a log is only actionable once it says WHICH
+     * server kept refusing.
      */
-    onConnectOutcome?: (acked: boolean, err?: unknown) => void;
+    onConnectOutcome?: (acked: boolean, err: unknown, endpoint: TransportEndpoint) => void;
     backoff?: BackoffOptions;
     liveness?: LivenessOptions;
     /** Deterministic automatic reconnect delay. Manual `connect({auto:false})` never reaches this scheduler. */
     reconnectDelayMs?: (attempt: number, baseDelayMs: number) => number;
 }
+/**
+ * One canonical authenticated capability snapshot for both transports.
+ * Long-poll sends this envelope through `POST /byok/messages`; WS sends the
+ * same shape as its opening frame. Keeping construction here prevents one
+ * transport from silently omitting a newly added daemon capability.
+ */
+export declare function createConnectionHelloEnvelope(opts: Pick<WsTransportOptions, 'deviceId' | 'productId' | 'capabilities' | 'clientVersion' | 'runtimes' | 'getConfiguredToolsets' | 'getCursor'>): Envelope;
 /**
  * The daemon's outbound-only WS connection: opens, sends `conn.hello`, waits
  * for `conn.ack`, and reconnects with capped exponential backoff + jitter on

package/dist/index.d.ts

@@ -1,4 +1,9 @@
-export type { RuntimeAdapter, RuntimeAdapterDescriptor, RuntimeAdapterPrepareInput, RuntimeAdapterPrepareResult, RuntimeAdapterRejectedOperation, RuntimeAdapterPreparedOperation, PreparedRuntimeOperation, RuntimeOperationManifest, RuntimeOperationStartInput, RuntimeCapabilities, RuntimeDetectResult, Session, GitWorkspaceConfig, McpStdioServerConfig, McpToolsetConfig, } from './types';
+export type { RuntimeAdapter, RuntimeAdapterDescriptor, RuntimeAdapterPrepareInput, RuntimeAdapterPrepareResult, RuntimeAdapterRejectedOperation, RuntimeAdapterPreparedOperation, PreparedRuntimeOperation, RuntimeOperationManifest, RuntimeOperationStartInput, RuntimeCapabilities, RuntimeDetectResult, Session, GitWorkspaceConfig, McpStdioServerConfig, McpToolsetConfig, McpToolsetLifecycleState, McpToolsetObservation, McpToolsetStatus, McpToolsetRegistryStatus, McpToolsetReloadReceipt, AgentEgressPolicy, } from './types';
+export type { AgentRef } from './agent-home';
+export { AgentHomeError, AgentRefValidationError, AgentHomeResolutionError, AgentHomeCollisionError, AgentHomeBusyError, AgentHomeLeaseCorruptError, AgentHomeLayout, AgentHomeLeaseManager, AgentHomeManager, createAgentHomeProjection, stableAgentHomeOwnerId, validateAgentRef, } from './agent-home';
+export { AgentSessionHandoffStore, AgentSessionHandoffStoreError, AgentSessionHandoffCorruptError, AgentSessionHandoffMismatchError, } from './daemon/agent-session-handoff-store';
+export type { AgentSessionHandoff, AgentSessionHandoffMatch, AgentTaskTerminalEvidence, AgentTaskTerminalMatch, AgentTerminalCause, } from './daemon/agent-session-handoff-store';
+export type { AgentHomeResolution, AgentHomeProjection, AgentHomeProjectionInput, AgentHomeProjectionFunction, AgentHomeLease, AgentHomeBinding, } from './agent-home';
 export { PolicyUnsupportedError, SteerUnsupportedError, freezeRuntimeAdapterDescriptor, sealRuntimeOperationManifest } from './types';
 export type { RuntimeEnvironmentRequirements } from './daemon/environment';
 export { resolveLocalAgentReleaseIdentity } from './release-identity';
@@ -10,7 +15,12 @@ export type { GitWorkspaceObservation, GitWorkspaceLease, GitWorkspaceOptions, G
 export { GitWorkspaceStore } from './daemon/git-workspace-store';
 export type { GitWorkspaceLedger, GitWorkspaceLedgerRecord, GitWorkspacePhase } from './daemon/git-workspace-store';
 export { createDaemon, createDaemonWithAdapters } from './daemon/create-daemon';
-export type { Daemon, DaemonConfig, DaemonStatus, DaemonOverrides, DaemonBranding, HostedJournalConfig, DeviceAssertionConfig } from './daemon/create-daemon';
+export type { Daemon, DaemonConfig, DaemonStatus, DaemonOverrides, DaemonBranding, HostedJournalConfig, DeviceAssertionConfig, AgentEgressConfig, AgentContentReadConfig, AgentContentReadSurfaceConfig, AgentReliableEgressInput, } from './daemon/create-daemon';
+export type { AgentEgressDropReceipt, AgentEgressLaneStatus, AgentEgressStatus, } from './daemon/agent-egress-policy';
+export type { AgentEgressSanitizer, AgentEgressSanitizerContext } from './daemon/agent-egress-sanitizer';
+export { AGENT_CONTENT_READ_CAPABILITIES, AGENT_CONTENT_READ_CAPABILITY_WORKSPACE, AGENT_CONTENT_READ_CAPABILITY_TRANSCRIPT, AGENT_CONTENT_READ_CAPABILITY_ARTIFACT, } from './daemon/agent-content-read';
+export type { AgentContentReadSurface, AgentContentReadDecision, AgentContentReadReason, AgentContentReadRoot, AgentContentReadPolicy, AgentContentReadPolicySelection, AgentContentReadRequest, AgentContentReadResult, AgentContentReadAllowed, AgentContentReadDenied, AgentContentSessionIdentity, AgentContentAuditReceipt, } from './daemon/agent-content-read';
+export { McpToolsetRevisionConflictError, McpToolsetDefinitionRevisionConflictError, } from './daemon/toolset-registry';
 export type { ProgressBatcherOptions } from './daemon/progress-batcher';
 /**
  * Plan `device-assertion-broker`: the ONLY control-socket capability this