@byok-sdk/client 0.8.1 → 0.9.0

package/dist/daemon/agent-message-outbox.d.ts

@@ -0,0 +1,58 @@
+import { type AgentMessageContentType, type AgentMessageEgressRequirement, type AgentMessagePublishPayload } from '@byok-sdk/protocol';
+import type { AgentRef } from '../agent-home';
+export declare const AGENT_MESSAGE_DIRECTORY: string;
+export declare const AGENT_MESSAGE_OUTBOX_FILENAME = "outbox-v1.jsonl";
+export interface AgentMessageOutboxRecord {
+    readonly schema: 1;
+    readonly taskId: string;
+    readonly tenantId: string;
+    readonly agentRef: AgentRef;
+    readonly contract: string;
+    readonly messageId: string;
+    readonly cursor: number;
+    readonly contentType: AgentMessageContentType;
+    readonly body: string;
+    readonly contentHash: string;
+    readonly byteCount: number;
+    readonly createdAt: string;
+    readonly sessionRef?: string;
+}
+export declare class AgentMessageOutboxError extends Error {
+    constructor(message: string);
+}
+/** Agent-local, append-before-send outbox. Only exact accepted disposition retires bytes. */
+export declare class AgentMessageOutbox {
+    readonly homeDir: string;
+    readonly outboxPath: string;
+    private readonly pendingByTask;
+    private readonly dispositionByTask;
+    private nextCursor;
+    private logEntries;
+    private writeTail;
+    private constructor();
+    static open(homeDir: string): Promise<AgentMessageOutbox>;
+    /** Re-open every existing Agent-local message outbox without following Agent-home symlinks. */
+    static recover(agentsRoot: string, tenantId: string): Promise<readonly AgentMessageOutbox[]>;
+    records(): readonly AgentMessageOutboxRecord[];
+    /** Activated records with no exact disposition yet; only these may be transport-replayed. */
+    retryableRecords(): readonly AgentMessageOutboxRecord[];
+    get(taskId: string): AgentMessageOutboxRecord | undefined;
+    appendDraft(input: {
+        readonly taskId: string;
+        readonly tenantId: string;
+        readonly agentRef: AgentRef;
+        readonly requirement: AgentMessageEgressRequirement;
+        readonly contentType: AgentMessageContentType;
+        readonly body: string;
+        readonly sessionRef?: string;
+        readonly maxPendingEvents: number;
+        readonly maxPendingBytes: number;
+    }): Promise<AgentMessageOutboxRecord>;
+    activate(taskId: string, sessionRef: string): Promise<AgentMessageOutboxRecord | undefined>;
+    publishPayload(record: AgentMessageOutboxRecord): AgentMessagePublishPayload;
+    applyDisposition(taskId: string, input: unknown): Promise<'accepted' | 'held' | 'refused' | 'mismatch' | 'unknown'>;
+    private load;
+    private appendEntry;
+    private compact;
+    private exclusive;
+}

package/dist/daemon/control-protocol.d.ts

@@ -323,6 +323,31 @@ export interface ApprovalsRequestResult {
     approved: boolean;
     reason?: string;
 }
+export interface AgentMessagePublishParams {
+    contextToken: string;
+    contentType: 'text/plain' | 'text/markdown';
+    body: string;
+}
+export declare function parseAgentMessagePublishParams(value: unknown): AgentMessagePublishParams | undefined;
+export interface AgentMessagePublishResult {
+    messageId: string;
+    state: 'staged' | 'pending';
+}
+export interface AgentMemoryRecallParams {
+    contextToken: string;
+    path: string;
+    ifRevision?: string;
+}
+export interface AgentMemorySaveParams {
+    contextToken: string;
+    op: 'replace' | 'delete';
+    path: string;
+    expectedRevision: string;
+    content?: string;
+}
+/** Parser only validates the local IPC shape. Agent identity and memory root stay daemon-owned. */
+export declare function parseAgentMemoryRecallParams(value: unknown): AgentMemoryRecallParams | undefined;
+export declare function parseAgentMemorySaveParams(value: unknown): AgentMemorySaveParams | undefined;
 /**
  * Params for `assertion.issue`: a sibling local process (the host's own CLI,
  * installed alongside this daemon) asking the daemon to mint one short-lived,

package/dist/daemon/create-daemon.d.ts

@@ -18,6 +18,8 @@ import { type ProgressBatcherOptions } from './progress-batcher';
 import { type AgentEgressReliableAppendResult } from './agent-egress-controller';
 import { type AgentEgressStatus } from './agent-egress-policy';
 import { type AgentEgressSanitizer } from './agent-egress-sanitizer';
+import { type AgentMemoryHostedProjection } from './agent-memory';
+import type { AgentMemoryFilesystemHelperConfig } from './agent-memory-filesystem';
 import { type AgentContentReadRoot } from './agent-content-read';
 /**
  * Optional white-label product display info — purely opaque passthrough
@@ -100,6 +102,14 @@ export interface DaemonConfig {
         hostStorageRoot: string;
         projection?: AgentHomeProjection;
     };
+    /** Optional, one-way hosted projection. Without all guards it has zero network activity. */
+    agentMemory?: AgentMemoryHostedProjection;
+    /**
+     * Product-owned external secure-filesystem helper. The path must be absolute;
+     * the SDK never searches PATH or bundles a native addon. Required for Phase
+     * 2 on macOS. Windows remains fail-closed pending its native race proof.
+     */
+    agentMemoryFilesystem?: AgentMemoryFilesystemHelperConfig;
     /**
      * Refuse legacy task offers locally. This is an additive capability only
      * after the SDK-owned Agent home has passed construction-time preflight.

package/dist/daemon/memory-guidance.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Runtime-neutral instructions for an Agent's model-authored local memory.
+ *
+ * This is deliberately prompt guidance only: the SDK does not read memory
+ * content, infer durable values, or auto-inject files into the operation.
+ */
+export declare const AGENT_MEMORY_GUIDANCE: string;
+export declare function prependAgentMemoryGuidance(instruction: string): string;

package/dist/daemon/resolve-agent-memory-mcp-bin.d.ts

@@ -0,0 +1,6 @@
+export interface ResolvedAgentMemoryMcpBin {
+    readonly command: string;
+    readonly args: readonly string[];
+}
+/** Resolve the SDK-owned stdio Agent-memory MCP helper shipped beside the client bundle. */
+export declare function resolveAgentMemoryMcpBin(externalHelperConfigured?: boolean): ResolvedAgentMemoryMcpBin | undefined;

package/dist/daemon/resolve-agent-message-mcp-bin.d.ts

@@ -0,0 +1,6 @@
+export interface ResolvedAgentMessageMcpBin {
+    readonly command: string;
+    readonly args: readonly string[];
+}
+/** Resolve the SDK-owned stdio MCP helper shipped beside the client bundle. */
+export declare function resolveAgentMessageMcpBin(): ResolvedAgentMessageMcpBin;

package/dist/daemon/task-runner.d.ts

@@ -1,4 +1,4 @@
-import { type AgentEgressPolicy, type Envelope, type PermissionPolicy, type RuntimeId, type TaskOfferPayload, type TaskOfferForAgentPayload, type TaskOfferForAgentWithEgressPayload, type TaskOfferForAgentWithEgressFreshPayload, type TaskOfferWithToolsetsPayload } from '@byok-sdk/protocol';
+import { type AgentMessageContentType, type AgentEgressPolicy, type Envelope, type PermissionPolicy, type RuntimeId, type TerminalProjectionSelection, type TaskOfferPayload, type TaskOfferForAgentPayload, type TaskOfferForAgentWithEgressPayload, type TaskOfferForAgentWithEgressFreshPayload, type TaskOfferWithToolsetsPayload } from '@byok-sdk/protocol';
 import { type McpToolsetConfig, type RuntimeAdapter } from '../types';
 import { AgentHomeManager, type AgentRef } from '../agent-home';
 import { AgentSessionHandoffStore, type AgentTerminalCause } from './agent-session-handoff-store';
@@ -12,6 +12,9 @@ import type { SessionWorkspaceStore } from './session-workspace-store';
 import type { GitWorkspaceManager, GitWorkspaceObservation } from './git-workspace';
 import type { GitWorkspaceStore, GitWorkspacePhase } from './git-workspace-store';
 import type { AgentEgressController } from './agent-egress-controller';
+import type { ResolvedAgentMessageMcpBin } from './resolve-agent-message-mcp-bin';
+import type { ResolvedAgentMemoryMcpBin } from './resolve-agent-memory-mcp-bin';
+import { type AgentMemoryAuditWarning, type AgentMemoryHostedProjection } from './agent-memory';
 /**
  * M4 Phase 3: default wait for `requestApproval` (see its own doc comment)
  * before force-resolving an unanswered out-of-band approval as a fail-closed
@@ -138,12 +141,15 @@ export declare const RESULT_DOCUMENT_UNDELIVERABLE_REASON_PREFIX = "result docum
 export interface ResultDocumentTask {
     readonly taskId: string;
     readonly sessionRef: string;
+    /** Exact offer-scoped second projection; absent for legacy and message-only offers. */
+    readonly terminalProjection?: Readonly<TerminalProjectionSelection>;
 }
 /**
  * Host-supplied glue that turns a finished task's final output into the
  * product's structured terminal result (`task.complete.document`). Returning
- * `undefined` means "this task has no structured result" and completes the
- * task exactly as it would have without an extractor configured at all.
+ * `undefined` means "this task has no structured result" for legacy offers.
+ * An explicit `terminalProjection.mode: 'result-document'` instead treats
+ * `undefined` as a fail-closed missing required document.
  *
  * SYNCHRONOUS by contract, like every other single-purpose callback on
  * `TaskRunnerDeps`, and the runtime ENFORCES that rather than trusting it:
@@ -258,6 +264,8 @@ export interface TaskRunnerDeps {
     approvalRegistry: ApprovalRegistry;
     storeDir: string;
     productId: string;
+    /** Authenticated enrollment tenant projection; required by Agent message durability/recovery. */
+    tenantId?: string;
     /**
      * The already-resolved, process-immutable U4a Local Agent release identity.
      * `TaskRunner` only consumes this value; it never creates, normalizes, or
@@ -359,6 +367,14 @@ export interface TaskRunnerDeps {
     resultDocument?: {
         readonly extract: ResultDocumentExtractor;
     };
+    /** SDK-owned, task-scoped MCP helper. Required only for offers declaring messageEgress. */
+    agentMessageMcpBin?: Readonly<ResolvedAgentMessageMcpBin>;
+    /** SDK-owned MCP helper injected only into strict Agent tasks. */
+    agentMemoryMcpBin?: Readonly<ResolvedAgentMemoryMcpBin>;
+    /** Explicit external secure-fs helper. No PATH discovery or bundled native addon exists. */
+    agentMemoryFilesystemHelperBin?: string;
+    /** Optional local-to-hosted redacted projection port. Omission is zero-network. */
+    agentMemoryHostedProjection?: AgentMemoryHostedProjection;
 }
 /** See {@link TaskRunnerDeps.admissionGuard}. */
 export type AdmissionGuardDecision = {
@@ -387,6 +403,16 @@ type AcceptedOfferPayload = TaskOfferPayload | TaskOfferWithToolsetsPayload | Ta
 export declare class TaskRunner {
     private readonly deps;
     private readonly tasks;
+    private readonly pendingMessageTasks;
+    private readonly messageContextByToken;
+    private readonly messageContextByTask;
+    private readonly memoryContextByToken;
+    private readonly memoryContextByTask;
+    private readonly memoryInFlightByTask;
+    private readonly memoryClosingTasks;
+    private readonly memoryFilesystemByTask;
+    private readonly recoveredMessageOutboxes;
+    private readonly recoveredMessageRetryTimers;
     /**
      * Finding F4 (cancel lost during the offer-processing window): a
      * `task.cancel` for a taskId that hasn't finished `handleOffer` yet (still
@@ -515,6 +541,44 @@ export declare class TaskRunner {
      * approval count, not the adapter's own event-queue depth.
      */
     getQueueWatermarks(): TaskQueueWatermark[];
+    /** Authenticated control-socket entry used only by the SDK-owned task MCP helper. */
+    publishAgentMessage(input: {
+        readonly contextToken: string;
+        readonly contentType: AgentMessageContentType;
+        readonly body: string;
+    }): Promise<{
+        messageId: string;
+        state: 'staged' | 'pending';
+    }>;
+    /** Authenticated control-socket entry used only by the SDK-owned memory MCP helper. */
+    recallAgentMemory(input: {
+        readonly contextToken: string;
+        readonly path: string;
+        readonly ifRevision?: string;
+    }): Promise<{
+        path: string;
+        revision: string;
+        content: string;
+        auditWarning?: AgentMemoryAuditWarning;
+    }>;
+    /** Authenticated control-socket entry used only by the SDK-owned memory MCP helper. */
+    saveAgentMemory(input: {
+        readonly contextToken: string;
+        readonly op: 'replace' | 'delete';
+        readonly path: string;
+        readonly expectedRevision: string;
+        readonly content?: string;
+    }): Promise<{
+        path: string;
+        revision?: string;
+        deleted: boolean;
+    }>;
+    /** Restore activated, unaccepted message drafts before transport admission on daemon restart. */
+    recoverAgentMessageOutboxes(agentsRoot: string): Promise<void>;
+    /** Retry stable recovered records after a transport handshake/re-handshake. */
+    retryRecoveredAgentMessages(): void;
+    private sendAgentMessageRecord;
+    private handleAgentMessageDisposition;
     /** M4 Phase 2: stop claiming any FUTURE `task.offer` — see `stoppingOffers`'s own doc comment. Idempotent. */
     stopAcceptingOffers(): void;
     /**
@@ -620,11 +684,23 @@ export declare class TaskRunner {
     private armMaxDurationTimer;
     handleEnvelope(envelope: Envelope): Promise<void>;
     private handleOffer;
+    private withAgentMessageMcp;
+    private revokeAgentMessageContext;
+    /** Injected only after strict Agent admission; a host registry may never replace this reserved name. */
+    private withAgentMemoryMcp;
+    /** Reconstruct all sensitive context from the active sealed task, never from MCP/model arguments. */
+    private activeMemoryContext;
+    private runMemoryOperation;
+    private quiesceAndSnapshotAgentMemory;
+    private bindAgentMemoryFilesystem;
+    private closeAgentMemoryFilesystem;
+    private revokeAgentMemoryContext;
     /** Protocol §7: an instruction too large to inline arrives as a `blobRef` — resolve it via the blob client rather than failing closed. */
     private resolveInstruction;
     /** Resolve every requested logical id locally and reject missing/colliding server authority before claim. */
     private resolveMcpServers;
     private pump;
+    private publishSuccessfulCompletion;
     /**
      * Protocol §7: an `artifact` `AgentEvent` only names a file the runtime
      * wrote into the task workspace (`name`/`contentType` — it carries no

package/dist/daemon/toolset-registry.d.ts

@@ -1,5 +1,7 @@
 import { type ToolsetId } from '@byok-sdk/protocol';
 import type { McpToolsetConfig, McpToolsetObservation, McpToolsetRegistryStatus, McpToolsetReloadReceipt } from '../types';
+export declare const AGENT_MESSAGE_MCP_SERVER_NAME = "byokagentmessage";
+export declare const AGENT_MEMORY_MCP_SERVER_NAME = "byokagentmemory";
 export type McpToolsetConfigInput = Record<string, McpToolsetConfig> | undefined;
 export interface McpToolsetRegistrySnapshot {
     revision: string;

package/dist/index.d.ts

@@ -18,6 +18,9 @@ export { GitWorkspaceStore } from './daemon/git-workspace-store';
 export type { GitWorkspaceLedger, GitWorkspaceLedgerRecord, GitWorkspacePhase } from './daemon/git-workspace-store';
 export { createDaemon, createDaemonWithAdapters } from './daemon/create-daemon';
 export type { Daemon, DaemonConfig, DaemonStatus, DaemonOverrides, DaemonBranding, HostedJournalConfig, DeviceAssertionConfig, AgentEgressConfig, AgentContentReadConfig, AgentContentReadSurfaceConfig, AgentReliableEgressInput, } from './daemon/create-daemon';
+export { AgentMemoryError, AgentMemoryRevisionConflictError, isAgentMemorySecureFilesystemAvailable, AGENT_MEMORY_AUDIT_FILENAME, AGENT_MEMORY_OUTBOX_FILENAME, } from './daemon/agent-memory';
+export type { AgentMemoryFilesystemHelperConfig } from './daemon/agent-memory-filesystem';
+export type { AgentMemoryFile, AgentMemorySnapshot, AgentMemoryRedactor, AgentMemoryProjectionGrant, AgentMemoryProjectionPort, AgentMemoryHostedProjection, } from './daemon/agent-memory';
 export type { AgentEgressDropReceipt, AgentEgressLaneStatus, AgentEgressStatus, } from './daemon/agent-egress-policy';
 export type { AgentEgressSanitizer, AgentEgressSanitizerContext } from './daemon/agent-egress-sanitizer';
 export { AGENT_CONTENT_READ_CAPABILITIES, AGENT_CONTENT_READ_CAPABILITY_WORKSPACE, AGENT_CONTENT_READ_CAPABILITY_TRANSCRIPT, AGENT_CONTENT_READ_CAPABILITY_ARTIFACT, } from './daemon/agent-content-read';