@byok-sdk/client 0.8.0 → 0.9.0-rc.1

package/dist/daemon/agent-message-outbox.d.ts

@@ -0,0 +1,58 @@
+import { type AgentMessageContentType, type AgentMessageEgressRequirement, type AgentMessagePublishPayload } from '@byok-sdk/protocol';
+import type { AgentRef } from '../agent-home';
+export declare const AGENT_MESSAGE_DIRECTORY: string;
+export declare const AGENT_MESSAGE_OUTBOX_FILENAME = "outbox-v1.jsonl";
+export interface AgentMessageOutboxRecord {
+    readonly schema: 1;
+    readonly taskId: string;
+    readonly tenantId: string;
+    readonly agentRef: AgentRef;
+    readonly contract: string;
+    readonly messageId: string;
+    readonly cursor: number;
+    readonly contentType: AgentMessageContentType;
+    readonly body: string;
+    readonly contentHash: string;
+    readonly byteCount: number;
+    readonly createdAt: string;
+    readonly sessionRef?: string;
+}
+export declare class AgentMessageOutboxError extends Error {
+    constructor(message: string);
+}
+/** Agent-local, append-before-send outbox. Only exact accepted disposition retires bytes. */
+export declare class AgentMessageOutbox {
+    readonly homeDir: string;
+    readonly outboxPath: string;
+    private readonly pendingByTask;
+    private readonly dispositionByTask;
+    private nextCursor;
+    private logEntries;
+    private writeTail;
+    private constructor();
+    static open(homeDir: string): Promise<AgentMessageOutbox>;
+    /** Re-open every existing Agent-local message outbox without following Agent-home symlinks. */
+    static recover(agentsRoot: string, tenantId: string): Promise<readonly AgentMessageOutbox[]>;
+    records(): readonly AgentMessageOutboxRecord[];
+    /** Activated records with no exact disposition yet; only these may be transport-replayed. */
+    retryableRecords(): readonly AgentMessageOutboxRecord[];
+    get(taskId: string): AgentMessageOutboxRecord | undefined;
+    appendDraft(input: {
+        readonly taskId: string;
+        readonly tenantId: string;
+        readonly agentRef: AgentRef;
+        readonly requirement: AgentMessageEgressRequirement;
+        readonly contentType: AgentMessageContentType;
+        readonly body: string;
+        readonly sessionRef?: string;
+        readonly maxPendingEvents: number;
+        readonly maxPendingBytes: number;
+    }): Promise<AgentMessageOutboxRecord>;
+    activate(taskId: string, sessionRef: string): Promise<AgentMessageOutboxRecord | undefined>;
+    publishPayload(record: AgentMessageOutboxRecord): AgentMessagePublishPayload;
+    applyDisposition(taskId: string, input: unknown): Promise<'accepted' | 'held' | 'refused' | 'mismatch' | 'unknown'>;
+    private load;
+    private appendEntry;
+    private compact;
+    private exclusive;
+}

package/dist/daemon/auth-manager.d.ts

@@ -1,4 +1,5 @@
 import { DeviceStore, type DeviceRecord } from './store';
+import type { DeviceCredentialStore, InMemoryDeviceCredentialStore } from './device-credential-store';
 /**
  * Thrown when the server has revoked this device: a 401 on `/byok/challenge`
  * or `/byok/token` (protocol §6.3). The only recourse is a fresh
@@ -11,6 +12,8 @@ export declare class DeviceRevokedError extends Error {
 export interface AuthManagerOptions {
     serverUrl: string;
     store: DeviceStore;
+    /** Internal-only credential custody seam. Product construction uses store.credentials. */
+    credentials?: DeviceCredentialStore | InMemoryDeviceCredentialStore;
     deviceName?: string;
     /** Called once revocation is detected, so a caller (ConnectionManager) can stop retrying and surface the state instead of looping. */
     onRevoked?: () => void;
@@ -31,9 +34,12 @@ export declare class AuthManager {
     private stopped;
     private pairing;
     private credentialMutationTail;
+    private readonly credentials;
     constructor(opts: AuthManagerOptions);
     get deviceId(): string | undefined;
     isRevoked(): boolean;
+    /** Internal signer read: always recompose metadata with the current OS secret authority. */
+    readCurrent(): Promise<DeviceRecord | undefined>;
     /** Load a previously-paired device record from disk, if any (idempotent — a second call is a no-op once loaded). */
     loadExisting(): Promise<DeviceRecord | undefined>;
     /** `POST /byok/pair` (v2): generates a device keypair on first pair, reuses it on any subsequent (e.g. post-revocation) re-pair. */
@@ -49,4 +55,6 @@ export declare class AuthManager {
     private markRevoked;
     private scheduleProactiveRenewal;
     private runCredentialMutation;
+    /** Read the current paired authority afresh; metadata without its OS secret is re-pair required. */
+    private loadRecord;
 }

package/dist/daemon/control-protocol.d.ts

@@ -281,6 +281,17 @@ export interface ToolsetsReloadParams {
     expectedRevision: string;
     mcpToolsets: Record<string, McpToolsetConfig>;
 }
+/** Maximum opaque pairing-code payload accepted over local control IPC. */
+export declare const ENROLLMENT_PAIRING_CODE_MAX_BYTES = 1024;
+export interface EnrollmentPairParams {
+    pairingCode: string;
+}
+/**
+ * Exact shape gate for service-identity pairing. The code is opaque server
+ * authority: this only bounds transport bytes and rejects unknown fields; it
+ * never parses, normalizes or logs the code.
+ */
+export declare function parseEnrollmentPairParams(value: unknown): EnrollmentPairParams | undefined;
 /** Shape-only parser; executable definition validation remains registry-owned. */
 export declare function parseToolsetsReloadParams(value: unknown): ToolsetsReloadParams | undefined;
 export interface ApprovalsListResult {
@@ -312,6 +323,31 @@ export interface ApprovalsRequestResult {
     approved: boolean;
     reason?: string;
 }
+export interface AgentMessagePublishParams {
+    contextToken: string;
+    contentType: 'text/plain' | 'text/markdown';
+    body: string;
+}
+export declare function parseAgentMessagePublishParams(value: unknown): AgentMessagePublishParams | undefined;
+export interface AgentMessagePublishResult {
+    messageId: string;
+    state: 'staged' | 'pending';
+}
+export interface AgentMemoryRecallParams {
+    contextToken: string;
+    path: string;
+    ifRevision?: string;
+}
+export interface AgentMemorySaveParams {
+    contextToken: string;
+    op: 'replace' | 'delete';
+    path: string;
+    expectedRevision: string;
+    content?: string;
+}
+/** Parser only validates the local IPC shape. Agent identity and memory root stay daemon-owned. */
+export declare function parseAgentMemoryRecallParams(value: unknown): AgentMemoryRecallParams | undefined;
+export declare function parseAgentMemorySaveParams(value: unknown): AgentMemorySaveParams | undefined;
 /**
  * Params for `assertion.issue`: a sibling local process (the host's own CLI,
  * installed alongside this daemon) asking the daemon to mint one short-lived,

package/dist/daemon/create-daemon.d.ts

@@ -9,7 +9,7 @@ import { type OperationalHealthSnapshot } from './operational-health';
 import { type DaemonEventListener, type DaemonTaskInfo, type Unsubscribe } from './observer';
 import { GitWorkspaceManager } from './git-workspace';
 import { GitWorkspaceStore } from './git-workspace-store';
-import { type DeviceRecord } from './store';
+import { type DeviceEnrollment } from './store';
 import { type LocalTaskJournal } from './journal/journal';
 import { type JournalOpenFaultSeam } from './journal/sqlite-support';
 import { LocalStoragePressureEngine, type LocalStoragePolicyInput } from './journal/storage-policy';
@@ -18,6 +18,8 @@ import { type ProgressBatcherOptions } from './progress-batcher';
 import { type AgentEgressReliableAppendResult } from './agent-egress-controller';
 import { type AgentEgressStatus } from './agent-egress-policy';
 import { type AgentEgressSanitizer } from './agent-egress-sanitizer';
+import { type AgentMemoryHostedProjection } from './agent-memory';
+import type { AgentMemoryFilesystemHelperConfig } from './agent-memory-filesystem';
 import { type AgentContentReadRoot } from './agent-content-read';
 /**
  * Optional white-label product display info — purely opaque passthrough
@@ -100,6 +102,19 @@ export interface DaemonConfig {
         hostStorageRoot: string;
         projection?: AgentHomeProjection;
     };
+    /** Optional, one-way hosted projection. Without all guards it has zero network activity. */
+    agentMemory?: AgentMemoryHostedProjection;
+    /**
+     * Product-owned external secure-filesystem helper. The path must be absolute;
+     * the SDK never searches PATH or bundles a native addon. Required for Phase
+     * 2 on macOS. Windows remains fail-closed pending its native race proof.
+     */
+    agentMemoryFilesystem?: AgentMemoryFilesystemHelperConfig;
+    /**
+     * Refuse legacy task offers locally. This is an additive capability only
+     * after the SDK-owned Agent home has passed construction-time preflight.
+     */
+    strictAgentOnly?: boolean;
     /**
      * Explicit Agent-local/cloud egress selection. Omission still enforces the
      * SDK metadata/status projection, but does not advertise or admit the new
@@ -188,6 +203,17 @@ export interface DaemonConfig {
      */
     permissionDefaults?: PermissionPolicy;
     storeDir?: string;
+    /**
+     * Opt-in host composition for a daemon launched under a different OS
+     * principal than the interactive CLI (notably a WinSW service). When true,
+     * an unpaired daemon holds the normal writer lease and exposes only the
+     * existing HMAC-authenticated local control surface so `enrollment.pair`
+     * can persist the credential under the daemon's own OS token. Absent by
+     * default: ordinary foreground `start()` keeps rejecting an unpaired device.
+     */
+    serviceEnrollment?: {
+        readonly enabled: true;
+    };
     /** Optional white-label branding — see `DaemonBranding`. Carried through verbatim to `status().branding`. */
     branding?: DaemonBranding;
     /**
@@ -448,7 +474,8 @@ export interface DaemonStatus {
     egress: AgentEgressStatus;
 }
 export interface Daemon {
-    pair(pairingCode: string): Promise<DeviceRecord>;
+    /** Pairing result is intentionally credential-blind. */
+    pair(pairingCode: string): Promise<DeviceEnrollment>;
     start(): Promise<void>;
     stop(): Promise<void>;
     status(): DaemonStatus;

package/dist/daemon/daemon-owner.d.ts

@@ -52,6 +52,15 @@ export declare class DaemonOwnerActiveError extends Error {
     readonly role: OwnerRecord['role'] | 'unknown';
     constructor(role: OwnerRecord['role'] | 'unknown');
 }
+/**
+ * Read-only relocation inspection. The caller must already hold this store's
+ * path-mutation gate, so a conforming writer cannot publish after this check.
+ * Any persisted owner or reclaim object is a refusal; relocation never
+ * reclaims crash residue or repairs SDK-private state.
+ *
+ * @internal Used only by the high-level local-state relocation coordinator.
+ */
+export declare function assertDaemonStoreQuiescent(storeDir: string): Promise<void>;
 /**
  * Cross-process, fail-closed ownership for store mutations that must never
  * race a daemon. A separate exclusive reclaim file serializes stale-owner recovery so two

package/dist/daemon/device-credential-store.d.ts

@@ -0,0 +1,58 @@
+/** Secret fields inside the internal complete enrollment authority. */
+export interface DeviceCredentials {
+    readonly accessToken: string;
+    readonly expiresAt: string;
+    readonly devicePrivateKeyPem: string;
+}
+/** Non-secret deterministic projection of the authenticated enrollment. */
+export interface DeviceMetadata {
+    readonly deviceId: string;
+    readonly tenantId: string;
+    readonly devicePublicKey: string;
+}
+/**
+ * The single local enrollment authority. Keeping identity and credential
+ * bytes in one OS-managed entry prevents a crash from composing a token/key
+ * from one pairing response with metadata from another.
+ */
+export type DeviceRecord = DeviceMetadata & DeviceCredentials;
+export interface DeviceCommandResult {
+    readonly exitCode: number;
+    readonly stdout: string;
+    readonly stderr: string;
+}
+export type DeviceCommandRunner = (executable: string, args: readonly string[], stdin?: string) => Promise<DeviceCommandResult>;
+/** Typed unavailability; callers must surface re-pair/operational failure, never write a file fallback. */
+export declare class DeviceCredentialStoreUnavailableError extends Error {
+    constructor(message?: string);
+}
+export declare class DeviceCredentialStoreError extends Error {
+    constructor(message: string);
+}
+export interface DeviceCredentialStoreOptions {
+    readonly productId: string;
+    readonly platform?: NodeJS.Platform;
+    readonly commandRunner?: DeviceCommandRunner;
+}
+/**
+ * Internal OS-backed authority for the bearer token and device private key.
+ * The constructor deliberately accepts no path or backend selector: real
+ * callers get the platform provider; tests import this internal module and
+ * inject a double directly.
+ */
+export declare class DeviceCredentialStore {
+    #private;
+    constructor(options: DeviceCredentialStoreOptions);
+    read(): Promise<DeviceRecord | undefined>;
+    replace(record: DeviceRecord): Promise<void>;
+    /** Returns true only after the sole secret authority is confirmed absent. */
+    clear(): Promise<boolean>;
+}
+/** Test-only double; it is intentionally internal and never selected by a production config. */
+export declare class InMemoryDeviceCredentialStore {
+    #private;
+    read(): Promise<DeviceRecord | undefined>;
+    replace(record: DeviceRecord): Promise<void>;
+    clear(): Promise<boolean>;
+}
+export declare function runDeviceCommand(executable: string, args: readonly string[], stdin?: string): Promise<DeviceCommandResult>;

package/dist/daemon/device-proof-signer.d.ts

@@ -1,5 +1,5 @@
 import { type DeviceProofEnvelopeV1 } from '@byok-sdk/core';
-import type { DeviceStore } from './store';
+import type { AuthManager } from './auth-manager';
 export interface DeviceProofRequest {
     readonly method: string;
     /** Exact origin-relative path, including the query string when present. */
@@ -17,7 +17,7 @@ export interface DeviceProofSigner {
     sign(request: DeviceProofRequest): Promise<DeviceProofEnvelopeV1>;
 }
 export interface StoredDeviceProofSignerOptions {
-    readonly store: Pick<DeviceStore, 'load'>;
+    readonly auth: Pick<AuthManager, 'readCurrent'>;
     /** Explicit host configuration. Pairing/bearer state is never mined for tenant identity. */
     readonly tenantId: string;
     readonly productId: string;
@@ -28,8 +28,9 @@ export interface StoredDeviceProofSignerOptions {
 /**
  * Signs request-bound S6 proofs with the paired device identity key.
  *
- * The store is read for every signature rather than cached: clearing the paired
- * record immediately removes local signing authority. Canonicalization is
+ * The authenticated enrollment authority is read for every signature rather
+ * than cached: clearing the OS credential immediately removes local signing
+ * authority. Canonicalization is
  * imported from `@byok-sdk/core`, the one frozen byte authority; this module only
  * supplies the Node Ed25519 operation.
  */

package/dist/daemon/memory-guidance.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Runtime-neutral instructions for an Agent's model-authored local memory.
+ *
+ * This is deliberately prompt guidance only: the SDK does not read memory
+ * content, infer durable values, or auto-inject files into the operation.
+ */
+export declare const AGENT_MEMORY_GUIDANCE: string;
+export declare function prependAgentMemoryGuidance(instruction: string): string;

package/dist/daemon/path-mutation-gate.d.ts

@@ -0,0 +1,25 @@
+export type PathMutationGateScope = 'store' | 'agent-home-root';
+export interface PathMutationGateInput {
+    readonly scope: PathMutationGateScope;
+    readonly targetPath: string;
+}
+export interface PathMutationGateAcquireOptions {
+    /** Bounded wait for another conforming short-lived writer; relocation uses zero. */
+    readonly waitMs?: number;
+}
+export interface PathMutationGate {
+    readonly scope: PathMutationGateScope;
+    readonly targetPath: string;
+    readonly identity: string;
+    release(): Promise<void>;
+}
+export declare class PathMutationGateBusyError extends Error {
+    readonly scope: PathMutationGateScope;
+    readonly targetPath: string;
+    constructor(scope: PathMutationGateScope, targetPath: string);
+}
+/** Canonicalize through the deepest existing ancestor without creating the target. */
+export declare function resolvePathWithoutCreate(input: string): Promise<string>;
+/** Acquire multiple path gates in one deterministic order to prevent deadlock. */
+export declare function acquirePathMutationGates(inputs: readonly PathMutationGateInput[]): Promise<readonly PathMutationGate[]>;
+export declare function acquirePathMutationGate(input: PathMutationGateInput, options?: PathMutationGateAcquireOptions): Promise<PathMutationGate>;

package/dist/daemon/resolve-agent-memory-mcp-bin.d.ts

@@ -0,0 +1,6 @@
+export interface ResolvedAgentMemoryMcpBin {
+    readonly command: string;
+    readonly args: readonly string[];
+}
+/** Resolve the SDK-owned stdio Agent-memory MCP helper shipped beside the client bundle. */
+export declare function resolveAgentMemoryMcpBin(externalHelperConfigured?: boolean): ResolvedAgentMemoryMcpBin | undefined;

package/dist/daemon/resolve-agent-message-mcp-bin.d.ts

@@ -0,0 +1,6 @@
+export interface ResolvedAgentMessageMcpBin {
+    readonly command: string;
+    readonly args: readonly string[];
+}
+/** Resolve the SDK-owned stdio MCP helper shipped beside the client bundle. */
+export declare function resolveAgentMessageMcpBin(): ResolvedAgentMessageMcpBin;

package/dist/daemon/store.d.ts

@@ -1,17 +1,32 @@
 import { type EnsureSecureDirOptions } from '../util/secure-dir';
-export interface DeviceRecord {
-    deviceId: string;
-    /** Opaque tenant binding returned by the authenticated pairing response. */
-    tenantId: string;
-    /** Current access token (JWT), renewed via challenge/token without re-pairing (protocol §6.2). */
-    accessToken: string;
-    /** ISO-8601 expiry for `accessToken` (our best knowledge of it — see auth-manager.ts for how this is derived after `/byok/pair`, which reports no explicit expiry itself). */
-    expiresAt: string;
-    /** Ed25519 private key, PKCS8 PEM. Never leaves this device. Stored as a 0600 file; OS keychain integration is deferred (tracked as a future roadmap item, not promised for any specific milestone). */
-    devicePrivateKeyPem: string;
-    /** Ed25519 public key, base64url — re-sent verbatim on a post-revocation re-pair (protocol §6.3). */
-    devicePublicKey: string;
+import { DeviceCredentialStore, InMemoryDeviceCredentialStore, type DeviceMetadata } from './device-credential-store';
+export type { DeviceMetadata, DeviceRecord } from './device-credential-store';
+/**
+ * Non-secret projection of an authenticated device enrollment. This is the
+ * complete permitted `device.json` shape. The complete record, including
+ * these authenticated metadata fields and secret bytes, lives atomically in
+ * DeviceCredentialStore; this file is only its deterministic projection.
+ *
+ * Internal only: the package root exposes DeviceEnrollment/status, never this
+ * storage record.
+ */
+/** Public credential-blind result of explicit pairing. */
+export interface DeviceEnrollment {
+    readonly deviceId: string;
+}
+export interface DeviceEnrollmentStatusOptions {
+    productId: string;
+    storeDir?: string;
 }
+/** Credential-blind cold read model for host setup and diagnostics. */
+export type DeviceEnrollmentStatus = {
+    state: 'unpaired';
+} | {
+    state: 'paired';
+    deviceId: string;
+} | {
+    state: 're_pair_required';
+};
 /**
  * A durable enrollment record cannot be used by any steady-state path. Only
  * the explicit pair operation may replace it with a fresh authenticated row.
@@ -20,17 +35,17 @@ export declare class DeviceRecordRePairRequiredError extends Error {
     constructor();
 }
 /**
- * Persists the device identity issued by `pair()` — deviceId, current
- * access token + its expiry, and the device's own Ed25519 keypair. This is
- * the ONLY credential material the daemon itself ever holds — never a
- * runtime's own credentials (see the credential-isolation rule on
- * `RuntimeAdapter`). Stored 0600 under `storeDir` (default
- * `~/.byok/<productId>/`); OS keychain storage is deferred (tracked as a
- * future roadmap item, not promised for any specific milestone).
+ * Persists only bounded non-secret enrollment projection. The paired bearer
+ * token and private key are never accepted here and are owned by the internal
+ * OS DeviceCredentialStore.
  */
 export declare class DeviceStore {
     private readonly secureDirOptions?;
+    /** Process-local keyed doubles preserve restart semantics in isolated tests. */
+    private static readonly testCredentials;
     private readonly filePath;
+    /** Internal test seam. Product construction always supplies productId and gets an OS store. */
+    readonly credentials: DeviceCredentialStore | InMemoryDeviceCredentialStore;
     /**
      * `secureDirOptions` is a test-only DI seam (mirrors `EnsureSecureDirOptions`'s
      * own `run`/`platform` overrides) — every real caller omits it, getting
@@ -41,7 +56,7 @@ export declare class DeviceStore {
      * ACL-unprotected credential") is verifiable from a real `darwin`/`linux`
      * CI/dev machine, not just asserted.
      */
-    constructor(storeDir: string, secureDirOptions?: EnsureSecureDirOptions | undefined);
+    constructor(storeDir: string, secureDirOptions?: EnsureSecureDirOptions | undefined, productId?: string);
     static defaultDir(productId: string): string;
     /**
      * Resolve the one store pathname every daemon/CLI component must share.
@@ -50,14 +65,20 @@ export declare class DeviceStore {
      * cwd to pin a quarantine directory inode.
      */
     static resolveDir(productId: string, configured?: string): string;
-    load(): Promise<DeviceRecord | undefined>;
+    load(): Promise<DeviceMetadata | undefined>;
     /**
      * Read and remove the exact bounded, no-follow device record under the
      * caller's mutation lease. The hard-link guard keeps the inspected inode
      * identifiable until the synchronous pathname check and unlink complete.
      */
-    remove(): Promise<DeviceRecord | undefined>;
-    save(record: DeviceRecord): Promise<void>;
-    clear(): Promise<void>;
+    remove(): Promise<DeviceMetadata | undefined>;
+    save(record: DeviceMetadata): Promise<void>;
     private openBounded;
 }
+/**
+ * Read the canonical device store without projecting credential or tenant
+ * material. A legacy/tampered record remains distinct from an absent record so
+ * hosts can require explicit re-pair instead of silently changing semantics.
+ * Filesystem and pathname-safety failures intentionally remain errors.
+ */
+export declare function readDeviceEnrollmentStatus(options: DeviceEnrollmentStatusOptions): Promise<DeviceEnrollmentStatus>;

package/dist/daemon/task-runner.d.ts

@@ -1,4 +1,4 @@
-import { type AgentEgressPolicy, type Envelope, type PermissionPolicy, type RuntimeId, type TaskOfferPayload, type TaskOfferForAgentPayload, type TaskOfferForAgentWithEgressPayload, type TaskOfferForAgentWithEgressFreshPayload, type TaskOfferWithToolsetsPayload } from '@byok-sdk/protocol';
+import { type AgentMessageContentType, type AgentEgressPolicy, type Envelope, type PermissionPolicy, type RuntimeId, type TerminalProjectionSelection, type TaskOfferPayload, type TaskOfferForAgentPayload, type TaskOfferForAgentWithEgressPayload, type TaskOfferForAgentWithEgressFreshPayload, type TaskOfferWithToolsetsPayload } from '@byok-sdk/protocol';
 import { type McpToolsetConfig, type RuntimeAdapter } from '../types';
 import { AgentHomeManager, type AgentRef } from '../agent-home';
 import { AgentSessionHandoffStore, type AgentTerminalCause } from './agent-session-handoff-store';
@@ -12,6 +12,9 @@ import type { SessionWorkspaceStore } from './session-workspace-store';
 import type { GitWorkspaceManager, GitWorkspaceObservation } from './git-workspace';
 import type { GitWorkspaceStore, GitWorkspacePhase } from './git-workspace-store';
 import type { AgentEgressController } from './agent-egress-controller';
+import type { ResolvedAgentMessageMcpBin } from './resolve-agent-message-mcp-bin';
+import type { ResolvedAgentMemoryMcpBin } from './resolve-agent-memory-mcp-bin';
+import { type AgentMemoryAuditWarning, type AgentMemoryHostedProjection } from './agent-memory';
 /**
  * M4 Phase 3: default wait for `requestApproval` (see its own doc comment)
  * before force-resolving an unanswered out-of-band approval as a fail-closed
@@ -138,12 +141,15 @@ export declare const RESULT_DOCUMENT_UNDELIVERABLE_REASON_PREFIX = "result docum
 export interface ResultDocumentTask {
     readonly taskId: string;
     readonly sessionRef: string;
+    /** Exact offer-scoped second projection; absent for legacy and message-only offers. */
+    readonly terminalProjection?: Readonly<TerminalProjectionSelection>;
 }
 /**
  * Host-supplied glue that turns a finished task's final output into the
  * product's structured terminal result (`task.complete.document`). Returning
- * `undefined` means "this task has no structured result" and completes the
- * task exactly as it would have without an extractor configured at all.
+ * `undefined` means "this task has no structured result" for legacy offers.
+ * An explicit `terminalProjection.mode: 'result-document'` instead treats
+ * `undefined` as a fail-closed missing required document.
  *
  * SYNCHRONOUS by contract, like every other single-purpose callback on
  * `TaskRunnerDeps`, and the runtime ENFORCES that rather than trusting it:
@@ -195,6 +201,8 @@ export interface TaskRunnerDeps {
     workspaceRoot: string;
     /** Strict Agent offer authority. Absent means legacy offers never resolve an Agent home. */
     agentHome?: AgentHomeManager;
+    /** Local authority: legacy offers are declined after journal/dedup/cancel precedence. */
+    strictAgentOnly?: boolean;
     /** Exact host-selected policy accepted by `task.offer_for_agent_with_egress`. */
     agentEgressPolicy?: Readonly<AgentEgressPolicy>;
     /** Always-present projection/sanitizer consumer; it defaults to metadata-only. */
@@ -256,6 +264,8 @@ export interface TaskRunnerDeps {
     approvalRegistry: ApprovalRegistry;
     storeDir: string;
     productId: string;
+    /** Authenticated enrollment tenant projection; required by Agent message durability/recovery. */
+    tenantId?: string;
     /**
      * The already-resolved, process-immutable U4a Local Agent release identity.
      * `TaskRunner` only consumes this value; it never creates, normalizes, or
@@ -357,6 +367,14 @@ export interface TaskRunnerDeps {
     resultDocument?: {
         readonly extract: ResultDocumentExtractor;
     };
+    /** SDK-owned, task-scoped MCP helper. Required only for offers declaring messageEgress. */
+    agentMessageMcpBin?: Readonly<ResolvedAgentMessageMcpBin>;
+    /** SDK-owned MCP helper injected only into strict Agent tasks. */
+    agentMemoryMcpBin?: Readonly<ResolvedAgentMemoryMcpBin>;
+    /** Explicit external secure-fs helper. No PATH discovery or bundled native addon exists. */
+    agentMemoryFilesystemHelperBin?: string;
+    /** Optional local-to-hosted redacted projection port. Omission is zero-network. */
+    agentMemoryHostedProjection?: AgentMemoryHostedProjection;
 }
 /** See {@link TaskRunnerDeps.admissionGuard}. */
 export type AdmissionGuardDecision = {
@@ -385,6 +403,16 @@ type AcceptedOfferPayload = TaskOfferPayload | TaskOfferWithToolsetsPayload | Ta
 export declare class TaskRunner {
     private readonly deps;
     private readonly tasks;
+    private readonly pendingMessageTasks;
+    private readonly messageContextByToken;
+    private readonly messageContextByTask;
+    private readonly memoryContextByToken;
+    private readonly memoryContextByTask;
+    private readonly memoryInFlightByTask;
+    private readonly memoryClosingTasks;
+    private readonly memoryFilesystemByTask;
+    private readonly recoveredMessageOutboxes;
+    private readonly recoveredMessageRetryTimers;
     /**
      * Finding F4 (cancel lost during the offer-processing window): a
      * `task.cancel` for a taskId that hasn't finished `handleOffer` yet (still
@@ -479,6 +507,12 @@ export declare class TaskRunner {
      * cancellation intent.
      */
     private readonly finishedTaskIds;
+    /**
+     * Bounded local receive dedup for strict legacy declines. A decline is not a
+     * task terminal receipt, so it must never enter `finishedTaskIds`; retaining
+     * it separately keeps replay idempotent without claiming or finishing work.
+     */
+    private readonly strictDeclinedTaskIds;
     /**
      * M4 Phase 2 (daemon control socket `shutdown` RPC): set once by
      * {@link stopAcceptingOffers}, checked at the very top of `handleOffer` —
@@ -507,6 +541,44 @@ export declare class TaskRunner {
      * approval count, not the adapter's own event-queue depth.
      */
     getQueueWatermarks(): TaskQueueWatermark[];
+    /** Authenticated control-socket entry used only by the SDK-owned task MCP helper. */
+    publishAgentMessage(input: {
+        readonly contextToken: string;
+        readonly contentType: AgentMessageContentType;
+        readonly body: string;
+    }): Promise<{
+        messageId: string;
+        state: 'staged' | 'pending';
+    }>;
+    /** Authenticated control-socket entry used only by the SDK-owned memory MCP helper. */
+    recallAgentMemory(input: {
+        readonly contextToken: string;
+        readonly path: string;
+        readonly ifRevision?: string;
+    }): Promise<{
+        path: string;
+        revision: string;
+        content: string;
+        auditWarning?: AgentMemoryAuditWarning;
+    }>;
+    /** Authenticated control-socket entry used only by the SDK-owned memory MCP helper. */
+    saveAgentMemory(input: {
+        readonly contextToken: string;
+        readonly op: 'replace' | 'delete';
+        readonly path: string;
+        readonly expectedRevision: string;
+        readonly content?: string;
+    }): Promise<{
+        path: string;
+        revision?: string;
+        deleted: boolean;
+    }>;
+    /** Restore activated, unaccepted message drafts before transport admission on daemon restart. */
+    recoverAgentMessageOutboxes(agentsRoot: string): Promise<void>;
+    /** Retry stable recovered records after a transport handshake/re-handshake. */
+    retryRecoveredAgentMessages(): void;
+    private sendAgentMessageRecord;
+    private handleAgentMessageDisposition;
     /** M4 Phase 2: stop claiming any FUTURE `task.offer` — see `stoppingOffers`'s own doc comment. Idempotent. */
     stopAcceptingOffers(): void;
     /**
@@ -612,11 +684,23 @@ export declare class TaskRunner {
     private armMaxDurationTimer;
     handleEnvelope(envelope: Envelope): Promise<void>;
     private handleOffer;
+    private withAgentMessageMcp;
+    private revokeAgentMessageContext;
+    /** Injected only after strict Agent admission; a host registry may never replace this reserved name. */
+    private withAgentMemoryMcp;
+    /** Reconstruct all sensitive context from the active sealed task, never from MCP/model arguments. */
+    private activeMemoryContext;
+    private runMemoryOperation;
+    private quiesceAndSnapshotAgentMemory;
+    private bindAgentMemoryFilesystem;
+    private closeAgentMemoryFilesystem;
+    private revokeAgentMemoryContext;
     /** Protocol §7: an instruction too large to inline arrives as a `blobRef` — resolve it via the blob client rather than failing closed. */
     private resolveInstruction;
     /** Resolve every requested logical id locally and reject missing/colliding server authority before claim. */
     private resolveMcpServers;
     private pump;
+    private publishSuccessfulCompletion;
     /**
      * Protocol §7: an `artifact` `AgentEvent` only names a file the runtime
      * wrote into the task workspace (`name`/`contentType` — it carries no
@@ -1019,6 +1103,7 @@ export declare class TaskRunner {
     private reserveSemanticTerminal;
     /** M3-B: bounded insert for `finishedTaskIds` — see its class-level doc comment and `MAX_TRACKED_TASK_IDS`. Evicts the oldest (first-inserted) entry once over cap, same idiom as `ConnectionHub.checkAndRecordDuplicate` (packages/server/src/hub.ts). */
     private addFinishedTaskId;
+    private addStrictDeclinedTaskId;
     /** `reuseDir`, when set (a known sessionRef's recorded workspace), is used verbatim instead of a fresh `workspaceRoot/<taskId>` directory — `mkdir recursive` is idempotent either way, so ensuring-exists is safe to do unconditionally. */
     private resolveWorkspaceDir;
     /**

package/dist/daemon/toolset-registry.d.ts

@@ -1,5 +1,7 @@
 import { type ToolsetId } from '@byok-sdk/protocol';
 import type { McpToolsetConfig, McpToolsetObservation, McpToolsetRegistryStatus, McpToolsetReloadReceipt } from '../types';
+export declare const AGENT_MESSAGE_MCP_SERVER_NAME = "byokagentmessage";
+export declare const AGENT_MEMORY_MCP_SERVER_NAME = "byokagentmemory";
 export type McpToolsetConfigInput = Record<string, McpToolsetConfig> | undefined;
 export interface McpToolsetRegistrySnapshot {
     revision: string;