@byok-sdk/client 0.7.0 → 0.8.0

package/dist/bin/byok-agent.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { randomUUID, createHash, randomBytes, timingSafeEqual, createHmac, createPrivateKey, generateKeyPairSync, sign } from 'crypto';
 import { readFileSync, promises, linkSync, fstatSync, lstatSync, unlinkSync, constants, readSync, openSync, writeFileSync, fchmodSync, fsyncSync, closeSync, opendirSync, existsSync, realpathSync, mkdirSync, renameSync, chmodSync, statSync, readdirSync } from 'fs';
-import path, { isAbsolute, join } from 'path';
-import { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, TASK_STATES, AgentEgressPolicySchema, CONFIGURED_TOOLSETS_MAX_ITEMS, ToolsetIdSchema, AgentRefSchema, AgentContentReceiptPayloadSchema, BYOK_PAIR_PATH, PairResponseSchema, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, partitionAgentEvents, TASK_TRANSITIONS, encodeEnvelope, PROTOCOL_VERSION, createEnvelope, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, byokBlobUrlPath, BYOK_BLOBS_PATH, byokBlobFinalizePath, AGENT_EGRESS_POLICY_CAPABILITY, parseMessage, checkResultDocument, MAX_MESSAGES_PER_BATCH, BYOK_CAPABILITIES_PATH, BYOK_PRESENCE_PATH, RuntimeIdSchema, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, RESULT_DOCUMENT_MAX_BYTES, decodeEnvelope, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendResponseSchema, UnknownMessageTypeError, BYOK_WS_PATH } from '@byok-sdk/protocol';
+import path2, { isAbsolute, join } from 'path';
+import { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, TASK_STATES, AgentEgressPolicySchema, AgentHomeProjectionPayloadSchema, CONFIGURED_TOOLSETS_MAX_ITEMS, ToolsetIdSchema, AgentRefSchema, AgentContentReceiptPayloadSchema, BYOK_PAIR_PATH, PairResponseSchema, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, partitionAgentEvents, TASK_TRANSITIONS, encodeEnvelope, PROTOCOL_VERSION, createEnvelope, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, byokBlobUrlPath, BYOK_BLOBS_PATH, byokBlobFinalizePath, AGENT_HOME_PROJECTION_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AgentHomeProjectionCompletionRequestSchema, byokAgentHomeProjectionCompletionPath, AgentHomeProjectionReadbackSchema, parseMessage, checkResultDocument, MAX_MESSAGES_PER_BATCH, BYOK_CAPABILITIES_PATH, BYOK_PRESENCE_PATH, RuntimeIdSchema, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, RESULT_DOCUMENT_MAX_BYTES, decodeEnvelope, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendResponseSchema, UnknownMessageTypeError, BYOK_WS_PATH } from '@byok-sdk/protocol';
 import { execFile, spawn } from 'child_process';
 import os from 'os';
 import { isTenantId, DEVICE_ASSERTION_AUDIENCE_MAX_BYTES, DEVICE_ASSERTION_DEFAULT_TTL_MS, DEVICE_ASSERTION_MAX_TTL_MS, nonceSigningBytes, CapabilityDeclarationSchema, hasCapability, DeviceAssertionClaimsSchema, deviceAssertionSigningInput, DEVICE_ASSERTION_SCHEMA_ID } from '@byok-sdk/core';
@@ -14,8 +14,79 @@ import { WebSocket } from 'ws';
 import { createRequire } from 'module';
 import { createInterface } from 'readline/promises';
 
+var tmpSeq = 0;
+async function atomicWriteFile(filePath, data, options = {}) {
+  const tmpPath = `${filePath}.${process.pid}-${tmpSeq++}.tmp`;
+  try {
+    const handle = await promises.open(tmpPath, "w", options.mode);
+    try {
+      await handle.writeFile(data);
+      if (options.mode !== void 0) {
+        await handle.chmod(options.mode);
+      }
+      if (options.fsync) {
+        await handle.sync();
+      }
+    } finally {
+      await handle.close();
+    }
+  } catch (err) {
+    await promises.rm(tmpPath, { force: true }).catch(() => {
+    });
+    throw err;
+  }
+  await renameOnto(tmpPath, filePath);
+  if (options.mode !== void 0) {
+    await promises.chmod(filePath, options.mode);
+  }
+  if (options.fsync) {
+    const target = await promises.open(filePath, process.platform === "win32" ? "r+" : "r");
+    try {
+      await target.sync();
+    } finally {
+      await target.close();
+    }
+    if (process.platform !== "win32") {
+      const directory = await promises.open(path2.dirname(filePath), "r");
+      try {
+        await directory.sync();
+      } finally {
+        await directory.close();
+      }
+    }
+  }
+}
+var RENAME_RETRY_ATTEMPTS = 5;
+var RENAME_RETRY_DELAY_MS = 20;
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function renameOnto(tmpPath, targetPath) {
+  for (let attempt = 1; attempt <= RENAME_RETRY_ATTEMPTS; attempt++) {
+    try {
+      await promises.rename(tmpPath, targetPath);
+      return;
+    } catch (err) {
+      const code = err.code;
+      if (code !== "EPERM" && code !== "EEXIST") {
+        await promises.rm(tmpPath, { force: true }).catch(() => {
+        });
+        throw err;
+      }
+      if (attempt === RENAME_RETRY_ATTEMPTS) {
+        await promises.rm(tmpPath, { force: true }).catch(() => {
+        });
+        throw err;
+      }
+      await delay(RENAME_RETRY_DELAY_MS * attempt);
+    }
+  }
+}
+
+// src/agent-home.ts
 var AGENT_HOME_DIRECTORY = "agents";
 var AGENT_HOME_INTERNAL_DIRECTORY = ".byok";
+var AGENT_HOME_PROJECTION_STATE_FILE = "agent-home-projection.json";
 var AgentHomeError = class extends Error {
   constructor(message) {
     super(message);
@@ -64,11 +135,11 @@ function validateAgentRef(value) {
   return Object.freeze({ agentId: candidate.agentId, profileRevision: candidate.profileRevision });
 }
 function isWithin(root, candidate) {
-  const relative = path.relative(root, candidate);
-  return relative === "" || relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+  const relative = path2.relative(root, candidate);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path2.sep}`) && !path2.isAbsolute(relative);
 }
 function assertAbsolutePath(value, label) {
-  if (typeof value !== "string" || value.length === 0 || !path.isAbsolute(value)) {
+  if (typeof value !== "string" || value.length === 0 || !path2.isAbsolute(value)) {
     throw new AgentHomeResolutionError(`${label} must be an absolute path`);
   }
   if (/[\u0000\r\n]/u.test(value)) {
@@ -76,7 +147,7 @@ function assertAbsolutePath(value, label) {
   }
 }
 async function resolveExistingAncestor(inputPath) {
-  let cursor = path.resolve(inputPath);
+  let cursor = path2.resolve(inputPath);
   const tail = [];
   for (; ; ) {
     try {
@@ -84,9 +155,9 @@ async function resolveExistingAncestor(inputPath) {
     } catch (error) {
       const code = error.code;
       if (code !== "ENOENT" && code !== "ENOTDIR") throw error;
-      const parent = path.dirname(cursor);
+      const parent = path2.dirname(cursor);
       if (parent === cursor) throw new AgentHomeResolutionError(`no existing ancestor for ${inputPath}`);
-      tail.unshift(path.basename(cursor));
+      tail.unshift(path2.basename(cursor));
       cursor = parent;
     }
   }
@@ -95,7 +166,7 @@ async function materializeDirectory(inputPath) {
   const { canonical: canonical2, tail } = await resolveExistingAncestor(inputPath);
   let cursor = canonical2;
   for (const component of tail) {
-    cursor = path.join(cursor, component);
+    cursor = path2.join(cursor, component);
     try {
       const stat = await promises.lstat(cursor);
       if (!stat.isDirectory() || stat.isSymbolicLink()) {
@@ -114,11 +185,11 @@ async function materializeDirectory(inputPath) {
 }
 async function ensureDirectoryNoSymlink(root, target) {
   if (!isWithin(root, target)) throw new AgentHomeResolutionError("Agent home is outside hostStorageRoot");
-  const relative = path.relative(root, target);
-  const components = relative === "" ? [] : relative.split(path.sep);
+  const relative = path2.relative(root, target);
+  const components = relative === "" ? [] : relative.split(path2.sep);
   let cursor = root;
   for (const component of components) {
-    cursor = path.join(cursor, component);
+    cursor = path2.join(cursor, component);
     try {
       const stat = await promises.lstat(cursor);
       if (!stat.isDirectory() || stat.isSymbolicLink()) {
@@ -154,16 +225,16 @@ var AgentHomeLayout = class {
   canonicalRoot;
   constructor(hostStorageRoot) {
     assertAbsolutePath(hostStorageRoot, "agentHome.hostStorageRoot");
-    this.hostStorageRootInput = path.resolve(hostStorageRoot);
+    this.hostStorageRootInput = path2.resolve(hostStorageRoot);
   }
   async resolve(agentRefInput) {
     const agentRef = validateAgentRef(agentRefInput);
     const hostStorageRoot = await this.resolveRoot();
     const agentsRoot = await ensureDirectoryNoSymlink(
       hostStorageRoot,
-      path.join(hostStorageRoot, AGENT_HOME_DIRECTORY)
+      path2.join(hostStorageRoot, AGENT_HOME_DIRECTORY)
     );
-    const lexicalHome = path.join(agentsRoot, agentRef.agentId);
+    const lexicalHome = path2.join(agentsRoot, agentRef.agentId);
     const canonicalHome = await ensureDirectoryNoSymlink(agentsRoot, lexicalHome);
     const priorAgentId = this.agentIdByCanonicalHome.get(canonicalHome);
     if (priorAgentId !== void 0 && priorAgentId !== agentRef.agentId) {
@@ -193,9 +264,9 @@ var AgentHomeLayout = class {
       const hostStorageRoot = await this.resolveRoot();
       const agentsRoot = await ensureDirectoryNoSymlink(
         hostStorageRoot,
-        path.join(hostStorageRoot, AGENT_HOME_DIRECTORY)
+        path2.join(hostStorageRoot, AGENT_HOME_DIRECTORY)
       );
-      probePath = path.join(agentsRoot, `.byok-agent-home-preflight-${randomUUID()}`);
+      probePath = path2.join(agentsRoot, `.byok-agent-home-preflight-${randomUUID()}`);
       handle = await promises.open(probePath, "wx", 384);
       created = true;
       await handle.sync();
@@ -226,7 +297,7 @@ var AgentHomeLayout = class {
   }
 };
 function stableAgentHomeOwnerId(storeDir, productId) {
-  const identity = `${path.resolve(storeDir)}\0${productId}`;
+  const identity = `${path2.resolve(storeDir)}\0${productId}`;
   return `store-product:${createHash("sha256").update(identity).digest("hex")}`;
 }
 function parseLeaseMarker(value, lockPath) {
@@ -236,7 +307,7 @@ function parseLeaseMarker(value, lockPath) {
   } catch {
     throw new AgentHomeLeaseCorruptError(`Agent home lease marker ${lockPath} is corrupt`);
   }
-  if (typeof parsed !== "object" || parsed === null || parsed.version !== 1 || typeof parsed.ownerId !== "string" || typeof parsed.leaseId !== "string" || typeof parsed.canonicalHome !== "string" || !path.isAbsolute(parsed.canonicalHome)) {
+  if (typeof parsed !== "object" || parsed === null || parsed.version !== 1 || typeof parsed.ownerId !== "string" || typeof parsed.leaseId !== "string" || typeof parsed.canonicalHome !== "string" || !path2.isAbsolute(parsed.canonicalHome)) {
     throw new AgentHomeLeaseCorruptError(`Agent home lease marker ${lockPath} has an invalid shape`);
   }
   let agentRef;
@@ -246,7 +317,7 @@ function parseLeaseMarker(value, lockPath) {
     throw new AgentHomeLeaseCorruptError(`Agent home lease marker ${lockPath} has an invalid AgentRef`);
   }
   const marker = parsed;
-  return { ...marker, agentRef, canonicalHome: path.resolve(marker.canonicalHome) };
+  return { ...marker, agentRef, canonicalHome: path2.resolve(marker.canonicalHome) };
 }
 var AgentHomeLeaseManager = class _AgentHomeLeaseManager {
   static held = /* @__PURE__ */ new Map();
@@ -268,9 +339,9 @@ var AgentHomeLeaseManager = class _AgentHomeLeaseManager {
       await ensureDirectoryNoSymlink(resolution.agentsRoot, canonicalHome);
       const internalDir = await ensureDirectoryNoSymlink(
         canonicalHome,
-        path.join(canonicalHome, AGENT_HOME_INTERNAL_DIRECTORY)
+        path2.join(canonicalHome, AGENT_HOME_INTERNAL_DIRECTORY)
       );
-      lockPath = path.join(internalDir, "agent-home.lease");
+      lockPath = path2.join(internalDir, "agent-home.lease");
       handle = await this.openLeaseMarker(lockPath, canonicalHome, agentRef.agentId);
       ownsMarker = true;
       const marker = {
@@ -369,9 +440,73 @@ var AgentHomeLeaseManager = class _AgentHomeLeaseManager {
 async function initializeAgentHome(resolution) {
   await ensureDirectoryNoSymlink(
     resolution.canonicalHome,
-    path.join(resolution.canonicalHome, "notes")
+    path2.join(resolution.canonicalHome, "notes")
   );
-  await ensurePreservedFile(path.join(resolution.canonicalHome, "MEMORY.md"));
+  await ensurePreservedFile(path2.join(resolution.canonicalHome, "MEMORY.md"));
+}
+function projectionStatePath(resolution) {
+  return path2.join(
+    resolution.canonicalHome,
+    AGENT_HOME_INTERNAL_DIRECTORY,
+    AGENT_HOME_PROJECTION_STATE_FILE
+  );
+}
+async function readProjectionState(resolution) {
+  const filePath = projectionStatePath(resolution);
+  try {
+    const stat = await promises.lstat(filePath);
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+      throw new AgentHomeResolutionError(`Agent projection state is not a regular file: ${filePath}`);
+    }
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(await promises.readFile(filePath, "utf8"));
+  } catch (error) {
+    throw new AgentHomeResolutionError(
+      `Agent projection state is corrupt: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  if (typeof parsed !== "object" || parsed === null || parsed.version !== 1 || typeof parsed.requestId !== "string" || typeof parsed.projectionHash !== "string") {
+    throw new AgentHomeResolutionError("Agent projection state has an invalid shape");
+  }
+  const candidate = parsed;
+  const agentRef = validateAgentRef(candidate.agentRef);
+  if (agentRef.agentId !== resolution.agentRef.agentId) {
+    throw new AgentHomeCollisionError("Agent projection state belongs to a different Agent home");
+  }
+  return Object.freeze({
+    version: 1,
+    agentRef,
+    requestId: candidate.requestId,
+    projectionHash: candidate.projectionHash
+  });
+}
+async function writeProjectionState(resolution, payload) {
+  const filePath = projectionStatePath(resolution);
+  const existing = await promises.lstat(filePath).catch((error) => {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  });
+  if (existing !== void 0 && (!existing.isFile() || existing.isSymbolicLink())) {
+    throw new AgentHomeResolutionError(`Agent projection state is not a regular file: ${filePath}`);
+  }
+  const state = {
+    version: 1,
+    agentRef: payload.agentRef,
+    requestId: payload.requestId,
+    projectionHash: payload.projectionHash
+  };
+  await atomicWriteFile(filePath, `${JSON.stringify(state)}
+`, { mode: 384, fsync: true });
+}
+function compareProjectionRevision(left, right) {
+  const leftRevision = BigInt(left);
+  const rightRevision = BigInt(right);
+  return leftRevision < rightRevision ? -1 : leftRevision > rightRevision ? 1 : 0;
 }
 var AgentHomeManager = class {
   layout;
@@ -407,12 +542,59 @@ var AgentHomeManager = class {
   async initialize(binding) {
     const { resolution, lease } = binding;
     await initializeAgentHome(resolution);
-    await this.projection?.prepare({ ...resolution, cwd: lease.cwd });
+    const prepare = this.projection?.prepare;
+    if (prepare !== void 0) await prepare({ ...resolution, cwd: lease.cwd });
     if (await promises.realpath(resolution.homeDir) !== resolution.canonicalHome) {
       throw new AgentHomeResolutionError("Agent projection changed the canonical home path");
     }
     await initializeAgentHome(resolution);
   }
+  supportsTaskFreeProjection() {
+    return this.projection?.apply !== void 0;
+  }
+  /**
+   * Apply one task-free projection under the same canonical-home writer lease
+   * used by Agent execution. Only a successful host hook followed by the
+   * SDK-owned fsynced ordering record can return `applied`.
+   */
+  async project(input) {
+    const payload = AgentHomeProjectionPayloadSchema.parse(input);
+    const binding = await this.acquire(payload.agentRef);
+    try {
+      const { resolution, lease } = binding;
+      await initializeAgentHome(resolution);
+      const current = await readProjectionState(resolution);
+      if (current !== void 0) {
+        const order = compareProjectionRevision(
+          payload.agentRef.profileRevision,
+          current.agentRef.profileRevision
+        );
+        if (order < 0) return "stale";
+        if (order === 0) {
+          return payload.projectionHash === current.projectionHash ? "idempotent" : "conflict";
+        }
+      }
+      const apply = this.projection?.apply;
+      if (apply === void 0) {
+        throw new AgentHomeError("task-free Agent-home projection is not configured");
+      }
+      await apply({
+        ...resolution,
+        cwd: lease.cwd,
+        requestId: payload.requestId,
+        projectionHash: payload.projectionHash,
+        projection: payload.projection
+      });
+      if (await promises.realpath(resolution.homeDir) !== resolution.canonicalHome) {
+        throw new AgentHomeResolutionError("Agent projection changed the canonical home path");
+      }
+      await initializeAgentHome(resolution);
+      await writeProjectionState(resolution, payload);
+      return "applied";
+    } finally {
+      await binding.lease.release();
+    }
+  }
 };
 var AgentSessionHandoffStoreError = class extends Error {
   constructor(message) {
@@ -453,7 +635,7 @@ function parseTaskTerminalEntry(value) {
   assertNonEmptyString(value.terminalReason, "taskTerminal.terminalReason");
   assertNonEmptyString(value.updatedAt, "taskTerminal.updatedAt");
   if (value.sessionRef !== void 0) assertNonEmptyString(value.sessionRef, "taskTerminal.sessionRef");
-  if (typeof value.cwd !== "string" || !path.isAbsolute(value.cwd)) {
+  if (typeof value.cwd !== "string" || !path2.isAbsolute(value.cwd)) {
     throw new AgentSessionHandoffCorruptError("taskTerminal.cwd must be an absolute path");
   }
   if (value.terminalCause !== "failed") {
@@ -466,7 +648,7 @@ function parseTaskTerminalEntry(value) {
     agentRef,
     taskId: value.taskId,
     runtimeId: value.runtimeId,
-    cwd: path.resolve(value.cwd),
+    cwd: path2.resolve(value.cwd),
     leaseId: value.leaseId,
     ...value.sessionRef === void 0 ? {} : { sessionRef: value.sessionRef },
     terminalCause: "failed",
@@ -496,7 +678,7 @@ function parseEntry(value) {
   assertNonEmptyString(value.runtimeId, "handoff.runtimeId");
   assertNonEmptyString(value.leaseId, "handoff.leaseId");
   assertNonEmptyString(value.updatedAt, "handoff.updatedAt");
-  if (typeof value.cwd !== "string" || !path.isAbsolute(value.cwd)) {
+  if (typeof value.cwd !== "string" || !path2.isAbsolute(value.cwd)) {
     throw new AgentSessionHandoffCorruptError("handoff.cwd must be an absolute path");
   }
   if (Number.isNaN(Date.parse(value.updatedAt))) {
@@ -513,7 +695,7 @@ function parseEntry(value) {
     taskId: value.taskId,
     sessionRef: value.sessionRef,
     runtimeId: value.runtimeId,
-    cwd: path.resolve(value.cwd),
+    cwd: path2.resolve(value.cwd),
     leaseId: value.leaseId,
     ...value.terminalCause === void 0 ? {} : { terminalCause: value.terminalCause },
     ...value.terminalReason === void 0 ? {} : { terminalReason: value.terminalReason },
@@ -524,10 +706,10 @@ function sameRef(left, right) {
   return left.agentId === right.agentId && left.profileRevision === right.profileRevision;
 }
 function sameMatch(entry, expected) {
-  return sameRef(entry.agentRef, expected.agentRef) && entry.sessionRef === expected.sessionRef && entry.runtimeId === expected.runtimeId && entry.cwd === path.resolve(expected.cwd);
+  return sameRef(entry.agentRef, expected.agentRef) && entry.sessionRef === expected.sessionRef && entry.runtimeId === expected.runtimeId && entry.cwd === path2.resolve(expected.cwd);
 }
 function sameTaskTerminalMatch(entry, expected) {
-  return sameRef(entry.agentRef, expected.agentRef) && entry.taskId === expected.taskId && entry.runtimeId === expected.runtimeId && entry.cwd === path.resolve(expected.cwd);
+  return sameRef(entry.agentRef, expected.agentRef) && entry.taskId === expected.taskId && entry.runtimeId === expected.runtimeId && entry.cwd === path2.resolve(expected.cwd);
 }
 function sessionFileName(runtimeId, sessionRef) {
   const digest2 = createHash("sha256").update(sessionRef, "utf8").digest("hex");
@@ -540,13 +722,13 @@ function taskTerminalFileName(runtimeId, taskId) {
   return `${runtime}-task-${digest2}.jsonl`;
 }
 async function evidenceDirectory(cwdInput) {
-  if (!path.isAbsolute(cwdInput)) {
+  if (!path2.isAbsolute(cwdInput)) {
     throw new AgentSessionHandoffStoreError("Agent session cwd must be absolute");
   }
   const cwd = await promises.realpath(cwdInput);
   let cursor = cwd;
   for (const component of [".byok", "runtime-sessions"]) {
-    cursor = path.join(cursor, component);
+    cursor = path2.join(cursor, component);
     try {
       const stat = await promises.lstat(cursor);
       if (!stat.isDirectory() || stat.isSymbolicLink()) {
@@ -558,8 +740,8 @@ async function evidenceDirectory(cwdInput) {
     }
   }
   const canonical2 = await promises.realpath(cursor);
-  const relative = path.relative(cwd, canonical2);
-  if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+  const relative = path2.relative(cwd, canonical2);
+  if (relative === ".." || relative.startsWith(`..${path2.sep}`) || path2.isAbsolute(relative)) {
     throw new AgentSessionHandoffStoreError("Agent session evidence path escaped the canonical Agent home");
   }
   return canonical2;
@@ -605,7 +787,7 @@ var AgentSessionHandoffStore = class {
         taskId: input.taskId,
         sessionRef: input.sessionRef,
         runtimeId: input.runtimeId,
-        cwd: path.resolve(input.cwd),
+        cwd: path2.resolve(input.cwd),
         leaseId: input.leaseId,
         updatedAt: (/* @__PURE__ */ new Date()).toISOString()
       });
@@ -648,7 +830,7 @@ var AgentSessionHandoffStore = class {
       agentRef: validateAgentRef(input.agentRef),
       taskId: input.taskId,
       runtimeId: input.runtimeId,
-      cwd: path.resolve(input.cwd)
+      cwd: path2.resolve(input.cwd)
     };
     const filePath = await this.taskTerminalFilePath(expected);
     return this.enqueue(filePath, async () => {
@@ -675,7 +857,7 @@ var AgentSessionHandoffStore = class {
       agentRef: validateAgentRef(expectedInput.agentRef),
       taskId: expectedInput.taskId,
       runtimeId: expectedInput.runtimeId,
-      cwd: path.resolve(expectedInput.cwd)
+      cwd: path2.resolve(expectedInput.cwd)
     };
     const filePath = await this.taskTerminalFilePath(expected);
     return this.enqueue(filePath, async () => {
@@ -693,14 +875,14 @@ var AgentSessionHandoffStore = class {
     assertNonEmptyString(match.sessionRef, "handoff.sessionRef");
     assertNonEmptyString(match.runtimeId, "handoff.runtimeId");
     const directory = await evidenceDirectory(match.cwd);
-    return path.join(directory, sessionFileName(match.runtimeId, match.sessionRef));
+    return path2.join(directory, sessionFileName(match.runtimeId, match.sessionRef));
   }
   async taskTerminalFilePath(match) {
     validateAgentRef(match.agentRef);
     assertNonEmptyString(match.taskId, "taskTerminal.taskId");
     assertNonEmptyString(match.runtimeId, "taskTerminal.runtimeId");
     const directory = await evidenceDirectory(match.cwd);
-    return path.join(directory, taskTerminalFileName(match.runtimeId, match.taskId));
+    return path2.join(directory, taskTerminalFileName(match.runtimeId, match.taskId));
   }
   enqueue(key, task) {
     const previous = this.queues.get(key) ?? Promise.resolve();
@@ -1011,7 +1193,7 @@ function gitEnvironment(readOnly) {
   return env;
 }
 function stableGitWorkspaceOwnerId(storeDir, productId) {
-  const identity = `${path.resolve(storeDir)}\\0${productId}`;
+  const identity = `${path2.resolve(storeDir)}\\0${productId}`;
   return `store-product:${createHash("sha256").update(identity).digest("hex")}`;
 }
 var GUIDANCE = [
@@ -1023,11 +1205,11 @@ var GUIDANCE = [
   "Leave incomplete work visible for recovery."
 ].join("\n");
 function canonical(value) {
-  return path.resolve(value);
+  return path2.resolve(value);
 }
 function isContained(root, candidate) {
-  const relative = path.relative(root, candidate);
-  return relative === "" || !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+  const relative = path2.relative(root, candidate);
+  return relative === "" || !relative.startsWith(`..${path2.sep}`) && !path2.isAbsolute(relative);
 }
 function bounded(value, max) {
   return Buffer.byteLength(value, "utf8") <= max ? value : value.slice(0, max);
@@ -1132,7 +1314,7 @@ var GitWorkspaceManager = class {
     await this.ensureOwnerMarker();
   }
   async ensureOwnerMarker() {
-    const markerPath = path.join(this.workspaceRoot, OWNER_MARKER);
+    const markerPath = path2.join(this.workspaceRoot, OWNER_MARKER);
     let existing;
     try {
       existing = JSON.parse(await promises.readFile(markerPath, "utf8"));
@@ -1291,7 +1473,7 @@ ${instruction}`;
         if (error instanceof GitWorkspaceError || code !== "ENOENT" && code !== "ENOTDIR") {
           throw new GitWorkspaceError("workspace-root-invalid", "workspace directory is invalid");
         }
-        const parent = path.dirname(current);
+        const parent = path2.dirname(current);
         if (parent === current) {
           throw new GitWorkspaceError("workspace-root-invalid", "workspace directory is invalid");
         }
@@ -1316,74 +1498,6 @@ ${instruction}`;
 function prependGitWorkspaceGuidance(instruction) {
   return GitWorkspaceManager.prependGuidance(instruction);
 }
-var tmpSeq = 0;
-async function atomicWriteFile(filePath, data, options = {}) {
-  const tmpPath = `${filePath}.${process.pid}-${tmpSeq++}.tmp`;
-  try {
-    const handle = await promises.open(tmpPath, "w", options.mode);
-    try {
-      await handle.writeFile(data);
-      if (options.mode !== void 0) {
-        await handle.chmod(options.mode);
-      }
-      if (options.fsync) {
-        await handle.sync();
-      }
-    } finally {
-      await handle.close();
-    }
-  } catch (err) {
-    await promises.rm(tmpPath, { force: true }).catch(() => {
-    });
-    throw err;
-  }
-  await renameOnto(tmpPath, filePath);
-  if (options.mode !== void 0) {
-    await promises.chmod(filePath, options.mode);
-  }
-  if (options.fsync) {
-    const target = await promises.open(filePath, process.platform === "win32" ? "r+" : "r");
-    try {
-      await target.sync();
-    } finally {
-      await target.close();
-    }
-    if (process.platform !== "win32") {
-      const directory = await promises.open(path.dirname(filePath), "r");
-      try {
-        await directory.sync();
-      } finally {
-        await directory.close();
-      }
-    }
-  }
-}
-var RENAME_RETRY_ATTEMPTS = 5;
-var RENAME_RETRY_DELAY_MS = 20;
-function delay(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-async function renameOnto(tmpPath, targetPath) {
-  for (let attempt = 1; attempt <= RENAME_RETRY_ATTEMPTS; attempt++) {
-    try {
-      await promises.rename(tmpPath, targetPath);
-      return;
-    } catch (err) {
-      const code = err.code;
-      if (code !== "EPERM" && code !== "EEXIST") {
-        await promises.rm(tmpPath, { force: true }).catch(() => {
-        });
-        throw err;
-      }
-      if (attempt === RENAME_RETRY_ATTEMPTS) {
-        await promises.rm(tmpPath, { force: true }).catch(() => {
-        });
-        throw err;
-      }
-      await delay(RENAME_RETRY_DELAY_MS * attempt);
-    }
-  }
-}
 var defaultRunner = (command, args) => new Promise((resolve, reject) => {
   execFile(command, args, (error, stdout, stderr) => {
     if (error && typeof error.code !== "number") {
@@ -1510,7 +1624,7 @@ function isProtected(record) {
 var GitWorkspaceStore = class {
   constructor(storeDir, options = {}) {
     this.storeDir = storeDir;
-    this.filePath = path.join(storeDir, FILE_NAME);
+    this.filePath = path2.join(storeDir, FILE_NAME);
     this.maxRecords = Math.max(1, Math.floor(options.maxRecords ?? MAX_RECORDS));
   }
   storeDir;
@@ -1645,7 +1759,7 @@ var GitWorkspaceStore = class {
 var BYOK_PI_MCP_CONFIG_PATH = "BYOK_PI_MCP_CONFIG_PATH";
 var PI_PACKAGE_NAME = "@earendil-works/pi-coding-agent";
 function readPackageJson(dir) {
-  const candidate = path.join(dir, "package.json");
+  const candidate = path2.join(dir, "package.json");
   if (!existsSync(candidate)) return void 0;
   try {
     return JSON.parse(readFileSync(candidate, "utf8"));
@@ -1660,17 +1774,17 @@ function resolvePiBin() {
   }
   try {
     const mainEntryUrl = import.meta.resolve(PI_PACKAGE_NAME);
-    let dir = path.dirname(fileURLToPath(mainEntryUrl));
+    let dir = path2.dirname(fileURLToPath(mainEntryUrl));
     for (let depth = 0; depth < 6; depth++) {
       const pkg = readPackageJson(dir);
       if (pkg?.name === PI_PACKAGE_NAME) {
         const binRel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.pi;
         if (binRel) {
-          return { command: path.join(dir, binRel), source: "package" };
+          return { command: path2.join(dir, binRel), source: "package" };
         }
         break;
       }
-      const parent = path.dirname(dir);
+      const parent = path2.dirname(dir);
       if (parent === dir) break;
       dir = parent;
     }
@@ -1688,7 +1802,7 @@ function resolvePiExtensions() {
   const clientManifest = fileURLToPath(import.meta.resolve("@byok-sdk/client/package.json"));
   return {
     webAccess: fileURLToPath(import.meta.resolve("pi-web-access/index.ts")),
-    mcpAdapter: path.join(path.dirname(clientManifest), "dist", "adapters", "pi", "mcp-extension.js")
+    mcpAdapter: path2.join(path2.dirname(clientManifest), "dist", "adapters", "pi", "mcp-extension.js")
   };
 }
 
@@ -2614,10 +2728,10 @@ var PiAdapter = class {
           const taskMcpServers = startInput.mcpServers ?? {};
           const hasMcpServers = Object.keys(taskMcpServers).length > 0;
           if (hasMcpServers) {
-            mcpConfigDir = await promises.mkdtemp(path.join(os.tmpdir(), "byok-pi-mcp-"));
+            mcpConfigDir = await promises.mkdtemp(path2.join(os.tmpdir(), "byok-pi-mcp-"));
             await promises.chmod(mcpConfigDir, 448).catch(() => {
             });
-            const mcpConfigPath = path.join(mcpConfigDir, "mcp-config.json");
+            const mcpConfigPath = path2.join(mcpConfigDir, "mcp-config.json");
             await promises.writeFile(mcpConfigPath, JSON.stringify({ mcpServers: taskMcpServers }), { mode: 384 });
             runtimeEnv = { ...runtimeEnv, [BYOK_PI_MCP_CONFIG_PATH]: mcpConfigPath };
           }
@@ -2848,7 +2962,7 @@ function resolveApprovalMcpBin() {
   if (override) {
     return { command: override, args: [], source: "env" };
   }
-  const distBin = path.join(path.dirname(fileURLToPath(import.meta.url)), "bin", "byok-approval-mcp.js");
+  const distBin = path2.join(path2.dirname(fileURLToPath(import.meta.url)), "bin", "byok-approval-mcp.js");
   return { command: process.execPath, args: [distBin], source: "dist" };
 }
 
@@ -2939,7 +3053,7 @@ var EXTENSION_CONTENT_TYPES = {
   ".yml": "application/yaml"
 };
 function guessContentType(filePath) {
-  const ext = path.extname(filePath).toLowerCase();
+  const ext = path2.extname(filePath).toLowerCase();
   return EXTENSION_CONTENT_TYPES[ext] ?? "application/octet-stream";
 }
 function mapAssistant(msg, correlation) {
@@ -3023,11 +3137,11 @@ function tryBuildArtifactEvent(msg, workspaceDir) {
   const filePath = toolUseResult && typeof toolUseResult.filePath === "string" ? toolUseResult.filePath : void 0;
   if (!filePath) return void 0;
   const realWorkspaceDir = tryRealpath(workspaceDir) ?? workspaceDir;
-  const fileDir = path.dirname(filePath);
+  const fileDir = path2.dirname(filePath);
   const realFileDir = tryRealpath(fileDir) ?? fileDir;
-  const realFilePath = path.join(realFileDir, path.basename(filePath));
-  const relative = path.relative(realWorkspaceDir, realFilePath);
-  if (relative === "" || relative.startsWith("..") || path.isAbsolute(relative)) {
+  const realFilePath = path2.join(realFileDir, path2.basename(filePath));
+  const relative = path2.relative(realWorkspaceDir, realFilePath);
+  if (relative === "" || relative.startsWith("..") || path2.isAbsolute(relative)) {
     return void 0;
   }
   return { type: "artifact", name: relative, contentType: guessContentType(filePath) };
@@ -3421,10 +3535,10 @@ var ClaudeAdapter = class {
       });
     }
     if (needsMcpConfig) {
-      mcpConfigDir = await promises.mkdtemp(path.join(os.tmpdir(), "byok-mcp-"));
+      mcpConfigDir = await promises.mkdtemp(path2.join(os.tmpdir(), "byok-mcp-"));
       await promises.chmod(mcpConfigDir, 448).catch(() => {
       });
-      const mcpConfigPath = path.join(mcpConfigDir, "mcp-config.json");
+      const mcpConfigPath = path2.join(mcpConfigDir, "mcp-config.json");
       const mcpServers = { ...taskMcpServers };
       if (mapping.needsApprovalMcp) {
         const approvalChannel = startInput.approvalChannel;
@@ -3910,8 +4024,8 @@ function extractArtifactEvents(changes, workspaceDir) {
     const absolutePath = typeof change.path === "string" ? change.path : void 0;
     const kind = typeof change.kind === "string" ? change.kind : void 0;
     if (!absolutePath || kind === "delete") continue;
-    const relative = path.relative(workspaceDir, absolutePath);
-    if (relative.length === 0 || relative.startsWith("..") || path.isAbsolute(relative)) continue;
+    const relative = path2.relative(workspaceDir, absolutePath);
+    if (relative.length === 0 || relative.startsWith("..") || path2.isAbsolute(relative)) continue;
     events.push({ type: "artifact", name: relative, contentType: guessContentType2(relative) });
   }
   return events;
@@ -3932,7 +4046,7 @@ var CONTENT_TYPE_BY_EXTENSION = {
   ".csv": "text/csv"
 };
 function guessContentType2(relativePath) {
-  return CONTENT_TYPE_BY_EXTENSION[path.extname(relativePath).toLowerCase()] ?? "application/octet-stream";
+  return CONTENT_TYPE_BY_EXTENSION[path2.extname(relativePath).toLowerCase()] ?? "application/octet-stream";
 }
 function extractErrorMessage(rawError) {
   if (typeof rawError === "string") return rawError;
@@ -4788,12 +4902,12 @@ var DeviceStore = class _DeviceStore {
    */
   constructor(storeDir, secureDirOptions) {
     this.secureDirOptions = secureDirOptions;
-    this.filePath = path.join(storeDir, "device.json");
+    this.filePath = path2.join(storeDir, "device.json");
   }
   secureDirOptions;
   filePath;
   static defaultDir(productId) {
-    return path.join(os.homedir(), ".byok", productId);
+    return path2.join(os.homedir(), ".byok", productId);
   }
   /**
    * Resolve the one store pathname every daemon/CLI component must share.
@@ -4802,7 +4916,7 @@ var DeviceStore = class _DeviceStore {
    * cwd to pin a quarantine directory inode.
    */
   static resolveDir(productId, configured) {
-    return path.resolve(configured ?? _DeviceStore.defaultDir(productId));
+    return path2.resolve(configured ?? _DeviceStore.defaultDir(productId));
   }
   async load() {
     const opened = await this.openBounded();
@@ -4844,7 +4958,7 @@ var DeviceStore = class _DeviceStore {
   }
   async save(record) {
     assertDeviceRecord(record);
-    const storeDir = path.dirname(this.filePath);
+    const storeDir = path2.dirname(this.filePath);
     await ensureSecureDir(storeDir, this.secureDirOptions);
     await atomicWriteFile(this.filePath, JSON.stringify(record, null, 2), { mode: 384 });
   }
@@ -5498,19 +5612,19 @@ function shortHash(input) {
   return createHash("sha256").update(input, "utf8").digest("hex").slice(0, 16);
 }
 function controlSocketPath(storeDir) {
-  const candidate = path.join(storeDir, "control.sock");
+  const candidate = path2.join(storeDir, "control.sock");
   if (Buffer.byteLength(candidate, "utf8") <= UNIX_SOCKET_PATH_SOFT_LIMIT) return candidate;
-  return path.join(CONTROL_SOCKET_FALLBACK_ROOT, `byok-${shortHash(storeDir)}`, "sock");
+  return path2.join(CONTROL_SOCKET_FALLBACK_ROOT, `byok-${shortHash(storeDir)}`, "sock");
 }
 function controlPipeName(productId, storeDir) {
-  const id = shortHash(`${productId}|${path.resolve(storeDir)}`);
+  const id = shortHash(`${productId}|${path2.resolve(storeDir)}`);
   return `\\\\.\\pipe\\byok-${id}`;
 }
 function controlEndpointPath(productId, storeDir, platform = process.platform) {
   return platform === "win32" ? controlPipeName(productId, storeDir) : controlSocketPath(storeDir);
 }
 function controlTokenPath(storeDir) {
-  return path.join(storeDir, "control.token");
+  return path2.join(storeDir, "control.token");
 }
 var SERVER_PROOF_LABEL = "byok-control-server|";
 var CLIENT_AUTH_LABEL = "byok-control-client|";
@@ -5689,7 +5803,7 @@ async function assertOwnedPrivateDir(dir) {
 }
 async function bindControlEndpoint(server, endpoint) {
   if (process.platform !== "win32") {
-    const endpointDir = path.dirname(endpoint);
+    const endpointDir = path2.dirname(endpoint);
     await promises.mkdir(endpointDir, { recursive: true, mode: 448 });
     await promises.chmod(endpointDir, 448).catch(() => {
     });
@@ -6588,7 +6702,7 @@ function toBytes(data, _isBinary) {
 
 // src/daemon/connection-manager.ts
 function isCursorEnvelopeType(type) {
-  return type.startsWith("task.") || type === "agent.egress.ack" || type === "agent.content.read";
+  return type.startsWith("task.") || type === "agent.egress.ack" || type === "agent.content.read" || type === "agent.home.projection";
 }
 var ConnectionManager = class {
   constructor(opts) {
@@ -7103,6 +7217,10 @@ var ConnectionManager = class {
   async process(envelope, tracked) {
     const seq = tracked ? envelope.seq : void 0;
     try {
+      if (tracked && this.cursor === void 0) {
+        await this.opts.cursorStore.save(this.opts.serverUrl, this.opts.deviceId, 0);
+        this.cursor = 0;
+      }
       await this.opts.onEnvelope(envelope);
       if (!tracked) return;
       this.processedSeqs.add(seq);
@@ -7332,7 +7450,7 @@ function sameFileState2(left, right) {
   return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs;
 }
 async function openOperationalHealthFile(storeDir) {
-  const filePath = path.join(storeDir, OPERATIONAL_HEALTH_FILENAME);
+  const filePath = path2.join(storeDir, OPERATIONAL_HEALTH_FILENAME);
   let namedBefore;
   try {
     namedBefore = await promises.lstat(filePath, { bigint: true });
@@ -7374,7 +7492,7 @@ var OperationalHealthTracker = class {
   #writeTail = Promise.resolve();
   #started = false;
   constructor(storeDir, options = {}) {
-    this.#filePath = path.join(storeDir, OPERATIONAL_HEALTH_FILENAME);
+    this.#filePath = path2.join(storeDir, OPERATIONAL_HEALTH_FILENAME);
     this.#windowMs = options.windowMs ?? 6e4;
     this.#failureThreshold = options.failureThreshold ?? 3;
     this.#maxFailures = options.maxFailures ?? 128;
@@ -7461,7 +7579,7 @@ var OperationalHealthTracker = class {
   async #load() {
     let opened;
     try {
-      opened = await openOperationalHealthFile(path.dirname(this.#filePath));
+      opened = await openOperationalHealthFile(path2.dirname(this.#filePath));
     } catch (err) {
       throw new Error("operational health state could not be read");
     }
@@ -7497,7 +7615,7 @@ var OperationalHealthTracker = class {
     if (!this.#state) return;
     const body = JSON.stringify(this.#state, null, 2);
     this.#writeTail = this.#writeTail.then(async () => {
-      await ensureSecureDir(path.dirname(this.#filePath));
+      await ensureSecureDir(path2.dirname(this.#filePath));
       await atomicWriteFile(this.#filePath, body, { mode: 384, fsync: true });
     });
     try {
@@ -7625,9 +7743,9 @@ function storeMutexIdentity(canonicalStoreDir) {
 }
 function storeMutexEndpoint(canonicalStoreDir, identity, platform = process.platform) {
   if (platform === "win32") return `\\\\.\\pipe\\byok-store-mutex-${identity.slice(0, 16)}`;
-  const candidate = path.join(canonicalStoreDir, STORE_MUTEX_SOCKET_FILENAME);
+  const candidate = path2.join(canonicalStoreDir, STORE_MUTEX_SOCKET_FILENAME);
   if (Buffer.byteLength(candidate, "utf8") <= UNIX_SOCKET_PATH_SOFT_LIMIT2) return candidate;
-  return path.join(STORE_MUTEX_FALLBACK_ROOT, `byok-store-mutex-${identity.slice(0, 16)}`, "sock");
+  return path2.join(STORE_MUTEX_FALLBACK_ROOT, `byok-store-mutex-${identity.slice(0, 16)}`, "sock");
 }
 var DaemonOwnerActiveError = class extends Error {
   constructor(role) {
@@ -7799,7 +7917,7 @@ async function acquireStoreMutex(canonicalStoreDir) {
   const endpoint = storeMutexEndpoint(canonicalStoreDir, identity);
   const isPipe = process.platform === "win32";
   if (!isPipe) {
-    const endpointDir = path.dirname(endpoint);
+    const endpointDir = path2.dirname(endpoint);
     if (endpointDir !== canonicalStoreDir) {
       await ensureSecureDir(endpointDir);
       await assertOwnedPrivateDir2(endpointDir);
@@ -7879,8 +7997,8 @@ async function acquireDaemonOwner(storeDir, role, clock = () => /* @__PURE__ */
     await mutex.close().catch(() => void 0);
     throw err;
   }
-  const ownerPath = path.join(storeDir, DAEMON_OWNER_FILENAME);
-  const reclaimPath = path.join(storeDir, RECLAIM_FILENAME);
+  const ownerPath = path2.join(storeDir, DAEMON_OWNER_FILENAME);
+  const reclaimPath = path2.join(storeDir, RECLAIM_FILENAME);
   const record = {
     version: 2,
     pid: process.pid,
@@ -7958,7 +8076,7 @@ var CursorStore = class {
   storeDir;
   fileFor(serverUrl, deviceId) {
     const key = createHash("sha256").update(`${serverUrl}::${deviceId}`).digest("hex").slice(0, 32);
-    return path.join(this.storeDir, `cursor-${key}.json`);
+    return path2.join(this.storeDir, `cursor-${key}.json`);
   }
   async load(serverUrl, deviceId) {
     let raw;
@@ -7978,7 +8096,7 @@ var CursorStore = class {
   }
   async save(serverUrl, deviceId, cursor) {
     const file = this.fileFor(serverUrl, deviceId);
-    await promises.mkdir(path.dirname(file), { recursive: true, mode: 448 });
+    await promises.mkdir(path2.dirname(file), { recursive: true, mode: 448 });
     await atomicWriteFile(file, JSON.stringify({ cursor }));
   }
   /** Remove any persisted cursor for (serverUrl, deviceId) — a no-op if none exists. Called from `pair()` (finding F5) so a device that's about to be replaced never leaves a cursor a future, unrelated device could somehow inherit. */
@@ -8308,7 +8426,7 @@ var SessionWorkspaceStore = class {
    */
   queue = Promise.resolve();
   constructor(storeDir) {
-    this.filePath = path.join(storeDir, "session-workspaces.json");
+    this.filePath = path2.join(storeDir, "session-workspaces.json");
   }
   async get(sessionRef) {
     return this.enqueue(async () => {
@@ -8366,7 +8484,7 @@ var SessionWorkspaceStore = class {
     }
   }
   async save(all) {
-    const dir = path.dirname(this.filePath);
+    const dir = path2.dirname(this.filePath);
     await promises.mkdir(dir, { recursive: true, mode: 448 });
     const tmpPath = `${this.filePath}.${process.pid}-${tmpSeq2++}.tmp`;
     try {
@@ -9910,6 +10028,11 @@ function offeredAgentRef(payload) {
   if (!Object.prototype.hasOwnProperty.call(payload, "agentRef")) return void 0;
   return validateAgentRef(payload.agentRef);
 }
+function offeredSessionRef(payload) {
+  if (!Object.prototype.hasOwnProperty.call(payload, "sessionRef")) return void 0;
+  const value = payload.sessionRef;
+  return typeof value === "string" ? value : void 0;
+}
 function errorMessage4(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -9945,8 +10068,8 @@ function estimateEventBytes(event) {
 }
 async function openArtifact(workspaceDir, name) {
   const realWorkspaceDir = await promises.realpath(workspaceDir).catch(() => workspaceDir);
-  const candidate = path.resolve(realWorkspaceDir, name);
-  const prefix = realWorkspaceDir.endsWith(path.sep) ? realWorkspaceDir : realWorkspaceDir + path.sep;
+  const candidate = path2.resolve(realWorkspaceDir, name);
+  const prefix = realWorkspaceDir.endsWith(path2.sep) ? realWorkspaceDir : realWorkspaceDir + path2.sep;
   if (candidate !== realWorkspaceDir && !candidate.startsWith(prefix)) {
     return { ok: false, reason: `artifact name "${name}" resolves outside the task workspace \u2014 rejected` };
   }
@@ -10278,6 +10401,9 @@ var TaskRunner = class {
       case "task.offer_for_agent_with_egress":
         await this.handleOffer(envelope.task_id, envelope.payload, true);
         return;
+      case "task.offer_for_agent_with_egress_fresh":
+        await this.handleOffer(envelope.task_id, envelope.payload, true);
+        return;
       case "task.cancel":
         await this.handleCancel(envelope.task_id, envelope.payload.reason);
         return;
@@ -10319,6 +10445,7 @@ var TaskRunner = class {
     const decline = (reason, retryable) => {
       this.decline(taskId, reason, retryable, agentRef);
     };
+    const sessionRef = offeredSessionRef(payload);
     if ("egressPolicy" in payload) {
       if (this.deps.agentEgressPolicy === void 0 || !sameEgressPolicy(this.deps.agentEgressPolicy, payload.egressPolicy)) {
         decline("Agent egress offer policy is not exactly enabled by this daemon", false);
@@ -10420,11 +10547,11 @@ var TaskRunner = class {
       let plainWorkspaceNeedsResolve = false;
       if (agentBinding !== void 0) {
         workspaceDir = agentBinding.lease.cwd;
-        if (payload.sessionRef !== void 0) {
+        if (sessionRef !== void 0) {
           try {
             await this.deps.agentSessionHandoffs.requireMatch({
               agentRef: agentBinding.resolution.agentRef,
-              sessionRef: payload.sessionRef,
+              sessionRef,
               runtimeId: pick.descriptor.id,
               cwd: workspaceDir
             });
@@ -10446,15 +10573,15 @@ var TaskRunner = class {
           return;
         }
       } else if (this.deps.gitWorkspaceManager && this.deps.gitWorkspaceStore) {
-        known = payload.sessionRef ? await this.deps.sessionWorkspaces.get(payload.sessionRef) : void 0;
+        known = sessionRef ? await this.deps.sessionWorkspaces.get(sessionRef) : void 0;
         const gitManager = this.deps.gitWorkspaceManager;
         const gitStore = this.deps.gitWorkspaceStore;
-        if (payload.sessionRef) {
-          const ledger = await gitStore.findBySessionAnyPhase(payload.sessionRef).catch(() => void 0);
+        if (sessionRef) {
+          const ledger = await gitStore.findBySessionAnyPhase(sessionRef).catch(() => void 0);
           const sameProtocolTask = ledger?.taskId === taskId;
           const interruptedOldTask = ledger?.phase === "interrupted" && sameProtocolTask;
           const activeDifferentTask = ledger !== void 0 && ledger.taskId !== taskId && (ledger.phase === "preparing" || ledger.phase === "active");
-          if (!known || known.workspaceKind !== "git" || !known.gitWorkspaceId || !ledger || ledger.workspaceId !== known.gitWorkspaceId || ledger.sessionRef !== payload.sessionRef || path.resolve(ledger.workspaceDir) !== path.resolve(known.workspaceDir) || interruptedOldTask || activeDifferentTask) {
+          if (!known || known.workspaceKind !== "git" || !known.gitWorkspaceId || !ledger || ledger.workspaceId !== known.gitWorkspaceId || ledger.sessionRef !== sessionRef || path2.resolve(ledger.workspaceDir) !== path2.resolve(known.workspaceDir) || interruptedOldTask || activeDifferentTask) {
             decline("session is incompatible with Git workspace mode", true);
             return;
           }
@@ -10469,18 +10596,18 @@ var TaskRunner = class {
             return;
           }
         } else {
-          workspaceDir = path.join(this.deps.workspaceRoot, taskId);
+          workspaceDir = path2.join(this.deps.workspaceRoot, taskId);
           gitWorkspaceId = randomUUID();
         }
         try {
-          gitLease = await gitManager.acquireLease(workspaceDir, payload.sessionRef);
+          gitLease = await gitManager.acquireLease(workspaceDir, sessionRef);
         } catch {
           decline("workspace is busy or unavailable", true);
           return;
         }
       } else if (!this.deps.gitWorkspaceManager && !this.deps.gitWorkspaceStore) {
-        known = payload.sessionRef ? await this.deps.sessionWorkspaces.get(payload.sessionRef) : void 0;
-        workspaceDir = known?.workspaceDir ?? path.join(this.deps.workspaceRoot, taskId);
+        known = sessionRef ? await this.deps.sessionWorkspaces.get(sessionRef) : void 0;
+        workspaceDir = known?.workspaceDir ?? path2.join(this.deps.workspaceRoot, taskId);
         plainWorkspaceNeedsResolve = true;
       } else {
         decline("workspace mode is unavailable", true);
@@ -10498,7 +10625,7 @@ var TaskRunner = class {
         policy: decision.policy,
         requiredToolsetIds: requiredToolsets ?? [],
         ...offered.dispatchSelection === void 0 ? {} : { dispatchSelection: offered.dispatchSelection },
-        ...payload.sessionRef === void 0 || known === void 0 && agentBinding === void 0 ? {} : { sessionRef: payload.sessionRef },
+        ...sessionRef === void 0 || known === void 0 && agentBinding === void 0 ? {} : { sessionRef },
         ...agentBinding === void 0 ? {} : {
           agentRef: agentBinding.resolution.agentRef,
           cwd: agentBinding.lease.cwd,
@@ -10601,7 +10728,7 @@ var TaskRunner = class {
             workspaceId,
             taskId,
             workspaceDir,
-            sessionRef: payload.sessionRef,
+            sessionRef,
             phase,
             baseline: gitBaseline ?? observation.head,
             current: observation.head,
@@ -11867,7 +11994,7 @@ var TaskRunner = class {
   }
   /** `reuseDir`, when set (a known sessionRef's recorded workspace), is used verbatim instead of a fresh `workspaceRoot/<taskId>` directory — `mkdir recursive` is idempotent either way, so ensuring-exists is safe to do unconditionally. */
   async resolveWorkspaceDir(taskId, reuseDir) {
-    const dir = reuseDir ?? path.join(this.deps.workspaceRoot, taskId);
+    const dir = reuseDir ?? path2.join(this.deps.workspaceRoot, taskId);
     await promises.mkdir(dir, { recursive: true });
     return dir;
   }
@@ -12005,7 +12132,7 @@ var encoder2 = new TextEncoder();
 function eventBytes(event) {
   return encoder2.encode(JSON.stringify(event)).length;
 }
-var AGENT_EGRESS_DIRECTORY = path.join(".byok", "egress");
+var AGENT_EGRESS_DIRECTORY = path2.join(".byok", "egress");
 var AGENT_RELIABLE_SPOOL_FILENAME = "reliable-v1.jsonl";
 var AgentReliableSpoolError = class extends Error {
   constructor(message) {
@@ -12116,9 +12243,9 @@ var AgentReliableSpool = class _AgentReliableSpool {
   logEntries = 0;
   writeTail = Promise.resolve();
   static async open(homeDir) {
-    const directory = path.join(homeDir, AGENT_EGRESS_DIRECTORY);
+    const directory = path2.join(homeDir, AGENT_EGRESS_DIRECTORY);
     await ensureSecureDir(directory);
-    const spool = new _AgentReliableSpool(homeDir, path.join(directory, AGENT_RELIABLE_SPOOL_FILENAME));
+    const spool = new _AgentReliableSpool(homeDir, path2.join(directory, AGENT_RELIABLE_SPOOL_FILENAME));
     await spool.load();
     return spool;
   }
@@ -12581,7 +12708,7 @@ var AgentEgressController = class {
   }
   /** Re-open every existing Agent-local spool before retrying stable records after restart. */
   async recover(agentsRoot) {
-    if (!path.isAbsolute(agentsRoot)) throw new Error("Agent egress recovery root must be absolute");
+    if (!path2.isAbsolute(agentsRoot)) throw new Error("Agent egress recovery root must be absolute");
     if (!this.active) throw new Error("Agent egress recovery requires an active authenticated enrollment");
     if (this.options.tenantId === void 0) {
       throw new Error("Agent egress recovery requires one authenticated tenant authority");
@@ -12596,14 +12723,14 @@ var AgentEgressController = class {
     }
     for (const entry of entries) {
       if (!entry.isDirectory() || entry.isSymbolicLink()) continue;
-      const homeDir = path.join(canonicalAgentsRoot, entry.name);
+      const homeDir = path2.join(canonicalAgentsRoot, entry.name);
       const canonicalHome = await promises.realpath(homeDir);
-      const relativeHome = path.relative(canonicalAgentsRoot, canonicalHome);
-      if (relativeHome !== entry.name || relativeHome.includes(path.sep) || path.isAbsolute(relativeHome)) {
+      const relativeHome = path2.relative(canonicalAgentsRoot, canonicalHome);
+      if (relativeHome !== entry.name || relativeHome.includes(path2.sep) || path2.isAbsolute(relativeHome)) {
         throw new Error(`Agent egress recovery home escaped the canonical agents root: ${entry.name}`);
       }
       try {
-        await promises.lstat(path.join(homeDir, AGENT_EGRESS_DIRECTORY));
+        await promises.lstat(path2.join(homeDir, AGENT_EGRESS_DIRECTORY));
       } catch (error) {
         if (error.code === "ENOENT") continue;
         throw error;
@@ -12690,12 +12817,12 @@ function isAgentRef(value) {
 }
 function isCanonicalRelativeTarget(value) {
   if (value === "[invalid-target]") return true;
-  if (path.isAbsolute(value) || value.includes("\\")) return false;
+  if (path2.isAbsolute(value) || value.includes("\\")) return false;
   const segments = value.split("/");
   return value.length > 0 && segments.every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
 }
 function validateIdentity(value, label) {
-  if (!isRecord4(value) || !isAgentRef(value.agentRef) || !isNonEmptyString(value.sessionRef) || !isNonEmptyString(value.runtimeId) || !isNonEmptyString(value.cwd) || !path.isAbsolute(value.cwd)) {
+  if (!isRecord4(value) || !isAgentRef(value.agentRef) || !isNonEmptyString(value.sessionRef) || !isNonEmptyString(value.runtimeId) || !isNonEmptyString(value.cwd) || !path2.isAbsolute(value.cwd)) {
     throw new AgentContentAuditStoreError(`${label} has an invalid exact Agent/session identity`);
   }
   return Object.freeze({
@@ -12705,7 +12832,7 @@ function validateIdentity(value, label) {
     }),
     sessionRef: value.sessionRef,
     runtimeId: value.runtimeId,
-    cwd: path.resolve(value.cwd)
+    cwd: path2.resolve(value.cwd)
   });
 }
 function validateReceipt(value) {
@@ -12787,16 +12914,16 @@ function assertUniqueRequestIds(entries) {
   }
 }
 function assertAbsoluteFilePath(filePath) {
-  if (typeof filePath !== "string" || filePath.length === 0 || !path.isAbsolute(filePath)) {
+  if (typeof filePath !== "string" || filePath.length === 0 || !path2.isAbsolute(filePath)) {
     throw new AgentContentAuditStoreError("content audit path must be absolute");
   }
   if (/[\u0000\r\n]/u.test(filePath)) {
     throw new AgentContentAuditStoreError("content audit path must not contain NUL or line breaks");
   }
-  return path.resolve(filePath);
+  return path2.resolve(filePath);
 }
 async function ensureDirectoryNoSymlink2(directory) {
-  const absolute = path.resolve(directory);
+  const absolute = path2.resolve(directory);
   await promises.mkdir(absolute, { recursive: true, mode: 448 });
   const stat = await promises.lstat(absolute);
   if (!stat.isDirectory() || stat.isSymbolicLink()) {
@@ -12830,12 +12957,12 @@ var AgentContentAuditStore = class _AgentContentAuditStore {
   /** The daemon may address this ledger only through an AgentHomeLayout resolution. */
   static forCanonicalAgentHome(canonicalHome) {
     const home = assertAbsoluteFilePath(canonicalHome);
-    return new _AgentContentAuditStore(path.join(home, AGENT_HOME_INTERNAL_DIRECTORY, AGENT_CONTENT_AUDIT_FILENAME));
+    return new _AgentContentAuditStore(path2.join(home, AGENT_HOME_INTERNAL_DIRECTORY, AGENT_CONTENT_AUDIT_FILENAME));
   }
   async append(receipt) {
     const validated = validateReceipt(receipt);
     return this.enqueue(async () => {
-      await ensureDirectoryNoSymlink2(path.dirname(this.filePath));
+      await ensureDirectoryNoSymlink2(path2.dirname(this.filePath));
       await assertAuditFile(this.filePath);
       const entries = await this.readAllUnlocked();
       const prior = entries.find((entry) => entry.requestId === validated.requestId);
@@ -12930,6 +13057,63 @@ var AgentContentAuditStore = class _AgentContentAuditStore {
     return result;
   }
 };
+var AgentHomeProjectionCompletionError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "AgentHomeProjectionCompletionError";
+  }
+};
+function sameAgentRef2(left, right) {
+  return left.agentId === right.agentId && left.profileRevision === right.profileRevision;
+}
+var AgentHomeProjectionCompletionClient = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  async complete(input) {
+    const completion = AgentHomeProjectionCompletionRequestSchema.parse(input);
+    const url = new URL(
+      byokAgentHomeProjectionCompletionPath(completion.requestId),
+      toHttpBase(this.options.serverUrl)
+    );
+    let response;
+    try {
+      response = await authedFetch(
+        url,
+        {
+          method: "PUT",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify(completion)
+        },
+        this.options.auth
+      );
+    } catch (error) {
+      throw new AgentHomeProjectionCompletionError("Agent-home projection completion transport failed", {
+        cause: error
+      });
+    }
+    if (!response.ok) {
+      throw new AgentHomeProjectionCompletionError(
+        `Agent-home projection completion was rejected with HTTP ${response.status}`
+      );
+    }
+    let readback;
+    try {
+      readback = AgentHomeProjectionReadbackSchema.parse(await response.json());
+    } catch (error) {
+      throw new AgentHomeProjectionCompletionError("Agent-home projection completion readback is invalid", {
+        cause: error
+      });
+    }
+    if (readback.tenantId !== this.options.tenantId || readback.deviceId !== this.options.deviceId || readback.requestId !== completion.requestId || !sameAgentRef2(readback.agentRef, completion.agentRef) || readback.projectionHash !== completion.projectionHash || readback.status !== completion.outcome || readback.completedAt === void 0) {
+      throw new AgentHomeProjectionCompletionError(
+        "Agent-home projection completion readback does not exactly match the authenticated request"
+      );
+    }
+    return readback;
+  }
+};
 var AGENT_CONTENT_READ_SURFACES = ["workspace", "transcript", "artifact"];
 var AGENT_CONTENT_READ_CAPABILITIES = Object.freeze({
   workspace: AGENT_CONTENT_WORKSPACE_READ_CAPABILITY,
@@ -13033,8 +13217,8 @@ function normalizeIdentity(value, field) {
   const sessionRef = nonEmptyString(value.sessionRef, `${field}.sessionRef`);
   const runtimeId = nonEmptyString(value.runtimeId, `${field}.runtimeId`);
   const cwd = nonEmptyString(value.cwd, `${field}.cwd`);
-  if (!path.isAbsolute(cwd)) throw new AgentContentReadPolicyError(`${field}.cwd must be absolute`);
-  return Object.freeze({ agentRef, sessionRef, runtimeId, cwd: path.resolve(cwd) });
+  if (!path2.isAbsolute(cwd)) throw new AgentContentReadPolicyError(`${field}.cwd must be absolute`);
+  return Object.freeze({ agentRef, sessionRef, runtimeId, cwd: path2.resolve(cwd) });
 }
 function createAgentContentReadPolicy(input) {
   if (!isRecord5(input) || input.enabled !== true) {
@@ -13062,10 +13246,10 @@ function createAgentContentReadPolicy(input) {
     root = Object.freeze({ kind: "agent-home" });
   } else if (input.root.kind === "runtime-allowlisted") {
     const configuredRoot = nonEmptyString(input.root.root, "contentRead.root.root");
-    if (!path.isAbsolute(configuredRoot)) {
+    if (!path2.isAbsolute(configuredRoot)) {
       throw new AgentContentReadPolicyError("contentRead.root.root must be absolute");
     }
-    root = Object.freeze({ kind: "runtime-allowlisted", root: path.resolve(configuredRoot) });
+    root = Object.freeze({ kind: "runtime-allowlisted", root: path2.resolve(configuredRoot) });
   } else {
     throw new AgentContentReadPolicyError("contentRead.root.kind is not supported");
   }
@@ -13088,11 +13272,11 @@ function createAgentContentReadPolicy(input) {
   });
 }
 function isWithin2(root, candidate) {
-  const relative = path.relative(root, candidate);
-  return relative === "" || relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+  const relative = path2.relative(root, candidate);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path2.sep}`) && !path2.isAbsolute(relative);
 }
 function isPortableAbsoluteTarget(value) {
-  return path.isAbsolute(value) || /^[a-z]:[\\/]/iu.test(value) || /^[/\\]/u.test(value);
+  return path2.isAbsolute(value) || /^[a-z]:[\\/]/iu.test(value) || /^[/\\]/u.test(value);
 }
 function canonicalAuditTarget(value) {
   if (typeof value !== "string" || value.length === 0 || /[\u0000\r\n]/u.test(value) || isPortableAbsoluteTarget(value) || value.includes("\\")) {
@@ -13130,7 +13314,7 @@ function isSensitiveTarget(segments, productNames) {
   return segments.some((segment) => patterns.some((pattern) => nameMatches(pattern, segment)));
 }
 async function resolveExistingAncestor2(inputPath) {
-  let cursor = path.resolve(inputPath);
+  let cursor = path2.resolve(inputPath);
   const tail = [];
   for (; ; ) {
     try {
@@ -13138,9 +13322,9 @@ async function resolveExistingAncestor2(inputPath) {
     } catch (error) {
       const code = error.code;
       if (code !== "ENOENT" && code !== "ENOTDIR") throw error;
-      const parent = path.dirname(cursor);
+      const parent = path2.dirname(cursor);
       if (parent === cursor) throw new TargetPolicyError("target-missing");
-      tail.unshift(path.basename(cursor));
+      tail.unshift(path2.basename(cursor));
       cursor = parent;
     }
   }
@@ -13161,11 +13345,11 @@ var RootPolicyError = class extends Error {
     this.reason = reason;
   }
 };
-function sameAgentRef2(left, right) {
+function sameAgentRef3(left, right) {
   return left.agentId === right.agentId && left.profileRevision === right.profileRevision;
 }
 function sameSessionIdentity(left, right) {
-  return sameAgentRef2(left.agentRef, right.agentRef) && left.sessionRef === right.sessionRef && left.runtimeId === right.runtimeId && left.cwd === right.cwd;
+  return sameAgentRef3(left.agentRef, right.agentRef) && left.sessionRef === right.sessionRef && left.runtimeId === right.runtimeId && left.cwd === right.cwd;
 }
 function validateRequest(request) {
   if (!isRecord5(request)) throw new AgentContentReadRequestError("content read request must be an object");
@@ -13227,18 +13411,18 @@ function normalizeRequestIdentity(value, field) {
   const sessionRef = requestString(value.sessionRef, `${field}.sessionRef`);
   const runtimeId = requestString(value.runtimeId, `${field}.runtimeId`);
   const cwd = requestString(value.cwd, `${field}.cwd`);
-  if (!path.isAbsolute(cwd)) throw new AgentContentReadRequestError(`${field}.cwd must be absolute`);
-  return Object.freeze({ agentRef, sessionRef, runtimeId, cwd: path.resolve(cwd) });
+  if (!path2.isAbsolute(cwd)) throw new AgentContentReadRequestError(`${field}.cwd must be absolute`);
+  return Object.freeze({ agentRef, sessionRef, runtimeId, cwd: path2.resolve(cwd) });
 }
 async function inspectRegularTarget(root, target) {
   const ancestor = await resolveExistingAncestor2(target);
   if (!isWithin2(root, ancestor.canonical)) {
     throw new TargetPolicyError("path-escape");
   }
-  const components = path.relative(root, target).split(path.sep).filter((component) => component.length > 0);
+  const components = path2.relative(root, target).split(path2.sep).filter((component) => component.length > 0);
   let cursor = root;
   for (const [index, component] of components.entries()) {
-    cursor = path.join(cursor, component);
+    cursor = path2.join(cursor, component);
     let stat;
     try {
       stat = await promises.lstat(cursor);
@@ -13303,8 +13487,8 @@ var AgentContentReadPolicyEngine = class {
     this.capabilities = new Set(options.capabilities);
     this.runtimeRoots = Object.freeze((options.runtimeAllowlistedRoots ?? []).map((root, index) => {
       const value = nonEmptyString(root, `contentRead.runtimeAllowlistedRoots[${index}]`);
-      if (!path.isAbsolute(value)) throw new AgentContentReadPolicyError("runtime allowlisted roots must be absolute");
-      return path.resolve(value);
+      if (!path2.isAbsolute(value)) throw new AgentContentReadPolicyError("runtime allowlisted roots must be absolute");
+      return path2.resolve(value);
     }));
     this.resolveSessionIdentity = options.resolveSessionIdentity;
     this.resolveTranscriptIdentity = options.resolveTranscriptIdentity;
@@ -13356,7 +13540,7 @@ var AgentContentReadPolicyEngine = class {
     if (request.decodeAs === "utf8" && !policy.textMimeTypes.includes(request.mimeType)) {
       return this.deny(request, relativeTarget, "text-not-allowlisted");
     }
-    const target = path.resolve(root, ...segments);
+    const target = path2.resolve(root, ...segments);
     if (!isWithin2(root, target)) return this.deny(request, relativeTarget, "path-escape");
     try {
       await inspectRegularTarget(root, target);
@@ -13437,7 +13621,7 @@ var AgentContentReadPolicyEngine = class {
   }
   async checkSessionIdentity(request, resolver, requiredCwd) {
     const session = request.session;
-    if (session === void 0 || !sameAgentRef2(session.agentRef, request.agentRef) || requiredCwd !== void 0 && session.cwd !== requiredCwd) {
+    if (session === void 0 || !sameAgentRef3(session.agentRef, request.agentRef) || requiredCwd !== void 0 && session.cwd !== requiredCwd) {
       return "identity-mismatch";
     }
     let expected;
@@ -13553,7 +13737,7 @@ async function detectRuntimes(adapters) {
   }
   return runtimes;
 }
-function computeCapabilities(adapters, agentHomeConfigured = false, agentEgressConfigured = false, contentReadPolicies) {
+function computeCapabilities(adapters, agentHomeConfigured = false, agentHomeProjectionConfigured = false, agentEgressConfigured = false, contentReadPolicies) {
   const flags = [];
   if (adapters.some((adapter) => adapter.descriptor.capabilities.steer)) flags.push("steer");
   flags.push("blob-upload");
@@ -13568,7 +13752,14 @@ function computeCapabilities(adapters, agentHomeConfigured = false, agentEgressC
     flags.push("toolset-selection");
   }
   if (agentHomeConfigured) flags.push("agent-home-contract");
-  if (agentEgressConfigured) flags.push(AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY);
+  if (agentHomeProjectionConfigured) flags.push(AGENT_HOME_PROJECTION_CAPABILITY);
+  if (agentEgressConfigured) {
+    flags.push(
+      AGENT_EGRESS_POLICY_CAPABILITY,
+      AGENT_EGRESS_RELIABLE_ACK_CAPABILITY,
+      AGENT_EGRESS_FRESH_SESSION_CAPABILITY
+    );
+  }
   if (contentReadPolicies !== void 0) {
     for (const surface of Object.keys(AGENT_CONTENT_READ_CAPABILITIES)) {
       const policy = contentReadPolicies[surface];
@@ -13920,7 +14111,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       }
       await agentHomeManager?.preflight();
       if (config.agentEgress !== void 0 && config.agentHome !== void 0) {
-        await agentEgress.recover(path.join(config.agentHome.hostStorageRoot, "agents"));
+        await agentEgress.recover(path2.join(config.agentHome.hostStorageRoot, "agents"));
       }
       fleetJitter = createFleetJitter(config.productId, record.deviceId);
       if (config.permissionDefaults?.workspaceRoot !== void 0) {
@@ -13975,9 +14166,16 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       const capabilities = computeCapabilities(
         adapters,
         config.agentHome !== void 0,
+        agentHomeManager?.supportsTaskFreeProjection() === true,
         config.agentEgress !== void 0,
         agentContentReadPolicies
       );
+      const agentHomeProjectionCompletion = agentHomeManager?.supportsTaskFreeProjection() === true ? new AgentHomeProjectionCompletionClient({
+        serverUrl: config.serverUrl,
+        auth,
+        tenantId: record.tenantId,
+        deviceId: record.deviceId
+      }) : void 0;
       const journalIdentity = config.hostedJournal ? { tenantId: record.tenantId, productId: config.productId, deviceId: record.deviceId } : void 0;
       const sendSanitizedEnvelope = activeJournal && journalIdentity ? (envelope) => {
         observer.handleOutboundEnvelope(envelope);
@@ -14114,6 +14312,20 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         ...activePressureEngine ? { admissionGuard: () => activePressureEngine.admissionGuard() } : {}
       };
       runner = new TaskRunner(deps);
+      const handleAgentHomeProjectionEnvelope = async (envelope) => {
+        if (envelope.type !== "agent.home.projection") return false;
+        if (agentHomeManager === void 0 || agentHomeProjectionCompletion === void 0) {
+          throw new Error("task-free Agent-home projection is not configured on this daemon");
+        }
+        const outcome = await agentHomeManager.project(envelope.payload);
+        await agentHomeProjectionCompletion.complete({
+          requestId: envelope.payload.requestId,
+          agentRef: envelope.payload.agentRef,
+          projectionHash: envelope.payload.projectionHash,
+          outcome
+        });
+        return true;
+      };
       const handleAgentEgressEnvelope = async (envelope) => {
         if (envelope.type !== "agent.egress.ack") return false;
         if (config.agentEgress === void 0) return true;
@@ -14269,6 +14481,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
             throw new Error("tenant enrollment is being re-paired; inbound work is blocked until restart");
           }
           observer.handleInboundEnvelope(envelope);
+          if (await handleAgentHomeProjectionEnvelope(envelope)) return;
           if (await handleAgentEgressEnvelope(envelope)) return;
           if (await handleAgentContentReadEnvelope(envelope)) return;
           activePressureEngine?.assertAckCriticalAllowed();
@@ -14279,6 +14492,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
             return Promise.reject(new Error("tenant enrollment is being re-paired; inbound work is blocked until restart"));
           }
           observer.handleInboundEnvelope(envelope);
+          if (envelope.type === "agent.home.projection") return handleAgentHomeProjectionEnvelope(envelope).then(() => void 0);
           if (envelope.type === "agent.egress.ack") return handleAgentEgressEnvelope(envelope).then(() => void 0);
           if (envelope.type === "agent.content.read") return handleAgentContentReadEnvelope(envelope).then(() => void 0);
           return runner?.handleEnvelope(envelope) ?? Promise.resolve();
@@ -14773,7 +14987,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
     connection.send(sanitized.envelope);
   }
   async function publishReliableAgentEgress(input) {
-    if (config.agentEgress === void 0 || agentHomeManager === void 0) {
+    if (config.agentEgress === void 0 || agentHomeManager === void 0 || agentSessionHandoffs === void 0) {
       throw new Error("Agent reliable egress is not configured");
     }
     if (tenantRebinding) {
@@ -14782,12 +14996,21 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
     const binding = await agentHomeManager.acquire(input.agentRef);
     try {
       await agentHomeManager.initialize(binding);
+      const handoff = await agentSessionHandoffs.requireMatch({
+        agentRef: binding.resolution.agentRef,
+        sessionRef: input.sessionRef,
+        runtimeId: input.runtimeId,
+        cwd: binding.resolution.canonicalHome
+      });
+      if (handoff.taskId !== input.taskId) {
+        throw new Error("Agent reliable egress taskId does not match the durable session handoff");
+      }
       const appended = await agentEgress.appendReliable({
         homeDir: binding.resolution.canonicalHome,
         agentRef: binding.resolution.agentRef,
         sessionRef: input.sessionRef,
         payload: input.payload,
-        ...input.taskId === void 0 ? {} : { taskId: input.taskId },
+        taskId: input.taskId,
         ...input.eventId === void 0 ? {} : { eventId: input.eventId }
       });
       if (appended.ok) dispatchReliableRecord(appended.record);
@@ -15132,8 +15355,8 @@ function generateLaunchdPlist(def) {
   const { label, program, logDir } = def;
   const args = [program.command, ...program.args];
   const cwd = program.cwd ?? os.homedir();
-  const outLog = path.join(logDir, `${label}.out.log`);
-  const errLog = path.join(logDir, `${label}.err.log`);
+  const outLog = path2.join(logDir, `${label}.out.log`);
+  const errLog = path2.join(logDir, `${label}.err.log`);
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -15174,7 +15397,7 @@ function createLaunchdLifecycle(def, deps = {}) {
     return process.getuid();
   });
   const label = sanitizeServiceName(def.name);
-  const plistPath = () => path.join(homedir(), "Library", "LaunchAgents", `${label}.plist`);
+  const plistPath = () => path2.join(homedir(), "Library", "LaunchAgents", `${label}.plist`);
   const domainTarget = () => `gui/${getuid()}`;
   const serviceTarget = () => `${domainTarget()}/${label}`;
   async function fileExists(p) {
@@ -15187,7 +15410,7 @@ function createLaunchdLifecycle(def, deps = {}) {
   }
   async function writePlist(program) {
     const xml = generateLaunchdPlist({ label, program, logDir: def.logDir });
-    await fs26.mkdir(path.dirname(plistPath()), { recursive: true });
+    await fs26.mkdir(path2.dirname(plistPath()), { recursive: true });
     await fs26.mkdir(def.logDir, { recursive: true });
     await fs26.writeFile(plistPath(), xml, "utf8");
   }
@@ -15261,8 +15484,8 @@ function generateSystemdUnit(def) {
   assertNoControlChars(displayName, "displayName");
   const cwd = program.cwd ?? os.homedir();
   assertNoControlChars(cwd, "program.cwd");
-  const outLog = path.join(logDir, `${name}.out.log`);
-  const errLog = path.join(logDir, `${name}.err.log`);
+  const outLog = path2.join(logDir, `${name}.out.log`);
+  const errLog = path2.join(logDir, `${name}.err.log`);
   assertNoControlChars(outLog, "logDir");
   assertNoControlChars(errLog, "logDir");
   const execStart = [program.command, ...program.args].map(quoteSystemdArg).join(" ");
@@ -15288,7 +15511,7 @@ function createSystemdLifecycle(def, deps = {}) {
   const homedir = deps.homedir ?? (() => os.homedir());
   const name = sanitizeServiceName(def.name);
   const unitName = `${name}.service`;
-  const unitPath = () => path.join(homedir(), ".config", "systemd", "user", unitName);
+  const unitPath = () => path2.join(homedir(), ".config", "systemd", "user", unitName);
   async function fileExists(p) {
     try {
       await fs26.stat(p);
@@ -15299,7 +15522,7 @@ function createSystemdLifecycle(def, deps = {}) {
   }
   async function writeUnit(program) {
     const unit = generateSystemdUnit({ name, displayName: def.displayName ?? def.name, program, logDir: def.logDir });
-    await fs26.mkdir(path.dirname(unitPath()), { recursive: true });
+    await fs26.mkdir(path2.dirname(unitPath()), { recursive: true });
     await fs26.mkdir(def.logDir, { recursive: true });
     await fs26.writeFile(unitPath(), unit, "utf8");
   }
@@ -15381,8 +15604,8 @@ function createWinswLifecycle(def, deps = {}) {
   const winswBin = windows.winswBin;
   const id = sanitizeServiceName(def.name);
   const installDir = windows.installDir ?? def.logDir;
-  const exePath = path.join(installDir, `${id}.exe`);
-  const xmlPath = path.join(installDir, `${id}.xml`);
+  const exePath = path2.join(installDir, `${id}.exe`);
+  const xmlPath = path2.join(installDir, `${id}.xml`);
   async function fileExists(p) {
     try {
       await fs26.stat(p);
@@ -15452,7 +15675,7 @@ function createServiceLifecycle(def, opts = {}) {
 
 // src/bin/official-release.ts
 var OFFICIAL_LOCAL_AGENT_RELEASE = resolveLocalAgentReleaseIdentity({
-  version: "0.7.0"
+  version: "0.8.0"
 });
 
 // src/bin/config.ts
@@ -15937,7 +16160,7 @@ function safeProtocol(serverUrl) {
   }
 }
 async function inspectDevice(storeDir) {
-  const filePath = path.join(storeDir, "device.json");
+  const filePath = path2.join(storeDir, "device.json");
   let pathStat;
   try {
     pathStat = await promises.lstat(filePath);
@@ -16017,11 +16240,11 @@ async function copyOpenFileBounded(source, expected, destinationPath) {
   }
 }
 async function inspectJournal(storeDir) {
-  const journalPath = path.join(storeDir, JOURNAL_DB_FILENAME);
+  const journalPath = path2.join(storeDir, JOURNAL_DB_FILENAME);
   try {
     const mainIdentity = await regularFileIdentity(journalPath);
     if (mainIdentity === void 0) return { status: "missing" };
-    const walIdentity = await regularFileIdentity(path.join(storeDir, `${JOURNAL_DB_FILENAME}-wal`));
+    const walIdentity = await regularFileIdentity(path2.join(storeDir, `${JOURNAL_DB_FILENAME}-wal`));
     let sizeBytes = Number(mainIdentity.size);
     let walBytes = walIdentity === void 0 ? void 0 : Number(walIdentity.size);
     if (!isSqliteAvailable()) {
@@ -16029,7 +16252,7 @@ async function inspectJournal(storeDir) {
     }
     const componentNames = [JOURNAL_DB_FILENAME, `${JOURNAL_DB_FILENAME}-wal`, `${JOURNAL_DB_FILENAME}-shm`];
     const initial = /* @__PURE__ */ new Map();
-    for (const name of componentNames) initial.set(name, await regularFileIdentity(path.join(storeDir, name)));
+    for (const name of componentNames) initial.set(name, await regularFileIdentity(path2.join(storeDir, name)));
     const snapshotMain = initial.get(JOURNAL_DB_FILENAME);
     if (!snapshotMain) return { status: "unavailable", reason: "journal changed during diagnostics snapshot" };
     sizeBytes = Number(snapshotMain.size);
@@ -16041,7 +16264,7 @@ async function inspectJournal(storeDir) {
         let handle;
         try {
           handle = await promises.open(
-            path.join(storeDir, name),
+            path2.join(storeDir, name),
             constants.O_RDONLY | constants.O_NONBLOCK | (constants.O_NOFOLLOW ?? 0)
           );
         } catch (err) {
@@ -16070,28 +16293,28 @@ async function inspectJournal(storeDir) {
           reason: "journal exceeds the bounded diagnostics copy limit"
         };
       }
-      const tempDir = await promises.mkdtemp(path.join(os.tmpdir(), "byok-journal-inspect-"));
+      const tempDir = await promises.mkdtemp(path2.join(os.tmpdir(), "byok-journal-inspect-"));
       const { DatabaseSync } = loadSqliteModule();
       let db;
       try {
         for (const name of componentNames) {
           const component = opened.get(name);
-          if (component && !await copyOpenFileBounded(component.handle, component.identity, path.join(tempDir, name))) {
+          if (component && !await copyOpenFileBounded(component.handle, component.identity, path2.join(tempDir, name))) {
             return { status: "unavailable", sizeBytes, ...walBytes === void 0 ? {} : { walBytes }, reason: "journal changed during diagnostics snapshot" };
           }
         }
         for (const [name, component] of opened) {
-          if (!sameIdentity(component.identity, identityFromBigIntStat(await component.handle.stat({ bigint: true }))) || !sameIdentity(component.identity, await regularFileIdentity(path.join(storeDir, name)))) {
+          if (!sameIdentity(component.identity, identityFromBigIntStat(await component.handle.stat({ bigint: true }))) || !sameIdentity(component.identity, await regularFileIdentity(path2.join(storeDir, name)))) {
             return { status: "unavailable", sizeBytes, ...walBytes === void 0 ? {} : { walBytes }, reason: "journal changed during diagnostics snapshot" };
           }
         }
         for (const name of componentNames) {
-          if (!opened.has(name) && await regularFileIdentity(path.join(storeDir, name)) !== void 0) {
+          if (!opened.has(name) && await regularFileIdentity(path2.join(storeDir, name)) !== void 0) {
             return { status: "unavailable", sizeBytes, ...walBytes === void 0 ? {} : { walBytes }, reason: "journal changed during diagnostics snapshot" };
           }
         }
         const header = Buffer.alloc(16);
-        const copiedHandle = await promises.open(path.join(tempDir, JOURNAL_DB_FILENAME), "r");
+        const copiedHandle = await promises.open(path2.join(tempDir, JOURNAL_DB_FILENAME), "r");
         try {
           const { bytesRead } = await copiedHandle.read(header, 0, header.length, 0);
           if (bytesRead !== 16 || header.toString("binary") !== "SQLite format 3\0") {
@@ -16100,7 +16323,7 @@ async function inspectJournal(storeDir) {
         } finally {
           await copiedHandle.close();
         }
-        db = new DatabaseSync(path.join(tempDir, JOURNAL_DB_FILENAME), { readOnly: true });
+        db = new DatabaseSync(path2.join(tempDir, JOURNAL_DB_FILENAME), { readOnly: true });
         const result = db.prepare("PRAGMA quick_check(1)").get();
         if (result?.quick_check !== "ok") {
           return { status: "corrupt", sizeBytes, ...walBytes === void 0 ? {} : { walBytes }, reason: "journal quick_check failed" };
@@ -16135,7 +16358,7 @@ async function inspectWorkspace(workspaceRoot) {
   }
 }
 function readPinnedQuarantineFile(name, maxBytes, includeBytes, budget) {
-  if (path.basename(name) !== name || name === "." || name === "..") {
+  if (path2.basename(name) !== name || name === "." || name === "..") {
     throw new Error("quarantine manifest contains an invalid evidence name");
   }
   const namedBefore = lstatSync(name, { bigint: true });
@@ -16239,10 +16462,10 @@ function inspectQuarantinePinned(dir, expectedDirectory) {
       if (isJournalQuarantineManifest(parsed)) {
         const manifestBase = manifestName.slice(0, -".manifest.json".length);
         const boundNames = parsed.files.map((file) => {
-          if (path.dirname(path.resolve(file)) !== path.resolve(".")) {
+          if (path2.dirname(path2.resolve(file)) !== path2.resolve(".")) {
             throw new Error("journal quarantine manifest points outside quarantine");
           }
-          return path.basename(file);
+          return path2.basename(file);
         });
         if (!boundNames.includes(manifestBase)) {
           throw new Error("journal quarantine manifest is not bound to its primary database evidence");
@@ -16282,7 +16505,7 @@ function inspectQuarantinePinned(dir, expectedDirectory) {
   }
 }
 async function inspectQuarantine(storeDir) {
-  const dir = path.join(storeDir, JOURNAL_QUARANTINE_DIRNAME);
+  const dir = path2.join(storeDir, JOURNAL_QUARANTINE_DIRNAME);
   let directory;
   try {
     directory = await promises.lstat(dir, { bigint: true });
@@ -16353,7 +16576,7 @@ function checksFor(snapshot) {
   ];
 }
 async function collectDiagnostics(config, storeDir, options = {}) {
-  const resolvedStoreDir = path.resolve(storeDir);
+  const resolvedStoreDir = path2.resolve(storeDir);
   const adapters = options.adapters ?? defaultRuntimeAdapters(config.runtimeAllowlist);
   const connectControl = options.connectControl ?? connectControlClient;
   const [device, probedRuntimes, health, journal, workspace, quarantine, controlConnection] = await Promise.all([
@@ -16528,7 +16751,7 @@ function publishQuarantineEvidencePinned(quarantineDir, expectedDirectory, sourc
     unlinkSync(sourcePath);
     sourceRemoved = true;
     if (process.platform !== "win32") {
-      const directoryFd = openSync(path.dirname(sourcePath), constants.O_RDONLY);
+      const directoryFd = openSync(path2.dirname(sourcePath), constants.O_RDONLY);
       try {
         fsyncSync(directoryFd);
       } finally {
@@ -16567,10 +16790,10 @@ function publishQuarantineEvidencePinned(quarantineDir, expectedDirectory, sourc
   }
 }
 async function quarantineCorruptOperationalHealth(storeDir, options = {}) {
-  const resolvedStoreDir = path.resolve(storeDir);
+  const resolvedStoreDir = path2.resolve(storeDir);
   const owner = await acquireDaemonOwner(resolvedStoreDir, "doctor", options.clock);
   try {
-    const sourcePath = path.join(resolvedStoreDir, OPERATIONAL_HEALTH_FILENAME);
+    const sourcePath = path2.join(resolvedStoreDir, OPERATIONAL_HEALTH_FILENAME);
     let opened;
     try {
       opened = await openOperationalHealthFile(resolvedStoreDir);
@@ -16587,7 +16810,7 @@ async function quarantineCorruptOperationalHealth(storeDir, options = {}) {
       }
       const sourceStat = await source.stat({ bigint: true });
       if (!sourceStat.isFile()) throw new Error("operational health state is not a regular file; refusing quarantine");
-      const quarantineDir = path.join(resolvedStoreDir, JOURNAL_QUARANTINE_DIRNAME);
+      const quarantineDir = path2.join(resolvedStoreDir, JOURNAL_QUARANTINE_DIRNAME);
       try {
         const existing = await promises.lstat(quarantineDir);
         if (!existing.isDirectory() || existing.isSymbolicLink()) {
@@ -16688,8 +16911,8 @@ function buildServiceDefinition(config, configPath, rest) {
   const name = argValue(rest, "--name") ?? config.productId;
   const agentBin = argValue(rest, "--agent-bin") ?? process.argv[1] ?? "byok-agent";
   const nodeBin = argValue(rest, "--node-bin") ?? process.execPath;
-  const absoluteConfigPath = path.resolve(configPath);
-  const logDir = path.join(resolveStoreDir(config), "service-logs");
+  const absoluteConfigPath = path2.resolve(configPath);
+  const logDir = path2.join(resolveStoreDir(config), "service-logs");
   const definition = {
     name,
     displayName: config.branding?.displayName ?? config.productName,
@@ -16743,7 +16966,7 @@ async function runServiceStatusCommand(config, configPath, rest, deps = {}) {
   log(`detail: ${status.detail.trim() || "(none)"}`);
 }
 function auditLogPath(storeDir) {
-  return path.join(storeDir, "audit.jsonl");
+  return path2.join(storeDir, "audit.jsonl");
 }
 var AUDIT_LOG_MODE = 384;
 var AUDIT_STORE_DIR_MODE = 448;
@@ -17581,11 +17804,11 @@ async function createSupportBundle(config, storeDir, options = {}) {
   };
 }
 async function writeSupportBundle(outputPath, bundle, secureFileOptions = {}) {
-  const dir = path.dirname(outputPath);
+  const dir = path2.dirname(outputPath);
   const parentStat = await promises.stat(dir);
   if (!parentStat.isDirectory()) throw new Error("support bundle output parent is not a directory");
-  const privateDir = path.join(dir, `.${path.basename(outputPath)}.${process.pid}.${randomUUID()}.private`);
-  const tempPath = path.join(privateDir, "bundle.tmp");
+  const privateDir = path2.join(dir, `.${path2.basename(outputPath)}.${process.pid}.${randomUUID()}.private`);
+  const tempPath = path2.join(privateDir, "bundle.tmp");
   try {
     await promises.mkdir(privateDir, { mode: 448 });
     await ensureSecureDir(privateDir, secureFileOptions);
@@ -17615,7 +17838,7 @@ async function writeSupportBundle(outputPath, bundle, secureFileOptions = {}) {
 // src/bin/commands/support-bundle.ts
 async function runSupportBundleCommand(config, options) {
   if (!options.outputPath) throw new Error("support-bundle requires --output <path>");
-  const outputPath = path.resolve(options.outputPath);
+  const outputPath = path2.resolve(options.outputPath);
   const bundle = await createSupportBundle(config, resolveStoreDir(config), options);
   await writeSupportBundle(outputPath, bundle);
   const log = options.log ?? ((line) => console.log(line));