@byok-sdk/protocol 0.24.0 → 0.25.0-rc.1

package/dist/version.d.ts

@@ -7,25 +7,34 @@ export declare const MAILBOX_READ_AHEAD_CAPABILITY = "mailbox-read-ahead";
  * do not require a bump — servers negotiate the highest common version and
  * daemons/servers must ignore unknown fields and unknown message types.
  *
- * FROZEN v1 (end of M2 — see docs/protocol.md "Freeze rule"): the pi, claude,
- * and codex runtime adapters have all exercised the wire, and every M1/M2
- * protocol gap has been closed. `PROTOCOL_VERSION` stays `1` from here
- * forward; it does not bump for additive changes (new optional fields, new
- * message types, new `AgentEvent` variants, new capability flags) — only for
- * a breaking one (changing, removing, or retyping anything that already
- * exists).
+ * FROZEN (see docs/protocol.md "Freeze rule"): `PROTOCOL_VERSION` does not
+ * bump for additive changes (new optional fields, new message types, new
+ * `AgentEvent` variants, new capability flags) — only for a breaking one
+ * (changing, removing, or retyping anything that already exists).
+ *
+ * v2 removed the task offer's `policy` (`PermissionPolicy`), the runtime
+ * capability `permissionModes` and the input-preparation `permissionMode`.
+ * Sessions run without an SDK permission gate; each local agent keeps its
+ * own guardrails. A v1 envelope is rejected; there is no v1 reader.
+ * v2 also removed the egress policy's `metadata-status` activity mode, its
+ * `activity.mode` field and the `sanitizer_rejected` drop reason. Agent
+ * egress goes to the Host as the runtime produced it.
+ * v2 also removed the input-preparation artifact's `toolImplementationKinds`
+ * and the readiness reason `executor_identity_unproven`. The SDK does not
+ * attest tool executables. The artifact names its counted tools in
+ * `toolNames`.
  *
  * IMPORTANT: changing this constant, or changing/removing/retyping any
  * already-frozen schema in this package, requires a DELIBERATE update to the
- * committed golden fixtures in `src/__tests__/golden/` (`v1.frozen.json`,
- * `v1.envelopes.ndjson`) — see `src/__tests__/freeze-guard.test.ts`, which
+ * committed golden fixtures in `src/__tests__/golden/` (`v<N>.frozen.json`,
+ * `v<N>.envelopes.ndjson`) — see `src/__tests__/freeze-guard.test.ts`, which
  * fails loudly on exactly that kind of drift. A passing freeze-guard run
  * after such a change means either (a) the change was genuinely additive and
  * the golden was regenerated with justification, or (b) this constant was
  * bumped alongside a new golden generation for the new version — never a
  * silent edit to either file to make the test pass.
  */
-export declare const PROTOCOL_VERSION = 1;
+export declare const PROTOCOL_VERSION = 2;
 /** Host declares that this device accepts only Agent-bound offer variants. */
 export declare const STRICT_AGENT_ONLY_CAPABILITY: 'strict-agent-only';
 /**
@@ -107,5 +116,5 @@ export declare const STRICT_AGENT_ONLY_CAPABILITY: 'strict-agent-only';
  * cannot accidentally execute the instruction without the required tools.
  */
 export declare const CUSTOM_HARNESS_CAPABILITY: 'custom-harness';
-export declare const CAPABILITY_FLAGS: readonly ['steer', 'blob-upload', 'interactive-approval', 'approval_resolved', 'approval-targeting', 'result-document', 'dispatch-selection', "provider-profile-binding", 'toolset-selection', 'agent-home-contract', "strict-agent-only", "agent-egress-policy", "agent-egress-reliable-ack", "agent-message-egress", "agent-egress-fresh-session", "agent-content-workspace-read", "agent-content-transcript-read", "agent-content-artifact-read", "agent-home-projection", "agent-input-preparation-v8", "terminal-projection-selection", "host-mcp-task-context", "custom-harness", "mailbox-read-ahead", "provider-provisioning.v1", "agent-memory-intent.v1"];
+export declare const CAPABILITY_FLAGS: readonly ['steer', 'blob-upload', 'interactive-approval', 'approval_resolved', 'approval-targeting', 'result-document', 'dispatch-selection', "provider-profile-binding", 'toolset-selection', 'agent-home-contract', "strict-agent-only", "agent-egress-policy", "agent-egress-reliable-ack", "agent-message-egress", "agent-egress-fresh-session", "agent-content-workspace-read", "agent-content-transcript-read", "agent-content-artifact-read", "agent-home-projection", "agent-input-preparation-v9", "terminal-projection-selection", "host-mcp-task-context", "custom-harness", "mailbox-read-ahead", "provider-provisioning.v1", "agent-memory-intent.v1"];
 export type CapabilityFlag = (typeof CAPABILITY_FLAGS)[number];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@byok-sdk/protocol",
-  "version": "0.24.0",
+  "version": "0.25.0-rc.1",
   "description": "BYOK SDK wire protocol: envelope schema, message types, and codec helpers",
   "type": "module",
   "license": "MIT",

package/dist/permission.d.ts

@@ -1,39 +0,0 @@
-import { z } from 'zod';
-export declare const PERMISSION_MODES: readonly ['auto', 'confirm', 'readonly', 'plan'];
-export type PermissionMode = (typeof PERMISSION_MODES)[number];
-/**
- * Policy the server proposes for a task. The daemon/runtime adapter maps this
- * onto the concrete runtime's flags; anything that can't be expressed exactly
- * must fail closed (deny) rather than silently widen the grant.
- *
- * `.strict()`: this is control/security data, so per the freeze rule's
- * observability-vs-control asymmetry (docs/protocol.md "Freeze rule") an
- * unrecognized field must be REJECTED, not silently stripped-and-ignored the
- * way an ordinary payload's unknown field is (plain `z.object()`'s default
- * behavior). Without `.strict()`, a policy carrying a future constraint this
- * schema doesn't know about yet would parse successfully with that
- * constraint silently discarded — exactly the silent-widening failure mode
- * this type's own doc comment above warns against, since a stripped
- * constraint is indistinguishable from a constraint that was never sent.
- *
- * Consequence: adding a new field to this schema post-freeze is therefore a
- * BREAKING change requiring a `PROTOCOL_VERSION` bump — unlike the general
- * "a new optional field on an existing payload is non-breaking" rule the
- * freeze rule grants every other schema. That's intentional: a new
- * security/control constraint must force a conscious version bump so an
- * unupgraded peer can never silently ignore it, rather than being added the
- * same low-friction way a harmless observability field would be.
- */
-export declare const PermissionPolicySchema: z.ZodObject<{
-    mode: z.ZodEnum<{
-        auto: "auto";
-        confirm: "confirm";
-        plan: "plan";
-        readonly: "readonly";
-    }>;
-    allowTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    denyTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    workspaceRoot: z.ZodOptional<z.ZodString>;
-    network: z.ZodOptional<z.ZodBoolean>;
-}, z.core.$strict>;
-export type PermissionPolicy = z.infer<typeof PermissionPolicySchema>;