@canonmsg/agent-sdk 12.3.2 → 12.4.1

package/README.md

@@ -211,16 +211,20 @@ The CLI is `canon-agent run --driver code --module <path> [--profile <name>] [--
 
 ## Encrypted rooms
 
-Dev and Prod require every new room to be end-to-end encrypted (MLS). Without an MLS device an agent takes part in no encrypted room. An agent whose outbound policy is closed cannot send there. The runner holds the agent's MLS device; drivers need nothing for it. Give the runner the operator's MLS configuration: a private JSON file with the custody helper and the environment's issuer and receipt public keys, never private keys or credentials. There is no prebuilt custody helper yet: build it from `mls/native` in the Canon repository. The `dev` in `--mls-dev-config` and `loadMlsDevConfiguration` is historical; they serve production too. `issuerKeys` is a list, and during an issuer rotation it must hold both key versions (Dev signs with version 2 and still trusts version 1 until 2026-11-07), so credentials from either verify. Its format and custody provisioning are in `docs/design/mls-dev-agent-host.md` in the Canon repository:
+Dev and Prod require every new room to be end-to-end encrypted (MLS). Without an MLS device an agent takes part in no encrypted room. An agent whose outbound policy is closed cannot send there. The runner holds the agent's MLS device; drivers need nothing for it.
+
+On macOS (Apple silicon) and Linux (x64 and arm64, glibc 2.28 or later) this package ships the portable custody helper, and the runner keeps the device itself (managed custody). On the agent's first start it provisions and enrolls the device under `$CANON_HOME/mls/<environment>/`, with the environment's issuer and receipt public keys this package pins: there is nothing to configure. Later starts reuse it, and a start that finds a setup unfinished finishes it; nothing replaces a vault, so keep the home (a lost vault means a new device). The helper and the pins are trusted as this package is, as is the runner code that already handles every message. `canon-agent mls --action setup` does the same without starting a model; in library form, pass `mls: managedMlsDevice({ home, environmentId })` to `createRunner`.
+
+Elsewhere (an Intel Mac or musl; Windows is not supported), or to keep the device in custody of your own, give the runner an operator's MLS configuration with `--mls-dev-config`: a private JSON file with the custody helper, built from `mls/native` in the Canon repository, and the environment's issuer and receipt public keys, never private keys or credentials. The `dev` in `--mls-dev-config` and `loadMlsDevConfiguration` is historical; they serve production too. `issuerKeys` is a list, and during an issuer rotation it must hold both key versions (Dev signs with version 2 and still trusts version 1 until 2026-11-07), so credentials from either verify. Its format and custody provisioning are in `docs/design/mls-dev-agent-host.md` in the Canon repository:
 
 ```sh
-canon-agent mls --action status --mls-dev-config /abs/mls-dev.json --profile dev-agent
-canon-agent mls --action enroll --mls-dev-config /abs/mls-dev.json --profile dev-agent
-canon-agent mls --action publish --room <conversation id> --mls-dev-config /abs/mls-dev.json --profile dev-agent
+canon-agent run --driver claude --profile dev-agent
+canon-agent mls --action status --profile dev-agent
+canon-agent mls --action publish --room <conversation id> --profile dev-agent
 canon-agent run --driver claude --mls-dev-config /abs/mls-dev.json --profile dev-agent
 ```
 
-`canon-agent mls` runs one setup step (`status`, `provision` for portable custody, once, `enroll`, `renew`, `publish` a KeyPackage for a room before someone adds the agent, `refresh` a room) on the same home as `run`, so stop the agent first. It prints public device state and never starts a model. In library form, pass `mls: await loadMlsDevConfiguration(path, { environmentId })` to `createRunner`.
+`canon-agent mls` runs one setup step (`status`, `setup` for whatever is left of provision then enroll, `provision` for portable custody, once, `enroll`, `renew`, `publish` a KeyPackage for a room before someone adds the agent, `refresh` a room) on the same home as `run`, so stop the agent first. Each takes `--mls-dev-config` for an operator's custody. It prints public device state and never starts a model. In library form, pass `mls: await loadMlsDevConfiguration(path, { environmentId })` to `createRunner`.
 
 In an encrypted room:
 
@@ -232,18 +236,18 @@ In an encrypted room:
 - A reply is journaled before it is encrypted. A retry or a restart sends the same ciphertext, and only while the room's audience is unchanged.
 - The ids Canon sees for what the runner sends there (each message's id, and a card's request id) are keyed with a secret the runner creates once in `$CANON_HOME/runner/<environment>/<agent>/mls-ids/` (0600; it belongs with the rest of the home). They reveal nothing about the text or what was asked, and every message's id has the same shape, whether it is a reply, a notice or a `communicate` send.
 
-Without `--mls-dev-config` (or `mls`), the runner refuses each encrypted room, logs it once, and runs nothing for it. Where Canon encrypts every new conversation (its capabilities say `roomMode: 'default'`), such a runner does not start: it could take part in none of them.
+Without a device (no helper for the host and no `--mls-dev-config`, or no `mls` for `createRunner`), the runner refuses each encrypted room, logs it once, and runs nothing for it. Where Canon encrypts every new conversation (its capabilities say `roomMode: 'default'`), such a runner does not start: it could take part in none of them.
 
 ### The class-C relay (Canon-operated)
 
 An assistant without an install of its own (ChatGPT, Claude.ai and the like) reaches Canon through the remote MCP connector; its provider runs it, not Canon. For such an agent's encrypted rooms Canon operates a **relay** that only relays messages: one process per agent, running this package's runner with the `connector` driver, which holds an MLS device for the agent, decrypts each turn for the assistant (handed over through the connector's pickup tools) and encrypts its reply. Those rooms are therefore **not end-to-end encrypted** to that agent. Agent developers do not run it; Canon's operator does:
 
 ```sh
-canon-agent run --driver connector --relay-config /abs/relay.json --mls-dev-config /abs/mls-dev.json
-canon-agent mls --action provision --mls-dev-config /abs/mls-dev.json --relay-config /abs/relay.json
+canon-agent run --driver connector --relay-config /abs/relay.json
+canon-agent mls --action status --relay-config /abs/relay.json
 ```
 
-The relay configuration (a private JSON file) names the agent, where the channel to Canon's Functions listens, and the path of the channel secret. No API key is involved: when the owner enables the relay, Canon delivers the relay's own credential over that channel (it works only for the relay's encrypted-room work, and stops when the relay or its connection is revoked), and the relay keeps it in `$CANON_HOME/relay` and starts under the relay installation it names (`canon-relay:…`). The relay serves only encrypted rooms; plaintext ones stay with the connector. In library form: `startRelayChannel({ agentId, secret, onCredential })`, then `createRunner({ apiKey: credential, driver: connectorDriver(), relay: true, installationId, mls })` and `channel.serve({ runner, inbox: driver.inbox }, grantId)`. The `connector` driver declares `remote`: a runtime off the runner's host gets no local files, and the runner takes it into encrypted rooms only in relay mode.
+The relay configuration (a private JSON file) names the agent, where the channel to Canon's Functions listens, and the path of the channel secret. No API key is involved: when the owner enables the relay, Canon delivers the relay's own credential over that channel (it works only for the relay's encrypted-room work, and stops when the relay or its connection is revoked), and the relay keeps it in `$CANON_HOME/relay` and starts under the relay installation it names (`canon-relay:…`), setting up that installation's device as any runner does (or with `--mls-dev-config`). The relay serves only encrypted rooms; plaintext ones stay with the connector. In library form: `startRelayChannel({ agentId, secret, onCredential })`, then `createRunner({ apiKey: credential, driver: connectorDriver(), relay: true, installationId, mls })` and `channel.serve({ runner, inbox: driver.inbox }, grantId)`. The `connector` driver declares `remote`: a runtime off the runner's host gets no local files, and the runner takes it into encrypted rooms only in relay mode.
 
 ## Team rooms
 

package/dist/chunks/{chunk-RFNYPZXD.js → chunk-6PKXASSK.js}

@@ -8,6 +8,7 @@ import {
   MAX_PUBLIC_RUNTIME_COMMANDS,
   MLS_DEV_CREDENTIAL_MAX_BYTES,
   MLS_DEV_CREDENTIAL_RECONCILIATION_MAX_BYTES,
+  MLS_DEV_DISCLOSED_PROCESSING_FIELDS,
   MLS_DEV_ENROLLMENT_MAX_BYTES,
   MLS_DEV_GROUP_RECEIPT_CLOCK_SKEW,
   MLS_DEV_INTERACTION_LIMITS,
@@ -109,7 +110,7 @@ import {
   readMembershipChangeMetadata,
   resolveAllowedUploadMimeType,
   sanitizeDownloadFileName
-} from "./chunk-5MI6Q3VS.js";
+} from "./chunk-GWQF4WFT.js";
 
 // src/media.ts
 import { createWriteStream as createWriteStream2 } from "node:fs";
@@ -2602,6 +2603,8 @@ async function assertMlsDevPlaintextAllowed(tx, intent2, lane = "operation.reque
   }), "failure");
   const action = intent2.action === "verb_execute" ? intent2.body.verb : intent2.action;
   if (typeof action === "string" && MLS_DEV_UNSUPPORTED_CONTENT_ACTIONS.some((unsupported) => unsupported === action)) throw failure2();
+  const disclosed = lane === "operation.request" && Object.hasOwn(MLS_DEV_DISCLOSED_PROCESSING_FIELDS, intent2.action) ? MLS_DEV_DISCLOSED_PROCESSING_FIELDS[intent2.action] : void 0;
+  if (disclosed && !intent2.envelope && Object.keys(intent2.body).every((field) => disclosed.includes(field))) return;
   const payload = lane === "operation.request" ? { body: { encoding: "json", value: intent2.body }, ...intent2.envelope ? { envelope: intent2.envelope } : {} } : intent2.body;
   let boundary;
   try {
@@ -8803,9 +8806,28 @@ function createEndpoint(options) {
   }
   __name(sendDeferredOpeners, "sendDeferredOpeners");
   const stubReads = /* @__PURE__ */ new Map();
+  const stubNames = /* @__PURE__ */ new Map();
   let liveActionCounter = 0;
   const liveActions = /* @__PURE__ */ new Map();
   const stubKey = /* @__PURE__ */ __name((conversationId, messageId) => `${conversationId}\0${messageId}`, "stubKey");
+  function rememberStubName(conversationId, stub) {
+    const name = typeof stub.senderName === "string" ? stub.senderName.trim() : "";
+    if (typeof stub.senderId !== "string" || !stub.senderId || !name || name === stub.senderId || name.length > 80) return;
+    const key2 = stubKey(conversationId, stub.id);
+    stubNames.delete(key2);
+    stubNames.set(key2, { senderId: stub.senderId, name });
+    if (stubNames.size > 1e3) stubNames.delete(stubNames.keys().next().value);
+  }
+  __name(rememberStubName, "rememberStubName");
+  function withStubNames(conversationId, history) {
+    const messages = history.messages;
+    if (!Array.isArray(messages)) return history;
+    return { ...history, messages: messages.map((message) => {
+      const named = typeof message.id === "string" ? stubNames.get(stubKey(conversationId, message.id)) : void 0;
+      return named && named.senderId === message.senderId ? { ...message, senderName: named.name } : message;
+    }) };
+  }
+  __name(withStubNames, "withStubNames");
   function forgetStubReads(conversationId) {
     for (const key2 of stubReads.keys()) if (key2.startsWith(`${conversationId}\0`)) stubReads.delete(key2);
   }
@@ -8823,6 +8845,7 @@ function createEndpoint(options) {
     } catch {
       return false;
     }
+    for (const stub of stubs) if (typeof stub.id === "string" && due.includes(stub.id)) rememberStubName(conversationId, { ...stub, id: stub.id });
     return store.transaction(async (tx) => {
       let changed = false;
       for (const stub of stubs) {
@@ -9667,7 +9690,7 @@ function createEndpoint(options) {
             const room = normalized.conversationId, read = /* @__PURE__ */ __name(() => mlsDevGroups.queryTextHistory(room, name, normalized), "read");
             const history = await read();
             const shown = (history.messages ?? []).map((entry) => entry.id).filter((id2) => typeof id2 === "string");
-            return await recoverMlsDevMessageActions(room, shown) ? await read() : history;
+            return withStubNames(room, await recoverMlsDevMessageActions(room, shown) ? await read() : history);
           }
         }
         if (name === "get_runtime_card_state" && await mlsDevInteractionRoom(normalized.conversationId, false)) {
@@ -10096,7 +10119,7 @@ async function acquireAgentEndpoint(input) {
   }
   const requestedMls = input.options.mlsDev;
   const mls = requestedMls ? await (async () => {
-    const crypto2 = await import("./mls-crypto-D5YAGYJ3.js");
+    const crypto2 = await import("./mls-crypto-LGPCXM3K.js");
     const configuration = crypto2.parseMlsDevClientConfiguration(requestedMls.configuration);
     if (configuration.environmentId !== environmentId || baseUrl !== CANON_RUNTIME_ENDPOINT_DEFAULTS[configuration.environmentId]?.apiBaseUrl || configuration.principalIds && !configuration.principalIds.includes(input.principalId) || !Number.isSafeInteger(input.ownershipVersion) || input.ownershipVersion < 0) throw new Error("MLS_DEV_AGENT_CONFIGURATION_BINDING_MISMATCH");
     const custody = requestedMls.custody;
@@ -14097,6 +14120,7 @@ function getCodexImagePath(attachment) {
 __name(getCodexImagePath, "getCodexImagePath");
 
 export {
+  NodeMlsDevCustodyError,
   createNodeMlsDevCustody,
   createPortableNodeMlsDevCustody,
   resolveCanonRuntimeConnection,

package/dist/chunks/{chunk-5MI6Q3VS.js → chunk-GWQF4WFT.js}

@@ -4065,6 +4065,9 @@ __name(normalizePublicRuntimeFacts, "normalizePublicRuntimeFacts");
 
 // ../backend-contracts/src/endpointContentPolicy.ts
 var MLS_DEV_UNSUPPORTED_CONTENT_ACTIONS = ["forward_message"];
+var MLS_DEV_DISCLOSED_PROCESSING_FIELDS = {
+  generate_image: ["conversationId", "requestId", "prompt", "sourceUploadId"]
+};
 var ENDPOINT_CONTENT_ACTIONS = [
   "mls_application",
   "mls_group_control",
@@ -5381,6 +5384,7 @@ export {
   normalizePublicRuntimeDescriptor,
   normalizePublicRuntimeFacts,
   MLS_DEV_UNSUPPORTED_CONTENT_ACTIONS,
+  MLS_DEV_DISCLOSED_PROCESSING_FIELDS,
   endpointOperationRequestRetention,
   endpointContentBoundary,
   canonicalEndpointJson,

package/dist/chunks/{chunk-JCBQCO3F.js → chunk-NXL4C2R6.js}

@@ -3,6 +3,7 @@ import {
   BoundedFileReadError,
   CanonClient,
   MAX_CANON_MEDIA_BYTES,
+  NodeMlsDevCustodyError,
   RUNTIME_NEW_SESSION_ACTION,
   RUNTIME_STOP_ACTION,
   RUNTIME_STOP_AND_DROP_ACTION,
@@ -29,7 +30,7 @@ import {
   sendMessageWithRetryChunked,
   splitTextByUtf8Bytes,
   verifyCanonRuntimeConnection
-} from "./chunk-RFNYPZXD.js";
+} from "./chunk-6PKXASSK.js";
 import {
   CONNECTOR_RELAY_ANSWER_WITHIN_MS,
   CONNECTOR_RELAY_INSTALLATION_PATTERN,
@@ -58,7 +59,7 @@ import {
   parseMlsDevGroupHead,
   parseMlsDevGroupRoster,
   resolveAllowedUploadMimeType
-} from "./chunk-5MI6Q3VS.js";
+} from "./chunk-GWQF4WFT.js";
 
 // src/runner/types.ts
 var DriverSessionError = class extends Error {
@@ -464,6 +465,8 @@ var GUEST_ITEMS = /* @__PURE__ */ new Set([
   "subAgentActivity",
   "sleep"
 ]);
+var OWN_LISTINGS = /* @__PURE__ */ new Set(["list_mcp_resources", "list_mcp_resource_templates"]);
+var GUEST = "Only your owner can let you use tools in this conversation, and this turn holds a message from someone else: you cannot read files, run commands or use any tool but the canon MCP server's. Answer from the conversation and what you already know, and say so when something needs your owner.";
 var RISKY = /\brm\s+-[a-z]*[rf]|\bgit\s+(reset\s+--hard|push\s+(-f|--force))|\bdrop\s+(table|database)\b|\bmkfs\b|\bdd\s+if=/i;
 var IMAGE = /\.(png|jpe?g|gif|webp)$/i;
 var isRecord2 = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isRecord");
@@ -750,10 +753,11 @@ function codexDriver(options) {
           settle(new Error(`Codex ended the turn ${ended.status === "interrupted" ? "interrupted" : `with an error${detail ? `: ${oneLine2(detail, 300)}` : ""}`}`));
         }, "conclude");
         const guard = /* @__PURE__ */ __name((item) => {
-          if (!guest || GUEST_ITEMS.has(text(item.type)) || item.type === "mcpToolCall" && item.server === CANON) return;
+          if (!guest || GUEST_ITEMS.has(text(item.type)) || item.type === "mcpToolCall" && (item.server === CANON || item.server === "codex" && OWN_LISTINGS.has(text(item.tool)))) return;
           interrupt();
           entry.close();
-          settle(new DriverSessionError(`Codex started ${text(item.type) || "an unknown item"} in a turn holding someone other than the owner's message`));
+          const what = item.type === "mcpToolCall" ? `mcpToolCall (${describe(item)})` : text(item.type) || "an unknown item";
+          settle(new DriverSessionError(`Codex started ${what} in a turn holding someone other than the owner's message`));
         }, "guard");
         const link = rpc(child, {
           notify(method, params) {
@@ -813,6 +817,7 @@ function codexDriver(options) {
           }
           if (turn.signal.aborted) return finish();
           const started = await link.call("turn/start", { threadId, input: [
+            ...guest ? [{ type: "text", text: GUEST, text_elements: [] }] : [],
             { type: "text", text: turn.prompt, text_elements: [] },
             // Images go to the model as images; every attachment's path is also in the prompt for Codex to read.
             ...turn.files.filter((file) => IMAGE.test(file)).map((path) => ({ type: "localImage", path }))
@@ -1485,7 +1490,7 @@ async function loadMlsDevConfiguration(filePath, input) {
   return { configuration, custody: custody2, close: /* @__PURE__ */ __name(() => custody2.close(), "close") };
 }
 __name(loadMlsDevConfiguration, "loadMlsDevConfiguration");
-var MLS_SETUP_ACTIONS = ["status", "provision", "enroll", "renew", "publish", "refresh"];
+var MLS_SETUP_ACTIONS = ["status", "setup", "provision", "enroll", "renew", "publish", "refresh"];
 function mlsDevRoomPackageId(identity, room) {
   const hex = createHash4("sha256").update(JSON.stringify([
     "canon.mls.dev-agent-room-package.v1",
@@ -1498,25 +1503,37 @@ function mlsDevRoomPackageId(identity, room) {
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-8${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
 }
 __name(mlsDevRoomPackageId, "mlsDevRoomPackageId");
-async function runMlsDevSetup(endpoint, action, room, provision) {
+async function runMlsDevSetup(endpoint, action, room, provision, provisioned) {
   const identity = await endpoint.ready();
-  if (!isMlsEnvironmentId(identity.environmentId) || !endpoint.mlsDevDevice || !endpoint.mlsDevKeyPackages || !endpoint.mlsDevGroups) throw new Error("MLS_DEV_SETUP_UNAVAILABLE");
+  const { environmentId } = identity, devices = endpoint.mlsDevDevice;
+  if (!isMlsEnvironmentId(environmentId) || !devices || !endpoint.mlsDevKeyPackages || !endpoint.mlsDevGroups) throw new Error("MLS_DEV_SETUP_UNAVAILABLE");
   if ((action === "publish" || action === "refresh") !== !!room) throw new Error("MLS_DEV_SETUP_ARGUMENTS_INVALID");
-  if (action === "provision") {
+  const enroll = /* @__PURE__ */ __name(async () => {
+    await devices.enroll();
+    if ((await devices.read()).status !== "credential_committed") await devices.renew();
+  }, "enroll");
+  const provisionDevice = /* @__PURE__ */ __name(async (unlessProvisioned) => {
     if (!provision || identity.ownershipVersion === void 0) throw new Error("MLS_DEV_SETUP_UNAVAILABLE");
-    const device2 = await endpoint.mlsDevDevice.read();
+    const device2 = await devices.read();
     if (device2.registration || device2.status !== "absent") throw new Error("MLS_DEV_SETUP_ALREADY_PROVISIONED");
-    await provision({
+    const context = {
       version: 1,
-      environmentId: identity.environmentId,
+      environmentId,
       installationId: identity.installationId,
       principal: { type: "ai_agent", id: await endpoint.mlsPrincipalId(), ownershipVersion: identity.ownershipVersion },
       revision: 0
-    });
-  } else if (action === "enroll") {
-    await endpoint.mlsDevDevice.enroll();
-    if ((await endpoint.mlsDevDevice.read()).status !== "credential_committed") await endpoint.mlsDevDevice.renew();
-  } else if (action === "renew") await endpoint.mlsDevDevice.renew();
+    };
+    if (!unlessProvisioned || !provisioned?.(context)) await provision(context);
+  }, "provisionDevice");
+  if (action === "setup") {
+    const { status } = await devices.read();
+    if (status === "revoked") throw new Error("MLS_DEV_SETUP_REVOKED");
+    if (status === "absent") await provisionDevice(true);
+    if (status === "registered") await devices.ensureReady();
+    else if (status !== "credential_committed") await enroll();
+  } else if (action === "provision") await provisionDevice(false);
+  else if (action === "enroll") await enroll();
+  else if (action === "renew") await devices.renew();
   else if (action === "publish") {
     const keyPackageId = mlsDevRoomPackageId(identity, room);
     await endpoint.mlsDevKeyPackages.prepare({ keyPackageId });
@@ -1525,7 +1542,7 @@ async function runMlsDevSetup(endpoint, action, room, provision) {
     const group = await endpoint.mlsDevGroups.refresh(room);
     if (group?.status !== "active" || await endpoint.mlsDevGroups.readRecoveryFailure(room)) throw new Error("MLS_DEV_SETUP_ROOM_NOT_READY");
   }
-  const device = await endpoint.mlsDevDevice.read();
+  const device = await devices.read();
   return {
     version: 1,
     action,
@@ -1541,12 +1558,238 @@ async function runMlsDevSetup(endpoint, action, room, provision) {
 }
 __name(runMlsDevSetup, "runMlsDevSetup");
 
+// src/runner/mls-bundled.ts
+import { createHash as createHash5 } from "node:crypto";
+import { existsSync, readFileSync as readFileSync2 } from "node:fs";
+import { dirname as dirname4, join as join2 } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// mls-custody.json
+var mls_custody_default = {
+  schemaVersion: 1,
+  release: "mls-custody-cadb937436ce",
+  protocolVersion: 1,
+  rustVersion: "rustc 1.91.0 (f8297e351 2025-10-28)",
+  sourceHashes: {
+    "mls/native/Cargo.toml": "f93b48329951d5a11ef6d5830ff7c375cb847543bdb1c98a6fd8a8d02026db89",
+    "mls/native/Cargo.lock": "9c2e9a3bb0f79c14540942c091124cba4aa262ee14cef2cdd5490653cd4656f3",
+    "mls/native/src/lib.rs": "8e586bfaedc5fe376febbda78c32f8383aaa2ac92868000dd4c84ca083731571",
+    "mls/native/src/bin/canon-mls-custody.rs": "3ab54102bfe315e425b6c3cf0aa7feb66e44d047e135336b0291305507062459",
+    "mls/native/src/portable/mod.rs": "3005b60f7777a841347421ad96eb631b72063e85cebe96afd1c11fef095b0e34",
+    "mls/native/src/portable/json.rs": "d4e68556a051ffe9008686036597b1fd8239ae66fad67bd848c3f0e16bf8ccaf",
+    "mls/native/src/portable/vault.rs": "14b9ff1e10ec4058e39a46511a489c7e82a9836e4175a768ac5d4b69c1dba8e5",
+    "mls/native/src/portable/tests.rs": "7eadba2a49ed044470bb567d9b93fba44b64dc117b1da50a22187cff3dccb64e",
+    "mls/native/portable/build.mjs": "84c422a8a8aa6a7ec112a358bdeef080201aa4ea9a91f6d5726b05f46fa2a10c",
+    "mls/core/open.rs": "8cdc03882f3b84dca72ab06afd437f162de01a0fe21327b019f17867dd59f5d0",
+    "mls/core/protocol.rs": "7f3e021d6e4f1cc130b5dd3c98e0b0fa23edf813c72802c3fa3f8fb9e431c947",
+    "mls/core/fault_storage.rs": "fdd6672a21f6ffee657142755637824541a5090b4f8a5fb4902f482556fb2793",
+    "mls/core/mls_environment.rs": "390d11ee82ef8b108a7fffc7bb193ac7f3e470aa14e9643d029007aaaa29c4e4",
+    "mls/core/dev_identity.rs": "97df6bdb9daab66f0e3d4ca3b49bf9954fa06ac032c927d9ae6c83509b0166bd",
+    "mls/core/dev_key_package.rs": "3e7011fe8ab3044d80d84d04944068dbcf683141fcaba8a7a00bd2cfd103de72",
+    "mls/core/dev_application.rs": "fafe245ace38e384da265bab2c12fef6b77c86b2c20477d00563ab891a54f94b",
+    "mls/core/dev_group.rs": "1d519a5d15394bbc163aef00e0ddacb9bb87631beaf8a13e52c76d628749152b",
+    "packages/test-fixtures/src/mlsDevEnrollmentProofV1.json": "50d7896e0a3a25b420412e84484e64f1e49480a3f298ee2d125f2f9188382810",
+    "packages/test-fixtures/src/mlsDevCredentialV1.json": "24cd23af794b8a6e35caf050995020c6584b806de060969db4536f44b1188780",
+    "packages/test-fixtures/src/mlsDevCredentialReconciliationV1.json": "bd4bbb3a2e5dc7921867a2e5936d1da77d536740b4360012c1f741f9caed2826",
+    "packages/test-fixtures/src/mlsDevGroupV1.json": "10b7c0da00cfd3ecfb3c9e7f0118bc574be613cc82d97268766ba271c464ca9d",
+    "packages/test-fixtures/src/mlsDevApplicationV1.json": "77c05e728acb7793a70c03a6857bc8b0e522e586b117241432460eec05ae3673",
+    "packages/test-fixtures/src/mlsDevInteractionV1.json": "045ee34e1b5e126b67da94705b3f03a1d265774d7889ec3f4f272dd06ecef676"
+  },
+  platforms: {
+    "darwin-arm64": {
+      target: "aarch64-apple-darwin",
+      sha256: "918ae350f1d7bd339c4eee548f6668943217f5fa66022bb93f41a02992dd296c",
+      bytes: 2932976,
+      unitTestsPassed: 95,
+      commit: "cdc6ce8fd9d7a47bc5c796d19a72828e4cc9db06",
+      builder: {
+        macos: "26.3.1",
+        sdk: "26.4",
+        linker: "@(#)PROGRAM:ld PROJECT:ld-1266.8"
+      }
+    },
+    "linux-x64": {
+      target: "x86_64-unknown-linux-gnu",
+      sha256: "1c5a12d0213c53bdf59b5f36a7390a4b4c17f8a53c95e760ad8cb4905297d256",
+      bytes: 3389816,
+      unitTestsPassed: 95,
+      commit: "cdc6ce8fd9d7a47bc5c796d19a72828e4cc9db06",
+      builder: {
+        image: "quay.io/pypa/manylinux_2_28_x86_64@sha256:e0adf18521ad35192df733a6c62d35df7801957d24e0470238aacecfab2188a3",
+        dockerfileSha256: "fe8d4895b8bd304954441fd27c6273c8c00baa10a1ad912d3c3851b193b8ad75"
+      }
+    },
+    "linux-arm64": {
+      target: "aarch64-unknown-linux-gnu",
+      sha256: "371c5754cf0c437f561e8c49b3ea654c037311b951e11b1c5a29fb6b91656619",
+      bytes: 3234232,
+      unitTestsPassed: 95,
+      commit: "cdc6ce8fd9d7a47bc5c796d19a72828e4cc9db06",
+      builder: {
+        image: "quay.io/pypa/manylinux_2_28_aarch64@sha256:a3e02308c822fb6ce0d12248b0c941817ba5e1a1bc9e7bb5929f29c50eaa40a9",
+        dockerfileSha256: "fe8d4895b8bd304954441fd27c6273c8c00baa10a1ad912d3c3851b193b8ad75"
+      }
+    }
+  }
+};
+
+// src/runner/mls-bundled.ts
+var MLS_ENVIRONMENT_PINS = {
+  "canon-prod-v1": {
+    issuerKeys: [{
+      keyVersion: "projects/canonmail-prod/locations/europe-west1/keyRings/canon-mls/cryptoKeys/device-issuer/cryptoKeyVersions/1",
+      signaturePublicKey: "AYLEqY7gKOhQvRALb-31lz82XinehW2_gl0jKC-G8Pk"
+    }],
+    receiptKeys: [{
+      keyVersion: "projects/canonmail-prod/locations/europe-west1/keyRings/canon-mls/cryptoKeys/feed-receipt/cryptoKeyVersions/1",
+      signaturePublicKey: "sRi4mvMbFTL-LKzXilIJedefSqtqrF8Q-deM2AUSt40"
+    }]
+  },
+  "canon-dev-v1": {
+    // Dev signs with version 2 and still trusts version 1 until 2026-11-07.
+    issuerKeys: [
+      {
+        keyVersion: "projects/canonmail-dev/locations/europe-west1/keyRings/canon-mls/cryptoKeys/device-issuer/cryptoKeyVersions/1",
+        signaturePublicKey: "Hm1ULJGsF9MIQbHYIWmpkK3j2dPcFzeJ71xbYVsPZNs"
+      },
+      {
+        keyVersion: "projects/canonmail-dev/locations/europe-west1/keyRings/canon-mls/cryptoKeys/device-issuer/cryptoKeyVersions/2",
+        signaturePublicKey: "G2fwJdPQXP6Ar68LJveXQ_WAOtdtcsiyKdeEVb-9Gcw"
+      }
+    ],
+    receiptKeys: [{
+      keyVersion: "projects/canonmail-dev/locations/europe-west1/keyRings/canon-mls/cryptoKeys/feed-receipt/cryptoKeyVersions/1",
+      signaturePublicKey: "LSRMjRHH73Q4ExPFSTaU_KTvr8wQ4Cp9vtaBBrVZvig"
+    }]
+  }
+};
+function packageRoot() {
+  for (let directory = dirname4(fileURLToPath(import.meta.url)); ; directory = dirname4(directory)) {
+    const manifest = join2(directory, "package.json");
+    if (existsSync(manifest) && JSON.parse(readFileSync2(manifest, "utf8")).name === "@canonmsg/agent-sdk") return directory;
+    if (dirname4(directory) === directory) return void 0;
+  }
+}
+__name(packageRoot, "packageRoot");
+function bundledMlsCustodyHelper() {
+  const platform = `${process.platform}-${process.arch}`;
+  const pin = mls_custody_default.platforms[platform];
+  const root = pin && packageRoot();
+  const path = root && join2(root, "dist", "mls", platform, "canon-mls-custody");
+  if (!pin || !path || !existsSync(path)) return void 0;
+  if (createHash5("sha256").update(readFileSync2(path)).digest("hex") !== pin.sha256) {
+    throw new Error(`${path} is not the custody helper this package pins; reinstall @canonmsg/agent-sdk.`);
+  }
+  return { path, sha256: pin.sha256 };
+}
+__name(bundledMlsCustodyHelper, "bundledMlsCustodyHelper");
+
+// src/runner/mls-managed.ts
+import { createHash as createHash6 } from "node:crypto";
+import { chmodSync, copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync3, renameSync as renameSync2 } from "node:fs";
+import { dirname as dirname5, join as join3 } from "node:path";
+var sha256 = /* @__PURE__ */ __name((bytes) => createHash6("sha256").update(bytes).digest("hex"), "sha256");
+function managedMlsDevice(options) {
+  const { environmentId } = options;
+  const helper = options.helper ?? bundledMlsCustodyHelper();
+  if (!helper) {
+    throw new Error(`@canonmsg/agent-sdk ships no MLS custody helper for ${process.platform}-${process.arch}: build one from mls/native in the Canon repository and give the runner --mls-dev-config <path> (docs/design/mls-dev-agent-host.md).`);
+  }
+  const pins = options.pins ?? MLS_ENVIRONMENT_PINS[environmentId];
+  const configuration = parseMlsDevClientConfiguration({
+    version: 1,
+    environmentId,
+    enabled: true,
+    issuerKeys: pins.issuerKeys,
+    receiptKeys: pins.receiptKeys
+  });
+  const root = join3(options.home, "mls", environmentId);
+  const directory = /* @__PURE__ */ __name((context) => join3(root, sha256(Buffer.from(JSON.stringify([
+    context.installationId,
+    context.principal.type,
+    context.principal.id,
+    "ownershipVersion" in context.principal ? context.principal.ownershipVersion : null
+  ]))).slice(0, 32)), "directory");
+  const vault = /* @__PURE__ */ __name((context) => join3(directory(context), "vault", "vault.bin"), "vault");
+  let executable;
+  function install() {
+    const target = join3(root, "bin", helper.sha256, "canon-mls-custody");
+    if (existsSync2(target) && sha256(readFileSync3(target)) === helper.sha256) return target;
+    mkdirSync3(dirname5(target), { recursive: true, mode: 448 });
+    const temporary = `${target}.${process.pid}.tmp`;
+    copyFileSync(helper.path, temporary);
+    chmodSync(temporary, 448);
+    if (sha256(readFileSync3(temporary)) !== helper.sha256) throw new Error(`${helper.path} is not the pinned custody helper`);
+    renameSync2(temporary, target);
+    return target;
+  }
+  __name(install, "install");
+  const devices = /* @__PURE__ */ new Map();
+  function device(context, provisioning) {
+    const key = directory(context);
+    let found = devices.get(key);
+    if (!found) {
+      found = (async () => {
+        if (!provisioning && !existsSync2(vault(context))) throw new NodeMlsDevCustodyError();
+        mkdirSync3(dirname5(vault(context)), { recursive: true, mode: 448 });
+        const unlock = join3(key, "unlock");
+        if (provisioning) privateKey(unlock, 32);
+        const text3 = `${JSON.stringify({
+          version: 1,
+          environmentId,
+          context: {
+            version: 1,
+            environmentId: context.environmentId,
+            principal: context.principal,
+            installationId: context.installationId
+          },
+          vaultPath: vault(context),
+          issuerKeys: configuration.issuerKeys,
+          receiptKeys: configuration.receiptKeys
+        }, null, 2)}
+`;
+        const file = join3(key, "native.json");
+        if (!existsSync2(file) || readFileSync3(file, "utf8") !== text3) writeDurable(file, text3);
+        return createPortableNodeMlsDevCustody({
+          executablePath: executable ??= install(),
+          executableSha256: helper.sha256,
+          configurationPath: file,
+          configurationSha256: sha256(Buffer.from(text3)),
+          secretSource: { kind: "managed-file", path: unlock },
+          ...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs }
+        });
+      })();
+      devices.set(key, found);
+      found.catch(() => {
+        if (devices.get(key) === found) devices.delete(key);
+      });
+    }
+    return found;
+  }
+  __name(device, "device");
+  const custody2 = {
+    prepareProtected: /* @__PURE__ */ __name((context, ...rest) => device(context, false).then((open4) => open4.prepareProtected(context, ...rest)), "prepareProtected"),
+    prepareProtectedKeyPackage: /* @__PURE__ */ __name((context, ...rest) => device(context, false).then((open4) => open4.prepareProtectedKeyPackage(context, ...rest)), "prepareProtectedKeyPackage"),
+    prepareProtectedGroup: /* @__PURE__ */ __name((identity, ...rest) => device(identity, false).then((open4) => open4.prepareProtectedGroup(identity, ...rest)), "prepareProtectedGroup")
+  };
+  return {
+    configuration,
+    custody: custody2,
+    provision: /* @__PURE__ */ __name((context) => device(context, true).then((open4) => open4.provision(context)), "provision"),
+    provisioned: /* @__PURE__ */ __name((context) => existsSync2(vault(context)), "provisioned"),
+    async close() {
+      await Promise.allSettled([...devices.values()].map((open4) => open4.then((custody3) => custody3.close())));
+    }
+  };
+}
+__name(managedMlsDevice, "managedMlsDevice");
+
 // src/runner/relay.ts
 import { createHmac as createHmac2, timingSafeEqual } from "node:crypto";
-import { closeSync as closeSync3, constants as constants5, fsyncSync as fsyncSync2, mkdirSync as mkdirSync3, openSync as openSync3, renameSync as renameSync2, writeSync as writeSync2 } from "node:fs";
+import { closeSync as closeSync3, constants as constants5, fsyncSync as fsyncSync2, mkdirSync as mkdirSync4, openSync as openSync3, renameSync as renameSync3, writeSync as writeSync2 } from "node:fs";
 import { lstat as lstat2, open as open3, realpath as realpath4 } from "node:fs/promises";
 import { createServer } from "node:http";
-import { isAbsolute as isAbsolute2, join as join2, resolve as resolve2 } from "node:path";
+import { isAbsolute as isAbsolute2, join as join4, resolve as resolve2 } from "node:path";
 var TOLERANCE_S = 300;
 function relaySecretKey(secret) {
   if (typeof secret !== "string" || !/^whsec_[A-Za-z0-9+/]+={0,2}$/.test(secret)) throw new Error("The relay channel secret must be a whsec_ value");
@@ -1715,8 +1958,8 @@ async function loadRelayConfiguration(path, input) {
   return { environmentId: value.environmentId, agentId: value.agentId, listen: { host: listen.host, port: listen.port }, secret };
 }
 __name(loadRelayConfiguration, "loadRelayConfiguration");
-var relayDirectory = /* @__PURE__ */ __name((home) => join2(home, "relay"), "relayDirectory");
-var credentialFile = /* @__PURE__ */ __name((home) => join2(relayDirectory(home), "credential.json"), "credentialFile");
+var relayDirectory = /* @__PURE__ */ __name((home) => join4(home, "relay"), "relayDirectory");
+var credentialFile = /* @__PURE__ */ __name((home) => join4(relayDirectory(home), "credential.json"), "credentialFile");
 async function readRelayCredential(home, relay) {
   const path = credentialFile(home);
   if (!await lstat2(path).then(() => true, () => false)) return void 0;
@@ -1742,7 +1985,7 @@ function writeRelayCredential(home, relay, delivery) {
     generation: delivery.generation,
     credential: delivery.credential
   };
-  mkdirSync3(relayDirectory(home), { recursive: true, mode: 448 });
+  mkdirSync4(relayDirectory(home), { recursive: true, mode: 448 });
   const file = credentialFile(home);
   const temporary = `${file}.${process.pid}.tmp`;
   const fd = openSync3(temporary, "w", 384);
@@ -1752,23 +1995,23 @@ function writeRelayCredential(home, relay, delivery) {
   } finally {
     closeSync3(fd);
   }
-  renameSync2(temporary, file);
+  renameSync3(temporary, file);
   return value;
 }
 __name(writeRelayCredential, "writeRelayCredential");
 function relayRunnerHome(home, installationId) {
   if (!CONNECTOR_RELAY_INSTALLATION_PATTERN.test(installationId)) throw new Error("Invalid relay installation");
-  const directory = join2(relayDirectory(home), installationId.slice(CONNECTOR_RELAY_INSTALLATION_PREFIX.length));
-  mkdirSync3(directory, { recursive: true, mode: 448 });
+  const directory = join4(relayDirectory(home), installationId.slice(CONNECTOR_RELAY_INSTALLATION_PREFIX.length));
+  mkdirSync4(directory, { recursive: true, mode: 448 });
   return directory;
 }
 __name(relayRunnerHome, "relayRunnerHome");
 
 // src/runner/runner.ts
-import { createHash as createHash6 } from "node:crypto";
-import { readFileSync as readFileSync3, rmSync as rmSync3 } from "node:fs";
+import { createHash as createHash8 } from "node:crypto";
+import { readFileSync as readFileSync5, rmSync as rmSync3 } from "node:fs";
 import { realpath as realpath5, stat as stat2 } from "node:fs/promises";
-import { basename as basename3, isAbsolute as isAbsolute3, join as join4, sep } from "node:path";
+import { basename as basename3, isAbsolute as isAbsolute3, join as join6, sep } from "node:path";
 
 // ../agent-tools/src/communication-tool.ts
 var CANON_COMMUNICATE_TOOL_NAME = "communicate";
@@ -2262,10 +2505,10 @@ function createLivePublisher(options) {
 __name(createLivePublisher, "createLivePublisher");
 
 // src/runner/mls-ask.ts
-import { createHash as createHash5 } from "node:crypto";
-import { readdirSync as readdirSync2, readFileSync as readFileSync2, rmSync as rmSync2 } from "node:fs";
-import { join as join3 } from "node:path";
-var sha256 = /* @__PURE__ */ __name((value) => createHash5("sha256").update(value).digest("hex"), "sha256");
+import { createHash as createHash7 } from "node:crypto";
+import { readdirSync as readdirSync2, readFileSync as readFileSync4, rmSync as rmSync2 } from "node:fs";
+import { join as join5 } from "node:path";
+var sha2562 = /* @__PURE__ */ __name((value) => createHash7("sha256").update(value).digest("hex"), "sha256");
 var pause = /* @__PURE__ */ __name((ms) => new Promise((resolve3) => {
   setTimeout(resolve3, ms).unref?.();
 }), "pause");
@@ -2319,10 +2562,10 @@ function createMlsAsks(options, approvalScope2) {
       });
     }
   });
-  const file = /* @__PURE__ */ __name((conversationId, requestId) => join3(options.directory, `${sha256(JSON.stringify([conversationId, requestId])).slice(0, 32)}.json`), "file");
+  const file = /* @__PURE__ */ __name((conversationId, requestId) => join5(options.directory, `${sha2562(JSON.stringify([conversationId, requestId])).slice(0, 32)}.json`), "file");
   const save = /* @__PURE__ */ __name((journal) => writeDurable(file(journal.conversationId, journal.requestId), JSON.stringify(journal)), "save");
   const forget = /* @__PURE__ */ __name((journal) => rmSync2(file(journal.conversationId, journal.requestId), { force: true }), "forget");
-  const operationOf = /* @__PURE__ */ __name((conversationId, messageId) => `runner-mls-ask:${sha256(JSON.stringify([conversationId, messageId])).slice(0, 48)}`, "operationOf");
+  const operationOf = /* @__PURE__ */ __name((conversationId, messageId) => `runner-mls-ask:${sha2562(JSON.stringify([conversationId, messageId])).slice(0, 48)}`, "operationOf");
   const withdrawalOf = /* @__PURE__ */ __name((journal) => operationOf(journal.conversationId, `${journal.requestId}:withdraw`), "withdrawalOf");
   const audienceChanged = /* @__PURE__ */ __name((error) => codeOf(error) === "MLS_DEV_AUDIENCE_CHANGED", "audienceChanged");
   const sameHead = /* @__PURE__ */ __name((a, b) => JSON.stringify(a.head) === JSON.stringify(b.head), "sameHead");
@@ -2663,11 +2906,11 @@ function createMlsAsks(options, approvalScope2) {
       for (const name of names) {
         let journal;
         try {
-          journal = JSON.parse(readFileSync2(join3(options.directory, name), "utf8"));
+          journal = JSON.parse(readFileSync4(join5(options.directory, name), "utf8"));
           if (journal.version !== 1 || typeof journal.conversationId !== "string" || typeof journal.requestId !== "string" || !Array.isArray(journal.sends) || journal.sends.some((sent) => typeof sent?.operationId !== "string" || typeof sent.messageId !== "string")) throw new Error();
           for (const sent of journal.sends) sent.audience = snapshotMlsAudience(sent.audience);
         } catch {
-          rmSync2(join3(options.directory, name), { force: true });
+          rmSync2(join5(options.directory, name), { force: true });
           continue;
         }
         try {
@@ -2825,7 +3068,7 @@ function answerText(answer) {
   return answer.text?.trim() ? answer.text : "They answered with an empty message.";
 }
 __name(answerText, "answerText");
-var sha2562 = /* @__PURE__ */ __name((value) => createHash6("sha256").update(value).digest("hex"), "sha256");
+var sha2563 = /* @__PURE__ */ __name((value) => createHash8("sha256").update(value).digest("hex"), "sha256");
 var toolText = /* @__PURE__ */ __name((text3, isError = false) => ({ content: [{ type: "text", text: text3 }], ...isError ? { isError } : {} }), "toolText");
 var turnEnded2 = /* @__PURE__ */ __name(() => new DOMException("This turn has ended", "AbortError"), "turnEnded");
 function within(promise, ms) {
@@ -2841,9 +3084,10 @@ var pause2 = /* @__PURE__ */ __name((ms) => new Promise((resolve3) => {
 }), "pause");
 var audienceOf = /* @__PURE__ */ __name((room) => room?.memberIds ? { memberIds: [...room.memberIds], ...typeof room.membershipRevision === "number" ? { membershipRevision: room.membershipRevision } : {} } : null, "audienceOf");
 var inert = /* @__PURE__ */ __name((value) => value.replace(/\s+/g, " ").trim(), "inert");
+var OWNER_MARK = " [your owner]";
 var TRUSTED_MARK = " [trusted teammate agent]";
 var speaker = /* @__PURE__ */ __name((name) => inert(name).replace(/\[/g, "(").replace(/\]/g, ")"), "speaker");
-var defused = /* @__PURE__ */ __name((text3) => text3.replace(/\[(\s*trusted\s+teammate\s+agent\s*)\]/gi, "($1)").replace(/\[(\s*(?:end\s+of\s+)?owner['\u2019]s\s+(?:private\s+note|errand)\s*)\]/gi, "($1)"), "defused");
+var defused = /* @__PURE__ */ __name((text3) => text3.replace(/\[(\s*(?:trusted\s+teammate\s+agent|your\s+owner)\s*)\]/gi, "($1)").replace(/\[(\s*(?:end\s+of\s+)?owner['\u2019]s\s+(?:private\s+note|errand)\s*)\]/gi, "($1)"), "defused");
 var NOTE_OPEN = "[owner's private note] Your owner left this for you on the machine you run on. It is not a message in this conversation: no one in it sees it, and it was not posted.";
 var NOTE_CLOSE = "[end of owner's private note]";
 var ERRAND_OPEN = "[owner's errand]";
@@ -2858,8 +3102,8 @@ var errandCommunicate = /* @__PURE__ */ __name((contact) => ({
     properties: { action: { const: "start_conversation" }, principalId: { type: "string", minLength: 1 }, text: { type: "string", minLength: 1 } }
   }] : []] }
 }), "errandCommunicate");
-var promptLine = /* @__PURE__ */ __name((message2, name, media, trusted = false) => [
-  `${speaker(name)}${trusted ? TRUSTED_MARK : ""}: ${defused(renderCanonHostInboundContent(message2, media?.files))}`,
+var promptLine = /* @__PURE__ */ __name((message2, name, media, mark = "") => [
+  `${speaker(name)}${mark}: ${defused(renderCanonHostInboundContent(message2, media?.files))}`,
   ...(media?.failed ?? []).map((label) => `[Attachment "${defused(inert(label))}" could not be downloaded]`)
 ].join("\n"), "promptLine");
 var inputMessage = /* @__PURE__ */ __name((message2, trusted = false) => Object.freeze({
@@ -2896,7 +3140,7 @@ function approvalScope(request) {
   if (request.scopeKey !== void 0 && /^[A-Za-z0-9_:-]{1,64}$/.test(request.scopeKey)) return request.scopeKey;
   const key = request.scopeKey ?? request.title;
   const slug = key.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "").slice(0, 40) || "approval";
-  return `${slug}-${sha2562(JSON.stringify([request.scopeKey === void 0 ? "title" : "scope", key])).slice(0, 16)}`;
+  return `${slug}-${sha2563(JSON.stringify([request.scopeKey === void 0 ? "title" : "scope", key])).slice(0, 16)}`;
 }
 __name(approvalScope, "approvalScope");
 var MAX_GROUP_PARTS = 100;
@@ -3053,7 +3297,7 @@ async function createRunner(options) {
   const dispose = /* @__PURE__ */ __name((inputs, kind, reason) => Promise.allSettled(inputs.map((input) => input.handle[kind](reason))).then(() => void 0), "dispose");
   const settle = /* @__PURE__ */ __name(async (ids, reason) => (await Promise.allSettled(ids.map((id) => endpoint.setInboundState(id, "settled", reason)))).every(({ status }) => status === "fulfilled"), "settle");
   const queued = /* @__PURE__ */ __name((turn) => turn.inputs.filter((input) => input.handle.phase === "queued"), "queued");
-  const turnId = /* @__PURE__ */ __name((roomId, inputs) => `turn-${sha2562(JSON.stringify([roomId, ...inputs.map((input) => [input.id, input.generation])])).slice(0, 32)}`, "turnId");
+  const turnId = /* @__PURE__ */ __name((roomId, inputs) => `turn-${sha2563(JSON.stringify([roomId, ...inputs.map((input) => [input.id, input.generation])])).slice(0, 32)}`, "turnId");
   const livePublisher = /* @__PURE__ */ __name((current, turn, mode) => createLivePublisher({
     client,
     conversationId: current.id,
@@ -3069,7 +3313,7 @@ async function createRunner(options) {
       current.lane = current.lane.then(publish2).catch(() => void 0);
     }, "enqueue")
   }), "livePublisher");
-  const stateFile = /* @__PURE__ */ __name((session) => join4(home, "runner", options.environmentId, agentId, "state", driver.name, `${sha2562(JSON.stringify([scope, session]))}.json`), "stateFile");
+  const stateFile = /* @__PURE__ */ __name((session) => join6(home, "runner", options.environmentId, agentId, "state", driver.name, `${sha2563(JSON.stringify([scope, session]))}.json`), "stateFile");
   const resetSession = /* @__PURE__ */ __name(async (session) => {
     rmSync3(stateFile(session), { force: true });
     mlsAsks?.endSession(session);
@@ -3189,6 +3433,7 @@ ${error instanceof Error ? error.message : String(error)}`;
     const verified = {
       id: message2.id,
       senderId: message2.senderId,
+      ...message2.senderName ? { senderName: message2.senderName } : {},
       senderType: fromAgent ? "ai_agent" : "human",
       isOwner: !fromAgent && message2.senderId === ownerId,
       text: message2.text ?? void 0,
@@ -3399,7 +3644,7 @@ ${error instanceof Error ? error.message : String(error)}`;
     return check;
   }
   __name(reaudience, "reaudience");
-  const inboundMedia = /* @__PURE__ */ __name((conversationId) => ({ agentId: "inbound", conversationId, rootDir: join4(home, "runner", options.environmentId, agentId) }), "inboundMedia");
+  const inboundMedia = /* @__PURE__ */ __name((conversationId) => ({ agentId: "inbound", conversationId, rootDir: join6(home, "runner", options.environmentId, agentId) }), "inboundMedia");
   async function materialize(current, turn) {
     if (driver.capabilities.remote) return;
     for (const { payload: { message: message2 } } of turn.inputs) {
@@ -3450,7 +3695,7 @@ ${error instanceof Error ? error.message : String(error)}`;
       ask_question: /* @__PURE__ */ __name(async (args) => {
         const question = questionOf(args);
         if (typeof question === "string") return { result: toolText(question, true) };
-        const key = sha2562(JSON.stringify(question));
+        const key = sha2563(JSON.stringify(question));
         const waiting = questions.get(key);
         const entry = waiting?.waiting ? waiting : { id: `canon:ask_question:${asked += 1}`, waiting: true };
         questions.set(key, entry);
@@ -3768,7 +4013,7 @@ ${JSON.stringify(result, null, 2)}`);
         messageId: `${root}-part-${index + 1}`,
         metadata: buildChunkedMessagePartMetadata({ groupId: root, metadata: options2.metadata, index: index + 1, count: bodies.length })
       } }));
-      return client.prepareMessageGroup(record.conversationId, root, parts, { signal, ...replaces ? { operationId: sha2562(JSON.stringify([root, ...attachments.map((attachment) => attachment.uploadId)])), replacesOperationId: replaces } : {} }).then((group2) => ({ ...group2, count: parts.length }));
+      return client.prepareMessageGroup(record.conversationId, root, parts, { signal, ...replaces ? { operationId: sha2563(JSON.stringify([root, ...attachments.map((attachment) => attachment.uploadId)])), replacesOperationId: replaces } : {} }).then((group2) => ({ ...group2, count: parts.length }));
     }, "register");
     const original = await register(record.attachments);
     let group = original;
@@ -3891,7 +4136,7 @@ ${JSON.stringify(result, null, 2)}`);
     return { items, refused: refused2 };
   }
   __name(admitItems, "admitItems");
-  const encryptedOperation = /* @__PURE__ */ __name((audience, messageId) => `runner-mls:${sha2562(JSON.stringify([audience.conversationId, messageId])).slice(0, 48)}`, "encryptedOperation");
+  const encryptedOperation = /* @__PURE__ */ __name((audience, messageId) => `runner-mls:${sha2563(JSON.stringify([audience.conversationId, messageId])).slice(0, 48)}`, "encryptedOperation");
   function forgetGuard(audience, messageId, sent) {
     if (sent === "pending") return;
     const operationId = encryptedOperation(audience, messageId);
@@ -3919,7 +4164,7 @@ ${JSON.stringify(result, null, 2)}`);
       ...turn.contexts.length ? { errands: Object.freeze(turn.contexts.map(({ record }) => errandFacts(record))) } : {},
       ...turn.errand ? { errand: errandFacts(turn.errand.record) } : {}
     });
-    const line = /* @__PURE__ */ __name((message2, trusted = false) => promptLine(message2, message2.senderId === agentId ? "You" : message2.senderName ?? message2.senderId, turn.media.get(message2.id), trusted), "line");
+    const line = /* @__PURE__ */ __name((message2, mark = "") => promptLine(message2, message2.senderId === agentId ? "You" : message2.senderName ?? message2.senderId, turn.media.get(message2.id), mark), "line");
     const open4 = /* @__PURE__ */ __name(() => turn.open && !turn.controller.signal.aborted, "open");
     const live = /* @__PURE__ */ __name(() => open4() && !turn.silenced, "live");
     return {
@@ -3929,7 +4174,7 @@ ${JSON.stringify(result, null, 2)}`);
         ...turn.notes.flatMap((note) => [NOTE_OPEN, defused(note.text), NOTE_CLOSE, ""]),
         ...turn.contexts.flatMap((context) => [...contextPrompt(context, !!turn.mls), ""]),
         ...history.length ? ["Earlier in this conversation (context, not new requests):", ...history.map((message2) => line(message2)), "", "New messages:"] : turn.notes.length || turn.contexts.length ? ["New messages:"] : [],
-        ...turn.inputs.map(({ payload: { message: message2 } }) => line(message2, trustedSender(message2)))
+        ...turn.inputs.map(({ payload: { message: message2 } }) => line(message2, message2.isOwner === true ? OWNER_MARK : trustedSender(message2) ? TRUSTED_MARK : ""))
       ].join("\n"),
       input,
       files: turn.inputs.flatMap(({ payload: { message: message2 } }) => turn.media.get(message2.id)?.files.map((file) => file.path) ?? []),
@@ -3989,7 +4234,7 @@ ${JSON.stringify(result, null, 2)}`);
         }));
         const secret = request.kind === "text" && request.secret === true;
         const responder = secret || sender.type !== "human" ? ownerId : sender.id;
-        const requestId = turn.mls ? keyed().request(roomId, turn.id, request.id) : `ask-${sha2562(JSON.stringify([turn.id, request.id])).slice(0, 32)}`;
+        const requestId = turn.mls ? keyed().request(roomId, turn.id, request.id) : `ask-${sha2563(JSON.stringify([turn.id, request.id])).slice(0, 32)}`;
         const expiresAt = Date.now() + askExpiryMs;
         if (turn.mls) {
           return await mlsAsks.ask({
@@ -4061,7 +4306,7 @@ ${JSON.stringify(result, null, 2)}`);
     const file = stateFile(session);
     let data = {};
     try {
-      data = JSON.parse(readFileSync3(file, "utf8"));
+      data = JSON.parse(readFileSync5(file, "utf8"));
     } catch {
     }
     const save = /* @__PURE__ */ __name((next) => {
@@ -4278,7 +4523,7 @@ ${JSON.stringify(result, null, 2)}`);
       log(`Errand ${id} (tell) kept for the next turn in ${conversationId}.`);
       return true;
     }
-    const turnId2 = `turn-${sha2562(JSON.stringify(["canon.runner.errand", id])).slice(0, 32)}`;
+    const turnId2 = `turn-${sha2563(JSON.stringify(["canon.runner.errand", id])).slice(0, 32)}`;
     const record = {
       version: 1,
       turnId: turnId2,
@@ -4347,7 +4592,7 @@ ${JSON.stringify(result, null, 2)}`);
     pump();
   }
   __name(enqueueErrand, "enqueueErrand");
-  const errandTurnId = /* @__PURE__ */ __name((id) => `turn-${sha2562(JSON.stringify(["canon.runner.errand-turn", id])).slice(0, 32)}`, "errandTurnId");
+  const errandTurnId = /* @__PURE__ */ __name((id) => `turn-${sha2563(JSON.stringify(["canon.runner.errand-turn", id])).slice(0, 32)}`, "errandTurnId");
   const errandFacts = /* @__PURE__ */ __name((record) => Object.freeze({
     id: record.id,
     why: record.why,
@@ -4683,7 +4928,7 @@ ${JSON.stringify(result, null, 2)}`);
       client = new CanonClient(options.apiKey, connection.apiBaseUrl, {
         environmentId: connection.environmentId,
         streamUrl: connection.streamUrl,
-        stateDirectory: join4(home, "endpoint"),
+        stateDirectory: join6(home, "endpoint"),
         ...options.client ? { client: options.client } : {},
         // Below Canon's client floor nothing can work, wherever the refusal surfaces: a query, an operation or the stream.
         ...options.onFatal ? { onClientUpdateRequired: /* @__PURE__ */ __name((error) => options.onFatal(error), "onClientUpdateRequired") } : {},
@@ -4704,7 +4949,14 @@ ${JSON.stringify(result, null, 2)}`);
       if (options.wake !== void 0) await client.configureWake(options.wake);
       mlsOn = !!(endpoint.mlsDevDevice && endpoint.mlsDevGroups);
       if (!mlsOn && (await endpoint.capabilities().catch(() => null))?.mls?.roomMode === "default") {
-        throw new Error("Canon encrypts every new conversation here, and this runner has no MLS device: run it with --mls-dev-config <path> (set one up with canon-agent mls).");
+        throw new Error("Canon encrypts every new conversation here, and this runner has no MLS device: give it mls (managedMlsDevice, or an operator's configuration: --mls-dev-config <path>).");
+      }
+      if (mlsOn && options.mls?.provisioned && (await endpoint.mlsDevDevice.read()).status !== "credential_committed") {
+        log("Setting up this agent's MLS device");
+        const device = await runMlsDevSetup(endpoint, "setup", void 0, options.mls.provision, options.mls.provisioned).catch((error) => {
+          throw new Error(`Could not set up this agent's MLS device: ${error instanceof Error ? error.message : String(error)}`);
+        });
+        log(`MLS device ${device.deviceId} is ${device.status}`);
       }
       if (mlsOn) await endpoint.mlsDevDevice.ensureReady().catch(warn("MLS device not ready; encrypted rooms wait for it"));
       const keepPool = /* @__PURE__ */ __name(() => endpoint.mlsDevDevice.read().then(async (view) => {
@@ -4721,23 +4973,23 @@ ${JSON.stringify(result, null, 2)}`);
       }
       scope = JSON.stringify([identity.environmentId, agentId, identity.ownershipVersion ?? 0, identity.installationId]);
       if (mlsOn) {
-        mlsIds = createMlsIds(privateKey(join4(home, "runner", options.environmentId, agentId, "mls-ids", `${sha2562(scope).slice(0, 32)}.key`), MLS_ID_KEY_BYTES));
+        mlsIds = createMlsIds(privateKey(join6(home, "runner", options.environmentId, agentId, "mls-ids", `${sha2563(scope).slice(0, 32)}.key`), MLS_ID_KEY_BYTES));
         mlsAsks = createMlsAsks({
           endpoint,
           agentId,
-          directory: join4(home, "runner", options.environmentId, agentId, "asks", sha2562(scope).slice(0, 32)),
+          directory: join6(home, "runner", options.environmentId, agentId, "asks", sha2563(scope).slice(0, 32)),
           assertAudience,
           sessionForDestructive: options.sessionApprovalForDestructive === true,
           log
         }, approvalScope);
       }
-      journal = createCompletedOutputJournal(join4(home, "runner", options.environmentId, agentId, "finals"), scope, {
+      journal = createCompletedOutputJournal(join6(home, "runner", options.environmentId, agentId, "finals"), scope, {
         label: "agent runner",
         validate: /* @__PURE__ */ __name((record) => typeof record.text === "string" && typeof record.options?.messageId === "string" && Array.isArray(record.inputs) && typeof record.notice === "boolean" && (record.attachments === void 0 || Array.isArray(record.attachments)) && (record.flows === void 0 || Array.isArray(record.flows) && record.flows.length === record.attachments?.length) && (record.mls === void 0 || !!record.mls && typeof record.mls === "object") && (record.errand === void 0 || typeof record.errand === "string"), "validate")
       });
       if (!options.relay && !driver.capabilities.remote) {
         errands = errandJournal(errandsDirectory(home, options.environmentId, agentId));
-        errandScope = sha2562(scope).slice(0, 32);
+        errandScope = sha2563(scope).slice(0, 32);
         const pending = errands.list().filter((record) => record.kind === "tell" && record.status === "pending").sort((a, b) => (a.createdAt ?? "").localeCompare(b.createdAt ?? "") || a.id.localeCompare(b.id));
         for (const note of pending) {
           if (note.scope === errandScope) notes.set(note.conversationId, [...notes.get(note.conversationId) ?? [], note]);
@@ -4858,7 +5110,7 @@ ${JSON.stringify(result, null, 2)}`);
         throw new ConnectorRelayError(400, "CONNECTOR_RELAY_INVALID", "A send needs a messageId and 1 byte to 32 KiB of text");
       }
       const deadline = options2.deadline ?? Date.now() + CONNECTOR_RELAY_ANSWER_WITHIN_MS;
-      const id = `relay-send-${sha2562(JSON.stringify([conversationId, messageId])).slice(0, 32)}`;
+      const id = `relay-send-${sha2563(JSON.stringify([conversationId, messageId])).slice(0, 32)}`;
       let entry = relaySends.get(id);
       if (!entry) relaySends.set(id, entry = prepareRelaySend(conversationId, id, text3, deadline));
       const prepared = await beforeDeadline(entry.ready, deadline);
@@ -4903,6 +5155,9 @@ export {
   MLS_SETUP_ACTIONS,
   mlsDevRoomPackageId,
   runMlsDevSetup,
+  MLS_ENVIRONMENT_PINS,
+  bundledMlsCustodyHelper,
+  managedMlsDevice,
   startRelayChannel,
   loadRelayConfiguration,
   readRelayCredential,

package/dist/chunks/{mls-crypto-D5YAGYJ3.js → mls-crypto-LGPCXM3K.js}

@@ -2,7 +2,7 @@ import {
   createMlsDevCredentialVerifier,
   mlsDevDeviceHttpConfiguration,
   parseMlsDevClientConfiguration
-} from "./chunk-5MI6Q3VS.js";
+} from "./chunk-GWQF4WFT.js";
 export {
   createMlsDevCredentialVerifier,
   mlsDevDeviceHttpConfiguration,

package/dist/cli.js

@@ -3,6 +3,7 @@ import {
   MLS_SETUP_ACTIONS,
   assertPrivateHome,
   awaitErrand,
+  bundledMlsCustodyHelper,
   checkCodex,
   claudeDriver,
   codeDriver,
@@ -15,6 +16,7 @@ import {
   loadInstructions,
   loadMlsDevConfiguration,
   loadRelayConfiguration,
+  managedMlsDevice,
   queueErrand,
   readRelayCredential,
   relayRunnerHome,
@@ -22,7 +24,7 @@ import {
   runnerLockName,
   startRelayChannel,
   writeRelayCredential
-} from "./chunks/chunk-JCBQCO3F.js";
+} from "./chunks/chunk-NXL4C2R6.js";
 import {
   CanonApiError,
   CanonClient,
@@ -33,11 +35,12 @@ import {
   resolveCanonRuntimeConnection,
   runCli,
   verifyCanonRuntimeConnection
-} from "./chunks/chunk-RFNYPZXD.js";
+} from "./chunks/chunk-6PKXASSK.js";
 import {
   __name,
-  isCanonClientVersion
-} from "./chunks/chunk-5MI6Q3VS.js";
+  isCanonClientVersion,
+  isMlsEnvironmentId
+} from "./chunks/chunk-GWQF4WFT.js";
 
 // src/cli.ts
 import { realpathSync } from "node:fs";
@@ -66,9 +69,9 @@ Usage:
   canon-agent run --driver codex [--cwd <dir>] [--model <id>] [--sandbox <mode>]
                   [--approval-policy <policy>] [--codex-path <path>] [--profile <name>]
                   [--environment <id>]
-  canon-agent run --driver connector --relay-config <path> --mls-dev-config <path>
+  canon-agent run --driver connector --relay-config <path> [--mls-dev-config <path>]
                   [--profile <name>] [--environment <id>]
-  canon-agent mls --action <action> --mls-dev-config <path> [--room <id>]
+  canon-agent mls --action <action> [--mls-dev-config <path>] [--room <id>]
                   [--relay-config <path>] [--profile <name>] [--environment <id>]
   canon-agent tell --room <id> --text <text> (--agent <id> | --profile <name>)
                   [--environment <id>] [--wait]
@@ -80,10 +83,12 @@ Usage:
   canon-agent errands [--follow] [--cancel <errand id>] (--agent <id> | --profile <name>)
                   [--environment <id>]
 
-Every run command also takes --mls-dev-config <path>, which gives the agent its MLS
-device so it can take part in encrypted rooms. Without it, the agent refuses encrypted
-rooms and logs each one once; where Canon encrypts every new conversation, it does not
-start.
+Encrypted rooms need the agent's MLS device. On macOS (Apple silicon) and Linux
+(x64, arm64) the runner keeps it in $CANON_HOME with the custody helper this package
+ships, and sets it up on the agent's first start: nothing to configure. Every run
+command also takes --mls-dev-config <path>, an operator's own custody instead. With
+neither, the agent refuses encrypted rooms, and where Canon encrypts every new
+conversation it does not start.
 
 Team rooms (an owner's agents working together): claude and codex also take
 [--instructions <file>] [--trust-agent <agentId>]...; every run command takes
@@ -146,20 +151,22 @@ Flags:
                          marks destructive (Claude Code's default-to-no prompts,
                          Codex's risky commands and deletions) for the rest of the
                          session. Off by default: each such action asks.
-  --relay-config <path>  connector (Dev only): run as Canon's class-C relay for one agent
+  --relay-config <path>  connector: run as Canon's class-C relay for one agent
                          connected through Canon's MCP connector. A private JSON file
                          naming the agent, where the channel to Canon's Functions
                          listens, and the path of the channel secret. Canon delivers
                          the relay's own credential over that channel when the owner
                          enables the relay (no API key is used); it is kept in
                          $CANON_HOME/relay. The relay serves only encrypted rooms,
-                         which are then not end-to-end encrypted to that agent. With
-                         "mls", it sets up the relay's device with that credential.
-  --mls-dev-config <p>   The operator's MLS configuration: an absolute path to a private
-                         JSON file with the environment's issuer pins and the custody
-                         helper (no keys or credentials).
-  --action <action>      mls: status (public device state), provision (create the
-                         portable vault, once), enroll, renew, publish (this device's
+                         which are then not end-to-end encrypted to that agent. It sets
+                         up the relay's device with that credential.
+  --mls-dev-config <p>   An operator's own MLS configuration, instead of the device the
+                         runner keeps itself: an absolute path to a private JSON file
+                         with the environment's issuer pins and the custody helper (no
+                         keys or credentials).
+  --action <action>      mls: status (public device state), setup (whatever is left of
+                         provision then enroll), provision (create the portable vault,
+                         once), enroll, renew, publish (this device's
                          KeyPackage for --room) or refresh (catch up --room). It never
                          starts a model, and uses the same home as "run": stop the
                          agent first.
@@ -232,7 +239,6 @@ async function main() {
   }
   if (values.driver === "code" && !values.module) throw new UsageError("--driver code needs --module <path>.");
   if (values.driver === "connector" !== !!values["relay-config"]) throw new UsageError("--relay-config goes with --driver connector, which needs it.");
-  if (values.driver === "connector" && !values["mls-dev-config"]) throw new UsageError("--driver connector needs --mls-dev-config <path>: the relay holds the agent's MLS device.");
   if (!["claude", "codex"].includes(values.driver) && (values.instructions !== void 0 || values["trust-agent"]?.length)) {
     throw new UsageError("--instructions and --trust-agent go with --driver claude or codex.");
   }
@@ -254,7 +260,7 @@ async function main() {
   if (trustedAgents.some((id) => !/^[\w.:-]{1,200}$/.test(id))) throw new UsageError("--trust-agent takes an agent id.");
   const instructions = values.instructions !== void 0 ? await loadInstructions(resolve(values.instructions)) : void 0;
   const { environmentId, home, profile, apiKey } = await settings(values);
-  const mls = values["mls-dev-config"] ? await loadMlsDevConfiguration(values["mls-dev-config"], { environmentId }) : void 0;
+  const mls = await mlsDevice(values, environmentId, home);
   const baseUrl = process.env.CANON_BASE_URL || profile?.baseUrl;
   const streamUrl = process.env.CANON_STREAM_URL || profile?.streamUrl;
   let driver;
@@ -352,7 +358,8 @@ async function runRelay(values, team) {
     channel.serve(void 0);
     await current?.stop();
     current = void 0;
-    const mls = await loadMlsDevConfiguration(values["mls-dev-config"], { environmentId });
+    const mls = await mlsDevice(values, environmentId, relayRunnerHome(home, stored2.installationId));
+    if (!mls) throw new Error(`this host has no MLS custody helper (${process.platform}-${process.arch}): give the relay --mls-dev-config <path>`);
     const driver = connectorDriver();
     const runner = await createRunner({
       apiKey: stored2.credential,
@@ -455,11 +462,17 @@ async function settings(values, { key = true } = {}) {
   return { environmentId, home, profile, apiKey: process.env.CANON_API_KEY || profile?.apiKey || "" };
 }
 __name(settings, "settings");
+async function mlsDevice(values, environmentId, home) {
+  if (values["mls-dev-config"]) return loadMlsDevConfiguration(values["mls-dev-config"], { environmentId });
+  if (!isMlsEnvironmentId(environmentId)) return void 0;
+  const helper = bundledMlsCustodyHelper();
+  return helper ? managedMlsDevice({ home, environmentId, helper }) : void 0;
+}
+__name(mlsDevice, "mlsDevice");
 async function mlsSetup(values) {
   const action = values.action;
   if (!action || !MLS_SETUP_ACTIONS.includes(action)) throw new UsageError(`--action must be one of ${MLS_SETUP_ACTIONS.join(", ")}.`);
   if ((action === "publish" || action === "refresh") !== !!values.room) throw new UsageError("--room is needed for publish and refresh, and only for them.");
-  if (!values["mls-dev-config"]) throw new UsageError("--mls-dev-config <path> is required.");
   const settled = await settings(values, { key: !values["relay-config"] });
   const { environmentId, profile } = settled;
   const relay = values["relay-config"] ? await loadRelayConfiguration(values["relay-config"], { environmentId }) : void 0;
@@ -469,7 +482,8 @@ async function mlsSetup(values) {
   }
   const apiKey = stored ? stored.credential : settled.apiKey;
   const home = stored ? relayRunnerHome(settled.home, stored.installationId) : settled.home;
-  const config = await loadMlsDevConfiguration(values["mls-dev-config"], { environmentId });
+  const config = await mlsDevice(values, environmentId, home);
+  if (!config) throw new Error(`@canonmsg/agent-sdk ships no MLS custody helper for ${process.platform}-${process.arch}: give --mls-dev-config <path>.`);
   let client;
   let lock;
   try {
@@ -489,7 +503,7 @@ async function mlsSetup(values) {
     });
     const me = await client.getAgentMe();
     lock = acquireLock(runnerLockName(environmentId, me.agentId), home);
-    console.log(JSON.stringify(await runMlsDevSetup(await client.getEndpoint(), action, values.room, config.provision)));
+    console.log(JSON.stringify(await runMlsDevSetup(await client.getEndpoint(), action, values.room, config.provision, config.provisioned)));
   } finally {
     try {
       await client?.close();

package/dist/index.d.ts

@@ -3,6 +3,8 @@ export type { Runner, RunnerOptions } from './runner/runner.js';
 export { ConnectorRelayError, DriverSessionError } from './runner/types.js';
 export { loadMlsDevConfiguration, MLS_SETUP_ACTIONS, mlsDevRoomPackageId, runMlsDevSetup } from './runner/mls.js';
 export type { MlsSetupAction, RunnerMlsOptions } from './runner/mls.js';
+export { bundledMlsCustodyHelper, MLS_ENVIRONMENT_PINS } from './runner/mls-bundled.js';
+export { managedMlsDevice, type ManagedMlsDevice, type ManagedMlsDeviceOptions } from './runner/mls-managed.js';
 export type { ActivityEvent, AskAnswer, AskRequest, DriverCapabilities, DriverResult, DriverState, DriverTurn, ErrandFacts, RuntimeDriver, ToolDefinition, ToolResult, TurnInput, TurnInputMessage, TurnTools, } from './runner/types.js';
 export { errandJournal, errandsDirectory, queueErrand } from './runner/errands.js';
 export type { ErrandCommand, ErrandInput, ErrandKind, ErrandRecord, ErrandStatus } from './runner/errands.js';

package/dist/index.js

@@ -1,7 +1,9 @@
 import {
   ConnectorRelayError,
   DriverSessionError,
+  MLS_ENVIRONMENT_PINS,
   MLS_SETUP_ACTIONS,
+  bundledMlsCustodyHelper,
   checkCodex,
   claudeDriver,
   codeDriver,
@@ -13,12 +15,13 @@ import {
   loadClaudeQuery,
   loadMlsDevConfiguration,
   loadRelayConfiguration,
+  managedMlsDevice,
   mlsDevRoomPackageId,
   queueErrand,
   runMlsDevSetup,
   runtimeDescriptor,
   startRelayChannel
-} from "./chunks/chunk-JCBQCO3F.js";
+} from "./chunks/chunk-NXL4C2R6.js";
 import {
   CanonApiError,
   DEFAULT_ANTHROPIC_REQUEST_HEADROOM_BYTES,
@@ -43,8 +46,8 @@ import {
   toAnthropicImageBlock,
   toAnthropicImageBlocksWithinBudget,
   uploadMediaFile
-} from "./chunks/chunk-RFNYPZXD.js";
-import "./chunks/chunk-5MI6Q3VS.js";
+} from "./chunks/chunk-6PKXASSK.js";
+import "./chunks/chunk-GWQF4WFT.js";
 export {
   CanonApiError,
   ConnectorRelayError,
@@ -55,7 +58,9 @@ export {
   MAX_ANTHROPIC_IMAGE_RAW_BYTES,
   MAX_ANTHROPIC_REQUEST_BYTES,
   MAX_CANON_MEDIA_BYTES,
+  MLS_ENVIRONMENT_PINS,
   MLS_SETUP_ACTIONS,
+  bundledMlsCustodyHelper,
   checkCodex,
   claudeDriver,
   clearPendingRegistration,
@@ -74,6 +79,7 @@ export {
   loadClaudeQuery,
   loadMlsDevConfiguration,
   loadRelayConfiguration,
+  managedMlsDevice,
   materializeAttachment,
   materializeMessageMedia,
   materializeReplyContextMedia,

package/dist/internal/backend-contracts/endpointContentPolicy.d.ts

@@ -8,6 +8,11 @@ export type EndpointContentLane = 'operation.request' | 'operation.receipt' | 'q
  * authenticated encrypted protocol before they can operate on a protected room.
  * Their routing fields remain public metadata; classification is not authority. */
 export declare const MLS_DEV_UNSUPPORTED_CONTENT_ACTIONS: readonly ["forward_message"];
+/** Operations that send their private content to a named processor in an encrypted room too, disclosed where the
+ * app offers them, with the fields reviewed for that: an image's description and source photo go through Canon to
+ * Google (image-generation.md). The fields stay classified as private; only the encrypted room's plaintext fence lets
+ * them through, and any other field still keeps the operation out. */
+export declare const MLS_DEV_DISCLOSED_PROCESSING_FIELDS: Readonly<Record<string, readonly string[]>>;
 export declare const ENDPOINT_CONTENT_ACTIONS: readonly ["mls_application", "mls_group_control", "initialize_endpoint", "append_artifact_command", "retain_artifact_asset", "sync_phone_contacts", "update_agent_behavior_policy", "update_conversation_agent_behavior_policy", "send_message", "delete_message", "forward_message", "react", "verb_execute", "send_contextual_message", "create_interaction", "consume_interaction", "start_conversation", "create_conversation", "add_member", "remove_member", "leave_conversation", "update_member_role", "update_conversation", "rename_conversation", "update_topic", "update_group_avatar", "mark_read", "cancel_queued_message", "set_conversation_preferences", "set_block", "save_contact", "remove_contact", "respond_interaction", "session_control", "approve_contact_request", "reject_contact_request", "cancel_direct_request", "update_message_disposition", "create_upload", "finalize_upload", "delete_upload", "retry_video_processing", "stage_media_message", "cancel_media_message", "renew_media_message_upload", "finalize_memo_stream", "abort_memo_stream", "create_voice_session", "join_voice_session", "decline_voice_session", "end_voice_session", "consume_runtime_signal", "consume_runtime_primitive", "generate_image"];
 export declare const ENDPOINT_CONTENT_FUNCTION_QUERIES: readonly ["mls_group_feed", "mls_group_controls", "mls_group_admissions", "mls_interactions", "list_artifacts", "get_artifact_log", "get_artifact_asset", "discover_agents", "get_unread_summary", "peek_runtime_signal", "list_runtime_primitives", "get_agent_behavior_policy", "get_conversation_agent_behavior_policy", "get_ephemeral", "list_voice_sessions", "list_contact_requests", "list_conversations", "list_messages", "get_messages", "admission_fences", "list_contacts", "get_contact", "get_members", "resolve_admission", "resolve_group_admission", "get_runtime_card_state", "conversation", "conversation_changes", "get_upload", "get_media_message", "get_voice_session", "get_image_generation", "get_image_generation_status", "same_owner_agents"];
 export declare const ENDPOINT_CONTENT_QUERIES: readonly ["mls_group_feed", "mls_group_controls", "mls_group_admissions", "mls_interactions", "list_artifacts", "get_artifact_log", "get_artifact_asset", "discover_agents", "get_unread_summary", "peek_runtime_signal", "list_runtime_primitives", "get_agent_behavior_policy", "get_conversation_agent_behavior_policy", "get_ephemeral", "list_voice_sessions", "list_contact_requests", "list_conversations", "list_messages", "get_messages", "admission_fences", "list_contacts", "get_contact", "get_members", "resolve_admission", "resolve_group_admission", "get_runtime_card_state", "conversation", "conversation_changes", "get_upload", "get_media_message", "get_voice_session", "get_image_generation", "get_image_generation_status", "same_owner_agents", "admit_messages"];

package/dist/media.js

@@ -18,8 +18,8 @@ import {
   toAnthropicImageBlock,
   toAnthropicImageBlocksWithinBudget,
   uploadMediaFile
-} from "./chunks/chunk-RFNYPZXD.js";
-import "./chunks/chunk-5MI6Q3VS.js";
+} from "./chunks/chunk-6PKXASSK.js";
+import "./chunks/chunk-GWQF4WFT.js";
 export {
   DEFAULT_ANTHROPIC_REQUEST_HEADROOM_BYTES,
   DEFAULT_MEDIA_CACHE_DIR,

package/dist/runner/mls-bundled.d.ts

@@ -0,0 +1,25 @@
+import type { MlsEnvironmentId } from '../internal/backend-contracts/index.js';
+/**
+ * Each environment's Cloud KMS issuer and feed-receipt key versions (public keys, raw Ed25519 in base64url). During an
+ * issuer rotation `issuerKeys` holds both versions (docs/mls-dev-activation.md, "Planned issuer rotation"), and an SDK
+ * release carrying the new one ships before issuance switches.
+ */
+export declare const MLS_ENVIRONMENT_PINS: Readonly<Record<MlsEnvironmentId, {
+    issuerKeys: ReadonlyArray<{
+        keyVersion: string;
+        signaturePublicKey: string;
+    }>;
+    receiptKeys: ReadonlyArray<{
+        keyVersion: string;
+        signaturePublicKey: string;
+    }>;
+}>>;
+/**
+ * The custody helper this package ships for this host (`dist/mls/<platform>/canon-mls-custody`), checked against its
+ * pin, or undefined where it ships none: an Intel Mac, musl, Windows, or a build of this package without helpers. A
+ * file that is there but differs from its pin is refused.
+ */
+export declare function bundledMlsCustodyHelper(): {
+    path: string;
+    sha256: string;
+} | undefined;

package/dist/runner/mls-managed.d.ts

@@ -0,0 +1,31 @@
+import type { MlsDevDeviceContext, MlsEnvironmentId } from '../internal/backend-contracts/index.js';
+import type { RunnerMlsOptions } from './mls.js';
+export interface ManagedMlsDeviceOptions {
+    /** The runner's home (CANON_HOME, or a relay installation's home). */
+    home: string;
+    environmentId: MlsEnvironmentId;
+    /** Another helper than this package's for the host, such as one built from mls/native. */
+    helper?: {
+        path: string;
+        sha256: string;
+    };
+    /** Other public pins than this package's for the environment. */
+    pins?: {
+        issuerKeys: ReadonlyArray<{
+            keyVersion: string;
+            signaturePublicKey: string;
+        }>;
+        receiptKeys: ReadonlyArray<{
+            keyVersion: string;
+            signaturePublicKey: string;
+        }>;
+    };
+    timeoutMs?: number;
+}
+export type ManagedMlsDevice = RunnerMlsOptions & {
+    provision(context: MlsDevDeviceContext): Promise<void>;
+    /** Whether this context's vault exists: its device was provisioned here. */
+    provisioned(context: MlsDevDeviceContext): boolean;
+    close(): Promise<void>;
+};
+export declare function managedMlsDevice(options: ManagedMlsDeviceOptions): ManagedMlsDevice;

package/dist/runner/mls.d.ts

@@ -1,9 +1,14 @@
 import { type CanonEndpoint, type CanonMlsDevOptions, type MlsDevCurrentAudience } from '../internal/core/index.js';
 import { type MlsDevDeviceContext } from '../internal/backend-contracts/index.js';
 import type { ToolDefinition } from './types.js';
-/** What `createRunner({ mls })` takes: issuer pins and custody, plus the custody's own shutdown. */
+/**
+ * What `createRunner({ mls })` takes: issuer pins and custody, plus the custody's own shutdown. With `provisioned`
+ * (managed custody, `managedMlsDevice`) the runner sets the device up itself at start.
+ */
 export type RunnerMlsOptions = CanonMlsDevOptions & {
     close?(): Promise<void>;
+    provision?(context: MlsDevDeviceContext): Promise<void>;
+    provisioned?(context: MlsDevDeviceContext): boolean;
 };
 /** A closed copy of the public audience (no provider input or key material), in a fixed field order. */
 export declare function snapshotMlsAudience(value: unknown): MlsDevCurrentAudience;
@@ -70,7 +75,7 @@ export declare function loadMlsDevConfiguration(filePath: string, input: {
     provision?: (context: MlsDevDeviceContext) => Promise<void>;
     close(): Promise<void>;
 }>;
-export declare const MLS_SETUP_ACTIONS: readonly ["status", "provision", "enroll", "renew", "publish", "refresh"];
+export declare const MLS_SETUP_ACTIONS: readonly ["status", "setup", "provision", "enroll", "renew", "publish", "refresh"];
 export type MlsSetupAction = typeof MLS_SETUP_ACTIONS[number];
 /** The KeyPackage an agent publishes for one room: stable for its installation, so a repeated publish is the same intent. */
 export declare function mlsDevRoomPackageId(identity: {
@@ -81,13 +86,15 @@ export declare function mlsDevRoomPackageId(identity: {
 }, room: string): string;
 /**
  * One operator step for the agent's device (`canon-agent mls`), on the same engine store the runner uses. It never
- * starts a model, and prints only public device state: no credentials, proofs, envelopes or history.
+ * starts a model, and prints only public device state: no credentials, proofs, envelopes or history. `setup` does what
+ * is left of provision then enroll, so it also finishes a setup that stopped part way; it never replaces a vault, and
+ * with `provisioned` (managed custody) it provisions only where this installation has none.
  */
-export declare function runMlsDevSetup(endpoint: CanonEndpoint, action: MlsSetupAction, room?: string, provision?: (context: MlsDevDeviceContext) => Promise<void>): Promise<{
+export declare function runMlsDevSetup(endpoint: CanonEndpoint, action: MlsSetupAction, room?: string, provision?: (context: MlsDevDeviceContext) => Promise<void>, provisioned?: (context: MlsDevDeviceContext) => boolean): Promise<{
     conversationId?: string | undefined;
     version: number;
-    action: "status" | "publish" | "enroll" | "renew" | "provision" | "refresh";
-    environmentId: "canon-dev-v1" | "canon-prod-v1";
+    action: "status" | "publish" | "enroll" | "renew" | "provision" | "setup" | "refresh";
+    environmentId: string;
     principalId: string;
     installationId: string;
     ownershipVersion: number | undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canonmsg/agent-sdk",
-  "version": "12.3.2",
+  "version": "12.4.1",
   "description": "Canon Agent SDK — build AI agents that participate in Canon conversations",
   "type": "module",
   "main": "dist/index.js",
@@ -24,7 +24,7 @@
   "scripts": {
     "build": "node ../../scripts/build-agent-sdk.mjs",
     "dev": "tsc --watch --noEmit",
-    "prepack": "npm run build"
+    "prepack": "node ../../scripts/build-agent-sdk.mjs --pack"
   },
   "engines": {
     "node": ">=22.23.4 <23 || >=24.22.1 <25 || >=26.12.1 <27"