@byokit/openclaw 0.9.0 → 0.11.0

package/dist/auth-store.js

@@ -1,13 +1,16 @@
 // The pin persists OAuth JSON in both shared and agent SQLite. There is no public persistence hook.
-// Seal only credential state — the engine's complete `state` tree plus every config/credential path in
-// `home` — never the regenerable tool caches, transcripts and logs a signed-in home accumulates.
-// Sealing those too once produced a snapshot past the runtime string limit and aborted boot.
+// Credential state under `home` and `state` is sealed as one bounded blob (`auth-store.sealed`, capped at
+// SEAL_CAP_BYTES, refusing with a typed error). Every other file under `state` — the SQLite databases, which mix
+// credentials with transcript rows, and the regenerable caches, transcripts, media, logs and session stores beside
+// them — is sealed as its own file under `auth-store.objects/`. Each such file is capped individually at
+// SEAL_CAP_BYTES; the total across objects is not, so growth in aggregate never refuses.
 import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, writeFileSync, closeSync, fsyncSync, openSync } from 'node:fs';
+import { createHash } from 'node:crypto';
 import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { EngineAlreadyRunningError, pidAlive as live } from "./engine-status.js";
 const encoder = new TextEncoder();
-const archive = (name) => /^(auth-profiles|auth-state|auth|oauth)\.json\.(migrated-.+|sqlite-import\..+\.bak)$/.test(name)
-    || name.endsWith('.moved-to-engine');
+const archive = (name) => !name.endsWith('.sealed') && (/^(auth-profiles|auth-state|auth|oauth)\.json\.(migrated-.+|sqlite-import\..+\.bak)$/.test(name)
+    || name.endsWith('.moved-to-engine'));
 function regular(path) {
     if (!lstatSync(path).isFile())
         throw new Error(`credential store requires regular files: ${path}`);
@@ -47,20 +50,92 @@ function put(path, bytes) {
         rmSync(tmp, { force: true });
     }
 }
+// Restore-only variant of put(): the same temp write, file fsync and atomic rename, but it records the
+// containing directory in `changed` instead of fsyncing it now. restore() fsyncs each distinct directory
+// once after every file is written, so a restore still makes each rename durable before it removes the
+// restoring marker, without one directory fsync per object. seal() and the stop path keep put().
+// When the live file already holds the exact bytes at the restore mode, the write (and its file fsync,
+// rename and directory fsync) is skipped: nothing on disk changes, so there is nothing to make durable.
+// Size is compared before reading; any read error (or a missing, changed or different-mode file) writes.
+function sameLiveFile(path, bytes) {
+    try {
+        const stat = lstatSync(path);
+        if (!stat.isFile())
+            return false;
+        if ((stat.mode & 0o777) !== 0o600)
+            return false;
+        if (stat.size !== bytes.length)
+            return false;
+        return readFileSync(path).equals(Buffer.from(bytes));
+    }
+    catch {
+        return false;
+    }
+}
+function putRestore(path, bytes, changed) {
+    if (sameLiveFile(path, bytes))
+        return;
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const tmp = `${path}.sealing-${process.pid}`;
+    try {
+        writeFileSync(tmp, bytes, { mode: 0o600, flag: 'wx' });
+        const fd = openSync(tmp, 'r');
+        try {
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        renameSync(tmp, path);
+        changed.add(dirname(path));
+    }
+    finally {
+        rmSync(tmp, { force: true });
+    }
+}
 // Credential state is what restores a working signed-in session. Regenerable tool caches, transcripts
-// and logs never do: the XDG cache and npm cache homes the kit's engine environment pins, plus the
-// transcript/log/cache subtrees of the Codex and Claude Code CLIs it runs in `home`. Unknown paths stay
+// and logs never do. In `home`: the XDG cache and npm cache homes the kit's engine environment pins, plus
+// the transcript/log/cache subtrees of the Codex and Claude Code CLIs it runs; those stay on disk unsealed.
+// In the isolated engine `state` tree the pinned engine (2026.8.1, `resolveStateDatabasePath`/`resolveOpenClawAgentSqlitePath`/
+// `resolveOAuthDir`) keeps credentials in the shared and per-agent SQLite databases and `credentials/`, and
+// writes non-credential data beside them: the caches (`cache/` control-UI assets, shell snapshots and
+// worker bundles, `completions/`), exported transcript artifacts (`transcripts/`), legacy session stores
+// (`sessions/`, `agents/<agentId>/sessions/`), the media stores (`media/`, `delivery-queue-media/`),
+// logs (`logs/`) and gateway temp/lock files (`tmp/`). Unknown paths stay
 // sealed — a credential location we do not know about must fail loudly, never drop silently.
 const HOME_CACHES = {
     home: ['.cache', '.npm'],
     'home/.codex': ['sessions', 'log', 'cache', '.tmp', 'history.jsonl'],
     'home/.claude': ['projects', 'todos', 'shell-snapshots', 'statsig', 'file-history', 'history.jsonl'],
 };
-/** True for the regenerable cache paths the collector never seals; tests assert these are all that stay at rest. */
-export function cached(name) {
-    const parent = name.includes('/') ? name.slice(0, name.lastIndexOf('/')) : '';
-    return (HOME_CACHES[parent] ?? []).includes(name.slice(name.lastIndexOf('/') + 1));
+// Positively non-credential subtrees directly under the isolated engine `state` tree. They are sealed as
+// separate objects, never in the credential blob.
+const STATE_NON_CREDENTIAL = new Set(['cache', 'completions', 'transcripts', 'sessions', 'media', 'delivery-queue-media', 'logs', 'tmp']);
+// Legacy per-agent session migration sources and archives.
+const AGENT_SESSIONS = /^state\/agents\/[^/]+\/sessions(\/|$)/;
+// The engine's SQLite databases and their journal/WAL sidecars.
+const DATABASE = /\.sqlite(-wal|-shm|-journal)?$/;
+/** True for the non-credential paths: under `home` they are never sealed; under `state` they are sealed as objects. */
+export function nonCredential(name) {
+    if (AGENT_SESSIONS.test(name))
+        return true;
+    const slash = name.lastIndexOf('/');
+    const parent = slash === -1 ? '' : name.slice(0, slash);
+    if (parent === 'state')
+        return STATE_NON_CREDENTIAL.has(name.slice(slash + 1));
+    return (HOME_CACHES[parent] ?? []).includes(name.slice(slash + 1));
+}
+// A file under `state` that is sealed as its own object: the SQLite databases and anything in a non-credential subtree.
+function apart(name) {
+    if (!name.startsWith('state/'))
+        return false;
+    if (DATABASE.test(name))
+        return true;
+    const parts = name.split('/');
+    return parts.some((_, i) => nonCredential(parts.slice(0, i + 1).join('/')));
 }
+const objectName = (name) => `${createHash('sha256').update(name).digest('hex')}.sealed`;
+const objectHash = (payload) => createHash('sha256').update(payload).digest('hex');
 function safePath(path) {
     return typeof path === 'string' && /^(state|home)(\/[^/]+)*$/.test(path)
         && !path.split('/').some((part) => part === '.' || part === '..' || part.includes('\\') || part.includes('\0'));
@@ -98,17 +173,46 @@ export class AuthStoreUnreadableError extends Error {
         this.reason = reason;
     }
 }
+/** Total raw credential bytes one snapshot may seal. The sealed payload is one runtime string, so collect()
+ *  refuses a larger snapshot before reading it and the process never aborts inside the sealer. Credential
+ *  state is normally a few MiB; the cap leaves several times that headroom. The same bound applies to each
+ *  non-credential engine store under `state` sealed as its own object; their total is not bounded. */
+export const SEAL_CAP_BYTES = 128 * 1024 * 1024;
+/** The saved sign-in data (or one object file, when `file` names it) is over `SEAL_CAP_BYTES`. On a refusal the
+ *  last good saved store is kept as it was and no live file is deleted. `size` is a lower bound for the whole
+ *  store (the running total when the cap was crossed) and the exact size when `file` is set. */
+export class AuthStoreSealSizeError extends Error {
+    code = 'auth-store-seal-size';
+    size;
+    cap;
+    file;
+    constructor(size, cap, file) {
+        const MiB = 1024 * 1024;
+        super(`${file ? `Engine data ${file}` : 'Your saved sign-in data'} is too large to keep safely (more than ${Math.floor(size / MiB)} MB; the limit is ${cap / MiB} MB). ` +
+            'Your sign-ins were kept.');
+        this.name = 'AuthStoreSealSizeError';
+        this.size = size;
+        this.cap = cap;
+        this.file = file;
+    }
+}
 export class AuthStore {
     active = false;
     owned = false;
     queue = Promise.resolve();
     file;
+    objects;
     lock;
     cleanup;
     restoring;
+    // Object file name -> sha256 of the plaintext payload currently sealed at that file. Kept only in memory: it
+    // never becomes on-disk metadata. Filled by restore() from what is decrypted, refreshed after each successful
+    // seal. A process that never restored starts with an empty map and reseals every object, as before.
+    objectHashes = new Map();
     constructor(privateOptions) {
         this.o = privateOptions;
         this.file = join(this.o.root, 'auth-store.sealed');
+        this.objects = join(this.o.root, 'auth-store.objects');
         this.lock = join(this.o.root, 'auth-store.lock');
         this.cleanup = join(this.o.root, 'auth-store.cleanup');
         this.restoring = join(this.o.root, 'auth-store.restoring');
@@ -178,21 +282,32 @@ export class AuthStore {
         rmSync(this.lock, { recursive: true });
         this.owned = false;
     }
-    async read() {
-        if (!existsSync(this.file))
-            return undefined;
-        regular(this.file);
-        const seal = this.o.seal;
-        const bytes = readFileSync(this.file);
-        let text;
+    open(bytes) {
         try {
-            text = seal.decryptString(bytes);
+            return this.o.seal.decryptString(bytes);
         }
         catch (error) {
             if (error?.code !== 'auth-failed')
                 throw error;
             throw new AuthStoreUnreadableError('auth-failed');
         }
+    }
+    seal(path, payload) {
+        const seal = this.o.seal;
+        const sealed = seal.encryptString(payload);
+        if (seal.decryptString(Buffer.from(sealed)) !== payload)
+            throw new Error('credential seal verification failed');
+        put(path, sealed);
+        if (seal.decryptString(readFileSync(path)) !== payload)
+            throw new Error('credential seal verification failed');
+    }
+    async read() {
+        if (!existsSync(this.file))
+            return undefined;
+        regular(this.file);
+        const seal = this.o.seal;
+        const bytes = readFileSync(this.file);
+        const text = this.open(bytes);
         let saved;
         try {
             saved = snapshot(text);
@@ -208,22 +323,45 @@ export class AuthStore {
         }
         return saved;
     }
-    collect() {
-        const s = { v: 1, dirs: [], files: [] };
+    readObject(file) {
+        let text = '';
+        let entry = null;
+        try {
+            text = this.open(readFileSync(file));
+            entry = JSON.parse(text);
+        }
+        catch (error) {
+            if (error instanceof AuthStoreUnreadableError)
+                throw error;
+            throw new AuthStoreUnreadableError('invalid-snapshot');
+        }
+        const path = entry?.path;
+        const data = entry?.data;
+        if (!safePath(path) || !apart(path) || typeof data !== 'string' || Buffer.from(data, 'base64').toString('base64') !== data) {
+            throw new AuthStoreUnreadableError('invalid-snapshot');
+        }
+        return [path, data, text];
+    }
+    inventory() {
+        const dirs = [];
+        const files = [];
+        const objects = [];
+        let total = 0;
         const root = realpathSync(this.o.root);
         const walk = (path) => {
             const name = relative(this.o.root, path).split('\\').join('/');
-            if (cached(name))
-                return; // tool caches are never credential state; skipping a directory skips its subtree
+            if (name.startsWith('home/') && nonCredential(name))
+                return; // regenerable home caches stay on disk; skipping a directory skips its subtree
             const stat = lstatSync(path);
             if (stat.isDirectory()) {
-                chmodSync(path, 0o700);
-                s.dirs.push(name);
+                if (!apart(name))
+                    dirs.push(name);
                 for (const child of readdirSync(path).sort())
                     walk(join(path, child));
                 return;
             }
             let file = path;
+            let target = stat;
             if (stat.isSymbolicLink()) {
                 try {
                     file = realpathSync(path);
@@ -233,26 +371,44 @@ export class AuthStore {
                         return;
                     throw error;
                 }
-                const target = relative(root, file);
-                if (isAbsolute(target) || target === '..' || target.startsWith(`..${sep}`))
-                    return;
-                if (!lstatSync(file).isFile())
+                const rel = relative(root, file);
+                if (isAbsolute(rel) || rel === '..' || rel.startsWith(`..${sep}`))
                     return;
+                target = lstatSync(file);
             }
-            else if (!stat.isFile())
+            if (!target.isFile())
                 return;
-            // Read the checked target, but save the link's path: restore materializes a regular file there.
-            chmodSync(file, 0o600);
-            s.files.push([name, readFileSync(file).toString('base64')]);
+            if (apart(name)) {
+                if (target.size > SEAL_CAP_BYTES)
+                    throw new AuthStoreSealSizeError(target.size, SEAL_CAP_BYTES, name);
+                objects.push({ name, file, size: target.size });
+                return;
+            }
+            // Refuse by size before any file is touched or read: an over-cap file must never reach memory or the sealer.
+            total += target.size;
+            if (total > SEAL_CAP_BYTES)
+                throw new AuthStoreSealSizeError(total, SEAL_CAP_BYTES);
+            files.push({ name, file, size: target.size });
         };
         for (const dir of ['state', 'home'])
             if (existsSync(join(this.o.root, dir)))
                 walk(join(this.o.root, dir));
-        return s;
+        return { dirs, files, objects };
     }
-    /** Remove the live credential trees: `state` entirely (it is all credential state, including the
-     *  runtime entries the collector skips), and in `home` exactly the sealed paths — regenerable caches
-     *  and the directories still holding them are left in place. */
+    collect() {
+        const { dirs, files, objects } = this.inventory();
+        for (const dir of dirs)
+            chmodSync(join(this.o.root, dir), 0o700);
+        // Read the checked target, but save the link's path: restore materializes a regular file there.
+        for (const { file } of [...files, ...objects])
+            chmodSync(file, 0o600);
+        return {
+            saved: { v: 1, dirs, files: files.map(({ name, file }) => [name, readFileSync(file).toString('base64')]) },
+            objects,
+        };
+    }
+    /** Remove the live sealed trees: all of `state` (every file there is sealed, as a blob entry or an object),
+     *  and in `home` exactly the sealed paths — regenerable caches and the directories still holding them are left in place. */
     remove(s) {
         rmSync(join(this.o.root, 'state'), { recursive: true, force: true });
         for (const [path] of s.files)
@@ -271,6 +427,28 @@ export class AuthStore {
             }
         }
     }
+    sealObjects(objects) {
+        mkdirSync(this.objects, { recursive: true, mode: 0o700 });
+        const keep = new Set();
+        for (const { name, file } of objects) {
+            const object = objectName(name);
+            keep.add(object);
+            const target = join(this.objects, object);
+            const payload = JSON.stringify({ path: name, data: readFileSync(file).toString('base64') });
+            // An object this process already sealed (or restored) unchanged is not resealed: its plaintext hash is
+            // the same and its sealed file is still on disk, so the encrypt + verify + fsyncs are skipped. A changed
+            // file, a new one, or one whose sealed file vanished falls through to the normal seal.
+            const hash = objectHash(payload);
+            if (this.objectHashes.get(object) === hash && existsSync(target))
+                continue;
+            this.objectHashes.delete(object);
+            this.seal(target, payload);
+            this.objectHashes.set(object, hash);
+        }
+        for (const entry of readdirSync(this.objects))
+            if (!keep.has(entry))
+                rmSync(join(this.objects, entry), { force: true });
+    }
     async persist() {
         if (!this.o.seal)
             return;
@@ -282,40 +460,66 @@ export class AuthStore {
             removeMarker(this.restoring);
             this.o.log?.('interrupted credential transition recovered');
         }
-        const saved = this.collect();
+        const { saved, objects } = this.collect();
         // Live trees with nothing sealable are debris (crash leftovers, or only the caches a previous stop
         // left in place) — keep the sealed credentials instead of replacing them with an empty snapshot.
         // A running engine always leaves files behind (its SQLite stores), so a genuine sign-out still re-seals.
-        if (!saved.files.length && previous)
+        if (!saved.files.length && !objects.length && previous)
             return;
         // The payload is built exactly once; verification decrypts the sealed bytes and compares to it.
-        const payload = JSON.stringify(saved);
-        const sealed = this.o.seal.encryptString(payload);
-        if (this.o.seal.decryptString(Buffer.from(sealed)) !== payload)
-            throw new Error('credential seal verification failed');
-        put(this.file, sealed);
-        if (this.o.seal.decryptString(readFileSync(this.file)) !== payload)
-            throw new Error('credential seal verification failed');
-        if (previous?.dirs.some(cached))
+        this.seal(this.file, JSON.stringify(saved));
+        if (previous?.dirs.some(nonCredential))
             this.o.log?.('sealed credential store re-sealed: tool caches no longer sealed');
+        this.sealObjects(objects);
         put(this.cleanup, encoder.encode('1'));
         this.remove(saved);
         removeMarker(this.cleanup);
     }
+    /** `mkdir -p` for a restore target that records the parent of every directory it creates: a new directory
+     *  changes its parent's entries, so the parent needs a directory fsync too. Stops at the store root (it exists)
+     *  and never fsyncs now; restore() fsyncs the collected directories once after all files are written. */
+    ensureRestoreDirs(dir, changed) {
+        const created = [];
+        for (let d = dir; d !== this.o.root && d !== dirname(d) && !existsSync(d); d = dirname(d))
+            created.push(d);
+        for (const d of created.reverse()) {
+            mkdirSync(d, { mode: 0o700 });
+            changed.add(dirname(d));
+        }
+    }
     async restore() {
         if (!this.o.seal)
             return;
         const saved = await this.read();
         // A crashed host may leave a newer live state; prepare seals that before restore.
         put(this.restoring, encoder.encode('1'));
+        const changed = new Set();
         if (saved) {
             for (const dir of saved.dirs.sort((a, b) => a.split('/').length - b.split('/').length))
-                mkdirSync(join(this.o.root, dir), { recursive: true, mode: 0o700 });
+                this.ensureRestoreDirs(join(this.o.root, dir), changed);
             for (const [path, data] of saved.files)
-                put(join(this.o.root, path), Buffer.from(data, 'base64'));
+                putRestore(join(this.o.root, path), Buffer.from(data, 'base64'), changed);
+        }
+        if (existsSync(this.objects)) {
+            for (const entry of readdirSync(this.objects)) {
+                const [path, data, payload] = this.readObject(join(this.objects, entry));
+                this.objectHashes.set(entry, objectHash(payload));
+                // An object path can be several directories below an existing one, and those directories are not in
+                // `saved.dirs` (they sit in a non-credential subtree). Create them through ensureRestoreDirs so the
+                // parent of every directory this restore creates — not just each object's own directory — is fsynced
+                // before the marker goes; otherwise a crash after marker removal could lose a directory entry and the
+                // next prepare() would seal the now-incomplete live tree over the good sealed objects.
+                const target = join(this.o.root, path);
+                this.ensureRestoreDirs(dirname(target), changed);
+                putRestore(target, Buffer.from(data, 'base64'), changed);
+            }
         }
         for (const dir of ['state', 'home'])
-            mkdirSync(join(this.o.root, dir), { recursive: true, mode: 0o700 });
+            this.ensureRestoreDirs(join(this.o.root, dir), changed);
+        // Each restored file's content is durable already (putRestore fsyncs it); every rename and every new
+        // directory entry is made durable here, once per distinct directory, before the marker is removed.
+        for (const dir of changed)
+            syncDir(dir);
         removeMarker(this.restoring);
     }
     async archives() {
@@ -373,8 +577,17 @@ export class AuthStore {
         return this.serial(async () => {
             if (!this.owned)
                 return;
-            await this.archives();
-            await this.persist();
+            try {
+                await this.archives();
+                await this.persist();
+            }
+            catch (error) {
+                if (error instanceof AuthStoreSealSizeError) {
+                    this.active = false;
+                    this.release();
+                }
+                throw error;
+            }
             this.active = false;
             this.release();
         });

package/dist/classify.js

@@ -2,7 +2,8 @@
 // The regexes are Crewhouse `classifyText`; the kinds are the kit's: rate_limit|overloaded → resting,
 // signed_out → signed-out, not_included → plan, network → network, anything unrecognised → other.
 export function classify(message) {
-    const retry = /try again in ~?(\d+)\s*(min|h)/i.exec(message);
+    // Kept in step with @byokit/accounts' classifyFailure: both read the retry delay from either wording.
+    const retry = /(?:try again in|next reset in)\s*~?(\d+)\s*(min|h)/i.exec(message);
     const until = retry ? Date.now() + Number(retry[1]) * (retry[2].toLowerCase() === 'h' ? 3_600_000 : 60_000) : undefined;
     const kind = /your plan doesn't include/i.test(message) ? 'plan'
         : /usage limit|rate.?limit|quota|too many requests|\b429\b/i.test(message) ? 'resting'

package/dist/config.d.ts

@@ -11,6 +11,7 @@ export declare function reconcileConfig(saved: object | undefined, o: {
     policyPath: string;
     app?: object;
     installPolicy?: KitOptions['installPolicy'];
+    offered?: readonly string[];
     browser?: {
         profiles: Record<string, {
             cdpUrl: string;

package/dist/config.js

@@ -1,6 +1,6 @@
 import { dirname, join } from 'node:path';
 import { routes } from "./routes.js";
-import { MEMBER_ID, KEY_PREFIX, keyAgentId } from "./members.js";
+import { MEMBER_ID, KEY_PREFIX, BASE_AGENT, keyAgentId } from "./members.js";
 const object = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
 const merge = (a, b) => {
     for (const [k, v] of Object.entries(b))
@@ -26,6 +26,16 @@ const safeMemory = (memory) => {
         s.provider = 'none';
     s.fallback = 'none';
 };
+/** The plugin of every route an app offers by name (5.6). A consumer names its offered accounts; each is the engine
+ * provider, the auth choice or an alias a route carries. Routes nobody names stay out. */
+function offeredPlugins(offered) {
+    if (!Array.isArray(offered) || !offered.length)
+        return [];
+    const named = new Set(offered);
+    return routes().filter(route => route.plugin && !route.needs?.plugin
+        && (named.has(route.provider) || named.has(route.choice) || (route.aliases ?? []).some(alias => named.has(alias))))
+        .map(route => route.plugin);
+}
 export function reconcileConfig(saved, o) {
     const c = merge(merge({}, object(saved) ? saved : {}), object(o.app) ? o.app : {});
     merge(c, {
@@ -37,6 +47,9 @@ export function reconcileConfig(saved, o) {
     c.channels ??= {};
     c.agents ??= {};
     c.agents.defaults ??= {};
+    // Auth isolation (5.15): left unset, the pin makes the first agent the inherited owner once the roster grows, and
+    // every later agent (other members too) reads its sign-ins. The base is an id the kit never creates.
+    c.agents.defaults.authInheritance = { agentId: BASE_AGENT };
     c.agents.defaults.models ??= {};
     c.agents.defaults.models['openai/*'] = { ...c.agents.defaults.models['openai/*'], agentRuntime: { id: 'openclaw' } };
     const allow = c.agents.defaults.modelPolicy?.allow;
@@ -59,7 +72,9 @@ export function reconcileConfig(saved, o) {
             // Every default-eligible bundled route, not only the ready ones: anthropic-cli waits on its binary and
             // shares its plugin with the explicit apiKey route, so neither may depend on another route being offered.
             ...routes().filter(route => route.offerPolicy === 'default' && !route.needs?.plugin && route.plugin)
-                .map(route => route.plugin)])];
+                .map(route => route.plugin),
+            // Plus every explicitly offered route the app names, so an opted-in sign-in (OpenRouter) is not blocked.
+            ...offeredPlugins(o.offered)])];
     c.plugins.entries ??= {};
     c.plugins.entries[o.pluginId] = merge(c.plugins.entries[o.pluginId] ?? {}, { hooks: { timeouts: { before_tool_call: 200_000 } } });
     if (o.browser) {

package/dist/constants.d.ts

@@ -1,3 +1,3 @@
-export declare const ENGINE_VERSION = "2026.8.1";
+export declare const ENGINE_VERSION = "2026.8.35";
 export declare const PROTOCOL_VERSION = 4;
 export declare const OPERATOR_SCOPES: readonly ["operator.read", "operator.write", "operator.admin", "operator.approvals", "operator.questions", "operator.pairing", "operator.talk"];

package/dist/constants.js

@@ -1,6 +1,6 @@
 // The pins this kit is built against (D4, D6). Data, not behavior: an installed engine on another version is
 // `needs-update`, never silently run.
-export const ENGINE_VERSION = '2026.8.1';
+export const ENGINE_VERSION = '2026.8.35';
 export const PROTOCOL_VERSION = 4;
 export const OPERATOR_SCOPES = [
     'operator.read',

package/dist/device.d.ts

@@ -1,5 +1,5 @@
 import type { BrowserDevice, SignInRefusedWhy } from './browser.ts';
-import type { DeviceLink } from '@byokit/link';
+import type { DeviceLink } from '@byokit/pair';
 import type { RouteView } from './routes.ts';
 import { type AccountView } from './words.ts';
 import type { Approval, Decision, GatewayEventName, GatewayEventPayload, GatewayMethod, GatewayParams, GatewayResult, KitState, RunEnd, OutputSchema, SchemaOutput, RunEvent, SignInView } from './types.ts';

package/dist/engine.d.ts

@@ -1,7 +1,7 @@
-import { AuthStore } from './auth-store.ts';
+import { AuthStore, AuthStoreSealSizeError } from './auth-store.ts';
 import type { KitOptions } from './kit.ts';
 import type { KitState, ToolSpec } from './types.ts';
-export type EngineOptions = Pick<KitOptions, 'stateDir' | 'engineDir' | 'npmPath' | 'enginePath' | 'config' | 'appOwnedSessions' | 'installPolicy' | 'log' | 'bridge' | 'authSeal'> & {
+export type EngineOptions = Pick<KitOptions, 'stateDir' | 'engineDir' | 'npmPath' | 'enginePath' | 'config' | 'offered' | 'appOwnedSessions' | 'installPolicy' | 'log' | 'bridge' | 'authSeal'> & {
     pluginId: string;
     tools: ToolSpec[];
     gateBuiltins?: boolean;
@@ -16,6 +16,7 @@ export type EngineOptions = Pick<KitOptions, 'stateDir' | 'engineDir' | 'npmPath
     onState(s: KitState): void;
     onExit(code: number | null): void;
 };
+export declare const refusedOnly: (error: unknown) => AuthStoreSealSizeError;
 export declare class Engine {
     readonly root: string;
     readonly bridgeSock: string;
@@ -38,6 +39,8 @@ export declare class Engine {
     private readonly appOwnedSessionPrefixes;
     constructor(o: EngineOptions);
     private state;
+    private retainInstallDiagnostics;
+    private exitedState;
     private get entry();
     private freePort;
     prepare(): Promise<void>;