@byok-sdk/client 0.8.0-beta.0 → 0.8.1

package/dist/bin/byok-agent.js

@@ -1,184 +1,543 @@
 #!/usr/bin/env node
 import { randomUUID, createHash, randomBytes, timingSafeEqual, createHmac, createPrivateKey, generateKeyPairSync, sign } from 'crypto';
 import { readFileSync, promises, linkSync, fstatSync, lstatSync, unlinkSync, constants, readSync, openSync, writeFileSync, fchmodSync, fsyncSync, closeSync, opendirSync, existsSync, realpathSync, mkdirSync, renameSync, chmodSync, statSync, readdirSync } from 'fs';
-import path, { isAbsolute, join } from 'path';
-import { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, TASK_STATES, AgentEgressPolicySchema, CONFIGURED_TOOLSETS_MAX_ITEMS, ToolsetIdSchema, AgentRefSchema, AgentContentReceiptPayloadSchema, BYOK_PAIR_PATH, PairResponseSchema, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, partitionAgentEvents, TASK_TRANSITIONS, encodeEnvelope, PROTOCOL_VERSION, createEnvelope, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, byokBlobUrlPath, BYOK_BLOBS_PATH, byokBlobFinalizePath, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, parseMessage, checkResultDocument, MAX_MESSAGES_PER_BATCH, BYOK_CAPABILITIES_PATH, BYOK_PRESENCE_PATH, RuntimeIdSchema, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, RESULT_DOCUMENT_MAX_BYTES, decodeEnvelope, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendResponseSchema, UnknownMessageTypeError, BYOK_WS_PATH } from '@byok-sdk/protocol';
+import * as path3 from 'path';
+import path3__default, { isAbsolute, join } from 'path';
+import { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, TASK_STATES, AgentEgressPolicySchema, AgentHomeProjectionPayloadSchema, CONFIGURED_TOOLSETS_MAX_ITEMS, ToolsetIdSchema, AgentRefSchema, AgentContentReceiptPayloadSchema, BYOK_PAIR_PATH, PairResponseSchema, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, partitionAgentEvents, TASK_TRANSITIONS, encodeEnvelope, PROTOCOL_VERSION, createEnvelope, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, byokBlobUrlPath, BYOK_BLOBS_PATH, byokBlobFinalizePath, STRICT_AGENT_ONLY_CAPABILITY, AGENT_HOME_PROJECTION_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AgentHomeProjectionCompletionRequestSchema, byokAgentHomeProjectionCompletionPath, AgentHomeProjectionReadbackSchema, parseMessage, checkResultDocument, MAX_MESSAGES_PER_BATCH, BYOK_CAPABILITIES_PATH, BYOK_PRESENCE_PATH, RuntimeIdSchema, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, RESULT_DOCUMENT_MAX_BYTES, decodeEnvelope, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendResponseSchema, UnknownMessageTypeError, BYOK_WS_PATH } from '@byok-sdk/protocol';
+import net, { createServer, createConnection } from 'net';
+import * as os from 'os';
+import os__default from 'os';
 import { execFile, spawn } from 'child_process';
-import os from 'os';
 import { isTenantId, DEVICE_ASSERTION_AUDIENCE_MAX_BYTES, DEVICE_ASSERTION_DEFAULT_TTL_MS, DEVICE_ASSERTION_MAX_TTL_MS, nonceSigningBytes, CapabilityDeclarationSchema, hasCapability, DeviceAssertionClaimsSchema, deviceAssertionSigningInput, DEVICE_ASSERTION_SCHEMA_ID } from '@byok-sdk/core';
 import { promisify } from 'util';
 import { fileURLToPath } from 'url';
 import 'readline';
-import net, { createServer, createConnection } from 'net';
+import * as fs12 from 'fs/promises';
 import { WebSocket } from 'ws';
 import { createRequire } from 'module';
 import { createInterface } from 'readline/promises';
 
-var AGENT_HOME_DIRECTORY = "agents";
-var AGENT_HOME_INTERNAL_DIRECTORY = ".byok";
-var AgentHomeError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "AgentHomeError";
+var tmpSeq = 0;
+async function atomicWriteFile(filePath, data, options = {}) {
+  const tmpPath = `${filePath}.${process.pid}-${tmpSeq++}.tmp`;
+  try {
+    const handle = await promises.open(tmpPath, "w", options.mode);
+    try {
+      await handle.writeFile(data);
+      if (options.mode !== void 0) {
+        await handle.chmod(options.mode);
+      }
+      if (options.fsync) {
+        await handle.sync();
+      }
+    } finally {
+      await handle.close();
+    }
+  } catch (err) {
+    await promises.rm(tmpPath, { force: true }).catch(() => {
+    });
+    throw err;
   }
-};
-var AgentRefValidationError = class extends AgentHomeError {
-  constructor(message) {
-    super(message);
-    this.name = "AgentRefValidationError";
+  await renameOnto(tmpPath, filePath);
+  if (options.mode !== void 0) {
+    await promises.chmod(filePath, options.mode);
   }
-};
-var AgentHomeResolutionError = class extends AgentHomeError {
-  constructor(message) {
-    super(message);
-    this.name = "AgentHomeResolutionError";
+  if (options.fsync) {
+    const target = await promises.open(filePath, process.platform === "win32" ? "r+" : "r");
+    try {
+      await target.sync();
+    } finally {
+      await target.close();
+    }
+    if (process.platform !== "win32") {
+      const directory = await promises.open(path3__default.dirname(filePath), "r");
+      try {
+        await directory.sync();
+      } finally {
+        await directory.close();
+      }
+    }
   }
-};
-var AgentHomeCollisionError = class extends AgentHomeResolutionError {
-  constructor(message) {
-    super(message);
-    this.name = "AgentHomeCollisionError";
+}
+var RENAME_RETRY_ATTEMPTS = 5;
+var RENAME_RETRY_DELAY_MS = 20;
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function renameOnto(tmpPath, targetPath) {
+  for (let attempt = 1; attempt <= RENAME_RETRY_ATTEMPTS; attempt++) {
+    try {
+      await promises.rename(tmpPath, targetPath);
+      return;
+    } catch (err) {
+      const code = err.code;
+      if (code !== "EPERM" && code !== "EEXIST") {
+        await promises.rm(tmpPath, { force: true }).catch(() => {
+        });
+        throw err;
+      }
+      if (attempt === RENAME_RETRY_ATTEMPTS) {
+        await promises.rm(tmpPath, { force: true }).catch(() => {
+        });
+        throw err;
+      }
+      await delay(RENAME_RETRY_DELAY_MS * attempt);
+    }
   }
-};
-var AgentHomeBusyError = class extends AgentHomeError {
-  constructor(message) {
-    super(message);
-    this.name = "AgentHomeBusyError";
+}
+var defaultRunner = (command, args) => new Promise((resolve, reject) => {
+  execFile(command, args, (error, stdout, stderr) => {
+    if (error && typeof error.code !== "number") {
+      reject(error);
+      return;
+    }
+    resolve({ code: error ? error.code : 0, stdout, stderr });
+  });
+});
+async function runOrThrow(run, command, args, label) {
+  const result = await run(command, args);
+  if (result.code !== 0) {
+    const detail = (result.stderr || result.stdout).trim();
+    throw new Error(`${label} failed (exit ${result.code})${detail ? `: ${detail}` : ""}`);
+  }
+  return result;
+}
+function isIdempotentAbsence(result, absence) {
+  if (result.code === 0) return true;
+  const detail = `${result.stdout}
+${result.stderr}`;
+  if (absence.neverAbsence?.some((pattern) => pattern.test(detail))) return false;
+  if (absence.codes?.includes(result.code)) return true;
+  return absence.patterns.some((pattern) => pattern.test(detail));
+}
+async function runIdempotent(run, command, args, label, absence) {
+  const result = await run(command, args);
+  if (!isIdempotentAbsence(result, absence)) {
+    const detail = (result.stderr || result.stdout).trim();
+    throw new Error(`${label} failed (exit ${result.code})${detail ? `: ${detail}` : ""}`);
+  }
+  return result;
+}
+
+// src/util/secure-dir.ts
+var SYSTEM_SID = "*S-1-5-18";
+var ADMINISTRATORS_SID = "*S-1-5-32-544";
+function buildIcaclsArgs(dir, username) {
+  return [dir, "/inheritance:r", "/grant:r", `${username}:(OI)(CI)F`, "/grant", `${SYSTEM_SID}:(OI)(CI)F`, "/grant", `${ADMINISTRATORS_SID}:(OI)(CI)F`];
+}
+function buildIcaclsFileArgs(filePath, username) {
+  return [
+    filePath,
+    "/inheritance:r",
+    "/grant:r",
+    `${username}:F`,
+    "/grant",
+    `${SYSTEM_SID}:F`,
+    "/grant",
+    `${ADMINISTRATORS_SID}:F`
+  ];
+}
+var SecureDirHardeningError = class extends Error {
+  constructor(dir, reason) {
+    super(
+      `failed to apply a restrictive Windows ACL to "${dir}": ${reason} \u2014 refusing to leave this directory unprotected (it holds device credentials and/or the control-socket token, otherwise readable by any other local user); see docs/security.md`
+    );
+    this.dir = dir;
+    this.name = "SecureDirHardeningError";
   }
+  dir;
 };
-var AgentHomeLeaseCorruptError = class extends AgentHomeResolutionError {
-  constructor(message) {
-    super(message);
-    this.name = "AgentHomeLeaseCorruptError";
+var SecureFileHardeningError = class extends Error {
+  constructor(filePath, reason) {
+    super(`failed to apply a restrictive Windows ACL to "${filePath}": ${reason}`);
+    this.filePath = filePath;
+    this.name = "SecureFileHardeningError";
   }
+  filePath;
 };
-function validateAgentRef(value) {
-  let candidate;
+async function ensureSecureDir(dir, opts = {}) {
+  const platform = opts.platform ?? process.platform;
+  const run = opts.run ?? defaultRunner;
+  await promises.mkdir(dir, { recursive: true, mode: 448 });
+  await promises.chmod(dir, 448).catch(() => {
+  });
+  if (platform !== "win32") return;
+  const { username } = os__default.userInfo();
+  let result;
   try {
-    candidate = AgentRefSchema.parse(value);
-  } catch (error) {
-    throw new AgentRefValidationError(
-      `AgentRef does not match the protocol contract: ${error instanceof Error ? error.message : String(error)}`
-    );
+    result = await run("icacls", buildIcaclsArgs(dir, username));
+  } catch (err) {
+    throw new SecureDirHardeningError(dir, `could not run icacls: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (result.code !== 0) {
+    throw new SecureDirHardeningError(dir, `icacls exited ${result.code}: ${(result.stderr || result.stdout).trim()}`);
   }
-  return Object.freeze({ agentId: candidate.agentId, profileRevision: candidate.profileRevision });
-}
-function isWithin(root, candidate) {
-  const relative = path.relative(root, candidate);
-  return relative === "" || relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
 }
-function assertAbsolutePath(value, label) {
-  if (typeof value !== "string" || value.length === 0 || !path.isAbsolute(value)) {
-    throw new AgentHomeResolutionError(`${label} must be an absolute path`);
+async function ensureSecureFile(filePath, opts = {}) {
+  const platform = opts.platform ?? process.platform;
+  const run = opts.run ?? defaultRunner;
+  await promises.chmod(filePath, 384);
+  if (platform !== "win32") return;
+  const { username } = os__default.userInfo();
+  let result;
+  try {
+    result = await run("icacls", buildIcaclsFileArgs(filePath, username));
+  } catch (err) {
+    throw new SecureFileHardeningError(filePath, `could not run icacls: ${err instanceof Error ? err.message : String(err)}`);
   }
-  if (/[\u0000\r\n]/u.test(value)) {
-    throw new AgentHomeResolutionError(`${label} must not contain NUL or line breaks`);
+  if (result.code !== 0) {
+    throw new SecureFileHardeningError(filePath, `icacls exited ${result.code}: ${(result.stderr || result.stdout).trim()}`);
   }
 }
-async function resolveExistingAncestor(inputPath) {
-  let cursor = path.resolve(inputPath);
-  const tail = [];
+
+// src/daemon/path-mutation-gate.ts
+var PathMutationGateBusyError = class extends Error {
+  constructor(scope, targetPath) {
+    super(`${scope} mutation gate is already held for ${targetPath}`);
+    this.scope = scope;
+    this.targetPath = targetPath;
+    this.name = "PathMutationGateBusyError";
+  }
+  scope;
+  targetPath;
+};
+var GATE_PROTOCOL_PREFIX = "byok-path-mutation-v1:";
+var GATE_PROBE_TIMEOUT_MS = 1e3;
+var POSIX_GATE_ROOT = `/tmp/byok-pm-${process.getuid?.() ?? "unknown"}`;
+function assertAbsolutePath(value) {
+  if (!path3__default.isAbsolute(value)) throw new Error("path mutation gate target must be absolute");
+  if (/[\x00\r\n]/u.test(value)) throw new Error("path mutation gate target must not contain NUL or line breaks");
+}
+async function resolvePathWithoutCreate(input) {
+  assertAbsolutePath(input);
+  let cursor = path3__default.resolve(input);
+  const missing = [];
   for (; ; ) {
     try {
-      return { canonical: await promises.realpath(cursor), tail };
+      return path3__default.resolve(await promises.realpath(cursor), ...missing);
     } catch (error) {
       const code = error.code;
       if (code !== "ENOENT" && code !== "ENOTDIR") throw error;
-      const parent = path.dirname(cursor);
-      if (parent === cursor) throw new AgentHomeResolutionError(`no existing ancestor for ${inputPath}`);
-      tail.unshift(path.basename(cursor));
+      const parent = path3__default.dirname(cursor);
+      if (parent === cursor) throw new Error(`no existing ancestor for ${input}`);
+      missing.unshift(path3__default.basename(cursor));
       cursor = parent;
     }
   }
 }
-async function materializeDirectory(inputPath) {
-  const { canonical: canonical2, tail } = await resolveExistingAncestor(inputPath);
-  let cursor = canonical2;
-  for (const component of tail) {
-    cursor = path.join(cursor, component);
-    try {
-      const stat = await promises.lstat(cursor);
-      if (!stat.isDirectory() || stat.isSymbolicLink()) {
-        throw new AgentHomeResolutionError(`Agent home path component is not a real directory: ${cursor}`);
-      }
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-      await promises.mkdir(cursor, { mode: 448 });
-    }
-  }
-  const realized = await promises.realpath(inputPath);
-  if (realized !== cursor) {
-    throw new AgentHomeResolutionError(`Agent home path changed through a symlink while being created: ${inputPath}`);
-  }
-  return realized;
+function gateIdentity(scope, canonicalTarget) {
+  return createHash("sha256").update(`${scope}\0${canonicalTarget}`).digest("hex");
 }
-async function ensureDirectoryNoSymlink(root, target) {
-  if (!isWithin(root, target)) throw new AgentHomeResolutionError("Agent home is outside hostStorageRoot");
-  const relative = path.relative(root, target);
-  const components = relative === "" ? [] : relative.split(path.sep);
-  let cursor = root;
-  for (const component of components) {
-    cursor = path.join(cursor, component);
-    try {
-      const stat = await promises.lstat(cursor);
-      if (!stat.isDirectory() || stat.isSymbolicLink()) {
-        throw new AgentHomeResolutionError(`Agent home path component is not a real directory: ${cursor}`);
-      }
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-      await promises.mkdir(cursor, { mode: 448 });
-    }
-  }
-  const realized = await promises.realpath(target);
-  if (!isWithin(root, realized) || realized !== target) {
-    throw new AgentHomeResolutionError("Agent home changed through a symlink while it was being prepared");
-  }
-  return realized;
+function gateEndpoint(identity) {
+  if (process.platform === "win32") return `\\\\.\\pipe\\byok-path-mutation-${identity}`;
+  return path3__default.join(POSIX_GATE_ROOT, `${identity}.sock`);
 }
-async function ensurePreservedFile(filePath) {
-  try {
-    const handle = await promises.open(filePath, "wx", 384);
-    await handle.close();
-    return;
-  } catch (error) {
-    if (error.code !== "EEXIST") throw error;
-  }
-  const stat = await promises.lstat(filePath);
-  if (!stat.isFile() || stat.isSymbolicLink()) {
-    throw new AgentHomeResolutionError(`Agent home preserved file is not a regular file: ${filePath}`);
-  }
+function endProbe(socket, identity) {
+  socket.on("error", () => {
+  });
+  socket.end(`${GATE_PROTOCOL_PREFIX}${identity}
+`);
+}
+async function probeEndpoint(endpoint, identity) {
+  return new Promise((resolve) => {
+    const socket = createConnection(endpoint);
+    let settled = false;
+    let raw = "";
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.removeAllListeners();
+      socket.destroy();
+      resolve(result);
+    };
+    const timer = setTimeout(() => finish("occupied"), GATE_PROBE_TIMEOUT_MS);
+    socket.setEncoding("utf8");
+    socket.on("data", (chunk) => {
+      raw += chunk;
+      if (raw.length > GATE_PROTOCOL_PREFIX.length + 65) finish("occupied");
+    });
+    socket.once("end", () => {
+      finish(raw.trimEnd() === `${GATE_PROTOCOL_PREFIX}${identity}` ? "holder" : "occupied");
+    });
+    socket.once("error", (error) => {
+      finish(error.code === "ECONNREFUSED" || error.code === "ENOENT" ? "unbound" : "occupied");
+    });
+  });
+}
+async function assertPrivateGateRoot() {
+  if (process.platform === "win32") return;
+  await ensureSecureDir(POSIX_GATE_ROOT);
+  const stat = await promises.lstat(POSIX_GATE_ROOT);
+  const uid = process.getuid?.();
+  if (!stat.isDirectory() || stat.isSymbolicLink() || uid !== void 0 && stat.uid !== uid) {
+    throw new Error(`path mutation gate root is not a private owned directory: ${POSIX_GATE_ROOT}`);
+  }
+}
+async function clearProvenStaleEndpoint(endpoint, identity, scope, targetPath) {
+  if (process.platform === "win32") return;
+  let stat;
+  try {
+    stat = await promises.lstat(endpoint);
+  } catch (error) {
+    if (error.code === "ENOENT") return;
+    throw error;
+  }
+  if (!stat.isSocket()) throw new Error(`path mutation gate endpoint is not a socket: ${endpoint}`);
+  if (await probeEndpoint(endpoint, identity) !== "unbound") {
+    throw new PathMutationGateBusyError(scope, targetPath);
+  }
+  await promises.rm(endpoint, { force: true });
+}
+async function acquireOne(input) {
+  const canonicalTarget = await resolvePathWithoutCreate(input.targetPath);
+  const identity = gateIdentity(input.scope, canonicalTarget);
+  const endpoint = gateEndpoint(identity);
+  await assertPrivateGateRoot();
+  await clearProvenStaleEndpoint(endpoint, identity, input.scope, canonicalTarget);
+  const server = createServer((socket) => endProbe(socket, identity));
+  try {
+    await new Promise((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(endpoint, () => {
+        server.removeListener("error", reject);
+        resolve();
+      });
+    });
+  } catch (error) {
+    server.close();
+    if (error.code === "EADDRINUSE") {
+      throw new PathMutationGateBusyError(input.scope, canonicalTarget);
+    }
+    throw error;
+  }
+  if (process.platform !== "win32") await promises.chmod(endpoint, 384).catch(() => void 0);
+  server.unref();
+  try {
+    const rechecked = await resolvePathWithoutCreate(input.targetPath);
+    if (rechecked !== canonicalTarget) {
+      throw new Error(`path mutation gate target changed during acquisition: ${input.targetPath}`);
+    }
+  } catch (error) {
+    await new Promise((resolve) => server.close(() => resolve()));
+    if (process.platform !== "win32") await promises.rm(endpoint, { force: true }).catch(() => void 0);
+    throw error;
+  }
+  let serverClosed = false;
+  let released = false;
+  let releaseAttempt;
+  return Object.freeze({
+    scope: input.scope,
+    targetPath: canonicalTarget,
+    identity,
+    release: () => {
+      if (released) return Promise.resolve();
+      if (releaseAttempt !== void 0) return releaseAttempt;
+      releaseAttempt = (async () => {
+        if (!serverClosed) {
+          await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+          serverClosed = true;
+        }
+        if (process.platform !== "win32") await promises.rm(endpoint, { force: true });
+        released = true;
+      })().catch((error) => {
+        releaseAttempt = void 0;
+        throw error;
+      });
+      return releaseAttempt;
+    }
+  });
+}
+async function acquirePathMutationGate(input, options = {}) {
+  const waitMs = options.waitMs ?? 0;
+  if (!Number.isSafeInteger(waitMs) || waitMs < 0 || waitMs > 3e4) {
+    throw new Error("path mutation gate waitMs must be an integer from 0 through 30000");
+  }
+  const deadline = Date.now() + waitMs;
+  for (; ; ) {
+    try {
+      return await acquireOne(input);
+    } catch (error) {
+      if (!(error instanceof PathMutationGateBusyError) || Date.now() >= deadline) throw error;
+      await new Promise((resolve) => {
+        setTimeout(resolve, Math.min(10, Math.max(1, deadline - Date.now())));
+      });
+    }
+  }
+}
+
+// src/agent-home.ts
+var AGENT_HOME_DIRECTORY = "agents";
+var AGENT_HOME_INTERNAL_DIRECTORY = ".byok";
+var AGENT_HOME_PROJECTION_STATE_FILE = "agent-home-projection.json";
+var AgentHomeError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AgentHomeError";
+  }
+};
+var AgentRefValidationError = class extends AgentHomeError {
+  constructor(message) {
+    super(message);
+    this.name = "AgentRefValidationError";
+  }
+};
+var AgentHomeResolutionError = class extends AgentHomeError {
+  constructor(message) {
+    super(message);
+    this.name = "AgentHomeResolutionError";
+  }
+};
+var AgentHomeCollisionError = class extends AgentHomeResolutionError {
+  constructor(message) {
+    super(message);
+    this.name = "AgentHomeCollisionError";
+  }
+};
+var AgentHomeBusyError = class extends AgentHomeError {
+  constructor(message) {
+    super(message);
+    this.name = "AgentHomeBusyError";
+  }
+};
+var AgentHomeLeaseCorruptError = class extends AgentHomeResolutionError {
+  constructor(message) {
+    super(message);
+    this.name = "AgentHomeLeaseCorruptError";
+  }
+};
+function validateAgentRef(value) {
+  let candidate;
+  try {
+    candidate = AgentRefSchema.parse(value);
+  } catch (error) {
+    throw new AgentRefValidationError(
+      `AgentRef does not match the protocol contract: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  return Object.freeze({ agentId: candidate.agentId, profileRevision: candidate.profileRevision });
+}
+function isWithin(root, candidate) {
+  const relative = path3__default.relative(root, candidate);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path3__default.sep}`) && !path3__default.isAbsolute(relative);
+}
+function assertAbsolutePath2(value, label) {
+  if (typeof value !== "string" || value.length === 0 || !path3__default.isAbsolute(value)) {
+    throw new AgentHomeResolutionError(`${label} must be an absolute path`);
+  }
+  if (/[\u0000\r\n]/u.test(value)) {
+    throw new AgentHomeResolutionError(`${label} must not contain NUL or line breaks`);
+  }
+}
+async function resolveExistingAncestor(inputPath) {
+  let cursor = path3__default.resolve(inputPath);
+  const tail = [];
+  for (; ; ) {
+    try {
+      return { canonical: await promises.realpath(cursor), tail };
+    } catch (error) {
+      const code = error.code;
+      if (code !== "ENOENT" && code !== "ENOTDIR") throw error;
+      const parent = path3__default.dirname(cursor);
+      if (parent === cursor) throw new AgentHomeResolutionError(`no existing ancestor for ${inputPath}`);
+      tail.unshift(path3__default.basename(cursor));
+      cursor = parent;
+    }
+  }
+}
+async function materializeDirectory(inputPath) {
+  const { canonical: canonical2, tail } = await resolveExistingAncestor(inputPath);
+  let cursor = canonical2;
+  for (const component of tail) {
+    cursor = path3__default.join(cursor, component);
+    try {
+      const stat = await promises.lstat(cursor);
+      if (!stat.isDirectory() || stat.isSymbolicLink()) {
+        throw new AgentHomeResolutionError(`Agent home path component is not a real directory: ${cursor}`);
+      }
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      await promises.mkdir(cursor, { mode: 448 });
+    }
+  }
+  const realized = await promises.realpath(inputPath);
+  if (realized !== cursor) {
+    throw new AgentHomeResolutionError(`Agent home path changed through a symlink while being created: ${inputPath}`);
+  }
+  return realized;
+}
+async function ensureDirectoryNoSymlink(root, target) {
+  if (!isWithin(root, target)) throw new AgentHomeResolutionError("Agent home is outside hostStorageRoot");
+  const relative = path3__default.relative(root, target);
+  const components = relative === "" ? [] : relative.split(path3__default.sep);
+  let cursor = root;
+  for (const component of components) {
+    cursor = path3__default.join(cursor, component);
+    try {
+      const stat = await promises.lstat(cursor);
+      if (!stat.isDirectory() || stat.isSymbolicLink()) {
+        throw new AgentHomeResolutionError(`Agent home path component is not a real directory: ${cursor}`);
+      }
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      await promises.mkdir(cursor, { mode: 448 });
+    }
+  }
+  const realized = await promises.realpath(target);
+  if (!isWithin(root, realized) || realized !== target) {
+    throw new AgentHomeResolutionError("Agent home changed through a symlink while it was being prepared");
+  }
+  return realized;
+}
+async function ensurePreservedFile(filePath) {
+  try {
+    const handle = await promises.open(filePath, "wx", 384);
+    await handle.close();
+    return;
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+  }
+  const stat = await promises.lstat(filePath);
+  if (!stat.isFile() || stat.isSymbolicLink()) {
+    throw new AgentHomeResolutionError(`Agent home preserved file is not a regular file: ${filePath}`);
+  }
 }
 var AgentHomeLayout = class {
   hostStorageRootInput;
   agentIdByCanonicalHome = /* @__PURE__ */ new Map();
   canonicalRoot;
   constructor(hostStorageRoot) {
-    assertAbsolutePath(hostStorageRoot, "agentHome.hostStorageRoot");
-    this.hostStorageRootInput = path.resolve(hostStorageRoot);
+    assertAbsolutePath2(hostStorageRoot, "agentHome.hostStorageRoot");
+    this.hostStorageRootInput = path3__default.resolve(hostStorageRoot);
   }
   async resolve(agentRefInput) {
-    const agentRef = validateAgentRef(agentRefInput);
-    const hostStorageRoot = await this.resolveRoot();
-    const agentsRoot = await ensureDirectoryNoSymlink(
-      hostStorageRoot,
-      path.join(hostStorageRoot, AGENT_HOME_DIRECTORY)
-    );
-    const lexicalHome = path.join(agentsRoot, agentRef.agentId);
-    const canonicalHome = await ensureDirectoryNoSymlink(agentsRoot, lexicalHome);
-    const priorAgentId = this.agentIdByCanonicalHome.get(canonicalHome);
-    if (priorAgentId !== void 0 && priorAgentId !== agentRef.agentId) {
-      throw new AgentHomeCollisionError(
-        `canonical Agent home ${canonicalHome} is already bound to Agent ${priorAgentId}`
+    const gate = await this.acquireRootMutationGate();
+    try {
+      const agentRef = validateAgentRef(agentRefInput);
+      const hostStorageRoot = await this.resolveRoot();
+      const agentsRoot = await ensureDirectoryNoSymlink(
+        hostStorageRoot,
+        path3__default.join(hostStorageRoot, AGENT_HOME_DIRECTORY)
       );
+      const lexicalHome = path3__default.join(agentsRoot, agentRef.agentId);
+      const canonicalHome = await ensureDirectoryNoSymlink(agentsRoot, lexicalHome);
+      const priorAgentId = this.agentIdByCanonicalHome.get(canonicalHome);
+      if (priorAgentId !== void 0 && priorAgentId !== agentRef.agentId) {
+        throw new AgentHomeCollisionError(
+          `canonical Agent home ${canonicalHome} is already bound to Agent ${priorAgentId}`
+        );
+      }
+      this.agentIdByCanonicalHome.set(canonicalHome, agentRef.agentId);
+      return Object.freeze({
+        agentRef,
+        hostStorageRoot,
+        agentsRoot,
+        homeDir: canonicalHome,
+        canonicalHome
+      });
+    } finally {
+      await gate.release();
     }
-    this.agentIdByCanonicalHome.set(canonicalHome, agentRef.agentId);
-    return Object.freeze({
-      agentRef,
-      hostStorageRoot,
-      agentsRoot,
-      homeDir: canonicalHome,
-      canonicalHome
-    });
   }
   /**
    * Prove the canonical root is materializable and writable before the daemon
@@ -186,6 +545,7 @@ var AgentHomeLayout = class {
    * file is created by this preflight.
    */
   async preflight() {
+    const gate = await this.acquireRootMutationGate();
     let probePath;
     let handle;
     let created = false;
@@ -193,9 +553,9 @@ var AgentHomeLayout = class {
       const hostStorageRoot = await this.resolveRoot();
       const agentsRoot = await ensureDirectoryNoSymlink(
         hostStorageRoot,
-        path.join(hostStorageRoot, AGENT_HOME_DIRECTORY)
+        path3__default.join(hostStorageRoot, AGENT_HOME_DIRECTORY)
       );
-      probePath = path.join(agentsRoot, `.byok-agent-home-preflight-${randomUUID()}`);
+      probePath = path3__default.join(agentsRoot, `.byok-agent-home-preflight-${randomUUID()}`);
       handle = await promises.open(probePath, "wx", 384);
       created = true;
       await handle.sync();
@@ -211,8 +571,19 @@ var AgentHomeLayout = class {
       throw new AgentHomeResolutionError(
         `agentHome.hostStorageRoot preflight failed: ${error instanceof Error ? error.message : String(error)}`
       );
+    } finally {
+      await gate.release();
     }
   }
+  /**
+   * Construction-time validation is deliberately non-mutating. The actual
+   * writable preflight runs asynchronously after daemon ownership is acquired
+   * and before transport/capability publication, where it can participate in
+   * the cross-process relocation gate without a sync shadow lock.
+   */
+  preflightSync() {
+    assertAbsolutePath2(this.hostStorageRootInput, "agentHome.hostStorageRoot");
+  }
   async resolveRoot() {
     if (this.canonicalRoot !== void 0) return this.canonicalRoot;
     try {
@@ -224,9 +595,22 @@ var AgentHomeLayout = class {
     }
     return this.canonicalRoot;
   }
+  async acquireRootMutationGate() {
+    try {
+      return await acquirePathMutationGate({
+        scope: "agent-home-root",
+        targetPath: path3__default.join(this.hostStorageRootInput, AGENT_HOME_DIRECTORY)
+      }, { waitMs: 1e3 });
+    } catch (error) {
+      if (error instanceof PathMutationGateBusyError) {
+        throw new AgentHomeBusyError("Agent-home root is reserved for local-state relocation");
+      }
+      throw error;
+    }
+  }
 };
 function stableAgentHomeOwnerId(storeDir, productId) {
-  const identity = `${path.resolve(storeDir)}\0${productId}`;
+  const identity = `${path3__default.resolve(storeDir)}\0${productId}`;
   return `store-product:${createHash("sha256").update(identity).digest("hex")}`;
 }
 function parseLeaseMarker(value, lockPath) {
@@ -236,7 +620,7 @@ function parseLeaseMarker(value, lockPath) {
   } catch {
     throw new AgentHomeLeaseCorruptError(`Agent home lease marker ${lockPath} is corrupt`);
   }
-  if (typeof parsed !== "object" || parsed === null || parsed.version !== 1 || typeof parsed.ownerId !== "string" || typeof parsed.leaseId !== "string" || typeof parsed.canonicalHome !== "string" || !path.isAbsolute(parsed.canonicalHome)) {
+  if (typeof parsed !== "object" || parsed === null || parsed.version !== 1 || typeof parsed.ownerId !== "string" || typeof parsed.leaseId !== "string" || typeof parsed.canonicalHome !== "string" || !path3__default.isAbsolute(parsed.canonicalHome)) {
     throw new AgentHomeLeaseCorruptError(`Agent home lease marker ${lockPath} has an invalid shape`);
   }
   let agentRef;
@@ -246,7 +630,7 @@ function parseLeaseMarker(value, lockPath) {
     throw new AgentHomeLeaseCorruptError(`Agent home lease marker ${lockPath} has an invalid AgentRef`);
   }
   const marker = parsed;
-  return { ...marker, agentRef, canonicalHome: path.resolve(marker.canonicalHome) };
+  return { ...marker, agentRef, canonicalHome: path3__default.resolve(marker.canonicalHome) };
 }
 var AgentHomeLeaseManager = class _AgentHomeLeaseManager {
   static held = /* @__PURE__ */ new Map();
@@ -263,14 +647,19 @@ var AgentHomeLeaseManager = class _AgentHomeLeaseManager {
     _AgentHomeLeaseManager.held.set(canonicalHome, leaseId);
     let lockPath;
     let handle;
+    let rootGate;
     let ownsMarker = false;
     try {
+      rootGate = await acquirePathMutationGate({
+        scope: "agent-home-root",
+        targetPath: resolution.agentsRoot
+      }, { waitMs: 1e3 });
       await ensureDirectoryNoSymlink(resolution.agentsRoot, canonicalHome);
       const internalDir = await ensureDirectoryNoSymlink(
         canonicalHome,
-        path.join(canonicalHome, AGENT_HOME_INTERNAL_DIRECTORY)
+        path3__default.join(canonicalHome, AGENT_HOME_INTERNAL_DIRECTORY)
       );
-      lockPath = path.join(internalDir, "agent-home.lease");
+      lockPath = path3__default.join(internalDir, "agent-home.lease");
       handle = await this.openLeaseMarker(lockPath, canonicalHome, agentRef.agentId);
       ownsMarker = true;
       const marker = {
@@ -284,14 +673,21 @@ var AgentHomeLeaseManager = class _AgentHomeLeaseManager {
       await handle.sync();
       await handle.close();
       handle = void 0;
+      await rootGate.release();
+      rootGate = void 0;
     } catch (error) {
       await handle?.close().catch(() => {
       });
       if (ownsMarker && lockPath !== void 0) await promises.rm(lockPath, { force: true }).catch(() => {
       });
+      await rootGate?.release().catch(() => {
+      });
       if (_AgentHomeLeaseManager.held.get(canonicalHome) === leaseId) {
         _AgentHomeLeaseManager.held.delete(canonicalHome);
       }
+      if (error instanceof PathMutationGateBusyError) {
+        throw new AgentHomeBusyError("Agent-home root is reserved for local-state relocation");
+      }
       if (error instanceof AgentHomeError) throw error;
       throw new AgentHomeError(`could not acquire Agent home lease: ${error instanceof Error ? error.message : String(error)}`);
     }
@@ -369,9 +765,73 @@ var AgentHomeLeaseManager = class _AgentHomeLeaseManager {
 async function initializeAgentHome(resolution) {
   await ensureDirectoryNoSymlink(
     resolution.canonicalHome,
-    path.join(resolution.canonicalHome, "notes")
+    path3__default.join(resolution.canonicalHome, "notes")
   );
-  await ensurePreservedFile(path.join(resolution.canonicalHome, "MEMORY.md"));
+  await ensurePreservedFile(path3__default.join(resolution.canonicalHome, "MEMORY.md"));
+}
+function projectionStatePath(resolution) {
+  return path3__default.join(
+    resolution.canonicalHome,
+    AGENT_HOME_INTERNAL_DIRECTORY,
+    AGENT_HOME_PROJECTION_STATE_FILE
+  );
+}
+async function readProjectionState(resolution) {
+  const filePath = projectionStatePath(resolution);
+  try {
+    const stat = await promises.lstat(filePath);
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+      throw new AgentHomeResolutionError(`Agent projection state is not a regular file: ${filePath}`);
+    }
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(await promises.readFile(filePath, "utf8"));
+  } catch (error) {
+    throw new AgentHomeResolutionError(
+      `Agent projection state is corrupt: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  if (typeof parsed !== "object" || parsed === null || parsed.version !== 1 || typeof parsed.requestId !== "string" || typeof parsed.projectionHash !== "string") {
+    throw new AgentHomeResolutionError("Agent projection state has an invalid shape");
+  }
+  const candidate = parsed;
+  const agentRef = validateAgentRef(candidate.agentRef);
+  if (agentRef.agentId !== resolution.agentRef.agentId) {
+    throw new AgentHomeCollisionError("Agent projection state belongs to a different Agent home");
+  }
+  return Object.freeze({
+    version: 1,
+    agentRef,
+    requestId: candidate.requestId,
+    projectionHash: candidate.projectionHash
+  });
+}
+async function writeProjectionState(resolution, payload) {
+  const filePath = projectionStatePath(resolution);
+  const existing = await promises.lstat(filePath).catch((error) => {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  });
+  if (existing !== void 0 && (!existing.isFile() || existing.isSymbolicLink())) {
+    throw new AgentHomeResolutionError(`Agent projection state is not a regular file: ${filePath}`);
+  }
+  const state = {
+    version: 1,
+    agentRef: payload.agentRef,
+    requestId: payload.requestId,
+    projectionHash: payload.projectionHash
+  };
+  await atomicWriteFile(filePath, `${JSON.stringify(state)}
+`, { mode: 384, fsync: true });
+}
+function compareProjectionRevision(left, right) {
+  const leftRevision = BigInt(left);
+  const rightRevision = BigInt(right);
+  return leftRevision < rightRevision ? -1 : leftRevision > rightRevision ? 1 : 0;
 }
 var AgentHomeManager = class {
   layout;
@@ -397,6 +857,10 @@ var AgentHomeManager = class {
   async preflight() {
     await this.layout.preflight();
   }
+  /** Synchronous construction-time preflight for strict Agent-only admission. */
+  preflightSync() {
+    this.layout.preflightSync();
+  }
   /** Resolve and lease without applying downstream projection side effects. */
   async acquire(agentRef) {
     const resolution = await this.layout.resolve(agentRef);
@@ -407,14 +871,68 @@ var AgentHomeManager = class {
   async initialize(binding) {
     const { resolution, lease } = binding;
     await initializeAgentHome(resolution);
-    await this.projection?.prepare({ ...resolution, cwd: lease.cwd });
+    const prepare = this.projection?.prepare;
+    if (prepare !== void 0) await prepare({ ...resolution, cwd: lease.cwd });
     if (await promises.realpath(resolution.homeDir) !== resolution.canonicalHome) {
       throw new AgentHomeResolutionError("Agent projection changed the canonical home path");
     }
     await initializeAgentHome(resolution);
   }
-};
-var AgentSessionHandoffStoreError = class extends Error {
+  supportsTaskFreeProjection() {
+    return this.projection?.apply !== void 0;
+  }
+  /**
+   * Apply one task-free projection under the same canonical-home writer lease
+   * used by Agent execution. The host hook owns an atomic/idempotent ensure of
+   * its opaque product bytes, so an exact desired-state replay invokes it again
+   * before returning `idempotent`. Only a successful new-state hook followed
+   * by the SDK-owned fsynced ordering record can return `applied`.
+   */
+  async project(input) {
+    const payload = AgentHomeProjectionPayloadSchema.parse(input);
+    const binding = await this.acquire(payload.agentRef);
+    try {
+      const { resolution, lease } = binding;
+      await initializeAgentHome(resolution);
+      const applyProjection = async () => {
+        const apply = this.projection?.apply;
+        if (apply === void 0) {
+          throw new AgentHomeError("task-free Agent-home projection is not configured");
+        }
+        await apply({
+          ...resolution,
+          cwd: lease.cwd,
+          requestId: payload.requestId,
+          projectionHash: payload.projectionHash,
+          projection: payload.projection
+        });
+        if (await promises.realpath(resolution.homeDir) !== resolution.canonicalHome) {
+          throw new AgentHomeResolutionError("Agent projection changed the canonical home path");
+        }
+        await initializeAgentHome(resolution);
+      };
+      const current = await readProjectionState(resolution);
+      if (current !== void 0) {
+        const order = compareProjectionRevision(
+          payload.agentRef.profileRevision,
+          current.agentRef.profileRevision
+        );
+        if (order < 0) return "stale";
+        if (order === 0) {
+          if (payload.projectionHash !== current.projectionHash) return "conflict";
+          await applyProjection();
+          return "idempotent";
+        }
+      }
+      await applyProjection();
+      await writeProjectionState(resolution, payload);
+      return "applied";
+    } finally {
+      await binding.lease.release();
+    }
+  }
+};
+var AgentSessionHandoffStoreError = class extends Error {
   constructor(message) {
     super(message);
     this.name = "AgentSessionHandoffStoreError";
@@ -453,7 +971,7 @@ function parseTaskTerminalEntry(value) {
   assertNonEmptyString(value.terminalReason, "taskTerminal.terminalReason");
   assertNonEmptyString(value.updatedAt, "taskTerminal.updatedAt");
   if (value.sessionRef !== void 0) assertNonEmptyString(value.sessionRef, "taskTerminal.sessionRef");
-  if (typeof value.cwd !== "string" || !path.isAbsolute(value.cwd)) {
+  if (typeof value.cwd !== "string" || !path3__default.isAbsolute(value.cwd)) {
     throw new AgentSessionHandoffCorruptError("taskTerminal.cwd must be an absolute path");
   }
   if (value.terminalCause !== "failed") {
@@ -466,7 +984,7 @@ function parseTaskTerminalEntry(value) {
     agentRef,
     taskId: value.taskId,
     runtimeId: value.runtimeId,
-    cwd: path.resolve(value.cwd),
+    cwd: path3__default.resolve(value.cwd),
     leaseId: value.leaseId,
     ...value.sessionRef === void 0 ? {} : { sessionRef: value.sessionRef },
     terminalCause: "failed",
@@ -496,7 +1014,7 @@ function parseEntry(value) {
   assertNonEmptyString(value.runtimeId, "handoff.runtimeId");
   assertNonEmptyString(value.leaseId, "handoff.leaseId");
   assertNonEmptyString(value.updatedAt, "handoff.updatedAt");
-  if (typeof value.cwd !== "string" || !path.isAbsolute(value.cwd)) {
+  if (typeof value.cwd !== "string" || !path3__default.isAbsolute(value.cwd)) {
     throw new AgentSessionHandoffCorruptError("handoff.cwd must be an absolute path");
   }
   if (Number.isNaN(Date.parse(value.updatedAt))) {
@@ -513,7 +1031,7 @@ function parseEntry(value) {
     taskId: value.taskId,
     sessionRef: value.sessionRef,
     runtimeId: value.runtimeId,
-    cwd: path.resolve(value.cwd),
+    cwd: path3__default.resolve(value.cwd),
     leaseId: value.leaseId,
     ...value.terminalCause === void 0 ? {} : { terminalCause: value.terminalCause },
     ...value.terminalReason === void 0 ? {} : { terminalReason: value.terminalReason },
@@ -524,10 +1042,10 @@ function sameRef(left, right) {
   return left.agentId === right.agentId && left.profileRevision === right.profileRevision;
 }
 function sameMatch(entry, expected) {
-  return sameRef(entry.agentRef, expected.agentRef) && entry.sessionRef === expected.sessionRef && entry.runtimeId === expected.runtimeId && entry.cwd === path.resolve(expected.cwd);
+  return sameRef(entry.agentRef, expected.agentRef) && entry.sessionRef === expected.sessionRef && entry.runtimeId === expected.runtimeId && entry.cwd === path3__default.resolve(expected.cwd);
 }
 function sameTaskTerminalMatch(entry, expected) {
-  return sameRef(entry.agentRef, expected.agentRef) && entry.taskId === expected.taskId && entry.runtimeId === expected.runtimeId && entry.cwd === path.resolve(expected.cwd);
+  return sameRef(entry.agentRef, expected.agentRef) && entry.taskId === expected.taskId && entry.runtimeId === expected.runtimeId && entry.cwd === path3__default.resolve(expected.cwd);
 }
 function sessionFileName(runtimeId, sessionRef) {
   const digest2 = createHash("sha256").update(sessionRef, "utf8").digest("hex");
@@ -540,13 +1058,13 @@ function taskTerminalFileName(runtimeId, taskId) {
   return `${runtime}-task-${digest2}.jsonl`;
 }
 async function evidenceDirectory(cwdInput) {
-  if (!path.isAbsolute(cwdInput)) {
+  if (!path3__default.isAbsolute(cwdInput)) {
     throw new AgentSessionHandoffStoreError("Agent session cwd must be absolute");
   }
   const cwd = await promises.realpath(cwdInput);
   let cursor = cwd;
   for (const component of [".byok", "runtime-sessions"]) {
-    cursor = path.join(cursor, component);
+    cursor = path3__default.join(cursor, component);
     try {
       const stat = await promises.lstat(cursor);
       if (!stat.isDirectory() || stat.isSymbolicLink()) {
@@ -558,8 +1076,8 @@ async function evidenceDirectory(cwdInput) {
     }
   }
   const canonical2 = await promises.realpath(cursor);
-  const relative = path.relative(cwd, canonical2);
-  if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+  const relative = path3__default.relative(cwd, canonical2);
+  if (relative === ".." || relative.startsWith(`..${path3__default.sep}`) || path3__default.isAbsolute(relative)) {
     throw new AgentSessionHandoffStoreError("Agent session evidence path escaped the canonical Agent home");
   }
   return canonical2;
@@ -605,7 +1123,7 @@ var AgentSessionHandoffStore = class {
         taskId: input.taskId,
         sessionRef: input.sessionRef,
         runtimeId: input.runtimeId,
-        cwd: path.resolve(input.cwd),
+        cwd: path3__default.resolve(input.cwd),
         leaseId: input.leaseId,
         updatedAt: (/* @__PURE__ */ new Date()).toISOString()
       });
@@ -648,7 +1166,7 @@ var AgentSessionHandoffStore = class {
       agentRef: validateAgentRef(input.agentRef),
       taskId: input.taskId,
       runtimeId: input.runtimeId,
-      cwd: path.resolve(input.cwd)
+      cwd: path3__default.resolve(input.cwd)
     };
     const filePath = await this.taskTerminalFilePath(expected);
     return this.enqueue(filePath, async () => {
@@ -675,7 +1193,7 @@ var AgentSessionHandoffStore = class {
       agentRef: validateAgentRef(expectedInput.agentRef),
       taskId: expectedInput.taskId,
       runtimeId: expectedInput.runtimeId,
-      cwd: path.resolve(expectedInput.cwd)
+      cwd: path3__default.resolve(expectedInput.cwd)
     };
     const filePath = await this.taskTerminalFilePath(expected);
     return this.enqueue(filePath, async () => {
@@ -693,14 +1211,14 @@ var AgentSessionHandoffStore = class {
     assertNonEmptyString(match.sessionRef, "handoff.sessionRef");
     assertNonEmptyString(match.runtimeId, "handoff.runtimeId");
     const directory = await evidenceDirectory(match.cwd);
-    return path.join(directory, sessionFileName(match.runtimeId, match.sessionRef));
+    return path3__default.join(directory, sessionFileName(match.runtimeId, match.sessionRef));
   }
   async taskTerminalFilePath(match) {
     validateAgentRef(match.agentRef);
     assertNonEmptyString(match.taskId, "taskTerminal.taskId");
     assertNonEmptyString(match.runtimeId, "taskTerminal.runtimeId");
     const directory = await evidenceDirectory(match.cwd);
-    return path.join(directory, taskTerminalFileName(match.runtimeId, match.taskId));
+    return path3__default.join(directory, taskTerminalFileName(match.runtimeId, match.taskId));
   }
   enqueue(key, task) {
     const previous = this.queues.get(key) ?? Promise.resolve();
@@ -774,183 +1292,537 @@ var AgentSessionHandoffStore = class {
     }
   }
 };
-
-// src/types.ts
-function frozenStrings(values) {
-  return values === void 0 ? void 0 : Object.freeze([...values]);
-}
-function frozenPolicy(policy) {
-  const allowTools = policy.allowTools === void 0 ? void 0 : Object.freeze([...policy.allowTools]);
-  const denyTools = policy.denyTools === void 0 ? void 0 : Object.freeze([...policy.denyTools]);
-  return Object.freeze({
-    mode: policy.mode,
-    ...allowTools === void 0 ? {} : { allowTools },
-    ...denyTools === void 0 ? {} : { denyTools },
-    ...policy.workspaceRoot === void 0 ? {} : { workspaceRoot: policy.workspaceRoot },
-    ...policy.network === void 0 ? {} : { network: policy.network }
+var DAEMON_OWNER_FILENAME = "daemon-owner.json";
+var RECLAIM_FILENAME = `${DAEMON_OWNER_FILENAME}.reclaim`;
+var MAX_OWNER_BYTES = 4096;
+var RECLAIM_MALFORMED_GRACE_MS = 3e4;
+var SELF_PROCESS_STARTED_AT = new Date(Date.now() - process.uptime() * 1e3).toISOString();
+function endOwnershipProbe(socket, response) {
+  socket.on("error", () => {
   });
+  if (response === void 0) socket.end();
+  else socket.end(response);
 }
-function freezeRuntimeAdapterDescriptor(descriptor) {
-  const baseNames = frozenStrings(descriptor.environmentRequirements.baseNames);
-  const credentialNames = frozenStrings(descriptor.environmentRequirements.credentialNames);
-  return Object.freeze({
-    id: descriptor.id,
-    supportsDispatchSelection: descriptor.supportsDispatchSelection === true,
-    capabilities: Object.freeze({
-      steer: descriptor.capabilities.steer === true,
-      resume: descriptor.capabilities.resume === true,
-      approvalInteractive: descriptor.capabilities.approvalInteractive === true,
-      ...descriptor.capabilities.mcpToolsets === void 0 ? {} : { mcpToolsets: descriptor.capabilities.mcpToolsets === true },
-      permissionModes: Object.freeze([...descriptor.capabilities.permissionModes])
-    }),
-    environmentRequirements: Object.freeze({
-      ...baseNames === void 0 ? {} : { baseNames },
-      ...credentialNames === void 0 ? {} : { credentialNames }
-    })
-  });
+var STORE_MUTEX_ID_PREFIX = "byok-store-mutex-v1:";
+var STORE_MUTEX_PROBE_TIMEOUT_MS = 1e3;
+var STORE_MUTEX_SOCKET_FILENAME = "mutex.sock";
+var UNIX_SOCKET_PATH_SOFT_LIMIT = 100;
+var STORE_MUTEX_FALLBACK_ROOT = "/tmp";
+function storeMutexIdentity(canonicalStoreDir) {
+  return createHash("sha256").update(canonicalStoreDir).digest("hex");
 }
-function sealRuntimeOperationManifest(manifest) {
-  return Object.freeze({
-    taskId: manifest.taskId,
-    runtimeId: manifest.runtimeId,
-    descriptor: freezeRuntimeAdapterDescriptor(manifest.descriptor),
-    policy: frozenPolicy(manifest.policy),
-    requiredToolsetIds: Object.freeze([...manifest.requiredToolsetIds]),
-    ...manifest.dispatchSelection === void 0 ? {} : { dispatchSelection: Object.freeze({ ...manifest.dispatchSelection }) },
-    ...manifest.sessionRef === void 0 ? {} : { sessionRef: manifest.sessionRef },
-    ...manifest.agentRef === void 0 ? {} : { agentRef: Object.freeze({ agentId: manifest.agentRef.agentId, profileRevision: manifest.agentRef.profileRevision }) },
-    cwd: manifest.cwd ?? manifest.workspace.workspaceDir,
-    ...manifest.lease === void 0 ? {} : { lease: Object.freeze({ leaseId: manifest.lease.leaseId, canonicalHome: manifest.lease.canonicalHome }) },
-    workspace: Object.freeze({ ...manifest.workspace }),
-    forwardedEnvironmentNames: Object.freeze([...manifest.forwardedEnvironmentNames])
-  });
+function storeMutexEndpoint(canonicalStoreDir, identity, platform = process.platform) {
+  if (platform === "win32") return `\\\\.\\pipe\\byok-store-mutex-${identity.slice(0, 16)}`;
+  const candidate = path3__default.join(canonicalStoreDir, STORE_MUTEX_SOCKET_FILENAME);
+  if (Buffer.byteLength(candidate, "utf8") <= UNIX_SOCKET_PATH_SOFT_LIMIT) return candidate;
+  return path3__default.join(STORE_MUTEX_FALLBACK_ROOT, `byok-store-mutex-${identity.slice(0, 16)}`, "sock");
 }
-var PolicyUnsupportedError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "PolicyUnsupportedError";
+var DaemonOwnerActiveError = class extends Error {
+  constructor(role) {
+    super(`store mutation lease is already held by an active ${role} process`);
+    this.role = role;
+    this.name = "DaemonOwnerActiveError";
   }
+  role;
 };
-var SteerUnsupportedError = class extends Error {
-  /** The `RuntimeAdapter.descriptor.id` that cannot steer (e.g. `claude`, `codex`). */
-  runtimeId;
-  constructor(runtimeId, message) {
-    super(message);
-    this.name = "SteerUnsupportedError";
-    this.runtimeId = runtimeId;
+function isOwnerRecord(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const candidate = value;
+  return candidate.version === 2 && Number.isSafeInteger(candidate.pid) && (candidate.pid ?? 0) > 0 && typeof candidate.nonce === "string" && candidate.nonce.length === 36 && (candidate.role === "daemon" || candidate.role === "doctor") && typeof candidate.acquiredAt === "string" && Number.isFinite(Date.parse(candidate.acquiredAt)) && typeof candidate.processStartedAt === "string" && Number.isFinite(Date.parse(candidate.processStartedAt)) && Number.isSafeInteger(candidate.livenessPort) && (candidate.livenessPort ?? 0) > 0 && (candidate.livenessPort ?? 0) <= 65535;
+}
+async function readOwner(filePath) {
+  let namedBefore;
+  try {
+    namedBefore = await promises.lstat(filePath, { bigint: true });
+  } catch (err) {
+    if (err.code === "ENOENT") return void 0;
+    throw err;
   }
-};
-
-// src/release-identity.ts
-var LOCAL_AGENT_RELEASE_VERSION_MAX_LENGTH = 128;
-var LOCAL_AGENT_RELEASE_BUILD_ID_MAX_LENGTH = 128;
-var STRICT_SEMVER_PATTERN = new RegExp(
-  "^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$"
-);
-var BUILD_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;
-function resolveLocalAgentReleaseIdentity(input) {
-  if (input === void 0 || typeof input.version !== "string" || input.version.length > LOCAL_AGENT_RELEASE_VERSION_MAX_LENGTH || !STRICT_SEMVER_PATTERN.test(input.version)) {
-    throw new Error("DaemonConfig.localAgentRelease.version must be canonical strict SemVer");
+  if (!namedBefore.isFile() || namedBefore.isSymbolicLink()) {
+    throw new Error("store mutation owner path is not a real regular file");
   }
-  if (input.buildId !== void 0 && (typeof input.buildId !== "string" || input.buildId.length > LOCAL_AGENT_RELEASE_BUILD_ID_MAX_LENGTH || !BUILD_ID_PATTERN.test(input.buildId))) {
-    throw new Error(
-      `DaemonConfig.localAgentRelease.buildId must be 1-${LOCAL_AGENT_RELEASE_BUILD_ID_MAX_LENGTH} safe opaque characters`
+  let handle;
+  try {
+    handle = await promises.open(
+      filePath,
+      constants.O_RDONLY | (constants.O_NONBLOCK ?? 0) | (constants.O_NOFOLLOW ?? 0)
     );
+  } catch (err) {
+    if (err.code === "ENOENT") return void 0;
+    throw err;
   }
-  return Object.freeze({
-    version: input.version,
-    ...input.buildId === void 0 ? {} : { buildId: input.buildId }
-  });
-}
-
-// src/runtime-failure.ts
-var RUNTIME_EXECUTION_FAILURE_BRAND = /* @__PURE__ */ Symbol.for("@byok-sdk/client/RuntimeExecutionFailure/v1");
-var RUNTIME_DISPOSAL_FAILURE_BRAND = /* @__PURE__ */ Symbol.for("@byok-sdk/client/RuntimeDisposalFailure/v1");
-var RuntimeDisposalFailure = class extends Error {
-  stage;
-  constructor(input, options) {
-    if (!isRuntimeDisposalStage(input.stage) || typeof input.reason !== "string" || input.reason.length === 0) {
-      throw new TypeError("invalid RuntimeDisposalFailure input");
+  try {
+    const stat = await handle.stat({ bigint: true });
+    const namedAfterOpen = await promises.lstat(filePath, { bigint: true });
+    if (!stat.isFile() || !namedAfterOpen.isFile() || namedAfterOpen.isSymbolicLink() || stat.dev !== namedBefore.dev || stat.ino !== namedBefore.ino || stat.size !== namedBefore.size || stat.mtimeNs !== namedBefore.mtimeNs || stat.ctimeNs !== namedBefore.ctimeNs || stat.dev !== namedAfterOpen.dev || stat.ino !== namedAfterOpen.ino || stat.size !== namedAfterOpen.size || stat.mtimeNs !== namedAfterOpen.mtimeNs || stat.ctimeNs !== namedAfterOpen.ctimeNs) {
+      throw new Error("store mutation owner path changed before safe open");
     }
-    super(input.reason, options);
-    this.name = "RuntimeDisposalFailure";
-    this.stage = input.stage;
-    Object.defineProperty(this, RUNTIME_DISPOSAL_FAILURE_BRAND, { value: true });
-    Object.freeze(this);
-  }
-};
-function isRuntimeDisposalStage(value) {
-  return value === "signal" || value === "quiescence" || value === "cleanup";
-}
-function isRuntimeDisposalFailure(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const candidate = value;
-  return candidate[RUNTIME_DISPOSAL_FAILURE_BRAND] === true && isRuntimeDisposalStage(candidate.stage) && typeof candidate.message === "string" && candidate.message.length > 0;
-}
-var RuntimeExecutionFailure = class extends Error {
-  phase;
-  category;
-  retry;
-  constructor(input, options) {
-    if (!isRuntimeFailurePhase(input.phase) || !isRuntimeFailureCategory(input.category) || !isRuntimeRetryDisposition(input.retry) || typeof input.reason !== "string" || input.reason.length === 0) {
-      throw new TypeError("invalid RuntimeExecutionFailure input");
+    if (stat.size <= 0 || stat.size > MAX_OWNER_BYTES) return void 0;
+    const size = Number(stat.size);
+    const buffer = Buffer.alloc(size);
+    const { bytesRead } = await handle.read(buffer, 0, size, 0);
+    const after = await handle.stat({ bigint: true });
+    const namedAfterRead = await promises.lstat(filePath, { bigint: true });
+    if (bytesRead !== size || after.dev !== stat.dev || after.ino !== stat.ino || after.size !== stat.size || after.mtimeNs !== stat.mtimeNs || after.ctimeNs !== stat.ctimeNs || namedAfterRead.dev !== stat.dev || namedAfterRead.ino !== stat.ino || namedAfterRead.size !== stat.size || namedAfterRead.mtimeNs !== stat.mtimeNs || namedAfterRead.ctimeNs !== stat.ctimeNs) {
+      throw new Error("store mutation owner path changed during inspection");
     }
-    super(input.reason, options);
-    this.name = "RuntimeExecutionFailure";
-    this.phase = input.phase;
-    this.category = input.category;
-    this.retry = input.retry;
-    Object.defineProperty(this, RUNTIME_EXECUTION_FAILURE_BRAND, { value: true });
-    Object.freeze(this);
+    const raw = buffer.toString("utf8");
+    const parsed = JSON.parse(raw);
+    return isOwnerRecord(parsed) ? parsed : void 0;
+  } catch (err) {
+    if (err instanceof Error && err.message.startsWith("store mutation owner path changed")) throw err;
+    return void 0;
+  } finally {
+    await handle.close();
   }
-};
-function isRuntimeFailurePhase(value) {
-  return value === "start" || value === "run";
-}
-function isRuntimeFailureCategory(value) {
-  return value === "semantic" || value === "infrastructure" || value === "authority";
 }
-function isRuntimeRetryDisposition(value) {
-  return value === "retryable" || value === "non-retryable";
-}
-function isRuntimeExecutionFailure(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const candidate = value;
-  return candidate[RUNTIME_EXECUTION_FAILURE_BRAND] === true && isRuntimeFailurePhase(candidate.phase) && isRuntimeFailureCategory(candidate.category) && isRuntimeRetryDisposition(candidate.retry) && typeof candidate.message === "string" && candidate.message.length > 0;
-}
-function retryableFromDisposition(disposition) {
-  switch (disposition) {
-    case "retryable":
-      return true;
-    case "non-retryable":
-      return false;
+function pidIsAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
   }
 }
-function projectRuntimeExecutionFailure(failure) {
-  return {
-    reason: failure.message,
-    retryable: retryableFromDisposition(failure.retry)
-  };
-}
-var RUNTIME_ADAPTER_CONTRACT_VIOLATION_REASON = Object.freeze({
-  start: "runtime adapter contract violation during start",
-  run: "runtime adapter contract violation during run"
-});
-function projectRuntimeBoundaryFailure(value, expectedPhase) {
-  if (isRuntimeExecutionFailure(value) && value.phase === expectedPhase) {
-    return { ...projectRuntimeExecutionFailure(value), contractViolation: false };
-  }
-  return {
-    reason: RUNTIME_ADAPTER_CONTRACT_VIOLATION_REASON[expectedPhase],
-    retryable: false,
-    contractViolation: true
-  };
+async function processOwnsRecord(record) {
+  if (!pidIsAlive(record.pid)) return false;
+  if (record.pid === process.pid && record.processStartedAt !== SELF_PROCESS_STARTED_AT) return false;
+  return portIsBound(record.livenessPort);
 }
-var GIT_ERROR_CATEGORIES = [
-  "git-unavailable",
-  "git-timeout",
-  "git-output-limit",
-  "git-command-failed",
+async function portIsBound(port) {
+  const probe = createServer();
+  return new Promise((resolve, reject) => {
+    const finish = (result) => {
+      probe.removeAllListeners();
+      resolve(result);
+    };
+    probe.once("error", (err) => {
+      if (err.code === "EADDRINUSE") finish(true);
+      else reject(err);
+    });
+    probe.listen({ host: "127.0.0.1", port, exclusive: true }, () => {
+      probe.close((err) => {
+        if (err) reject(err);
+        else finish(false);
+      });
+    });
+  });
+}
+async function createLivenessListener() {
+  const server = createServer((socket) => endOwnershipProbe(socket));
+  const port = await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen({ host: "127.0.0.1", port: 0, exclusive: true }, () => {
+      server.removeListener("error", reject);
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        reject(new Error("store mutation liveness listener did not expose a TCP port"));
+        return;
+      }
+      resolve(address.port);
+    });
+  });
+  server.unref();
+  let closed = false;
+  return {
+    port,
+    close: () => new Promise((resolve, reject) => {
+      if (closed) {
+        resolve();
+        return;
+      }
+      closed = true;
+      server.close((err) => err ? reject(err) : resolve());
+    })
+  };
+}
+async function probeStoreMutex(endpoint, identity) {
+  return new Promise((resolve) => {
+    const socket = createConnection(endpoint);
+    let settled = false;
+    let raw = "";
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.removeAllListeners();
+      socket.destroy();
+      resolve(result);
+    };
+    const timer = setTimeout(() => finish({ kind: "occupied" }), STORE_MUTEX_PROBE_TIMEOUT_MS);
+    socket.setEncoding("utf8");
+    socket.on("data", (chunk) => {
+      raw += chunk;
+      if (raw.length > STORE_MUTEX_ID_PREFIX.length + 64 + 1) finish({ kind: "occupied" });
+    });
+    socket.once("end", () => finish(raw.trimEnd() === `${STORE_MUTEX_ID_PREFIX}${identity}` ? { kind: "holder" } : { kind: "occupied" }));
+    socket.once(
+      "error",
+      (err) => finish(err.code === "ECONNREFUSED" || err.code === "ENOENT" ? { kind: "unbound" } : { kind: "occupied" })
+    );
+  });
+}
+async function clearStaleStoreMutexSocket(endpoint, identity) {
+  let stat;
+  try {
+    stat = await promises.lstat(endpoint);
+  } catch (err) {
+    if (err.code === "ENOENT") return;
+    throw err;
+  }
+  if (!stat.isSocket()) throw new Error("store mutation lock path exists but is not a socket");
+  if ((await probeStoreMutex(endpoint, identity)).kind !== "unbound") throw new DaemonOwnerActiveError("unknown");
+  await promises.rm(endpoint, { force: true });
+}
+async function assertOwnedPrivateDir(dir) {
+  const uid = process.getuid?.();
+  if (uid === void 0) return;
+  const stat = await promises.lstat(dir);
+  if (stat.isSymbolicLink() || stat.uid !== uid) {
+    throw new Error(`refusing to bind the store mutation lock under "${dir}": not a real directory owned by this process's own uid`);
+  }
+}
+async function acquireStoreMutex(canonicalStoreDir) {
+  const identity = storeMutexIdentity(canonicalStoreDir);
+  const endpoint = storeMutexEndpoint(canonicalStoreDir, identity);
+  const isPipe = process.platform === "win32";
+  if (!isPipe) {
+    const endpointDir = path3__default.dirname(endpoint);
+    if (endpointDir !== canonicalStoreDir) {
+      await ensureSecureDir(endpointDir);
+      await assertOwnedPrivateDir(endpointDir);
+    }
+    await clearStaleStoreMutexSocket(endpoint, identity);
+  }
+  const server = createServer((socket) => endOwnershipProbe(socket, `${STORE_MUTEX_ID_PREFIX}${identity}
+`));
+  try {
+    await new Promise((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(endpoint, () => {
+        server.removeListener("error", reject);
+        resolve();
+      });
+    });
+  } catch (err) {
+    if (err.code === "EADDRINUSE") throw new DaemonOwnerActiveError("unknown");
+    throw err;
+  }
+  if (!isPipe) await promises.chmod(endpoint, 384).catch(() => void 0);
+  server.unref();
+  let closed = false;
+  return {
+    endpoint,
+    close: async () => {
+      if (closed) return;
+      closed = true;
+      await new Promise((resolve, reject) => server.close((err) => err ? reject(err) : resolve()));
+      if (!isPipe) await promises.rm(endpoint, { force: true }).catch(() => void 0);
+    }
+  };
+}
+async function reclaimExistsAndIsActive(reclaimPath) {
+  let stat;
+  try {
+    stat = await promises.lstat(reclaimPath);
+  } catch (err) {
+    if (err.code === "ENOENT") return false;
+    throw err;
+  }
+  if (!stat.isFile()) throw new Error("store mutation reclaim marker is not a regular file");
+  const owner = await readOwner(reclaimPath);
+  if (owner) return processOwnsRecord(owner);
+  return Date.now() - stat.mtimeMs <= RECLAIM_MALFORMED_GRACE_MS;
+}
+async function createOwner(filePath, record) {
+  const tempPath = `${filePath}.${record.pid}.${record.nonce}.tmp`;
+  let handle;
+  try {
+    handle = await promises.open(tempPath, "wx", 384);
+    await handle.writeFile(`${JSON.stringify(record)}
+`, "utf8");
+    await handle.chmod(384);
+    await handle.sync();
+    await handle.close();
+    try {
+      await promises.link(tempPath, filePath);
+      return true;
+    } catch (err) {
+      if (err.code === "EEXIST") return false;
+      throw err;
+    }
+  } finally {
+    await handle?.close().catch(() => void 0);
+    await promises.rm(tempPath, { force: true }).catch(() => void 0);
+  }
+}
+async function acquireDaemonOwner(storeDir, role, clock = () => /* @__PURE__ */ new Date()) {
+  let pathGate;
+  try {
+    pathGate = await acquirePathMutationGate({ scope: "store", targetPath: storeDir }, { waitMs: 1e3 });
+  } catch (error) {
+    if (error instanceof PathMutationGateBusyError) throw new DaemonOwnerActiveError("unknown");
+    throw error;
+  }
+  let mutex;
+  let liveness;
+  try {
+    await ensureSecureDir(storeDir);
+    const canonicalStoreDir = await promises.realpath(storeDir);
+    mutex = await acquireStoreMutex(canonicalStoreDir);
+    liveness = await createLivenessListener();
+    const ownerPath = path3__default.join(canonicalStoreDir, DAEMON_OWNER_FILENAME);
+    const reclaimPath = path3__default.join(canonicalStoreDir, RECLAIM_FILENAME);
+    const record = {
+      version: 2,
+      pid: process.pid,
+      nonce: randomUUID(),
+      role,
+      acquiredAt: clock().toISOString(),
+      processStartedAt: SELF_PROCESS_STARTED_AT,
+      livenessPort: liveness.port
+    };
+    for (; ; ) {
+      if (await reclaimExistsAndIsActive(reclaimPath)) {
+        throw new Error("store mutation lease is being reclaimed; retry after the current operation finishes");
+      }
+      await promises.rm(reclaimPath, { force: true });
+      if (await createOwner(ownerPath, record)) {
+        try {
+          await pathGate.release();
+          pathGate = void 0;
+        } catch (error) {
+          await promises.rm(ownerPath, { force: true }).catch(() => void 0);
+          throw error;
+        }
+        const ownedLiveness = liveness;
+        const ownedMutex = mutex;
+        let released = false;
+        return {
+          release: async () => {
+            if (released) return;
+            const releaseGate = await acquirePathMutationGate({
+              scope: "store",
+              targetPath: canonicalStoreDir
+            }, { waitMs: 2e3 });
+            try {
+              const current = await readOwner(ownerPath);
+              if (current?.nonce !== record.nonce) {
+                throw new Error("store mutation lease identity changed before release");
+              }
+              await ownedLiveness.close();
+              await ownedMutex.close();
+              await promises.rm(ownerPath);
+              released = true;
+            } finally {
+              await releaseGate.release();
+            }
+          }
+        };
+      }
+      const existing = await readOwner(ownerPath);
+      if (existing && await processOwnsRecord(existing)) throw new DaemonOwnerActiveError(existing.role);
+      if (!await createOwner(reclaimPath, record)) {
+        throw new Error("store mutation lease is being reclaimed; retry after the current operation finishes");
+      }
+      try {
+        const rechecked = await readOwner(ownerPath);
+        if (rechecked && await processOwnsRecord(rechecked)) throw new DaemonOwnerActiveError(rechecked.role);
+        if (rechecked || await promises.stat(ownerPath).then(() => true, (err) => {
+          if (err.code === "ENOENT") return false;
+          throw err;
+        })) {
+          await promises.rm(ownerPath);
+        }
+      } finally {
+        const currentReclaim = await readOwner(reclaimPath);
+        if (currentReclaim?.nonce === record.nonce) await promises.rm(reclaimPath, { force: true });
+      }
+    }
+  } catch (err) {
+    await liveness?.close().catch(() => void 0);
+    await mutex?.close().catch(() => void 0);
+    await pathGate?.release().catch(() => void 0);
+    throw err;
+  }
+}
+
+// src/types.ts
+function frozenStrings(values) {
+  return values === void 0 ? void 0 : Object.freeze([...values]);
+}
+function frozenPolicy(policy) {
+  const allowTools = policy.allowTools === void 0 ? void 0 : Object.freeze([...policy.allowTools]);
+  const denyTools = policy.denyTools === void 0 ? void 0 : Object.freeze([...policy.denyTools]);
+  return Object.freeze({
+    mode: policy.mode,
+    ...allowTools === void 0 ? {} : { allowTools },
+    ...denyTools === void 0 ? {} : { denyTools },
+    ...policy.workspaceRoot === void 0 ? {} : { workspaceRoot: policy.workspaceRoot },
+    ...policy.network === void 0 ? {} : { network: policy.network }
+  });
+}
+function freezeRuntimeAdapterDescriptor(descriptor) {
+  const baseNames = frozenStrings(descriptor.environmentRequirements.baseNames);
+  const credentialNames = frozenStrings(descriptor.environmentRequirements.credentialNames);
+  return Object.freeze({
+    id: descriptor.id,
+    supportsDispatchSelection: descriptor.supportsDispatchSelection === true,
+    capabilities: Object.freeze({
+      steer: descriptor.capabilities.steer === true,
+      resume: descriptor.capabilities.resume === true,
+      approvalInteractive: descriptor.capabilities.approvalInteractive === true,
+      ...descriptor.capabilities.mcpToolsets === void 0 ? {} : { mcpToolsets: descriptor.capabilities.mcpToolsets === true },
+      permissionModes: Object.freeze([...descriptor.capabilities.permissionModes])
+    }),
+    environmentRequirements: Object.freeze({
+      ...baseNames === void 0 ? {} : { baseNames },
+      ...credentialNames === void 0 ? {} : { credentialNames }
+    })
+  });
+}
+function sealRuntimeOperationManifest(manifest) {
+  return Object.freeze({
+    taskId: manifest.taskId,
+    runtimeId: manifest.runtimeId,
+    descriptor: freezeRuntimeAdapterDescriptor(manifest.descriptor),
+    policy: frozenPolicy(manifest.policy),
+    requiredToolsetIds: Object.freeze([...manifest.requiredToolsetIds]),
+    ...manifest.dispatchSelection === void 0 ? {} : { dispatchSelection: Object.freeze({ ...manifest.dispatchSelection }) },
+    ...manifest.sessionRef === void 0 ? {} : { sessionRef: manifest.sessionRef },
+    ...manifest.agentRef === void 0 ? {} : { agentRef: Object.freeze({ agentId: manifest.agentRef.agentId, profileRevision: manifest.agentRef.profileRevision }) },
+    cwd: manifest.cwd ?? manifest.workspace.workspaceDir,
+    ...manifest.lease === void 0 ? {} : { lease: Object.freeze({ leaseId: manifest.lease.leaseId, canonicalHome: manifest.lease.canonicalHome }) },
+    workspace: Object.freeze({ ...manifest.workspace }),
+    forwardedEnvironmentNames: Object.freeze([...manifest.forwardedEnvironmentNames])
+  });
+}
+var PolicyUnsupportedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PolicyUnsupportedError";
+  }
+};
+var SteerUnsupportedError = class extends Error {
+  /** The `RuntimeAdapter.descriptor.id` that cannot steer (e.g. `claude`, `codex`). */
+  runtimeId;
+  constructor(runtimeId, message) {
+    super(message);
+    this.name = "SteerUnsupportedError";
+    this.runtimeId = runtimeId;
+  }
+};
+
+// src/release-identity.ts
+var LOCAL_AGENT_RELEASE_VERSION_MAX_LENGTH = 128;
+var LOCAL_AGENT_RELEASE_BUILD_ID_MAX_LENGTH = 128;
+var STRICT_SEMVER_PATTERN = new RegExp(
+  "^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$"
+);
+var BUILD_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;
+function resolveLocalAgentReleaseIdentity(input) {
+  if (input === void 0 || typeof input.version !== "string" || input.version.length > LOCAL_AGENT_RELEASE_VERSION_MAX_LENGTH || !STRICT_SEMVER_PATTERN.test(input.version)) {
+    throw new Error("DaemonConfig.localAgentRelease.version must be canonical strict SemVer");
+  }
+  if (input.buildId !== void 0 && (typeof input.buildId !== "string" || input.buildId.length > LOCAL_AGENT_RELEASE_BUILD_ID_MAX_LENGTH || !BUILD_ID_PATTERN.test(input.buildId))) {
+    throw new Error(
+      `DaemonConfig.localAgentRelease.buildId must be 1-${LOCAL_AGENT_RELEASE_BUILD_ID_MAX_LENGTH} safe opaque characters`
+    );
+  }
+  return Object.freeze({
+    version: input.version,
+    ...input.buildId === void 0 ? {} : { buildId: input.buildId }
+  });
+}
+
+// src/runtime-failure.ts
+var RUNTIME_EXECUTION_FAILURE_BRAND = /* @__PURE__ */ Symbol.for("@byok-sdk/client/RuntimeExecutionFailure/v1");
+var RUNTIME_DISPOSAL_FAILURE_BRAND = /* @__PURE__ */ Symbol.for("@byok-sdk/client/RuntimeDisposalFailure/v1");
+var RuntimeDisposalFailure = class extends Error {
+  stage;
+  constructor(input, options) {
+    if (!isRuntimeDisposalStage(input.stage) || typeof input.reason !== "string" || input.reason.length === 0) {
+      throw new TypeError("invalid RuntimeDisposalFailure input");
+    }
+    super(input.reason, options);
+    this.name = "RuntimeDisposalFailure";
+    this.stage = input.stage;
+    Object.defineProperty(this, RUNTIME_DISPOSAL_FAILURE_BRAND, { value: true });
+    Object.freeze(this);
+  }
+};
+function isRuntimeDisposalStage(value) {
+  return value === "signal" || value === "quiescence" || value === "cleanup";
+}
+function isRuntimeDisposalFailure(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const candidate = value;
+  return candidate[RUNTIME_DISPOSAL_FAILURE_BRAND] === true && isRuntimeDisposalStage(candidate.stage) && typeof candidate.message === "string" && candidate.message.length > 0;
+}
+var RuntimeExecutionFailure = class extends Error {
+  phase;
+  category;
+  retry;
+  constructor(input, options) {
+    if (!isRuntimeFailurePhase(input.phase) || !isRuntimeFailureCategory(input.category) || !isRuntimeRetryDisposition(input.retry) || typeof input.reason !== "string" || input.reason.length === 0) {
+      throw new TypeError("invalid RuntimeExecutionFailure input");
+    }
+    super(input.reason, options);
+    this.name = "RuntimeExecutionFailure";
+    this.phase = input.phase;
+    this.category = input.category;
+    this.retry = input.retry;
+    Object.defineProperty(this, RUNTIME_EXECUTION_FAILURE_BRAND, { value: true });
+    Object.freeze(this);
+  }
+};
+function isRuntimeFailurePhase(value) {
+  return value === "start" || value === "run";
+}
+function isRuntimeFailureCategory(value) {
+  return value === "semantic" || value === "infrastructure" || value === "authority";
+}
+function isRuntimeRetryDisposition(value) {
+  return value === "retryable" || value === "non-retryable";
+}
+function isRuntimeExecutionFailure(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const candidate = value;
+  return candidate[RUNTIME_EXECUTION_FAILURE_BRAND] === true && isRuntimeFailurePhase(candidate.phase) && isRuntimeFailureCategory(candidate.category) && isRuntimeRetryDisposition(candidate.retry) && typeof candidate.message === "string" && candidate.message.length > 0;
+}
+function retryableFromDisposition(disposition) {
+  switch (disposition) {
+    case "retryable":
+      return true;
+    case "non-retryable":
+      return false;
+  }
+}
+function projectRuntimeExecutionFailure(failure) {
+  return {
+    reason: failure.message,
+    retryable: retryableFromDisposition(failure.retry)
+  };
+}
+var RUNTIME_ADAPTER_CONTRACT_VIOLATION_REASON = Object.freeze({
+  start: "runtime adapter contract violation during start",
+  run: "runtime adapter contract violation during run"
+});
+function projectRuntimeBoundaryFailure(value, expectedPhase) {
+  if (isRuntimeExecutionFailure(value) && value.phase === expectedPhase) {
+    return { ...projectRuntimeExecutionFailure(value), contractViolation: false };
+  }
+  return {
+    reason: RUNTIME_ADAPTER_CONTRACT_VIOLATION_REASON[expectedPhase],
+    retryable: false,
+    contractViolation: true
+  };
+}
+var GIT_ERROR_CATEGORIES = [
+  "git-unavailable",
+  "git-timeout",
+  "git-output-limit",
+  "git-command-failed",
   "workspace-root-invalid",
   "workspace-root-conflict",
   "workspace-not-owned",
@@ -1011,7 +1883,7 @@ function gitEnvironment(readOnly) {
   return env;
 }
 function stableGitWorkspaceOwnerId(storeDir, productId) {
-  const identity = `${path.resolve(storeDir)}\\0${productId}`;
+  const identity = `${path3__default.resolve(storeDir)}\\0${productId}`;
   return `store-product:${createHash("sha256").update(identity).digest("hex")}`;
 }
 var GUIDANCE = [
@@ -1023,11 +1895,11 @@ var GUIDANCE = [
   "Leave incomplete work visible for recovery."
 ].join("\n");
 function canonical(value) {
-  return path.resolve(value);
+  return path3__default.resolve(value);
 }
 function isContained(root, candidate) {
-  const relative = path.relative(root, candidate);
-  return relative === "" || !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+  const relative = path3__default.relative(root, candidate);
+  return relative === "" || !relative.startsWith(`..${path3__default.sep}`) && !path3__default.isAbsolute(relative);
 }
 function bounded(value, max) {
   return Buffer.byteLength(value, "utf8") <= max ? value : value.slice(0, max);
@@ -1132,7 +2004,7 @@ var GitWorkspaceManager = class {
     await this.ensureOwnerMarker();
   }
   async ensureOwnerMarker() {
-    const markerPath = path.join(this.workspaceRoot, OWNER_MARKER);
+    const markerPath = path3__default.join(this.workspaceRoot, OWNER_MARKER);
     let existing;
     try {
       existing = JSON.parse(await promises.readFile(markerPath, "utf8"));
@@ -1226,270 +2098,96 @@ var GitWorkspaceManager = class {
       }
     };
     workspaceLeases.set(root, lease);
-    if (sessionRef) sessionLeases.set(sessionRef, lease);
-    return lease;
-  }
-  static guidance() {
-    return GUIDANCE;
-  }
-  static prependGuidance(instruction) {
-    return `${GUIDANCE}
-
-${instruction}`;
-  }
-  commandOptions(cwd, readOnly = false) {
-    return {
-      cwd,
-      timeout: this.timeoutMs,
-      maxBuffer: this.maxOutputBytes,
-      env: gitEnvironment(readOnly)
-    };
-  }
-  async read(args, cwd) {
-    try {
-      return await this.run(args, this.commandOptions(cwd, true));
-    } catch (error) {
-      throw asGitError(error, "git-command-failed", "Git observation failed");
-    }
-  }
-  async readTopLevel(root) {
-    const result = await this.read(["rev-parse", "--show-toplevel"], root);
-    if (result.code !== 0) throw new GitWorkspaceError("repository-invalid", "workspace is not a Git repository");
-    return canonical(result.stdout.trim());
-  }
-  async assertTaskRoot(workspaceDir) {
-    const candidate = canonical(workspaceDir);
-    const realWorkspaceRoot = await promises.realpath(this.workspaceRoot).catch(() => {
-      throw new GitWorkspaceError("workspace-root-invalid", "workspace root is unavailable");
-    });
-    if (!isContained(this.workspaceRoot, candidate) && !isContained(realWorkspaceRoot, candidate)) {
-      throw new GitWorkspaceError("workspace-root-invalid", "workspace directory is invalid");
-    }
-    await this.assertExistingAncestry(candidate, realWorkspaceRoot);
-    await promises.mkdir(candidate, { recursive: true, mode: 448 }).catch(() => {
-      throw new GitWorkspaceError("workspace-root-invalid", "workspace directory is unavailable");
-    });
-    const realCandidate = await promises.realpath(candidate).catch(() => {
-      throw new GitWorkspaceError("workspace-root-invalid", "workspace directory is unavailable");
-    });
-    if (!isContained(realWorkspaceRoot, realCandidate)) {
-      throw new GitWorkspaceError("workspace-root-invalid", "workspace directory is invalid");
-    }
-    return realCandidate;
-  }
-  async assertExistingAncestry(candidate, realWorkspaceRoot) {
-    let current = candidate;
-    while (true) {
-      try {
-        const realCurrent = await promises.realpath(current);
-        if (!isContained(realWorkspaceRoot, realCurrent)) {
-          throw new GitWorkspaceError("workspace-root-invalid", "workspace directory is invalid");
-        }
-        return;
-      } catch (error) {
-        const code = error.code;
-        if (error instanceof GitWorkspaceError || code !== "ENOENT" && code !== "ENOTDIR") {
-          throw new GitWorkspaceError("workspace-root-invalid", "workspace directory is invalid");
-        }
-        const parent = path.dirname(current);
-        if (parent === current) {
-          throw new GitWorkspaceError("workspace-root-invalid", "workspace directory is invalid");
-        }
-        current = parent;
-      }
-    }
-  }
-  async assertExistingTaskRoot(workspaceDir) {
-    const candidate = canonical(workspaceDir);
-    const realWorkspaceRoot = await promises.realpath(this.workspaceRoot).catch(() => {
-      throw new GitWorkspaceError("workspace-root-invalid", "workspace root is unavailable");
-    });
-    const realCandidate = await promises.realpath(candidate).catch(() => {
-      throw new GitWorkspaceError("repository-invalid", "workspace directory is unavailable");
-    });
-    if (!isContained(realWorkspaceRoot, realCandidate)) {
-      throw new GitWorkspaceError("workspace-root-invalid", "workspace directory is invalid");
-    }
-    return realCandidate;
-  }
-};
-function prependGitWorkspaceGuidance(instruction) {
-  return GitWorkspaceManager.prependGuidance(instruction);
-}
-var tmpSeq = 0;
-async function atomicWriteFile(filePath, data, options = {}) {
-  const tmpPath = `${filePath}.${process.pid}-${tmpSeq++}.tmp`;
-  try {
-    const handle = await promises.open(tmpPath, "w", options.mode);
-    try {
-      await handle.writeFile(data);
-      if (options.mode !== void 0) {
-        await handle.chmod(options.mode);
-      }
-      if (options.fsync) {
-        await handle.sync();
-      }
-    } finally {
-      await handle.close();
-    }
-  } catch (err) {
-    await promises.rm(tmpPath, { force: true }).catch(() => {
-    });
-    throw err;
-  }
-  await renameOnto(tmpPath, filePath);
-  if (options.mode !== void 0) {
-    await promises.chmod(filePath, options.mode);
-  }
-  if (options.fsync) {
-    const target = await promises.open(filePath, process.platform === "win32" ? "r+" : "r");
-    try {
-      await target.sync();
-    } finally {
-      await target.close();
-    }
-    if (process.platform !== "win32") {
-      const directory = await promises.open(path.dirname(filePath), "r");
-      try {
-        await directory.sync();
-      } finally {
-        await directory.close();
-      }
-    }
-  }
-}
-var RENAME_RETRY_ATTEMPTS = 5;
-var RENAME_RETRY_DELAY_MS = 20;
-function delay(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-async function renameOnto(tmpPath, targetPath) {
-  for (let attempt = 1; attempt <= RENAME_RETRY_ATTEMPTS; attempt++) {
-    try {
-      await promises.rename(tmpPath, targetPath);
-      return;
-    } catch (err) {
-      const code = err.code;
-      if (code !== "EPERM" && code !== "EEXIST") {
-        await promises.rm(tmpPath, { force: true }).catch(() => {
-        });
-        throw err;
-      }
-      if (attempt === RENAME_RETRY_ATTEMPTS) {
-        await promises.rm(tmpPath, { force: true }).catch(() => {
-        });
-        throw err;
-      }
-      await delay(RENAME_RETRY_DELAY_MS * attempt);
-    }
-  }
-}
-var defaultRunner = (command, args) => new Promise((resolve, reject) => {
-  execFile(command, args, (error, stdout, stderr) => {
-    if (error && typeof error.code !== "number") {
-      reject(error);
-      return;
-    }
-    resolve({ code: error ? error.code : 0, stdout, stderr });
-  });
-});
-async function runOrThrow(run, command, args, label) {
-  const result = await run(command, args);
-  if (result.code !== 0) {
-    const detail = (result.stderr || result.stdout).trim();
-    throw new Error(`${label} failed (exit ${result.code})${detail ? `: ${detail}` : ""}`);
-  }
-  return result;
-}
-function isIdempotentAbsence(result, absence) {
-  if (result.code === 0) return true;
-  const detail = `${result.stdout}
-${result.stderr}`;
-  if (absence.neverAbsence?.some((pattern) => pattern.test(detail))) return false;
-  if (absence.codes?.includes(result.code)) return true;
-  return absence.patterns.some((pattern) => pattern.test(detail));
-}
-async function runIdempotent(run, command, args, label, absence) {
-  const result = await run(command, args);
-  if (!isIdempotentAbsence(result, absence)) {
-    const detail = (result.stderr || result.stdout).trim();
-    throw new Error(`${label} failed (exit ${result.code})${detail ? `: ${detail}` : ""}`);
+    if (sessionRef) sessionLeases.set(sessionRef, lease);
+    return lease;
   }
-  return result;
-}
+  static guidance() {
+    return GUIDANCE;
+  }
+  static prependGuidance(instruction) {
+    return `${GUIDANCE}
 
-// src/util/secure-dir.ts
-var SYSTEM_SID = "*S-1-5-18";
-var ADMINISTRATORS_SID = "*S-1-5-32-544";
-function buildIcaclsArgs(dir, username) {
-  return [dir, "/inheritance:r", "/grant:r", `${username}:(OI)(CI)F`, "/grant", `${SYSTEM_SID}:(OI)(CI)F`, "/grant", `${ADMINISTRATORS_SID}:(OI)(CI)F`];
-}
-function buildIcaclsFileArgs(filePath, username) {
-  return [
-    filePath,
-    "/inheritance:r",
-    "/grant:r",
-    `${username}:F`,
-    "/grant",
-    `${SYSTEM_SID}:F`,
-    "/grant",
-    `${ADMINISTRATORS_SID}:F`
-  ];
-}
-var SecureDirHardeningError = class extends Error {
-  constructor(dir, reason) {
-    super(
-      `failed to apply a restrictive Windows ACL to "${dir}": ${reason} \u2014 refusing to leave this directory unprotected (it holds device credentials and/or the control-socket token, otherwise readable by any other local user); see docs/security.md`
-    );
-    this.dir = dir;
-    this.name = "SecureDirHardeningError";
+${instruction}`;
   }
-  dir;
-};
-var SecureFileHardeningError = class extends Error {
-  constructor(filePath, reason) {
-    super(`failed to apply a restrictive Windows ACL to "${filePath}": ${reason}`);
-    this.filePath = filePath;
-    this.name = "SecureFileHardeningError";
+  commandOptions(cwd, readOnly = false) {
+    return {
+      cwd,
+      timeout: this.timeoutMs,
+      maxBuffer: this.maxOutputBytes,
+      env: gitEnvironment(readOnly)
+    };
   }
-  filePath;
-};
-async function ensureSecureDir(dir, opts = {}) {
-  const platform = opts.platform ?? process.platform;
-  const run = opts.run ?? defaultRunner;
-  await promises.mkdir(dir, { recursive: true, mode: 448 });
-  await promises.chmod(dir, 448).catch(() => {
-  });
-  if (platform !== "win32") return;
-  const { username } = os.userInfo();
-  let result;
-  try {
-    result = await run("icacls", buildIcaclsArgs(dir, username));
-  } catch (err) {
-    throw new SecureDirHardeningError(dir, `could not run icacls: ${err instanceof Error ? err.message : String(err)}`);
+  async read(args, cwd) {
+    try {
+      return await this.run(args, this.commandOptions(cwd, true));
+    } catch (error) {
+      throw asGitError(error, "git-command-failed", "Git observation failed");
+    }
   }
-  if (result.code !== 0) {
-    throw new SecureDirHardeningError(dir, `icacls exited ${result.code}: ${(result.stderr || result.stdout).trim()}`);
+  async readTopLevel(root) {
+    const result = await this.read(["rev-parse", "--show-toplevel"], root);
+    if (result.code !== 0) throw new GitWorkspaceError("repository-invalid", "workspace is not a Git repository");
+    return canonical(result.stdout.trim());
   }
-}
-async function ensureSecureFile(filePath, opts = {}) {
-  const platform = opts.platform ?? process.platform;
-  const run = opts.run ?? defaultRunner;
-  await promises.chmod(filePath, 384);
-  if (platform !== "win32") return;
-  const { username } = os.userInfo();
-  let result;
-  try {
-    result = await run("icacls", buildIcaclsFileArgs(filePath, username));
-  } catch (err) {
-    throw new SecureFileHardeningError(filePath, `could not run icacls: ${err instanceof Error ? err.message : String(err)}`);
+  async assertTaskRoot(workspaceDir) {
+    const candidate = canonical(workspaceDir);
+    const realWorkspaceRoot = await promises.realpath(this.workspaceRoot).catch(() => {
+      throw new GitWorkspaceError("workspace-root-invalid", "workspace root is unavailable");
+    });
+    if (!isContained(this.workspaceRoot, candidate) && !isContained(realWorkspaceRoot, candidate)) {
+      throw new GitWorkspaceError("workspace-root-invalid", "workspace directory is invalid");
+    }
+    await this.assertExistingAncestry(candidate, realWorkspaceRoot);
+    await promises.mkdir(candidate, { recursive: true, mode: 448 }).catch(() => {
+      throw new GitWorkspaceError("workspace-root-invalid", "workspace directory is unavailable");
+    });
+    const realCandidate = await promises.realpath(candidate).catch(() => {
+      throw new GitWorkspaceError("workspace-root-invalid", "workspace directory is unavailable");
+    });
+    if (!isContained(realWorkspaceRoot, realCandidate)) {
+      throw new GitWorkspaceError("workspace-root-invalid", "workspace directory is invalid");
+    }
+    return realCandidate;
   }
-  if (result.code !== 0) {
-    throw new SecureFileHardeningError(filePath, `icacls exited ${result.code}: ${(result.stderr || result.stdout).trim()}`);
+  async assertExistingAncestry(candidate, realWorkspaceRoot) {
+    let current = candidate;
+    while (true) {
+      try {
+        const realCurrent = await promises.realpath(current);
+        if (!isContained(realWorkspaceRoot, realCurrent)) {
+          throw new GitWorkspaceError("workspace-root-invalid", "workspace directory is invalid");
+        }
+        return;
+      } catch (error) {
+        const code = error.code;
+        if (error instanceof GitWorkspaceError || code !== "ENOENT" && code !== "ENOTDIR") {
+          throw new GitWorkspaceError("workspace-root-invalid", "workspace directory is invalid");
+        }
+        const parent = path3__default.dirname(current);
+        if (parent === current) {
+          throw new GitWorkspaceError("workspace-root-invalid", "workspace directory is invalid");
+        }
+        current = parent;
+      }
+    }
+  }
+  async assertExistingTaskRoot(workspaceDir) {
+    const candidate = canonical(workspaceDir);
+    const realWorkspaceRoot = await promises.realpath(this.workspaceRoot).catch(() => {
+      throw new GitWorkspaceError("workspace-root-invalid", "workspace root is unavailable");
+    });
+    const realCandidate = await promises.realpath(candidate).catch(() => {
+      throw new GitWorkspaceError("repository-invalid", "workspace directory is unavailable");
+    });
+    if (!isContained(realWorkspaceRoot, realCandidate)) {
+      throw new GitWorkspaceError("workspace-root-invalid", "workspace directory is invalid");
+    }
+    return realCandidate;
   }
+};
+function prependGitWorkspaceGuidance(instruction) {
+  return GitWorkspaceManager.prependGuidance(instruction);
 }
-
-// src/daemon/git-workspace-store.ts
 var FILE_NAME = "git-workspaces.json";
 var MAX_RECORDS = 500;
 var PHASES = /* @__PURE__ */ new Set(["preparing", "active", "completed", "failed", "cancelled", "interrupted", "salvage"]);
@@ -1510,7 +2208,7 @@ function isProtected(record) {
 var GitWorkspaceStore = class {
   constructor(storeDir, options = {}) {
     this.storeDir = storeDir;
-    this.filePath = path.join(storeDir, FILE_NAME);
+    this.filePath = path3__default.join(storeDir, FILE_NAME);
     this.maxRecords = Math.max(1, Math.floor(options.maxRecords ?? MAX_RECORDS));
   }
   storeDir;
@@ -1645,7 +2343,7 @@ var GitWorkspaceStore = class {
 var BYOK_PI_MCP_CONFIG_PATH = "BYOK_PI_MCP_CONFIG_PATH";
 var PI_PACKAGE_NAME = "@earendil-works/pi-coding-agent";
 function readPackageJson(dir) {
-  const candidate = path.join(dir, "package.json");
+  const candidate = path3__default.join(dir, "package.json");
   if (!existsSync(candidate)) return void 0;
   try {
     return JSON.parse(readFileSync(candidate, "utf8"));
@@ -1660,17 +2358,17 @@ function resolvePiBin() {
   }
   try {
     const mainEntryUrl = import.meta.resolve(PI_PACKAGE_NAME);
-    let dir = path.dirname(fileURLToPath(mainEntryUrl));
+    let dir = path3__default.dirname(fileURLToPath(mainEntryUrl));
     for (let depth = 0; depth < 6; depth++) {
       const pkg = readPackageJson(dir);
       if (pkg?.name === PI_PACKAGE_NAME) {
         const binRel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.pi;
         if (binRel) {
-          return { command: path.join(dir, binRel), source: "package" };
+          return { command: path3__default.join(dir, binRel), source: "package" };
         }
         break;
       }
-      const parent = path.dirname(dir);
+      const parent = path3__default.dirname(dir);
       if (parent === dir) break;
       dir = parent;
     }
@@ -1688,7 +2386,7 @@ function resolvePiExtensions() {
   const clientManifest = fileURLToPath(import.meta.resolve("@byok-sdk/client/package.json"));
   return {
     webAccess: fileURLToPath(import.meta.resolve("pi-web-access/index.ts")),
-    mcpAdapter: path.join(path.dirname(clientManifest), "dist", "adapters", "pi", "mcp-extension.js")
+    mcpAdapter: path3__default.join(path3__default.dirname(clientManifest), "dist", "adapters", "pi", "mcp-extension.js")
   };
 }
 
@@ -2614,10 +3312,10 @@ var PiAdapter = class {
           const taskMcpServers = startInput.mcpServers ?? {};
           const hasMcpServers = Object.keys(taskMcpServers).length > 0;
           if (hasMcpServers) {
-            mcpConfigDir = await promises.mkdtemp(path.join(os.tmpdir(), "byok-pi-mcp-"));
+            mcpConfigDir = await promises.mkdtemp(path3__default.join(os__default.tmpdir(), "byok-pi-mcp-"));
             await promises.chmod(mcpConfigDir, 448).catch(() => {
             });
-            const mcpConfigPath = path.join(mcpConfigDir, "mcp-config.json");
+            const mcpConfigPath = path3__default.join(mcpConfigDir, "mcp-config.json");
             await promises.writeFile(mcpConfigPath, JSON.stringify({ mcpServers: taskMcpServers }), { mode: 384 });
             runtimeEnv = { ...runtimeEnv, [BYOK_PI_MCP_CONFIG_PATH]: mcpConfigPath };
           }
@@ -2848,7 +3546,7 @@ function resolveApprovalMcpBin() {
   if (override) {
     return { command: override, args: [], source: "env" };
   }
-  const distBin = path.join(path.dirname(fileURLToPath(import.meta.url)), "bin", "byok-approval-mcp.js");
+  const distBin = path3__default.join(path3__default.dirname(fileURLToPath(import.meta.url)), "bin", "byok-approval-mcp.js");
   return { command: process.execPath, args: [distBin], source: "dist" };
 }
 
@@ -2939,7 +3637,7 @@ var EXTENSION_CONTENT_TYPES = {
   ".yml": "application/yaml"
 };
 function guessContentType(filePath) {
-  const ext = path.extname(filePath).toLowerCase();
+  const ext = path3__default.extname(filePath).toLowerCase();
   return EXTENSION_CONTENT_TYPES[ext] ?? "application/octet-stream";
 }
 function mapAssistant(msg, correlation) {
@@ -3023,11 +3721,11 @@ function tryBuildArtifactEvent(msg, workspaceDir) {
   const filePath = toolUseResult && typeof toolUseResult.filePath === "string" ? toolUseResult.filePath : void 0;
   if (!filePath) return void 0;
   const realWorkspaceDir = tryRealpath(workspaceDir) ?? workspaceDir;
-  const fileDir = path.dirname(filePath);
+  const fileDir = path3__default.dirname(filePath);
   const realFileDir = tryRealpath(fileDir) ?? fileDir;
-  const realFilePath = path.join(realFileDir, path.basename(filePath));
-  const relative = path.relative(realWorkspaceDir, realFilePath);
-  if (relative === "" || relative.startsWith("..") || path.isAbsolute(relative)) {
+  const realFilePath = path3__default.join(realFileDir, path3__default.basename(filePath));
+  const relative = path3__default.relative(realWorkspaceDir, realFilePath);
+  if (relative === "" || relative.startsWith("..") || path3__default.isAbsolute(relative)) {
     return void 0;
   }
   return { type: "artifact", name: relative, contentType: guessContentType(filePath) };
@@ -3421,10 +4119,10 @@ var ClaudeAdapter = class {
       });
     }
     if (needsMcpConfig) {
-      mcpConfigDir = await promises.mkdtemp(path.join(os.tmpdir(), "byok-mcp-"));
+      mcpConfigDir = await promises.mkdtemp(path3__default.join(os__default.tmpdir(), "byok-mcp-"));
       await promises.chmod(mcpConfigDir, 448).catch(() => {
       });
-      const mcpConfigPath = path.join(mcpConfigDir, "mcp-config.json");
+      const mcpConfigPath = path3__default.join(mcpConfigDir, "mcp-config.json");
       const mcpServers = { ...taskMcpServers };
       if (mapping.needsApprovalMcp) {
         const approvalChannel = startInput.approvalChannel;
@@ -3910,8 +4608,8 @@ function extractArtifactEvents(changes, workspaceDir) {
     const absolutePath = typeof change.path === "string" ? change.path : void 0;
     const kind = typeof change.kind === "string" ? change.kind : void 0;
     if (!absolutePath || kind === "delete") continue;
-    const relative = path.relative(workspaceDir, absolutePath);
-    if (relative.length === 0 || relative.startsWith("..") || path.isAbsolute(relative)) continue;
+    const relative = path3__default.relative(workspaceDir, absolutePath);
+    if (relative.length === 0 || relative.startsWith("..") || path3__default.isAbsolute(relative)) continue;
     events.push({ type: "artifact", name: relative, contentType: guessContentType2(relative) });
   }
   return events;
@@ -3932,7 +4630,7 @@ var CONTENT_TYPE_BY_EXTENSION = {
   ".csv": "text/csv"
 };
 function guessContentType2(relativePath) {
-  return CONTENT_TYPE_BY_EXTENSION[path.extname(relativePath).toLowerCase()] ?? "application/octet-stream";
+  return CONTENT_TYPE_BY_EXTENSION[path3__default.extname(relativePath).toLowerCase()] ?? "application/octet-stream";
 }
 function extractErrorMessage(rawError) {
   if (typeof rawError === "string") return rawError;
@@ -4731,6 +5429,301 @@ var ApprovalRegistry = class {
     entry.onResolve(decision, reason, origin);
   }
 };
+var ENTRY_ACCOUNT = "device-enrollment";
+var ENCODED_PREFIX = "byok-device-credential-v1:";
+var NOT_FOUND = 44;
+var WINDOWS_BRIDGE_DIRECTORY_PREFIX = "byok-device-credential-";
+var WINDOWS_BRIDGE_STALE_MS = 24 * 60 * 60 * 1e3;
+function providerDiagnostic(stderr) {
+  const match = /credential operation failed \((win32=\d{1,10}|hresult=-?\d{1,11}|stage=\d{1,2},kind=\d{1,2},hresult=-?\d{1,11})\)/u.exec(stderr);
+  return match === null ? "" : ` (${match[1]})`;
+}
+function isNodeError(error, code) {
+  return error instanceof Error && "code" in error && error.code === code;
+}
+async function scavengeStaleWindowsBridges() {
+  const temporaryRoot = os.tmpdir();
+  let entries;
+  try {
+    entries = await fs12.readdir(temporaryRoot, { withFileTypes: true });
+  } catch {
+    throw new DeviceCredentialStoreError("temporary Windows credential bridge root is unavailable");
+  }
+  const staleBefore = Date.now() - WINDOWS_BRIDGE_STALE_MS;
+  for (const entry of entries) {
+    if (!entry.isDirectory() || !entry.name.startsWith(WINDOWS_BRIDGE_DIRECTORY_PREFIX)) continue;
+    const candidate = path3.join(temporaryRoot, entry.name);
+    try {
+      const info = await fs12.lstat(candidate);
+      if (!info.isDirectory() || info.isSymbolicLink() || info.mtimeMs >= staleBefore) continue;
+      await fs12.rm(candidate, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 });
+    } catch (error) {
+      if (isNodeError(error, "ENOENT")) continue;
+      throw new DeviceCredentialStoreError("stale Windows credential bridge cleanup failed");
+    }
+  }
+}
+function windowsPowerShellExecutable() {
+  const systemRoot = process.env.SystemRoot;
+  if (systemRoot === void 0 || !path3.win32.isAbsolute(systemRoot)) {
+    throw new DeviceCredentialStoreError("Windows system root is unavailable");
+  }
+  return path3.win32.join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+}
+var DeviceCredentialStoreUnavailableError = class extends Error {
+  constructor(message = "no supported operating-system credential provider is available") {
+    super(message);
+    this.name = "DeviceCredentialStoreUnavailableError";
+  }
+};
+var DeviceCredentialStoreError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "DeviceCredentialStoreError";
+  }
+};
+function assertRecord(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value) || typeof value.deviceId !== "string" || !isTenantId(value.tenantId) || typeof value.devicePublicKey !== "string" || typeof value.accessToken !== "string" || typeof value.expiresAt !== "string" || typeof value.devicePrivateKeyPem !== "string") {
+    throw new DeviceCredentialStoreError("OS credential entry has an invalid device credential shape");
+  }
+  const credential = value;
+  if (credential.deviceId.length === 0 || credential.devicePublicKey.length === 0 || credential.accessToken.length === 0 || credential.expiresAt.length === 0 || credential.devicePrivateKeyPem.length === 0) {
+    throw new DeviceCredentialStoreError("OS credential entry has an incomplete device credential");
+  }
+}
+function encode(record) {
+  assertRecord(record);
+  const encoded = Buffer.from(JSON.stringify(record), "utf8").toString("base64");
+  const value = `${ENCODED_PREFIX}${encoded}`;
+  if (Buffer.byteLength(value, "utf8") > 2400) {
+    throw new DeviceCredentialStoreError("device credential exceeds the OS credential entry bound");
+  }
+  return value;
+}
+function decode(value) {
+  if (!value.startsWith(ENCODED_PREFIX)) {
+    throw new DeviceCredentialStoreError("OS credential entry is not owned by this client credential store");
+  }
+  const encoded = value.slice(ENCODED_PREFIX.length);
+  if (encoded.length === 0 || encoded.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/u.test(encoded)) {
+    throw new DeviceCredentialStoreError("OS credential entry is not strict base64");
+  }
+  const bytes = Buffer.from(encoded, "base64");
+  if (bytes.toString("base64") !== encoded) {
+    throw new DeviceCredentialStoreError("OS credential entry is not canonical base64");
+  }
+  const raw = bytes.toString("utf8");
+  if (!Buffer.from(raw, "utf8").equals(bytes)) {
+    throw new DeviceCredentialStoreError("OS credential entry is not valid UTF-8");
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new DeviceCredentialStoreError("OS credential entry is not valid JSON");
+  }
+  assertRecord(parsed);
+  return Object.freeze({
+    deviceId: parsed.deviceId,
+    tenantId: parsed.tenantId,
+    devicePublicKey: parsed.devicePublicKey,
+    accessToken: parsed.accessToken,
+    expiresAt: parsed.expiresAt,
+    devicePrivateKeyPem: parsed.devicePrivateKeyPem
+  });
+}
+function serviceFor(productId) {
+  if (typeof productId !== "string" || productId.length === 0 || /[\u0000\r\n]/u.test(productId)) {
+    throw new DeviceCredentialStoreError("productId must be a non-empty single-line string");
+  }
+  return `com.byok.client.device.${createHash("sha256").update(productId, "utf8").digest("hex")}`;
+}
+function quoteInteractive(value) {
+  if (/[\u0000\r\n]/u.test(value)) throw new DeviceCredentialStoreError("credential command argument is invalid");
+  return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+}
+var DeviceCredentialStore = class {
+  #service;
+  #platform;
+  #run;
+  constructor(options) {
+    this.#service = serviceFor(options.productId);
+    this.#platform = options.platform ?? process.platform;
+    this.#run = options.commandRunner ?? runDeviceCommand;
+  }
+  async read() {
+    const result = await this.#invoke("read");
+    if (result.exitCode === NOT_FOUND || this.#platform === "linux" && result.exitCode === 1 && result.stderr.trim().length === 0) return void 0;
+    if (result.exitCode === 127) throw new DeviceCredentialStoreUnavailableError();
+    if (result.exitCode !== 0) {
+      throw new DeviceCredentialStoreError(
+        `operating-system credential provider could not read device credentials${providerDiagnostic(result.stderr)}`
+      );
+    }
+    return decode(result.stdout.trimEnd());
+  }
+  async replace(record) {
+    const encoded = encode(record);
+    const result = await this.#invoke("replace", encoded);
+    if (result.exitCode === 127) throw new DeviceCredentialStoreUnavailableError();
+    if (result.exitCode !== 0) {
+      throw new DeviceCredentialStoreError(
+        `operating-system credential provider could not replace device credentials${providerDiagnostic(result.stderr)}`
+      );
+    }
+  }
+  /** Returns true only after the sole secret authority is confirmed absent. */
+  async clear() {
+    const before = await this.read();
+    if (before === void 0) return false;
+    const result = await this.#invoke("clear");
+    if (result.exitCode === 127) throw new DeviceCredentialStoreUnavailableError();
+    if (result.exitCode !== 0 && result.exitCode !== NOT_FOUND) {
+      throw new DeviceCredentialStoreError(
+        `operating-system credential provider could not clear device credentials${providerDiagnostic(result.stderr)}`
+      );
+    }
+    if (await this.read() !== void 0) {
+      throw new DeviceCredentialStoreError("operating-system credential provider reported deletion but device credentials remain");
+    }
+    return true;
+  }
+  async #invoke(operation, encoded) {
+    switch (this.#platform) {
+      case "darwin":
+        return this.#macos(operation, encoded);
+      case "win32":
+        return this.#windows(operation, encoded);
+      case "linux":
+        return this.#linux(operation, encoded);
+      default:
+        throw new DeviceCredentialStoreUnavailableError(`no operating-system credential provider is supported on ${this.#platform}`);
+    }
+  }
+  #macos(operation, encoded) {
+    if (operation === "read") return this.#run("/usr/bin/security", ["find-generic-password", "-a", ENTRY_ACCOUNT, "-s", this.#service, "-w"]);
+    if (operation === "clear") return this.#run("/usr/bin/security", ["delete-generic-password", "-a", ENTRY_ACCOUNT, "-s", this.#service]);
+    const command = [
+      "add-generic-password",
+      "-U",
+      "-a",
+      quoteInteractive(ENTRY_ACCOUNT),
+      "-s",
+      quoteInteractive(this.#service),
+      "-w",
+      quoteInteractive(encoded)
+    ].join(" ");
+    return this.#run("/usr/bin/security", ["-i"], `${command}
+`);
+  }
+  #linux(operation, encoded) {
+    const attrs = ["service", this.#service, "account", ENTRY_ACCOUNT];
+    if (operation === "read") return this.#run("secret-tool", ["lookup", ...attrs]);
+    if (operation === "clear") return this.#run("secret-tool", ["clear", ...attrs]);
+    return this.#run("secret-tool", ["store", "--label=BYOK device enrollment", ...attrs], encoded);
+  }
+  async #windows(operation, encoded) {
+    await scavengeStaleWindowsBridges();
+    const directory = await fs12.mkdtemp(path3.join(os.tmpdir(), WINDOWS_BRIDGE_DIRECTORY_PREFIX));
+    const executable = path3.join(directory, "credential-bridge.exe");
+    const request = [
+      operation,
+      Buffer.from(this.#service, "utf8").toString("base64"),
+      Buffer.from(ENTRY_ACCOUNT, "utf8").toString("base64"),
+      encoded === void 0 ? "" : Buffer.from(encoded, "utf8").toString("base64")
+    ].join("\n");
+    let result;
+    let cleanupFailed = false;
+    try {
+      const compiler = await this.#run(
+        windowsPowerShellExecutable(),
+        ["-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", WINDOWS_CREDENTIAL_COMPILER_SCRIPT],
+        executable
+      );
+      result = compiler.exitCode === 0 ? await this.#run(executable, [], request) : { exitCode: compiler.exitCode, stdout: "", stderr: compiler.stderr };
+    } finally {
+      try {
+        await fs12.rm(directory, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 });
+      } catch {
+        cleanupFailed = true;
+      }
+    }
+    if (cleanupFailed) {
+      throw new DeviceCredentialStoreError("temporary Windows credential bridge cleanup failed");
+    }
+    if (result === void 0) {
+      throw new DeviceCredentialStoreError("Windows credential bridge did not produce a result");
+    }
+    return result;
+  }
+};
+var InMemoryDeviceCredentialStore = class {
+  #record;
+  async read() {
+    return this.#record === void 0 ? void 0 : Object.freeze({ ...this.#record });
+  }
+  async replace(record) {
+    assertRecord(record);
+    this.#record = Object.freeze({ ...record });
+  }
+  async clear() {
+    const had = this.#record !== void 0;
+    this.#record = void 0;
+    return had;
+  }
+};
+async function runDeviceCommand(executable, args, stdin) {
+  return new Promise((resolve) => {
+    const child = spawn(executable, [...args], { env: process.env, stdio: ["pipe", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.setEncoding("utf8");
+    child.stderr.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk;
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk;
+    });
+    child.once("error", () => resolve({ exitCode: 127, stdout: "", stderr: "command unavailable" }));
+    child.once("close", (code) => resolve({ exitCode: code ?? 1, stdout, stderr }));
+    child.stdin.end(stdin);
+  });
+}
+var WINDOWS_CREDENTIAL_COMPILER_SCRIPT = Buffer.from(String.raw`
+$assembly=[Console]::In.ReadToEnd()
+try {
+Add-Type -OutputAssembly $assembly -OutputType ConsoleApplication -ErrorAction Stop -TypeDefinition @"
+using System; using System.Runtime.InteropServices; using System.Text;
+public static class ByokDeviceCredential {
+ [StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)] private struct C { public UInt32 Flags; public UInt32 Type; [MarshalAs(UnmanagedType.LPWStr)] public string TargetName; [MarshalAs(UnmanagedType.LPWStr)] public string Comment; public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten; public UInt32 CredentialBlobSize; public IntPtr CredentialBlob; public UInt32 Persist; public UInt32 AttributeCount; public IntPtr Attributes; [MarshalAs(UnmanagedType.LPWStr)] public string TargetAlias; [MarshalAs(UnmanagedType.LPWStr)] public string UserName; }
+ [DllImport("Advapi32.dll", EntryPoint="CredWriteW", CharSet=CharSet.Unicode, SetLastError=true)] private static extern bool W(ref C c, UInt32 f);
+ [DllImport("Advapi32.dll", EntryPoint="CredReadW", CharSet=CharSet.Unicode, SetLastError=true)] private static extern bool R(string t, UInt32 ty, UInt32 f, out IntPtr p);
+ [DllImport("Advapi32.dll", EntryPoint="CredDeleteW", CharSet=CharSet.Unicode, SetLastError=true)] private static extern bool D(string t, UInt32 ty, UInt32 f);
+ [DllImport("Advapi32.dll")] private static extern void CredFree(IntPtr p);
+ private static int Set(string t,string u,byte[] b) { IntPtr p=IntPtr.Zero; try { p=Marshal.AllocHGlobal(b.Length); Marshal.Copy(b,0,p,b.Length); C c=new C { Type=1,TargetName=t,CredentialBlobSize=(UInt32)b.Length,CredentialBlob=p,Persist=2,UserName=u}; if(!W(ref c,0)) return Marshal.GetLastWin32Error(); return 0; } finally { if(p!=IntPtr.Zero) { Marshal.Copy(new byte[b.Length],0,p,b.Length); Marshal.FreeHGlobal(p); } } }
+ private static int Kind(Exception e) { if(e is DllNotFoundException)return 1;if(e is EntryPointNotFoundException)return 2;if(e is BadImageFormatException)return 3;if(e is MarshalDirectiveException)return 4;if(e is SEHException)return 5;if(e is AccessViolationException)return 6;if(e is TypeInitializationException)return 7;if(e is TypeLoadException)return 8;if(e is InvalidCastException)return 9;if(e is ArgumentException)return 10;if(e is InvalidOperationException)return 11;if(e.GetType()==typeof(SystemException))return 12;if(e is SystemException)return 13;return 99; }
+ private static int Failure(int stage,Exception e) { Console.Error.Write("credential operation failed (stage="+stage+",kind="+Kind(e)+",hresult="+e.HResult+")"); return -1; }
+ private static int InputFailure(int kind) { Console.Error.Write("credential operation failed (stage=0,kind="+kind+",hresult=0)"); return 2; }
+ private static int Get(string t) { IntPtr p=IntPtr.Zero; bool found; try { found=R(t,1,0,out p); } catch(Exception e) { return Failure(1,e); } if(!found) return Marshal.GetLastWin32Error(); int code=0; try { C c=(C)Marshal.PtrToStructure(p,typeof(C)); byte[] b=new byte[c.CredentialBlobSize]; if(b.Length>0) { Marshal.Copy(c.CredentialBlob,b,0,b.Length); using(var output=Console.OpenStandardOutput()) { output.Write(b,0,b.Length); output.Flush(); } } } catch(Exception e) { code=Failure(2,e); } try { CredFree(p); } catch(Exception e) { return Failure(3,e); } return code; }
+ private static int Delete(string t) { if(D(t,1,0)) return 0; return Marshal.GetLastWin32Error(); }
+ private static int ExitFor(int code,bool missingIsAbsent) { if(code==0)return 0;if(missingIsAbsent&&code==1168)return 44;if(code<0)return 1;Console.Error.Write("credential operation failed (win32="+code+")");return 1; }
+ private static string Decode(string value) { return Encoding.UTF8.GetString(Convert.FromBase64String(value)); }
+ public static int Main() { int stage=1;byte[] secret=null;try { string[] fields=Console.In.ReadToEnd().Split(new[]{'\n'},StringSplitOptions.None);if(fields.Length!=4)return InputFailure(fields.Length<100?fields.Length:99);string operation=fields[0];string target=Decode(fields[1]);string username=Decode(fields[2]);if(target.Length==0||username.Length==0)return InputFailure(20);if(operation=="replace") { stage=2;secret=Convert.FromBase64String(fields[3]);stage=3;return ExitFor(Set(target,username,secret),false); } if(operation=="read") { stage=4;return ExitFor(Get(target),true); } if(operation=="clear") { stage=6;return ExitFor(Delete(target),true); } return InputFailure(21); } catch(Exception e) { Failure(stage,e);return 1; } finally { if(secret!=null)Array.Clear(secret,0,secret.Length); } }
+}
+"@
+if(Test-Path -LiteralPath $assembly -PathType Leaf){exit 0}
+[Console]::Error.Write("credential operation failed (stage=8,kind=2,hresult=0)")
+} catch {
+$compilerCode=99
+$errorNumber=[string]$_.TargetObject.ErrorNumber
+if($errorNumber -match '\ACS([0-9]{4})\z'){$compilerCode=[Convert]::ToInt32($Matches[1])}
+[Console]::Error.Write("credential operation failed (stage=8,kind=3,hresult="+$compilerCode+")")
+}
+exit 1
+`, "utf16le").toString("base64");
+
+// src/daemon/store.ts
 var MAX_DEVICE_RECORD_BYTES = 256 * 1024;
 var REPAIR_REQUIRED_MESSAGE = "device enrollment record is missing or has an invalid authenticated tenant binding; re-pair required";
 var DeviceRecordRePairRequiredError = class extends Error {
@@ -4748,30 +5741,31 @@ function sameFileState(left, right) {
 function sameContentState(left, right) {
   return sameInode(left, right) && left.size === right.size && left.mtimeNs === right.mtimeNs;
 }
-function assertDeviceRecord(value) {
+var LEGACY_SECRET_FIELDS = /* @__PURE__ */ new Set(["accessToken", "expiresAt", "devicePrivateKeyPem"]);
+function assertDeviceMetadata(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     throw new DeviceRecordRePairRequiredError();
   }
   const parsed = value;
-  if (typeof parsed.deviceId === "string" && isTenantId(parsed.tenantId) && typeof parsed.accessToken === "string" && typeof parsed.expiresAt === "string" && typeof parsed.devicePrivateKeyPem === "string" && typeof parsed.devicePublicKey === "string") {
+  if (Object.keys(parsed).some((key) => LEGACY_SECRET_FIELDS.has(key))) {
+    throw new DeviceRecordRePairRequiredError();
+  }
+  if (typeof parsed.deviceId === "string" && isTenantId(parsed.tenantId) && typeof parsed.devicePublicKey === "string") {
     return;
   }
   throw new DeviceRecordRePairRequiredError();
 }
-function parseDeviceRecord(raw) {
+function parseDeviceMetadata(raw) {
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch {
     throw new DeviceRecordRePairRequiredError();
   }
-  assertDeviceRecord(parsed);
+  assertDeviceMetadata(parsed);
   return {
     deviceId: parsed.deviceId,
     tenantId: parsed.tenantId,
-    accessToken: parsed.accessToken,
-    expiresAt: parsed.expiresAt,
-    devicePrivateKeyPem: parsed.devicePrivateKeyPem,
     devicePublicKey: parsed.devicePublicKey
   };
 }
@@ -4786,14 +5780,31 @@ var DeviceStore = class _DeviceStore {
    * ACL-unprotected credential") is verifiable from a real `darwin`/`linux`
    * CI/dev machine, not just asserted.
    */
-  constructor(storeDir, secureDirOptions) {
+  constructor(storeDir, secureDirOptions, productId) {
     this.secureDirOptions = secureDirOptions;
-    this.filePath = path.join(storeDir, "device.json");
+    this.filePath = path3__default.join(storeDir, "device.json");
+    if (productId === void 0) {
+      this.credentials = new InMemoryDeviceCredentialStore();
+    } else if (process.env.BYOK_TEST_DEVICE_CREDENTIAL_STORE === "1") {
+      const key = `${path3__default.resolve(storeDir)}\0${productId}`;
+      let credentials = _DeviceStore.testCredentials.get(key);
+      if (credentials === void 0) {
+        credentials = new InMemoryDeviceCredentialStore();
+        _DeviceStore.testCredentials.set(key, credentials);
+      }
+      this.credentials = credentials;
+    } else {
+      this.credentials = new DeviceCredentialStore({ productId });
+    }
   }
   secureDirOptions;
+  /** Process-local keyed doubles preserve restart semantics in isolated tests. */
+  static testCredentials = /* @__PURE__ */ new Map();
   filePath;
+  /** Internal test seam. Product construction always supplies productId and gets an OS store. */
+  credentials;
   static defaultDir(productId) {
-    return path.join(os.homedir(), ".byok", productId);
+    return path3__default.join(os__default.homedir(), ".byok", productId);
   }
   /**
    * Resolve the one store pathname every daemon/CLI component must share.
@@ -4802,13 +5813,13 @@ var DeviceStore = class _DeviceStore {
    * cwd to pin a quarantine directory inode.
    */
   static resolveDir(productId, configured) {
-    return path.resolve(configured ?? _DeviceStore.defaultDir(productId));
+    return path3__default.resolve(configured ?? _DeviceStore.defaultDir(productId));
   }
   async load() {
     const opened = await this.openBounded();
     if (!opened) return void 0;
     try {
-      return parseDeviceRecord(opened.raw);
+      return parseDeviceMetadata(opened.raw);
     } finally {
       await opened.handle.close();
     }
@@ -4823,7 +5834,7 @@ var DeviceStore = class _DeviceStore {
     if (!opened) return void 0;
     const guardPath = `${this.filePath}.${process.pid}.${randomUUID()}.remove`;
     try {
-      const record = parseDeviceRecord(opened.raw);
+      const record = parseDeviceMetadata(opened.raw);
       linkSync(this.filePath, guardPath);
       const openStat = fstatSync(opened.handle.fd, { bigint: true });
       const guarded = lstatSync(guardPath, { bigint: true });
@@ -4843,14 +5854,11 @@ var DeviceStore = class _DeviceStore {
     }
   }
   async save(record) {
-    assertDeviceRecord(record);
-    const storeDir = path.dirname(this.filePath);
+    assertDeviceMetadata(record);
+    const storeDir = path3__default.dirname(this.filePath);
     await ensureSecureDir(storeDir, this.secureDirOptions);
     await atomicWriteFile(this.filePath, JSON.stringify(record, null, 2), { mode: 384 });
   }
-  async clear() {
-    await promises.rm(this.filePath, { force: true });
-  }
   async openBounded() {
     let namedBefore;
     try {
@@ -4982,6 +5990,7 @@ var RENEW_MARGIN_MS = 60 * 1e3;
 var AuthManager = class {
   constructor(opts) {
     this.opts = opts;
+    this.credentials = opts.credentials ?? opts.store.credentials;
   }
   opts;
   record;
@@ -4991,17 +6000,22 @@ var AuthManager = class {
   stopped = false;
   pairing = false;
   credentialMutationTail = Promise.resolve();
+  credentials;
   get deviceId() {
     return this.record?.deviceId;
   }
   isRevoked() {
     return this.revoked;
   }
+  /** Internal signer read: always recompose metadata with the current OS secret authority. */
+  async readCurrent() {
+    return this.loadRecord();
+  }
   /** Load a previously-paired device record from disk, if any (idempotent — a second call is a no-op once loaded). */
   async loadExisting() {
     this.stopped = false;
     if (!this.record) {
-      this.record = await this.opts.store.load();
+      this.record = await this.loadRecord();
     }
     if (this.record) this.scheduleProactiveRenewal();
     return this.record;
@@ -5017,7 +6031,7 @@ var AuthManager = class {
         let existing = this.record;
         if (!existing) {
           try {
-            existing = await this.opts.store.load();
+            existing = await this.loadRecord();
           } catch (error) {
             if (!(error instanceof DeviceRecordRePairRequiredError)) throw error;
           }
@@ -5029,7 +6043,7 @@ var AuthManager = class {
           headers: { "content-type": "application/json" },
           body: JSON.stringify({
             pairingCode,
-            deviceName: this.opts.deviceName ?? os.hostname(),
+            deviceName: this.opts.deviceName ?? os__default.hostname(),
             devicePublicKey: keyPair.publicKeyBase64Url
           })
         });
@@ -5037,15 +6051,19 @@ var AuthManager = class {
           throw new Error(`pairing failed: HTTP ${res.status} ${await safeErrorText(res)}`.trimEnd());
         }
         const body = PairResponseSchema.parse(await res.json());
-        const record = {
+        const metadata = {
           deviceId: body.deviceId,
           tenantId: body.tenantId,
+          devicePublicKey: keyPair.publicKeyBase64Url
+        };
+        const record = {
+          ...metadata,
           accessToken: body.accessToken,
           expiresAt: resolvePairExpiry(body.refreshHint),
-          devicePrivateKeyPem: exportPrivateKeyPem(keyPair.privateKey),
-          devicePublicKey: keyPair.publicKeyBase64Url
+          devicePrivateKeyPem: exportPrivateKeyPem(keyPair.privateKey)
         };
-        await this.opts.store.save(record);
+        await this.opts.store.save(metadata);
+        await this.credentials.replace(record);
         this.record = record;
         this.revoked = false;
         return record;
@@ -5110,8 +6128,12 @@ var AuthManager = class {
       throw new Error(`token renewal (token) failed: HTTP ${tokenRes.status} ${await safeErrorText(tokenRes)}`.trimEnd());
     }
     const body = await tokenRes.json();
-    const updated = { ...record, accessToken: body.accessToken, expiresAt: body.expiresAt };
-    await this.opts.store.save(updated);
+    const updated = {
+      ...record,
+      accessToken: body.accessToken,
+      expiresAt: body.expiresAt
+    };
+    await this.credentials.replace(updated);
     this.record = updated;
     this.scheduleProactiveRenewal();
     return updated.accessToken;
@@ -5148,6 +6170,24 @@ var AuthManager = class {
       release();
     }
   }
+  /** Read the current paired authority afresh; metadata without its OS secret is re-pair required. */
+  async loadRecord() {
+    const authority = await this.credentials.read();
+    if (authority === void 0) {
+      if (await this.opts.store.load() === void 0) return void 0;
+      throw new DeviceRecordRePairRequiredError();
+    }
+    const projection = {
+      deviceId: authority.deviceId,
+      tenantId: authority.tenantId,
+      devicePublicKey: authority.devicePublicKey
+    };
+    const current = await this.opts.store.load();
+    if (current === void 0 || current.deviceId !== projection.deviceId || current.tenantId !== projection.tenantId || current.devicePublicKey !== projection.devicePublicKey) {
+      await this.opts.store.save(projection);
+    }
+    return Object.freeze({ ...authority });
+  }
 };
 function msUntilExpiry(expiresAt) {
   return new Date(expiresAt).getTime() - Date.now();
@@ -5492,25 +6532,25 @@ function mintDeviceAssertion(input) {
 }
 var CONTROL_PROTOCOL_VERSION = 1;
 var HANDSHAKE_TIMEOUT_MS = 3e3;
-var UNIX_SOCKET_PATH_SOFT_LIMIT = 100;
+var UNIX_SOCKET_PATH_SOFT_LIMIT2 = 100;
 var CONTROL_SOCKET_FALLBACK_ROOT = "/tmp";
 function shortHash(input) {
   return createHash("sha256").update(input, "utf8").digest("hex").slice(0, 16);
 }
 function controlSocketPath(storeDir) {
-  const candidate = path.join(storeDir, "control.sock");
-  if (Buffer.byteLength(candidate, "utf8") <= UNIX_SOCKET_PATH_SOFT_LIMIT) return candidate;
-  return path.join(CONTROL_SOCKET_FALLBACK_ROOT, `byok-${shortHash(storeDir)}`, "sock");
+  const candidate = path3__default.join(storeDir, "control.sock");
+  if (Buffer.byteLength(candidate, "utf8") <= UNIX_SOCKET_PATH_SOFT_LIMIT2) return candidate;
+  return path3__default.join(CONTROL_SOCKET_FALLBACK_ROOT, `byok-${shortHash(storeDir)}`, "sock");
 }
 function controlPipeName(productId, storeDir) {
-  const id = shortHash(`${productId}|${path.resolve(storeDir)}`);
+  const id = shortHash(`${productId}|${path3__default.resolve(storeDir)}`);
   return `\\\\.\\pipe\\byok-${id}`;
 }
 function controlEndpointPath(productId, storeDir, platform = process.platform) {
   return platform === "win32" ? controlPipeName(productId, storeDir) : controlSocketPath(storeDir);
 }
 function controlTokenPath(storeDir) {
-  return path.join(storeDir, "control.token");
+  return path3__default.join(storeDir, "control.token");
 }
 var SERVER_PROOF_LABEL = "byok-control-server|";
 var CLIENT_AUTH_LABEL = "byok-control-client|";
@@ -5592,7 +6632,15 @@ var NdjsonLineReader = class {
     }
     return lines;
   }
-};
+};
+var ENROLLMENT_PAIRING_CODE_MAX_BYTES = 1024;
+function parseEnrollmentPairParams(value) {
+  if (!isRecord3(value) || Object.keys(value).some((key) => key !== "pairingCode")) return void 0;
+  if (typeof value.pairingCode !== "string" || value.pairingCode.length === 0 || Buffer.byteLength(value.pairingCode, "utf8") > ENROLLMENT_PAIRING_CODE_MAX_BYTES) {
+    return void 0;
+  }
+  return { pairingCode: value.pairingCode };
+}
 function parseToolsetsReloadParams(value) {
   if (!isRecord3(value) || Object.keys(value).some((key) => key !== "expectedRevision" && key !== "mcpToolsets")) {
     return void 0;
@@ -5672,7 +6720,7 @@ async function handleStaleUnixSocket(socketPath) {
   if (alive) throw new AnotherControlServerRunningError(socketPath);
   await promises.rm(socketPath, { force: true });
 }
-async function assertOwnedPrivateDir(dir) {
+async function assertOwnedPrivateDir2(dir) {
   const uid = process.getuid?.();
   if (uid === void 0) return;
   const st = await promises.lstat(dir);
@@ -5689,11 +6737,11 @@ async function assertOwnedPrivateDir(dir) {
 }
 async function bindControlEndpoint(server, endpoint) {
   if (process.platform !== "win32") {
-    const endpointDir = path.dirname(endpoint);
+    const endpointDir = path3__default.dirname(endpoint);
     await promises.mkdir(endpointDir, { recursive: true, mode: 448 });
     await promises.chmod(endpointDir, 448).catch(() => {
     });
-    await assertOwnedPrivateDir(endpointDir);
+    await assertOwnedPrivateDir2(endpointDir);
     await handleStaleUnixSocket(endpoint);
   }
   await new Promise((resolve, reject) => {
@@ -6588,7 +7636,7 @@ function toBytes(data, _isBinary) {
 
 // src/daemon/connection-manager.ts
 function isCursorEnvelopeType(type) {
-  return type.startsWith("task.") || type === "agent.egress.ack" || type === "agent.content.read";
+  return type.startsWith("task.") || type === "agent.egress.ack" || type === "agent.content.read" || type === "agent.home.projection";
 }
 var ConnectionManager = class {
   constructor(opts) {
@@ -7103,6 +8151,10 @@ var ConnectionManager = class {
   async process(envelope, tracked) {
     const seq = tracked ? envelope.seq : void 0;
     try {
+      if (tracked && this.cursor === void 0) {
+        await this.opts.cursorStore.save(this.opts.serverUrl, this.opts.deviceId, 0);
+        this.cursor = 0;
+      }
       await this.opts.onEnvelope(envelope);
       if (!tracked) return;
       this.processedSeqs.add(seq);
@@ -7332,7 +8384,7 @@ function sameFileState2(left, right) {
   return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs;
 }
 async function openOperationalHealthFile(storeDir) {
-  const filePath = path.join(storeDir, OPERATIONAL_HEALTH_FILENAME);
+  const filePath = path3__default.join(storeDir, OPERATIONAL_HEALTH_FILENAME);
   let namedBefore;
   try {
     namedBefore = await promises.lstat(filePath, { bigint: true });
@@ -7374,7 +8426,7 @@ var OperationalHealthTracker = class {
   #writeTail = Promise.resolve();
   #started = false;
   constructor(storeDir, options = {}) {
-    this.#filePath = path.join(storeDir, OPERATIONAL_HEALTH_FILENAME);
+    this.#filePath = path3__default.join(storeDir, OPERATIONAL_HEALTH_FILENAME);
     this.#windowMs = options.windowMs ?? 6e4;
     this.#failureThreshold = options.failureThreshold ?? 3;
     this.#maxFailures = options.maxFailures ?? 128;
@@ -7407,539 +8459,203 @@ var OperationalHealthTracker = class {
     if (loaded.currentRun) {
       loaded.crashes.push({ detectedAt: now.toISOString(), previousRunStartedAt: loaded.currentRun.startedAt });
       loaded.crashes = loaded.crashes.slice(-this.#maxCrashes);
-    }
-    loaded.currentRun = { id: this.#runId(), startedAt: now.toISOString(), pid: this.#pid };
-    await this.#persist();
-    return this.snapshot();
-  }
-  async recordFailure(source) {
-    if (!this.#state || this.#unavailableReason) return;
-    const now = this.#clock();
-    this.#prune(now);
-    this.#state.failures.push({ at: now.toISOString(), source });
-    this.#state.failures = this.#state.failures.slice(-this.#maxFailures);
-    if (this.#state.failures.length >= this.#failureThreshold || this.#state.state === "recovering") {
-      this.#state.state = "degraded";
-    }
-    await this.#persist();
-  }
-  async recordSuccess(_source) {
-    if (!this.#state || this.#unavailableReason) return;
-    const now = this.#clock();
-    this.#prune(now);
-    if (this.#state.state === "healthy") return;
-    if (this.#state.state === "degraded") {
-      this.#state.state = "recovering";
-    } else if (this.#state.state === "recovering" && this.#state.failures.length < this.#failureThreshold) {
-      this.#state.state = "healthy";
-    } else {
-      return;
-    }
-    await this.#persist();
-  }
-  async markCleanStop() {
-    if (!this.#state || this.#unavailableReason || !this.#started) return;
-    this.#state.currentRun = void 0;
-    await this.#persist();
-    this.#started = false;
-  }
-  snapshot() {
-    if (this.#unavailableReason) return { availability: "unavailable", reason: this.#unavailableReason };
-    if (!this.#state) return { availability: "unavailable", reason: "operational health has not been loaded" };
-    this.#prune(this.#clock());
-    return {
-      availability: "available",
-      state: this.#state.state,
-      failureCount: this.#state.failures.length,
-      windowMs: this.#windowMs,
-      failureThreshold: this.#failureThreshold,
-      crashCount: this.#state.crashes.length,
-      ...this.#state.crashes.at(-1) ? { lastCrashAt: this.#state.crashes.at(-1).detectedAt } : {},
-      ...this.#state.currentRun ? { currentRunStartedAt: this.#state.currentRun.startedAt } : {}
-    };
-  }
-  async #load() {
-    let opened;
-    try {
-      opened = await openOperationalHealthFile(path.dirname(this.#filePath));
-    } catch (err) {
-      throw new Error("operational health state could not be read");
-    }
-    if (!opened) return { version: 1, state: "healthy", failures: [], crashes: [] };
-    try {
-      const inspected = await readOperationalHealthHandle(opened.handle, opened.stat);
-      if (inspected.status !== "read") throw new Error(inspected.reason);
-      let parsed;
-      try {
-        parsed = JSON.parse(inspected.raw);
-      } catch {
-        throw new Error("operational health state is corrupt JSON");
-      }
-      if (!isHealthFile(parsed)) throw new Error("operational health state has an invalid shape");
-      return parsed;
-    } finally {
-      await opened.handle.close();
-    }
-  }
-  #prune(now) {
-    if (!this.#state) return;
-    const nowMs = now.getTime();
-    const cutoff = nowMs - this.#windowMs;
-    this.#state.failures = this.#state.failures.filter((event) => {
-      const eventMs = Date.parse(event.at);
-      return eventMs >= cutoff && eventMs <= nowMs;
-    });
-    if (this.#state.state === "recovering" && this.#state.failures.length < this.#failureThreshold) {
-      this.#state.state = "healthy";
-    }
-  }
-  async #persist() {
-    if (!this.#state) return;
-    const body = JSON.stringify(this.#state, null, 2);
-    this.#writeTail = this.#writeTail.then(async () => {
-      await ensureSecureDir(path.dirname(this.#filePath));
-      await atomicWriteFile(this.#filePath, body, { mode: 384, fsync: true });
-    });
-    try {
-      await this.#writeTail;
-    } catch (err) {
-      this.#unavailableReason = "operational health state could not be persisted";
-      throw err;
-    }
-  }
-};
-async function inspectOperationalHealthHandle(handle, expected) {
-  const read = await readOperationalHealthHandle(handle, expected);
-  if (read.status !== "read") return read;
-  const { raw, sizeBytes } = read;
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return { status: "corrupt", sizeBytes, reason: "operational health state is corrupt JSON" };
-  }
-  if (!isHealthFile(parsed)) {
-    return { status: "corrupt", sizeBytes, reason: "operational health state has an invalid shape" };
-  }
-  return {
-    status: "valid",
-    sizeBytes,
-    state: parsed.state,
-    failureCount: parsed.failures.length,
-    crashCount: parsed.crashes.length,
-    ...parsed.currentRun ? { currentRunStartedAt: new Date(Date.parse(parsed.currentRun.startedAt)).toISOString() } : {},
-    ...parsed.crashes.at(-1) ? { lastCrashAt: new Date(Date.parse(parsed.crashes.at(-1).detectedAt)).toISOString() } : {}
-  };
-}
-async function readOperationalHealthHandle(handle, expected) {
-  let before;
-  try {
-    before = await handle.stat({ bigint: true });
-  } catch {
-    return { status: "unavailable", reason: "operational health state could not be inspected" };
-  }
-  const sizeBytes = Number(before.size);
-  if (expected && !sameFileState2(before, expected)) {
-    return { status: "unavailable", sizeBytes, reason: "operational health handle identity changed before inspection" };
-  }
-  if (!before.isFile()) {
-    return { status: "unavailable", sizeBytes, reason: "operational health state is not a regular file" };
-  }
-  if (sizeBytes > MAX_OPERATIONAL_HEALTH_FILE_BYTES) {
-    return {
-      status: "unavailable",
-      sizeBytes,
-      reason: "operational health state exceeds the 1 MiB read limit; corruption is unconfirmed"
-    };
-  }
-  try {
-    const buffer = Buffer.alloc(sizeBytes);
-    const { bytesRead } = await handle.read(buffer, 0, sizeBytes, 0);
-    const after = await handle.stat({ bigint: true });
-    if (bytesRead !== sizeBytes || after.size !== before.size || after.mtimeNs !== before.mtimeNs || after.ctimeNs !== before.ctimeNs) {
-      return { status: "unavailable", sizeBytes: Number(after.size), reason: "operational health state changed during inspection" };
-    }
-    return { status: "read", raw: buffer.toString("utf8"), sizeBytes };
-  } catch {
-    return { status: "unavailable", sizeBytes, reason: "operational health state could not be read" };
-  }
-}
-async function inspectOperationalHealthFile(storeDir) {
-  let opened;
-  try {
-    opened = await openOperationalHealthFile(storeDir);
-  } catch {
-    return { status: "unavailable", reason: "operational health state could not be opened safely" };
-  }
-  if (!opened) return { status: "missing" };
-  try {
-    return await inspectOperationalHealthHandle(opened.handle, opened.stat);
-  } finally {
-    await opened.handle.close();
-  }
-}
-function isHealthFile(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const candidate = value;
-  const keys = Object.keys(candidate);
-  if (keys.some((key) => !["version", "state", "failures", "crashes", "currentRun"].includes(key))) return false;
-  if (candidate.version !== 1 || !["healthy", "degraded", "recovering"].includes(String(candidate.state))) return false;
-  if (!Array.isArray(candidate.failures) || !candidate.failures.every(isFailureEvent)) return false;
-  if (!Array.isArray(candidate.crashes) || !candidate.crashes.every(isCrashRecord)) return false;
-  if (candidate.currentRun !== void 0 && !isRunMarker(candidate.currentRun)) return false;
-  return true;
-}
-function isFailureEvent(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const event = value;
-  return Object.keys(event).every((key) => ["at", "source"].includes(key)) && typeof event.at === "string" && Number.isFinite(Date.parse(event.at)) && ["reconnect", "upload", "maintenance", "lifecycle"].includes(String(event.source));
-}
-function isCrashRecord(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const record = value;
-  return Object.keys(record).every((key) => ["detectedAt", "previousRunStartedAt"].includes(key)) && typeof record.detectedAt === "string" && Number.isFinite(Date.parse(record.detectedAt)) && typeof record.previousRunStartedAt === "string" && Number.isFinite(Date.parse(record.previousRunStartedAt));
-}
-function isRunMarker(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const marker = value;
-  return Object.keys(marker).every((key) => ["id", "startedAt", "pid"].includes(key)) && typeof marker.id === "string" && typeof marker.startedAt === "string" && Number.isFinite(Date.parse(marker.startedAt)) && typeof marker.pid === "number" && Number.isSafeInteger(marker.pid);
-}
-var DAEMON_OWNER_FILENAME = "daemon-owner.json";
-var RECLAIM_FILENAME = `${DAEMON_OWNER_FILENAME}.reclaim`;
-var MAX_OWNER_BYTES = 4096;
-var RECLAIM_MALFORMED_GRACE_MS = 3e4;
-var SELF_PROCESS_STARTED_AT = new Date(Date.now() - process.uptime() * 1e3).toISOString();
-function endOwnershipProbe(socket, response) {
-  socket.on("error", () => {
-  });
-  if (response === void 0) socket.end();
-  else socket.end(response);
-}
-var STORE_MUTEX_ID_PREFIX = "byok-store-mutex-v1:";
-var STORE_MUTEX_PROBE_TIMEOUT_MS = 1e3;
-var STORE_MUTEX_SOCKET_FILENAME = "mutex.sock";
-var UNIX_SOCKET_PATH_SOFT_LIMIT2 = 100;
-var STORE_MUTEX_FALLBACK_ROOT = "/tmp";
-function storeMutexIdentity(canonicalStoreDir) {
-  return createHash("sha256").update(canonicalStoreDir).digest("hex");
-}
-function storeMutexEndpoint(canonicalStoreDir, identity, platform = process.platform) {
-  if (platform === "win32") return `\\\\.\\pipe\\byok-store-mutex-${identity.slice(0, 16)}`;
-  const candidate = path.join(canonicalStoreDir, STORE_MUTEX_SOCKET_FILENAME);
-  if (Buffer.byteLength(candidate, "utf8") <= UNIX_SOCKET_PATH_SOFT_LIMIT2) return candidate;
-  return path.join(STORE_MUTEX_FALLBACK_ROOT, `byok-store-mutex-${identity.slice(0, 16)}`, "sock");
-}
-var DaemonOwnerActiveError = class extends Error {
-  constructor(role) {
-    super(`store mutation lease is already held by an active ${role} process`);
-    this.role = role;
-    this.name = "DaemonOwnerActiveError";
-  }
-  role;
-};
-function isOwnerRecord(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const candidate = value;
-  return candidate.version === 2 && Number.isSafeInteger(candidate.pid) && (candidate.pid ?? 0) > 0 && typeof candidate.nonce === "string" && candidate.nonce.length === 36 && (candidate.role === "daemon" || candidate.role === "doctor") && typeof candidate.acquiredAt === "string" && Number.isFinite(Date.parse(candidate.acquiredAt)) && typeof candidate.processStartedAt === "string" && Number.isFinite(Date.parse(candidate.processStartedAt)) && Number.isSafeInteger(candidate.livenessPort) && (candidate.livenessPort ?? 0) > 0 && (candidate.livenessPort ?? 0) <= 65535;
-}
-async function readOwner(filePath) {
-  let namedBefore;
-  try {
-    namedBefore = await promises.lstat(filePath, { bigint: true });
-  } catch (err) {
-    if (err.code === "ENOENT") return void 0;
-    throw err;
-  }
-  if (!namedBefore.isFile() || namedBefore.isSymbolicLink()) {
-    throw new Error("store mutation owner path is not a real regular file");
-  }
-  let handle;
-  try {
-    handle = await promises.open(
-      filePath,
-      constants.O_RDONLY | (constants.O_NONBLOCK ?? 0) | (constants.O_NOFOLLOW ?? 0)
-    );
-  } catch (err) {
-    if (err.code === "ENOENT") return void 0;
-    throw err;
+    }
+    loaded.currentRun = { id: this.#runId(), startedAt: now.toISOString(), pid: this.#pid };
+    await this.#persist();
+    return this.snapshot();
   }
-  try {
-    const stat = await handle.stat({ bigint: true });
-    const namedAfterOpen = await promises.lstat(filePath, { bigint: true });
-    if (!stat.isFile() || !namedAfterOpen.isFile() || namedAfterOpen.isSymbolicLink() || stat.dev !== namedBefore.dev || stat.ino !== namedBefore.ino || stat.size !== namedBefore.size || stat.mtimeNs !== namedBefore.mtimeNs || stat.ctimeNs !== namedBefore.ctimeNs || stat.dev !== namedAfterOpen.dev || stat.ino !== namedAfterOpen.ino || stat.size !== namedAfterOpen.size || stat.mtimeNs !== namedAfterOpen.mtimeNs || stat.ctimeNs !== namedAfterOpen.ctimeNs) {
-      throw new Error("store mutation owner path changed before safe open");
+  async recordFailure(source) {
+    if (!this.#state || this.#unavailableReason) return;
+    const now = this.#clock();
+    this.#prune(now);
+    this.#state.failures.push({ at: now.toISOString(), source });
+    this.#state.failures = this.#state.failures.slice(-this.#maxFailures);
+    if (this.#state.failures.length >= this.#failureThreshold || this.#state.state === "recovering") {
+      this.#state.state = "degraded";
     }
-    if (stat.size <= 0 || stat.size > MAX_OWNER_BYTES) return void 0;
-    const size = Number(stat.size);
-    const buffer = Buffer.alloc(size);
-    const { bytesRead } = await handle.read(buffer, 0, size, 0);
-    const after = await handle.stat({ bigint: true });
-    const namedAfterRead = await promises.lstat(filePath, { bigint: true });
-    if (bytesRead !== size || after.dev !== stat.dev || after.ino !== stat.ino || after.size !== stat.size || after.mtimeNs !== stat.mtimeNs || after.ctimeNs !== stat.ctimeNs || namedAfterRead.dev !== stat.dev || namedAfterRead.ino !== stat.ino || namedAfterRead.size !== stat.size || namedAfterRead.mtimeNs !== stat.mtimeNs || namedAfterRead.ctimeNs !== stat.ctimeNs) {
-      throw new Error("store mutation owner path changed during inspection");
+    await this.#persist();
+  }
+  async recordSuccess(_source) {
+    if (!this.#state || this.#unavailableReason) return;
+    const now = this.#clock();
+    this.#prune(now);
+    if (this.#state.state === "healthy") return;
+    if (this.#state.state === "degraded") {
+      this.#state.state = "recovering";
+    } else if (this.#state.state === "recovering" && this.#state.failures.length < this.#failureThreshold) {
+      this.#state.state = "healthy";
+    } else {
+      return;
     }
-    const raw = buffer.toString("utf8");
-    const parsed = JSON.parse(raw);
-    return isOwnerRecord(parsed) ? parsed : void 0;
-  } catch (err) {
-    if (err instanceof Error && err.message.startsWith("store mutation owner path changed")) throw err;
-    return void 0;
-  } finally {
-    await handle.close();
+    await this.#persist();
   }
-}
-function pidIsAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (err) {
-    return err.code === "EPERM";
+  async markCleanStop() {
+    if (!this.#state || this.#unavailableReason || !this.#started) return;
+    this.#state.currentRun = void 0;
+    await this.#persist();
+    this.#started = false;
   }
-}
-async function processOwnsRecord(record) {
-  if (!pidIsAlive(record.pid)) return false;
-  if (record.pid === process.pid && record.processStartedAt !== SELF_PROCESS_STARTED_AT) return false;
-  return portIsBound(record.livenessPort);
-}
-async function portIsBound(port) {
-  const probe = createServer();
-  return new Promise((resolve, reject) => {
-    const finish = (result) => {
-      probe.removeAllListeners();
-      resolve(result);
+  snapshot() {
+    if (this.#unavailableReason) return { availability: "unavailable", reason: this.#unavailableReason };
+    if (!this.#state) return { availability: "unavailable", reason: "operational health has not been loaded" };
+    this.#prune(this.#clock());
+    return {
+      availability: "available",
+      state: this.#state.state,
+      failureCount: this.#state.failures.length,
+      windowMs: this.#windowMs,
+      failureThreshold: this.#failureThreshold,
+      crashCount: this.#state.crashes.length,
+      ...this.#state.crashes.at(-1) ? { lastCrashAt: this.#state.crashes.at(-1).detectedAt } : {},
+      ...this.#state.currentRun ? { currentRunStartedAt: this.#state.currentRun.startedAt } : {}
     };
-    probe.once("error", (err) => {
-      if (err.code === "EADDRINUSE") finish(true);
-      else reject(err);
-    });
-    probe.listen({ host: "127.0.0.1", port, exclusive: true }, () => {
-      probe.close((err) => {
-        if (err) reject(err);
-        else finish(false);
-      });
-    });
-  });
-}
-async function createLivenessListener() {
-  const server = createServer((socket) => endOwnershipProbe(socket));
-  const port = await new Promise((resolve, reject) => {
-    server.once("error", reject);
-    server.listen({ host: "127.0.0.1", port: 0, exclusive: true }, () => {
-      server.removeListener("error", reject);
-      const address = server.address();
-      if (!address || typeof address === "string") {
-        reject(new Error("store mutation liveness listener did not expose a TCP port"));
-        return;
-      }
-      resolve(address.port);
-    });
-  });
-  server.unref();
-  let closed = false;
-  return {
-    port,
-    close: () => new Promise((resolve, reject) => {
-      if (closed) {
-        resolve();
-        return;
+  }
+  async #load() {
+    let opened;
+    try {
+      opened = await openOperationalHealthFile(path3__default.dirname(this.#filePath));
+    } catch (err) {
+      throw new Error("operational health state could not be read");
+    }
+    if (!opened) return { version: 1, state: "healthy", failures: [], crashes: [] };
+    try {
+      const inspected = await readOperationalHealthHandle(opened.handle, opened.stat);
+      if (inspected.status !== "read") throw new Error(inspected.reason);
+      let parsed;
+      try {
+        parsed = JSON.parse(inspected.raw);
+      } catch {
+        throw new Error("operational health state is corrupt JSON");
       }
-      closed = true;
-      server.close((err) => err ? reject(err) : resolve());
-    })
-  };
-}
-async function probeStoreMutex(endpoint, identity) {
-  return new Promise((resolve) => {
-    const socket = createConnection(endpoint);
-    let settled = false;
-    let raw = "";
-    const finish = (result) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      socket.removeAllListeners();
-      socket.destroy();
-      resolve(result);
-    };
-    const timer = setTimeout(() => finish({ kind: "occupied" }), STORE_MUTEX_PROBE_TIMEOUT_MS);
-    socket.setEncoding("utf8");
-    socket.on("data", (chunk) => {
-      raw += chunk;
-      if (raw.length > STORE_MUTEX_ID_PREFIX.length + 64 + 1) finish({ kind: "occupied" });
-    });
-    socket.once("end", () => finish(raw.trimEnd() === `${STORE_MUTEX_ID_PREFIX}${identity}` ? { kind: "holder" } : { kind: "occupied" }));
-    socket.once(
-      "error",
-      (err) => finish(err.code === "ECONNREFUSED" || err.code === "ENOENT" ? { kind: "unbound" } : { kind: "occupied" })
-    );
-  });
-}
-async function clearStaleStoreMutexSocket(endpoint, identity) {
-  let stat;
-  try {
-    stat = await promises.lstat(endpoint);
-  } catch (err) {
-    if (err.code === "ENOENT") return;
-    throw err;
+      if (!isHealthFile(parsed)) throw new Error("operational health state has an invalid shape");
+      return parsed;
+    } finally {
+      await opened.handle.close();
+    }
   }
-  if (!stat.isSocket()) throw new Error("store mutation lock path exists but is not a socket");
-  if ((await probeStoreMutex(endpoint, identity)).kind !== "unbound") throw new DaemonOwnerActiveError("unknown");
-  await promises.rm(endpoint, { force: true });
-}
-async function assertOwnedPrivateDir2(dir) {
-  const uid = process.getuid?.();
-  if (uid === void 0) return;
-  const stat = await promises.lstat(dir);
-  if (stat.isSymbolicLink() || stat.uid !== uid) {
-    throw new Error(`refusing to bind the store mutation lock under "${dir}": not a real directory owned by this process's own uid`);
+  #prune(now) {
+    if (!this.#state) return;
+    const nowMs = now.getTime();
+    const cutoff = nowMs - this.#windowMs;
+    this.#state.failures = this.#state.failures.filter((event) => {
+      const eventMs = Date.parse(event.at);
+      return eventMs >= cutoff && eventMs <= nowMs;
+    });
+    if (this.#state.state === "recovering" && this.#state.failures.length < this.#failureThreshold) {
+      this.#state.state = "healthy";
+    }
   }
-}
-async function acquireStoreMutex(canonicalStoreDir) {
-  const identity = storeMutexIdentity(canonicalStoreDir);
-  const endpoint = storeMutexEndpoint(canonicalStoreDir, identity);
-  const isPipe = process.platform === "win32";
-  if (!isPipe) {
-    const endpointDir = path.dirname(endpoint);
-    if (endpointDir !== canonicalStoreDir) {
-      await ensureSecureDir(endpointDir);
-      await assertOwnedPrivateDir2(endpointDir);
+  async #persist() {
+    if (!this.#state) return;
+    const body = JSON.stringify(this.#state, null, 2);
+    this.#writeTail = this.#writeTail.then(async () => {
+      await ensureSecureDir(path3__default.dirname(this.#filePath));
+      await atomicWriteFile(this.#filePath, body, { mode: 384, fsync: true });
+    });
+    try {
+      await this.#writeTail;
+    } catch (err) {
+      this.#unavailableReason = "operational health state could not be persisted";
+      throw err;
     }
-    await clearStaleStoreMutexSocket(endpoint, identity);
   }
-  const server = createServer((socket) => endOwnershipProbe(socket, `${STORE_MUTEX_ID_PREFIX}${identity}
-`));
+};
+async function inspectOperationalHealthHandle(handle, expected) {
+  const read = await readOperationalHealthHandle(handle, expected);
+  if (read.status !== "read") return read;
+  const { raw, sizeBytes } = read;
+  let parsed;
   try {
-    await new Promise((resolve, reject) => {
-      server.once("error", reject);
-      server.listen(endpoint, () => {
-        server.removeListener("error", reject);
-        resolve();
-      });
-    });
-  } catch (err) {
-    if (err.code === "EADDRINUSE") throw new DaemonOwnerActiveError("unknown");
-    throw err;
+    parsed = JSON.parse(raw);
+  } catch {
+    return { status: "corrupt", sizeBytes, reason: "operational health state is corrupt JSON" };
+  }
+  if (!isHealthFile(parsed)) {
+    return { status: "corrupt", sizeBytes, reason: "operational health state has an invalid shape" };
   }
-  if (!isPipe) await promises.chmod(endpoint, 384).catch(() => void 0);
-  server.unref();
-  let closed = false;
   return {
-    endpoint,
-    close: async () => {
-      if (closed) return;
-      closed = true;
-      await new Promise((resolve, reject) => server.close((err) => err ? reject(err) : resolve()));
-      if (!isPipe) await promises.rm(endpoint, { force: true }).catch(() => void 0);
-    }
+    status: "valid",
+    sizeBytes,
+    state: parsed.state,
+    failureCount: parsed.failures.length,
+    crashCount: parsed.crashes.length,
+    ...parsed.currentRun ? { currentRunStartedAt: new Date(Date.parse(parsed.currentRun.startedAt)).toISOString() } : {},
+    ...parsed.crashes.at(-1) ? { lastCrashAt: new Date(Date.parse(parsed.crashes.at(-1).detectedAt)).toISOString() } : {}
   };
 }
-async function reclaimExistsAndIsActive(reclaimPath) {
-  let stat;
+async function readOperationalHealthHandle(handle, expected) {
+  let before;
   try {
-    stat = await promises.lstat(reclaimPath);
-  } catch (err) {
-    if (err.code === "ENOENT") return false;
-    throw err;
+    before = await handle.stat({ bigint: true });
+  } catch {
+    return { status: "unavailable", reason: "operational health state could not be inspected" };
+  }
+  const sizeBytes = Number(before.size);
+  if (expected && !sameFileState2(before, expected)) {
+    return { status: "unavailable", sizeBytes, reason: "operational health handle identity changed before inspection" };
+  }
+  if (!before.isFile()) {
+    return { status: "unavailable", sizeBytes, reason: "operational health state is not a regular file" };
+  }
+  if (sizeBytes > MAX_OPERATIONAL_HEALTH_FILE_BYTES) {
+    return {
+      status: "unavailable",
+      sizeBytes,
+      reason: "operational health state exceeds the 1 MiB read limit; corruption is unconfirmed"
+    };
   }
-  if (!stat.isFile()) throw new Error("store mutation reclaim marker is not a regular file");
-  const owner = await readOwner(reclaimPath);
-  if (owner) return processOwnsRecord(owner);
-  return Date.now() - stat.mtimeMs <= RECLAIM_MALFORMED_GRACE_MS;
-}
-async function createOwner(filePath, record) {
-  const tempPath = `${filePath}.${record.pid}.${record.nonce}.tmp`;
-  let handle;
   try {
-    handle = await promises.open(tempPath, "wx", 384);
-    await handle.writeFile(`${JSON.stringify(record)}
-`, "utf8");
-    await handle.chmod(384);
-    await handle.sync();
-    await handle.close();
-    try {
-      await promises.link(tempPath, filePath);
-      return true;
-    } catch (err) {
-      if (err.code === "EEXIST") return false;
-      throw err;
+    const buffer = Buffer.alloc(sizeBytes);
+    const { bytesRead } = await handle.read(buffer, 0, sizeBytes, 0);
+    const after = await handle.stat({ bigint: true });
+    if (bytesRead !== sizeBytes || after.size !== before.size || after.mtimeNs !== before.mtimeNs || after.ctimeNs !== before.ctimeNs) {
+      return { status: "unavailable", sizeBytes: Number(after.size), reason: "operational health state changed during inspection" };
     }
-  } finally {
-    await handle?.close().catch(() => void 0);
-    await promises.rm(tempPath, { force: true }).catch(() => void 0);
+    return { status: "read", raw: buffer.toString("utf8"), sizeBytes };
+  } catch {
+    return { status: "unavailable", sizeBytes, reason: "operational health state could not be read" };
   }
 }
-async function acquireDaemonOwner(storeDir, role, clock = () => /* @__PURE__ */ new Date()) {
-  await ensureSecureDir(storeDir);
-  const canonicalStoreDir = await promises.realpath(storeDir);
-  const mutex = await acquireStoreMutex(canonicalStoreDir);
-  let liveness;
+async function inspectOperationalHealthFile(storeDir) {
+  let opened;
   try {
-    liveness = await createLivenessListener();
-  } catch (err) {
-    await mutex.close().catch(() => void 0);
-    throw err;
+    opened = await openOperationalHealthFile(storeDir);
+  } catch {
+    return { status: "unavailable", reason: "operational health state could not be opened safely" };
   }
-  const ownerPath = path.join(storeDir, DAEMON_OWNER_FILENAME);
-  const reclaimPath = path.join(storeDir, RECLAIM_FILENAME);
-  const record = {
-    version: 2,
-    pid: process.pid,
-    nonce: randomUUID(),
-    role,
-    acquiredAt: clock().toISOString(),
-    processStartedAt: SELF_PROCESS_STARTED_AT,
-    livenessPort: liveness.port
-  };
+  if (!opened) return { status: "missing" };
   try {
-    for (; ; ) {
-      if (await reclaimExistsAndIsActive(reclaimPath)) {
-        throw new Error("store mutation lease is being reclaimed; retry after the current operation finishes");
-      }
-      await promises.rm(reclaimPath, { force: true });
-      if (await createOwner(ownerPath, record)) {
-        let released = false;
-        return {
-          release: async () => {
-            if (released) return;
-            const current = await readOwner(ownerPath);
-            if (current?.nonce !== record.nonce) {
-              throw new Error("store mutation lease identity changed before release");
-            }
-            await promises.rm(ownerPath);
-            released = true;
-            try {
-              await liveness.close();
-            } finally {
-              await mutex.close();
-            }
-          }
-        };
-      }
-      const existing = await readOwner(ownerPath);
-      if (existing && await processOwnsRecord(existing)) throw new DaemonOwnerActiveError(existing.role);
-      if (!await createOwner(reclaimPath, record)) {
-        throw new Error("store mutation lease is being reclaimed; retry after the current operation finishes");
-      }
-      try {
-        const rechecked = await readOwner(ownerPath);
-        if (rechecked && await processOwnsRecord(rechecked)) throw new DaemonOwnerActiveError(rechecked.role);
-        if (rechecked || await promises.stat(ownerPath).then(() => true, (err) => {
-          if (err.code === "ENOENT") return false;
-          throw err;
-        })) {
-          await promises.rm(ownerPath);
-        }
-      } finally {
-        const currentReclaim = await readOwner(reclaimPath);
-        if (currentReclaim?.nonce === record.nonce) await promises.rm(reclaimPath, { force: true });
-      }
-    }
-  } catch (err) {
-    await liveness.close().catch(() => void 0);
-    await mutex.close().catch(() => void 0);
-    throw err;
+    return await inspectOperationalHealthHandle(opened.handle, opened.stat);
+  } finally {
+    await opened.handle.close();
   }
 }
+function isHealthFile(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const candidate = value;
+  const keys = Object.keys(candidate);
+  if (keys.some((key) => !["version", "state", "failures", "crashes", "currentRun"].includes(key))) return false;
+  if (candidate.version !== 1 || !["healthy", "degraded", "recovering"].includes(String(candidate.state))) return false;
+  if (!Array.isArray(candidate.failures) || !candidate.failures.every(isFailureEvent)) return false;
+  if (!Array.isArray(candidate.crashes) || !candidate.crashes.every(isCrashRecord)) return false;
+  if (candidate.currentRun !== void 0 && !isRunMarker(candidate.currentRun)) return false;
+  return true;
+}
+function isFailureEvent(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const event = value;
+  return Object.keys(event).every((key) => ["at", "source"].includes(key)) && typeof event.at === "string" && Number.isFinite(Date.parse(event.at)) && ["reconnect", "upload", "maintenance", "lifecycle"].includes(String(event.source));
+}
+function isCrashRecord(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const record = value;
+  return Object.keys(record).every((key) => ["detectedAt", "previousRunStartedAt"].includes(key)) && typeof record.detectedAt === "string" && Number.isFinite(Date.parse(record.detectedAt)) && typeof record.previousRunStartedAt === "string" && Number.isFinite(Date.parse(record.previousRunStartedAt));
+}
+function isRunMarker(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const marker = value;
+  return Object.keys(marker).every((key) => ["id", "startedAt", "pid"].includes(key)) && typeof marker.id === "string" && typeof marker.startedAt === "string" && Number.isFinite(Date.parse(marker.startedAt)) && typeof marker.pid === "number" && Number.isSafeInteger(marker.pid);
+}
 
 // src/daemon/runtime-capabilities.ts
 function toRuntimeInfoCapabilities(caps) {
@@ -7958,7 +8674,7 @@ var CursorStore = class {
   storeDir;
   fileFor(serverUrl, deviceId) {
     const key = createHash("sha256").update(`${serverUrl}::${deviceId}`).digest("hex").slice(0, 32);
-    return path.join(this.storeDir, `cursor-${key}.json`);
+    return path3__default.join(this.storeDir, `cursor-${key}.json`);
   }
   async load(serverUrl, deviceId) {
     let raw;
@@ -7978,7 +8694,7 @@ var CursorStore = class {
   }
   async save(serverUrl, deviceId, cursor) {
     const file = this.fileFor(serverUrl, deviceId);
-    await promises.mkdir(path.dirname(file), { recursive: true, mode: 448 });
+    await promises.mkdir(path3__default.dirname(file), { recursive: true, mode: 448 });
     await atomicWriteFile(file, JSON.stringify({ cursor }));
   }
   /** Remove any persisted cursor for (serverUrl, deviceId) — a no-op if none exists. Called from `pair()` (finding F5) so a device that's about to be replaced never leaves a cursor a future, unrelated device could somehow inherit. */
@@ -8308,7 +9024,7 @@ var SessionWorkspaceStore = class {
    */
   queue = Promise.resolve();
   constructor(storeDir) {
-    this.filePath = path.join(storeDir, "session-workspaces.json");
+    this.filePath = path3__default.join(storeDir, "session-workspaces.json");
   }
   async get(sessionRef) {
     return this.enqueue(async () => {
@@ -8366,7 +9082,7 @@ var SessionWorkspaceStore = class {
     }
   }
   async save(all) {
-    const dir = path.dirname(this.filePath);
+    const dir = path3__default.dirname(this.filePath);
     await promises.mkdir(dir, { recursive: true, mode: 448 });
     const tmpPath = `${this.filePath}.${process.pid}-${tmpSeq2++}.tmp`;
     try {
@@ -8471,9 +9187,9 @@ function isSqliteAvailable() {
   }
 }
 var SECURE_FILE_MODE = 384;
-function openJournalDatabase(path34, busyTimeoutMs, faults) {
+function openJournalDatabase(path36, busyTimeoutMs, faults) {
   const { DatabaseSync } = loadSqliteModule();
-  const db = new DatabaseSync(path34, { timeout: busyTimeoutMs });
+  const db = new DatabaseSync(path36, { timeout: busyTimeoutMs });
   try {
     faults?.onStep?.("after-open");
     db.exec("PRAGMA auto_vacuum = INCREMENTAL;");
@@ -8616,9 +9332,9 @@ var RECEIVED_STATE = "received";
 function byteLength(value) {
   return Buffer.byteLength(value, "utf8");
 }
-function fileBytes(path34) {
+function fileBytes(path36) {
   try {
-    return statSync(path34).size;
+    return statSync(path36).size;
   } catch {
     return 0;
   }
@@ -9950,8 +10666,8 @@ function estimateEventBytes(event) {
 }
 async function openArtifact(workspaceDir, name) {
   const realWorkspaceDir = await promises.realpath(workspaceDir).catch(() => workspaceDir);
-  const candidate = path.resolve(realWorkspaceDir, name);
-  const prefix = realWorkspaceDir.endsWith(path.sep) ? realWorkspaceDir : realWorkspaceDir + path.sep;
+  const candidate = path3__default.resolve(realWorkspaceDir, name);
+  const prefix = realWorkspaceDir.endsWith(path3__default.sep) ? realWorkspaceDir : realWorkspaceDir + path3__default.sep;
   if (candidate !== realWorkspaceDir && !candidate.startsWith(prefix)) {
     return { ok: false, reason: `artifact name "${name}" resolves outside the task workspace \u2014 rejected` };
   }
@@ -10084,6 +10800,12 @@ var TaskRunner = class {
    * cancellation intent.
    */
   finishedTaskIds = /* @__PURE__ */ new Set();
+  /**
+   * Bounded local receive dedup for strict legacy declines. A decline is not a
+   * task terminal receipt, so it must never enter `finishedTaskIds`; retaining
+   * it separately keeps replay idempotent without claiming or finishing work.
+   */
+  strictDeclinedTaskIds = /* @__PURE__ */ new Set();
   /**
    * M4 Phase 2 (daemon control socket `shutdown` RPC): set once by
    * {@link stopAcceptingOffers}, checked at the very top of `handleOffer` —
@@ -10303,7 +11025,7 @@ var TaskRunner = class {
     }
   }
   async handleOffer(taskId, payload, strictAgentOffer) {
-    if (this.tasks.has(taskId) || this.finishedTaskIds.has(taskId)) {
+    if (this.tasks.has(taskId) || this.finishedTaskIds.has(taskId) || this.strictDeclinedTaskIds.has(taskId)) {
       return;
     }
     let agentRef;
@@ -10334,15 +11056,6 @@ var TaskRunner = class {
         return;
       }
     }
-    const guarded = this.deps.admissionGuard?.({ taskId, payload });
-    if (guarded !== void 0 && !guarded.admit) {
-      decline(guarded.reason, guarded.retryable);
-      return;
-    }
-    if (this.stoppingOffers) {
-      decline("daemon is shutting down", true);
-      return;
-    }
     this.inFlightOffers.add(taskId);
     let agentBinding;
     let agentLeaseTransferred = false;
@@ -10353,6 +11066,20 @@ var TaskRunner = class {
         decline(reason ? `cancelled before claim: ${reason}` : "cancelled before claim", false);
         return;
       }
+      if (this.deps.strictAgentOnly === true && !strictAgentOffer) {
+        this.addStrictDeclinedTaskId(taskId);
+        decline("strict Agent-only daemon refuses legacy task offers", false);
+        return;
+      }
+      const guarded = this.deps.admissionGuard?.({ taskId, payload });
+      if (guarded !== void 0 && !guarded.admit) {
+        decline(guarded.reason, guarded.retryable);
+        return;
+      }
+      if (this.stoppingOffers) {
+        decline("daemon is shutting down", true);
+        return;
+      }
       if (payload.limits?.maxTokens !== void 0) {
         decline(
           `offer requests limits.maxTokens (${payload.limits.maxTokens}), which no bundled runtime adapter enforces \u2014 declining fail-closed rather than silently ignoring it`,
@@ -10463,7 +11190,7 @@ var TaskRunner = class {
           const sameProtocolTask = ledger?.taskId === taskId;
           const interruptedOldTask = ledger?.phase === "interrupted" && sameProtocolTask;
           const activeDifferentTask = ledger !== void 0 && ledger.taskId !== taskId && (ledger.phase === "preparing" || ledger.phase === "active");
-          if (!known || known.workspaceKind !== "git" || !known.gitWorkspaceId || !ledger || ledger.workspaceId !== known.gitWorkspaceId || ledger.sessionRef !== sessionRef || path.resolve(ledger.workspaceDir) !== path.resolve(known.workspaceDir) || interruptedOldTask || activeDifferentTask) {
+          if (!known || known.workspaceKind !== "git" || !known.gitWorkspaceId || !ledger || ledger.workspaceId !== known.gitWorkspaceId || ledger.sessionRef !== sessionRef || path3__default.resolve(ledger.workspaceDir) !== path3__default.resolve(known.workspaceDir) || interruptedOldTask || activeDifferentTask) {
             decline("session is incompatible with Git workspace mode", true);
             return;
           }
@@ -10478,7 +11205,7 @@ var TaskRunner = class {
             return;
           }
         } else {
-          workspaceDir = path.join(this.deps.workspaceRoot, taskId);
+          workspaceDir = path3__default.join(this.deps.workspaceRoot, taskId);
           gitWorkspaceId = randomUUID();
         }
         try {
@@ -10489,7 +11216,7 @@ var TaskRunner = class {
         }
       } else if (!this.deps.gitWorkspaceManager && !this.deps.gitWorkspaceStore) {
         known = sessionRef ? await this.deps.sessionWorkspaces.get(sessionRef) : void 0;
-        workspaceDir = known?.workspaceDir ?? path.join(this.deps.workspaceRoot, taskId);
+        workspaceDir = known?.workspaceDir ?? path3__default.join(this.deps.workspaceRoot, taskId);
         plainWorkspaceNeedsResolve = true;
       } else {
         decline("workspace mode is unavailable", true);
@@ -11874,9 +12601,16 @@ var TaskRunner = class {
       if (oldest !== void 0) this.finishedTaskIds.delete(oldest);
     }
   }
+  addStrictDeclinedTaskId(taskId) {
+    this.strictDeclinedTaskIds.add(taskId);
+    if (this.strictDeclinedTaskIds.size > MAX_TRACKED_TASK_IDS) {
+      const oldest = this.strictDeclinedTaskIds.values().next().value;
+      if (oldest !== void 0) this.strictDeclinedTaskIds.delete(oldest);
+    }
+  }
   /** `reuseDir`, when set (a known sessionRef's recorded workspace), is used verbatim instead of a fresh `workspaceRoot/<taskId>` directory — `mkdir recursive` is idempotent either way, so ensuring-exists is safe to do unconditionally. */
   async resolveWorkspaceDir(taskId, reuseDir) {
-    const dir = reuseDir ?? path.join(this.deps.workspaceRoot, taskId);
+    const dir = reuseDir ?? path3__default.join(this.deps.workspaceRoot, taskId);
     await promises.mkdir(dir, { recursive: true });
     return dir;
   }
@@ -12014,7 +12748,7 @@ var encoder2 = new TextEncoder();
 function eventBytes(event) {
   return encoder2.encode(JSON.stringify(event)).length;
 }
-var AGENT_EGRESS_DIRECTORY = path.join(".byok", "egress");
+var AGENT_EGRESS_DIRECTORY = path3__default.join(".byok", "egress");
 var AGENT_RELIABLE_SPOOL_FILENAME = "reliable-v1.jsonl";
 var AgentReliableSpoolError = class extends Error {
   constructor(message) {
@@ -12125,9 +12859,9 @@ var AgentReliableSpool = class _AgentReliableSpool {
   logEntries = 0;
   writeTail = Promise.resolve();
   static async open(homeDir) {
-    const directory = path.join(homeDir, AGENT_EGRESS_DIRECTORY);
+    const directory = path3__default.join(homeDir, AGENT_EGRESS_DIRECTORY);
     await ensureSecureDir(directory);
-    const spool = new _AgentReliableSpool(homeDir, path.join(directory, AGENT_RELIABLE_SPOOL_FILENAME));
+    const spool = new _AgentReliableSpool(homeDir, path3__default.join(directory, AGENT_RELIABLE_SPOOL_FILENAME));
     await spool.load();
     return spool;
   }
@@ -12590,7 +13324,7 @@ var AgentEgressController = class {
   }
   /** Re-open every existing Agent-local spool before retrying stable records after restart. */
   async recover(agentsRoot) {
-    if (!path.isAbsolute(agentsRoot)) throw new Error("Agent egress recovery root must be absolute");
+    if (!path3__default.isAbsolute(agentsRoot)) throw new Error("Agent egress recovery root must be absolute");
     if (!this.active) throw new Error("Agent egress recovery requires an active authenticated enrollment");
     if (this.options.tenantId === void 0) {
       throw new Error("Agent egress recovery requires one authenticated tenant authority");
@@ -12605,14 +13339,14 @@ var AgentEgressController = class {
     }
     for (const entry of entries) {
       if (!entry.isDirectory() || entry.isSymbolicLink()) continue;
-      const homeDir = path.join(canonicalAgentsRoot, entry.name);
+      const homeDir = path3__default.join(canonicalAgentsRoot, entry.name);
       const canonicalHome = await promises.realpath(homeDir);
-      const relativeHome = path.relative(canonicalAgentsRoot, canonicalHome);
-      if (relativeHome !== entry.name || relativeHome.includes(path.sep) || path.isAbsolute(relativeHome)) {
+      const relativeHome = path3__default.relative(canonicalAgentsRoot, canonicalHome);
+      if (relativeHome !== entry.name || relativeHome.includes(path3__default.sep) || path3__default.isAbsolute(relativeHome)) {
         throw new Error(`Agent egress recovery home escaped the canonical agents root: ${entry.name}`);
       }
       try {
-        await promises.lstat(path.join(homeDir, AGENT_EGRESS_DIRECTORY));
+        await promises.lstat(path3__default.join(homeDir, AGENT_EGRESS_DIRECTORY));
       } catch (error) {
         if (error.code === "ENOENT") continue;
         throw error;
@@ -12699,12 +13433,12 @@ function isAgentRef(value) {
 }
 function isCanonicalRelativeTarget(value) {
   if (value === "[invalid-target]") return true;
-  if (path.isAbsolute(value) || value.includes("\\")) return false;
+  if (path3__default.isAbsolute(value) || value.includes("\\")) return false;
   const segments = value.split("/");
   return value.length > 0 && segments.every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
 }
 function validateIdentity(value, label) {
-  if (!isRecord4(value) || !isAgentRef(value.agentRef) || !isNonEmptyString(value.sessionRef) || !isNonEmptyString(value.runtimeId) || !isNonEmptyString(value.cwd) || !path.isAbsolute(value.cwd)) {
+  if (!isRecord4(value) || !isAgentRef(value.agentRef) || !isNonEmptyString(value.sessionRef) || !isNonEmptyString(value.runtimeId) || !isNonEmptyString(value.cwd) || !path3__default.isAbsolute(value.cwd)) {
     throw new AgentContentAuditStoreError(`${label} has an invalid exact Agent/session identity`);
   }
   return Object.freeze({
@@ -12714,7 +13448,7 @@ function validateIdentity(value, label) {
     }),
     sessionRef: value.sessionRef,
     runtimeId: value.runtimeId,
-    cwd: path.resolve(value.cwd)
+    cwd: path3__default.resolve(value.cwd)
   });
 }
 function validateReceipt(value) {
@@ -12796,16 +13530,16 @@ function assertUniqueRequestIds(entries) {
   }
 }
 function assertAbsoluteFilePath(filePath) {
-  if (typeof filePath !== "string" || filePath.length === 0 || !path.isAbsolute(filePath)) {
+  if (typeof filePath !== "string" || filePath.length === 0 || !path3__default.isAbsolute(filePath)) {
     throw new AgentContentAuditStoreError("content audit path must be absolute");
   }
   if (/[\u0000\r\n]/u.test(filePath)) {
     throw new AgentContentAuditStoreError("content audit path must not contain NUL or line breaks");
   }
-  return path.resolve(filePath);
+  return path3__default.resolve(filePath);
 }
 async function ensureDirectoryNoSymlink2(directory) {
-  const absolute = path.resolve(directory);
+  const absolute = path3__default.resolve(directory);
   await promises.mkdir(absolute, { recursive: true, mode: 448 });
   const stat = await promises.lstat(absolute);
   if (!stat.isDirectory() || stat.isSymbolicLink()) {
@@ -12839,12 +13573,12 @@ var AgentContentAuditStore = class _AgentContentAuditStore {
   /** The daemon may address this ledger only through an AgentHomeLayout resolution. */
   static forCanonicalAgentHome(canonicalHome) {
     const home = assertAbsoluteFilePath(canonicalHome);
-    return new _AgentContentAuditStore(path.join(home, AGENT_HOME_INTERNAL_DIRECTORY, AGENT_CONTENT_AUDIT_FILENAME));
+    return new _AgentContentAuditStore(path3__default.join(home, AGENT_HOME_INTERNAL_DIRECTORY, AGENT_CONTENT_AUDIT_FILENAME));
   }
   async append(receipt) {
     const validated = validateReceipt(receipt);
     return this.enqueue(async () => {
-      await ensureDirectoryNoSymlink2(path.dirname(this.filePath));
+      await ensureDirectoryNoSymlink2(path3__default.dirname(this.filePath));
       await assertAuditFile(this.filePath);
       const entries = await this.readAllUnlocked();
       const prior = entries.find((entry) => entry.requestId === validated.requestId);
@@ -12939,6 +13673,63 @@ var AgentContentAuditStore = class _AgentContentAuditStore {
     return result;
   }
 };
+var AgentHomeProjectionCompletionError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "AgentHomeProjectionCompletionError";
+  }
+};
+function sameAgentRef2(left, right) {
+  return left.agentId === right.agentId && left.profileRevision === right.profileRevision;
+}
+var AgentHomeProjectionCompletionClient = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  async complete(input) {
+    const completion = AgentHomeProjectionCompletionRequestSchema.parse(input);
+    const url = new URL(
+      byokAgentHomeProjectionCompletionPath(completion.requestId),
+      toHttpBase(this.options.serverUrl)
+    );
+    let response;
+    try {
+      response = await authedFetch(
+        url,
+        {
+          method: "PUT",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify(completion)
+        },
+        this.options.auth
+      );
+    } catch (error) {
+      throw new AgentHomeProjectionCompletionError("Agent-home projection completion transport failed", {
+        cause: error
+      });
+    }
+    if (!response.ok) {
+      throw new AgentHomeProjectionCompletionError(
+        `Agent-home projection completion was rejected with HTTP ${response.status}`
+      );
+    }
+    let readback;
+    try {
+      readback = AgentHomeProjectionReadbackSchema.parse(await response.json());
+    } catch (error) {
+      throw new AgentHomeProjectionCompletionError("Agent-home projection completion readback is invalid", {
+        cause: error
+      });
+    }
+    if (readback.tenantId !== this.options.tenantId || readback.deviceId !== this.options.deviceId || readback.requestId !== completion.requestId || !sameAgentRef2(readback.agentRef, completion.agentRef) || readback.projectionHash !== completion.projectionHash || readback.status !== completion.outcome || readback.completedAt === void 0) {
+      throw new AgentHomeProjectionCompletionError(
+        "Agent-home projection completion readback does not exactly match the authenticated request"
+      );
+    }
+    return readback;
+  }
+};
 var AGENT_CONTENT_READ_SURFACES = ["workspace", "transcript", "artifact"];
 var AGENT_CONTENT_READ_CAPABILITIES = Object.freeze({
   workspace: AGENT_CONTENT_WORKSPACE_READ_CAPABILITY,
@@ -13042,8 +13833,8 @@ function normalizeIdentity(value, field) {
   const sessionRef = nonEmptyString(value.sessionRef, `${field}.sessionRef`);
   const runtimeId = nonEmptyString(value.runtimeId, `${field}.runtimeId`);
   const cwd = nonEmptyString(value.cwd, `${field}.cwd`);
-  if (!path.isAbsolute(cwd)) throw new AgentContentReadPolicyError(`${field}.cwd must be absolute`);
-  return Object.freeze({ agentRef, sessionRef, runtimeId, cwd: path.resolve(cwd) });
+  if (!path3__default.isAbsolute(cwd)) throw new AgentContentReadPolicyError(`${field}.cwd must be absolute`);
+  return Object.freeze({ agentRef, sessionRef, runtimeId, cwd: path3__default.resolve(cwd) });
 }
 function createAgentContentReadPolicy(input) {
   if (!isRecord5(input) || input.enabled !== true) {
@@ -13071,10 +13862,10 @@ function createAgentContentReadPolicy(input) {
     root = Object.freeze({ kind: "agent-home" });
   } else if (input.root.kind === "runtime-allowlisted") {
     const configuredRoot = nonEmptyString(input.root.root, "contentRead.root.root");
-    if (!path.isAbsolute(configuredRoot)) {
+    if (!path3__default.isAbsolute(configuredRoot)) {
       throw new AgentContentReadPolicyError("contentRead.root.root must be absolute");
     }
-    root = Object.freeze({ kind: "runtime-allowlisted", root: path.resolve(configuredRoot) });
+    root = Object.freeze({ kind: "runtime-allowlisted", root: path3__default.resolve(configuredRoot) });
   } else {
     throw new AgentContentReadPolicyError("contentRead.root.kind is not supported");
   }
@@ -13097,11 +13888,11 @@ function createAgentContentReadPolicy(input) {
   });
 }
 function isWithin2(root, candidate) {
-  const relative = path.relative(root, candidate);
-  return relative === "" || relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+  const relative = path3__default.relative(root, candidate);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path3__default.sep}`) && !path3__default.isAbsolute(relative);
 }
 function isPortableAbsoluteTarget(value) {
-  return path.isAbsolute(value) || /^[a-z]:[\\/]/iu.test(value) || /^[/\\]/u.test(value);
+  return path3__default.isAbsolute(value) || /^[a-z]:[\\/]/iu.test(value) || /^[/\\]/u.test(value);
 }
 function canonicalAuditTarget(value) {
   if (typeof value !== "string" || value.length === 0 || /[\u0000\r\n]/u.test(value) || isPortableAbsoluteTarget(value) || value.includes("\\")) {
@@ -13139,7 +13930,7 @@ function isSensitiveTarget(segments, productNames) {
   return segments.some((segment) => patterns.some((pattern) => nameMatches(pattern, segment)));
 }
 async function resolveExistingAncestor2(inputPath) {
-  let cursor = path.resolve(inputPath);
+  let cursor = path3__default.resolve(inputPath);
   const tail = [];
   for (; ; ) {
     try {
@@ -13147,9 +13938,9 @@ async function resolveExistingAncestor2(inputPath) {
     } catch (error) {
       const code = error.code;
       if (code !== "ENOENT" && code !== "ENOTDIR") throw error;
-      const parent = path.dirname(cursor);
+      const parent = path3__default.dirname(cursor);
       if (parent === cursor) throw new TargetPolicyError("target-missing");
-      tail.unshift(path.basename(cursor));
+      tail.unshift(path3__default.basename(cursor));
       cursor = parent;
     }
   }
@@ -13170,11 +13961,11 @@ var RootPolicyError = class extends Error {
     this.reason = reason;
   }
 };
-function sameAgentRef2(left, right) {
+function sameAgentRef3(left, right) {
   return left.agentId === right.agentId && left.profileRevision === right.profileRevision;
 }
 function sameSessionIdentity(left, right) {
-  return sameAgentRef2(left.agentRef, right.agentRef) && left.sessionRef === right.sessionRef && left.runtimeId === right.runtimeId && left.cwd === right.cwd;
+  return sameAgentRef3(left.agentRef, right.agentRef) && left.sessionRef === right.sessionRef && left.runtimeId === right.runtimeId && left.cwd === right.cwd;
 }
 function validateRequest(request) {
   if (!isRecord5(request)) throw new AgentContentReadRequestError("content read request must be an object");
@@ -13236,18 +14027,18 @@ function normalizeRequestIdentity(value, field) {
   const sessionRef = requestString(value.sessionRef, `${field}.sessionRef`);
   const runtimeId = requestString(value.runtimeId, `${field}.runtimeId`);
   const cwd = requestString(value.cwd, `${field}.cwd`);
-  if (!path.isAbsolute(cwd)) throw new AgentContentReadRequestError(`${field}.cwd must be absolute`);
-  return Object.freeze({ agentRef, sessionRef, runtimeId, cwd: path.resolve(cwd) });
+  if (!path3__default.isAbsolute(cwd)) throw new AgentContentReadRequestError(`${field}.cwd must be absolute`);
+  return Object.freeze({ agentRef, sessionRef, runtimeId, cwd: path3__default.resolve(cwd) });
 }
 async function inspectRegularTarget(root, target) {
   const ancestor = await resolveExistingAncestor2(target);
   if (!isWithin2(root, ancestor.canonical)) {
     throw new TargetPolicyError("path-escape");
   }
-  const components = path.relative(root, target).split(path.sep).filter((component) => component.length > 0);
+  const components = path3__default.relative(root, target).split(path3__default.sep).filter((component) => component.length > 0);
   let cursor = root;
   for (const [index, component] of components.entries()) {
-    cursor = path.join(cursor, component);
+    cursor = path3__default.join(cursor, component);
     let stat;
     try {
       stat = await promises.lstat(cursor);
@@ -13312,8 +14103,8 @@ var AgentContentReadPolicyEngine = class {
     this.capabilities = new Set(options.capabilities);
     this.runtimeRoots = Object.freeze((options.runtimeAllowlistedRoots ?? []).map((root, index) => {
       const value = nonEmptyString(root, `contentRead.runtimeAllowlistedRoots[${index}]`);
-      if (!path.isAbsolute(value)) throw new AgentContentReadPolicyError("runtime allowlisted roots must be absolute");
-      return path.resolve(value);
+      if (!path3__default.isAbsolute(value)) throw new AgentContentReadPolicyError("runtime allowlisted roots must be absolute");
+      return path3__default.resolve(value);
     }));
     this.resolveSessionIdentity = options.resolveSessionIdentity;
     this.resolveTranscriptIdentity = options.resolveTranscriptIdentity;
@@ -13365,7 +14156,7 @@ var AgentContentReadPolicyEngine = class {
     if (request.decodeAs === "utf8" && !policy.textMimeTypes.includes(request.mimeType)) {
       return this.deny(request, relativeTarget, "text-not-allowlisted");
     }
-    const target = path.resolve(root, ...segments);
+    const target = path3__default.resolve(root, ...segments);
     if (!isWithin2(root, target)) return this.deny(request, relativeTarget, "path-escape");
     try {
       await inspectRegularTarget(root, target);
@@ -13446,7 +14237,7 @@ var AgentContentReadPolicyEngine = class {
   }
   async checkSessionIdentity(request, resolver, requiredCwd) {
     const session = request.session;
-    if (session === void 0 || !sameAgentRef2(session.agentRef, request.agentRef) || requiredCwd !== void 0 && session.cwd !== requiredCwd) {
+    if (session === void 0 || !sameAgentRef3(session.agentRef, request.agentRef) || requiredCwd !== void 0 && session.cwd !== requiredCwd) {
       return "identity-mismatch";
     }
     let expected;
@@ -13562,7 +14353,7 @@ async function detectRuntimes(adapters) {
   }
   return runtimes;
 }
-function computeCapabilities(adapters, agentHomeConfigured = false, agentEgressConfigured = false, contentReadPolicies) {
+function computeCapabilities(adapters, agentHomeConfigured = false, strictAgentOnly = false, agentHomeProjectionConfigured = false, agentEgressConfigured = false, contentReadPolicies) {
   const flags = [];
   if (adapters.some((adapter) => adapter.descriptor.capabilities.steer)) flags.push("steer");
   flags.push("blob-upload");
@@ -13577,6 +14368,8 @@ function computeCapabilities(adapters, agentHomeConfigured = false, agentEgressC
     flags.push("toolset-selection");
   }
   if (agentHomeConfigured) flags.push("agent-home-contract");
+  if (strictAgentOnly) flags.push(STRICT_AGENT_ONLY_CAPABILITY);
+  if (agentHomeProjectionConfigured) flags.push(AGENT_HOME_PROJECTION_CAPABILITY);
   if (agentEgressConfigured) {
     flags.push(
       AGENT_EGRESS_POLICY_CAPABILITY,
@@ -13705,6 +14498,9 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
   if (config.agentEgress !== void 0 && config.agentHome === void 0) {
     throw new Error("DaemonConfig.agentEgress requires DaemonConfig.agentHome for the per-Agent local spool");
   }
+  if (config.strictAgentOnly === true && config.agentHome === void 0) {
+    throw new Error("DaemonConfig.strictAgentOnly requires DaemonConfig.agentHome");
+  }
   const egressPolicy = resolveAgentEgressPolicy(config.agentEgress?.policy);
   const egressBatcherOptions = egressPolicy.activity.mode === "contentful-trajectory" ? {
     ...config.progressBatch,
@@ -13720,7 +14516,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
   const deviceAssertionTtlMs = resolveDeviceAssertionTtlMs(config.deviceAssertion);
   let shuttingDown = false;
   const storeDir = DeviceStore.resolveDir(config.productId, config.storeDir);
-  const store = new DeviceStore(storeDir);
+  const store = new DeviceStore(storeDir, void 0, config.productId);
   const operationalHealth = new OperationalHealthTracker(storeDir);
   let fleetJitter;
   let maintenanceSequence = 0;
@@ -13734,6 +14530,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
     })
   });
   const agentSessionHandoffs = config.agentHome === void 0 ? void 0 : new AgentSessionHandoffStore();
+  if (config.strictAgentOnly === true) agentHomeManager?.preflightSync();
   const agentContentReadPolicies = resolveContentReadPolicies(egressPolicy, config.agentEgress?.contentRead);
   let agentEgress = new AgentEgressController({
     policy: egressPolicy,
@@ -13818,6 +14615,8 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
   let tenantRebinding = false;
   let runner;
   let controlServerHandle;
+  let serviceEnrollmentWaiting = false;
+  let serviceEnrollmentTransitioning = false;
   let daemonOwnerLease;
   let presencePublisher;
   let detectedRuntimeFacts = [];
@@ -13865,7 +14664,8 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
   }
   async function pair(pairingCode) {
     checkServerUrl();
-    return runLifecycleMutation(() => pairUnderLease(pairingCode));
+    const record = await runLifecycleMutation(() => pairUnderLease(pairingCode));
+    return Object.freeze({ deviceId: record.deviceId });
   }
   async function pairUnderLease(pairingCode) {
     const wasRunning = daemonStarted;
@@ -13876,7 +14676,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
     try {
       let previous;
       try {
-        previous = await store.load();
+        previous = await auth.readCurrent();
       } catch (error) {
         if (!(error instanceof DeviceRecordRePairRequiredError)) throw error;
       }
@@ -13911,6 +14711,28 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       throw err;
     }
   }
+  async function replaceControlServer(required, enrollmentOnly = false) {
+    if (controlServerHandle) {
+      await controlServerHandle.close();
+      controlServerHandle = void 0;
+    }
+    try {
+      const methods = enrollmentOnly ? {
+        unary: {
+          status: controlMethods.unary.status,
+          "enrollment.pair": controlMethods.unary["enrollment.pair"]
+        },
+        stream: {}
+      } : controlMethods;
+      controlServerHandle = await startControlServer({ storeDir, productId: config.productId, methods });
+    } catch (err) {
+      if (required || err instanceof AnotherControlServerRunningError) throw err;
+      console.warn(
+        `[byok/client] control socket failed to start (continuing without it): ${err instanceof Error ? err.message : String(err)}`
+      );
+      controlServerHandle = void 0;
+    }
+  }
   async function start() {
     checkServerUrl();
     await runLifecycleMutation(startUnderLease);
@@ -13918,14 +14740,27 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
   async function startUnderLease() {
     if (!daemonOwnerLease) daemonOwnerLease = await acquireDaemonOwner(storeDir, "daemon");
     try {
+      let record;
+      if (config.serviceEnrollment?.enabled === true) {
+        record = await auth.loadExisting();
+        if (!record) {
+          startedAt = Date.now();
+          serviceEnrollmentWaiting = true;
+          serviceEnrollmentTransitioning = false;
+          await replaceControlServer(true, true);
+          return;
+        }
+      }
+      serviceEnrollmentWaiting = false;
+      serviceEnrollmentTransitioning = false;
       initializeOwnedHostedStorage();
-      const activeJournal = journal;
-      const activePressureEngine = pressureEngine;
-      const activeOwnedPressureEngine = ownedPressureEngine;
-      const record = await auth.loadExisting();
+      record ??= await auth.loadExisting();
       if (!record) {
         throw new Error("device is not paired yet; call pair(pairingCode) first");
       }
+      const activeJournal = journal;
+      const activePressureEngine = pressureEngine;
+      const activeOwnedPressureEngine = ownedPressureEngine;
       if (config.agentEgress !== void 0) {
         agentEgress = new AgentEgressController({
           policy: egressPolicy,
@@ -13935,7 +14770,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       }
       await agentHomeManager?.preflight();
       if (config.agentEgress !== void 0 && config.agentHome !== void 0) {
-        await agentEgress.recover(path.join(config.agentHome.hostStorageRoot, "agents"));
+        await agentEgress.recover(path3__default.join(config.agentHome.hostStorageRoot, "agents"));
       }
       fleetJitter = createFleetJitter(config.productId, record.deviceId);
       if (config.permissionDefaults?.workspaceRoot !== void 0) {
@@ -13962,19 +14797,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         activeOwnedPressureEngine.start();
       }
       startedAt = Date.now();
-      if (controlServerHandle) {
-        await controlServerHandle.close();
-        controlServerHandle = void 0;
-      }
-      try {
-        controlServerHandle = await startControlServer({ storeDir, productId: config.productId, methods: controlMethods });
-      } catch (err) {
-        if (err instanceof AnotherControlServerRunningError) throw err;
-        console.warn(
-          `[byok/client] control socket failed to start (continuing without it): ${err instanceof Error ? err.message : String(err)}`
-        );
-        controlServerHandle = void 0;
-      }
+      await replaceControlServer(false);
       await operationalHealth.startRun();
       if (gitWorkspaceManager) {
         await gitWorkspaceManager.preflight();
@@ -13990,9 +14813,17 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       const capabilities = computeCapabilities(
         adapters,
         config.agentHome !== void 0,
+        config.strictAgentOnly === true,
+        agentHomeManager?.supportsTaskFreeProjection() === true,
         config.agentEgress !== void 0,
         agentContentReadPolicies
       );
+      const agentHomeProjectionCompletion = agentHomeManager?.supportsTaskFreeProjection() === true ? new AgentHomeProjectionCompletionClient({
+        serverUrl: config.serverUrl,
+        auth,
+        tenantId: record.tenantId,
+        deviceId: record.deviceId
+      }) : void 0;
       const journalIdentity = config.hostedJournal ? { tenantId: record.tenantId, productId: config.productId, deviceId: record.deviceId } : void 0;
       const sendSanitizedEnvelope = activeJournal && journalIdentity ? (envelope) => {
         observer.handleOutboundEnvelope(envelope);
@@ -14043,6 +14874,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         permissionDefaults: config.permissionDefaults,
         workspaceRoot: config.workspaceRoot,
         ...agentHomeManager === void 0 ? {} : { agentHome: agentHomeManager },
+        ...config.strictAgentOnly === true ? { strictAgentOnly: true } : {},
         ...agentSessionHandoffs === void 0 ? {} : { agentSessionHandoffs },
         deviceId: record.deviceId,
         // M5: see `DaemonConfig.runtimeEnvironment`'s own doc comment above.
@@ -14129,6 +14961,20 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         ...activePressureEngine ? { admissionGuard: () => activePressureEngine.admissionGuard() } : {}
       };
       runner = new TaskRunner(deps);
+      const handleAgentHomeProjectionEnvelope = async (envelope) => {
+        if (envelope.type !== "agent.home.projection") return false;
+        if (agentHomeManager === void 0 || agentHomeProjectionCompletion === void 0) {
+          throw new Error("task-free Agent-home projection is not configured on this daemon");
+        }
+        const outcome = await agentHomeManager.project(envelope.payload);
+        await agentHomeProjectionCompletion.complete({
+          requestId: envelope.payload.requestId,
+          agentRef: envelope.payload.agentRef,
+          projectionHash: envelope.payload.projectionHash,
+          outcome
+        });
+        return true;
+      };
       const handleAgentEgressEnvelope = async (envelope) => {
         if (envelope.type !== "agent.egress.ack") return false;
         if (config.agentEgress === void 0) return true;
@@ -14284,6 +15130,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
             throw new Error("tenant enrollment is being re-paired; inbound work is blocked until restart");
           }
           observer.handleInboundEnvelope(envelope);
+          if (await handleAgentHomeProjectionEnvelope(envelope)) return;
           if (await handleAgentEgressEnvelope(envelope)) return;
           if (await handleAgentContentReadEnvelope(envelope)) return;
           activePressureEngine?.assertAckCriticalAllowed();
@@ -14294,6 +15141,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
             return Promise.reject(new Error("tenant enrollment is being re-paired; inbound work is blocked until restart"));
           }
           observer.handleInboundEnvelope(envelope);
+          if (envelope.type === "agent.home.projection") return handleAgentHomeProjectionEnvelope(envelope).then(() => void 0);
           if (envelope.type === "agent.egress.ack") return handleAgentEgressEnvelope(envelope).then(() => void 0);
           if (envelope.type === "agent.content.read") return handleAgentContentReadEnvelope(envelope).then(() => void 0);
           return runner?.handleEnvelope(envelope) ?? Promise.resolve();
@@ -14492,10 +15340,24 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
     await runShutdownSequence("operator");
     const cleanupLease = await acquireDaemonOwner(storeDir, "daemon");
     try {
-      const current = await store.remove();
-      if (current) {
-        await cursorStore.clear(config.serverUrl, current.deviceId);
+      let current;
+      try {
+        current = await auth.readCurrent();
+      } catch (error) {
+        if (!(error instanceof DeviceRecordRePairRequiredError)) throw error;
+      }
+      try {
+        await store.credentials.clear();
+      } catch {
+        throw new Error("device credential could not be cleared; enrollment remains paired and fail-closed");
+      }
+      try {
+        await store.remove();
+      } catch (error) {
+        auth = buildAuthManager();
+        throw error;
       }
+      if (current) await cursorStore.clear(config.serverUrl, current.deviceId);
     } finally {
       await cleanupLease.release();
     }
@@ -14577,6 +15439,38 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
   const controlMethods = {
     unary: {
       status: () => buildControlStatus(),
+      "enrollment.pair": async (params) => {
+        if (config.serviceEnrollment?.enabled !== true) {
+          throw new ControlError("enrollment_disabled", "service enrollment is not enabled for this daemon");
+        }
+        const parsed = parseEnrollmentPairParams(params);
+        if (!parsed) {
+          throw new ControlError(
+            "bad_request",
+            `enrollment.pair requires exactly {pairingCode} with 1-${ENROLLMENT_PAIRING_CODE_MAX_BYTES} UTF-8 bytes`
+          );
+        }
+        if (!serviceEnrollmentWaiting || daemonStarted) {
+          throw new ControlError("already_paired", "this service daemon is not waiting for initial enrollment");
+        }
+        if (serviceEnrollmentTransitioning) {
+          throw new ControlError("pairing_in_progress", "service enrollment is already in progress");
+        }
+        serviceEnrollmentTransitioning = true;
+        let record;
+        try {
+          record = await runLifecycleMutation(() => pairUnderLease(parsed.pairingCode));
+        } catch (err) {
+          serviceEnrollmentTransitioning = false;
+          throw err;
+        }
+        setImmediate(() => {
+          void runLifecycleMutation(startUnderLease).catch(() => {
+            console.error("[byok/client] service enrollment persisted but normal daemon startup failed");
+          });
+        });
+        return { deviceId: record.deviceId };
+      },
       "toolsets.reload": (params) => {
         const parsed = parseToolsetsReloadParams(params);
         if (!parsed) {
@@ -14687,7 +15581,12 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
           observer.noteDeviceAssertion({ result: "denied", reason: "revoked", audience: parsed.audience });
           throw new ControlError("revoked", "this device has been revoked by the server; re-pair required");
         }
-        const record = await store.load();
+        let record;
+        try {
+          record = await auth.readCurrent();
+        } catch (error) {
+          if (!(error instanceof DeviceRecordRePairRequiredError)) throw error;
+        }
         if (record === void 0) {
           observer.noteDeviceAssertion({ result: "denied", reason: "not_paired", audience: parsed.audience });
           throw new ControlError("not_paired", "this device is not paired; nothing can be asserted about it");
@@ -15155,9 +16054,9 @@ function plistString(value) {
 function generateLaunchdPlist(def) {
   const { label, program, logDir } = def;
   const args = [program.command, ...program.args];
-  const cwd = program.cwd ?? os.homedir();
-  const outLog = path.join(logDir, `${label}.out.log`);
-  const errLog = path.join(logDir, `${label}.err.log`);
+  const cwd = program.cwd ?? os__default.homedir();
+  const outLog = path3__default.join(logDir, `${label}.out.log`);
+  const errLog = path3__default.join(logDir, `${label}.err.log`);
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -15189,8 +16088,8 @@ ${args.map((a) => `    ${plistString(a)}`).join("\n")}
 }
 function createLaunchdLifecycle(def, deps = {}) {
   const run = deps.run ?? defaultRunner;
-  const fs26 = deps.fs ?? promises;
-  const homedir = deps.homedir ?? (() => os.homedir());
+  const fs28 = deps.fs ?? promises;
+  const homedir = deps.homedir ?? (() => os__default.homedir());
   const getuid = deps.getuid ?? (() => {
     if (typeof process.getuid !== "function") {
       throw new Error("launchd lifecycle requires a POSIX uid (process.getuid unavailable) \u2014 this module only runs on macOS");
@@ -15198,12 +16097,12 @@ function createLaunchdLifecycle(def, deps = {}) {
     return process.getuid();
   });
   const label = sanitizeServiceName(def.name);
-  const plistPath = () => path.join(homedir(), "Library", "LaunchAgents", `${label}.plist`);
+  const plistPath = () => path3__default.join(homedir(), "Library", "LaunchAgents", `${label}.plist`);
   const domainTarget = () => `gui/${getuid()}`;
   const serviceTarget = () => `${domainTarget()}/${label}`;
   async function fileExists(p) {
     try {
-      await fs26.stat(p);
+      await fs28.stat(p);
       return true;
     } catch {
       return false;
@@ -15211,9 +16110,9 @@ function createLaunchdLifecycle(def, deps = {}) {
   }
   async function writePlist(program) {
     const xml = generateLaunchdPlist({ label, program, logDir: def.logDir });
-    await fs26.mkdir(path.dirname(plistPath()), { recursive: true });
-    await fs26.mkdir(def.logDir, { recursive: true });
-    await fs26.writeFile(plistPath(), xml, "utf8");
+    await fs28.mkdir(path3__default.dirname(plistPath()), { recursive: true });
+    await fs28.mkdir(def.logDir, { recursive: true });
+    await fs28.writeFile(plistPath(), xml, "utf8");
   }
   async function install(opts = {}) {
     await writePlist(opts.program ?? def.program);
@@ -15224,7 +16123,7 @@ function createLaunchdLifecycle(def, deps = {}) {
   }
   async function uninstall() {
     await runIdempotent(run, "launchctl", ["bootout", serviceTarget()], "launchctl bootout", LAUNCHD_NOT_LOADED);
-    await fs26.rm(plistPath(), { force: true });
+    await fs28.rm(plistPath(), { force: true });
   }
   async function start() {
     if (!await fileExists(plistPath())) {
@@ -15283,10 +16182,10 @@ function generateSystemdUnit(def) {
   const { name, displayName, program, logDir } = def;
   assertNoControlChars(name, "name");
   assertNoControlChars(displayName, "displayName");
-  const cwd = program.cwd ?? os.homedir();
+  const cwd = program.cwd ?? os__default.homedir();
   assertNoControlChars(cwd, "program.cwd");
-  const outLog = path.join(logDir, `${name}.out.log`);
-  const errLog = path.join(logDir, `${name}.err.log`);
+  const outLog = path3__default.join(logDir, `${name}.out.log`);
+  const errLog = path3__default.join(logDir, `${name}.err.log`);
   assertNoControlChars(outLog, "logDir");
   assertNoControlChars(errLog, "logDir");
   const execStart = [program.command, ...program.args].map(quoteSystemdArg).join(" ");
@@ -15308,14 +16207,14 @@ WantedBy=default.target
 }
 function createSystemdLifecycle(def, deps = {}) {
   const run = deps.run ?? defaultRunner;
-  const fs26 = deps.fs ?? promises;
-  const homedir = deps.homedir ?? (() => os.homedir());
+  const fs28 = deps.fs ?? promises;
+  const homedir = deps.homedir ?? (() => os__default.homedir());
   const name = sanitizeServiceName(def.name);
   const unitName = `${name}.service`;
-  const unitPath = () => path.join(homedir(), ".config", "systemd", "user", unitName);
+  const unitPath = () => path3__default.join(homedir(), ".config", "systemd", "user", unitName);
   async function fileExists(p) {
     try {
-      await fs26.stat(p);
+      await fs28.stat(p);
       return true;
     } catch {
       return false;
@@ -15323,9 +16222,9 @@ function createSystemdLifecycle(def, deps = {}) {
   }
   async function writeUnit(program) {
     const unit = generateSystemdUnit({ name, displayName: def.displayName ?? def.name, program, logDir: def.logDir });
-    await fs26.mkdir(path.dirname(unitPath()), { recursive: true });
-    await fs26.mkdir(def.logDir, { recursive: true });
-    await fs26.writeFile(unitPath(), unit, "utf8");
+    await fs28.mkdir(path3__default.dirname(unitPath()), { recursive: true });
+    await fs28.mkdir(def.logDir, { recursive: true });
+    await fs28.writeFile(unitPath(), unit, "utf8");
   }
   async function install(opts = {}) {
     await writeUnit(opts.program ?? def.program);
@@ -15334,7 +16233,7 @@ function createSystemdLifecycle(def, deps = {}) {
   }
   async function uninstall() {
     await runIdempotent(run, "systemctl", ["--user", "disable", "--now", unitName], "systemctl disable --now", SYSTEMD_NOT_LOADED);
-    await fs26.rm(unitPath(), { force: true });
+    await fs28.rm(unitPath(), { force: true });
     await run("systemctl", ["--user", "daemon-reload"]);
   }
   async function start() {
@@ -15397,7 +16296,7 @@ ${argXml}${cwdXml}
 }
 function createWinswLifecycle(def, deps = {}) {
   const run = deps.run ?? defaultRunner;
-  const fs26 = deps.fs ?? promises;
+  const fs28 = deps.fs ?? promises;
   const windows = def.windows;
   if (!windows) {
     throw new Error("WinSW service lifecycle requires `ServiceDefinition.windows.winswBin` (the product-bundled WinSW executable path)");
@@ -15405,11 +16304,11 @@ function createWinswLifecycle(def, deps = {}) {
   const winswBin = windows.winswBin;
   const id = sanitizeServiceName(def.name);
   const installDir = windows.installDir ?? def.logDir;
-  const exePath = path.join(installDir, `${id}.exe`);
-  const xmlPath = path.join(installDir, `${id}.xml`);
+  const exePath = path3__default.join(installDir, `${id}.exe`);
+  const xmlPath = path3__default.join(installDir, `${id}.xml`);
   async function fileExists(p) {
     try {
-      await fs26.stat(p);
+      await fs28.stat(p);
       return true;
     } catch {
       return false;
@@ -15417,10 +16316,10 @@ function createWinswLifecycle(def, deps = {}) {
   }
   async function writeFiles(program) {
     const xml = generateWinswXml({ id, displayName: def.displayName ?? def.name, program, logDir: def.logDir });
-    await fs26.mkdir(installDir, { recursive: true });
-    await fs26.mkdir(def.logDir, { recursive: true });
-    await fs26.copyFile(winswBin, exePath);
-    await fs26.writeFile(xmlPath, xml, "utf8");
+    await fs28.mkdir(installDir, { recursive: true });
+    await fs28.mkdir(def.logDir, { recursive: true });
+    await fs28.copyFile(winswBin, exePath);
+    await fs28.writeFile(xmlPath, xml, "utf8");
   }
   async function install(opts = {}) {
     await writeFiles(opts.program ?? def.program);
@@ -15430,8 +16329,8 @@ function createWinswLifecycle(def, deps = {}) {
   async function uninstall() {
     await runIdempotent(run, exePath, ["stop"], "winsw stop", WINSW_NOT_INSTALLED);
     await runIdempotent(run, exePath, ["uninstall"], "winsw uninstall", WINSW_NOT_INSTALLED);
-    await fs26.rm(exePath, { force: true });
-    await fs26.rm(xmlPath, { force: true });
+    await fs28.rm(exePath, { force: true });
+    await fs28.rm(xmlPath, { force: true });
   }
   async function start() {
     if (!await fileExists(xmlPath)) {
@@ -15476,7 +16375,7 @@ function createServiceLifecycle(def, opts = {}) {
 
 // src/bin/official-release.ts
 var OFFICIAL_LOCAL_AGENT_RELEASE = resolveLocalAgentReleaseIdentity({
-  version: "0.8.0-beta.0"
+  version: "0.8.1"
 });
 
 // src/bin/config.ts
@@ -15871,7 +16770,23 @@ async function resolveApproval(storeDir, productId, approvalId, decision, reason
 // src/bin/commands/pair.ts
 async function runPairCommand(config, code, deps = {}) {
   const log = deps.log ?? ((line) => console.log(line));
-  const daemon = deps.daemon ?? createDaemon(config);
+  if (deps.daemon) {
+    const result2 = await deps.daemon.pair(code);
+    log(`paired: deviceId=${result2.deviceId}`);
+    return;
+  }
+  const connectControl = deps.connectControl ?? connectControlClient;
+  const conn = await connectControl({ storeDir: resolveStoreDir(config), productId: config.productId });
+  if (conn.ok) {
+    try {
+      const result2 = await conn.client.request("enrollment.pair", { pairingCode: code });
+      log(`paired: deviceId=${result2.deviceId}`);
+      return;
+    } finally {
+      conn.client.close();
+    }
+  }
+  const daemon = createDaemon(config);
   const result = await daemon.pair(code);
   log(`paired: deviceId=${result.deviceId}`);
 }
@@ -15961,7 +16876,7 @@ function safeProtocol(serverUrl) {
   }
 }
 async function inspectDevice(storeDir) {
-  const filePath = path.join(storeDir, "device.json");
+  const filePath = path3__default.join(storeDir, "device.json");
   let pathStat;
   try {
     pathStat = await promises.lstat(filePath);
@@ -16041,11 +16956,11 @@ async function copyOpenFileBounded(source, expected, destinationPath) {
   }
 }
 async function inspectJournal(storeDir) {
-  const journalPath = path.join(storeDir, JOURNAL_DB_FILENAME);
+  const journalPath = path3__default.join(storeDir, JOURNAL_DB_FILENAME);
   try {
     const mainIdentity = await regularFileIdentity(journalPath);
     if (mainIdentity === void 0) return { status: "missing" };
-    const walIdentity = await regularFileIdentity(path.join(storeDir, `${JOURNAL_DB_FILENAME}-wal`));
+    const walIdentity = await regularFileIdentity(path3__default.join(storeDir, `${JOURNAL_DB_FILENAME}-wal`));
     let sizeBytes = Number(mainIdentity.size);
     let walBytes = walIdentity === void 0 ? void 0 : Number(walIdentity.size);
     if (!isSqliteAvailable()) {
@@ -16053,7 +16968,7 @@ async function inspectJournal(storeDir) {
     }
     const componentNames = [JOURNAL_DB_FILENAME, `${JOURNAL_DB_FILENAME}-wal`, `${JOURNAL_DB_FILENAME}-shm`];
     const initial = /* @__PURE__ */ new Map();
-    for (const name of componentNames) initial.set(name, await regularFileIdentity(path.join(storeDir, name)));
+    for (const name of componentNames) initial.set(name, await regularFileIdentity(path3__default.join(storeDir, name)));
     const snapshotMain = initial.get(JOURNAL_DB_FILENAME);
     if (!snapshotMain) return { status: "unavailable", reason: "journal changed during diagnostics snapshot" };
     sizeBytes = Number(snapshotMain.size);
@@ -16065,7 +16980,7 @@ async function inspectJournal(storeDir) {
         let handle;
         try {
           handle = await promises.open(
-            path.join(storeDir, name),
+            path3__default.join(storeDir, name),
             constants.O_RDONLY | constants.O_NONBLOCK | (constants.O_NOFOLLOW ?? 0)
           );
         } catch (err) {
@@ -16094,28 +17009,28 @@ async function inspectJournal(storeDir) {
           reason: "journal exceeds the bounded diagnostics copy limit"
         };
       }
-      const tempDir = await promises.mkdtemp(path.join(os.tmpdir(), "byok-journal-inspect-"));
+      const tempDir = await promises.mkdtemp(path3__default.join(os__default.tmpdir(), "byok-journal-inspect-"));
       const { DatabaseSync } = loadSqliteModule();
       let db;
       try {
         for (const name of componentNames) {
           const component = opened.get(name);
-          if (component && !await copyOpenFileBounded(component.handle, component.identity, path.join(tempDir, name))) {
+          if (component && !await copyOpenFileBounded(component.handle, component.identity, path3__default.join(tempDir, name))) {
             return { status: "unavailable", sizeBytes, ...walBytes === void 0 ? {} : { walBytes }, reason: "journal changed during diagnostics snapshot" };
           }
         }
         for (const [name, component] of opened) {
-          if (!sameIdentity(component.identity, identityFromBigIntStat(await component.handle.stat({ bigint: true }))) || !sameIdentity(component.identity, await regularFileIdentity(path.join(storeDir, name)))) {
+          if (!sameIdentity(component.identity, identityFromBigIntStat(await component.handle.stat({ bigint: true }))) || !sameIdentity(component.identity, await regularFileIdentity(path3__default.join(storeDir, name)))) {
             return { status: "unavailable", sizeBytes, ...walBytes === void 0 ? {} : { walBytes }, reason: "journal changed during diagnostics snapshot" };
           }
         }
         for (const name of componentNames) {
-          if (!opened.has(name) && await regularFileIdentity(path.join(storeDir, name)) !== void 0) {
+          if (!opened.has(name) && await regularFileIdentity(path3__default.join(storeDir, name)) !== void 0) {
             return { status: "unavailable", sizeBytes, ...walBytes === void 0 ? {} : { walBytes }, reason: "journal changed during diagnostics snapshot" };
           }
         }
         const header = Buffer.alloc(16);
-        const copiedHandle = await promises.open(path.join(tempDir, JOURNAL_DB_FILENAME), "r");
+        const copiedHandle = await promises.open(path3__default.join(tempDir, JOURNAL_DB_FILENAME), "r");
         try {
           const { bytesRead } = await copiedHandle.read(header, 0, header.length, 0);
           if (bytesRead !== 16 || header.toString("binary") !== "SQLite format 3\0") {
@@ -16124,7 +17039,7 @@ async function inspectJournal(storeDir) {
         } finally {
           await copiedHandle.close();
         }
-        db = new DatabaseSync(path.join(tempDir, JOURNAL_DB_FILENAME), { readOnly: true });
+        db = new DatabaseSync(path3__default.join(tempDir, JOURNAL_DB_FILENAME), { readOnly: true });
         const result = db.prepare("PRAGMA quick_check(1)").get();
         if (result?.quick_check !== "ok") {
           return { status: "corrupt", sizeBytes, ...walBytes === void 0 ? {} : { walBytes }, reason: "journal quick_check failed" };
@@ -16159,7 +17074,7 @@ async function inspectWorkspace(workspaceRoot) {
   }
 }
 function readPinnedQuarantineFile(name, maxBytes, includeBytes, budget) {
-  if (path.basename(name) !== name || name === "." || name === "..") {
+  if (path3__default.basename(name) !== name || name === "." || name === "..") {
     throw new Error("quarantine manifest contains an invalid evidence name");
   }
   const namedBefore = lstatSync(name, { bigint: true });
@@ -16263,10 +17178,10 @@ function inspectQuarantinePinned(dir, expectedDirectory) {
       if (isJournalQuarantineManifest(parsed)) {
         const manifestBase = manifestName.slice(0, -".manifest.json".length);
         const boundNames = parsed.files.map((file) => {
-          if (path.dirname(path.resolve(file)) !== path.resolve(".")) {
+          if (path3__default.dirname(path3__default.resolve(file)) !== path3__default.resolve(".")) {
             throw new Error("journal quarantine manifest points outside quarantine");
           }
-          return path.basename(file);
+          return path3__default.basename(file);
         });
         if (!boundNames.includes(manifestBase)) {
           throw new Error("journal quarantine manifest is not bound to its primary database evidence");
@@ -16306,7 +17221,7 @@ function inspectQuarantinePinned(dir, expectedDirectory) {
   }
 }
 async function inspectQuarantine(storeDir) {
-  const dir = path.join(storeDir, JOURNAL_QUARANTINE_DIRNAME);
+  const dir = path3__default.join(storeDir, JOURNAL_QUARANTINE_DIRNAME);
   let directory;
   try {
     directory = await promises.lstat(dir, { bigint: true });
@@ -16377,7 +17292,7 @@ function checksFor(snapshot) {
   ];
 }
 async function collectDiagnostics(config, storeDir, options = {}) {
-  const resolvedStoreDir = path.resolve(storeDir);
+  const resolvedStoreDir = path3__default.resolve(storeDir);
   const adapters = options.adapters ?? defaultRuntimeAdapters(config.runtimeAllowlist);
   const connectControl = options.connectControl ?? connectControlClient;
   const [device, probedRuntimes, health, journal, workspace, quarantine, controlConnection] = await Promise.all([
@@ -16552,7 +17467,7 @@ function publishQuarantineEvidencePinned(quarantineDir, expectedDirectory, sourc
     unlinkSync(sourcePath);
     sourceRemoved = true;
     if (process.platform !== "win32") {
-      const directoryFd = openSync(path.dirname(sourcePath), constants.O_RDONLY);
+      const directoryFd = openSync(path3__default.dirname(sourcePath), constants.O_RDONLY);
       try {
         fsyncSync(directoryFd);
       } finally {
@@ -16591,10 +17506,10 @@ function publishQuarantineEvidencePinned(quarantineDir, expectedDirectory, sourc
   }
 }
 async function quarantineCorruptOperationalHealth(storeDir, options = {}) {
-  const resolvedStoreDir = path.resolve(storeDir);
+  const resolvedStoreDir = path3__default.resolve(storeDir);
   const owner = await acquireDaemonOwner(resolvedStoreDir, "doctor", options.clock);
   try {
-    const sourcePath = path.join(resolvedStoreDir, OPERATIONAL_HEALTH_FILENAME);
+    const sourcePath = path3__default.join(resolvedStoreDir, OPERATIONAL_HEALTH_FILENAME);
     let opened;
     try {
       opened = await openOperationalHealthFile(resolvedStoreDir);
@@ -16611,7 +17526,7 @@ async function quarantineCorruptOperationalHealth(storeDir, options = {}) {
       }
       const sourceStat = await source.stat({ bigint: true });
       if (!sourceStat.isFile()) throw new Error("operational health state is not a regular file; refusing quarantine");
-      const quarantineDir = path.join(resolvedStoreDir, JOURNAL_QUARANTINE_DIRNAME);
+      const quarantineDir = path3__default.join(resolvedStoreDir, JOURNAL_QUARANTINE_DIRNAME);
       try {
         const existing = await promises.lstat(quarantineDir);
         if (!existing.isDirectory() || existing.isSymbolicLink()) {
@@ -16712,8 +17627,8 @@ function buildServiceDefinition(config, configPath, rest) {
   const name = argValue(rest, "--name") ?? config.productId;
   const agentBin = argValue(rest, "--agent-bin") ?? process.argv[1] ?? "byok-agent";
   const nodeBin = argValue(rest, "--node-bin") ?? process.execPath;
-  const absoluteConfigPath = path.resolve(configPath);
-  const logDir = path.join(resolveStoreDir(config), "service-logs");
+  const absoluteConfigPath = path3__default.resolve(configPath);
+  const logDir = path3__default.join(resolveStoreDir(config), "service-logs");
   const definition = {
     name,
     displayName: config.branding?.displayName ?? config.productName,
@@ -16767,7 +17682,7 @@ async function runServiceStatusCommand(config, configPath, rest, deps = {}) {
   log(`detail: ${status.detail.trim() || "(none)"}`);
 }
 function auditLogPath(storeDir) {
-  return path.join(storeDir, "audit.jsonl");
+  return path3__default.join(storeDir, "audit.jsonl");
 }
 var AUDIT_LOG_MODE = 384;
 var AUDIT_STORE_DIR_MODE = 448;
@@ -17605,11 +18520,11 @@ async function createSupportBundle(config, storeDir, options = {}) {
   };
 }
 async function writeSupportBundle(outputPath, bundle, secureFileOptions = {}) {
-  const dir = path.dirname(outputPath);
+  const dir = path3__default.dirname(outputPath);
   const parentStat = await promises.stat(dir);
   if (!parentStat.isDirectory()) throw new Error("support bundle output parent is not a directory");
-  const privateDir = path.join(dir, `.${path.basename(outputPath)}.${process.pid}.${randomUUID()}.private`);
-  const tempPath = path.join(privateDir, "bundle.tmp");
+  const privateDir = path3__default.join(dir, `.${path3__default.basename(outputPath)}.${process.pid}.${randomUUID()}.private`);
+  const tempPath = path3__default.join(privateDir, "bundle.tmp");
   try {
     await promises.mkdir(privateDir, { mode: 448 });
     await ensureSecureDir(privateDir, secureFileOptions);
@@ -17639,7 +18554,7 @@ async function writeSupportBundle(outputPath, bundle, secureFileOptions = {}) {
 // src/bin/commands/support-bundle.ts
 async function runSupportBundleCommand(config, options) {
   if (!options.outputPath) throw new Error("support-bundle requires --output <path>");
-  const outputPath = path.resolve(options.outputPath);
+  const outputPath = path3__default.resolve(options.outputPath);
   const bundle = await createSupportBundle(config, resolveStoreDir(config), options);
   await writeSupportBundle(outputPath, bundle);
   const log = options.log ?? ((line) => console.log(line));
@@ -17675,8 +18590,8 @@ async function runTasksFollowCommand(config, deps) {
     });
     return;
   }
-  const path34 = auditLogPath(storeDir);
-  await followAuditLog(path34, (event) => log(formatDaemonEventLine(event)), {
+  const path36 = auditLogPath(storeDir);
+  await followAuditLog(path36, (event) => log(formatDaemonEventLine(event)), {
     signal: deps.signal,
     pollIntervalMs: deps.pollIntervalMs,
     fromEnd: true