@byok-sdk/client 0.6.1 → 0.8.0-beta.0

package/dist/daemon/agent-egress-controller.d.ts

@@ -49,8 +49,11 @@ export declare class AgentEgressController {
     private readonly latestStatus;
     private readonly reliableStatus;
     private readonly drops;
+    private active;
     constructor(options: AgentEgressControllerOptions);
     get policy(): Readonly<AgentEgressPolicy>;
+    /** Permanently fail closed after its authenticated enrollment is replaced. */
+    deactivate(): void;
     status(): AgentEgressStatus;
     dropReceipts(): readonly AgentEgressDropReceipt[];
     noteTransportDrop(reason: AgentEgressDropReason, agentRef?: AgentRef): void;

package/dist/daemon/create-daemon.d.ts

@@ -62,13 +62,6 @@ export interface HostedJournalConfig {
      * to a closed set instead of a re-interpretation of an existing config.
      */
     mode: 'sqlite';
-    /**
-     * The tenant every journal row on this device is scoped to (§12.7.2's
-     * minimum fact set opens with tenant/product/device). Required: a hosted
-     * daemon that cannot say which tenant its durable evidence belongs to has
-     * evidence nobody can act on.
-     */
-    tenantId: string;
     /** Bound on waiting for the journal's write lock, ms. Defaults to the journal's own bound. */
     busyTimeoutMs?: number;
     /** Per-record byte bound. Defaults to the journal's own bound; oversized records are refused, never truncated. */
@@ -347,8 +340,6 @@ export interface DaemonConfig {
     deviceAssertion?: DeviceAssertionConfig;
 }
 export interface AgentEgressConfig {
-    /** Authenticated deployment tenant bound into every local reliable record. */
-    tenantId: string;
     /** Exact policy the daemon is willing to consume from an Agent offer. */
     policy: AgentEgressPolicy;
     /** Named redaction hook for explicit contentful trajectory only. */
@@ -381,8 +372,11 @@ export interface AgentContentReadConfig {
 export interface AgentReliableEgressInput {
     agentRef: AgentRef;
     sessionRef: string;
+    /** Exact runtime identity from the durable Agent-home handoff. */
+    runtimeId: string;
+    /** Exact task identity from the same durable Agent-home handoff. */
+    taskId: string;
     payload: unknown;
-    taskId?: string;
     eventId?: string;
 }
 /**

package/dist/daemon/store.d.ts

@@ -1,6 +1,8 @@
 import { type EnsureSecureDirOptions } from '../util/secure-dir';
 export interface DeviceRecord {
     deviceId: string;
+    /** Opaque tenant binding returned by the authenticated pairing response. */
+    tenantId: string;
     /** Current access token (JWT), renewed via challenge/token without re-pairing (protocol §6.2). */
     accessToken: string;
     /** ISO-8601 expiry for `accessToken` (our best knowledge of it — see auth-manager.ts for how this is derived after `/byok/pair`, which reports no explicit expiry itself). */
@@ -10,6 +12,13 @@ export interface DeviceRecord {
     /** Ed25519 public key, base64url — re-sent verbatim on a post-revocation re-pair (protocol §6.3). */
     devicePublicKey: string;
 }
+/**
+ * A durable enrollment record cannot be used by any steady-state path. Only
+ * the explicit pair operation may replace it with a fresh authenticated row.
+ */
+export declare class DeviceRecordRePairRequiredError extends Error {
+    constructor();
+}
 /**
  * Persists the device identity issued by `pair()` — deviceId, current
  * access token + its expiry, and the device's own Ed25519 keypair. This is

package/dist/daemon/task-runner.d.ts

@@ -1,4 +1,4 @@
-import { type AgentEgressPolicy, type Envelope, type PermissionPolicy, type RuntimeId, type TaskOfferPayload, type TaskOfferForAgentPayload, type TaskOfferForAgentWithEgressPayload, type TaskOfferWithToolsetsPayload } from '@byok-sdk/protocol';
+import { type AgentEgressPolicy, type Envelope, type PermissionPolicy, type RuntimeId, type TaskOfferPayload, type TaskOfferForAgentPayload, type TaskOfferForAgentWithEgressPayload, type TaskOfferForAgentWithEgressFreshPayload, type TaskOfferWithToolsetsPayload } from '@byok-sdk/protocol';
 import { type McpToolsetConfig, type RuntimeAdapter } from '../types';
 import { AgentHomeManager, type AgentRef } from '../agent-home';
 import { AgentSessionHandoffStore, type AgentTerminalCause } from './agent-session-handoff-store';
@@ -366,7 +366,7 @@ export type AdmissionGuardDecision = {
     readonly reason: string;
     readonly retryable: boolean;
 };
-type AcceptedOfferPayload = TaskOfferPayload | TaskOfferWithToolsetsPayload | TaskOfferForAgentPayload | TaskOfferForAgentWithEgressPayload;
+type AcceptedOfferPayload = TaskOfferPayload | TaskOfferWithToolsetsPayload | TaskOfferForAgentPayload | TaskOfferForAgentWithEgressPayload | TaskOfferForAgentWithEgressFreshPayload;
 /**
  * Per-connection task orchestration: offer -> (decline | prepare -> seal ->
  * claim -> prepared operation -> started) -> seq-ordered progress batches -> complete/fail/

package/dist/index.js

@@ -1,10 +1,10 @@
 import { randomUUID, createHash, sign, createPrivateKey, generateKeyPairSync, randomBytes, timingSafeEqual, createHmac } from 'crypto';
 import { promises, mkdirSync, existsSync, renameSync, writeFileSync, chmodSync, statSync, readdirSync, linkSync, fstatSync, lstatSync, unlinkSync, constants, readFileSync, realpathSync } from 'fs';
 import path, { join, isAbsolute } from 'path';
-import { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, AgentRefSchema, BYOK_PAIR_PATH, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, byokBlobUrlPath, BYOK_BLOBS_PATH, byokBlobFinalizePath, partitionAgentEvents, BYOK_SKILL_PACKS_PATH, byokSkillPackFilePath, BYOK_RECORDS_PATH, byokRecordPath, TASK_TRANSITIONS, AgentEgressPolicySchema, CONFIGURED_TOOLSETS_MAX_ITEMS, ToolsetIdSchema, AgentContentReceiptPayloadSchema, encodeEnvelope, PROTOCOL_VERSION, createEnvelope, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, parseMessage, checkResultDocument, MAX_MESSAGES_PER_BATCH, BYOK_CAPABILITIES_PATH, BYOK_PRESENCE_PATH, RuntimeIdSchema, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, RESULT_DOCUMENT_MAX_BYTES, decodeEnvelope, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendResponseSchema, UnknownMessageTypeError, BYOK_WS_PATH } from '@byok-sdk/protocol';
+import { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, AgentRefSchema, BYOK_PAIR_PATH, PairResponseSchema, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, byokBlobUrlPath, BYOK_BLOBS_PATH, byokBlobFinalizePath, partitionAgentEvents, BYOK_SKILL_PACKS_PATH, byokSkillPackFilePath, BYOK_RECORDS_PATH, byokRecordPath, TASK_TRANSITIONS, AgentEgressPolicySchema, CONFIGURED_TOOLSETS_MAX_ITEMS, ToolsetIdSchema, AgentContentReceiptPayloadSchema, encodeEnvelope, PROTOCOL_VERSION, createEnvelope, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, parseMessage, checkResultDocument, MAX_MESSAGES_PER_BATCH, BYOK_CAPABILITIES_PATH, BYOK_PRESENCE_PATH, RuntimeIdSchema, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, RESULT_DOCUMENT_MAX_BYTES, decodeEnvelope, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendResponseSchema, UnknownMessageTypeError, BYOK_WS_PATH } from '@byok-sdk/protocol';
 import { execFile, spawn } from 'child_process';
 import os6 from 'os';
-import { parseDeviceAssertionEnvelope, tenantId, DeviceProofProtectedClaimsSchema, deviceProofSigningInput, DEVICE_PROOF_SCHEMA_ID, SKILL_PACK_MAX_BYTES, hasCapability, parseSkillPackManifest, checkSkillPackManifest, skillPackContentHashInput, checkSkillPackFileContent, SKILL_PACK_ENTRY_PATH, checkSkillPackEntry, isSkillPackPathSafe, DEVICE_PROOF_HEADER, contentHash as contentHash$1, TRUTH_RECORD_KINDS, nonceSigningBytes, DEVICE_ASSERTION_AUDIENCE_MAX_BYTES, DEVICE_ASSERTION_DEFAULT_TTL_MS, DEVICE_ASSERTION_MAX_TTL_MS, CONTENT_HASH_PATTERN, CapabilityDeclarationSchema, DeviceAssertionClaimsSchema, deviceAssertionSigningInput, DEVICE_ASSERTION_SCHEMA_ID } from '@byok-sdk/core';
+import { parseDeviceAssertionEnvelope, tenantId, DeviceProofProtectedClaimsSchema, deviceProofSigningInput, DEVICE_PROOF_SCHEMA_ID, SKILL_PACK_MAX_BYTES, hasCapability, parseSkillPackManifest, checkSkillPackManifest, skillPackContentHashInput, checkSkillPackFileContent, SKILL_PACK_ENTRY_PATH, checkSkillPackEntry, isSkillPackPathSafe, DEVICE_PROOF_HEADER, contentHash as contentHash$1, TRUTH_RECORD_KINDS, nonceSigningBytes, DEVICE_ASSERTION_AUDIENCE_MAX_BYTES, DEVICE_ASSERTION_DEFAULT_TTL_MS, DEVICE_ASSERTION_MAX_TTL_MS, CONTENT_HASH_PATTERN, isTenantId, CapabilityDeclarationSchema, DeviceAssertionClaimsSchema, deviceAssertionSigningInput, DEVICE_ASSERTION_SCHEMA_ID } from '@byok-sdk/core';
 import { promisify } from 'util';
 import { fileURLToPath } from 'url';
 import 'readline';
@@ -4683,6 +4683,13 @@ var ApprovalRegistry = class {
   }
 };
 var MAX_DEVICE_RECORD_BYTES = 256 * 1024;
+var REPAIR_REQUIRED_MESSAGE = "device enrollment record is missing or has an invalid authenticated tenant binding; re-pair required";
+var DeviceRecordRePairRequiredError = class extends Error {
+  constructor() {
+    super(REPAIR_REQUIRED_MESSAGE);
+    this.name = "DeviceRecordRePairRequiredError";
+  }
+};
 function sameInode(left, right) {
   return left.dev === right.dev && left.ino === right.ino;
 }
@@ -4692,18 +4699,32 @@ function sameFileState(left, right) {
 function sameContentState(left, right) {
   return sameInode(left, right) && left.size === right.size && left.mtimeNs === right.mtimeNs;
 }
+function assertDeviceRecord(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new DeviceRecordRePairRequiredError();
+  }
+  const parsed = value;
+  if (typeof parsed.deviceId === "string" && isTenantId(parsed.tenantId) && typeof parsed.accessToken === "string" && typeof parsed.expiresAt === "string" && typeof parsed.devicePrivateKeyPem === "string" && typeof parsed.devicePublicKey === "string") {
+    return;
+  }
+  throw new DeviceRecordRePairRequiredError();
+}
 function parseDeviceRecord(raw) {
-  const parsed = JSON.parse(raw);
-  if (typeof parsed.deviceId === "string" && typeof parsed.accessToken === "string" && typeof parsed.expiresAt === "string" && typeof parsed.devicePrivateKeyPem === "string" && typeof parsed.devicePublicKey === "string") {
-    return {
-      deviceId: parsed.deviceId,
-      accessToken: parsed.accessToken,
-      expiresAt: parsed.expiresAt,
-      devicePrivateKeyPem: parsed.devicePrivateKeyPem,
-      devicePublicKey: parsed.devicePublicKey
-    };
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new DeviceRecordRePairRequiredError();
   }
-  return void 0;
+  assertDeviceRecord(parsed);
+  return {
+    deviceId: parsed.deviceId,
+    tenantId: parsed.tenantId,
+    accessToken: parsed.accessToken,
+    expiresAt: parsed.expiresAt,
+    devicePrivateKeyPem: parsed.devicePrivateKeyPem,
+    devicePublicKey: parsed.devicePublicKey
+  };
 }
 var DeviceStore = class _DeviceStore {
   /**
@@ -4773,6 +4794,7 @@ var DeviceStore = class _DeviceStore {
     }
   }
   async save(record) {
+    assertDeviceRecord(record);
     const storeDir = path.dirname(this.filePath);
     await ensureSecureDir(storeDir, this.secureDirOptions);
     await atomicWriteFile(this.filePath, JSON.stringify(record, null, 2), { mode: 384 });
@@ -4943,7 +4965,14 @@ var AuthManager = class {
     this.proactiveTimer = void 0;
     try {
       return await this.runCredentialMutation(async () => {
-        const existing = this.record ?? await this.opts.store.load();
+        let existing = this.record;
+        if (!existing) {
+          try {
+            existing = await this.opts.store.load();
+          } catch (error) {
+            if (!(error instanceof DeviceRecordRePairRequiredError)) throw error;
+          }
+        }
         const keyPair = existing ? { privateKey: importPrivateKeyPem(existing.devicePrivateKeyPem), publicKeyBase64Url: existing.devicePublicKey } : generateDeviceKeyPair();
         const url = new URL(BYOK_PAIR_PATH, toHttpBase(this.opts.serverUrl));
         const res = await fetch(url, {
@@ -4958,9 +4987,10 @@ var AuthManager = class {
         if (!res.ok) {
           throw new Error(`pairing failed: HTTP ${res.status} ${await safeErrorText(res)}`.trimEnd());
         }
-        const body = await res.json();
+        const body = PairResponseSchema.parse(await res.json());
         const record = {
           deviceId: body.deviceId,
+          tenantId: body.tenantId,
           accessToken: body.accessToken,
           expiresAt: resolvePairExpiry(body.refreshHint),
           devicePrivateKeyPem: exportPrivateKeyPem(keyPair.privateKey),
@@ -9797,6 +9827,11 @@ function offeredAgentRef(payload) {
   if (!Object.prototype.hasOwnProperty.call(payload, "agentRef")) return void 0;
   return validateAgentRef(payload.agentRef);
 }
+function offeredSessionRef(payload) {
+  if (!Object.prototype.hasOwnProperty.call(payload, "sessionRef")) return void 0;
+  const value = payload.sessionRef;
+  return typeof value === "string" ? value : void 0;
+}
 function errorMessage4(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -10165,6 +10200,9 @@ var TaskRunner = class {
       case "task.offer_for_agent_with_egress":
         await this.handleOffer(envelope.task_id, envelope.payload, true);
         return;
+      case "task.offer_for_agent_with_egress_fresh":
+        await this.handleOffer(envelope.task_id, envelope.payload, true);
+        return;
       case "task.cancel":
         await this.handleCancel(envelope.task_id, envelope.payload.reason);
         return;
@@ -10206,6 +10244,7 @@ var TaskRunner = class {
     const decline = (reason, retryable) => {
       this.decline(taskId, reason, retryable, agentRef);
     };
+    const sessionRef = offeredSessionRef(payload);
     if ("egressPolicy" in payload) {
       if (this.deps.agentEgressPolicy === void 0 || !sameEgressPolicy(this.deps.agentEgressPolicy, payload.egressPolicy)) {
         decline("Agent egress offer policy is not exactly enabled by this daemon", false);
@@ -10307,11 +10346,11 @@ var TaskRunner = class {
       let plainWorkspaceNeedsResolve = false;
       if (agentBinding !== void 0) {
         workspaceDir = agentBinding.lease.cwd;
-        if (payload.sessionRef !== void 0) {
+        if (sessionRef !== void 0) {
           try {
             await this.deps.agentSessionHandoffs.requireMatch({
               agentRef: agentBinding.resolution.agentRef,
-              sessionRef: payload.sessionRef,
+              sessionRef,
               runtimeId: pick.descriptor.id,
               cwd: workspaceDir
             });
@@ -10333,15 +10372,15 @@ var TaskRunner = class {
           return;
         }
       } else if (this.deps.gitWorkspaceManager && this.deps.gitWorkspaceStore) {
-        known = payload.sessionRef ? await this.deps.sessionWorkspaces.get(payload.sessionRef) : void 0;
+        known = sessionRef ? await this.deps.sessionWorkspaces.get(sessionRef) : void 0;
         const gitManager = this.deps.gitWorkspaceManager;
         const gitStore = this.deps.gitWorkspaceStore;
-        if (payload.sessionRef) {
-          const ledger = await gitStore.findBySessionAnyPhase(payload.sessionRef).catch(() => void 0);
+        if (sessionRef) {
+          const ledger = await gitStore.findBySessionAnyPhase(sessionRef).catch(() => void 0);
           const sameProtocolTask = ledger?.taskId === taskId;
           const interruptedOldTask = ledger?.phase === "interrupted" && sameProtocolTask;
           const activeDifferentTask = ledger !== void 0 && ledger.taskId !== taskId && (ledger.phase === "preparing" || ledger.phase === "active");
-          if (!known || known.workspaceKind !== "git" || !known.gitWorkspaceId || !ledger || ledger.workspaceId !== known.gitWorkspaceId || ledger.sessionRef !== payload.sessionRef || path.resolve(ledger.workspaceDir) !== path.resolve(known.workspaceDir) || interruptedOldTask || activeDifferentTask) {
+          if (!known || known.workspaceKind !== "git" || !known.gitWorkspaceId || !ledger || ledger.workspaceId !== known.gitWorkspaceId || ledger.sessionRef !== sessionRef || path.resolve(ledger.workspaceDir) !== path.resolve(known.workspaceDir) || interruptedOldTask || activeDifferentTask) {
             decline("session is incompatible with Git workspace mode", true);
             return;
           }
@@ -10360,13 +10399,13 @@ var TaskRunner = class {
           gitWorkspaceId = randomUUID();
         }
         try {
-          gitLease = await gitManager.acquireLease(workspaceDir, payload.sessionRef);
+          gitLease = await gitManager.acquireLease(workspaceDir, sessionRef);
         } catch {
           decline("workspace is busy or unavailable", true);
           return;
         }
       } else if (!this.deps.gitWorkspaceManager && !this.deps.gitWorkspaceStore) {
-        known = payload.sessionRef ? await this.deps.sessionWorkspaces.get(payload.sessionRef) : void 0;
+        known = sessionRef ? await this.deps.sessionWorkspaces.get(sessionRef) : void 0;
         workspaceDir = known?.workspaceDir ?? path.join(this.deps.workspaceRoot, taskId);
         plainWorkspaceNeedsResolve = true;
       } else {
@@ -10385,7 +10424,7 @@ var TaskRunner = class {
         policy: decision.policy,
         requiredToolsetIds: requiredToolsets ?? [],
         ...offered.dispatchSelection === void 0 ? {} : { dispatchSelection: offered.dispatchSelection },
-        ...payload.sessionRef === void 0 || known === void 0 && agentBinding === void 0 ? {} : { sessionRef: payload.sessionRef },
+        ...sessionRef === void 0 || known === void 0 && agentBinding === void 0 ? {} : { sessionRef },
         ...agentBinding === void 0 ? {} : {
           agentRef: agentBinding.resolution.agentRef,
           cwd: agentBinding.lease.cwd,
@@ -10488,7 +10527,7 @@ var TaskRunner = class {
             workspaceId,
             taskId,
             workspaceDir,
-            sessionRef: payload.sessionRef,
+            sessionRef,
             phase,
             baseline: gitBaseline ?? observation.head,
             current: observation.head,
@@ -12345,9 +12384,14 @@ var AgentEgressController = class {
   latestStatus = emptyLane();
   reliableStatus = emptyLane();
   drops = [];
+  active = true;
   get policy() {
     return this.options.policy;
   }
+  /** Permanently fail closed after its authenticated enrollment is replaced. */
+  deactivate() {
+    this.active = false;
+  }
   status() {
     const reliable = this.reliableRecords();
     return Object.freeze({
@@ -12365,6 +12409,10 @@ var AgentEgressController = class {
   /** Project before TaskRunner builds a `task.progress` envelope. */
   projectLatestValue(input) {
     if (input.agentRef === void 0) return Object.freeze([...input.events]);
+    if (!this.active) {
+      this.noteDrop("latest-value", "policy_denied", input.agentRef);
+      return [];
+    }
     if (this.options.policy.activity.mode === "contentful-trajectory" && !input.serverCapabilities.includes("agent-egress-policy")) {
       this.noteDrop("latest-value", "capability_missing", input.agentRef);
       return [];
@@ -12387,7 +12435,7 @@ var AgentEgressController = class {
     return latest === void 0 ? [] : Object.freeze([latest]);
   }
   async appendReliable(input) {
-    if (this.options.tenantId === void 0) {
+    if (!this.active || this.options.tenantId === void 0) {
       this.noteDrop("reliable", "policy_denied", input.agentRef);
       return { ok: false, reason: "policy_denied" };
     }
@@ -12425,7 +12473,7 @@ var AgentEgressController = class {
    * with `wireType: agent.content.receipt` before any transport attempt.
    */
   async appendContentReceipt(input) {
-    if (this.options.tenantId === void 0) {
+    if (!this.active || this.options.tenantId === void 0) {
       this.noteDrop("reliable", "policy_denied", input.agentRef);
       return { ok: false, reason: "policy_denied" };
     }
@@ -12449,7 +12497,7 @@ var AgentEgressController = class {
   /** Retires only the record whose full Agent/tenant/revision/id/cursor tuple matches. */
   async acknowledge(ack) {
     const spool = this.spools.get(agentKey(ack.agentRef));
-    if (!spool || this.options.tenantId === void 0 || ack.tenantId !== this.options.tenantId) {
+    if (!this.active || !spool || this.options.tenantId === void 0 || ack.tenantId !== this.options.tenantId) {
       this.noteDrop("reliable", "ack_mismatch", ack.agentRef);
       return false;
     }
@@ -12460,6 +12508,7 @@ var AgentEgressController = class {
   /** Re-open every existing Agent-local spool before retrying stable records after restart. */
   async recover(agentsRoot) {
     if (!path.isAbsolute(agentsRoot)) throw new Error("Agent egress recovery root must be absolute");
+    if (!this.active) throw new Error("Agent egress recovery requires an active authenticated enrollment");
     if (this.options.tenantId === void 0) {
       throw new Error("Agent egress recovery requires one authenticated tenant authority");
     }
@@ -13445,7 +13494,13 @@ function computeCapabilities(adapters, agentHomeConfigured = false, agentEgressC
     flags.push("toolset-selection");
   }
   if (agentHomeConfigured) flags.push("agent-home-contract");
-  if (agentEgressConfigured) flags.push(AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY);
+  if (agentEgressConfigured) {
+    flags.push(
+      AGENT_EGRESS_POLICY_CAPABILITY,
+      AGENT_EGRESS_RELIABLE_ACK_CAPABILITY,
+      AGENT_EGRESS_FRESH_SESSION_CAPABILITY
+    );
+  }
   if (contentReadPolicies !== void 0) {
     for (const surface of Object.keys(AGENT_CONTENT_READ_CAPABILITIES)) {
       const policy = contentReadPolicies[surface];
@@ -13567,9 +13622,6 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
   if (config.agentEgress !== void 0 && config.agentHome === void 0) {
     throw new Error("DaemonConfig.agentEgress requires DaemonConfig.agentHome for the per-Agent local spool");
   }
-  if (config.agentEgress !== void 0 && (config.agentEgress.tenantId.length === 0 || config.agentEgress.tenantId.trim() !== config.agentEgress.tenantId)) {
-    throw new Error("DaemonConfig.agentEgress.tenantId must be a non-empty canonical authenticated tenant id");
-  }
   const egressPolicy = resolveAgentEgressPolicy(config.agentEgress?.policy);
   const egressBatcherOptions = egressPolicy.activity.mode === "contentful-trajectory" ? {
     ...config.progressBatch,
@@ -13600,9 +13652,8 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
   });
   const agentSessionHandoffs = config.agentHome === void 0 ? void 0 : new AgentSessionHandoffStore();
   const agentContentReadPolicies = resolveContentReadPolicies(egressPolicy, config.agentEgress?.contentRead);
-  const agentEgress = new AgentEgressController({
+  let agentEgress = new AgentEgressController({
     policy: egressPolicy,
-    ...config.agentEgress?.tenantId === void 0 ? {} : { tenantId: config.agentEgress.tenantId },
     ...config.agentEgress?.sanitizer === void 0 ? {} : { sanitizer: config.agentEgress.sanitizer }
   });
   const gitWorkspaceManager = config.gitWorkspace ? overrides.gitWorkspace?.manager ?? new GitWorkspaceManager(config.workspaceRoot, { ownerId: stableGitWorkspaceOwnerId(storeDir, config.productId) }) : void 0;
@@ -13612,11 +13663,6 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
     if (config.hostedJournal.mode !== "sqlite") {
       throw new Error(`DaemonConfig.hostedJournal.mode must be "sqlite" \u2014 got ${JSON.stringify(config.hostedJournal.mode)}`);
     }
-    if (typeof config.hostedJournal.tenantId !== "string" || config.hostedJournal.tenantId.trim() === "") {
-      throw new Error(
-        "DaemonConfig.hostedJournal.tenantId must be a non-empty tenant id \u2014 a hosted journal row with no tenant is durable evidence nobody can act on"
-      );
-    }
     if (config.hostedJournal.storagePolicy) {
       resolvedStoragePolicy = resolveLocalStoragePolicy(config.hostedJournal.storagePolicy);
     }
@@ -13685,6 +13731,8 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
   const approvalRegistry = new ApprovalRegistry();
   let connection;
   let connectionState = "closed";
+  let daemonStarted = false;
+  let tenantRebinding = false;
   let runner;
   let controlServerHandle;
   let daemonOwnerLease;
@@ -13737,11 +13785,31 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
     return runLifecycleMutation(() => pairUnderLease(pairingCode));
   }
   async function pairUnderLease(pairingCode) {
+    const wasRunning = daemonStarted;
+    if (wasRunning) tenantRebinding = true;
     const acquiredHere = daemonOwnerLease === void 0;
     if (acquiredHere) daemonOwnerLease = await acquireDaemonOwner(storeDir, "daemon");
+    let replacementPersisted = false;
     try {
-      const previous = await store.load();
+      let previous;
+      try {
+        previous = await store.load();
+      } catch (error) {
+        if (!(error instanceof DeviceRecordRePairRequiredError)) throw error;
+      }
       const record = await auth.pair(pairingCode);
+      replacementPersisted = true;
+      if (config.agentEgress !== void 0) {
+        agentEgress.deactivate();
+        agentEgress = new AgentEgressController({
+          policy: egressPolicy,
+          ...config.agentEgress.sanitizer === void 0 ? {} : { sanitizer: config.agentEgress.sanitizer }
+        });
+      }
+      if (wasRunning) {
+        await runShutdownSequence("re-pairing enrollment binding");
+        tenantRebinding = false;
+      }
       if (previous && previous.deviceId !== record.deviceId) {
         await cursorStore.clear(config.serverUrl, previous.deviceId);
       }
@@ -13752,6 +13820,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       }
       return record;
     } catch (err) {
+      if (wasRunning && !replacementPersisted) tenantRebinding = false;
       if (acquiredHere) {
         await daemonOwnerLease?.release();
         daemonOwnerLease = void 0;
@@ -13774,6 +13843,13 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       if (!record) {
         throw new Error("device is not paired yet; call pair(pairingCode) first");
       }
+      if (config.agentEgress !== void 0) {
+        agentEgress = new AgentEgressController({
+          policy: egressPolicy,
+          tenantId: record.tenantId,
+          ...config.agentEgress.sanitizer === void 0 ? {} : { sanitizer: config.agentEgress.sanitizer }
+        });
+      }
       await agentHomeManager?.preflight();
       if (config.agentEgress !== void 0 && config.agentHome !== void 0) {
         await agentEgress.recover(path.join(config.agentHome.hostStorageRoot, "agents"));
@@ -13834,7 +13910,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         config.agentEgress !== void 0,
         agentContentReadPolicies
       );
-      const journalIdentity = config.hostedJournal ? { tenantId: config.hostedJournal.tenantId, productId: config.productId, deviceId: record.deviceId } : void 0;
+      const journalIdentity = config.hostedJournal ? { tenantId: record.tenantId, productId: config.productId, deviceId: record.deviceId } : void 0;
       const sendSanitizedEnvelope = activeJournal && journalIdentity ? (envelope) => {
         observer.handleOutboundEnvelope(envelope);
         const terminalKind = terminalKindOf(envelope.type);
@@ -13972,9 +14048,8 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       runner = new TaskRunner(deps);
       const handleAgentEgressEnvelope = async (envelope) => {
         if (envelope.type !== "agent.egress.ack") return false;
-        const tenantId2 = config.agentEgress?.tenantId;
-        if (tenantId2 === void 0) return true;
-        await agentEgress.acknowledge({ ...envelope.payload, tenantId: tenantId2 });
+        if (config.agentEgress === void 0) return true;
+        await agentEgress.acknowledge({ ...envelope.payload, tenantId: record.tenantId });
         return true;
       };
       const handleAgentContentReadEnvelope = async (envelope) => {
@@ -14026,7 +14101,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         const result = await policyEngine.read({
           requestId: payload.requestId,
           actor: payload.actor,
-          tenantId: config.agentEgress.tenantId,
+          tenantId: record.tenantId,
           deviceId: record.deviceId,
           agentRef: payload.agentRef,
           surface: payload.surface,
@@ -14122,6 +14197,9 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         //
         // The no-journal branch is the ORIGINAL closure, unchanged.
         onEnvelope: activeJournal && journalIdentity ? async (envelope) => {
+          if (tenantRebinding) {
+            throw new Error("tenant enrollment is being re-paired; inbound work is blocked until restart");
+          }
           observer.handleInboundEnvelope(envelope);
           if (await handleAgentEgressEnvelope(envelope)) return;
           if (await handleAgentContentReadEnvelope(envelope)) return;
@@ -14129,6 +14207,9 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
           await activeJournal.appendEnvelope(toJournalEnvelopeRecord(envelope, journalIdentity));
           return runner?.handleEnvelope(envelope) ?? Promise.resolve();
         } : (envelope) => {
+          if (tenantRebinding) {
+            return Promise.reject(new Error("tenant enrollment is being re-paired; inbound work is blocked until restart"));
+          }
           observer.handleInboundEnvelope(envelope);
           if (envelope.type === "agent.egress.ack") return handleAgentEgressEnvelope(envelope).then(() => void 0);
           if (envelope.type === "agent.content.read") return handleAgentContentReadEnvelope(envelope).then(() => void 0);
@@ -14160,6 +14241,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         dispatchReliableRecord(record2);
       }
       startPresenceProducer();
+      daemonStarted = true;
     } catch (err) {
       try {
         await runShutdownSequence("startup failed", { drainTimeoutMs: 0 });
@@ -14304,6 +14386,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
     if (!mutationBarrierComplete) {
       throw new Error("daemon shutdown mutation barrier is incomplete; ownership lease retained");
     }
+    daemonStarted = false;
   }
   async function stop(opts = {}) {
     shuttingDown = true;
@@ -14622,18 +14705,30 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
     connection.send(sanitized.envelope);
   }
   async function publishReliableAgentEgress(input) {
-    if (config.agentEgress === void 0 || agentHomeManager === void 0) {
+    if (config.agentEgress === void 0 || agentHomeManager === void 0 || agentSessionHandoffs === void 0) {
       throw new Error("Agent reliable egress is not configured");
     }
+    if (tenantRebinding) {
+      throw new Error("tenant enrollment is being re-paired; reliable egress is blocked until restart");
+    }
     const binding = await agentHomeManager.acquire(input.agentRef);
     try {
       await agentHomeManager.initialize(binding);
+      const handoff = await agentSessionHandoffs.requireMatch({
+        agentRef: binding.resolution.agentRef,
+        sessionRef: input.sessionRef,
+        runtimeId: input.runtimeId,
+        cwd: binding.resolution.canonicalHome
+      });
+      if (handoff.taskId !== input.taskId) {
+        throw new Error("Agent reliable egress taskId does not match the durable session handoff");
+      }
       const appended = await agentEgress.appendReliable({
         homeDir: binding.resolution.canonicalHome,
         agentRef: binding.resolution.agentRef,
         sessionRef: input.sessionRef,
         payload: input.payload,
-        ...input.taskId === void 0 ? {} : { taskId: input.taskId },
+        taskId: input.taskId,
         ...input.eventId === void 0 ? {} : { eventId: input.eventId }
       });
       if (appended.ok) dispatchReliableRecord(appended.record);