@byok-sdk/client 0.7.0 → 0.8.0

package/dist/index.js

@@ -1,7 +1,7 @@
 import { randomUUID, createHash, sign, createPrivateKey, generateKeyPairSync, randomBytes, timingSafeEqual, createHmac } from 'crypto';
 import { promises, mkdirSync, existsSync, renameSync, writeFileSync, chmodSync, statSync, readdirSync, linkSync, fstatSync, lstatSync, unlinkSync, constants, readFileSync, realpathSync } from 'fs';
-import path, { join, isAbsolute } from 'path';
-import { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, AgentRefSchema, BYOK_PAIR_PATH, PairResponseSchema, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, byokBlobUrlPath, BYOK_BLOBS_PATH, byokBlobFinalizePath, partitionAgentEvents, BYOK_SKILL_PACKS_PATH, byokSkillPackFilePath, BYOK_RECORDS_PATH, byokRecordPath, TASK_TRANSITIONS, AgentEgressPolicySchema, CONFIGURED_TOOLSETS_MAX_ITEMS, ToolsetIdSchema, AgentContentReceiptPayloadSchema, encodeEnvelope, PROTOCOL_VERSION, createEnvelope, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, parseMessage, checkResultDocument, MAX_MESSAGES_PER_BATCH, BYOK_CAPABILITIES_PATH, BYOK_PRESENCE_PATH, RuntimeIdSchema, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, RESULT_DOCUMENT_MAX_BYTES, decodeEnvelope, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendResponseSchema, UnknownMessageTypeError, BYOK_WS_PATH } from '@byok-sdk/protocol';
+import path2, { join, isAbsolute } from 'path';
+import { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, AgentRefSchema, AgentHomeProjectionPayloadSchema, BYOK_PAIR_PATH, PairResponseSchema, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, byokBlobUrlPath, BYOK_BLOBS_PATH, byokBlobFinalizePath, partitionAgentEvents, BYOK_SKILL_PACKS_PATH, byokSkillPackFilePath, BYOK_RECORDS_PATH, byokRecordPath, TASK_TRANSITIONS, AgentEgressPolicySchema, CONFIGURED_TOOLSETS_MAX_ITEMS, ToolsetIdSchema, AgentContentReceiptPayloadSchema, encodeEnvelope, PROTOCOL_VERSION, createEnvelope, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, AGENT_HOME_PROJECTION_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AgentHomeProjectionCompletionRequestSchema, byokAgentHomeProjectionCompletionPath, AgentHomeProjectionReadbackSchema, parseMessage, checkResultDocument, MAX_MESSAGES_PER_BATCH, BYOK_CAPABILITIES_PATH, BYOK_PRESENCE_PATH, RuntimeIdSchema, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, RESULT_DOCUMENT_MAX_BYTES, decodeEnvelope, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendResponseSchema, UnknownMessageTypeError, BYOK_WS_PATH } from '@byok-sdk/protocol';
 import { execFile, spawn } from 'child_process';
 import os6 from 'os';
 import { parseDeviceAssertionEnvelope, tenantId, DeviceProofProtectedClaimsSchema, deviceProofSigningInput, DEVICE_PROOF_SCHEMA_ID, SKILL_PACK_MAX_BYTES, hasCapability, parseSkillPackManifest, checkSkillPackManifest, skillPackContentHashInput, checkSkillPackFileContent, SKILL_PACK_ENTRY_PATH, checkSkillPackEntry, isSkillPackPathSafe, DEVICE_PROOF_HEADER, contentHash as contentHash$1, TRUTH_RECORD_KINDS, nonceSigningBytes, DEVICE_ASSERTION_AUDIENCE_MAX_BYTES, DEVICE_ASSERTION_DEFAULT_TTL_MS, DEVICE_ASSERTION_MAX_TTL_MS, CONTENT_HASH_PATTERN, isTenantId, CapabilityDeclarationSchema, DeviceAssertionClaimsSchema, deviceAssertionSigningInput, DEVICE_ASSERTION_SCHEMA_ID } from '@byok-sdk/core';
@@ -12,9 +12,80 @@ import net, { createServer, createConnection } from 'net';
 import { WebSocket } from 'ws';
 import { createRequire } from 'module';
 
+// src/agent-home.ts
+var tmpSeq = 0;
+async function atomicWriteFile(filePath, data, options = {}) {
+  const tmpPath = `${filePath}.${process.pid}-${tmpSeq++}.tmp`;
+  try {
+    const handle = await promises.open(tmpPath, "w", options.mode);
+    try {
+      await handle.writeFile(data);
+      if (options.mode !== void 0) {
+        await handle.chmod(options.mode);
+      }
+      if (options.fsync) {
+        await handle.sync();
+      }
+    } finally {
+      await handle.close();
+    }
+  } catch (err) {
+    await promises.rm(tmpPath, { force: true }).catch(() => {
+    });
+    throw err;
+  }
+  await renameOnto(tmpPath, filePath);
+  if (options.mode !== void 0) {
+    await promises.chmod(filePath, options.mode);
+  }
+  if (options.fsync) {
+    const target = await promises.open(filePath, process.platform === "win32" ? "r+" : "r");
+    try {
+      await target.sync();
+    } finally {
+      await target.close();
+    }
+    if (process.platform !== "win32") {
+      const directory = await promises.open(path2.dirname(filePath), "r");
+      try {
+        await directory.sync();
+      } finally {
+        await directory.close();
+      }
+    }
+  }
+}
+var RENAME_RETRY_ATTEMPTS = 5;
+var RENAME_RETRY_DELAY_MS = 20;
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function renameOnto(tmpPath, targetPath) {
+  for (let attempt = 1; attempt <= RENAME_RETRY_ATTEMPTS; attempt++) {
+    try {
+      await promises.rename(tmpPath, targetPath);
+      return;
+    } catch (err) {
+      const code = err.code;
+      if (code !== "EPERM" && code !== "EEXIST") {
+        await promises.rm(tmpPath, { force: true }).catch(() => {
+        });
+        throw err;
+      }
+      if (attempt === RENAME_RETRY_ATTEMPTS) {
+        await promises.rm(tmpPath, { force: true }).catch(() => {
+        });
+        throw err;
+      }
+      await delay(RENAME_RETRY_DELAY_MS * attempt);
+    }
+  }
+}
+
 // src/agent-home.ts
 var AGENT_HOME_DIRECTORY = "agents";
 var AGENT_HOME_INTERNAL_DIRECTORY = ".byok";
+var AGENT_HOME_PROJECTION_STATE_FILE = "agent-home-projection.json";
 var AgentHomeError = class extends Error {
   constructor(message) {
     super(message);
@@ -63,11 +134,11 @@ function validateAgentRef(value) {
   return Object.freeze({ agentId: candidate.agentId, profileRevision: candidate.profileRevision });
 }
 function isWithin(root, candidate) {
-  const relative = path.relative(root, candidate);
-  return relative === "" || relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+  const relative = path2.relative(root, candidate);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path2.sep}`) && !path2.isAbsolute(relative);
 }
 function assertAbsolutePath(value, label) {
-  if (typeof value !== "string" || value.length === 0 || !path.isAbsolute(value)) {
+  if (typeof value !== "string" || value.length === 0 || !path2.isAbsolute(value)) {
     throw new AgentHomeResolutionError(`${label} must be an absolute path`);
   }
   if (/[\u0000\r\n]/u.test(value)) {
@@ -75,7 +146,7 @@ function assertAbsolutePath(value, label) {
   }
 }
 async function resolveExistingAncestor(inputPath) {
-  let cursor = path.resolve(inputPath);
+  let cursor = path2.resolve(inputPath);
   const tail = [];
   for (; ; ) {
     try {
@@ -83,9 +154,9 @@ async function resolveExistingAncestor(inputPath) {
     } catch (error) {
       const code = error.code;
       if (code !== "ENOENT" && code !== "ENOTDIR") throw error;
-      const parent = path.dirname(cursor);
+      const parent = path2.dirname(cursor);
       if (parent === cursor) throw new AgentHomeResolutionError(`no existing ancestor for ${inputPath}`);
-      tail.unshift(path.basename(cursor));
+      tail.unshift(path2.basename(cursor));
       cursor = parent;
     }
   }
@@ -94,7 +165,7 @@ async function materializeDirectory(inputPath) {
   const { canonical: canonical2, tail } = await resolveExistingAncestor(inputPath);
   let cursor = canonical2;
   for (const component of tail) {
-    cursor = path.join(cursor, component);
+    cursor = path2.join(cursor, component);
     try {
       const stat = await promises.lstat(cursor);
       if (!stat.isDirectory() || stat.isSymbolicLink()) {
@@ -113,11 +184,11 @@ async function materializeDirectory(inputPath) {
 }
 async function ensureDirectoryNoSymlink(root, target) {
   if (!isWithin(root, target)) throw new AgentHomeResolutionError("Agent home is outside hostStorageRoot");
-  const relative = path.relative(root, target);
-  const components = relative === "" ? [] : relative.split(path.sep);
+  const relative = path2.relative(root, target);
+  const components = relative === "" ? [] : relative.split(path2.sep);
   let cursor = root;
   for (const component of components) {
-    cursor = path.join(cursor, component);
+    cursor = path2.join(cursor, component);
     try {
       const stat = await promises.lstat(cursor);
       if (!stat.isDirectory() || stat.isSymbolicLink()) {
@@ -153,16 +224,16 @@ var AgentHomeLayout = class {
   canonicalRoot;
   constructor(hostStorageRoot) {
     assertAbsolutePath(hostStorageRoot, "agentHome.hostStorageRoot");
-    this.hostStorageRootInput = path.resolve(hostStorageRoot);
+    this.hostStorageRootInput = path2.resolve(hostStorageRoot);
   }
   async resolve(agentRefInput) {
     const agentRef = validateAgentRef(agentRefInput);
     const hostStorageRoot = await this.resolveRoot();
     const agentsRoot = await ensureDirectoryNoSymlink(
       hostStorageRoot,
-      path.join(hostStorageRoot, AGENT_HOME_DIRECTORY)
+      path2.join(hostStorageRoot, AGENT_HOME_DIRECTORY)
     );
-    const lexicalHome = path.join(agentsRoot, agentRef.agentId);
+    const lexicalHome = path2.join(agentsRoot, agentRef.agentId);
     const canonicalHome = await ensureDirectoryNoSymlink(agentsRoot, lexicalHome);
     const priorAgentId = this.agentIdByCanonicalHome.get(canonicalHome);
     if (priorAgentId !== void 0 && priorAgentId !== agentRef.agentId) {
@@ -192,9 +263,9 @@ var AgentHomeLayout = class {
       const hostStorageRoot = await this.resolveRoot();
       const agentsRoot = await ensureDirectoryNoSymlink(
         hostStorageRoot,
-        path.join(hostStorageRoot, AGENT_HOME_DIRECTORY)
+        path2.join(hostStorageRoot, AGENT_HOME_DIRECTORY)
       );
-      probePath = path.join(agentsRoot, `.byok-agent-home-preflight-${randomUUID()}`);
+      probePath = path2.join(agentsRoot, `.byok-agent-home-preflight-${randomUUID()}`);
       handle = await promises.open(probePath, "wx", 384);
       created = true;
       await handle.sync();
@@ -225,7 +296,7 @@ var AgentHomeLayout = class {
   }
 };
 function stableAgentHomeOwnerId(storeDir, productId) {
-  const identity = `${path.resolve(storeDir)}\0${productId}`;
+  const identity = `${path2.resolve(storeDir)}\0${productId}`;
   return `store-product:${createHash("sha256").update(identity).digest("hex")}`;
 }
 function parseLeaseMarker(value, lockPath) {
@@ -235,7 +306,7 @@ function parseLeaseMarker(value, lockPath) {
   } catch {
     throw new AgentHomeLeaseCorruptError(`Agent home lease marker ${lockPath} is corrupt`);
   }
-  if (typeof parsed !== "object" || parsed === null || parsed.version !== 1 || typeof parsed.ownerId !== "string" || typeof parsed.leaseId !== "string" || typeof parsed.canonicalHome !== "string" || !path.isAbsolute(parsed.canonicalHome)) {
+  if (typeof parsed !== "object" || parsed === null || parsed.version !== 1 || typeof parsed.ownerId !== "string" || typeof parsed.leaseId !== "string" || typeof parsed.canonicalHome !== "string" || !path2.isAbsolute(parsed.canonicalHome)) {
     throw new AgentHomeLeaseCorruptError(`Agent home lease marker ${lockPath} has an invalid shape`);
   }
   let agentRef;
@@ -245,7 +316,7 @@ function parseLeaseMarker(value, lockPath) {
     throw new AgentHomeLeaseCorruptError(`Agent home lease marker ${lockPath} has an invalid AgentRef`);
   }
   const marker = parsed;
-  return { ...marker, agentRef, canonicalHome: path.resolve(marker.canonicalHome) };
+  return { ...marker, agentRef, canonicalHome: path2.resolve(marker.canonicalHome) };
 }
 var AgentHomeLeaseManager = class _AgentHomeLeaseManager {
   static held = /* @__PURE__ */ new Map();
@@ -267,9 +338,9 @@ var AgentHomeLeaseManager = class _AgentHomeLeaseManager {
       await ensureDirectoryNoSymlink(resolution.agentsRoot, canonicalHome);
       const internalDir = await ensureDirectoryNoSymlink(
         canonicalHome,
-        path.join(canonicalHome, AGENT_HOME_INTERNAL_DIRECTORY)
+        path2.join(canonicalHome, AGENT_HOME_INTERNAL_DIRECTORY)
       );
-      lockPath = path.join(internalDir, "agent-home.lease");
+      lockPath = path2.join(internalDir, "agent-home.lease");
       handle = await this.openLeaseMarker(lockPath, canonicalHome, agentRef.agentId);
       ownsMarker = true;
       const marker = {
@@ -368,9 +439,73 @@ var AgentHomeLeaseManager = class _AgentHomeLeaseManager {
 async function initializeAgentHome(resolution) {
   await ensureDirectoryNoSymlink(
     resolution.canonicalHome,
-    path.join(resolution.canonicalHome, "notes")
+    path2.join(resolution.canonicalHome, "notes")
   );
-  await ensurePreservedFile(path.join(resolution.canonicalHome, "MEMORY.md"));
+  await ensurePreservedFile(path2.join(resolution.canonicalHome, "MEMORY.md"));
+}
+function projectionStatePath(resolution) {
+  return path2.join(
+    resolution.canonicalHome,
+    AGENT_HOME_INTERNAL_DIRECTORY,
+    AGENT_HOME_PROJECTION_STATE_FILE
+  );
+}
+async function readProjectionState(resolution) {
+  const filePath = projectionStatePath(resolution);
+  try {
+    const stat = await promises.lstat(filePath);
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+      throw new AgentHomeResolutionError(`Agent projection state is not a regular file: ${filePath}`);
+    }
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(await promises.readFile(filePath, "utf8"));
+  } catch (error) {
+    throw new AgentHomeResolutionError(
+      `Agent projection state is corrupt: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  if (typeof parsed !== "object" || parsed === null || parsed.version !== 1 || typeof parsed.requestId !== "string" || typeof parsed.projectionHash !== "string") {
+    throw new AgentHomeResolutionError("Agent projection state has an invalid shape");
+  }
+  const candidate = parsed;
+  const agentRef = validateAgentRef(candidate.agentRef);
+  if (agentRef.agentId !== resolution.agentRef.agentId) {
+    throw new AgentHomeCollisionError("Agent projection state belongs to a different Agent home");
+  }
+  return Object.freeze({
+    version: 1,
+    agentRef,
+    requestId: candidate.requestId,
+    projectionHash: candidate.projectionHash
+  });
+}
+async function writeProjectionState(resolution, payload) {
+  const filePath = projectionStatePath(resolution);
+  const existing = await promises.lstat(filePath).catch((error) => {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  });
+  if (existing !== void 0 && (!existing.isFile() || existing.isSymbolicLink())) {
+    throw new AgentHomeResolutionError(`Agent projection state is not a regular file: ${filePath}`);
+  }
+  const state = {
+    version: 1,
+    agentRef: payload.agentRef,
+    requestId: payload.requestId,
+    projectionHash: payload.projectionHash
+  };
+  await atomicWriteFile(filePath, `${JSON.stringify(state)}
+`, { mode: 384, fsync: true });
+}
+function compareProjectionRevision(left, right) {
+  const leftRevision = BigInt(left);
+  const rightRevision = BigInt(right);
+  return leftRevision < rightRevision ? -1 : leftRevision > rightRevision ? 1 : 0;
 }
 var AgentHomeManager = class {
   layout;
@@ -406,16 +541,66 @@ var AgentHomeManager = class {
   async initialize(binding) {
     const { resolution, lease } = binding;
     await initializeAgentHome(resolution);
-    await this.projection?.prepare({ ...resolution, cwd: lease.cwd });
+    const prepare = this.projection?.prepare;
+    if (prepare !== void 0) await prepare({ ...resolution, cwd: lease.cwd });
     if (await promises.realpath(resolution.homeDir) !== resolution.canonicalHome) {
       throw new AgentHomeResolutionError("Agent projection changed the canonical home path");
     }
     await initializeAgentHome(resolution);
   }
+  supportsTaskFreeProjection() {
+    return this.projection?.apply !== void 0;
+  }
+  /**
+   * Apply one task-free projection under the same canonical-home writer lease
+   * used by Agent execution. Only a successful host hook followed by the
+   * SDK-owned fsynced ordering record can return `applied`.
+   */
+  async project(input) {
+    const payload = AgentHomeProjectionPayloadSchema.parse(input);
+    const binding = await this.acquire(payload.agentRef);
+    try {
+      const { resolution, lease } = binding;
+      await initializeAgentHome(resolution);
+      const current = await readProjectionState(resolution);
+      if (current !== void 0) {
+        const order = compareProjectionRevision(
+          payload.agentRef.profileRevision,
+          current.agentRef.profileRevision
+        );
+        if (order < 0) return "stale";
+        if (order === 0) {
+          return payload.projectionHash === current.projectionHash ? "idempotent" : "conflict";
+        }
+      }
+      const apply = this.projection?.apply;
+      if (apply === void 0) {
+        throw new AgentHomeError("task-free Agent-home projection is not configured");
+      }
+      await apply({
+        ...resolution,
+        cwd: lease.cwd,
+        requestId: payload.requestId,
+        projectionHash: payload.projectionHash,
+        projection: payload.projection
+      });
+      if (await promises.realpath(resolution.homeDir) !== resolution.canonicalHome) {
+        throw new AgentHomeResolutionError("Agent projection changed the canonical home path");
+      }
+      await initializeAgentHome(resolution);
+      await writeProjectionState(resolution, payload);
+      return "applied";
+    } finally {
+      await binding.lease.release();
+    }
+  }
 };
 function createAgentHomeProjection(prepare) {
   return Object.freeze({ prepare });
 }
+function createAgentHomeProjectionConsumer(apply) {
+  return Object.freeze({ apply });
+}
 var AgentSessionHandoffStoreError = class extends Error {
   constructor(message) {
     super(message);
@@ -455,7 +640,7 @@ function parseTaskTerminalEntry(value) {
   assertNonEmptyString(value.terminalReason, "taskTerminal.terminalReason");
   assertNonEmptyString(value.updatedAt, "taskTerminal.updatedAt");
   if (value.sessionRef !== void 0) assertNonEmptyString(value.sessionRef, "taskTerminal.sessionRef");
-  if (typeof value.cwd !== "string" || !path.isAbsolute(value.cwd)) {
+  if (typeof value.cwd !== "string" || !path2.isAbsolute(value.cwd)) {
     throw new AgentSessionHandoffCorruptError("taskTerminal.cwd must be an absolute path");
   }
   if (value.terminalCause !== "failed") {
@@ -468,7 +653,7 @@ function parseTaskTerminalEntry(value) {
     agentRef,
     taskId: value.taskId,
     runtimeId: value.runtimeId,
-    cwd: path.resolve(value.cwd),
+    cwd: path2.resolve(value.cwd),
     leaseId: value.leaseId,
     ...value.sessionRef === void 0 ? {} : { sessionRef: value.sessionRef },
     terminalCause: "failed",
@@ -498,7 +683,7 @@ function parseEntry(value) {
   assertNonEmptyString(value.runtimeId, "handoff.runtimeId");
   assertNonEmptyString(value.leaseId, "handoff.leaseId");
   assertNonEmptyString(value.updatedAt, "handoff.updatedAt");
-  if (typeof value.cwd !== "string" || !path.isAbsolute(value.cwd)) {
+  if (typeof value.cwd !== "string" || !path2.isAbsolute(value.cwd)) {
     throw new AgentSessionHandoffCorruptError("handoff.cwd must be an absolute path");
   }
   if (Number.isNaN(Date.parse(value.updatedAt))) {
@@ -515,7 +700,7 @@ function parseEntry(value) {
     taskId: value.taskId,
     sessionRef: value.sessionRef,
     runtimeId: value.runtimeId,
-    cwd: path.resolve(value.cwd),
+    cwd: path2.resolve(value.cwd),
     leaseId: value.leaseId,
     ...value.terminalCause === void 0 ? {} : { terminalCause: value.terminalCause },
     ...value.terminalReason === void 0 ? {} : { terminalReason: value.terminalReason },
@@ -526,10 +711,10 @@ function sameRef(left, right) {
   return left.agentId === right.agentId && left.profileRevision === right.profileRevision;
 }
 function sameMatch(entry, expected) {
-  return sameRef(entry.agentRef, expected.agentRef) && entry.sessionRef === expected.sessionRef && entry.runtimeId === expected.runtimeId && entry.cwd === path.resolve(expected.cwd);
+  return sameRef(entry.agentRef, expected.agentRef) && entry.sessionRef === expected.sessionRef && entry.runtimeId === expected.runtimeId && entry.cwd === path2.resolve(expected.cwd);
 }
 function sameTaskTerminalMatch(entry, expected) {
-  return sameRef(entry.agentRef, expected.agentRef) && entry.taskId === expected.taskId && entry.runtimeId === expected.runtimeId && entry.cwd === path.resolve(expected.cwd);
+  return sameRef(entry.agentRef, expected.agentRef) && entry.taskId === expected.taskId && entry.runtimeId === expected.runtimeId && entry.cwd === path2.resolve(expected.cwd);
 }
 function sessionFileName(runtimeId, sessionRef) {
   const digest2 = createHash("sha256").update(sessionRef, "utf8").digest("hex");
@@ -542,13 +727,13 @@ function taskTerminalFileName(runtimeId, taskId) {
   return `${runtime}-task-${digest2}.jsonl`;
 }
 async function evidenceDirectory(cwdInput) {
-  if (!path.isAbsolute(cwdInput)) {
+  if (!path2.isAbsolute(cwdInput)) {
     throw new AgentSessionHandoffStoreError("Agent session cwd must be absolute");
   }
   const cwd = await promises.realpath(cwdInput);
   let cursor = cwd;
   for (const component of [".byok", "runtime-sessions"]) {
-    cursor = path.join(cursor, component);
+    cursor = path2.join(cursor, component);
     try {
       const stat = await promises.lstat(cursor);
       if (!stat.isDirectory() || stat.isSymbolicLink()) {
@@ -560,8 +745,8 @@ async function evidenceDirectory(cwdInput) {
     }
   }
   const canonical2 = await promises.realpath(cursor);
-  const relative = path.relative(cwd, canonical2);
-  if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+  const relative = path2.relative(cwd, canonical2);
+  if (relative === ".." || relative.startsWith(`..${path2.sep}`) || path2.isAbsolute(relative)) {
     throw new AgentSessionHandoffStoreError("Agent session evidence path escaped the canonical Agent home");
   }
   return canonical2;
@@ -607,7 +792,7 @@ var AgentSessionHandoffStore = class {
         taskId: input.taskId,
         sessionRef: input.sessionRef,
         runtimeId: input.runtimeId,
-        cwd: path.resolve(input.cwd),
+        cwd: path2.resolve(input.cwd),
         leaseId: input.leaseId,
         updatedAt: (/* @__PURE__ */ new Date()).toISOString()
       });
@@ -650,7 +835,7 @@ var AgentSessionHandoffStore = class {
       agentRef: validateAgentRef(input.agentRef),
       taskId: input.taskId,
       runtimeId: input.runtimeId,
-      cwd: path.resolve(input.cwd)
+      cwd: path2.resolve(input.cwd)
     };
     const filePath = await this.taskTerminalFilePath(expected);
     return this.enqueue(filePath, async () => {
@@ -677,7 +862,7 @@ var AgentSessionHandoffStore = class {
       agentRef: validateAgentRef(expectedInput.agentRef),
       taskId: expectedInput.taskId,
       runtimeId: expectedInput.runtimeId,
-      cwd: path.resolve(expectedInput.cwd)
+      cwd: path2.resolve(expectedInput.cwd)
     };
     const filePath = await this.taskTerminalFilePath(expected);
     return this.enqueue(filePath, async () => {
@@ -695,14 +880,14 @@ var AgentSessionHandoffStore = class {
     assertNonEmptyString(match.sessionRef, "handoff.sessionRef");
     assertNonEmptyString(match.runtimeId, "handoff.runtimeId");
     const directory = await evidenceDirectory(match.cwd);
-    return path.join(directory, sessionFileName(match.runtimeId, match.sessionRef));
+    return path2.join(directory, sessionFileName(match.runtimeId, match.sessionRef));
   }
   async taskTerminalFilePath(match) {
     validateAgentRef(match.agentRef);
     assertNonEmptyString(match.taskId, "taskTerminal.taskId");
     assertNonEmptyString(match.runtimeId, "taskTerminal.runtimeId");
     const directory = await evidenceDirectory(match.cwd);
-    return path.join(directory, taskTerminalFileName(match.runtimeId, match.taskId));
+    return path2.join(directory, taskTerminalFileName(match.runtimeId, match.taskId));
   }
   enqueue(key, task) {
     const previous = this.queues.get(key) ?? Promise.resolve();
@@ -991,7 +1176,7 @@ function gitEnvironment(readOnly) {
   return env;
 }
 function stableGitWorkspaceOwnerId(storeDir, productId) {
-  const identity = `${path.resolve(storeDir)}\\0${productId}`;
+  const identity = `${path2.resolve(storeDir)}\\0${productId}`;
   return `store-product:${createHash("sha256").update(identity).digest("hex")}`;
 }
 var GUIDANCE = [
@@ -1003,11 +1188,11 @@ var GUIDANCE = [
   "Leave incomplete work visible for recovery."
 ].join("\n");
 function canonical(value) {
-  return path.resolve(value);
+  return path2.resolve(value);
 }
 function isContained(root, candidate) {
-  const relative = path.relative(root, candidate);
-  return relative === "" || !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+  const relative = path2.relative(root, candidate);
+  return relative === "" || !relative.startsWith(`..${path2.sep}`) && !path2.isAbsolute(relative);
 }
 function bounded(value, max) {
   return Buffer.byteLength(value, "utf8") <= max ? value : value.slice(0, max);
@@ -1112,7 +1297,7 @@ var GitWorkspaceManager = class {
     await this.ensureOwnerMarker();
   }
   async ensureOwnerMarker() {
-    const markerPath = path.join(this.workspaceRoot, OWNER_MARKER);
+    const markerPath = path2.join(this.workspaceRoot, OWNER_MARKER);
     let existing;
     try {
       existing = JSON.parse(await promises.readFile(markerPath, "utf8"));
@@ -1271,7 +1456,7 @@ ${instruction}`;
         if (error instanceof GitWorkspaceError || code !== "ENOENT" && code !== "ENOTDIR") {
           throw new GitWorkspaceError("workspace-root-invalid", "workspace directory is invalid");
         }
-        const parent = path.dirname(current);
+        const parent = path2.dirname(current);
         if (parent === current) {
           throw new GitWorkspaceError("workspace-root-invalid", "workspace directory is invalid");
         }
@@ -1303,74 +1488,6 @@ function isGitWorkspaceConfig(value) {
     return false;
   }
 }
-var tmpSeq = 0;
-async function atomicWriteFile(filePath, data, options = {}) {
-  const tmpPath = `${filePath}.${process.pid}-${tmpSeq++}.tmp`;
-  try {
-    const handle = await promises.open(tmpPath, "w", options.mode);
-    try {
-      await handle.writeFile(data);
-      if (options.mode !== void 0) {
-        await handle.chmod(options.mode);
-      }
-      if (options.fsync) {
-        await handle.sync();
-      }
-    } finally {
-      await handle.close();
-    }
-  } catch (err) {
-    await promises.rm(tmpPath, { force: true }).catch(() => {
-    });
-    throw err;
-  }
-  await renameOnto(tmpPath, filePath);
-  if (options.mode !== void 0) {
-    await promises.chmod(filePath, options.mode);
-  }
-  if (options.fsync) {
-    const target = await promises.open(filePath, process.platform === "win32" ? "r+" : "r");
-    try {
-      await target.sync();
-    } finally {
-      await target.close();
-    }
-    if (process.platform !== "win32") {
-      const directory = await promises.open(path.dirname(filePath), "r");
-      try {
-        await directory.sync();
-      } finally {
-        await directory.close();
-      }
-    }
-  }
-}
-var RENAME_RETRY_ATTEMPTS = 5;
-var RENAME_RETRY_DELAY_MS = 20;
-function delay(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-async function renameOnto(tmpPath, targetPath) {
-  for (let attempt = 1; attempt <= RENAME_RETRY_ATTEMPTS; attempt++) {
-    try {
-      await promises.rename(tmpPath, targetPath);
-      return;
-    } catch (err) {
-      const code = err.code;
-      if (code !== "EPERM" && code !== "EEXIST") {
-        await promises.rm(tmpPath, { force: true }).catch(() => {
-        });
-        throw err;
-      }
-      if (attempt === RENAME_RETRY_ATTEMPTS) {
-        await promises.rm(tmpPath, { force: true }).catch(() => {
-        });
-        throw err;
-      }
-      await delay(RENAME_RETRY_DELAY_MS * attempt);
-    }
-  }
-}
 var defaultRunner = (command, args) => new Promise((resolve, reject) => {
   execFile(command, args, (error, stdout, stderr) => {
     if (error && typeof error.code !== "number") {
@@ -1461,7 +1578,7 @@ function isProtected(record) {
 var GitWorkspaceStore = class {
   constructor(storeDir, options = {}) {
     this.storeDir = storeDir;
-    this.filePath = path.join(storeDir, FILE_NAME);
+    this.filePath = path2.join(storeDir, FILE_NAME);
     this.maxRecords = Math.max(1, Math.floor(options.maxRecords ?? MAX_RECORDS));
   }
   storeDir;
@@ -1596,7 +1713,7 @@ var GitWorkspaceStore = class {
 var BYOK_PI_MCP_CONFIG_PATH = "BYOK_PI_MCP_CONFIG_PATH";
 var PI_PACKAGE_NAME = "@earendil-works/pi-coding-agent";
 function readPackageJson(dir) {
-  const candidate = path.join(dir, "package.json");
+  const candidate = path2.join(dir, "package.json");
   if (!existsSync(candidate)) return void 0;
   try {
     return JSON.parse(readFileSync(candidate, "utf8"));
@@ -1611,17 +1728,17 @@ function resolvePiBin() {
   }
   try {
     const mainEntryUrl = import.meta.resolve(PI_PACKAGE_NAME);
-    let dir = path.dirname(fileURLToPath(mainEntryUrl));
+    let dir = path2.dirname(fileURLToPath(mainEntryUrl));
     for (let depth = 0; depth < 6; depth++) {
       const pkg = readPackageJson(dir);
       if (pkg?.name === PI_PACKAGE_NAME) {
         const binRel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.pi;
         if (binRel) {
-          return { command: path.join(dir, binRel), source: "package" };
+          return { command: path2.join(dir, binRel), source: "package" };
         }
         break;
       }
-      const parent = path.dirname(dir);
+      const parent = path2.dirname(dir);
       if (parent === dir) break;
       dir = parent;
     }
@@ -1639,7 +1756,7 @@ function resolvePiExtensions() {
   const clientManifest = fileURLToPath(import.meta.resolve("@byok-sdk/client/package.json"));
   return {
     webAccess: fileURLToPath(import.meta.resolve("pi-web-access/index.ts")),
-    mcpAdapter: path.join(path.dirname(clientManifest), "dist", "adapters", "pi", "mcp-extension.js")
+    mcpAdapter: path2.join(path2.dirname(clientManifest), "dist", "adapters", "pi", "mcp-extension.js")
   };
 }
 
@@ -2565,10 +2682,10 @@ var PiAdapter = class {
           const taskMcpServers = startInput.mcpServers ?? {};
           const hasMcpServers = Object.keys(taskMcpServers).length > 0;
           if (hasMcpServers) {
-            mcpConfigDir = await promises.mkdtemp(path.join(os6.tmpdir(), "byok-pi-mcp-"));
+            mcpConfigDir = await promises.mkdtemp(path2.join(os6.tmpdir(), "byok-pi-mcp-"));
             await promises.chmod(mcpConfigDir, 448).catch(() => {
             });
-            const mcpConfigPath = path.join(mcpConfigDir, "mcp-config.json");
+            const mcpConfigPath = path2.join(mcpConfigDir, "mcp-config.json");
             await promises.writeFile(mcpConfigPath, JSON.stringify({ mcpServers: taskMcpServers }), { mode: 384 });
             runtimeEnv = { ...runtimeEnv, [BYOK_PI_MCP_CONFIG_PATH]: mcpConfigPath };
           }
@@ -2799,7 +2916,7 @@ function resolveApprovalMcpBin() {
   if (override) {
     return { command: override, args: [], source: "env" };
   }
-  const distBin = path.join(path.dirname(fileURLToPath(import.meta.url)), "bin", "byok-approval-mcp.js");
+  const distBin = path2.join(path2.dirname(fileURLToPath(import.meta.url)), "bin", "byok-approval-mcp.js");
   return { command: process.execPath, args: [distBin], source: "dist" };
 }
 
@@ -2890,7 +3007,7 @@ var EXTENSION_CONTENT_TYPES = {
   ".yml": "application/yaml"
 };
 function guessContentType(filePath) {
-  const ext = path.extname(filePath).toLowerCase();
+  const ext = path2.extname(filePath).toLowerCase();
   return EXTENSION_CONTENT_TYPES[ext] ?? "application/octet-stream";
 }
 function mapAssistant(msg, correlation) {
@@ -2974,11 +3091,11 @@ function tryBuildArtifactEvent(msg, workspaceDir) {
   const filePath = toolUseResult && typeof toolUseResult.filePath === "string" ? toolUseResult.filePath : void 0;
   if (!filePath) return void 0;
   const realWorkspaceDir = tryRealpath(workspaceDir) ?? workspaceDir;
-  const fileDir = path.dirname(filePath);
+  const fileDir = path2.dirname(filePath);
   const realFileDir = tryRealpath(fileDir) ?? fileDir;
-  const realFilePath = path.join(realFileDir, path.basename(filePath));
-  const relative = path.relative(realWorkspaceDir, realFilePath);
-  if (relative === "" || relative.startsWith("..") || path.isAbsolute(relative)) {
+  const realFilePath = path2.join(realFileDir, path2.basename(filePath));
+  const relative = path2.relative(realWorkspaceDir, realFilePath);
+  if (relative === "" || relative.startsWith("..") || path2.isAbsolute(relative)) {
     return void 0;
   }
   return { type: "artifact", name: relative, contentType: guessContentType(filePath) };
@@ -3372,10 +3489,10 @@ var ClaudeAdapter = class {
       });
     }
     if (needsMcpConfig) {
-      mcpConfigDir = await promises.mkdtemp(path.join(os6.tmpdir(), "byok-mcp-"));
+      mcpConfigDir = await promises.mkdtemp(path2.join(os6.tmpdir(), "byok-mcp-"));
       await promises.chmod(mcpConfigDir, 448).catch(() => {
       });
-      const mcpConfigPath = path.join(mcpConfigDir, "mcp-config.json");
+      const mcpConfigPath = path2.join(mcpConfigDir, "mcp-config.json");
       const mcpServers = { ...taskMcpServers };
       if (mapping.needsApprovalMcp) {
         const approvalChannel = startInput.approvalChannel;
@@ -3861,8 +3978,8 @@ function extractArtifactEvents(changes, workspaceDir) {
     const absolutePath = typeof change.path === "string" ? change.path : void 0;
     const kind = typeof change.kind === "string" ? change.kind : void 0;
     if (!absolutePath || kind === "delete") continue;
-    const relative = path.relative(workspaceDir, absolutePath);
-    if (relative.length === 0 || relative.startsWith("..") || path.isAbsolute(relative)) continue;
+    const relative = path2.relative(workspaceDir, absolutePath);
+    if (relative.length === 0 || relative.startsWith("..") || path2.isAbsolute(relative)) continue;
     events.push({ type: "artifact", name: relative, contentType: guessContentType2(relative) });
   }
   return events;
@@ -3883,7 +4000,7 @@ var CONTENT_TYPE_BY_EXTENSION = {
   ".csv": "text/csv"
 };
 function guessContentType2(relativePath) {
-  return CONTENT_TYPE_BY_EXTENSION[path.extname(relativePath).toLowerCase()] ?? "application/octet-stream";
+  return CONTENT_TYPE_BY_EXTENSION[path2.extname(relativePath).toLowerCase()] ?? "application/octet-stream";
 }
 function extractErrorMessage(rawError) {
   if (typeof rawError === "string") return rawError;
@@ -4739,12 +4856,12 @@ var DeviceStore = class _DeviceStore {
    */
   constructor(storeDir, secureDirOptions) {
     this.secureDirOptions = secureDirOptions;
-    this.filePath = path.join(storeDir, "device.json");
+    this.filePath = path2.join(storeDir, "device.json");
   }
   secureDirOptions;
   filePath;
   static defaultDir(productId) {
-    return path.join(os6.homedir(), ".byok", productId);
+    return path2.join(os6.homedir(), ".byok", productId);
   }
   /**
    * Resolve the one store pathname every daemon/CLI component must share.
@@ -4753,7 +4870,7 @@ var DeviceStore = class _DeviceStore {
    * cwd to pin a quarantine directory inode.
    */
   static resolveDir(productId, configured) {
-    return path.resolve(configured ?? _DeviceStore.defaultDir(productId));
+    return path2.resolve(configured ?? _DeviceStore.defaultDir(productId));
   }
   async load() {
     const opened = await this.openBounded();
@@ -4795,7 +4912,7 @@ var DeviceStore = class _DeviceStore {
   }
   async save(record) {
     assertDeviceRecord(record);
-    const storeDir = path.dirname(this.filePath);
+    const storeDir = path2.dirname(this.filePath);
     await ensureSecureDir(storeDir, this.secureDirOptions);
     await atomicWriteFile(this.filePath, JSON.stringify(record, null, 2), { mode: 384 });
   }
@@ -5449,19 +5566,19 @@ function shortHash(input) {
   return createHash("sha256").update(input, "utf8").digest("hex").slice(0, 16);
 }
 function controlSocketPath(storeDir) {
-  const candidate = path.join(storeDir, "control.sock");
+  const candidate = path2.join(storeDir, "control.sock");
   if (Buffer.byteLength(candidate, "utf8") <= UNIX_SOCKET_PATH_SOFT_LIMIT) return candidate;
-  return path.join(CONTROL_SOCKET_FALLBACK_ROOT, `byok-${shortHash(storeDir)}`, "sock");
+  return path2.join(CONTROL_SOCKET_FALLBACK_ROOT, `byok-${shortHash(storeDir)}`, "sock");
 }
 function controlPipeName(productId, storeDir) {
-  const id = shortHash(`${productId}|${path.resolve(storeDir)}`);
+  const id = shortHash(`${productId}|${path2.resolve(storeDir)}`);
   return `\\\\.\\pipe\\byok-${id}`;
 }
 function controlEndpointPath(productId, storeDir, platform = process.platform) {
   return platform === "win32" ? controlPipeName(productId, storeDir) : controlSocketPath(storeDir);
 }
 function controlTokenPath(storeDir) {
-  return path.join(storeDir, "control.token");
+  return path2.join(storeDir, "control.token");
 }
 var SERVER_PROOF_LABEL = "byok-control-server|";
 var CLIENT_AUTH_LABEL = "byok-control-client|";
@@ -5640,7 +5757,7 @@ async function assertOwnedPrivateDir(dir) {
 }
 async function bindControlEndpoint(server, endpoint) {
   if (process.platform !== "win32") {
-    const endpointDir = path.dirname(endpoint);
+    const endpointDir = path2.dirname(endpoint);
     await promises.mkdir(endpointDir, { recursive: true, mode: 448 });
     await promises.chmod(endpointDir, 448).catch(() => {
     });
@@ -6539,7 +6656,7 @@ function toBytes(data, _isBinary) {
 
 // src/daemon/connection-manager.ts
 function isCursorEnvelopeType(type) {
-  return type.startsWith("task.") || type === "agent.egress.ack" || type === "agent.content.read";
+  return type.startsWith("task.") || type === "agent.egress.ack" || type === "agent.content.read" || type === "agent.home.projection";
 }
 var ConnectionManager = class {
   constructor(opts) {
@@ -7054,6 +7171,10 @@ var ConnectionManager = class {
   async process(envelope, tracked) {
     const seq = tracked ? envelope.seq : void 0;
     try {
+      if (tracked && this.cursor === void 0) {
+        await this.opts.cursorStore.save(this.opts.serverUrl, this.opts.deviceId, 0);
+        this.cursor = 0;
+      }
       await this.opts.onEnvelope(envelope);
       if (!tracked) return;
       this.processedSeqs.add(seq);
@@ -7283,7 +7404,7 @@ function sameFileState2(left, right) {
   return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs;
 }
 async function openOperationalHealthFile(storeDir) {
-  const filePath = path.join(storeDir, OPERATIONAL_HEALTH_FILENAME);
+  const filePath = path2.join(storeDir, OPERATIONAL_HEALTH_FILENAME);
   let namedBefore;
   try {
     namedBefore = await promises.lstat(filePath, { bigint: true });
@@ -7325,7 +7446,7 @@ var OperationalHealthTracker = class {
   #writeTail = Promise.resolve();
   #started = false;
   constructor(storeDir, options = {}) {
-    this.#filePath = path.join(storeDir, OPERATIONAL_HEALTH_FILENAME);
+    this.#filePath = path2.join(storeDir, OPERATIONAL_HEALTH_FILENAME);
     this.#windowMs = options.windowMs ?? 6e4;
     this.#failureThreshold = options.failureThreshold ?? 3;
     this.#maxFailures = options.maxFailures ?? 128;
@@ -7412,7 +7533,7 @@ var OperationalHealthTracker = class {
   async #load() {
     let opened;
     try {
-      opened = await openOperationalHealthFile(path.dirname(this.#filePath));
+      opened = await openOperationalHealthFile(path2.dirname(this.#filePath));
     } catch (err) {
       throw new Error("operational health state could not be read");
     }
@@ -7448,7 +7569,7 @@ var OperationalHealthTracker = class {
     if (!this.#state) return;
     const body = JSON.stringify(this.#state, null, 2);
     this.#writeTail = this.#writeTail.then(async () => {
-      await ensureSecureDir(path.dirname(this.#filePath));
+      await ensureSecureDir(path2.dirname(this.#filePath));
       await atomicWriteFile(this.#filePath, body, { mode: 384, fsync: true });
     });
     try {
@@ -7539,9 +7660,9 @@ function storeMutexIdentity(canonicalStoreDir) {
 }
 function storeMutexEndpoint(canonicalStoreDir, identity, platform = process.platform) {
   if (platform === "win32") return `\\\\.\\pipe\\byok-store-mutex-${identity.slice(0, 16)}`;
-  const candidate = path.join(canonicalStoreDir, STORE_MUTEX_SOCKET_FILENAME);
+  const candidate = path2.join(canonicalStoreDir, STORE_MUTEX_SOCKET_FILENAME);
   if (Buffer.byteLength(candidate, "utf8") <= UNIX_SOCKET_PATH_SOFT_LIMIT2) return candidate;
-  return path.join(STORE_MUTEX_FALLBACK_ROOT, `byok-store-mutex-${identity.slice(0, 16)}`, "sock");
+  return path2.join(STORE_MUTEX_FALLBACK_ROOT, `byok-store-mutex-${identity.slice(0, 16)}`, "sock");
 }
 var DaemonOwnerActiveError = class extends Error {
   constructor(role) {
@@ -7713,7 +7834,7 @@ async function acquireStoreMutex(canonicalStoreDir) {
   const endpoint = storeMutexEndpoint(canonicalStoreDir, identity);
   const isPipe = process.platform === "win32";
   if (!isPipe) {
-    const endpointDir = path.dirname(endpoint);
+    const endpointDir = path2.dirname(endpoint);
     if (endpointDir !== canonicalStoreDir) {
       await ensureSecureDir(endpointDir);
       await assertOwnedPrivateDir2(endpointDir);
@@ -7793,8 +7914,8 @@ async function acquireDaemonOwner(storeDir, role, clock = () => /* @__PURE__ */
     await mutex.close().catch(() => void 0);
     throw err;
   }
-  const ownerPath = path.join(storeDir, DAEMON_OWNER_FILENAME);
-  const reclaimPath = path.join(storeDir, RECLAIM_FILENAME);
+  const ownerPath = path2.join(storeDir, DAEMON_OWNER_FILENAME);
+  const reclaimPath = path2.join(storeDir, RECLAIM_FILENAME);
   const record = {
     version: 2,
     pid: process.pid,
@@ -7872,7 +7993,7 @@ var CursorStore = class {
   storeDir;
   fileFor(serverUrl, deviceId) {
     const key = createHash("sha256").update(`${serverUrl}::${deviceId}`).digest("hex").slice(0, 32);
-    return path.join(this.storeDir, `cursor-${key}.json`);
+    return path2.join(this.storeDir, `cursor-${key}.json`);
   }
   async load(serverUrl, deviceId) {
     let raw;
@@ -7892,7 +8013,7 @@ var CursorStore = class {
   }
   async save(serverUrl, deviceId, cursor) {
     const file = this.fileFor(serverUrl, deviceId);
-    await promises.mkdir(path.dirname(file), { recursive: true, mode: 448 });
+    await promises.mkdir(path2.dirname(file), { recursive: true, mode: 448 });
     await atomicWriteFile(file, JSON.stringify({ cursor }));
   }
   /** Remove any persisted cursor for (serverUrl, deviceId) — a no-op if none exists. Called from `pair()` (finding F5) so a device that's about to be replaced never leaves a cursor a future, unrelated device could somehow inherit. */
@@ -8222,7 +8343,7 @@ var SessionWorkspaceStore = class {
    */
   queue = Promise.resolve();
   constructor(storeDir) {
-    this.filePath = path.join(storeDir, "session-workspaces.json");
+    this.filePath = path2.join(storeDir, "session-workspaces.json");
   }
   async get(sessionRef) {
     return this.enqueue(async () => {
@@ -8280,7 +8401,7 @@ var SessionWorkspaceStore = class {
     }
   }
   async save(all) {
-    const dir = path.dirname(this.filePath);
+    const dir = path2.dirname(this.filePath);
     await promises.mkdir(dir, { recursive: true, mode: 448 });
     const tmpPath = `${this.filePath}.${process.pid}-${tmpSeq2++}.tmp`;
     try {
@@ -9827,6 +9948,11 @@ function offeredAgentRef(payload) {
   if (!Object.prototype.hasOwnProperty.call(payload, "agentRef")) return void 0;
   return validateAgentRef(payload.agentRef);
 }
+function offeredSessionRef(payload) {
+  if (!Object.prototype.hasOwnProperty.call(payload, "sessionRef")) return void 0;
+  const value = payload.sessionRef;
+  return typeof value === "string" ? value : void 0;
+}
 function errorMessage4(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -9862,8 +9988,8 @@ function estimateEventBytes(event) {
 }
 async function openArtifact(workspaceDir, name) {
   const realWorkspaceDir = await promises.realpath(workspaceDir).catch(() => workspaceDir);
-  const candidate = path.resolve(realWorkspaceDir, name);
-  const prefix = realWorkspaceDir.endsWith(path.sep) ? realWorkspaceDir : realWorkspaceDir + path.sep;
+  const candidate = path2.resolve(realWorkspaceDir, name);
+  const prefix = realWorkspaceDir.endsWith(path2.sep) ? realWorkspaceDir : realWorkspaceDir + path2.sep;
   if (candidate !== realWorkspaceDir && !candidate.startsWith(prefix)) {
     return { ok: false, reason: `artifact name "${name}" resolves outside the task workspace \u2014 rejected` };
   }
@@ -10195,6 +10321,9 @@ var TaskRunner = class {
       case "task.offer_for_agent_with_egress":
         await this.handleOffer(envelope.task_id, envelope.payload, true);
         return;
+      case "task.offer_for_agent_with_egress_fresh":
+        await this.handleOffer(envelope.task_id, envelope.payload, true);
+        return;
       case "task.cancel":
         await this.handleCancel(envelope.task_id, envelope.payload.reason);
         return;
@@ -10236,6 +10365,7 @@ var TaskRunner = class {
     const decline = (reason, retryable) => {
       this.decline(taskId, reason, retryable, agentRef);
     };
+    const sessionRef = offeredSessionRef(payload);
     if ("egressPolicy" in payload) {
       if (this.deps.agentEgressPolicy === void 0 || !sameEgressPolicy(this.deps.agentEgressPolicy, payload.egressPolicy)) {
         decline("Agent egress offer policy is not exactly enabled by this daemon", false);
@@ -10337,11 +10467,11 @@ var TaskRunner = class {
       let plainWorkspaceNeedsResolve = false;
       if (agentBinding !== void 0) {
         workspaceDir = agentBinding.lease.cwd;
-        if (payload.sessionRef !== void 0) {
+        if (sessionRef !== void 0) {
           try {
             await this.deps.agentSessionHandoffs.requireMatch({
               agentRef: agentBinding.resolution.agentRef,
-              sessionRef: payload.sessionRef,
+              sessionRef,
               runtimeId: pick.descriptor.id,
               cwd: workspaceDir
             });
@@ -10363,15 +10493,15 @@ var TaskRunner = class {
           return;
         }
       } else if (this.deps.gitWorkspaceManager && this.deps.gitWorkspaceStore) {
-        known = payload.sessionRef ? await this.deps.sessionWorkspaces.get(payload.sessionRef) : void 0;
+        known = sessionRef ? await this.deps.sessionWorkspaces.get(sessionRef) : void 0;
         const gitManager = this.deps.gitWorkspaceManager;
         const gitStore = this.deps.gitWorkspaceStore;
-        if (payload.sessionRef) {
-          const ledger = await gitStore.findBySessionAnyPhase(payload.sessionRef).catch(() => void 0);
+        if (sessionRef) {
+          const ledger = await gitStore.findBySessionAnyPhase(sessionRef).catch(() => void 0);
           const sameProtocolTask = ledger?.taskId === taskId;
           const interruptedOldTask = ledger?.phase === "interrupted" && sameProtocolTask;
           const activeDifferentTask = ledger !== void 0 && ledger.taskId !== taskId && (ledger.phase === "preparing" || ledger.phase === "active");
-          if (!known || known.workspaceKind !== "git" || !known.gitWorkspaceId || !ledger || ledger.workspaceId !== known.gitWorkspaceId || ledger.sessionRef !== payload.sessionRef || path.resolve(ledger.workspaceDir) !== path.resolve(known.workspaceDir) || interruptedOldTask || activeDifferentTask) {
+          if (!known || known.workspaceKind !== "git" || !known.gitWorkspaceId || !ledger || ledger.workspaceId !== known.gitWorkspaceId || ledger.sessionRef !== sessionRef || path2.resolve(ledger.workspaceDir) !== path2.resolve(known.workspaceDir) || interruptedOldTask || activeDifferentTask) {
             decline("session is incompatible with Git workspace mode", true);
             return;
           }
@@ -10386,18 +10516,18 @@ var TaskRunner = class {
             return;
           }
         } else {
-          workspaceDir = path.join(this.deps.workspaceRoot, taskId);
+          workspaceDir = path2.join(this.deps.workspaceRoot, taskId);
           gitWorkspaceId = randomUUID();
         }
         try {
-          gitLease = await gitManager.acquireLease(workspaceDir, payload.sessionRef);
+          gitLease = await gitManager.acquireLease(workspaceDir, sessionRef);
         } catch {
           decline("workspace is busy or unavailable", true);
           return;
         }
       } else if (!this.deps.gitWorkspaceManager && !this.deps.gitWorkspaceStore) {
-        known = payload.sessionRef ? await this.deps.sessionWorkspaces.get(payload.sessionRef) : void 0;
-        workspaceDir = known?.workspaceDir ?? path.join(this.deps.workspaceRoot, taskId);
+        known = sessionRef ? await this.deps.sessionWorkspaces.get(sessionRef) : void 0;
+        workspaceDir = known?.workspaceDir ?? path2.join(this.deps.workspaceRoot, taskId);
         plainWorkspaceNeedsResolve = true;
       } else {
         decline("workspace mode is unavailable", true);
@@ -10415,7 +10545,7 @@ var TaskRunner = class {
         policy: decision.policy,
         requiredToolsetIds: requiredToolsets ?? [],
         ...offered.dispatchSelection === void 0 ? {} : { dispatchSelection: offered.dispatchSelection },
-        ...payload.sessionRef === void 0 || known === void 0 && agentBinding === void 0 ? {} : { sessionRef: payload.sessionRef },
+        ...sessionRef === void 0 || known === void 0 && agentBinding === void 0 ? {} : { sessionRef },
         ...agentBinding === void 0 ? {} : {
           agentRef: agentBinding.resolution.agentRef,
           cwd: agentBinding.lease.cwd,
@@ -10518,7 +10648,7 @@ var TaskRunner = class {
             workspaceId,
             taskId,
             workspaceDir,
-            sessionRef: payload.sessionRef,
+            sessionRef,
             phase,
             baseline: gitBaseline ?? observation.head,
             current: observation.head,
@@ -11784,7 +11914,7 @@ var TaskRunner = class {
   }
   /** `reuseDir`, when set (a known sessionRef's recorded workspace), is used verbatim instead of a fresh `workspaceRoot/<taskId>` directory — `mkdir recursive` is idempotent either way, so ensuring-exists is safe to do unconditionally. */
   async resolveWorkspaceDir(taskId, reuseDir) {
-    const dir = reuseDir ?? path.join(this.deps.workspaceRoot, taskId);
+    const dir = reuseDir ?? path2.join(this.deps.workspaceRoot, taskId);
     await promises.mkdir(dir, { recursive: true });
     return dir;
   }
@@ -11922,7 +12052,7 @@ var encoder2 = new TextEncoder();
 function eventBytes(event) {
   return encoder2.encode(JSON.stringify(event)).length;
 }
-var AGENT_EGRESS_DIRECTORY = path.join(".byok", "egress");
+var AGENT_EGRESS_DIRECTORY = path2.join(".byok", "egress");
 var AGENT_RELIABLE_SPOOL_FILENAME = "reliable-v1.jsonl";
 var AgentReliableSpoolError = class extends Error {
   constructor(message) {
@@ -12033,9 +12163,9 @@ var AgentReliableSpool = class _AgentReliableSpool {
   logEntries = 0;
   writeTail = Promise.resolve();
   static async open(homeDir) {
-    const directory = path.join(homeDir, AGENT_EGRESS_DIRECTORY);
+    const directory = path2.join(homeDir, AGENT_EGRESS_DIRECTORY);
     await ensureSecureDir(directory);
-    const spool = new _AgentReliableSpool(homeDir, path.join(directory, AGENT_RELIABLE_SPOOL_FILENAME));
+    const spool = new _AgentReliableSpool(homeDir, path2.join(directory, AGENT_RELIABLE_SPOOL_FILENAME));
     await spool.load();
     return spool;
   }
@@ -12498,7 +12628,7 @@ var AgentEgressController = class {
   }
   /** Re-open every existing Agent-local spool before retrying stable records after restart. */
   async recover(agentsRoot) {
-    if (!path.isAbsolute(agentsRoot)) throw new Error("Agent egress recovery root must be absolute");
+    if (!path2.isAbsolute(agentsRoot)) throw new Error("Agent egress recovery root must be absolute");
     if (!this.active) throw new Error("Agent egress recovery requires an active authenticated enrollment");
     if (this.options.tenantId === void 0) {
       throw new Error("Agent egress recovery requires one authenticated tenant authority");
@@ -12513,14 +12643,14 @@ var AgentEgressController = class {
     }
     for (const entry of entries) {
       if (!entry.isDirectory() || entry.isSymbolicLink()) continue;
-      const homeDir = path.join(canonicalAgentsRoot, entry.name);
+      const homeDir = path2.join(canonicalAgentsRoot, entry.name);
       const canonicalHome = await promises.realpath(homeDir);
-      const relativeHome = path.relative(canonicalAgentsRoot, canonicalHome);
-      if (relativeHome !== entry.name || relativeHome.includes(path.sep) || path.isAbsolute(relativeHome)) {
+      const relativeHome = path2.relative(canonicalAgentsRoot, canonicalHome);
+      if (relativeHome !== entry.name || relativeHome.includes(path2.sep) || path2.isAbsolute(relativeHome)) {
         throw new Error(`Agent egress recovery home escaped the canonical agents root: ${entry.name}`);
       }
       try {
-        await promises.lstat(path.join(homeDir, AGENT_EGRESS_DIRECTORY));
+        await promises.lstat(path2.join(homeDir, AGENT_EGRESS_DIRECTORY));
       } catch (error) {
         if (error.code === "ENOENT") continue;
         throw error;
@@ -12607,12 +12737,12 @@ function isAgentRef(value) {
 }
 function isCanonicalRelativeTarget(value) {
   if (value === "[invalid-target]") return true;
-  if (path.isAbsolute(value) || value.includes("\\")) return false;
+  if (path2.isAbsolute(value) || value.includes("\\")) return false;
   const segments = value.split("/");
   return value.length > 0 && segments.every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
 }
 function validateIdentity(value, label) {
-  if (!isRecord4(value) || !isAgentRef(value.agentRef) || !isNonEmptyString(value.sessionRef) || !isNonEmptyString(value.runtimeId) || !isNonEmptyString(value.cwd) || !path.isAbsolute(value.cwd)) {
+  if (!isRecord4(value) || !isAgentRef(value.agentRef) || !isNonEmptyString(value.sessionRef) || !isNonEmptyString(value.runtimeId) || !isNonEmptyString(value.cwd) || !path2.isAbsolute(value.cwd)) {
     throw new AgentContentAuditStoreError(`${label} has an invalid exact Agent/session identity`);
   }
   return Object.freeze({
@@ -12622,7 +12752,7 @@ function validateIdentity(value, label) {
     }),
     sessionRef: value.sessionRef,
     runtimeId: value.runtimeId,
-    cwd: path.resolve(value.cwd)
+    cwd: path2.resolve(value.cwd)
   });
 }
 function validateReceipt(value) {
@@ -12704,16 +12834,16 @@ function assertUniqueRequestIds(entries) {
   }
 }
 function assertAbsoluteFilePath(filePath) {
-  if (typeof filePath !== "string" || filePath.length === 0 || !path.isAbsolute(filePath)) {
+  if (typeof filePath !== "string" || filePath.length === 0 || !path2.isAbsolute(filePath)) {
     throw new AgentContentAuditStoreError("content audit path must be absolute");
   }
   if (/[\u0000\r\n]/u.test(filePath)) {
     throw new AgentContentAuditStoreError("content audit path must not contain NUL or line breaks");
   }
-  return path.resolve(filePath);
+  return path2.resolve(filePath);
 }
 async function ensureDirectoryNoSymlink2(directory) {
-  const absolute = path.resolve(directory);
+  const absolute = path2.resolve(directory);
   await promises.mkdir(absolute, { recursive: true, mode: 448 });
   const stat = await promises.lstat(absolute);
   if (!stat.isDirectory() || stat.isSymbolicLink()) {
@@ -12747,12 +12877,12 @@ var AgentContentAuditStore = class _AgentContentAuditStore {
   /** The daemon may address this ledger only through an AgentHomeLayout resolution. */
   static forCanonicalAgentHome(canonicalHome) {
     const home = assertAbsoluteFilePath(canonicalHome);
-    return new _AgentContentAuditStore(path.join(home, AGENT_HOME_INTERNAL_DIRECTORY, AGENT_CONTENT_AUDIT_FILENAME));
+    return new _AgentContentAuditStore(path2.join(home, AGENT_HOME_INTERNAL_DIRECTORY, AGENT_CONTENT_AUDIT_FILENAME));
   }
   async append(receipt) {
     const validated = validateReceipt(receipt);
     return this.enqueue(async () => {
-      await ensureDirectoryNoSymlink2(path.dirname(this.filePath));
+      await ensureDirectoryNoSymlink2(path2.dirname(this.filePath));
       await assertAuditFile(this.filePath);
       const entries = await this.readAllUnlocked();
       const prior = entries.find((entry) => entry.requestId === validated.requestId);
@@ -12847,6 +12977,63 @@ var AgentContentAuditStore = class _AgentContentAuditStore {
     return result;
   }
 };
+var AgentHomeProjectionCompletionError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "AgentHomeProjectionCompletionError";
+  }
+};
+function sameAgentRef2(left, right) {
+  return left.agentId === right.agentId && left.profileRevision === right.profileRevision;
+}
+var AgentHomeProjectionCompletionClient = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  async complete(input) {
+    const completion = AgentHomeProjectionCompletionRequestSchema.parse(input);
+    const url = new URL(
+      byokAgentHomeProjectionCompletionPath(completion.requestId),
+      toHttpBase(this.options.serverUrl)
+    );
+    let response;
+    try {
+      response = await authedFetch(
+        url,
+        {
+          method: "PUT",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify(completion)
+        },
+        this.options.auth
+      );
+    } catch (error) {
+      throw new AgentHomeProjectionCompletionError("Agent-home projection completion transport failed", {
+        cause: error
+      });
+    }
+    if (!response.ok) {
+      throw new AgentHomeProjectionCompletionError(
+        `Agent-home projection completion was rejected with HTTP ${response.status}`
+      );
+    }
+    let readback;
+    try {
+      readback = AgentHomeProjectionReadbackSchema.parse(await response.json());
+    } catch (error) {
+      throw new AgentHomeProjectionCompletionError("Agent-home projection completion readback is invalid", {
+        cause: error
+      });
+    }
+    if (readback.tenantId !== this.options.tenantId || readback.deviceId !== this.options.deviceId || readback.requestId !== completion.requestId || !sameAgentRef2(readback.agentRef, completion.agentRef) || readback.projectionHash !== completion.projectionHash || readback.status !== completion.outcome || readback.completedAt === void 0) {
+      throw new AgentHomeProjectionCompletionError(
+        "Agent-home projection completion readback does not exactly match the authenticated request"
+      );
+    }
+    return readback;
+  }
+};
 var AGENT_CONTENT_READ_SURFACES = ["workspace", "transcript", "artifact"];
 var AGENT_CONTENT_READ_CAPABILITIES = Object.freeze({
   workspace: AGENT_CONTENT_WORKSPACE_READ_CAPABILITY,
@@ -12950,8 +13137,8 @@ function normalizeIdentity(value, field) {
   const sessionRef = nonEmptyString(value.sessionRef, `${field}.sessionRef`);
   const runtimeId = nonEmptyString(value.runtimeId, `${field}.runtimeId`);
   const cwd = nonEmptyString(value.cwd, `${field}.cwd`);
-  if (!path.isAbsolute(cwd)) throw new AgentContentReadPolicyError(`${field}.cwd must be absolute`);
-  return Object.freeze({ agentRef, sessionRef, runtimeId, cwd: path.resolve(cwd) });
+  if (!path2.isAbsolute(cwd)) throw new AgentContentReadPolicyError(`${field}.cwd must be absolute`);
+  return Object.freeze({ agentRef, sessionRef, runtimeId, cwd: path2.resolve(cwd) });
 }
 function createAgentContentReadPolicy(input) {
   if (!isRecord5(input) || input.enabled !== true) {
@@ -12979,10 +13166,10 @@ function createAgentContentReadPolicy(input) {
     root = Object.freeze({ kind: "agent-home" });
   } else if (input.root.kind === "runtime-allowlisted") {
     const configuredRoot = nonEmptyString(input.root.root, "contentRead.root.root");
-    if (!path.isAbsolute(configuredRoot)) {
+    if (!path2.isAbsolute(configuredRoot)) {
       throw new AgentContentReadPolicyError("contentRead.root.root must be absolute");
     }
-    root = Object.freeze({ kind: "runtime-allowlisted", root: path.resolve(configuredRoot) });
+    root = Object.freeze({ kind: "runtime-allowlisted", root: path2.resolve(configuredRoot) });
   } else {
     throw new AgentContentReadPolicyError("contentRead.root.kind is not supported");
   }
@@ -13005,11 +13192,11 @@ function createAgentContentReadPolicy(input) {
   });
 }
 function isWithin2(root, candidate) {
-  const relative = path.relative(root, candidate);
-  return relative === "" || relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+  const relative = path2.relative(root, candidate);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path2.sep}`) && !path2.isAbsolute(relative);
 }
 function isPortableAbsoluteTarget(value) {
-  return path.isAbsolute(value) || /^[a-z]:[\\/]/iu.test(value) || /^[/\\]/u.test(value);
+  return path2.isAbsolute(value) || /^[a-z]:[\\/]/iu.test(value) || /^[/\\]/u.test(value);
 }
 function canonicalAuditTarget(value) {
   if (typeof value !== "string" || value.length === 0 || /[\u0000\r\n]/u.test(value) || isPortableAbsoluteTarget(value) || value.includes("\\")) {
@@ -13047,7 +13234,7 @@ function isSensitiveTarget(segments, productNames) {
   return segments.some((segment) => patterns.some((pattern) => nameMatches(pattern, segment)));
 }
 async function resolveExistingAncestor2(inputPath) {
-  let cursor = path.resolve(inputPath);
+  let cursor = path2.resolve(inputPath);
   const tail = [];
   for (; ; ) {
     try {
@@ -13055,9 +13242,9 @@ async function resolveExistingAncestor2(inputPath) {
     } catch (error) {
       const code = error.code;
       if (code !== "ENOENT" && code !== "ENOTDIR") throw error;
-      const parent = path.dirname(cursor);
+      const parent = path2.dirname(cursor);
       if (parent === cursor) throw new TargetPolicyError("target-missing");
-      tail.unshift(path.basename(cursor));
+      tail.unshift(path2.basename(cursor));
       cursor = parent;
     }
   }
@@ -13078,11 +13265,11 @@ var RootPolicyError = class extends Error {
     this.reason = reason;
   }
 };
-function sameAgentRef2(left, right) {
+function sameAgentRef3(left, right) {
   return left.agentId === right.agentId && left.profileRevision === right.profileRevision;
 }
 function sameSessionIdentity(left, right) {
-  return sameAgentRef2(left.agentRef, right.agentRef) && left.sessionRef === right.sessionRef && left.runtimeId === right.runtimeId && left.cwd === right.cwd;
+  return sameAgentRef3(left.agentRef, right.agentRef) && left.sessionRef === right.sessionRef && left.runtimeId === right.runtimeId && left.cwd === right.cwd;
 }
 function validateRequest(request) {
   if (!isRecord5(request)) throw new AgentContentReadRequestError("content read request must be an object");
@@ -13144,18 +13331,18 @@ function normalizeRequestIdentity(value, field) {
   const sessionRef = requestString(value.sessionRef, `${field}.sessionRef`);
   const runtimeId = requestString(value.runtimeId, `${field}.runtimeId`);
   const cwd = requestString(value.cwd, `${field}.cwd`);
-  if (!path.isAbsolute(cwd)) throw new AgentContentReadRequestError(`${field}.cwd must be absolute`);
-  return Object.freeze({ agentRef, sessionRef, runtimeId, cwd: path.resolve(cwd) });
+  if (!path2.isAbsolute(cwd)) throw new AgentContentReadRequestError(`${field}.cwd must be absolute`);
+  return Object.freeze({ agentRef, sessionRef, runtimeId, cwd: path2.resolve(cwd) });
 }
 async function inspectRegularTarget(root, target) {
   const ancestor = await resolveExistingAncestor2(target);
   if (!isWithin2(root, ancestor.canonical)) {
     throw new TargetPolicyError("path-escape");
   }
-  const components = path.relative(root, target).split(path.sep).filter((component) => component.length > 0);
+  const components = path2.relative(root, target).split(path2.sep).filter((component) => component.length > 0);
   let cursor = root;
   for (const [index, component] of components.entries()) {
-    cursor = path.join(cursor, component);
+    cursor = path2.join(cursor, component);
     let stat;
     try {
       stat = await promises.lstat(cursor);
@@ -13220,8 +13407,8 @@ var AgentContentReadPolicyEngine = class {
     this.capabilities = new Set(options.capabilities);
     this.runtimeRoots = Object.freeze((options.runtimeAllowlistedRoots ?? []).map((root, index) => {
       const value = nonEmptyString(root, `contentRead.runtimeAllowlistedRoots[${index}]`);
-      if (!path.isAbsolute(value)) throw new AgentContentReadPolicyError("runtime allowlisted roots must be absolute");
-      return path.resolve(value);
+      if (!path2.isAbsolute(value)) throw new AgentContentReadPolicyError("runtime allowlisted roots must be absolute");
+      return path2.resolve(value);
     }));
     this.resolveSessionIdentity = options.resolveSessionIdentity;
     this.resolveTranscriptIdentity = options.resolveTranscriptIdentity;
@@ -13273,7 +13460,7 @@ var AgentContentReadPolicyEngine = class {
     if (request.decodeAs === "utf8" && !policy.textMimeTypes.includes(request.mimeType)) {
       return this.deny(request, relativeTarget, "text-not-allowlisted");
     }
-    const target = path.resolve(root, ...segments);
+    const target = path2.resolve(root, ...segments);
     if (!isWithin2(root, target)) return this.deny(request, relativeTarget, "path-escape");
     try {
       await inspectRegularTarget(root, target);
@@ -13354,7 +13541,7 @@ var AgentContentReadPolicyEngine = class {
   }
   async checkSessionIdentity(request, resolver, requiredCwd) {
     const session = request.session;
-    if (session === void 0 || !sameAgentRef2(session.agentRef, request.agentRef) || requiredCwd !== void 0 && session.cwd !== requiredCwd) {
+    if (session === void 0 || !sameAgentRef3(session.agentRef, request.agentRef) || requiredCwd !== void 0 && session.cwd !== requiredCwd) {
       return "identity-mismatch";
     }
     let expected;
@@ -13470,7 +13657,7 @@ async function detectRuntimes(adapters) {
   }
   return runtimes;
 }
-function computeCapabilities(adapters, agentHomeConfigured = false, agentEgressConfigured = false, contentReadPolicies) {
+function computeCapabilities(adapters, agentHomeConfigured = false, agentHomeProjectionConfigured = false, agentEgressConfigured = false, contentReadPolicies) {
   const flags = [];
   if (adapters.some((adapter) => adapter.descriptor.capabilities.steer)) flags.push("steer");
   flags.push("blob-upload");
@@ -13485,7 +13672,14 @@ function computeCapabilities(adapters, agentHomeConfigured = false, agentEgressC
     flags.push("toolset-selection");
   }
   if (agentHomeConfigured) flags.push("agent-home-contract");
-  if (agentEgressConfigured) flags.push(AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY);
+  if (agentHomeProjectionConfigured) flags.push(AGENT_HOME_PROJECTION_CAPABILITY);
+  if (agentEgressConfigured) {
+    flags.push(
+      AGENT_EGRESS_POLICY_CAPABILITY,
+      AGENT_EGRESS_RELIABLE_ACK_CAPABILITY,
+      AGENT_EGRESS_FRESH_SESSION_CAPABILITY
+    );
+  }
   if (contentReadPolicies !== void 0) {
     for (const surface of Object.keys(AGENT_CONTENT_READ_CAPABILITIES)) {
       const policy = contentReadPolicies[surface];
@@ -13837,7 +14031,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       }
       await agentHomeManager?.preflight();
       if (config.agentEgress !== void 0 && config.agentHome !== void 0) {
-        await agentEgress.recover(path.join(config.agentHome.hostStorageRoot, "agents"));
+        await agentEgress.recover(path2.join(config.agentHome.hostStorageRoot, "agents"));
       }
       fleetJitter = createFleetJitter(config.productId, record.deviceId);
       if (config.permissionDefaults?.workspaceRoot !== void 0) {
@@ -13892,9 +14086,16 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       const capabilities = computeCapabilities(
         adapters,
         config.agentHome !== void 0,
+        agentHomeManager?.supportsTaskFreeProjection() === true,
         config.agentEgress !== void 0,
         agentContentReadPolicies
       );
+      const agentHomeProjectionCompletion = agentHomeManager?.supportsTaskFreeProjection() === true ? new AgentHomeProjectionCompletionClient({
+        serverUrl: config.serverUrl,
+        auth,
+        tenantId: record.tenantId,
+        deviceId: record.deviceId
+      }) : void 0;
       const journalIdentity = config.hostedJournal ? { tenantId: record.tenantId, productId: config.productId, deviceId: record.deviceId } : void 0;
       const sendSanitizedEnvelope = activeJournal && journalIdentity ? (envelope) => {
         observer.handleOutboundEnvelope(envelope);
@@ -14031,6 +14232,20 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         ...activePressureEngine ? { admissionGuard: () => activePressureEngine.admissionGuard() } : {}
       };
       runner = new TaskRunner(deps);
+      const handleAgentHomeProjectionEnvelope = async (envelope) => {
+        if (envelope.type !== "agent.home.projection") return false;
+        if (agentHomeManager === void 0 || agentHomeProjectionCompletion === void 0) {
+          throw new Error("task-free Agent-home projection is not configured on this daemon");
+        }
+        const outcome = await agentHomeManager.project(envelope.payload);
+        await agentHomeProjectionCompletion.complete({
+          requestId: envelope.payload.requestId,
+          agentRef: envelope.payload.agentRef,
+          projectionHash: envelope.payload.projectionHash,
+          outcome
+        });
+        return true;
+      };
       const handleAgentEgressEnvelope = async (envelope) => {
         if (envelope.type !== "agent.egress.ack") return false;
         if (config.agentEgress === void 0) return true;
@@ -14186,6 +14401,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
             throw new Error("tenant enrollment is being re-paired; inbound work is blocked until restart");
           }
           observer.handleInboundEnvelope(envelope);
+          if (await handleAgentHomeProjectionEnvelope(envelope)) return;
           if (await handleAgentEgressEnvelope(envelope)) return;
           if (await handleAgentContentReadEnvelope(envelope)) return;
           activePressureEngine?.assertAckCriticalAllowed();
@@ -14196,6 +14412,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
             return Promise.reject(new Error("tenant enrollment is being re-paired; inbound work is blocked until restart"));
           }
           observer.handleInboundEnvelope(envelope);
+          if (envelope.type === "agent.home.projection") return handleAgentHomeProjectionEnvelope(envelope).then(() => void 0);
           if (envelope.type === "agent.egress.ack") return handleAgentEgressEnvelope(envelope).then(() => void 0);
           if (envelope.type === "agent.content.read") return handleAgentContentReadEnvelope(envelope).then(() => void 0);
           return runner?.handleEnvelope(envelope) ?? Promise.resolve();
@@ -14690,7 +14907,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
     connection.send(sanitized.envelope);
   }
   async function publishReliableAgentEgress(input) {
-    if (config.agentEgress === void 0 || agentHomeManager === void 0) {
+    if (config.agentEgress === void 0 || agentHomeManager === void 0 || agentSessionHandoffs === void 0) {
       throw new Error("Agent reliable egress is not configured");
     }
     if (tenantRebinding) {
@@ -14699,12 +14916,21 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
     const binding = await agentHomeManager.acquire(input.agentRef);
     try {
       await agentHomeManager.initialize(binding);
+      const handoff = await agentSessionHandoffs.requireMatch({
+        agentRef: binding.resolution.agentRef,
+        sessionRef: input.sessionRef,
+        runtimeId: input.runtimeId,
+        cwd: binding.resolution.canonicalHome
+      });
+      if (handoff.taskId !== input.taskId) {
+        throw new Error("Agent reliable egress taskId does not match the durable session handoff");
+      }
       const appended = await agentEgress.appendReliable({
         homeDir: binding.resolution.canonicalHome,
         agentRef: binding.resolution.agentRef,
         sessionRef: input.sessionRef,
         payload: input.payload,
-        ...input.taskId === void 0 ? {} : { taskId: input.taskId },
+        taskId: input.taskId,
         ...input.eventId === void 0 ? {} : { eventId: input.eventId }
       });
       if (appended.ok) dispatchReliableRecord(appended.record);
@@ -15149,14 +15375,14 @@ async function getJson(url, auth, signal, what) {
   return readBoundedJson(response, what);
 }
 function skillPacksRoot(dataDir) {
-  return path.join(dataDir, SKILL_PACKS_DIRNAME);
+  return path2.join(dataDir, SKILL_PACKS_DIRNAME);
 }
 function resolveInside(baseDir, relative) {
   if (!isSkillPackPathSafe(relative)) {
     throw new SkillPackInstallError("store_unsafe", `${JSON.stringify(relative)} is not a safe pack-relative path.`);
   }
-  const resolved = path.resolve(baseDir, relative);
-  const prefix = path.resolve(baseDir) + path.sep;
+  const resolved = path2.resolve(baseDir, relative);
+  const prefix = path2.resolve(baseDir) + path2.sep;
   if (!resolved.startsWith(prefix)) {
     throw new SkillPackInstallError(
       "store_unsafe",
@@ -15182,7 +15408,7 @@ async function appendAuditLine(dataDir, record) {
   await promises.mkdir(root, { recursive: true, mode: DIR_MODE });
   await promises.chmod(root, DIR_MODE).catch(() => {
   });
-  const filePath = path.join(root, SKILL_PACK_AUDIT_FILENAME);
+  const filePath = path2.join(root, SKILL_PACK_AUDIT_FILENAME);
   const handle = await promises.open(filePath, "a", FILE_MODE);
   try {
     await handle.chmod(FILE_MODE);
@@ -15297,12 +15523,12 @@ async function installOne(options, manifest, source, base) {
   if (!entryCheck.ok) {
     await refuse("content_rejected", `skill pack ${JSON.stringify(manifest.name)}: ${entryCheck.reason} \u2014 ${entryCheck.detail}`);
   }
-  const packRoot = path.join(skillPacksRoot(options.dataDir), manifest.name);
-  const revisionDir = path.join(packRoot, manifest.contentHash.slice("sha256:".length));
+  const packRoot = path2.join(skillPacksRoot(options.dataDir), manifest.name);
+  const revisionDir = path2.join(packRoot, manifest.contentHash.slice("sha256:".length));
   await promises.mkdir(revisionDir, { recursive: true, mode: DIR_MODE });
   for (const [relative, content] of bodies) {
     const target = resolveInside(revisionDir, relative);
-    await promises.mkdir(path.dirname(target), { recursive: true, mode: DIR_MODE });
+    await promises.mkdir(path2.dirname(target), { recursive: true, mode: DIR_MODE });
     await assertNotSymlink(target);
     await atomicWriteFile(target, content, { mode: FILE_MODE });
   }
@@ -15320,7 +15546,7 @@ async function installOne(options, manifest, source, base) {
       bytes: file.byteSize
     }))
   };
-  await atomicWriteFile(path.join(packRoot, SKILL_PACK_LOCK_FILENAME), `${JSON.stringify(lock, null, 2)}
+  await atomicWriteFile(path2.join(packRoot, SKILL_PACK_LOCK_FILENAME), `${JSON.stringify(lock, null, 2)}
 `, {
     mode: FILE_MODE
   });
@@ -15342,10 +15568,10 @@ function isLockShaped(value) {
 }
 async function readLock(dataDir, name) {
   if (!isSkillPackPathSafe(name)) return void 0;
-  const packRoot = path.join(skillPacksRoot(dataDir), name);
+  const packRoot = path2.join(skillPacksRoot(dataDir), name);
   let raw;
   try {
-    raw = await promises.readFile(path.join(packRoot, SKILL_PACK_LOCK_FILENAME), "utf8");
+    raw = await promises.readFile(path2.join(packRoot, SKILL_PACK_LOCK_FILENAME), "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return void 0;
     throw err;
@@ -15360,7 +15586,7 @@ async function readLock(dataDir, name) {
   return {
     name,
     lock: parsed,
-    directory: path.join(packRoot, parsed.content_hash.slice("sha256:".length))
+    directory: path2.join(packRoot, parsed.content_hash.slice("sha256:".length))
   };
 }
 async function listInstalledSkillPacks(dataDir) {
@@ -15409,7 +15635,7 @@ async function projectSkillPack(dataDir, name, targetDir) {
       );
     }
     const destination = resolveInside(targetDir, file.path);
-    await promises.mkdir(path.dirname(destination), { recursive: true, mode: DIR_MODE });
+    await promises.mkdir(path2.dirname(destination), { recursive: true, mode: DIR_MODE });
     await assertNotSymlink(destination);
     await atomicWriteFile(destination, bytes, { mode: FILE_MODE });
     copied.push(file.path);
@@ -15424,7 +15650,7 @@ async function projectSkillPack(dataDir, name, targetDir) {
   return {
     name: installed.name,
     contentHash: installed.lock.content_hash,
-    targetDir: path.resolve(targetDir),
+    targetDir: path2.resolve(targetDir),
     files: copied
   };
 }
@@ -15933,8 +16159,8 @@ function generateLaunchdPlist(def) {
   const { label, program, logDir } = def;
   const args = [program.command, ...program.args];
   const cwd = program.cwd ?? os6.homedir();
-  const outLog = path.join(logDir, `${label}.out.log`);
-  const errLog = path.join(logDir, `${label}.err.log`);
+  const outLog = path2.join(logDir, `${label}.out.log`);
+  const errLog = path2.join(logDir, `${label}.err.log`);
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -15975,7 +16201,7 @@ function createLaunchdLifecycle(def, deps = {}) {
     return process.getuid();
   });
   const label = sanitizeServiceName(def.name);
-  const plistPath = () => path.join(homedir(), "Library", "LaunchAgents", `${label}.plist`);
+  const plistPath = () => path2.join(homedir(), "Library", "LaunchAgents", `${label}.plist`);
   const domainTarget = () => `gui/${getuid()}`;
   const serviceTarget = () => `${domainTarget()}/${label}`;
   async function fileExists(p) {
@@ -15988,7 +16214,7 @@ function createLaunchdLifecycle(def, deps = {}) {
   }
   async function writePlist(program) {
     const xml = generateLaunchdPlist({ label, program, logDir: def.logDir });
-    await fs24.mkdir(path.dirname(plistPath()), { recursive: true });
+    await fs24.mkdir(path2.dirname(plistPath()), { recursive: true });
     await fs24.mkdir(def.logDir, { recursive: true });
     await fs24.writeFile(plistPath(), xml, "utf8");
   }
@@ -16062,8 +16288,8 @@ function generateSystemdUnit(def) {
   assertNoControlChars(displayName, "displayName");
   const cwd = program.cwd ?? os6.homedir();
   assertNoControlChars(cwd, "program.cwd");
-  const outLog = path.join(logDir, `${name}.out.log`);
-  const errLog = path.join(logDir, `${name}.err.log`);
+  const outLog = path2.join(logDir, `${name}.out.log`);
+  const errLog = path2.join(logDir, `${name}.err.log`);
   assertNoControlChars(outLog, "logDir");
   assertNoControlChars(errLog, "logDir");
   const execStart = [program.command, ...program.args].map(quoteSystemdArg).join(" ");
@@ -16089,7 +16315,7 @@ function createSystemdLifecycle(def, deps = {}) {
   const homedir = deps.homedir ?? (() => os6.homedir());
   const name = sanitizeServiceName(def.name);
   const unitName = `${name}.service`;
-  const unitPath = () => path.join(homedir(), ".config", "systemd", "user", unitName);
+  const unitPath = () => path2.join(homedir(), ".config", "systemd", "user", unitName);
   async function fileExists(p) {
     try {
       await fs24.stat(p);
@@ -16100,7 +16326,7 @@ function createSystemdLifecycle(def, deps = {}) {
   }
   async function writeUnit(program) {
     const unit = generateSystemdUnit({ name, displayName: def.displayName ?? def.name, program, logDir: def.logDir });
-    await fs24.mkdir(path.dirname(unitPath()), { recursive: true });
+    await fs24.mkdir(path2.dirname(unitPath()), { recursive: true });
     await fs24.mkdir(def.logDir, { recursive: true });
     await fs24.writeFile(unitPath(), unit, "utf8");
   }
@@ -16182,8 +16408,8 @@ function createWinswLifecycle(def, deps = {}) {
   const winswBin = windows.winswBin;
   const id = sanitizeServiceName(def.name);
   const installDir = windows.installDir ?? def.logDir;
-  const exePath = path.join(installDir, `${id}.exe`);
-  const xmlPath = path.join(installDir, `${id}.xml`);
+  const exePath = path2.join(installDir, `${id}.exe`);
+  const xmlPath = path2.join(installDir, `${id}.xml`);
   async function fileExists(p) {
     try {
       await fs24.stat(p);
@@ -16251,6 +16477,6 @@ function createServiceLifecycle(def, opts = {}) {
   }
 }
 
-export { AGENT_CONTENT_READ_CAPABILITIES, AGENT_CONTENT_READ_CAPABILITY_ARTIFACT, AGENT_CONTENT_READ_CAPABILITY_TRANSCRIPT, AGENT_CONTENT_READ_CAPABILITY_WORKSPACE, AgentHomeBusyError, AgentHomeCollisionError, AgentHomeError, AgentHomeLayout, AgentHomeLeaseCorruptError, AgentHomeLeaseManager, AgentHomeManager, AgentHomeResolutionError, AgentRefValidationError, AgentSessionHandoffCorruptError, AgentSessionHandoffMismatchError, AgentSessionHandoffStore, AgentSessionHandoffStoreError, AuthManager, BlobClient, ClaudeAdapter, CodexAdapter, DEFAULT_ACK_CRITICAL_RESERVE_BYTES, DEFAULT_CLEANUP_BATCH_LIMIT, DEFAULT_HARD_BUDGET_RATIO, DEFAULT_INCREMENTAL_VACUUM_PAGES, DEFAULT_LOG_ROTATION, DEFAULT_NORMAL_COMPACTION_INTERVAL_MS, DEFAULT_PRESSURE_COMPACTION_INTERVAL_MS, DEFAULT_RETENTION_MS, DEFAULT_SOFT_BUDGET_RATIO, DaemonObserver, DeviceRevokedError, GitWorkspaceError, GitWorkspaceManager, GitWorkspaceStore, JOURNAL_DB_FILENAME, JOURNAL_QUARANTINE_DIRNAME, JOURNAL_TASK_REF_PREFIX, JournalClosedError, JournalCorruptError, JournalRecordTooLargeError, JournalUnavailableError, JournalUnknownTaskError, LocalStorageEmergencyError, LocalStoragePolicyError, LocalStoragePressureEngine, McpToolsetDefinitionRevisionConflictError, McpToolsetRevisionConflictError, PI_PACKAGE_NAME, PiAdapter, PolicyUnsupportedError, RUNTIME_ADAPTER_CONTRACT_VIOLATION_REASON, RuntimeDisposalFailure, RuntimeExecutionFailure, SKILL_PACKS_CAPABILITY, SKILL_PACKS_DIRNAME, SKILL_PACK_AUDIT_FILENAME, SKILL_PACK_INSTALL_ERROR_CODES, SKILL_PACK_LOCK_FILENAME, SKILL_PACK_LOCK_SCHEMA, SKILL_PACK_RESPONSE_MAX_BYTES, SecureDirHardeningError, SkillPackInstallError, SqliteLocalTaskJournal, SteerUnsupportedError, StoredDeviceProofSigner, TruthMemoryClient, TruthMemoryClientError, UnsupportedServicePlatformError, buildIcaclsArgs, cleanupEligibleAt, cleanupOrderFor, computePressureState, createAgentHomeProjection, createDaemon, createDaemonWithAdapters, createFilesystemCleanupExecutor, createServiceLifecycle, createStatfsFreeBytesProvider, ensureSecureDir, freezeRuntimeAdapterDescriptor, generateLaunchdPlist, generateSystemdUnit, generateWinswXml, installSkillPacks, isGitWorkspaceConfig, isRuntimeDisposalFailure, isRuntimeExecutionFailure, journalHash, listInstalledSkillPacks, nodeAgentProgram, prependGitWorkspaceGuidance, projectRuntimeBoundaryFailure, projectRuntimeExecutionFailure, projectSkillPack, requestDeviceAssertion, resolveLocalAgentReleaseIdentity, resolveLocalStoragePolicy, sanitizeServiceName, sealRuntimeOperationManifest, skillPacksRoot, stableAgentHomeOwnerId, validateAgentRef };
+export { AGENT_CONTENT_READ_CAPABILITIES, AGENT_CONTENT_READ_CAPABILITY_ARTIFACT, AGENT_CONTENT_READ_CAPABILITY_TRANSCRIPT, AGENT_CONTENT_READ_CAPABILITY_WORKSPACE, AGENT_HOME_PROJECTION_STATE_FILE, AgentHomeBusyError, AgentHomeCollisionError, AgentHomeError, AgentHomeLayout, AgentHomeLeaseCorruptError, AgentHomeLeaseManager, AgentHomeManager, AgentHomeResolutionError, AgentRefValidationError, AgentSessionHandoffCorruptError, AgentSessionHandoffMismatchError, AgentSessionHandoffStore, AgentSessionHandoffStoreError, AuthManager, BlobClient, ClaudeAdapter, CodexAdapter, DEFAULT_ACK_CRITICAL_RESERVE_BYTES, DEFAULT_CLEANUP_BATCH_LIMIT, DEFAULT_HARD_BUDGET_RATIO, DEFAULT_INCREMENTAL_VACUUM_PAGES, DEFAULT_LOG_ROTATION, DEFAULT_NORMAL_COMPACTION_INTERVAL_MS, DEFAULT_PRESSURE_COMPACTION_INTERVAL_MS, DEFAULT_RETENTION_MS, DEFAULT_SOFT_BUDGET_RATIO, DaemonObserver, DeviceRevokedError, GitWorkspaceError, GitWorkspaceManager, GitWorkspaceStore, JOURNAL_DB_FILENAME, JOURNAL_QUARANTINE_DIRNAME, JOURNAL_TASK_REF_PREFIX, JournalClosedError, JournalCorruptError, JournalRecordTooLargeError, JournalUnavailableError, JournalUnknownTaskError, LocalStorageEmergencyError, LocalStoragePolicyError, LocalStoragePressureEngine, McpToolsetDefinitionRevisionConflictError, McpToolsetRevisionConflictError, PI_PACKAGE_NAME, PiAdapter, PolicyUnsupportedError, RUNTIME_ADAPTER_CONTRACT_VIOLATION_REASON, RuntimeDisposalFailure, RuntimeExecutionFailure, SKILL_PACKS_CAPABILITY, SKILL_PACKS_DIRNAME, SKILL_PACK_AUDIT_FILENAME, SKILL_PACK_INSTALL_ERROR_CODES, SKILL_PACK_LOCK_FILENAME, SKILL_PACK_LOCK_SCHEMA, SKILL_PACK_RESPONSE_MAX_BYTES, SecureDirHardeningError, SkillPackInstallError, SqliteLocalTaskJournal, SteerUnsupportedError, StoredDeviceProofSigner, TruthMemoryClient, TruthMemoryClientError, UnsupportedServicePlatformError, buildIcaclsArgs, cleanupEligibleAt, cleanupOrderFor, computePressureState, createAgentHomeProjection, createAgentHomeProjectionConsumer, createDaemon, createDaemonWithAdapters, createFilesystemCleanupExecutor, createServiceLifecycle, createStatfsFreeBytesProvider, ensureSecureDir, freezeRuntimeAdapterDescriptor, generateLaunchdPlist, generateSystemdUnit, generateWinswXml, installSkillPacks, isGitWorkspaceConfig, isRuntimeDisposalFailure, isRuntimeExecutionFailure, journalHash, listInstalledSkillPacks, nodeAgentProgram, prependGitWorkspaceGuidance, projectRuntimeBoundaryFailure, projectRuntimeExecutionFailure, projectSkillPack, requestDeviceAssertion, resolveLocalAgentReleaseIdentity, resolveLocalStoragePolicy, sanitizeServiceName, sealRuntimeOperationManifest, skillPacksRoot, stableAgentHomeOwnerId, validateAgentRef };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map