@byok-sdk/server 0.8.0 → 0.8.1

package/dist/index.js

@@ -5,7 +5,7 @@ import { mkdir, writeFile, readFile } from 'fs/promises';
 import { mkdtempSync, mkdirSync, existsSync, chmodSync } from 'fs';
 import { tmpdir } from 'os';
 import path, { dirname } from 'path';
-import { CAPABILITY_FLAGS, byokBlobContentPath, canTransition, PROTOCOL_VERSION, encodeEnvelope, DAEMON_TO_SERVER_TYPES, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, AgentRefSchema, AgentEgressPolicySchema, DispatchSelectionSchema, RequiredToolsetsSchema, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AgentContentReadPayloadSchema, AgentHomeProjectionPayloadSchema, AGENT_HOME_PROJECTION_CAPABILITY, AgentHomeProjectionReadbackSchema, AgentHomeProjectionCompletionRequestSchema, createEnvelope, TASK_STATES, BYOK_PAIR_PATH, PairRequestSchema, PairResponseSchema, BYOK_CHALLENGE_PATH, ChallengeRequestSchema, BYOK_TOKEN_PATH, TokenRequestSchema, BYOK_BLOBS_PATH, CreateBlobRequestSchema, BYOK_BLOB_FINALIZE_ROUTE, BYOK_BLOB_URL_ROUTE, BYOK_BLOB_CONTENT_ROUTE, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendRequestSchema, BYOK_AGENT_HOME_PROJECTION_COMPLETION_ROUTE, AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, PairResponseTenantIdSchema, decodeEnvelope, BYOK_WS_PATH } from '@byok-sdk/protocol';
+import { CAPABILITY_FLAGS, byokBlobContentPath, canTransition, PROTOCOL_VERSION, encodeEnvelope, DAEMON_TO_SERVER_TYPES, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, AgentRefSchema, AgentEgressPolicySchema, DispatchSelectionSchema, RequiredToolsetsSchema, STRICT_AGENT_ONLY_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AgentContentReadPayloadSchema, AgentHomeProjectionPayloadSchema, AGENT_HOME_PROJECTION_CAPABILITY, AgentHomeProjectionReadbackSchema, AgentHomeProjectionCompletionRequestSchema, createEnvelope, TASK_STATES, BYOK_PAIR_PATH, PairRequestSchema, PairResponseSchema, BYOK_CHALLENGE_PATH, ChallengeRequestSchema, BYOK_TOKEN_PATH, TokenRequestSchema, BYOK_BLOBS_PATH, CreateBlobRequestSchema, BYOK_BLOB_FINALIZE_ROUTE, BYOK_BLOB_URL_ROUTE, BYOK_BLOB_CONTENT_ROUTE, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendRequestSchema, BYOK_AGENT_HOME_PROJECTION_COMPLETION_ROUTE, AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, PairResponseTenantIdSchema, decodeEnvelope, BYOK_WS_PATH } from '@byok-sdk/protocol';
 import { Hono } from 'hono';
 import { WebSocketServer } from 'ws';
 import { createRequire } from 'module';
@@ -1629,7 +1629,7 @@ var ConnectionHub = class {
     const egressPolicy = input.egressPolicy === void 0 ? void 0 : AgentEgressPolicySchema.parse(input.egressPolicy);
     const dispatchSelection = input.dispatchSelection === void 0 ? void 0 : DispatchSelectionSchema.parse(input.dispatchSelection);
     const requiredToolsets = input.requiredToolsets === void 0 ? void 0 : RequiredToolsetsSchema.parse(input.requiredToolsets);
-    const deviceId = input.deviceId ?? this.pickFirstConnectedDevice(requiredToolsets);
+    const deviceId = input.deviceId ?? this.pickFirstConnectedDevice(requiredToolsets, agentRef !== void 0);
     if (agentRef !== void 0 && input.deviceId === void 0) {
       throw new Error("Agent-bound dispatch requires an explicit deviceId for capability admission");
     }
@@ -1641,6 +1641,11 @@ var ConnectionHub = class {
         deviceId ? `device ${deviceId} is not connected` : "no connected device to dispatch to (M0 does not queue tasks until a device connects)"
       );
     }
+    if (agentRef === void 0 && this.getDeviceCapabilities(deviceId)?.includes(STRICT_AGENT_ONLY_CAPABILITY) === true) {
+      throw new Error(
+        `device ${deviceId} advertises strict-agent-only; legacy task dispatch is refused before enqueue`
+      );
+    }
     if (agentRef !== void 0 && !(this.getDeviceCapabilities(deviceId)?.includes("agent-home-contract") ?? false)) {
       throw new Error(
         `device ${deviceId} did not advertise agent-home-contract capability; refusing Agent-bound dispatch`
@@ -2005,9 +2010,10 @@ var ConnectionHub = class {
     }
     this.sendToDevice(record.deviceId, "task.steer", { text }, { taskId });
   }
-  pickFirstConnectedDevice(requiredToolsets) {
+  pickFirstConnectedDevice(requiredToolsets, allowStrictAgentOnly = false) {
     for (const [deviceId, conn] of this.connections) {
       if (!conn.connected) continue;
+      if (!allowStrictAgentOnly && conn.capabilities?.includes(STRICT_AGENT_ONLY_CAPABILITY)) continue;
       if (requiredToolsets === void 0) return deviceId;
       if (!conn.capabilities?.includes("toolset-selection")) continue;
       if (conn.configuredToolsets === void 0) continue;