@byok-sdk/client 0.8.1 → 0.9.0

package/dist/bin/byok-agent.js

@@ -3,7 +3,7 @@ import { randomUUID, createHash, randomBytes, timingSafeEqual, createHmac, creat
 import { readFileSync, promises, linkSync, fstatSync, lstatSync, unlinkSync, constants, readSync, openSync, writeFileSync, fchmodSync, fsyncSync, closeSync, opendirSync, existsSync, realpathSync, mkdirSync, renameSync, chmodSync, statSync, readdirSync } from 'fs';
 import * as path3 from 'path';
 import path3__default, { isAbsolute, join } from 'path';
-import { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, TASK_STATES, AgentEgressPolicySchema, AgentHomeProjectionPayloadSchema, CONFIGURED_TOOLSETS_MAX_ITEMS, ToolsetIdSchema, AgentRefSchema, AgentContentReceiptPayloadSchema, BYOK_PAIR_PATH, PairResponseSchema, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, partitionAgentEvents, TASK_TRANSITIONS, encodeEnvelope, PROTOCOL_VERSION, createEnvelope, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, byokBlobUrlPath, BYOK_BLOBS_PATH, byokBlobFinalizePath, STRICT_AGENT_ONLY_CAPABILITY, AGENT_HOME_PROJECTION_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AgentHomeProjectionCompletionRequestSchema, byokAgentHomeProjectionCompletionPath, AgentHomeProjectionReadbackSchema, parseMessage, checkResultDocument, MAX_MESSAGES_PER_BATCH, BYOK_CAPABILITIES_PATH, BYOK_PRESENCE_PATH, RuntimeIdSchema, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, RESULT_DOCUMENT_MAX_BYTES, decodeEnvelope, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendResponseSchema, UnknownMessageTypeError, BYOK_WS_PATH } from '@byok-sdk/protocol';
+import { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, TASK_STATES, AgentEgressPolicySchema, AgentHomeProjectionPayloadSchema, CONFIGURED_TOOLSETS_MAX_ITEMS, ToolsetIdSchema, AgentRefSchema, AgentContentReceiptPayloadSchema, BYOK_PAIR_PATH, PairResponseSchema, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, partitionAgentEvents, TASK_TRANSITIONS, encodeEnvelope, PROTOCOL_VERSION, createEnvelope, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, byokBlobUrlPath, BYOK_BLOBS_PATH, byokBlobFinalizePath, TERMINAL_PROJECTION_SELECTION_CAPABILITY, STRICT_AGENT_ONLY_CAPABILITY, AGENT_HOME_PROJECTION_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AGENT_MESSAGE_EGRESS_CAPABILITY, AgentHomeProjectionCompletionRequestSchema, byokAgentHomeProjectionCompletionPath, AgentHomeProjectionReadbackSchema, parseMessage, checkResultDocument, MAX_MESSAGES_PER_BATCH, BYOK_CAPABILITIES_PATH, BYOK_PRESENCE_PATH, AgentMessagePublishPayloadSchema, AgentMessageDispositionPayloadSchema, RuntimeIdSchema, AGENT_MEMORY_PROJECTION_CAPABILITY, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, RESULT_DOCUMENT_MAX_BYTES, decodeEnvelope, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendResponseSchema, UnknownMessageTypeError, AGENT_MEMORY_PROJECTION_MAX_ORDERING_VALUE, AgentMemoryProjectionMutationSchema, AGENT_MEMORY_PROJECTION_MAX_REDACTED_BYTES, BYOK_WS_PATH } from '@byok-sdk/protocol';
 import net, { createServer, createConnection } from 'net';
 import * as os from 'os';
 import os__default from 'os';
@@ -649,12 +649,16 @@ var AgentHomeLeaseManager = class _AgentHomeLeaseManager {
     let handle;
     let rootGate;
     let ownsMarker = false;
+    let homeIdentity;
     try {
       rootGate = await acquirePathMutationGate({
         scope: "agent-home-root",
         targetPath: resolution.agentsRoot
       }, { waitMs: 1e3 });
       await ensureDirectoryNoSymlink(resolution.agentsRoot, canonicalHome);
+      const homeStat = await promises.stat(canonicalHome, { bigint: true });
+      if (!homeStat.isDirectory()) throw new AgentHomeResolutionError(`Agent home ${canonicalHome} is not a directory`);
+      homeIdentity = Object.freeze({ dev: homeStat.dev, ino: homeStat.ino });
       const internalDir = await ensureDirectoryNoSymlink(
         canonicalHome,
         path3__default.join(canonicalHome, AGENT_HOME_INTERNAL_DIRECTORY)
@@ -693,6 +697,7 @@ var AgentHomeLeaseManager = class _AgentHomeLeaseManager {
     }
     const acquiredLockPath = lockPath;
     if (acquiredLockPath === void 0) throw new AgentHomeError("Agent home lease marker path was not established");
+    if (homeIdentity === void 0) throw new AgentHomeError("Agent home lease identity was not established");
     let released = false;
     let releaseAttempt;
     return {
@@ -700,6 +705,7 @@ var AgentHomeLeaseManager = class _AgentHomeLeaseManager {
       agentRef,
       canonicalHome,
       cwd: canonicalHome,
+      homeIdentity,
       release: () => {
         if (released) return Promise.resolve();
         if (releaseAttempt !== void 0) return releaseAttempt;
@@ -1048,14 +1054,14 @@ function sameTaskTerminalMatch(entry, expected) {
   return sameRef(entry.agentRef, expected.agentRef) && entry.taskId === expected.taskId && entry.runtimeId === expected.runtimeId && entry.cwd === path3__default.resolve(expected.cwd);
 }
 function sessionFileName(runtimeId, sessionRef) {
-  const digest2 = createHash("sha256").update(sessionRef, "utf8").digest("hex");
+  const digest3 = createHash("sha256").update(sessionRef, "utf8").digest("hex");
   const runtime = runtimeId.replace(/[^a-z0-9._-]/giu, "_").slice(0, 64) || "runtime";
-  return `${runtime}-${digest2}.jsonl`;
+  return `${runtime}-${digest3}.jsonl`;
 }
 function taskTerminalFileName(runtimeId, taskId) {
-  const digest2 = createHash("sha256").update(taskId, "utf8").digest("hex");
+  const digest3 = createHash("sha256").update(taskId, "utf8").digest("hex");
   const runtime = runtimeId.replace(/[^a-z0-9._-]/giu, "_").slice(0, 64) || "runtime";
-  return `${runtime}-task-${digest2}.jsonl`;
+  return `${runtime}-task-${digest3}.jsonl`;
 }
 async function evidenceDirectory(cwdInput) {
   if (!path3__default.isAbsolute(cwdInput)) {
@@ -4794,6 +4800,7 @@ var CodexAdapter = class {
       steer: false,
       resume: true,
       approvalInteractive: false,
+      mcpToolsets: true,
       permissionModes: ["auto", "readonly"]
     },
     environmentRequirements: { credentialNames: [] }
@@ -4925,7 +4932,7 @@ ${withStreams.stderr ?? ""}`);
       resumeRef: startInput.manifest.sessionRef,
       instruction: startInput.instruction,
       modelId: manifestModelId,
-      policyArgs: [...policyArgs],
+      policyArgs: [...policyArgs, ...codexMcpConfigArgs(startInput.mcpServers)],
       cwd: manifestCwd,
       env: runtimeEnv,
       spawnFn: this.options.spawnFn,
@@ -4955,6 +4962,18 @@ ${withStreams.stderr ?? ""}`);
     return (this.options.resolveBin ?? resolveCodexBin)();
   }
 };
+function codexMcpConfigArgs(servers) {
+  if (servers === void 0 || Object.keys(servers).length === 0) return [];
+  const args = ["--ignore-user-config"];
+  for (const [name, server] of Object.entries(servers).sort(([left], [right]) => left.localeCompare(right))) {
+    args.push("-c", `mcp_servers.${name}.command=${JSON.stringify(server.command)}`);
+    if (server.args !== void 0) args.push("-c", `mcp_servers.${name}.args=${JSON.stringify([...server.args])}`);
+    for (const [key, value] of Object.entries(server.env ?? {}).sort(([left], [right]) => left.localeCompare(right))) {
+      args.push("-c", `mcp_servers.${name}.env.${key}=${JSON.stringify(value)}`);
+    }
+  }
+  return args;
+}
 async function resolveRealWorkspaceDir(workspaceDir) {
   return promises.realpath(workspaceDir).catch(() => workspaceDir);
 }
@@ -6666,6 +6685,27 @@ function parseApprovalsRequestParams(value) {
   if (typeof value.summary !== "string") return void 0;
   return { taskId: value.taskId, summary: value.summary };
 }
+function parseAgentMessagePublishParams(value) {
+  if (!isRecord3(value) || Object.keys(value).some((key) => key !== "contextToken" && key !== "contentType" && key !== "body")) return void 0;
+  if (typeof value.contextToken !== "string" || value.contextToken.length < 32 || value.contextToken.length > 160) return void 0;
+  if (value.contentType !== "text/plain" && value.contentType !== "text/markdown") return void 0;
+  if (typeof value.body !== "string" || value.body.length === 0) return void 0;
+  return { contextToken: value.contextToken, contentType: value.contentType, body: value.body };
+}
+function validAgentMemoryContextToken(value) {
+  return typeof value === "string" && value.length >= 32 && value.length <= 160 && !/[\u0000\r\n]/u.test(value);
+}
+function parseAgentMemoryRecallParams(value) {
+  if (!isRecord3(value) || Object.keys(value).some((key) => key !== "contextToken" && key !== "path" && key !== "ifRevision")) return void 0;
+  if (!validAgentMemoryContextToken(value.contextToken) || typeof value.path !== "string" || value.ifRevision !== void 0 && typeof value.ifRevision !== "string") return void 0;
+  return { contextToken: value.contextToken, path: value.path, ...value.ifRevision === void 0 ? {} : { ifRevision: value.ifRevision } };
+}
+function parseAgentMemorySaveParams(value) {
+  if (!isRecord3(value) || Object.keys(value).some((key) => key !== "contextToken" && key !== "op" && key !== "path" && key !== "expectedRevision" && key !== "content")) return void 0;
+  if (!validAgentMemoryContextToken(value.contextToken) || value.op !== "replace" && value.op !== "delete" || typeof value.path !== "string" || typeof value.expectedRevision !== "string" || value.op === "replace" && typeof value.content !== "string" || value.op === "delete" && value.content !== void 0) return void 0;
+  const content = value.content;
+  return { contextToken: value.contextToken, op: value.op, path: value.path, expectedRevision: value.expectedRevision, ...typeof content === "string" ? { content } : {} };
+}
 var ASSERTION_AUDIENCE_MAX_BYTES = 256;
 function parseAssertionIssueParams(value) {
   if (!isRecord3(value)) return void 0;
@@ -6923,6 +6963,8 @@ async function startControlServer(opts) {
   }
   return { endpoint, stopServing, close };
 }
+var AGENT_MESSAGE_MCP_SERVER_NAME = "byokagentmessage";
+var AGENT_MEMORY_MCP_SERVER_NAME = "byokagentmemory";
 var MAX_LOCAL_MCP_SERVERS_PER_TOOLSET = 16;
 var MAX_LOCAL_MCP_ARGS = 64;
 var MAX_LOCAL_MCP_TOKEN_CHARS = 4096;
@@ -7012,7 +7054,7 @@ function buildState(configured) {
           `DaemonConfig.mcpToolsets.${toolsetId}.mcpServers contains invalid server name ${JSON.stringify(serverName)}`
         );
       }
-      if (serverName === APPROVAL_MCP_SERVER_NAME) {
+      if (serverName === APPROVAL_MCP_SERVER_NAME || serverName === AGENT_MESSAGE_MCP_SERVER_NAME || serverName === AGENT_MEMORY_MCP_SERVER_NAME) {
         throw new Error(
           `DaemonConfig.mcpToolsets.${toolsetId}.mcpServers.${serverName} uses a server name reserved by the daemon`
         );
@@ -7175,9 +7217,9 @@ function deterministicJitterMs(input) {
     throw new Error("deterministic jitter ratio must be between 0 and 1");
   }
   if (input.baseMs === 0 || ratio === 0) return Math.round(input.baseMs);
-  const digest2 = createHash("sha256").update("byok-jitter-v1\0", "utf8").update(input.domain, "utf8").update("\0", "utf8").update(input.seed, "utf8").update("\0", "utf8").update(String(input.sequence), "utf8").digest();
-  const high = digest2.readUInt32BE(0) & 2097151;
-  const low = digest2.readUInt32BE(4);
+  const digest3 = createHash("sha256").update("byok-jitter-v1\0", "utf8").update(input.domain, "utf8").update("\0", "utf8").update(input.seed, "utf8").update("\0", "utf8").update(String(input.sequence), "utf8").digest();
+  const high = digest3.readUInt32BE(0) & 2097151;
+  const low = digest3.readUInt32BE(4);
   const unit = (high * 4294967296 + low) / 9007199254740992;
   const multiplier = 1 - ratio + unit * ratio * 2;
   return Math.max(0, Math.round(input.baseMs * multiplier));
@@ -9187,9 +9229,9 @@ function isSqliteAvailable() {
   }
 }
 var SECURE_FILE_MODE = 384;
-function openJournalDatabase(path36, busyTimeoutMs, faults) {
+function openJournalDatabase(path41, busyTimeoutMs, faults) {
   const { DatabaseSync } = loadSqliteModule();
-  const db = new DatabaseSync(path36, { timeout: busyTimeoutMs });
+  const db = new DatabaseSync(path41, { timeout: busyTimeoutMs });
   try {
     faults?.onStep?.("after-open");
     db.exec("PRAGMA auto_vacuum = INCREMENTAL;");
@@ -9332,9 +9374,9 @@ var RECEIVED_STATE = "received";
 function byteLength(value) {
   return Buffer.byteLength(value, "utf8");
 }
-function fileBytes(path36) {
+function fileBytes(path41) {
   try {
-    return statSync(path36).size;
+    return statSync(path41).size;
   } catch {
     return 0;
   }
@@ -10561,130 +10603,1262 @@ var ProgressBatcher = class {
     }
   }
 };
-
-// src/daemon/task-runner.ts
-var DEFAULT_APPROVAL_TIMEOUT_MS = 10 * 6e4;
-var DEFAULT_SHUTDOWN_INTERRUPT_TIMEOUT_MS = 5e3;
-var AGENT_TERMINAL_EVIDENCE_MAX_ATTEMPTS = 3;
-var AGENT_TERMINAL_EVIDENCE_RETRY_DELAY_MS = 20;
-var GIT_OBSERVATION_TIMEOUT_MS = 5e3;
-var MAX_PENDING_APPROVALS_PER_TASK = 16;
-var NoPendingApprovalError = class extends Error {
-  constructor(taskId) {
-    super(`no pending out-of-band approval to resolve for task ${taskId}`);
-    this.taskId = taskId;
-    this.name = "NoPendingApprovalError";
+var AGENT_MESSAGE_DIRECTORY = path3__default.join(".byok", "messages");
+var AGENT_MESSAGE_OUTBOX_FILENAME = "outbox-v1.jsonl";
+var AgentMessageOutboxError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AgentMessageOutboxError";
   }
-  taskId;
 };
-var MAX_INLINE_ARTIFACT_BYTES = 64 * 1024;
-var MAX_TRACKED_TASK_IDS = 2e3;
-var MAX_DURATION_EXCEEDED_REASON_PREFIX = "resource limit exceeded: maxDurationMs";
-var MAX_OUTPUT_BYTES_EXCEEDED_REASON_PREFIX = "resource limit exceeded: maxTaskOutputBytes";
-var MAX_PROGRESS_BATCH_BYTES_EXCEEDED_REASON_PREFIX = "resource limit exceeded: progressBatch.maxBatchBytes";
-var RESULT_DOCUMENT_UNDELIVERABLE_REASON_PREFIX = "result document undeliverable";
-function resultDocumentRejectionDetail(check) {
-  switch (check.reason) {
-    case "over-cap":
-      return `${check.bytes} bytes as canonical JSON, over the ${RESULT_DOCUMENT_MAX_BYTES}-byte limit (it is never truncated \u2014 a truncated JSON document is not valid JSON; use artifactRefs for a result this size)`;
-    case "not-serializable":
-      return "not JSON-serializable (JSON.stringify threw, or produced no output at all)";
-    case "not-plain-json":
-      return "not plain JSON data: it does not equal its own JSON round trip, so serializing it would silently change it (an undefined-valued key, NaN, a function or symbol value, a Date, a toJSON that rewrites the value, or a getter that answers differently on a second read)";
-    default: {
-      const exhaustive = check;
-      throw new Error(`unhandled result document rejection: ${JSON.stringify(exhaustive)}`);
+function stableJson(value) {
+  const encoded = JSON.stringify(value);
+  if (encoded === void 0) throw new AgentMessageOutboxError("message outbox value is not serializable");
+  return encoded;
+}
+function hashBody(body) {
+  return `sha256:${createHash("sha256").update(body, "utf8").digest("hex")}`;
+}
+function sameAgentRef(left, right) {
+  return left.agentId === right.agentId && left.profileRevision === right.profileRevision;
+}
+function exactDisposition(record, value) {
+  return value.messageId === record.messageId && value.cursor === record.cursor && value.contract === record.contract && value.contentHash === record.contentHash && value.sessionRef === record.sessionRef && sameAgentRef(value.agentRef, record.agentRef);
+}
+var AgentMessageOutbox = class _AgentMessageOutbox {
+  constructor(homeDir, outboxPath) {
+    this.homeDir = homeDir;
+    this.outboxPath = outboxPath;
+  }
+  homeDir;
+  outboxPath;
+  pendingByTask = /* @__PURE__ */ new Map();
+  dispositionByTask = /* @__PURE__ */ new Map();
+  nextCursor = 1;
+  logEntries = 0;
+  writeTail = Promise.resolve();
+  static async open(homeDir) {
+    const directory = path3__default.join(homeDir, AGENT_MESSAGE_DIRECTORY);
+    await ensureSecureDir(directory);
+    const outbox = new _AgentMessageOutbox(homeDir, path3__default.join(directory, AGENT_MESSAGE_OUTBOX_FILENAME));
+    await outbox.load();
+    return outbox;
+  }
+  /** Re-open every existing Agent-local message outbox without following Agent-home symlinks. */
+  static async recover(agentsRoot, tenantId) {
+    if (!path3__default.isAbsolute(agentsRoot)) throw new AgentMessageOutboxError("message outbox recovery root must be absolute");
+    let canonicalRoot;
+    try {
+      canonicalRoot = await promises.realpath(agentsRoot);
+    } catch (error) {
+      if (error.code === "ENOENT") return [];
+      throw error;
+    }
+    const recovered = [];
+    for (const entry of await promises.readdir(canonicalRoot, { withFileTypes: true })) {
+      if (!entry.isDirectory() || entry.isSymbolicLink()) continue;
+      const home = path3__default.join(canonicalRoot, entry.name);
+      const canonicalHome = await promises.realpath(home);
+      if (path3__default.relative(canonicalRoot, canonicalHome) !== entry.name) {
+        throw new AgentMessageOutboxError(`message outbox recovery home escaped the canonical agents root: ${entry.name}`);
+      }
+      try {
+        await promises.lstat(path3__default.join(canonicalHome, AGENT_MESSAGE_DIRECTORY, AGENT_MESSAGE_OUTBOX_FILENAME));
+      } catch (error) {
+        if (error.code === "ENOENT") continue;
+        throw error;
+      }
+      const outbox = await _AgentMessageOutbox.open(canonicalHome);
+      if (outbox.records().some((record) => record.agentRef.agentId !== entry.name)) {
+        throw new AgentMessageOutboxError(`message outbox in ${entry.name} claims a different Agent`);
+      }
+      if (outbox.records().some((record) => record.tenantId !== tenantId)) {
+        throw new AgentMessageOutboxError(`message outbox in ${entry.name} claims a different authenticated tenant`);
+      }
+      recovered.push(outbox);
     }
+    return Object.freeze(recovered);
   }
+  records() {
+    return Object.freeze([...this.pendingByTask.values()].sort((a, b) => a.cursor - b.cursor));
+  }
+  /** Activated records with no exact disposition yet; only these may be transport-replayed. */
+  retryableRecords() {
+    return Object.freeze(this.records().filter((record) => !this.dispositionByTask.has(record.taskId)));
+  }
+  get(taskId) {
+    return this.pendingByTask.get(taskId);
+  }
+  async appendDraft(input) {
+    return this.exclusive(async () => {
+      if (input.contentType !== input.requirement.contentType) throw new AgentMessageOutboxError("message contentType does not match the offer contract");
+      const byteCount = Buffer.byteLength(input.body, "utf8");
+      if (byteCount < 1 || byteCount > input.requirement.maxBytes) throw new AgentMessageOutboxError("message body exceeds the offer byte contract");
+      const existing = this.pendingByTask.get(input.taskId);
+      if (existing !== void 0) {
+        if (existing.tenantId !== input.tenantId || existing.contentType !== input.contentType || existing.body !== input.body || existing.contract !== input.requirement.contract || !sameAgentRef(existing.agentRef, input.agentRef)) {
+          throw new AgentMessageOutboxError("required-message task already has a different immutable draft");
+        }
+        return existing;
+      }
+      if (this.pendingByTask.size >= input.maxPendingEvents) throw new AgentMessageOutboxError("message outbox event quota is exhausted");
+      const pendingBytes = this.records().reduce((sum, record2) => sum + record2.byteCount, 0);
+      if (pendingBytes + byteCount > input.maxPendingBytes) throw new AgentMessageOutboxError("message outbox byte quota is exhausted");
+      const record = Object.freeze({
+        schema: 1,
+        taskId: input.taskId,
+        tenantId: input.tenantId,
+        agentRef: Object.freeze({ ...input.agentRef }),
+        contract: input.requirement.contract,
+        messageId: randomUUID(),
+        cursor: this.nextCursor++,
+        contentType: input.contentType,
+        body: input.body,
+        contentHash: hashBody(input.body),
+        byteCount,
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        ...input.sessionRef === void 0 ? {} : { sessionRef: input.sessionRef }
+      });
+      await this.appendEntry({ schema: 1, kind: "append", record });
+      this.pendingByTask.set(record.taskId, record);
+      return record;
+    });
+  }
+  async activate(taskId, sessionRef) {
+    return this.exclusive(async () => {
+      const record = this.pendingByTask.get(taskId);
+      if (record === void 0) return void 0;
+      if (record.sessionRef !== void 0) {
+        if (record.sessionRef !== sessionRef) throw new AgentMessageOutboxError("message draft is already bound to a different session");
+        return record;
+      }
+      await this.appendEntry({ schema: 1, kind: "activate", taskId, messageId: record.messageId, sessionRef });
+      const activated = Object.freeze({ ...record, sessionRef });
+      this.pendingByTask.set(taskId, activated);
+      return activated;
+    });
+  }
+  publishPayload(record) {
+    if (record.sessionRef === void 0) throw new AgentMessageOutboxError("message draft is not bound to a durable session");
+    return AgentMessagePublishPayloadSchema.parse({
+      agentRef: record.agentRef,
+      sessionRef: record.sessionRef,
+      contract: record.contract,
+      messageId: record.messageId,
+      cursor: record.cursor,
+      contentType: record.contentType,
+      body: record.body,
+      contentHash: record.contentHash,
+      byteCount: record.byteCount
+    });
+  }
+  async applyDisposition(taskId, input) {
+    return this.exclusive(async () => {
+      const disposition = AgentMessageDispositionPayloadSchema.parse(input);
+      const record = this.pendingByTask.get(taskId);
+      if (record === void 0) return "unknown";
+      if (!exactDisposition(record, disposition)) return "mismatch";
+      await this.appendEntry({ schema: 1, kind: "disposition", taskId, disposition });
+      if (disposition.outcome === "accepted") {
+        this.pendingByTask.delete(taskId);
+        this.dispositionByTask.delete(taskId);
+      } else {
+        this.dispositionByTask.set(taskId, disposition);
+      }
+      if (this.logEntries >= 512) await this.compact();
+      return disposition.outcome;
+    });
+  }
+  async load() {
+    let raw;
+    try {
+      const stat = await promises.stat(this.outboxPath);
+      if (stat.size > 64 * 1024 * 1024) throw new AgentMessageOutboxError("message outbox exceeds its bounded on-disk size");
+      raw = await promises.readFile(this.outboxPath, "utf8");
+    } catch (error) {
+      if (error.code === "ENOENT") return;
+      throw error;
+    }
+    for (const line of raw.split("\n")) {
+      if (line.length === 0) continue;
+      const entry = JSON.parse(line);
+      this.logEntries += 1;
+      if (entry.schema !== 1) throw new AgentMessageOutboxError("message outbox schema is unsupported");
+      if (entry.kind === "append") {
+        if (this.pendingByTask.has(entry.record.taskId)) throw new AgentMessageOutboxError("message outbox contains duplicate task draft");
+        this.pendingByTask.set(entry.record.taskId, Object.freeze(entry.record));
+        this.nextCursor = Math.max(this.nextCursor, entry.record.cursor + 1);
+      } else if (entry.kind === "activate") {
+        const record = this.pendingByTask.get(entry.taskId);
+        if (record === void 0 || record.messageId !== entry.messageId) throw new AgentMessageOutboxError("message activation has no exact draft");
+        if (record.sessionRef !== void 0 && record.sessionRef !== entry.sessionRef) throw new AgentMessageOutboxError("message activation session conflicts");
+        this.pendingByTask.set(entry.taskId, Object.freeze({ ...record, sessionRef: entry.sessionRef }));
+      } else if (entry.kind === "disposition") {
+        const record = this.pendingByTask.get(entry.taskId);
+        if (record === void 0 || !exactDisposition(record, entry.disposition)) throw new AgentMessageOutboxError("message outbox contains a mismatched disposition");
+        if (entry.disposition.outcome === "accepted") {
+          this.pendingByTask.delete(entry.taskId);
+          this.dispositionByTask.delete(entry.taskId);
+        } else {
+          this.dispositionByTask.set(entry.taskId, entry.disposition);
+        }
+      } else {
+        throw new AgentMessageOutboxError("message outbox entry kind is invalid");
+      }
+    }
+  }
+  async appendEntry(entry) {
+    const handle = await promises.open(this.outboxPath, constants.O_APPEND | constants.O_CREAT | constants.O_WRONLY, 384);
+    try {
+      await handle.write(`${stableJson(entry)}
+`, void 0, "utf8");
+      await handle.sync();
+      this.logEntries += 1;
+    } finally {
+      await handle.close();
+    }
+  }
+  async compact() {
+    const entries = this.records().flatMap((record) => {
+      const append = { schema: 1, kind: "append", record };
+      const disposition = this.dispositionByTask.get(record.taskId);
+      return disposition === void 0 ? [append] : [append, { schema: 1, kind: "disposition", taskId: record.taskId, disposition }];
+    });
+    await atomicWriteFile(this.outboxPath, entries.map(stableJson).join(entries.length === 0 ? "" : "\n"), { mode: 384 });
+    this.logEntries = entries.length;
+  }
+  async exclusive(fn) {
+    const prior = this.writeTail;
+    let release;
+    this.writeTail = new Promise((resolve) => {
+      release = resolve;
+    });
+    await prior;
+    try {
+      return await fn();
+    } finally {
+      release();
+    }
+  }
+};
+
+// src/daemon/memory-guidance.ts
+var AGENT_MEMORY_GUIDANCE = [
+  "At the start of this Agent task, first read `MEMORY.md` in the provided `cwd`.",
+  "Treat `MEMORY.md` as a concise, self-contained recovery index; if it is empty, initialize a brief index from durable, non-secret task knowledge.",
+  "Read files under `notes/` only as needed, following pointers from the index.",
+  "When task permissions allow and a durable value is learned, update the relevant `notes/` entry and the `MEMORY.md` index.",
+  "Never write credentials, secrets, tokens, API keys, private keys, or other authentication material to `MEMORY.md` or `notes/`."
+].join("\n");
+function prependAgentMemoryGuidance(instruction) {
+  return `${AGENT_MEMORY_GUIDANCE}
+
+${instruction}`;
 }
-var DEFAULT_MAX_TASK_OUTPUT_BYTES = 64 * 1024 * 1024;
-function isKnownRuntimeId(id) {
-  return RuntimeIdSchema.safeParse(id).success;
-}
-function terminalUsageNumber(value, maximum) {
-  return value !== void 0 && Number.isSafeInteger(value) && value >= 0 && value <= maximum ? value : void 0;
+var AGENT_MEMORY_AUDIT_FILENAME = "agent-memory-audit-v1.jsonl";
+var AGENT_MEMORY_OUTBOX_FILENAME = "agent-memory-redacted-outbox-v2.json";
+var AGENT_MEMORY_MAX_FILE_BYTES = 256 * 1024;
+var AGENT_MEMORY_MAX_SNAPSHOT_BYTES = 1024 * 1024;
+var AGENT_MEMORY_MAX_SNAPSHOT_FILES = 128;
+var AGENT_MEMORY_MAX_SNAPSHOT_ENTRIES = 512;
+var AGENT_MEMORY_MAX_LOCAL_LOG_BYTES = AGENT_MEMORY_MAX_SNAPSHOT_BYTES;
+var REVISION = /^sha256:[a-f0-9]{64}$/u;
+var SAFE_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
+var SECRET_LIKE = /(?:^|[-_.])(secret|token|credential|password|passwd|api[-_]?key|private[-_]?key|cookie)(?:$|[-_.])/iu;
+var encoder2 = new TextEncoder();
+var AGENT_MEMORY_PROJECTION_PUBLISH_TIMEOUT_MS = 1e4;
+var AgentMemoryError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AgentMemoryError";
+  }
+};
+var AgentMemoryRevisionConflictError = class extends AgentMemoryError {
+  constructor(expectedRevision, actualRevision) {
+    super(`Agent memory revision conflict: expected ${expectedRevision}, current ${actualRevision}`);
+    this.expectedRevision = expectedRevision;
+    this.actualRevision = actualRevision;
+    this.name = "AgentMemoryRevisionConflictError";
+  }
+  expectedRevision;
+  actualRevision;
+};
+var DRAINED_AGENT_MEMORY_PROJECTION_REPLAY = Object.freeze({ status: "drained" });
+var AgentMemoryProjectionReplayPendingError = class extends AgentMemoryError {
+  constructor(outcome) {
+    super("Agent memory projection replay remains pending");
+    this.outcome = outcome;
+    this.name = "AgentMemoryProjectionReplayPendingError";
+  }
+  outcome;
+};
+function digestBytes(content) {
+  return `sha256:${createHash("sha256").update(content).digest("hex")}`;
 }
-var DEFAULT_RUNTIME_PREFERENCE = ["claude", "codex", "pi"];
-function orderByPreference(candidates, preference) {
-  const rank = new Map(preference.map((id, index) => [id, index]));
-  return [...candidates].sort((a, b) => (rank.get(a.descriptor.id) ?? preference.length) - (rank.get(b.descriptor.id) ?? preference.length));
+function digest2(content) {
+  return digestBytes(encoder2.encode(content));
 }
-function adapterSupportsMode(descriptor, mode) {
-  return descriptor.capabilities.permissionModes.includes(mode);
+function nonEmpty(value) {
+  return typeof value === "string" && value.length > 0 && !/[\u0000\r\n]/u.test(value);
 }
-function adapterSupportsMcpToolsets(descriptor) {
-  return descriptor.capabilities.mcpToolsets === true;
+function revision(value) {
+  return typeof value === "string" && REVISION.test(value);
 }
-function withoutRequiredToolsets(payload) {
-  const { requiredToolsets, egressPolicy, ...offer } = payload;
-  return offer;
+function taskContext(value) {
+  if (!value || !nonEmpty(value.taskId) || !nonEmpty(value.tenantId) || !nonEmpty(value.deviceId) || !nonEmpty(value.sessionRef) || !nonEmpty(value.runtimeId) || !nonEmpty(value.leaseId) || !value.agentRef || !nonEmpty(value.agentRef.agentId) || !nonEmpty(value.agentRef.profileRevision) || !path3__default.isAbsolute(value.canonicalHome) || typeof value.homeIdentity?.dev !== "bigint" || typeof value.homeIdentity.ino !== "bigint") {
+    throw new AgentMemoryError("Agent memory requires an exact active Agent task context");
+  }
+  return Object.freeze({ ...value, agentRef: Object.freeze({ ...value.agentRef }), homeIdentity: Object.freeze({ ...value.homeIdentity }), canonicalHome: path3__default.resolve(value.canonicalHome) });
 }
-function sameEgressPolicy(left, right) {
-  return JSON.stringify(left) === JSON.stringify(right);
+function validateAgentMemoryPath(value) {
+  if (typeof value !== "string" || value.length === 0 || value.length > 1024 || /[\u0000\\]/u.test(value)) throw new AgentMemoryError("memory path is invalid");
+  if (value === "MEMORY.md") return value;
+  if (path3__default.posix.isAbsolute(value) || /[*?\[{]/u.test(value)) throw new AgentMemoryError("memory path must name exactly one file");
+  const parts = value.split("/");
+  if (parts.length < 2 || parts[0] !== "notes" || !value.endsWith(".md") || parts.some((part) => part === "" || part === "." || part === ".." || part === ".byok" || !SAFE_SEGMENT.test(part) || SECRET_LIKE.test(part))) {
+    throw new AgentMemoryError("memory path must be MEMORY.md or notes/<safe-relative>.md");
+  }
+  return value;
 }
-function offeredAgentRef(payload) {
-  if (!Object.prototype.hasOwnProperty.call(payload, "agentRef")) return void 0;
-  return validateAgentRef(payload.agentRef);
+var SECURE_DIRECTORY_DESCRIPTOR_ROOT = "/proc/self/fd";
+function isAgentMemorySecureFilesystemAvailable(externalHelperConfigured = false) {
+  const nativeLinux = process.platform === "linux" && typeof constants.O_NOFOLLOW === "number" && typeof constants.O_DIRECTORY === "number" && typeof constants.O_NONBLOCK === "number" && existsSync(SECURE_DIRECTORY_DESCRIPTOR_ROOT);
+  return nativeLinux || externalHelperConfigured && process.platform === "darwin";
 }
-function offeredSessionRef(payload) {
-  if (!Object.prototype.hasOwnProperty.call(payload, "sessionRef")) return void 0;
-  const value = payload.sessionRef;
-  return typeof value === "string" ? value : void 0;
+function requireSecureDirectoryDescriptors() {
+  if (!isAgentMemorySecureFilesystemAvailable(false) || process.platform !== "linux") {
+    throw new AgentMemoryError("Agent memory is unavailable because this Node platform lacks safe descriptor-relative filesystem operations");
+  }
+  return SECURE_DIRECTORY_DESCRIPTOR_ROOT;
 }
-function errorMessage4(err) {
-  return err instanceof Error ? err.message : String(err);
+function noFollowFlags(base) {
+  requireSecureDirectoryDescriptors();
+  return base | constants.O_NOFOLLOW;
 }
-function raceSettleFirst(fn, timeoutMs) {
-  return new Promise((resolve) => {
-    let settled = false;
-    const timer = setTimeout(() => {
-      if (!settled) {
-        settled = true;
-        resolve(false);
-      }
-    }, timeoutMs);
-    timer.unref?.();
-    void (async () => {
-      try {
-        await fn();
-      } catch {
-      }
-      if (!settled) {
-        settled = true;
-        clearTimeout(timer);
-        resolve(true);
-      }
-    })();
-  });
+function descriptorPath(handle) {
+  return `${requireSecureDirectoryDescriptors()}/${handle.fd}`;
 }
-function estimateEventBytes(event) {
+async function openPinnedDirectory(target, expectedIdentity) {
+  requireSecureDirectoryDescriptors();
+  let handle;
   try {
-    return Buffer.byteLength(JSON.stringify(event), "utf8");
-  } catch {
-    return 0;
+    handle = await promises.open(target, noFollowFlags(constants.O_RDONLY | constants.O_DIRECTORY));
+    const stat = await handle.stat({ bigint: true });
+    if (!stat.isDirectory() || stat.isSymbolicLink() || expectedIdentity !== void 0 && (stat.dev !== expectedIdentity.dev || stat.ino !== expectedIdentity.ino)) throw new AgentMemoryError("memory directory is not a real directory");
+    return handle;
+  } catch (error) {
+    await handle?.close().catch(() => {
+    });
+    if (error instanceof AgentMemoryError) throw error;
+    throw new AgentMemoryError("memory directory is unavailable or unsafe");
   }
 }
-async function openArtifact(workspaceDir, name) {
-  const realWorkspaceDir = await promises.realpath(workspaceDir).catch(() => workspaceDir);
-  const candidate = path3__default.resolve(realWorkspaceDir, name);
-  const prefix = realWorkspaceDir.endsWith(path3__default.sep) ? realWorkspaceDir : realWorkspaceDir + path3__default.sep;
-  if (candidate !== realWorkspaceDir && !candidate.startsWith(prefix)) {
-    return { ok: false, reason: `artifact name "${name}" resolves outside the task workspace \u2014 rejected` };
-  }
-  let realCandidate = candidate;
+async function withPinnedDirectory(home, parts, operation, expectedHomeIdentity) {
+  const handles = [];
   try {
-    realCandidate = await promises.realpath(candidate);
-  } catch {
-  }
-  if (realCandidate !== realWorkspaceDir && !realCandidate.startsWith(prefix)) {
-    return { ok: false, reason: `artifact name "${name}" resolves outside the task workspace \u2014 rejected` };
+    let directory = await openPinnedDirectory(home, expectedHomeIdentity);
+    handles.push(directory);
+    for (const part of parts) {
+      directory = await openPinnedDirectory(`${descriptorPath(directory)}/${part}`);
+      handles.push(directory);
+    }
+    return await operation(directory);
+  } finally {
+    await Promise.all(handles.reverse().map((handle) => handle.close().catch(() => {
+    })));
   }
-  const O_NOFOLLOW = constants.O_NOFOLLOW ?? 0;
+}
+async function withMemoryParent(context, relativePath, operation) {
+  const parts = relativePath.split("/");
+  const fileName = parts.pop();
+  if (fileName === void 0 || parts.some((part) => !SAFE_SEGMENT.test(part) && part !== ".byok")) throw new AgentMemoryError("memory path is invalid");
+  return withPinnedDirectory(context.canonicalHome, parts, (directory) => operation(directory, fileName), context.homeIdentity);
+}
+async function readPinnedFile(directory, fileName, maxBytes = AGENT_MEMORY_MAX_FILE_BYTES) {
   let handle;
   try {
-    handle = await promises.open(candidate, constants.O_RDONLY | O_NOFOLLOW);
-  } catch (err) {
-    return { ok: false, reason: `artifact "${name}" could not be opened: ${errorMessage4(err)}` };
+    handle = await promises.open(
+      `${descriptorPath(directory)}/${fileName}`,
+      noFollowFlags(constants.O_RDONLY | constants.O_NONBLOCK)
+    );
+  } catch (error) {
+    if (error.code === "ENOENT") return Object.freeze({ exists: false, content: "", revision: digest2(""), byteCount: 0 });
+    throw new AgentMemoryError("could not open memory file");
+  }
+  try {
+    const before = await handle.stat({ bigint: true });
+    if (!before.isFile() || before.isSymbolicLink() || before.size > BigInt(maxBytes)) throw new AgentMemoryError("memory file is not a bounded regular file");
+    const bytes = Buffer.alloc(Number(before.size));
+    let offset = 0;
+    while (offset < bytes.length) {
+      const read = await handle.read(bytes, offset, bytes.length - offset, offset);
+      if (read.bytesRead === 0) break;
+      offset += read.bytesRead;
+    }
+    const after = await handle.stat({ bigint: true });
+    if (offset !== bytes.length || after.size !== before.size || after.mtimeNs !== before.mtimeNs || after.ino !== before.ino) throw new AgentMemoryError("memory file changed during read");
+    const content = bytes.toString("utf8");
+    if (!Buffer.from(content, "utf8").equals(bytes)) throw new AgentMemoryError("memory file is not valid UTF-8");
+    return Object.freeze({ exists: true, content, revision: digestBytes(bytes), byteCount: bytes.length });
+  } finally {
+    await handle.close().catch(() => {
+    });
+  }
+}
+async function readFile(context, relativePath, maxBytes = AGENT_MEMORY_MAX_FILE_BYTES) {
+  if (context.filesystem !== void 0) return context.filesystem.read(relativePath, maxBytes);
+  return withMemoryParent(context, relativePath, (directory, fileName) => readPinnedFile(directory, fileName, maxBytes));
+}
+async function syncDirectory(directory) {
+  try {
+    await directory.sync();
+  } catch (error) {
+    if (!["EINVAL", "EPERM"].includes(error.code ?? "")) throw error;
+  }
+}
+async function replaceNative(context, relativePath, expected, content) {
+  const byteCount = encoder2.encode(content).byteLength;
+  if (byteCount > AGENT_MEMORY_MAX_FILE_BYTES) throw new AgentMemoryError("memory content exceeds its bounded file size");
+  return withMemoryParent(context, relativePath, async (directory, fileName) => {
+    const before = await readPinnedFile(directory, fileName);
+    if (before.revision !== expected) throw new AgentMemoryRevisionConflictError(expected, before.revision);
+    const parent = descriptorPath(directory);
+    const temporary = `${parent}/.byok-memory-${randomUUID()}.tmp`;
+    let handle;
+    try {
+      const check = await readPinnedFile(directory, fileName);
+      if (check.revision !== expected || check.exists !== before.exists) throw new AgentMemoryRevisionConflictError(expected, check.revision);
+      handle = await promises.open(temporary, noFollowFlags(constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL), 384);
+      await handle.writeFile(content, "utf8");
+      await handle.sync();
+      await handle.close();
+      handle = void 0;
+      const finalCheck = await readPinnedFile(directory, fileName);
+      if (finalCheck.revision !== expected || finalCheck.exists !== before.exists) throw new AgentMemoryRevisionConflictError(expected, finalCheck.revision);
+      await promises.rename(temporary, `${parent}/${fileName}`);
+      await syncDirectory(directory);
+      return Object.freeze({ exists: true, content, revision: digest2(content), byteCount });
+    } catch (error) {
+      await handle?.close().catch(() => {
+      });
+      await promises.rm(temporary, { force: true }).catch(() => {
+      });
+      if (error instanceof AgentMemoryError) throw error;
+      throw new AgentMemoryError("could not atomically replace memory file");
+    }
+  });
+}
+async function replace(context, relativePath, expected, content) {
+  if (context.filesystem !== void 0) return context.filesystem.replace(relativePath, expected, content, AGENT_MEMORY_MAX_FILE_BYTES);
+  return replaceNative(context, relativePath, expected, content);
+}
+async function removeNative(context, relativePath, expected) {
+  if (relativePath === "MEMORY.md") throw new AgentMemoryError("MEMORY.md may not be deleted");
+  await withMemoryParent(context, relativePath, async (directory, fileName) => {
+    const before = await readPinnedFile(directory, fileName);
+    if (!before.exists || before.revision !== expected) throw new AgentMemoryRevisionConflictError(expected, before.revision);
+    const parent = descriptorPath(directory);
+    const tombstone = `${parent}/.byok-memory-delete-${randomUUID()}.tmp`;
+    try {
+      const check = await readPinnedFile(directory, fileName);
+      if (!check.exists || check.revision !== expected) throw new AgentMemoryRevisionConflictError(expected, check.revision);
+      await promises.rename(`${parent}/${fileName}`, tombstone);
+      await syncDirectory(directory);
+      await promises.rm(tombstone);
+      await syncDirectory(directory);
+    } catch (error) {
+      if (error instanceof AgentMemoryError) throw error;
+      throw new AgentMemoryError("could not atomically delete memory file");
+    }
+  });
+}
+async function remove(context, relativePath, expected) {
+  if (relativePath === "MEMORY.md") throw new AgentMemoryError("MEMORY.md may not be deleted");
+  if (context.filesystem !== void 0) return context.filesystem.delete(relativePath, expected);
+  return removeNative(context, relativePath, expected);
+}
+async function readInternalFile(context, fileName) {
+  const relativePath = `${AGENT_HOME_INTERNAL_DIRECTORY}/${fileName}`;
+  if (context.filesystem !== void 0) return context.filesystem.read(relativePath, AGENT_MEMORY_MAX_LOCAL_LOG_BYTES);
+  return withPinnedDirectory(
+    context.canonicalHome,
+    [AGENT_HOME_INTERNAL_DIRECTORY],
+    (directory) => readPinnedFile(directory, fileName, AGENT_MEMORY_MAX_LOCAL_LOG_BYTES),
+    context.homeIdentity
+  );
+}
+async function replaceInternalFile(context, fileName, expectedRevision, content) {
+  const byteCount = encoder2.encode(content).byteLength;
+  if (byteCount > AGENT_MEMORY_MAX_LOCAL_LOG_BYTES) throw new AgentMemoryError("Agent memory internal state exceeds its bounded size");
+  const relativePath = `${AGENT_HOME_INTERNAL_DIRECTORY}/${fileName}`;
+  if (context.filesystem !== void 0) return context.filesystem.replace(relativePath, expectedRevision, content, AGENT_MEMORY_MAX_LOCAL_LOG_BYTES);
+  return withPinnedDirectory(context.canonicalHome, [AGENT_HOME_INTERNAL_DIRECTORY], async (directory) => {
+    const before = await readPinnedFile(directory, fileName, AGENT_MEMORY_MAX_LOCAL_LOG_BYTES);
+    if (before.revision !== expectedRevision) throw new AgentMemoryRevisionConflictError(expectedRevision, before.revision);
+    const parent = descriptorPath(directory);
+    const temporary = `${parent}/.byok-agent-memory-${randomUUID()}.tmp`;
+    let handle;
+    try {
+      handle = await promises.open(temporary, noFollowFlags(constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL), 384);
+      await handle.writeFile(content, "utf8");
+      await handle.sync();
+      await handle.close();
+      handle = void 0;
+      const check = await readPinnedFile(directory, fileName, AGENT_MEMORY_MAX_LOCAL_LOG_BYTES);
+      if (check.revision !== expectedRevision || check.exists !== before.exists) throw new AgentMemoryRevisionConflictError(expectedRevision, check.revision);
+      await promises.rename(temporary, `${parent}/${fileName}`);
+      await syncDirectory(directory);
+      return Object.freeze({ exists: true, content, revision: digest2(content), byteCount });
+    } catch (error) {
+      await handle?.close().catch(() => {
+      });
+      await promises.rm(temporary, { force: true }).catch(() => {
+      });
+      if (error instanceof AgentMemoryError) throw error;
+      throw new AgentMemoryError("could not atomically replace Agent memory internal state");
+    }
+  }, context.homeIdentity);
+}
+function boundedAuditTail(previous, entry) {
+  if (encoder2.encode(entry).byteLength > AGENT_MEMORY_MAX_LOCAL_LOG_BYTES) throw new AgentMemoryError("Agent memory audit entry exceeds its bounded size");
+  const lines = previous.split("\n").filter((line) => line.length > 0);
+  const kept = [entry];
+  let byteCount = encoder2.encode(entry).byteLength;
+  for (let index = lines.length - 1; index >= 0; index -= 1) {
+    const candidate = `${lines[index]}
+`;
+    const candidateBytes = encoder2.encode(candidate).byteLength;
+    if (byteCount + candidateBytes > AGENT_MEMORY_MAX_LOCAL_LOG_BYTES) break;
+    kept.unshift(candidate);
+    byteCount += candidateBytes;
+  }
+  return kept.join("");
+}
+async function audit(context, kind, values) {
+  const entry = `${JSON.stringify({ version: 1, kind, taskId: context.taskId, tenantId: context.tenantId, deviceId: context.deviceId, agentRef: context.agentRef, sessionRef: context.sessionRef, runtimeId: context.runtimeId, ...values, recordedAt: (/* @__PURE__ */ new Date()).toISOString() })}
+`;
+  const current = await readInternalFile(context, AGENT_MEMORY_AUDIT_FILENAME);
+  await replaceInternalFile(context, AGENT_MEMORY_AUDIT_FILENAME, current.revision, boundedAuditTail(current.content, entry));
+}
+async function recordAuditWarning(context, kind, values) {
+  try {
+    await audit(context, kind, values);
+    return void 0;
+  } catch {
+    return Object.freeze({ code: "agent_memory_audit_unavailable" });
+  }
+}
+var agentMemoryHomeQueues = /* @__PURE__ */ new Map();
+async function exclusiveAgentMemoryHome(home, fn) {
+  const previous = agentMemoryHomeQueues.get(home) ?? Promise.resolve();
+  let release;
+  const next = new Promise((resolve) => {
+    release = resolve;
+  });
+  agentMemoryHomeQueues.set(home, next);
+  await previous;
+  try {
+    return await fn();
+  } finally {
+    release();
+    if (agentMemoryHomeQueues.get(home) === next) agentMemoryHomeQueues.delete(home);
+  }
+}
+var AgentMemoryService = class {
+  constructor(input) {
+    this.input = input;
+  }
+  input;
+  async recall(input) {
+    const context = taskContext(this.input);
+    const relativePath = validateAgentMemoryPath(input.path);
+    if (input.ifRevision !== void 0 && !revision(input.ifRevision)) throw new AgentMemoryError("ifRevision must be a sha256 content revision");
+    const current = await readFile(context, relativePath);
+    if (!current.exists) throw new AgentMemoryError("memory file does not exist");
+    if (input.ifRevision !== void 0 && current.revision !== input.ifRevision) throw new AgentMemoryRevisionConflictError(input.ifRevision, current.revision);
+    const auditWarning = await exclusiveAgentMemoryHome(context.canonicalHome, () => recordAuditWarning(context, "recall", {
+      path: relativePath,
+      revision: current.revision,
+      byteCount: current.byteCount
+    }));
+    return Object.freeze({
+      path: relativePath,
+      revision: current.revision,
+      content: current.content,
+      ...auditWarning === void 0 ? {} : { auditWarning }
+    });
+  }
+  async save(input) {
+    const context = taskContext(this.input);
+    const relativePath = validateAgentMemoryPath(input.path);
+    if (input.op !== "replace" && input.op !== "delete" || !revision(input.expectedRevision)) throw new AgentMemoryError("memory save requires op and sha256 expectedRevision");
+    if (input.op === "replace" && typeof input.content !== "string") throw new AgentMemoryError("replace requires string content");
+    if (input.op === "delete" && input.content !== void 0) throw new AgentMemoryError("delete does not accept content");
+    const expectedRevision = input.expectedRevision;
+    const content = input.content;
+    return exclusiveAgentMemoryHome(context.canonicalHome, async () => {
+      if (input.op === "delete") {
+        await remove(context, relativePath, expectedRevision);
+        const auditWarning2 = await recordAuditWarning(context, "save", { path: relativePath, operation: "delete" });
+        return Object.freeze({ path: relativePath, deleted: true, ...auditWarning2 === void 0 ? {} : { auditWarning: auditWarning2 } });
+      }
+      if (typeof content !== "string") throw new AgentMemoryError("replace requires string content");
+      const current = await replace(context, relativePath, expectedRevision, content);
+      const auditWarning = await recordAuditWarning(context, "save", { path: relativePath, operation: "replace", revision: current.revision, byteCount: current.byteCount });
+      return Object.freeze({ path: relativePath, revision: current.revision, deleted: false, ...auditWarning === void 0 ? {} : { auditWarning } });
+    });
+  }
+};
+async function memoryNotePaths(context) {
+  if (context.filesystem !== void 0) {
+    const paths = await context.filesystem.walk("notes", AGENT_MEMORY_MAX_SNAPSHOT_ENTRIES);
+    const candidates2 = [];
+    for (const candidate of paths) {
+      try {
+        candidates2.push(validateAgentMemoryPath(candidate));
+      } catch {
+      }
+    }
+    return Object.freeze(candidates2);
+  }
+  const candidates = [];
+  let entriesSeen = 0;
+  async function walk(directory, relativeDirectory) {
+    const entries = await promises.readdir(descriptorPath(directory), { withFileTypes: true });
+    for (const entry of entries) {
+      entriesSeen += 1;
+      if (entriesSeen > AGENT_MEMORY_MAX_SNAPSHOT_ENTRIES) throw new AgentMemoryError("memory snapshot exceeds bounded directory entries");
+      const candidate = `${relativeDirectory}/${entry.name}`;
+      if (entry.isSymbolicLink()) throw new AgentMemoryError("memory notes contains a symlink");
+      if (entry.isDirectory()) {
+        if (SAFE_SEGMENT.test(entry.name) && !SECRET_LIKE.test(entry.name) && entry.name !== ".byok") {
+          const nested = await openPinnedDirectory(`${descriptorPath(directory)}/${entry.name}`);
+          try {
+            await walk(nested, candidate);
+          } finally {
+            await nested.close().catch(() => {
+            });
+          }
+        }
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      try {
+        candidates.push(validateAgentMemoryPath(candidate));
+      } catch {
+      }
+    }
+  }
+  await withPinnedDirectory(context.canonicalHome, ["notes"], (directory) => walk(directory, "notes"), context.homeIdentity);
+  return Object.freeze(candidates);
+}
+async function captureAgentMemorySnapshot(input) {
+  const context = taskContext(input);
+  const candidates = ["MEMORY.md", ...await memoryNotePaths(context)];
+  const paths = [...new Set(candidates)].sort((a, b) => a.localeCompare(b));
+  if (paths.length > AGENT_MEMORY_MAX_SNAPSHOT_FILES) throw new AgentMemoryError("memory snapshot exceeds bounded file count");
+  const files = [];
+  let totalBytes = 0;
+  for (const relativePath of paths) {
+    const current = await readFile(context, relativePath);
+    if (!current.exists) {
+      if (relativePath === "MEMORY.md") throw new AgentMemoryError("MEMORY.md disappeared before snapshot");
+      continue;
+    }
+    totalBytes += current.byteCount;
+    if (totalBytes > AGENT_MEMORY_MAX_SNAPSHOT_BYTES) throw new AgentMemoryError("memory snapshot exceeds bounded total size");
+    files.push(Object.freeze({ path: relativePath, revision: current.revision, byteCount: current.byteCount, content: current.content }));
+  }
+  const snapshot = Object.freeze({ files: Object.freeze(files), totalBytes });
+  await exclusiveAgentMemoryHome(context.canonicalHome, () => audit(context, "snapshot", {
+    files: files.map((file) => ({ path: file.path, revision: file.revision, byteCount: file.byteCount }))
+  }));
+  return snapshot;
+}
+function bytesEqual(left, right) {
+  if (left.byteLength !== right.byteLength) return false;
+  return left.every((value, index) => value === right[index]);
+}
+function rawSnapshotBytes(snapshot) {
+  return encoder2.encode(JSON.stringify({
+    files: snapshot.files.map((file) => ({ path: file.path, revision: file.revision, byteCount: file.byteCount, content: file.content }))
+  }));
+}
+function redactedBytes(raw, candidate) {
+  if (!(candidate instanceof Uint8Array)) throw new AgentMemoryError("redactor must return Uint8Array bytes");
+  const bytes = candidate.slice();
+  if (bytes.byteLength > AGENT_MEMORY_PROJECTION_MAX_REDACTED_BYTES) throw new AgentMemoryError("redacted snapshot exceeds bounded projection bytes");
+  if (bytesEqual(bytes, rawSnapshotBytes(raw))) throw new AgentMemoryError("identity/pass-through redactor is forbidden");
+  return bytes;
+}
+function isPlainRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function exactKeys(value, keys) {
+  const actual = Object.keys(value).sort();
+  const expected = [...keys].sort();
+  return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
+}
+function validOrderingValue(value, allowZero = false) {
+  return typeof value === "number" && Number.isInteger(value) && value >= (allowZero ? 0 : 1) && value <= AGENT_MEMORY_PROJECTION_MAX_ORDERING_VALUE;
+}
+function freezeOutboxRecord(value) {
+  if (!isPlainRecord(value) || !exactKeys(value, ["version", "mutation", "createdAt"]) || value.version !== 2 || typeof value.createdAt !== "string" || value.createdAt.length === 0 || /[\u0000\r\n]/u.test(value.createdAt)) throw new AgentMemoryError("Agent memory outbox state is invalid");
+  const mutation = AgentMemoryProjectionMutationSchema.safeParse(value.mutation);
+  if (!mutation.success) throw new AgentMemoryError("Agent memory outbox state is invalid");
+  return Object.freeze({ version: 2, mutation: Object.freeze(mutation.data), createdAt: value.createdAt });
+}
+function freezeOutboxState(value) {
+  if (!isPlainRecord(value) || !exactKeys(value, ["version", "currentWriterEpoch", "highWater", "pending"]) || value.version !== 2 || !validOrderingValue(value.currentWriterEpoch) || !Array.isArray(value.highWater) || !Array.isArray(value.pending)) throw new AgentMemoryError("Agent memory outbox state is invalid");
+  if (value.highWater.length > 1 || value.pending.length > 1) throw new AgentMemoryError("Agent memory outbox state is invalid");
+  const highWater = value.highWater.map((entry) => {
+    if (!isPlainRecord(entry) || !exactKeys(entry, ["writerEpoch", "sourceSeq"]) || !validOrderingValue(entry.writerEpoch) || !validOrderingValue(entry.sourceSeq, true)) throw new AgentMemoryError("Agent memory outbox state is invalid");
+    if (entry.writerEpoch !== value.currentWriterEpoch) throw new AgentMemoryError("Agent memory outbox state is invalid");
+    return Object.freeze({ writerEpoch: entry.writerEpoch, sourceSeq: entry.sourceSeq });
+  }).sort((left, right) => left.writerEpoch - right.writerEpoch);
+  const pending = value.pending.map(freezeOutboxRecord).sort((left, right) => left.mutation.sourceSeq - right.mutation.sourceSeq);
+  const seenEpochs = /* @__PURE__ */ new Set();
+  const highWaterByEpoch = /* @__PURE__ */ new Map();
+  for (const entry of highWater) {
+    if (seenEpochs.has(entry.writerEpoch)) throw new AgentMemoryError("Agent memory outbox state is invalid");
+    seenEpochs.add(entry.writerEpoch);
+    highWaterByEpoch.set(entry.writerEpoch, entry.sourceSeq);
+  }
+  const mutationIds = /* @__PURE__ */ new Set();
+  const sourceSeqs = /* @__PURE__ */ new Set();
+  for (const record of pending) {
+    if (record.mutation.writerEpoch !== value.currentWriterEpoch || mutationIds.has(record.mutation.mutationId) || sourceSeqs.has(record.mutation.sourceSeq) || record.mutation.sourceSeq > (highWaterByEpoch.get(record.mutation.writerEpoch) ?? 0)) throw new AgentMemoryError("Agent memory outbox state is invalid");
+    mutationIds.add(record.mutation.mutationId);
+    sourceSeqs.add(record.mutation.sourceSeq);
+  }
+  return Object.freeze({ version: 2, currentWriterEpoch: value.currentWriterEpoch, highWater: Object.freeze(highWater), pending: Object.freeze(pending) });
+}
+function outboxStateJson(state) {
+  return JSON.stringify({ version: state.version, currentWriterEpoch: state.currentWriterEpoch, highWater: state.highWater, pending: state.pending });
+}
+function initialOutboxState(writerEpoch) {
+  return freezeOutboxState({ version: 2, currentWriterEpoch: writerEpoch, highWater: [], pending: [] });
+}
+function stateWithHighWater(state, writerEpoch, sourceSeq, pending) {
+  if (writerEpoch !== state.currentWriterEpoch) throw new AgentMemoryError("Agent memory outbox state is invalid");
+  return freezeOutboxState({ version: 2, currentWriterEpoch: state.currentWriterEpoch, highWater: [Object.freeze({ writerEpoch, sourceSeq })], pending });
+}
+async function publishAgentMemoryProjection(port, mutation) {
+  let timer;
+  try {
+    return await new Promise((resolve, reject) => {
+      timer = setTimeout(
+        () => reject(new AgentMemoryError("Agent memory projection publish timed out")),
+        AGENT_MEMORY_PROJECTION_PUBLISH_TIMEOUT_MS
+      );
+      try {
+        Promise.resolve(port.publish(Object.freeze({ mutation }))).then(resolve, reject);
+      } catch (error) {
+        reject(error);
+      }
+    });
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+  }
+}
+var AgentMemoryRedactedOutbox = class _AgentMemoryRedactedOutbox {
+  constructor(context, grant, filePath) {
+    this.context = context;
+    this.grant = grant;
+    this.filePath = filePath;
+  }
+  context;
+  grant;
+  filePath;
+  state;
+  fileRevision;
+  writeTail = Promise.resolve();
+  static async open(input, grant) {
+    const context = taskContext(input);
+    const outbox = new _AgentMemoryRedactedOutbox(context, grant, path3__default.join(context.canonicalHome, AGENT_HOME_INTERNAL_DIRECTORY, AGENT_MEMORY_OUTBOX_FILENAME));
+    await outbox.load();
+    await outbox.admitGrant();
+    return outbox;
+  }
+  pending() {
+    return this.state.pending;
+  }
+  async append(bytes) {
+    return this.exclusive(async () => {
+      if (this.state.currentWriterEpoch !== this.grant.writerEpoch) throw new AgentMemoryError("Agent memory outbox writer epoch is stale");
+      if (this.state.pending.length > 0) throw new AgentMemoryError("Agent memory outbox has pending projection mutations");
+      const currentHighWater = this.state.highWater[0]?.sourceSeq ?? 0;
+      if (currentHighWater >= AGENT_MEMORY_PROJECTION_MAX_ORDERING_VALUE) throw new AgentMemoryError("Agent memory outbox source sequence is exhausted");
+      const sourceSeq = currentHighWater + 1;
+      const mutation = AgentMemoryProjectionMutationSchema.parse({
+        taskId: this.context.taskId,
+        agentRef: this.context.agentRef,
+        sessionRef: this.context.sessionRef,
+        runtimeId: this.context.runtimeId,
+        grantRef: this.grant.grantRef,
+        writerEpoch: this.grant.writerEpoch,
+        sourceSeq,
+        mutationId: randomUUID(),
+        policyRevision: this.grant.policyRevision,
+        snapshot: { redactedHash: digestBytes(bytes), redactedByteCount: bytes.byteLength, redactedBytes: Buffer.from(bytes).toString("base64url") }
+      });
+      const record = Object.freeze({ version: 2, mutation: Object.freeze(mutation), createdAt: (/* @__PURE__ */ new Date()).toISOString() });
+      await this.persist(stateWithHighWater(this.state, mutation.writerEpoch, mutation.sourceSeq, [record]));
+      return record;
+    });
+  }
+  async replay(port) {
+    return this.exclusive(async () => {
+      for (const record of this.pending()) {
+        if (!(await publishAgentMemoryProjection(port, record.mutation)).accepted) {
+          return Object.freeze({
+            status: "pending",
+            writerEpoch: record.mutation.writerEpoch,
+            sourceSeq: record.mutation.sourceSeq,
+            mutationId: record.mutation.mutationId
+          });
+        }
+        await this.persist(freezeOutboxState({
+          version: 2,
+          currentWriterEpoch: this.state.currentWriterEpoch,
+          highWater: this.state.highWater,
+          pending: this.state.pending.filter((candidate) => candidate.mutation.mutationId !== record.mutation.mutationId)
+        }));
+      }
+      return DRAINED_AGENT_MEMORY_PROJECTION_REPLAY;
+    });
+  }
+  async load() {
+    const current = await readInternalFile(this.context, AGENT_MEMORY_OUTBOX_FILENAME);
+    this.fileRevision = current.revision;
+    this.state = current.exists ? this.loadBody(current.content) : initialOutboxState(this.grant.writerEpoch);
+  }
+  loadBody(body) {
+    try {
+      return freezeOutboxState(JSON.parse(body));
+    } catch {
+      throw new AgentMemoryError("Agent memory outbox state is invalid");
+    }
+  }
+  async admitGrant() {
+    if (this.grant.writerEpoch < this.state.currentWriterEpoch) throw new AgentMemoryError("Agent memory outbox writer epoch is stale");
+    if (this.grant.writerEpoch === this.state.currentWriterEpoch) return;
+    await this.persist(freezeOutboxState({ version: 2, currentWriterEpoch: this.grant.writerEpoch, highWater: [], pending: [] }));
+  }
+  async persist(next) {
+    const replaced = await replaceInternalFile(this.context, AGENT_MEMORY_OUTBOX_FILENAME, this.fileRevision, outboxStateJson(next));
+    this.fileRevision = replaced.revision;
+    this.state = next;
+  }
+  async exclusive(fn) {
+    const previous = this.writeTail;
+    let release;
+    this.writeTail = new Promise((resolve) => {
+      release = resolve;
+    });
+    await previous;
+    try {
+      return await fn();
+    } finally {
+      release();
+    }
+  }
+};
+async function snapshotAndProjectAgentMemory(input, projection) {
+  if (projection?.capability !== AGENT_MEMORY_PROJECTION_CAPABILITY || !projection.grant || !projection.redactor || !projection.port) return;
+  const context = taskContext(input);
+  const outbox = await AgentMemoryRedactedOutbox.open(context, projection.grant);
+  const initialReplay = await outbox.replay(projection.port);
+  if (initialReplay.status === "pending") throw new AgentMemoryProjectionReplayPendingError(initialReplay);
+  const snapshot = await captureAgentMemorySnapshot(context);
+  await outbox.append(redactedBytes(snapshot, await projection.redactor.redact(snapshot)));
+  const trailingReplay = await outbox.replay(projection.port);
+  if (trailingReplay.status === "pending") throw new AgentMemoryProjectionReplayPendingError(trailingReplay);
+}
+var AGENT_MEMORY_FILESYSTEM_HELPER_PROTOCOL = 2;
+var AGENT_MEMORY_FILESYSTEM_HELPER_VERSION = "2";
+var HELPER_REQUEST_TIMEOUT_MS = 1e4;
+var HELPER_MAX_JSON_LINE_BYTES = 2 * 1024 * 1024;
+var HELPER_MAX_CONTENT_BYTES = 1 * 1024 * 1024;
+var HELPER_MAX_STDERR_BYTES = 4 * 1024;
+var HelperRevisionConflict = class extends Error {
+  constructor(actualRevision) {
+    super("helper revision conflict");
+    this.actualRevision = actualRevision;
+  }
+  actualRevision;
+};
+function safeHelperPath(value) {
+  if (typeof value !== "string" || !path3__default.isAbsolute(value) || value.length === 0 || /[\u0000\r\n]/u.test(value)) {
+    throw new AgentMemoryError("Agent memory filesystem helper must be an explicit absolute executable path");
+  }
+  return path3__default.resolve(value);
+}
+function helperPlatformSupported() {
+  return process.platform === "darwin";
+}
+function isAgentMemoryFilesystemHelperSupported() {
+  return helperPlatformSupported();
+}
+function unixIdentity(homeIdentity) {
+  return Object.freeze({ kind: "unix", dev: homeIdentity.dev.toString(10), ino: homeIdentity.ino.toString(10) });
+}
+function responseRecord(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const record = value;
+  if (typeof record.id !== "string" || record.protocol !== AGENT_MEMORY_FILESYSTEM_HELPER_PROTOCOL || typeof record.ok !== "boolean") return void 0;
+  if (record.ok) {
+    if (record.result === null || typeof record.result !== "object" || Array.isArray(record.result)) return void 0;
+    return record;
+  }
+  if (record.error === null || typeof record.error !== "object" || Array.isArray(record.error)) return void 0;
+  const error = record.error;
+  if (typeof error.code !== "string" || typeof error.message !== "string" || error.actualRevision !== void 0 && typeof error.actualRevision !== "string") return void 0;
+  return record;
+}
+function boundedFileState(result, maxBytes) {
+  let content;
+  try {
+    if (typeof result.contentBase64 !== "string" || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}|[A-Za-z0-9+/]{3})?$/u.test(result.contentBase64)) {
+      throw new Error("invalid base64");
+    }
+    content = Buffer.from(result.contentBase64, "base64").toString("utf8");
+  } catch {
+    throw new AgentMemoryError("Agent memory filesystem helper returned an invalid file state");
+  }
+  if (typeof result.exists !== "boolean" || typeof result.revision !== "string" || typeof result.byteCount !== "number" || !Number.isSafeInteger(result.byteCount) || result.byteCount < 0 || result.byteCount > maxBytes || Buffer.byteLength(content, "utf8") !== result.byteCount || !/^sha256:[a-f0-9]{64}$/u.test(result.revision)) {
+    throw new AgentMemoryError("Agent memory filesystem helper returned an invalid file state");
+  }
+  return Object.freeze({ exists: result.exists, content, revision: result.revision, byteCount: result.byteCount });
+}
+function encodeReplaceContent(content, maxBytes) {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 0 || maxBytes > HELPER_MAX_CONTENT_BYTES) {
+    throw new AgentMemoryError("Agent memory filesystem helper requested an invalid byte limit");
+  }
+  const bytes = Buffer.from(content, "utf8");
+  if (bytes.byteLength > maxBytes) {
+    throw new AgentMemoryError("Agent memory filesystem helper replacement exceeds its requested byte limit");
+  }
+  return bytes.toString("base64").replace(/=+$/u, "");
+}
+var AgentMemoryFilesystemHelperClient = class _AgentMemoryFilesystemHelperClient {
+  constructor(child) {
+    this.child = child;
+    child.stdout.on("data", (chunk) => this.handleStdoutChunk(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)));
+    child.stderr.on("data", (chunk) => {
+      this.stderrBytes += Buffer.byteLength(chunk);
+      if (this.stderrBytes > HELPER_MAX_STDERR_BYTES) this.fail(new AgentMemoryError("Agent memory filesystem helper exceeded bounded stderr"));
+    });
+    child.stdin.on("error", () => this.fail(new AgentMemoryError("Agent memory filesystem helper request could not be written")));
+    child.once("error", () => this.fail(new AgentMemoryError("Agent memory filesystem helper could not be started")));
+    child.once("exit", (code, signal) => {
+      if (!this.closed || code !== 0) this.fail(new AgentMemoryError(`Agent memory filesystem helper exited unexpectedly (${code ?? signal ?? "unknown"})`));
+    });
+  }
+  child;
+  pending = /* @__PURE__ */ new Map();
+  stdoutBuffer = Buffer.alloc(0);
+  sequence = 0;
+  stderrBytes = 0;
+  closed = false;
+  fatalError;
+  static async open(input) {
+    if (!helperPlatformSupported()) throw new AgentMemoryError("Agent memory filesystem helper is not admitted on this platform");
+    const helperBin = safeHelperPath(input.helperBin);
+    const child = spawn(helperBin, ["serve"], {
+      stdio: ["pipe", "pipe", "pipe"],
+      shell: false,
+      windowsHide: true,
+      env: Object.freeze({})
+    });
+    const client = new _AgentMemoryFilesystemHelperClient(child);
+    try {
+      const result = await client.request("open", {
+        root: path3__default.resolve(input.canonicalHome),
+        expectedIdentity: unixIdentity(input.homeIdentity)
+      });
+      if (result.helperVersion !== AGENT_MEMORY_FILESYSTEM_HELPER_VERSION) throw new AgentMemoryError("Agent memory filesystem helper version mismatch");
+      const identity = result.identity;
+      if (identity === null || typeof identity !== "object" || Array.isArray(identity)) throw new AgentMemoryError("Agent memory filesystem helper omitted root identity");
+      const actual = identity;
+      const expected = unixIdentity(input.homeIdentity);
+      if (actual.kind !== expected.kind || actual.dev !== expected.dev || actual.ino !== expected.ino) throw new AgentMemoryError("Agent memory filesystem helper root identity mismatch");
+      return client;
+    } catch (error) {
+      await client.close().catch(() => {
+      });
+      throw error;
+    }
+  }
+  async read(relativePath, maxBytes) {
+    return boundedFileState(await this.request("read", { path: relativePath, maxBytes }), maxBytes);
+  }
+  async replace(relativePath, expectedRevision, content, maxBytes) {
+    try {
+      const contentBase64 = encodeReplaceContent(content, maxBytes);
+      return boundedFileState(await this.request("replace", { path: relativePath, expectedRevision, contentBase64, maxBytes }), maxBytes);
+    } catch (error) {
+      if (error instanceof HelperRevisionConflict) throw new AgentMemoryRevisionConflictError(expectedRevision, error.actualRevision);
+      throw error;
+    }
+  }
+  async delete(relativePath, expectedRevision) {
+    try {
+      await this.request("delete", { path: relativePath, expectedRevision });
+    } catch (error) {
+      if (error instanceof HelperRevisionConflict) throw new AgentMemoryRevisionConflictError(expectedRevision, error.actualRevision);
+      throw error;
+    }
+  }
+  async append(relativePath, content, maxBytes) {
+    await this.request("append", { path: relativePath, content, maxBytes });
+  }
+  async walk(relativePath, maxEntries) {
+    const result = await this.request("walk", { path: relativePath, maxEntries });
+    if (!Array.isArray(result.paths) || result.paths.length > maxEntries || result.paths.some((candidate) => typeof candidate !== "string")) {
+      throw new AgentMemoryError("Agent memory filesystem helper returned an invalid walk result");
+    }
+    return Object.freeze([...result.paths]);
+  }
+  async close() {
+    if (this.closed) return;
+    this.closed = true;
+    try {
+      if (this.child.exitCode === null && this.child.signalCode === null && this.fatalError === void 0) await this.requestWhileClosing("close", {});
+    } finally {
+      this.child.stdin.end();
+      if (this.child.exitCode === null && this.child.signalCode === null) this.child.kill();
+      this.rejectPending(new AgentMemoryError("Agent memory filesystem helper is closed"));
+    }
+  }
+  request(op, fields) {
+    if (this.closed) return Promise.reject(new AgentMemoryError("Agent memory filesystem helper is closed"));
+    return this.requestInternal(op, fields);
+  }
+  requestWhileClosing(op, fields) {
+    return this.requestInternal(op, fields);
+  }
+  requestInternal(op, fields) {
+    if (this.fatalError !== void 0) return Promise.reject(this.fatalError);
+    const id = `m${++this.sequence}`;
+    let line;
+    try {
+      line = `${JSON.stringify({ id, protocol: AGENT_MEMORY_FILESYSTEM_HELPER_PROTOCOL, op, ...fields })}
+`;
+    } catch {
+      return Promise.reject(new AgentMemoryError("Agent memory filesystem helper request could not be encoded"));
+    }
+    if (Buffer.byteLength(line, "utf8") > HELPER_MAX_JSON_LINE_BYTES) {
+      return Promise.reject(new AgentMemoryError("Agent memory filesystem helper request exceeded bounded stdin"));
+    }
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        this.pending.delete(id);
+        const error = new AgentMemoryError("Agent memory filesystem helper request timed out");
+        reject(error);
+        this.fail(error);
+      }, HELPER_REQUEST_TIMEOUT_MS);
+      timer.unref?.();
+      this.pending.set(id, { resolve: (response) => resolve(response.result), reject, timer });
+      this.child.stdin.write(line, (error) => {
+        if (!error) return;
+        const item = this.pending.get(id);
+        if (item === void 0) return;
+        clearTimeout(item.timer);
+        this.pending.delete(id);
+        item.reject(new AgentMemoryError("Agent memory filesystem helper request could not be written"));
+      });
+    });
+  }
+  handleStdoutChunk(chunk) {
+    let offset = 0;
+    while (offset < chunk.length && this.fatalError === void 0) {
+      const newline = chunk.indexOf(10, offset);
+      const end = newline === -1 ? chunk.length : newline;
+      const segment = chunk.subarray(offset, end);
+      if (this.stdoutBuffer.length + segment.length > HELPER_MAX_JSON_LINE_BYTES) {
+        this.fail(new AgentMemoryError("Agent memory filesystem helper exceeded bounded stdout"));
+        return;
+      }
+      this.stdoutBuffer = this.stdoutBuffer.length === 0 ? Buffer.from(segment) : Buffer.concat([this.stdoutBuffer, segment]);
+      if (newline === -1) return;
+      const line = this.stdoutBuffer;
+      this.stdoutBuffer = Buffer.alloc(0);
+      this.handleLine(line);
+      offset = newline + 1;
+    }
+  }
+  handleLine(line) {
+    let parsed;
+    try {
+      parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(line));
+    } catch {
+      this.fail(new AgentMemoryError("Agent memory filesystem helper returned malformed JSON"));
+      return;
+    }
+    const response = responseRecord(parsed);
+    if (response === void 0) {
+      this.fail(new AgentMemoryError("Agent memory filesystem helper returned an invalid response"));
+      return;
+    }
+    const item = this.pending.get(response.id);
+    if (item === void 0) {
+      this.fail(new AgentMemoryError("Agent memory filesystem helper returned an unsolicited response"));
+      return;
+    }
+    clearTimeout(item.timer);
+    this.pending.delete(response.id);
+    if (response.ok) {
+      item.resolve(response);
+      return;
+    }
+    if (response.error.code === "revision_conflict" && typeof response.error.actualRevision === "string") {
+      item.reject(new HelperRevisionConflict(response.error.actualRevision));
+      return;
+    }
+    item.reject(new AgentMemoryError(`Agent memory filesystem helper rejected the operation: ${response.error.code}`));
+  }
+  fail(error) {
+    if (this.fatalError !== void 0) return;
+    this.fatalError = error;
+    this.rejectPending(error);
+    if (this.child.exitCode === null && this.child.signalCode === null) this.child.kill();
+  }
+  rejectPending(error) {
+    for (const item of this.pending.values()) {
+      clearTimeout(item.timer);
+      item.reject(error);
+    }
+    this.pending.clear();
+  }
+};
+async function openAgentMemoryFilesystemHelper(input) {
+  return AgentMemoryFilesystemHelperClient.open(input);
+}
+
+// src/daemon/task-runner.ts
+var DEFAULT_APPROVAL_TIMEOUT_MS = 10 * 6e4;
+var DEFAULT_SHUTDOWN_INTERRUPT_TIMEOUT_MS = 5e3;
+var AGENT_TERMINAL_EVIDENCE_MAX_ATTEMPTS = 3;
+var AGENT_TERMINAL_EVIDENCE_RETRY_DELAY_MS = 20;
+var GIT_OBSERVATION_TIMEOUT_MS = 5e3;
+var MAX_PENDING_APPROVALS_PER_TASK = 16;
+var NoPendingApprovalError = class extends Error {
+  constructor(taskId) {
+    super(`no pending out-of-band approval to resolve for task ${taskId}`);
+    this.taskId = taskId;
+    this.name = "NoPendingApprovalError";
+  }
+  taskId;
+};
+var MAX_INLINE_ARTIFACT_BYTES = 64 * 1024;
+var MAX_TRACKED_TASK_IDS = 2e3;
+var MAX_DURATION_EXCEEDED_REASON_PREFIX = "resource limit exceeded: maxDurationMs";
+var MAX_OUTPUT_BYTES_EXCEEDED_REASON_PREFIX = "resource limit exceeded: maxTaskOutputBytes";
+var MAX_PROGRESS_BATCH_BYTES_EXCEEDED_REASON_PREFIX = "resource limit exceeded: progressBatch.maxBatchBytes";
+var RESULT_DOCUMENT_UNDELIVERABLE_REASON_PREFIX = "result document undeliverable";
+function resultDocumentRejectionDetail(check) {
+  switch (check.reason) {
+    case "over-cap":
+      return `${check.bytes} bytes as canonical JSON, over the ${RESULT_DOCUMENT_MAX_BYTES}-byte limit (it is never truncated \u2014 a truncated JSON document is not valid JSON; use artifactRefs for a result this size)`;
+    case "not-serializable":
+      return "not JSON-serializable (JSON.stringify threw, or produced no output at all)";
+    case "not-plain-json":
+      return "not plain JSON data: it does not equal its own JSON round trip, so serializing it would silently change it (an undefined-valued key, NaN, a function or symbol value, a Date, a toJSON that rewrites the value, or a getter that answers differently on a second read)";
+    default: {
+      const exhaustive = check;
+      throw new Error(`unhandled result document rejection: ${JSON.stringify(exhaustive)}`);
+    }
+  }
+}
+var DEFAULT_MAX_TASK_OUTPUT_BYTES = 64 * 1024 * 1024;
+function isKnownRuntimeId(id) {
+  return RuntimeIdSchema.safeParse(id).success;
+}
+function terminalUsageNumber(value, maximum) {
+  return value !== void 0 && Number.isSafeInteger(value) && value >= 0 && value <= maximum ? value : void 0;
+}
+var DEFAULT_RUNTIME_PREFERENCE = ["claude", "codex", "pi"];
+function orderByPreference(candidates, preference) {
+  const rank = new Map(preference.map((id, index) => [id, index]));
+  return [...candidates].sort((a, b) => (rank.get(a.descriptor.id) ?? preference.length) - (rank.get(b.descriptor.id) ?? preference.length));
+}
+function adapterSupportsMode(descriptor, mode) {
+  return descriptor.capabilities.permissionModes.includes(mode);
+}
+function adapterSupportsMcpToolsets(descriptor) {
+  return descriptor.capabilities.mcpToolsets === true;
+}
+function withoutRequiredToolsets(payload) {
+  const { requiredToolsets, egressPolicy, messageEgress, ...offer } = payload;
+  return offer;
+}
+function sameEgressPolicy(left, right) {
+  return JSON.stringify(left) === JSON.stringify(right);
+}
+function offeredAgentRef(payload) {
+  if (!Object.prototype.hasOwnProperty.call(payload, "agentRef")) return void 0;
+  return validateAgentRef(payload.agentRef);
+}
+function offeredSessionRef(payload) {
+  if (!Object.prototype.hasOwnProperty.call(payload, "sessionRef")) return void 0;
+  const value = payload.sessionRef;
+  return typeof value === "string" ? value : void 0;
+}
+function errorMessage4(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function raceSettleFirst(fn, timeoutMs) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const timer = setTimeout(() => {
+      if (!settled) {
+        settled = true;
+        resolve(false);
+      }
+    }, timeoutMs);
+    timer.unref?.();
+    void (async () => {
+      try {
+        await fn();
+      } catch {
+      }
+      if (!settled) {
+        settled = true;
+        clearTimeout(timer);
+        resolve(true);
+      }
+    })();
+  });
+}
+function estimateEventBytes(event) {
+  try {
+    return Buffer.byteLength(JSON.stringify(event), "utf8");
+  } catch {
+    return 0;
+  }
+}
+async function openArtifact(workspaceDir, name) {
+  const realWorkspaceDir = await promises.realpath(workspaceDir).catch(() => workspaceDir);
+  const candidate = path3__default.resolve(realWorkspaceDir, name);
+  const prefix = realWorkspaceDir.endsWith(path3__default.sep) ? realWorkspaceDir : realWorkspaceDir + path3__default.sep;
+  if (candidate !== realWorkspaceDir && !candidate.startsWith(prefix)) {
+    return { ok: false, reason: `artifact name "${name}" resolves outside the task workspace \u2014 rejected` };
+  }
+  let realCandidate = candidate;
+  try {
+    realCandidate = await promises.realpath(candidate);
+  } catch {
+  }
+  if (realCandidate !== realWorkspaceDir && !realCandidate.startsWith(prefix)) {
+    return { ok: false, reason: `artifact name "${name}" resolves outside the task workspace \u2014 rejected` };
+  }
+  const O_NOFOLLOW = constants.O_NOFOLLOW ?? 0;
+  let handle;
+  try {
+    handle = await promises.open(candidate, constants.O_RDONLY | O_NOFOLLOW);
+  } catch (err) {
+    return { ok: false, reason: `artifact "${name}" could not be opened: ${errorMessage4(err)}` };
   }
   try {
     const st = await handle.stat();
@@ -10706,6 +11880,16 @@ var TaskRunner = class {
   }
   deps;
   tasks = /* @__PURE__ */ new Map();
+  pendingMessageTasks = /* @__PURE__ */ new Map();
+  messageContextByToken = /* @__PURE__ */ new Map();
+  messageContextByTask = /* @__PURE__ */ new Map();
+  memoryContextByToken = /* @__PURE__ */ new Map();
+  memoryContextByTask = /* @__PURE__ */ new Map();
+  memoryInFlightByTask = /* @__PURE__ */ new Map();
+  memoryClosingTasks = /* @__PURE__ */ new Set();
+  memoryFilesystemByTask = /* @__PURE__ */ new Map();
+  recoveredMessageOutboxes = /* @__PURE__ */ new Map();
+  recoveredMessageRetryTimers = /* @__PURE__ */ new Map();
   /**
    * Finding F4 (cancel lost during the offer-processing window): a
    * `task.cancel` for a taskId that hasn't finished `handleOffer` yet (still
@@ -10845,6 +12029,128 @@ var TaskRunner = class {
       pendingApprovals: (active.pendingApprovalId !== void 0 ? 1 : 0) + active.approvalQueue.length
     }));
   }
+  /** Authenticated control-socket entry used only by the SDK-owned task MCP helper. */
+  async publishAgentMessage(input) {
+    const taskId = this.messageContextByToken.get(input.contextToken);
+    if (taskId === void 0 || this.messageContextByTask.get(taskId) !== input.contextToken) {
+      throw new Error("invalid or expired Agent message task context");
+    }
+    const pending = this.pendingMessageTasks.get(taskId);
+    const active = this.tasks.get(taskId);
+    const context = pending ?? (active?.messageRequirement && active.agentRef && active.messageOutbox ? { agentRef: active.agentRef, requirement: active.messageRequirement, outbox: active.messageOutbox } : void 0);
+    if (context === void 0) throw new Error("task has no active required Agent message contract");
+    const record = await context.outbox.appendDraft({
+      taskId,
+      tenantId: this.deps.tenantId,
+      agentRef: context.agentRef,
+      requirement: context.requirement,
+      contentType: input.contentType,
+      body: input.body,
+      maxPendingEvents: 64,
+      maxPendingBytes: 4 * 1024 * 1024
+    });
+    if (active === void 0) return { messageId: record.messageId, state: "staged" };
+    const activated = await context.outbox.activate(taskId, active.session.sessionRef);
+    if (activated === void 0) throw new Error("Agent message draft disappeared before activation");
+    this.sendAgentMessageRecord(context.outbox, activated);
+    return { messageId: activated.messageId, state: "pending" };
+  }
+  /** Authenticated control-socket entry used only by the SDK-owned memory MCP helper. */
+  async recallAgentMemory(input) {
+    return this.runMemoryOperation(input.contextToken, (context) => new AgentMemoryService(context).recall(input));
+  }
+  /** Authenticated control-socket entry used only by the SDK-owned memory MCP helper. */
+  async saveAgentMemory(input) {
+    return this.runMemoryOperation(input.contextToken, (context) => new AgentMemoryService(context).save(input));
+  }
+  /** Restore activated, unaccepted message drafts before transport admission on daemon restart. */
+  async recoverAgentMessageOutboxes(agentsRoot) {
+    if (this.deps.tenantId === void 0) throw new Error("Agent message recovery requires authenticated tenant enrollment");
+    for (const outbox of await AgentMessageOutbox.recover(agentsRoot, this.deps.tenantId)) {
+      for (const record of outbox.retryableRecords()) {
+        if (record.sessionRef === void 0) continue;
+        const existing = this.recoveredMessageOutboxes.get(record.taskId);
+        if (existing !== void 0 && existing !== outbox) throw new Error(`multiple Agent message outboxes claim task ${record.taskId}`);
+        this.recoveredMessageOutboxes.set(record.taskId, outbox);
+      }
+    }
+  }
+  /** Retry stable recovered records after a transport handshake/re-handshake. */
+  retryRecoveredAgentMessages() {
+    for (const [taskId, outbox] of this.recoveredMessageOutboxes) {
+      const record = outbox.get(taskId);
+      if (record?.sessionRef !== void 0) this.sendAgentMessageRecord(outbox, record);
+    }
+  }
+  sendAgentMessageRecord(outbox, record) {
+    this.deps.send(createEnvelope("agent.message.publish", outbox.publishPayload(record), {
+      taskId: record.taskId,
+      sessionRef: record.sessionRef
+    }));
+    const active = this.tasks.get(record.taskId);
+    if (active?.messageOutbox === outbox) {
+      if (active.messageRetryTimer !== void 0) clearTimeout(active.messageRetryTimer);
+      active.messageRetryTimer = setTimeout(() => {
+        active.messageRetryTimer = void 0;
+        if (this.tasks.get(record.taskId) !== active) return;
+        const pending = outbox.get(record.taskId);
+        if (pending !== void 0) this.sendAgentMessageRecord(outbox, pending);
+      }, 1e3);
+      active.messageRetryTimer.unref?.();
+      return;
+    }
+    if (this.recoveredMessageOutboxes.get(record.taskId) === outbox) {
+      const prior = this.recoveredMessageRetryTimers.get(record.taskId);
+      if (prior !== void 0) clearTimeout(prior);
+      const timer = setTimeout(() => {
+        this.recoveredMessageRetryTimers.delete(record.taskId);
+        const pending = outbox.get(record.taskId);
+        if (pending !== void 0 && this.recoveredMessageOutboxes.get(record.taskId) === outbox) {
+          this.sendAgentMessageRecord(outbox, pending);
+        }
+      }, 1e3);
+      timer.unref?.();
+      this.recoveredMessageRetryTimers.set(record.taskId, timer);
+    }
+  }
+  async handleAgentMessageDisposition(taskId, disposition) {
+    const active = this.tasks.get(taskId);
+    const outbox = active?.messageOutbox ?? this.recoveredMessageOutboxes.get(taskId);
+    if (outbox === void 0) return;
+    const outcome = await outbox.applyDisposition(taskId, disposition);
+    if (active === void 0) {
+      if (outcome === "accepted" || outcome === "held" || outcome === "refused") {
+        const timer = this.recoveredMessageRetryTimers.get(taskId);
+        if (timer !== void 0) clearTimeout(timer);
+        this.recoveredMessageRetryTimers.delete(taskId);
+      }
+      if (outcome === "accepted") this.recoveredMessageOutboxes.delete(taskId);
+      return;
+    }
+    if (outcome === "held") {
+      if (active.messageRetryTimer !== void 0) clearTimeout(active.messageRetryTimer);
+      active.messageRetryTimer = void 0;
+      return;
+    }
+    if (outcome === "refused") {
+      if (active.messageRetryTimer !== void 0) clearTimeout(active.messageRetryTimer);
+      active.messageRetryTimer = void 0;
+      this.revokeAgentMessageContext(taskId);
+      return;
+    }
+    if (outcome !== "accepted") return;
+    if (active.messageRetryTimer !== void 0) {
+      clearTimeout(active.messageRetryTimer);
+      active.messageRetryTimer = void 0;
+    }
+    active.messageAccepted = true;
+    this.revokeAgentMessageContext(taskId);
+    if (active.pendingMessageCompletion !== void 0) {
+      const completion = active.pendingMessageCompletion;
+      active.pendingMessageCompletion = void 0;
+      await this.publishSuccessfulCompletion(active, completion.finalOutput, completion.document);
+    }
+  }
   /** M4 Phase 2: stop claiming any FUTURE `task.offer` — see `stoppingOffers`'s own doc comment. Idempotent. */
   stopAcceptingOffers() {
     this.stoppingOffers = true;
@@ -11020,6 +12326,9 @@ var TaskRunner = class {
       case "task.reject":
         await this.handleReject(envelope.task_id, envelope.payload.reason, envelope.payload.approvalId);
         return;
+      case "agent.message.disposition":
+        await this.handleAgentMessageDisposition(envelope.task_id, envelope.payload);
+        return;
       default:
         return;
     }
@@ -11050,12 +12359,22 @@ var TaskRunner = class {
       this.decline(taskId, reason, retryable, agentRef);
     };
     const sessionRef = offeredSessionRef(payload);
+    const messageRequirement = "messageEgress" in payload ? payload.messageEgress : void 0;
+    const terminalProjection = "terminalProjection" in payload ? payload.terminalProjection : void 0;
     if ("egressPolicy" in payload) {
       if (this.deps.agentEgressPolicy === void 0 || !sameEgressPolicy(this.deps.agentEgressPolicy, payload.egressPolicy)) {
         decline("Agent egress offer policy is not exactly enabled by this daemon", false);
         return;
       }
     }
+    if (messageRequirement !== void 0 && (agentRef === void 0 || this.deps.agentMessageMcpBin === void 0 || this.deps.tenantId === void 0)) {
+      decline("required Agent message egress is unavailable on this daemon", false);
+      return;
+    }
+    if (terminalProjection?.mode === "result-document" && this.deps.resultDocument === void 0) {
+      decline("offer requires a result document but this daemon has no resultDocument extractor", false);
+      return;
+    }
     this.inFlightOffers.add(taskId);
     let agentBinding;
     let agentLeaseTransferred = false;
@@ -11114,11 +12433,29 @@ var TaskRunner = class {
       }
       const offered = withoutRequiredToolsets(payload);
       const requestedRuntime = payload.dispatchSelection?.runtimeId ?? payload.runtime;
-      const pick = await this.pickAdapter(requestedRuntime, payload.policy.mode, requiredToolsets !== void 0);
+      const requiresAgentMemoryMcp = agentRef !== void 0 && this.deps.agentMemoryMcpBin !== void 0 && isAgentMemorySecureFilesystemAvailable(this.deps.agentMemoryFilesystemHelperBin !== void 0);
+      const pick = await this.pickAdapter(
+        requestedRuntime,
+        payload.policy.mode,
+        requiredToolsets !== void 0 || messageRequirement !== void 0 || requiresAgentMemoryMcp
+      );
       if (!pick.ok) {
         decline(pick.reason, pick.retryable);
         return;
       }
+      let taskMcpServers = this.withAgentMessageMcp(
+        resolvedMcp?.ok ? resolvedMcp.servers : void 0,
+        taskId,
+        messageRequirement
+      );
+      if (requiresAgentMemoryMcp && agentRef !== void 0) {
+        try {
+          taskMcpServers = this.withAgentMemoryMcp(taskMcpServers, taskId, agentRef);
+        } catch (error) {
+          decline(`Agent memory MCP configuration failed: ${errorMessage4(error)}`, false);
+          return;
+        }
+      }
       let prepared;
       try {
         prepared = await pick.adapter.prepare({
@@ -11126,7 +12463,7 @@ var TaskRunner = class {
           policy: decision.policy,
           descriptor: pick.descriptor,
           requiredToolsetIds: requiredToolsets ?? [],
-          ...resolvedMcp?.ok ? { mcpServers: resolvedMcp.servers } : {}
+          ...taskMcpServers === void 0 ? {} : { mcpServers: taskMcpServers }
         });
       } catch (error) {
         decline(`runtime preparation failed: ${errorMessage4(error)}`, true);
@@ -11181,6 +12518,23 @@ var TaskRunner = class {
           decline(`Agent home initialization failed: ${errorMessage4(error)}`, false);
           return;
         }
+        if (messageRequirement !== void 0) {
+          try {
+            const outbox = await AgentMessageOutbox.open(agentBinding.resolution.canonicalHome);
+            this.pendingMessageTasks.set(taskId, {
+              taskId,
+              agentRef: agentBinding.resolution.agentRef,
+              requirement: messageRequirement,
+              outbox
+            });
+          } catch (error) {
+            await agentBinding.lease.release().catch(() => {
+            });
+            agentBinding = void 0;
+            decline(`Agent message outbox initialization failed: ${errorMessage4(error)}`, true);
+            return;
+          }
+        }
       } else if (this.deps.gitWorkspaceManager && this.deps.gitWorkspaceStore) {
         known = sessionRef ? await this.deps.sessionWorkspaces.get(sessionRef) : void 0;
         const gitManager = this.deps.gitWorkspaceManager;
@@ -11364,9 +12718,9 @@ var TaskRunner = class {
       }
       const startInput = {
         manifest,
-        instruction: gitWorkspaceId ? prependGitWorkspaceGuidance(resolvedInstruction) : resolvedInstruction,
+        instruction: agentBinding === void 0 ? gitWorkspaceId ? prependGitWorkspaceGuidance(resolvedInstruction) : resolvedInstruction : prependAgentMemoryGuidance(resolvedInstruction),
         env,
-        ...resolvedMcp?.ok ? { mcpServers: resolvedMcp.servers } : {},
+        ...taskMcpServers === void 0 ? {} : { mcpServers: taskMcpServers },
         approvalChannel: {
           taskId,
           storeDir: this.deps.storeDir,
@@ -11436,7 +12790,12 @@ var TaskRunner = class {
         ),
         approvalQueue: [],
         outputBytesSoFar: 0,
-        startedAtMs: Date.now()
+        startedAtMs: Date.now(),
+        ...messageRequirement === void 0 ? {} : {
+          messageRequirement,
+          messageOutbox: this.pendingMessageTasks.get(taskId).outbox
+        },
+        ...terminalProjection === void 0 ? {} : { terminalProjection }
       };
       if (agentBinding !== void 0) {
         try {
@@ -11464,6 +12823,7 @@ var TaskRunner = class {
           return;
         }
       }
+      const activatedMessageRecord = active.messageOutbox === void 0 ? void 0 : await active.messageOutbox.activate(taskId, session.sessionRef);
       if (this.pendingCancelled.has(taskId)) {
         const reason = this.pendingCancelled.get(taskId);
         this.pendingCancelled.delete(taskId);
@@ -11489,6 +12849,10 @@ var TaskRunner = class {
       this.deps.send(createEnvelope("task.started", {}, { taskId }));
       agentLeaseTransferred = agentBinding !== void 0;
       this.tasks.set(taskId, active);
+      this.pendingMessageTasks.delete(taskId);
+      if (active.messageOutbox !== void 0 && activatedMessageRecord !== void 0) {
+        this.sendAgentMessageRecord(active.messageOutbox, activatedMessageRecord);
+      }
       if (payload.limits?.maxDurationMs !== void 0) {
         this.armMaxDurationTimer(active, payload.limits.maxDurationMs);
       }
@@ -11506,6 +12870,11 @@ var TaskRunner = class {
         });
       }
     } finally {
+      if (!agentLeaseTransferred) {
+        this.pendingMessageTasks.delete(taskId);
+        this.revokeAgentMessageContext(taskId);
+        this.revokeAgentMemoryContext(taskId);
+      }
       if (agentBinding !== void 0 && !agentLeaseTransferred) {
         await agentBinding.lease.release().catch(() => {
         });
@@ -11513,6 +12882,153 @@ var TaskRunner = class {
       this.inFlightOffers.delete(taskId);
     }
   }
+  withAgentMessageMcp(existing, taskId, requirement) {
+    if (requirement === void 0) return existing;
+    const bin = this.deps.agentMessageMcpBin;
+    const contextToken = `${randomUUID()}.${randomUUID()}`;
+    this.revokeAgentMessageContext(taskId);
+    this.messageContextByToken.set(contextToken, taskId);
+    this.messageContextByTask.set(taskId, contextToken);
+    return Object.freeze({
+      ...existing ?? {},
+      [AGENT_MESSAGE_MCP_SERVER_NAME]: Object.freeze({
+        command: bin.command,
+        args: Object.freeze([...bin.args]),
+        env: Object.freeze({
+          BYOK_STORE_DIR: this.deps.storeDir,
+          BYOK_PRODUCT_ID: this.deps.productId,
+          BYOK_AGENT_MESSAGE_CONTEXT: contextToken
+        })
+      })
+    });
+  }
+  revokeAgentMessageContext(taskId) {
+    const token = this.messageContextByTask.get(taskId);
+    if (token !== void 0) this.messageContextByToken.delete(token);
+    this.messageContextByTask.delete(taskId);
+  }
+  /** Injected only after strict Agent admission; a host registry may never replace this reserved name. */
+  withAgentMemoryMcp(existing, taskId, agentRef) {
+    if (existing !== void 0 && Object.prototype.hasOwnProperty.call(existing, AGENT_MEMORY_MCP_SERVER_NAME)) {
+      throw new Error(`MCP server name "${AGENT_MEMORY_MCP_SERVER_NAME}" is reserved by the daemon`);
+    }
+    const bin = this.deps.agentMemoryMcpBin;
+    const contextToken = `${randomUUID()}.${randomUUID()}`;
+    this.revokeAgentMemoryContext(taskId);
+    this.memoryContextByToken.set(contextToken, Object.freeze({ taskId, agentRef: Object.freeze({ ...agentRef }) }));
+    this.memoryContextByTask.set(taskId, contextToken);
+    return Object.freeze({
+      ...existing ?? {},
+      [AGENT_MEMORY_MCP_SERVER_NAME]: Object.freeze({
+        command: bin.command,
+        args: Object.freeze([...bin.args]),
+        env: Object.freeze({
+          BYOK_STORE_DIR: this.deps.storeDir,
+          BYOK_PRODUCT_ID: this.deps.productId,
+          BYOK_AGENT_MEMORY_CONTEXT: contextToken
+        })
+      })
+    });
+  }
+  /** Reconstruct all sensitive context from the active sealed task, never from MCP/model arguments. */
+  activeMemoryContext(contextToken) {
+    const registered = this.memoryContextByToken.get(contextToken);
+    if (registered === void 0 || this.memoryContextByTask.get(registered.taskId) !== contextToken || this.memoryClosingTasks.has(registered.taskId)) {
+      throw new Error("invalid, expired, or quiescing Agent memory task context");
+    }
+    const active = this.tasks.get(registered.taskId);
+    if (active === void 0 || active.finalizationStarted || active.agentBinding === void 0 || active.agentRef === void 0 || active.agentHandoff === void 0 || this.deps.tenantId === void 0 || active.agentRef.agentId !== registered.agentRef.agentId || active.agentRef.profileRevision !== registered.agentRef.profileRevision || active.agentBinding.resolution.agentRef.agentId !== registered.agentRef.agentId || active.agentBinding.resolution.agentRef.profileRevision !== registered.agentRef.profileRevision || active.agentHandoff.sessionRef !== active.session.sessionRef || active.agentHandoff.runtimeId !== active.adapter.descriptor.id || active.agentHandoff.cwd !== active.agentBinding.lease.cwd || active.agentBinding.lease.canonicalHome !== active.agentBinding.resolution.canonicalHome) {
+      throw new Error("Agent memory context no longer matches its exact active task identity");
+    }
+    return Object.freeze({
+      taskId: registered.taskId,
+      tenantId: this.deps.tenantId,
+      deviceId: this.deps.deviceId,
+      agentRef: Object.freeze({ ...active.agentRef }),
+      sessionRef: active.session.sessionRef,
+      runtimeId: active.adapter.descriptor.id,
+      canonicalHome: active.agentBinding.resolution.canonicalHome,
+      leaseId: active.agentBinding.lease.leaseId,
+      homeIdentity: active.agentBinding.lease.homeIdentity
+    });
+  }
+  async runMemoryOperation(contextToken, operation) {
+    let context = this.activeMemoryContext(contextToken);
+    context = await this.bindAgentMemoryFilesystem(context);
+    const current = this.activeMemoryContext(contextToken);
+    if (current.taskId !== context.taskId || current.leaseId !== context.leaseId) throw new Error("Agent memory context changed during secure filesystem handshake");
+    context = Object.freeze({ ...current, ...context.filesystem === void 0 ? {} : { filesystem: context.filesystem } });
+    const pending = this.memoryInFlightByTask.get(context.taskId) ?? /* @__PURE__ */ new Set();
+    this.memoryInFlightByTask.set(context.taskId, pending);
+    const result = operation(context);
+    pending.add(result);
+    try {
+      return await result;
+    } finally {
+      pending.delete(result);
+      if (pending.size === 0) this.memoryInFlightByTask.delete(context.taskId);
+    }
+  }
+  async quiesceAndSnapshotAgentMemory(active) {
+    if (active.agentBinding === void 0 || active.agentRef === void 0 || active.agentHandoff === void 0) return;
+    if (!isAgentMemorySecureFilesystemAvailable(this.deps.agentMemoryFilesystemHelperBin !== void 0)) return;
+    if (this.deps.tenantId === void 0) {
+      console.error(`[byok/client] Agent memory quiescent snapshot skipped for ${active.taskId}: exact tenant context is unavailable`);
+      return;
+    }
+    this.memoryClosingTasks.add(active.taskId);
+    try {
+      await Promise.allSettled([...this.memoryInFlightByTask.get(active.taskId) ?? []]);
+      const context = await this.bindAgentMemoryFilesystem({
+        taskId: active.taskId,
+        tenantId: this.deps.tenantId,
+        deviceId: this.deps.deviceId,
+        agentRef: active.agentRef,
+        sessionRef: active.agentHandoff.sessionRef,
+        runtimeId: active.agentHandoff.runtimeId,
+        canonicalHome: active.agentBinding.resolution.canonicalHome,
+        leaseId: active.agentBinding.lease.leaseId,
+        homeIdentity: active.agentBinding.lease.homeIdentity
+      });
+      await snapshotAndProjectAgentMemory(context, this.deps.agentMemoryHostedProjection);
+    } catch (error) {
+      console.error(`[byok/client] Agent memory quiescent snapshot failed for ${active.taskId}: ${errorMessage4(error)}`);
+    } finally {
+      await this.closeAgentMemoryFilesystem(active.taskId);
+    }
+  }
+  async bindAgentMemoryFilesystem(context) {
+    const helperBin = this.deps.agentMemoryFilesystemHelperBin;
+    if (helperBin === void 0) return context;
+    let filesystem = this.memoryFilesystemByTask.get(context.taskId);
+    if (filesystem === void 0) {
+      filesystem = openAgentMemoryFilesystemHelper({
+        helperBin,
+        canonicalHome: context.canonicalHome,
+        homeIdentity: context.homeIdentity
+      });
+      this.memoryFilesystemByTask.set(context.taskId, filesystem);
+      void filesystem.catch(() => {
+        if (this.memoryFilesystemByTask.get(context.taskId) === filesystem) this.memoryFilesystemByTask.delete(context.taskId);
+      });
+    }
+    return Object.freeze({ ...context, filesystem: await filesystem });
+  }
+  async closeAgentMemoryFilesystem(taskId) {
+    const filesystem = this.memoryFilesystemByTask.get(taskId);
+    this.memoryFilesystemByTask.delete(taskId);
+    if (filesystem === void 0) return;
+    await filesystem.then((authority) => authority.close()).catch(() => {
+    });
+  }
+  revokeAgentMemoryContext(taskId) {
+    const token = this.memoryContextByTask.get(taskId);
+    if (token !== void 0) this.memoryContextByToken.delete(token);
+    this.memoryContextByTask.delete(taskId);
+    this.memoryInFlightByTask.delete(taskId);
+    this.memoryClosingTasks.delete(taskId);
+    void this.closeAgentMemoryFilesystem(taskId);
+  }
   /** Protocol §7: an instruction too large to inline arrives as a `blobRef` — resolve it via the blob client rather than failing closed. */
   async resolveInstruction(instruction) {
     if (typeof instruction === "string") return instruction;
@@ -11590,42 +13106,13 @@ var TaskRunner = class {
           if (!outcome.deliver) return;
           await this.observeGit(active, "completed");
           if (this.tasks.get(active.taskId) !== active || active.beingTornDown) return;
-          if (outcome.document !== void 0 && !this.hasResultDocumentCapability()) {
-            await this.fail(
-              active.taskId,
-              `${RESULT_DOCUMENT_UNDELIVERABLE_REASON_PREFIX}: the connected server stopped advertising the result-document capability before this completion could be sent (a reconnect to an older server), so it would silently discard this document`,
-              false
-            );
+          if (active.messageRequirement !== void 0 && active.messageAccepted !== true) {
+            active.pendingMessageCompletion = { finalOutput, ...outcome.document === void 0 ? {} : { document: outcome.document } };
+            const record = active.messageOutbox?.get(active.taskId);
+            if (record !== void 0) this.sendAgentMessageRecord(active.messageOutbox, record);
             return;
           }
-          if (!this.reserveSemanticTerminal(active)) return;
-          await this.persistAgentTerminalEvidence(active, "complete");
-          this.deps.send(
-            createEnvelope(
-              "task.complete",
-              {
-                summary: finalOutput,
-                sessionRef: active.session.sessionRef,
-                // Spread rather than `document: outcome.document`, so a
-                // completion with no document is the exact same payload it
-                // was before this field existed — not one carrying an
-                // explicit `document: undefined` key.
-                //
-                // `outcome.document` is the protocol's CANONICAL SNAPSHOT
-                // (`checkResultDocument`), never the object the extractor
-                // returned: pure data serializes identically at the root
-                // (where it was measured) and nested inside this payload
-                // (where the codec actually serializes it), so a contextual
-                // `toJSON(key)` or an unstable getter cannot make the wire
-                // bytes differ from what the cap gate approved.
-                ...outcome.document !== void 0 ? { document: outcome.document } : {},
-                ...this.terminalInferenceUsagePayload(active),
-                ...this.agentTerminalPayload(active)
-              },
-              { taskId: active.taskId, sessionRef: active.session.sessionRef }
-            )
-          );
-          await this.finish(active.taskId);
+          await this.publishSuccessfulCompletion(active, finalOutput, outcome.document);
           return;
         }
         if (event.type === "progress") {
@@ -11661,6 +13148,26 @@ var TaskRunner = class {
       await this.fail(active.taskId, failure.reason, failure.retryable);
     }
   }
+  async publishSuccessfulCompletion(active, finalOutput, document) {
+    if (document !== void 0 && !this.hasResultDocumentCapability()) {
+      await this.fail(
+        active.taskId,
+        `${RESULT_DOCUMENT_UNDELIVERABLE_REASON_PREFIX}: the connected server stopped advertising the result-document capability before this completion could be sent (a reconnect to an older server), so it would silently discard this document`,
+        false
+      );
+      return;
+    }
+    if (!this.reserveSemanticTerminal(active)) return;
+    await this.persistAgentTerminalEvidence(active, "complete");
+    this.deps.send(createEnvelope("task.complete", {
+      summary: finalOutput,
+      sessionRef: active.session.sessionRef,
+      ...document !== void 0 ? { document } : {},
+      ...this.terminalInferenceUsagePayload(active),
+      ...this.agentTerminalPayload(active)
+    }, { taskId: active.taskId, sessionRef: active.session.sessionRef }));
+    await this.finish(active.taskId);
+  }
   /**
    * Protocol §7: an `artifact` `AgentEvent` only names a file the runtime
    * wrote into the task workspace (`name`/`contentType` — it carries no
@@ -12343,11 +13850,26 @@ var TaskRunner = class {
    * docs/protocol.md §7.2.
    */
   async resolveResultDocument(active, finalOutput) {
+    if (active.terminalProjection?.mode === "none" || active.messageRequirement !== void 0 && active.terminalProjection === void 0) return { deliver: true };
     const extract = this.deps.resultDocument?.extract;
-    if (!extract) return { deliver: true };
+    if (!extract) {
+      if (active.terminalProjection?.mode === "result-document") {
+        await this.fail(
+          active.taskId,
+          `${RESULT_DOCUMENT_UNDELIVERABLE_REASON_PREFIX}: the offer requires result contract ${active.terminalProjection.contract} but this daemon has no extractor`,
+          false
+        );
+        return { deliver: false };
+      }
+      return { deliver: true };
+    }
     let document;
     try {
-      document = extract(finalOutput, { taskId: active.taskId, sessionRef: active.session.sessionRef });
+      document = extract(finalOutput, {
+        taskId: active.taskId,
+        sessionRef: active.session.sessionRef,
+        ...active.terminalProjection === void 0 ? {} : { terminalProjection: active.terminalProjection }
+      });
     } catch (err) {
       await this.fail(
         active.taskId,
@@ -12364,7 +13886,17 @@ var TaskRunner = class {
       );
       return { deliver: false };
     }
-    if (document === void 0) return { deliver: true };
+    if (document === void 0) {
+      if (active.terminalProjection?.mode === "result-document") {
+        await this.fail(
+          active.taskId,
+          `${RESULT_DOCUMENT_UNDELIVERABLE_REASON_PREFIX}: the required result contract ${active.terminalProjection.contract} produced no document`,
+          false
+        );
+        return { deliver: false };
+      }
+      return { deliver: true };
+    }
     const check = checkResultDocument(document);
     if (!check.ok) {
       const detail = resultDocumentRejectionDetail(check);
@@ -12498,6 +14030,10 @@ var TaskRunner = class {
         clearTimeout(active.maxDurationTimer);
         active.maxDurationTimer = void 0;
       }
+      if (active.messageRetryTimer) {
+        clearTimeout(active.messageRetryTimer);
+        active.messageRetryTimer = void 0;
+      }
       active.batcher.stop();
       this.addFinishedTaskId(taskId);
       const queued = active.approvalQueue.splice(0);
@@ -12538,6 +14074,7 @@ var TaskRunner = class {
     if (active.agentBinding !== void 0 && active.agentRef !== void 0 && active.agentHandoff !== void 0) {
       const agentRef = active.agentRef;
       const handoff = active.agentHandoff;
+      await this.quiesceAndSnapshotAgentMemory(active);
       if (!active.agentTerminalPersisted) {
         const cause = active.terminalCause ?? "failed";
         const result = await this.retryAgentTerminalEvidence(
@@ -12576,11 +14113,15 @@ var TaskRunner = class {
       }
       active.gitLease?.release();
       this.tasks.delete(taskId);
+      this.revokeAgentMessageContext(taskId);
+      this.revokeAgentMemoryContext(taskId);
       active.resolveSemanticTerminalSettled?.(leaseReleased);
       return leaseReleased;
     }
     active.gitLease?.release();
     this.tasks.delete(taskId);
+    this.revokeAgentMessageContext(taskId);
+    this.revokeAgentMemoryContext(taskId);
     active.resolveSemanticTerminalSettled?.(true);
     return true;
   }
@@ -12744,9 +14285,9 @@ function metadataStatusEvent(event) {
       return { ...event };
   }
 }
-var encoder2 = new TextEncoder();
+var encoder3 = new TextEncoder();
 function eventBytes(event) {
-  return encoder2.encode(JSON.stringify(event)).length;
+  return encoder3.encode(JSON.stringify(event)).length;
 }
 var AGENT_EGRESS_DIRECTORY = path3__default.join(".byok", "egress");
 var AGENT_RELIABLE_SPOOL_FILENAME = "reliable-v1.jsonl";
@@ -12764,7 +14305,7 @@ var AgentReliableQuotaError = class extends AgentReliableSpoolError {
   }
   reason;
 };
-function sameAgentRef(left, right) {
+function sameAgentRef2(left, right) {
   return left.agentId === right.agentId && left.profileRevision === right.profileRevision;
 }
 function stableRecordJson(value) {
@@ -12797,7 +14338,7 @@ function assertWireType(value) {
   }
 }
 function sameRecord(record, candidate) {
-  return record.wireType === candidate.wireType && sameAgentRef(record.agentRef, candidate.agentRef) && record.tenantId === candidate.tenantId && record.policyRevision === candidate.policyRevision && record.eventId === candidate.eventId && record.cursor === candidate.cursor && record.payloadHash === candidate.payloadHash && record.byteCount === candidate.byteCount && record.sessionRef === candidate.sessionRef && record.taskId === candidate.taskId;
+  return record.wireType === candidate.wireType && sameAgentRef2(record.agentRef, candidate.agentRef) && record.tenantId === candidate.tenantId && record.policyRevision === candidate.policyRevision && record.eventId === candidate.eventId && record.cursor === candidate.cursor && record.payloadHash === candidate.payloadHash && record.byteCount === candidate.byteCount && record.sessionRef === candidate.sessionRef && record.taskId === candidate.taskId;
 }
 function parseEntry2(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) throw new AgentReliableSpoolError("reliable spool entry is not an object");
@@ -12984,7 +14525,7 @@ var AgentReliableSpool = class _AgentReliableSpool {
     return this.exclusive(async () => {
       const record = this.pending.get(ack.eventId);
       if (!record) return false;
-      if (record.cursor !== ack.cursor || record.tenantId !== ack.tenantId || record.sessionRef !== ack.sessionRef || record.policyRevision !== ack.policyRevision || !sameAgentRef(record.agentRef, ack.agentRef)) return false;
+      if (record.cursor !== ack.cursor || record.tenantId !== ack.tenantId || record.sessionRef !== ack.sessionRef || record.policyRevision !== ack.policyRevision || !sameAgentRef2(record.agentRef, ack.agentRef)) return false;
       await this.appendEntry({ schema: 1, kind: "ack", ack: Object.freeze({ ...ack, agentRef: { ...ack.agentRef } }) });
       this.pending.delete(record.eventId);
       if (this.logEntries >= 512) await this.compact();
@@ -13017,7 +14558,7 @@ var AgentReliableSpool = class _AgentReliableSpool {
       } else {
         const record = this.pending.get(entry.ack.eventId);
         if (!record) throw new AgentReliableSpoolError("reliable spool acknowledges an unknown event");
-        if (record.cursor !== entry.ack.cursor || record.tenantId !== entry.ack.tenantId || record.sessionRef !== entry.ack.sessionRef || record.policyRevision !== entry.ack.policyRevision || !sameAgentRef(record.agentRef, entry.ack.agentRef)) throw new AgentReliableSpoolError("reliable spool contains a mismatched ack");
+        if (record.cursor !== entry.ack.cursor || record.tenantId !== entry.ack.tenantId || record.sessionRef !== entry.ack.sessionRef || record.policyRevision !== entry.ack.policyRevision || !sameAgentRef2(record.agentRef, entry.ack.agentRef)) throw new AgentReliableSpoolError("reliable spool contains a mismatched ack");
         this.pending.delete(record.eventId);
       }
     }
@@ -13679,7 +15220,7 @@ var AgentHomeProjectionCompletionError = class extends Error {
     this.name = "AgentHomeProjectionCompletionError";
   }
 };
-function sameAgentRef2(left, right) {
+function sameAgentRef3(left, right) {
   return left.agentId === right.agentId && left.profileRevision === right.profileRevision;
 }
 var AgentHomeProjectionCompletionClient = class {
@@ -13722,7 +15263,7 @@ var AgentHomeProjectionCompletionClient = class {
         cause: error
       });
     }
-    if (readback.tenantId !== this.options.tenantId || readback.deviceId !== this.options.deviceId || readback.requestId !== completion.requestId || !sameAgentRef2(readback.agentRef, completion.agentRef) || readback.projectionHash !== completion.projectionHash || readback.status !== completion.outcome || readback.completedAt === void 0) {
+    if (readback.tenantId !== this.options.tenantId || readback.deviceId !== this.options.deviceId || readback.requestId !== completion.requestId || !sameAgentRef3(readback.agentRef, completion.agentRef) || readback.projectionHash !== completion.projectionHash || readback.status !== completion.outcome || readback.completedAt === void 0) {
       throw new AgentHomeProjectionCompletionError(
         "Agent-home projection completion readback does not exactly match the authenticated request"
       );
@@ -13730,6 +15271,15 @@ var AgentHomeProjectionCompletionClient = class {
     return readback;
   }
 };
+function resolveAgentMessageMcpBin() {
+  const script = path3__default.join(path3__default.dirname(fileURLToPath(import.meta.url)), "bin", "byok-agent-message-mcp.js");
+  return Object.freeze({ command: process.execPath, args: Object.freeze([script]) });
+}
+function resolveAgentMemoryMcpBin(externalHelperConfigured = false) {
+  if (!isAgentMemorySecureFilesystemAvailable(externalHelperConfigured)) return void 0;
+  const script = path3__default.join(path3__default.dirname(fileURLToPath(import.meta.url)), "bin", "byok-agent-memory-mcp.js");
+  return Object.freeze({ command: process.execPath, args: Object.freeze([script]) });
+}
 var AGENT_CONTENT_READ_SURFACES = ["workspace", "transcript", "artifact"];
 var AGENT_CONTENT_READ_CAPABILITIES = Object.freeze({
   workspace: AGENT_CONTENT_WORKSPACE_READ_CAPABILITY,
@@ -13961,11 +15511,11 @@ var RootPolicyError = class extends Error {
     this.reason = reason;
   }
 };
-function sameAgentRef3(left, right) {
+function sameAgentRef4(left, right) {
   return left.agentId === right.agentId && left.profileRevision === right.profileRevision;
 }
 function sameSessionIdentity(left, right) {
-  return sameAgentRef3(left.agentRef, right.agentRef) && left.sessionRef === right.sessionRef && left.runtimeId === right.runtimeId && left.cwd === right.cwd;
+  return sameAgentRef4(left.agentRef, right.agentRef) && left.sessionRef === right.sessionRef && left.runtimeId === right.runtimeId && left.cwd === right.cwd;
 }
 function validateRequest(request) {
   if (!isRecord5(request)) throw new AgentContentReadRequestError("content read request must be an object");
@@ -14237,7 +15787,7 @@ var AgentContentReadPolicyEngine = class {
   }
   async checkSessionIdentity(request, resolver, requiredCwd) {
     const session = request.session;
-    if (session === void 0 || !sameAgentRef3(session.agentRef, request.agentRef) || requiredCwd !== void 0 && session.cwd !== requiredCwd) {
+    if (session === void 0 || !sameAgentRef4(session.agentRef, request.agentRef) || requiredCwd !== void 0 && session.cwd !== requiredCwd) {
       return "identity-mismatch";
     }
     let expected;
@@ -14358,6 +15908,7 @@ function computeCapabilities(adapters, agentHomeConfigured = false, strictAgentO
   if (adapters.some((adapter) => adapter.descriptor.capabilities.steer)) flags.push("steer");
   flags.push("blob-upload");
   flags.push("approval-targeting");
+  flags.push(TERMINAL_PROJECTION_SELECTION_CAPABILITY);
   const selectionAdapters = adapters.filter(
     (adapter) => ALL_RUNTIME_IDS.includes(adapter.descriptor.id)
   );
@@ -14376,6 +15927,9 @@ function computeCapabilities(adapters, agentHomeConfigured = false, strictAgentO
       AGENT_EGRESS_RELIABLE_ACK_CAPABILITY,
       AGENT_EGRESS_FRESH_SESSION_CAPABILITY
     );
+    if (agentHomeConfigured && adapters.some((adapter) => adapter.descriptor.capabilities.mcpToolsets === true)) {
+      flags.push(AGENT_MESSAGE_EGRESS_CAPABILITY);
+    }
   }
   if (contentReadPolicies !== void 0) {
     for (const surface of Object.keys(AGENT_CONTENT_READ_CAPABILITIES)) {
@@ -14486,6 +16040,23 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       "DaemonConfig.agentHome and DaemonConfig.gitWorkspace are mutually exclusive; Agent home is the only workspace authority for Agent offers"
     );
   }
+  if (config.agentMemory !== void 0 && config.agentHome === void 0) {
+    throw new Error("DaemonConfig.agentMemory requires DaemonConfig.agentHome for the exact Agent memory authority");
+  }
+  if (config.agentMemoryFilesystem !== void 0 && config.agentHome === void 0) {
+    throw new Error("DaemonConfig.agentMemoryFilesystem requires DaemonConfig.agentHome for the exact Agent memory authority");
+  }
+  if (config.agentMemoryFilesystem !== void 0 && (!path3__default.isAbsolute(config.agentMemoryFilesystem.helperBin) || /[\u0000\r\n]/u.test(config.agentMemoryFilesystem.helperBin))) {
+    throw new Error("DaemonConfig.agentMemoryFilesystem.helperBin must be an explicit absolute executable path");
+  }
+  const externalAgentMemoryFilesystem = config.agentMemoryFilesystem !== void 0;
+  if (externalAgentMemoryFilesystem && !isAgentMemoryFilesystemHelperSupported()) {
+    throw new Error("DaemonConfig.agentMemoryFilesystem is not admitted on this platform without its native race proof");
+  }
+  if (config.agentMemory !== void 0 && !isAgentMemorySecureFilesystemAvailable(externalAgentMemoryFilesystem)) {
+    throw new Error("DaemonConfig.agentMemory requires a platform with safe descriptor-relative filesystem operations");
+  }
+  const agentMemoryMcpBin = config.agentHome === void 0 ? void 0 : resolveAgentMemoryMcpBin(externalAgentMemoryFilesystem);
   const localAgentRelease = resolveLocalAgentReleaseIdentity(config.localAgentRelease);
   const toolsetRegistry = new McpToolsetRegistry(config.mcpToolsets);
   validatePiByokLauncherConfig(config.piByokLauncher);
@@ -14917,6 +16488,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         approvalRegistry,
         storeDir,
         productId: config.productId,
+        tenantId: record.tenantId,
         // U2 terminal inference usage consumes the one U4a-resolved,
         // process-immutable identity captured above. This is composition-only:
         // TaskRunner receives no config, manifest, or second identity resolver.
@@ -14931,6 +16503,10 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         // doc comment. Spread rather than assigned so an unconfigured daemon
         // builds the exact `deps` object it did before this seam existed.
         ...config.resultDocument ? { resultDocument: config.resultDocument } : {},
+        ...agentMemoryMcpBin === void 0 ? {} : { agentMemoryMcpBin },
+        ...config.agentMemoryFilesystem === void 0 ? {} : { agentMemoryFilesystemHelperBin: path3__default.resolve(config.agentMemoryFilesystem.helperBin) },
+        ...config.agentHome !== void 0 && config.agentEgress !== void 0 ? { agentMessageMcpBin: resolveAgentMessageMcpBin() } : {},
+        ...config.agentMemory === void 0 ? {} : { agentMemoryHostedProjection: config.agentMemory },
         // M4 Phase 3 hardening: bridges TaskRunner's stale-approval-race
         // finding out to the SAME local observability seam every other
         // daemon-local event already uses (see observer.ts's own module doc
@@ -14961,6 +16537,9 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         ...activePressureEngine ? { admissionGuard: () => activePressureEngine.admissionGuard() } : {}
       };
       runner = new TaskRunner(deps);
+      if (config.agentHome !== void 0 && config.agentEgress !== void 0) {
+        await runner.recoverAgentMessageOutboxes(path3__default.join(config.agentHome.hostStorageRoot, "agents"));
+      }
       const handleAgentHomeProjectionEnvelope = async (envelope) => {
         if (envelope.type !== "agent.home.projection") return false;
         if (agentHomeManager === void 0 || agentHomeProjectionCompletion === void 0) {
@@ -15143,6 +16722,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
           observer.handleInboundEnvelope(envelope);
           if (envelope.type === "agent.home.projection") return handleAgentHomeProjectionEnvelope(envelope).then(() => void 0);
           if (envelope.type === "agent.egress.ack") return handleAgentEgressEnvelope(envelope).then(() => void 0);
+          if (envelope.type === "agent.message.disposition") return runner?.handleEnvelope(envelope) ?? Promise.resolve();
           if (envelope.type === "agent.content.read") return handleAgentContentReadEnvelope(envelope).then(() => void 0);
           return runner?.handleEnvelope(envelope) ?? Promise.resolve();
         },
@@ -15150,6 +16730,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
           const wasSettled = connectionState === "open" || connectionState === "degraded";
           connectionState = state;
           observer.noteConnectionState(state);
+          if (!wasSettled && (state === "open" || state === "degraded")) runner?.retryRecoveredAgentMessages();
           if (!wasSettled && (state === "open" || state === "degraded")) runPresenceDiscovery();
         },
         backoff: overrides.backoff,
@@ -15168,6 +16749,7 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
       });
       await connection.start();
       await connection.waitForAck();
+      runner.retryRecoveredAgentMessages();
       for (const record2 of agentEgress.retryableReliableRecords(connection.getServerCapabilities())) {
         dispatchReliableRecord(record2);
       }
@@ -15515,6 +17097,24 @@ function buildDaemonWithAdapters(config, adapters, overrides = {}, assertionProb
         if (!runner) throw new ControlError("not_found", "daemon is not started");
         return runner.requestApproval(parsed.taskId, parsed.summary);
       },
+      "agent_messages.publish": (params) => {
+        const parsed = parseAgentMessagePublishParams(params);
+        if (!parsed) throw new ControlError("bad_request", "agent_messages.publish requires exactly {contextToken,contentType,body}");
+        if (!runner) throw new ControlError("not_found", "daemon is not started");
+        return runner.publishAgentMessage(parsed);
+      },
+      "agent_memory.recall": (params) => {
+        const parsed = parseAgentMemoryRecallParams(params);
+        if (!parsed) throw new ControlError("bad_request", "agent_memory.recall requires exactly {contextToken,path,ifRevision?}");
+        if (!runner) throw new ControlError("not_found", "daemon is not started");
+        return runner.recallAgentMemory(parsed);
+      },
+      "agent_memory.save": (params) => {
+        const parsed = parseAgentMemorySaveParams(params);
+        if (!parsed) throw new ControlError("bad_request", "agent_memory.save requires exactly {contextToken,op,path,expectedRevision,content?}");
+        if (!runner) throw new ControlError("not_found", "daemon is not started");
+        return runner.saveAgentMemory(parsed);
+      },
       /**
        * Plan `device-assertion-broker`: mint one short-lived, audience-scoped
        * device assertion for a sibling local process.
@@ -16088,7 +17688,7 @@ ${args.map((a) => `    ${plistString(a)}`).join("\n")}
 }
 function createLaunchdLifecycle(def, deps = {}) {
   const run = deps.run ?? defaultRunner;
-  const fs28 = deps.fs ?? promises;
+  const fs30 = deps.fs ?? promises;
   const homedir = deps.homedir ?? (() => os__default.homedir());
   const getuid = deps.getuid ?? (() => {
     if (typeof process.getuid !== "function") {
@@ -16102,7 +17702,7 @@ function createLaunchdLifecycle(def, deps = {}) {
   const serviceTarget = () => `${domainTarget()}/${label}`;
   async function fileExists(p) {
     try {
-      await fs28.stat(p);
+      await fs30.stat(p);
       return true;
     } catch {
       return false;
@@ -16110,9 +17710,9 @@ function createLaunchdLifecycle(def, deps = {}) {
   }
   async function writePlist(program) {
     const xml = generateLaunchdPlist({ label, program, logDir: def.logDir });
-    await fs28.mkdir(path3__default.dirname(plistPath()), { recursive: true });
-    await fs28.mkdir(def.logDir, { recursive: true });
-    await fs28.writeFile(plistPath(), xml, "utf8");
+    await fs30.mkdir(path3__default.dirname(plistPath()), { recursive: true });
+    await fs30.mkdir(def.logDir, { recursive: true });
+    await fs30.writeFile(plistPath(), xml, "utf8");
   }
   async function install(opts = {}) {
     await writePlist(opts.program ?? def.program);
@@ -16123,7 +17723,7 @@ function createLaunchdLifecycle(def, deps = {}) {
   }
   async function uninstall() {
     await runIdempotent(run, "launchctl", ["bootout", serviceTarget()], "launchctl bootout", LAUNCHD_NOT_LOADED);
-    await fs28.rm(plistPath(), { force: true });
+    await fs30.rm(plistPath(), { force: true });
   }
   async function start() {
     if (!await fileExists(plistPath())) {
@@ -16207,14 +17807,14 @@ WantedBy=default.target
 }
 function createSystemdLifecycle(def, deps = {}) {
   const run = deps.run ?? defaultRunner;
-  const fs28 = deps.fs ?? promises;
+  const fs30 = deps.fs ?? promises;
   const homedir = deps.homedir ?? (() => os__default.homedir());
   const name = sanitizeServiceName(def.name);
   const unitName = `${name}.service`;
   const unitPath = () => path3__default.join(homedir(), ".config", "systemd", "user", unitName);
   async function fileExists(p) {
     try {
-      await fs28.stat(p);
+      await fs30.stat(p);
       return true;
     } catch {
       return false;
@@ -16222,9 +17822,9 @@ function createSystemdLifecycle(def, deps = {}) {
   }
   async function writeUnit(program) {
     const unit = generateSystemdUnit({ name, displayName: def.displayName ?? def.name, program, logDir: def.logDir });
-    await fs28.mkdir(path3__default.dirname(unitPath()), { recursive: true });
-    await fs28.mkdir(def.logDir, { recursive: true });
-    await fs28.writeFile(unitPath(), unit, "utf8");
+    await fs30.mkdir(path3__default.dirname(unitPath()), { recursive: true });
+    await fs30.mkdir(def.logDir, { recursive: true });
+    await fs30.writeFile(unitPath(), unit, "utf8");
   }
   async function install(opts = {}) {
     await writeUnit(opts.program ?? def.program);
@@ -16233,7 +17833,7 @@ function createSystemdLifecycle(def, deps = {}) {
   }
   async function uninstall() {
     await runIdempotent(run, "systemctl", ["--user", "disable", "--now", unitName], "systemctl disable --now", SYSTEMD_NOT_LOADED);
-    await fs28.rm(unitPath(), { force: true });
+    await fs30.rm(unitPath(), { force: true });
     await run("systemctl", ["--user", "daemon-reload"]);
   }
   async function start() {
@@ -16296,7 +17896,7 @@ ${argXml}${cwdXml}
 }
 function createWinswLifecycle(def, deps = {}) {
   const run = deps.run ?? defaultRunner;
-  const fs28 = deps.fs ?? promises;
+  const fs30 = deps.fs ?? promises;
   const windows = def.windows;
   if (!windows) {
     throw new Error("WinSW service lifecycle requires `ServiceDefinition.windows.winswBin` (the product-bundled WinSW executable path)");
@@ -16308,7 +17908,7 @@ function createWinswLifecycle(def, deps = {}) {
   const xmlPath = path3__default.join(installDir, `${id}.xml`);
   async function fileExists(p) {
     try {
-      await fs28.stat(p);
+      await fs30.stat(p);
       return true;
     } catch {
       return false;
@@ -16316,10 +17916,10 @@ function createWinswLifecycle(def, deps = {}) {
   }
   async function writeFiles(program) {
     const xml = generateWinswXml({ id, displayName: def.displayName ?? def.name, program, logDir: def.logDir });
-    await fs28.mkdir(installDir, { recursive: true });
-    await fs28.mkdir(def.logDir, { recursive: true });
-    await fs28.copyFile(winswBin, exePath);
-    await fs28.writeFile(xmlPath, xml, "utf8");
+    await fs30.mkdir(installDir, { recursive: true });
+    await fs30.mkdir(def.logDir, { recursive: true });
+    await fs30.copyFile(winswBin, exePath);
+    await fs30.writeFile(xmlPath, xml, "utf8");
   }
   async function install(opts = {}) {
     await writeFiles(opts.program ?? def.program);
@@ -16329,8 +17929,8 @@ function createWinswLifecycle(def, deps = {}) {
   async function uninstall() {
     await runIdempotent(run, exePath, ["stop"], "winsw stop", WINSW_NOT_INSTALLED);
     await runIdempotent(run, exePath, ["uninstall"], "winsw uninstall", WINSW_NOT_INSTALLED);
-    await fs28.rm(exePath, { force: true });
-    await fs28.rm(xmlPath, { force: true });
+    await fs30.rm(exePath, { force: true });
+    await fs30.rm(xmlPath, { force: true });
   }
   async function start() {
     if (!await fileExists(xmlPath)) {
@@ -16375,7 +17975,7 @@ function createServiceLifecycle(def, opts = {}) {
 
 // src/bin/official-release.ts
 var OFFICIAL_LOCAL_AGENT_RELEASE = resolveLocalAgentReleaseIdentity({
-  version: "0.8.1"
+  version: "0.9.0"
 });
 
 // src/bin/config.ts
@@ -18590,8 +20190,8 @@ async function runTasksFollowCommand(config, deps) {
     });
     return;
   }
-  const path36 = auditLogPath(storeDir);
-  await followAuditLog(path36, (event) => log(formatDaemonEventLine(event)), {
+  const path41 = auditLogPath(storeDir);
+  await followAuditLog(path41, (event) => log(formatDaemonEventLine(event)), {
     signal: deps.signal,
     pollIntervalMs: deps.pollIntervalMs,
     fromEnd: true