@camerontaylor/paseo-client 0.12.0-beta.1.fork.1 → 0.13.0-fork.1

package/dist/connection/index.d.ts

@@ -39,6 +39,7 @@ export declare const DEFAULT_CLIENT_CAPABILITIES: {
     timeline_notifications: true;
     plugin_timeline_items: true;
     workspace_setup_blocked: true;
+    workspace_setup_observation: true;
     durable_agent_queue: true;
     durable_voice_input_v1: true;
     explicit_event_subscriptions: true;

package/dist/connection/index.js

@@ -112,6 +112,7 @@ export const DEFAULT_CLIENT_CAPABILITIES = {
     [CLIENT_CAPS.timelineNotifications]: true,
     [CLIENT_CAPS.pluginTimelineItems]: true,
     [CLIENT_CAPS.workspaceSetupBlocked]: true,
+    [CLIENT_CAPS.workspaceSetupObservation]: true,
     [CLIENT_CAPS.durableAgentQueue]: true,
     [CLIENT_CAPS.durableVoiceInputV1]: true,
     [CLIENT_CAPS.explicitEventSubscriptions]: true,

package/dist/daemon-client-relay-e2ee-transport.d.ts

@@ -1,9 +1,29 @@
+import { type SecurityMode } from "@camerontaylor/paseo-relay/e2ee";
 import type { DaemonTransport, DaemonTransportFactory, TransportLogger } from "./daemon-client-transport-types.js";
-export declare function createRelayE2eeTransportFactory(args: {
-    baseFactory: DaemonTransportFactory;
+export interface RelayE2eeTransportOptions {
     daemonPublicKeyB64: string;
     logger: TransportLogger;
+    assertOutboundCapacity?: (wireBytes: number) => void;
+    /** Refuse to open unless the daemon negotiates at least this endpoint security mode. */
+    minimumMode?: SecurityMode;
+    /** Reports the negotiated mode once the daemon has authenticated the handshake. */
+    onSecurityMode?: (mode: SecurityMode) => void;
+}
+export declare function createRelayE2eeTransportFactory(args: RelayE2eeTransportOptions & {
+    baseFactory: DaemonTransportFactory;
 }): DaemonTransportFactory;
-export declare function createRelayTransportFactory(baseFactory: DaemonTransportFactory): DaemonTransportFactory;
-export declare function createEncryptedTransport(base: DaemonTransport, daemonPublicKeyB64: string, logger: TransportLogger): DaemonTransport;
+/**
+ * Returns a user-facing message when this client closed the session itself
+ * because endpoint security could not be established, so reconnecting cannot help.
+ *
+ * The daemon's own policy close never reaches the client: both relays replace a
+ * daemon-side close with their own code (1012 on the wrangler relay).
+ */
+export declare function describeEndpointSecurityClose(event: unknown): string | null;
+/**
+ * Relay upgrades carry routing only. Daemon credentials and subprotocols must
+ * never reach the relay; they travel inside the encrypted hello.
+ */
+export declare function createRelayUpgradeTransportFactory(baseFactory: DaemonTransportFactory): DaemonTransportFactory;
+export declare function createEncryptedTransport(base: DaemonTransport, options: RelayE2eeTransportOptions): DaemonTransport;
 //# sourceMappingURL=daemon-client-relay-e2ee-transport.d.ts.map

package/dist/daemon-client-relay-e2ee-transport.js

@@ -1,20 +1,68 @@
 import { MAX_RELAY_WEBSOCKET_MESSAGE_BYTES } from "@camerontaylor/paseo-protocol/websocket-message-limit";
-import { createClientChannel, } from "@camerontaylor/paseo-relay/e2ee";
+import { openClientSecureChannel, PROTECTED_HANDSHAKE_FAILED_CLOSE_CODE, } from "@camerontaylor/paseo-relay/e2ee";
 import { extractRelayMessage, normalizeTransportPayload, messageTooLargeError, } from "./daemon-client-transport-utils.js";
 export function createRelayE2eeTransportFactory(args) {
-    return ({ url }) => {
-        const base = args.baseFactory({ url });
-        return createEncryptedTransport(base, args.daemonPublicKeyB64, args.logger);
-    };
+    const { baseFactory, ...options } = args;
+    return ({ url }) => createEncryptedTransport(baseFactory({ url }), options);
+}
+const DAEMON_REQUIRES_PROTECTED_REASON = "daemon requires protected endpoint security";
+/**
+ * Returns a user-facing message when this client closed the session itself
+ * because endpoint security could not be established, so reconnecting cannot help.
+ *
+ * The daemon's own policy close never reaches the client: both relays replace a
+ * daemon-side close with their own code (1012 on the wrangler relay).
+ */
+export function describeEndpointSecurityClose(event) {
+    if (!event || typeof event !== "object")
+        return null;
+    const code = "code" in event ? event.code : undefined;
+    const reason = "reason" in event && typeof event.reason === "string" ? event.reason : "";
+    if (code === PROTECTED_HANDSHAKE_FAILED_CLOSE_CODE) {
+        return `Endpoint security handshake failed: ${reason || "protected mode unavailable"}`;
+    }
+    return null;
+}
+/**
+ * The first session message from the daemon is `server_info`. A daemon that can
+ * negotiate protected security advertises it there, so a legacy session with such
+ * a daemon was downgraded in transit and must not proceed to admission.
+ */
+function readServerInfoProtectedSupport(text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    if (!isRecord(parsed) || parsed.type !== "session" || !isRecord(parsed.message))
+        return null;
+    const message = parsed.message;
+    if (message.type !== "status" || !isRecord(message.payload))
+        return null;
+    if (message.payload.status !== "server_info")
+        return null;
+    const features = message.payload.features;
+    return isRecord(features) && features.relayProtectedSecurity === true;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
 }
-export function createRelayTransportFactory(baseFactory) {
-    // The relay upgrade precedes E2EE. Only the encrypted hello may carry daemon credentials.
+/**
+ * Relay upgrades carry routing only. Daemon credentials and subprotocols must
+ * never reach the relay; they travel inside the encrypted hello.
+ */
+export function createRelayUpgradeTransportFactory(baseFactory) {
     return ({ url }) => baseFactory({ url });
 }
-export function createEncryptedTransport(base, daemonPublicKeyB64, logger) {
+export function createEncryptedTransport(base, options) {
+    const { daemonPublicKeyB64, logger, minimumMode, onSecurityMode } = options;
+    const assertOutboundCapacity = options.assertOutboundCapacity ?? (() => { });
     let channel = null;
     let opened = false;
     let closed = false;
+    let awaitingServerInfo = true;
     const openHandlers = new Set();
     const closeHandlers = new Set();
     const errorHandlers = new Set();
@@ -43,6 +91,17 @@ export function createEncryptedTransport(base, daemonPublicKeyB64, logger) {
         if (closed) {
             return;
         }
+        if (awaitingServerInfo && typeof data === "string") {
+            const daemonSupportsProtected = readServerInfoProtectedSupport(data);
+            if (daemonSupportsProtected !== null) {
+                awaitingServerInfo = false;
+                if (daemonSupportsProtected && channel?.securityMode() === "legacy") {
+                    logger.warn({ reason: DAEMON_REQUIRES_PROTECTED_REASON }, "relay_e2ee_downgrade_rejected");
+                    channel.close(PROTECTED_HANDSHAKE_FAILED_CLOSE_CODE, DAEMON_REQUIRES_PROTECTED_REASON);
+                    return;
+                }
+            }
+        }
         emitHandlers(messageHandlers, data, data instanceof ArrayBuffer);
     };
     const relayTransport = {
@@ -61,18 +120,36 @@ export function createEncryptedTransport(base, daemonPublicKeyB64, logger) {
             }
             base.send(String(data));
         },
-        close: (code, reason) => base.close(code, reason),
+        // The channel decides the close code. Report it now: a socket close event
+        // arrives asynchronously, and the consumer must not act on an earlier
+        // error before it has seen the code.
+        close: (code, reason) => {
+            base.close(code, reason);
+            emitClose({ code, reason });
+        },
         onmessage: null,
         onclose: null,
         onerror: null,
     };
     const startHandshake = async () => {
         try {
-            channel = await createClientChannel(relayTransport, daemonPublicKeyB64, {
-                onopen: emitOpen,
-                onmessage: (data) => emitMessage(data),
-                onclose: (code, reason) => emitClose({ code, reason }),
-                onerror: (error) => emitError(error),
+            channel = await openClientSecureChannel(relayTransport, {
+                daemonPublicKeyB64,
+                ...(minimumMode ? { minimumMode } : {}),
+                events: {
+                    onopen: () => {
+                        onSecurityMode?.(channel?.securityMode() ?? "legacy");
+                        emitOpen();
+                    },
+                    onmessage: (data) => emitMessage(data),
+                    onclose: (code, reason) => emitClose({ code, reason }),
+                    // Every fatal channel error is followed by a close that carries the
+                    // code and reason; forwarding the error first would make the consumer
+                    // reconnect before it sees them.
+                    onerror: (error) => {
+                        logger.warn({ err: normalizeTransportError(error) }, "relay_e2ee_channel_error");
+                    },
+                },
             });
         }
         catch (error) {
@@ -109,6 +186,9 @@ export function createEncryptedTransport(base, daemonPublicKeyB64, logger) {
             if (wireBytes > MAX_RELAY_WEBSOCKET_MESSAGE_BYTES) {
                 throw messageTooLargeError(wireBytes, MAX_RELAY_WEBSOCKET_MESSAGE_BYTES);
             }
+            // Encryption and its transport handoff are synchronous up to send's first await.
+            // Reject capacity failures here so a routed sender loses only its own channel.
+            assertOutboundCapacity(wireBytes);
             void channel.send(payload).catch((error) => {
                 emitError(error);
             });

package/dist/daemon-client-transport.d.ts

@@ -1,5 +1,5 @@
 export type { DaemonTransport, DaemonTransportFactory, TransportLogger, WebSocketFactory, WebSocketLike, } from "./daemon-client-transport-types.js";
 export { decodeMessageData, describeTransportClose, describeTransportError, encodeUtf8String, extractRelayMessage, normalizeTransportPayload, safeRandomId, } from "./daemon-client-transport-utils.js";
-export { createEncryptedTransport, createRelayE2eeTransportFactory, createRelayTransportFactory, } from "./daemon-client-relay-e2ee-transport.js";
+export { createEncryptedTransport, createRelayE2eeTransportFactory, createRelayUpgradeTransportFactory, describeEndpointSecurityClose, } from "./daemon-client-relay-e2ee-transport.js";
 export { bindWsHandler, createWebSocketTransportFactory, defaultWebSocketFactory, } from "./daemon-client-websocket-transport.js";
 //# sourceMappingURL=daemon-client-transport.d.ts.map

package/dist/daemon-client-transport.js

@@ -1,4 +1,4 @@
 export { decodeMessageData, describeTransportClose, describeTransportError, encodeUtf8String, extractRelayMessage, normalizeTransportPayload, safeRandomId, } from "./daemon-client-transport-utils.js";
-export { createEncryptedTransport, createRelayE2eeTransportFactory, createRelayTransportFactory, } from "./daemon-client-relay-e2ee-transport.js";
+export { createEncryptedTransport, createRelayE2eeTransportFactory, createRelayUpgradeTransportFactory, describeEndpointSecurityClose, } from "./daemon-client-relay-e2ee-transport.js";
 export { bindWsHandler, createWebSocketTransportFactory, defaultWebSocketFactory, } from "./daemon-client-websocket-transport.js";
 //# sourceMappingURL=daemon-client-transport.js.map

package/dist/daemon-client.d.ts

@@ -1,3 +1,5 @@
+import { type HostRouteFrame } from "@camerontaylor/paseo-protocol/binary-frames/index";
+import type { HostAdd, HostUpdate, HostDirectory } from "@camerontaylor/paseo-protocol/hosts";
 import { type TimelineMessage } from "./timeline-subscription/index.js";
 import { type OwnedSubscription, type TimelineSubscription } from "./connection/index.js";
 import type { AgentQueueSnapshot, CreationSnapshot } from "@camerontaylor/paseo-protocol/messages";
@@ -48,6 +50,8 @@ export type ConnectionState = {
 } | {
     status: "disconnected";
     reason?: string;
+    nextRetryAt?: string;
+    failureCode?: string;
 } | {
     status: "disposed";
 };
@@ -110,10 +114,13 @@ export type DaemonEvent = {
 export type DaemonEventHandler = (event: DaemonEvent) => void;
 export type BrowserAutomationExecuteRequestMessage = BrowserAutomationExecuteRequest;
 export type BrowserAutomationExecuteResponseMessage = BrowserAutomationExecuteResponse;
+/** Endpoint security negotiated on a relay connection. See docs/relay-endpoint-security.md. */
+export type RelaySecurityMode = "legacy" | "protected";
 export interface DaemonClientConfig {
     /** Deliver compact bodies/hash references to a caller-owned snapshot cache.
      * The default keeps public SDK snapshot entries expanded. */
     providerSnapshots?: "wire";
+    sessionPermissions?: import("@camerontaylor/paseo-protocol/messages").DaemonPermission[];
     url: string;
     clientId: string;
     clientType?: "mobile" | "browser" | "cli" | "mcp" | "hub";
@@ -130,6 +137,10 @@ export interface DaemonClientConfig {
     e2ee?: {
         enabled?: boolean;
         daemonPublicKeyB64?: string;
+        /** Refuse connections whose negotiated endpoint security is below this mode. */
+        minimumMode?: RelaySecurityMode;
+        /** Called with the negotiated mode after each authenticated relay handshake. */
+        onSecurityMode?: (mode: RelaySecurityMode) => void;
     };
     reconnect?: {
         enabled?: boolean;
@@ -148,6 +159,8 @@ export interface DaemonClientTrace {
 }
 export interface SendMessageOptions {
     sourceAgentId?: string;
+    sourceAgentServerId?: string;
+    sessionMode?: string;
     messageId?: string;
     /** What happens when the agent is mid-turn. The daemon interrupts the turn when omitted. */
     activeTurnBehavior?: ActiveTurnBehavior;
@@ -180,10 +193,12 @@ export interface CreateAgentRequestOptions extends AgentConfigOverrides {
     outputSchema?: Record<string, unknown>;
     images?: CreateAgentRequestMessage["images"];
     attachments?: CreateAgentRequestMessage["attachments"];
+    /** @deprecated Use createWorkspace({ source, agent, idempotencyKey }); rejected by createAgent. */
     git?: GitSetupOptions;
     worktree?: CreateAgentRequestMessage["worktree"];
     autoArchive?: CreateAgentRequestMessage["autoArchive"];
     background?: CreateAgentRequestMessage["background"];
+    /** @deprecated Use createWorkspace({ source, agent, idempotencyKey }); rejected by createAgent. */
     worktreeName?: string;
     requestId?: string;
     labels?: Record<string, string>;
@@ -594,7 +609,13 @@ type CorrelatedResponsePayloads = {
 type CorrelatedResponsePayload<TType extends CorrelatedResponseType> = CorrelatedResponsePayloads[TType];
 export declare class DaemonConnectionError extends Error {
     readonly code: "DAEMON_CONNECTION_LOST" | "DAEMON_REQUEST_TIMEOUT";
-    constructor(message: string, code?: "DAEMON_CONNECTION_LOST" | "DAEMON_REQUEST_TIMEOUT");
+    readonly serverId?: string;
+    readonly outcome?: "unknown";
+    constructor(message: string, code?: "DAEMON_CONNECTION_LOST" | "DAEMON_REQUEST_TIMEOUT", context?: {
+        serverId?: string;
+        outcome?: "unknown";
+        cause?: Error;
+    });
 }
 export declare function supportsUsageReports(features: ServerInfoStatusPayload["features"]): boolean;
 /** Identifies the voice attachment a voice message belongs to. */
@@ -619,11 +640,14 @@ export declare class DaemonClient {
     private connectTimeout;
     private pendingGenericTransportErrorTimeout;
     private reconnectAttempt;
+    private traceConnectionAttempt;
     private shouldReconnect;
     private connectPromise;
     private connectResolve;
     private connectReject;
     private lastErrorValue;
+    private destinationServerId;
+    private connectionFailure;
     private authFailureReasonValue;
     private connectionState;
     private readonly terminalStreams;
@@ -632,6 +656,12 @@ export declare class DaemonClient {
     private completedBinaryFileReads;
     private logger;
     private pendingSendQueue;
+    /**
+     * Lowest relay endpoint security this client accepts on its next attempt.
+     * Starts at the configured minimum and rises to "protected" once a daemon
+     * negotiates it, so a later reconnect cannot be downgraded to legacy.
+     */
+    private relaySecurityFloorValue;
     private readonly logConnectionPath;
     private readonly logServerId;
     private readonly logClientIdHash;
@@ -655,10 +685,61 @@ export declare class DaemonClient {
         verify?: boolean;
     }): void;
     private verifyConnection;
+    requireConnectedHosts(): void;
+    listHosts(): Promise<HostDirectory>;
+    observeHosts(): OwnedSubscription<HostDirectory>;
+    addHost(input: HostAdd): Promise<{
+        registrationId: string;
+        serverId: string | null;
+        label: string | null;
+        source: {
+            id: string;
+            key: string;
+        };
+        metadata: Record<string, string>;
+        enabled: boolean;
+        status: "error" | "connecting" | "disabled" | "online" | "offline";
+        targetDescription: string;
+        lastOnlineAt: string | null;
+        nextRetryAt: string | null;
+        error: {
+            code: string;
+            message: string;
+        } | null;
+    }>;
+    updateHost(registrationId: string, patch: HostUpdate): Promise<{
+        registrationId: string;
+        serverId: string | null;
+        label: string | null;
+        source: {
+            id: string;
+            key: string;
+        };
+        metadata: Record<string, string>;
+        enabled: boolean;
+        status: "error" | "connecting" | "disabled" | "online" | "offline";
+        targetDescription: string;
+        lastOnlineAt: string | null;
+        nextRetryAt: string | null;
+        error: {
+            code: string;
+            message: string;
+        } | null;
+    }>;
+    removeHost(registrationId: string): Promise<void>;
+    openHostRoute(serverId: string, scopeId: string): Promise<string>;
+    openHostLink(channelId: string): Promise<string>;
+    sendHostFrame(routeId: string, data: string | Uint8Array): void;
+    private readonly hostFrameListeners;
+    subscribeHostFrames(handler: (frame: HostRouteFrame) => void): () => void;
+    cancelHostRoute(scopeId: string): void;
+    closeHostRoute(routeId: string): void;
     getConnectionState(): ConnectionState;
     subscribeConnectionStatus(listener: (status: ConnectionState) => void): () => void;
     get isConnected(): boolean;
     get isConnecting(): boolean;
+    /** The relay endpoint security this client requires on its next attempt. */
+    get relaySecurityFloor(): RelaySecurityMode | undefined;
     get lastError(): string | null;
     get authFailureReason(): DaemonAuthFailureReason | null;
     getLastLivenessRttMs(): number | null;
@@ -672,7 +753,9 @@ export declare class DaemonClient {
     private beginTraceSection;
     private endTraceSection;
     private traceInstant;
+    private beginSessionDispatchTrace;
     private sendJsonMessage;
+    private sendSessionPayload;
     private sendTransportFrame;
     /**
      * Send a session message. For fire-and-forget messages (heartbeats, etc.),
@@ -703,6 +786,7 @@ export declare class DaemonClient {
     private sendCorrelatedRequest;
     private sendCorrelatedSessionRequest;
     private sendNamespacedCorrelatedSessionRequest;
+    private unavailableError;
     private sendSessionMessageStrict;
     clearAgentAttention(agentId: string | string[]): Promise<void>;
     clearWorkspaceAttention(workspaceId: string | string[]): Promise<void>;
@@ -825,6 +909,10 @@ export declare class DaemonClient {
         type: "workspace.script.stop.response";
     }>["payload"]>;
     archiveWorkspace(workspaceId: string, requestId?: string): Promise<ArchiveWorkspacePayload>;
+    observeWorkspaceSetup(workspaceId: string, options?: {
+        signal?: AbortSignal;
+    }): OwnedSubscription<CorrelatedResponsePayload<"workspace.setup.subscribe.response">>;
+    private requireWorkspaceSetupObservation;
     fetchWorkspaceSetupStatus(workspaceId: string, requestId?: string): Promise<WorkspaceSetupStatusPayload>;
     runWorkspaceSetup(workspaceId: string, requestId?: string): Promise<Extract<SessionOutboundMessage, {
         type: "workspace.setup.run.response";
@@ -916,8 +1004,12 @@ export declare class DaemonClient {
     }): Promise<SideConversationListPayload>;
     subscribeAgentTimeline(agentId: string, handler: (message: TimelineMessage) => void): TimelineSubscription;
     buildAgentForkContext(agentId: string, options?: AgentForkContextOptions): Promise<AgentForkContextPayload>;
-    sendAgentMessage(agentId: string, text: string, options?: SendMessageOptions): Promise<void>;
-    sendMessage(agentId: string, text: string, options?: SendMessageOptions): Promise<void>;
+    sendAgentMessage(agentId: string, text: string, options?: SendMessageOptions): Promise<{
+        deliveryStatus?: "queued";
+    }>;
+    sendMessage(agentId: string, text: string, options?: SendMessageOptions): Promise<{
+        deliveryStatus?: "queued";
+    }>;
     /**
      * Admits a prompt into the durable queue with an explicit delivery intent.
      * `itemId` comes from the caller so an optimistic local row and the stored
@@ -1015,12 +1107,12 @@ export declare class DaemonClient {
     }): Promise<CheckoutStatusPayload>;
     private normalizeCheckoutDiffCompare;
     getCheckoutDiff(cwd: string, compare: {
-        mode: "uncommitted" | "base";
+        mode: "uncommitted" | "base" | "all";
         baseRef?: string;
         ignoreWhitespace?: boolean;
     }, requestId?: string): Promise<CheckoutDiffPayload>;
     observeCheckoutDiff(cwd: string, compare: {
-        mode: "uncommitted" | "base";
+        mode: "uncommitted" | "base" | "all";
         baseRef?: string;
         ignoreWhitespace?: boolean;
     }, options?: {
@@ -1171,6 +1263,8 @@ export declare class DaemonClient {
         cwd: string;
         path: string;
         content: string;
+        /** `base64` requires `server_info.features.fileByteWrites`. */
+        contentEncoding?: "utf-8" | "base64";
         expectedModifiedAt: string;
         expectedRevision?: string;
     }): Promise<FileWriteResult>;
@@ -1229,7 +1323,7 @@ export declare class DaemonClient {
     connectHub(hubUrl: string, token: string, permissions?: readonly string[], requestId?: string): Promise<{
         requestId: string;
         status: {
-            state: "not_connected" | "connecting" | "connected" | "reconnecting" | "disconnecting" | "revoked";
+            state: "connecting" | "not_connected" | "connected" | "reconnecting" | "disconnecting" | "revoked";
             daemonId: string | null;
             hubOrigin: string | null;
             permissions: ("daemon.read" | "daemon.manage" | "tunnel.manage" | "access.manage" | "workspace.read" | "workspace.write" | "workspace.manage" | "automation.manage" | "hub.execute")[];
@@ -1243,7 +1337,7 @@ export declare class DaemonClient {
     }, requestId?: string): Promise<{
         requestId: string;
         status: {
-            state: "not_connected" | "connecting" | "connected" | "reconnecting" | "disconnecting" | "revoked";
+            state: "connecting" | "not_connected" | "connected" | "reconnecting" | "disconnecting" | "revoked";
             daemonId: string | null;
             hubOrigin: string | null;
             permissions: ("daemon.read" | "daemon.manage" | "tunnel.manage" | "access.manage" | "workspace.read" | "workspace.write" | "workspace.manage" | "automation.manage" | "hub.execute")[];
@@ -1254,7 +1348,7 @@ export declare class DaemonClient {
     getHubStatus(requestId?: string): Promise<{
         requestId: string;
         status: {
-            state: "not_connected" | "connecting" | "connected" | "reconnecting" | "disconnecting" | "revoked";
+            state: "connecting" | "not_connected" | "connected" | "reconnecting" | "disconnecting" | "revoked";
             daemonId: string | null;
             hubOrigin: string | null;
             permissions: ("daemon.read" | "daemon.manage" | "tunnel.manage" | "access.manage" | "workspace.read" | "workspace.write" | "workspace.manage" | "automation.manage" | "hub.execute")[];
@@ -1265,7 +1359,7 @@ export declare class DaemonClient {
     disconnectHub(force?: boolean, requestId?: string): Promise<{
         requestId: string;
         status: {
-            state: "not_connected" | "connecting" | "connected" | "reconnecting" | "disconnecting" | "revoked";
+            state: "connecting" | "not_connected" | "connected" | "reconnecting" | "disconnecting" | "revoked";
             daemonId: string | null;
             hubOrigin: string | null;
             permissions: ("daemon.read" | "daemon.manage" | "tunnel.manage" | "access.manage" | "workspace.read" | "workspace.write" | "workspace.manage" | "automation.manage" | "hub.execute")[];