@canonmsg/agent-sdk 12.3.2 → 12.5.1

package/dist/chunks/{chunk-5MI6Q3VS.js → chunk-C2WJT3VX.js}

@@ -4065,6 +4065,9 @@ __name(normalizePublicRuntimeFacts, "normalizePublicRuntimeFacts");
 
 // ../backend-contracts/src/endpointContentPolicy.ts
 var MLS_DEV_UNSUPPORTED_CONTENT_ACTIONS = ["forward_message"];
+var MLS_DEV_DISCLOSED_PROCESSING_FIELDS = {
+  generate_image: ["conversationId", "requestId", "prompt", "sourceUploadId"]
+};
 var ENDPOINT_CONTENT_ACTIONS = [
   "mls_application",
   "mls_group_control",
@@ -4651,6 +4654,13 @@ function text4(value) {
   return value;
 }
 __name(text4, "text");
+function selection(value) {
+  const args = record3(value, ["mode"], ["conversationId"]);
+  if ((args.mode === "new" || args.mode === "latest_or_new") && args.conversationId === void 0) return { mode: args.mode };
+  if (args.mode === "specific") return { mode: "specific", conversationId: room(args.conversationId) };
+  return invalid11("selection");
+}
+__name(selection, "selection");
 function limit(value) {
   if (value === void 0) return void 0;
   if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1 || value > 100) invalid11("limit");
@@ -4700,6 +4710,15 @@ function parseConnectorRelayRequest(value) {
       const args = record3(body.args, ["conversationId", "messageId", "text"]);
       return { ...head, op: "send", args: { conversationId: room(args.conversationId), messageId: id6(args.messageId, "messageId"), text: text4(args.text) } };
     }
+    case "start": {
+      const args = record3(body.args, ["targetUserId", "messageId", "text"], ["selection"]);
+      return { ...head, op: "start", args: {
+        targetUserId: doc(args.targetUserId, "targetUserId"),
+        messageId: id6(args.messageId, "messageId"),
+        text: text4(args.text),
+        ...args.selection === void 0 ? {} : { selection: selection(args.selection) }
+      } };
+    }
     case "credential": {
       const args = record3(body.args, ["installationId", "generation", "credential"]);
       if (!Number.isSafeInteger(args.generation) || args.generation < 1) invalid11("generation");
@@ -5381,6 +5400,7 @@ export {
   normalizePublicRuntimeDescriptor,
   normalizePublicRuntimeFacts,
   MLS_DEV_UNSUPPORTED_CONTENT_ACTIONS,
+  MLS_DEV_DISCLOSED_PROCESSING_FIELDS,
   endpointOperationRequestRetention,
   endpointContentBoundary,
   canonicalEndpointJson,

package/dist/chunks/{chunk-RFNYPZXD.js → chunk-TFSURFF6.js}

@@ -8,6 +8,7 @@ import {
   MAX_PUBLIC_RUNTIME_COMMANDS,
   MLS_DEV_CREDENTIAL_MAX_BYTES,
   MLS_DEV_CREDENTIAL_RECONCILIATION_MAX_BYTES,
+  MLS_DEV_DISCLOSED_PROCESSING_FIELDS,
   MLS_DEV_ENROLLMENT_MAX_BYTES,
   MLS_DEV_GROUP_RECEIPT_CLOCK_SKEW,
   MLS_DEV_INTERACTION_LIMITS,
@@ -109,7 +110,7 @@ import {
   readMembershipChangeMetadata,
   resolveAllowedUploadMimeType,
   sanitizeDownloadFileName
-} from "./chunk-5MI6Q3VS.js";
+} from "./chunk-C2WJT3VX.js";
 
 // src/media.ts
 import { createWriteStream as createWriteStream2 } from "node:fs";
@@ -2602,6 +2603,8 @@ async function assertMlsDevPlaintextAllowed(tx, intent2, lane = "operation.reque
   }), "failure");
   const action = intent2.action === "verb_execute" ? intent2.body.verb : intent2.action;
   if (typeof action === "string" && MLS_DEV_UNSUPPORTED_CONTENT_ACTIONS.some((unsupported) => unsupported === action)) throw failure2();
+  const disclosed = lane === "operation.request" && Object.hasOwn(MLS_DEV_DISCLOSED_PROCESSING_FIELDS, intent2.action) ? MLS_DEV_DISCLOSED_PROCESSING_FIELDS[intent2.action] : void 0;
+  if (disclosed && !intent2.envelope && Object.keys(intent2.body).every((field) => disclosed.includes(field))) return;
   const payload = lane === "operation.request" ? { body: { encoding: "json", value: intent2.body }, ...intent2.envelope ? { envelope: intent2.envelope } : {} } : intent2.body;
   let boundary;
   try {
@@ -5216,7 +5219,7 @@ function createMlsDevDeviceClient(options, context) {
   const store = guardedStore();
   const fence = /* @__PURE__ */ __name(() => store.transaction(async () => {
   }), "fence");
-  async function initialized() {
+  async function initialized(storedPrincipalId) {
     context.assertOpen();
     const { identity, installationGeneration } = await context.ready();
     await fence();
@@ -5227,7 +5230,7 @@ function createMlsDevDeviceClient(options, context) {
     const binding = parseMlsDevDeviceBinding({
       version: 1,
       environmentId: identity.environmentId,
-      principal: { ...principal, id: await context.mlsPrincipalId() },
+      principal: { ...principal, id: storedPrincipalId ?? await context.mlsPrincipalId() },
       installationId: identity.installationId
     });
     const coordinator = /* @__PURE__ */ __name((journal) => createMlsDevDeviceCoordinator({
@@ -5514,6 +5517,14 @@ function createMlsDevDeviceClient(options, context) {
     }
   }
   __name(ensureReady, "ensureReady");
+  async function revoke() {
+    const { coordinator, transport: http } = await initialized();
+    const device = coordinator(store), view3 = await device.read();
+    if (view3.status === "revoked" || !view3.registration) return view3;
+    const receipt = await http.revokeCredential({ version: 1, deviceId: view3.registration.device.deviceId }, context.signal);
+    return device.acceptRevocation(receipt);
+  }
+  __name(revoke, "revoke");
   function run(goal) {
     context.assertOpen();
     const preceding = running;
@@ -5540,12 +5551,26 @@ function createMlsDevDeviceClient(options, context) {
     return promise;
   }
   __name(run, "run");
+  function read(options2) {
+    return context.run(async () => {
+      let storedPrincipalId;
+      if (options2?.localOnly) {
+        await context.ready();
+        const saved = await store.transaction((tx) => tx.get("mls-dev-device/identity"));
+        if (!saved) return void 0;
+        storedPrincipalId = parseMlsDevDeviceBinding(saved.binding).principal.id;
+      }
+      return (await initialized(storedPrincipalId)).coordinator(store).read();
+    });
+  }
+  __name(read, "read");
   return Object.freeze({
-    read: /* @__PURE__ */ __name(() => context.run(async () => (await initialized()).coordinator(store).read()), "read"),
+    read,
     enroll: /* @__PURE__ */ __name(() => run("enroll"), "enroll"),
     renew: /* @__PURE__ */ __name(() => run("renew"), "renew"),
     reconcile: /* @__PURE__ */ __name(() => run("reconcile"), "reconcile"),
-    ensureReady: /* @__PURE__ */ __name(() => run("ready"), "ensureReady")
+    ensureReady: /* @__PURE__ */ __name(() => run("ready"), "ensureReady"),
+    revoke: /* @__PURE__ */ __name(() => context.run(revoke), "revoke")
   });
 }
 __name(createMlsDevDeviceClient, "createMlsDevDeviceClient");
@@ -7239,7 +7264,11 @@ function createMlsDevGroups(options, context, keyPackages, bridge) {
       const group = envelope((await readPreparationSnapshot(tx, scope4(conversationId))).protocolState, init.binding, conversationId);
       const accounts = mlsRoomAccounts(room, init.binding.environmentId);
       const admitted = new Set((group && !group.removed ? group.roster : []).map((entry) => mlsAccountOf(accounts, entry.device.principal)));
-      const waiting = [...Array.isArray(room.memberIds) ? room.memberIds : [], ...typeof room.mlsInviteeId === "string" ? [room.mlsInviteeId] : []].filter((memberId) => typeof memberId === "string" && !admitted.has(memberId));
+      const waiting = [.../* @__PURE__ */ new Set([
+        ...Array.isArray(room.memberIds) ? room.memberIds : [],
+        ...typeof room.mlsInviteeId === "string" ? [room.mlsInviteeId] : [],
+        ...Array.isArray(room.mlsPendingFounderIds) ? room.mlsPendingFounderIds : []
+      ])].filter((memberId) => typeof memberId === "string" && !admitted.has(memberId));
       return Object.freeze({ held: waiting.length > 0, waitingPrincipalIds: Object.freeze(waiting) });
     });
   }
@@ -8803,9 +8832,28 @@ function createEndpoint(options) {
   }
   __name(sendDeferredOpeners, "sendDeferredOpeners");
   const stubReads = /* @__PURE__ */ new Map();
+  const stubNames = /* @__PURE__ */ new Map();
   let liveActionCounter = 0;
   const liveActions = /* @__PURE__ */ new Map();
   const stubKey = /* @__PURE__ */ __name((conversationId, messageId) => `${conversationId}\0${messageId}`, "stubKey");
+  function rememberStubName(conversationId, stub) {
+    const name = typeof stub.senderName === "string" ? stub.senderName.trim() : "";
+    if (typeof stub.senderId !== "string" || !stub.senderId || !name || name === stub.senderId || name.length > 80) return;
+    const key2 = stubKey(conversationId, stub.id);
+    stubNames.delete(key2);
+    stubNames.set(key2, { senderId: stub.senderId, name });
+    if (stubNames.size > 1e3) stubNames.delete(stubNames.keys().next().value);
+  }
+  __name(rememberStubName, "rememberStubName");
+  function withStubNames(conversationId, history) {
+    const messages = history.messages;
+    if (!Array.isArray(messages)) return history;
+    return { ...history, messages: messages.map((message) => {
+      const named = typeof message.id === "string" ? stubNames.get(stubKey(conversationId, message.id)) : void 0;
+      return named && named.senderId === message.senderId ? { ...message, senderName: named.name } : message;
+    }) };
+  }
+  __name(withStubNames, "withStubNames");
   function forgetStubReads(conversationId) {
     for (const key2 of stubReads.keys()) if (key2.startsWith(`${conversationId}\0`)) stubReads.delete(key2);
   }
@@ -8823,6 +8871,7 @@ function createEndpoint(options) {
     } catch {
       return false;
     }
+    for (const stub of stubs) if (typeof stub.id === "string" && due.includes(stub.id)) rememberStubName(conversationId, { ...stub, id: stub.id });
     return store.transaction(async (tx) => {
       let changed = false;
       for (const stub of stubs) {
@@ -9491,6 +9540,13 @@ function createEndpoint(options) {
           createdAt: timestamp,
           updatedAt: timestamp
         };
+        if (normalized.action === "start_conversation") {
+          const opener = normalized.body.opener;
+          if (opener?.withheld && typeof opener.messageId === "string") {
+            const pending = await tx.get(`${openerPrefix()}/${encodeURIComponent(opener.messageId)}`);
+            if (pending?.start?.operationId === operationId) created.openerFingerprint = pending.openerFingerprint;
+          }
+        }
         return commitOperationRecord(tx, created);
       }, "commitOperation");
       const operation = sensitive ? await store.transaction(async (tx) => {
@@ -9667,7 +9723,7 @@ function createEndpoint(options) {
             const room = normalized.conversationId, read = /* @__PURE__ */ __name(() => mlsDevGroups.queryTextHistory(room, name, normalized), "read");
             const history = await read();
             const shown = (history.messages ?? []).map((entry) => entry.id).filter((id2) => typeof id2 === "string");
-            return await recoverMlsDevMessageActions(room, shown) ? await read() : history;
+            return withStubNames(room, await recoverMlsDevMessageActions(room, shown) ? await read() : history);
           }
         }
         if (name === "get_runtime_card_state" && await mlsDevInteractionRoom(normalized.conversationId, false)) {
@@ -9743,6 +9799,7 @@ function createEndpoint(options) {
     },
     async startWithheldOpener(input) {
       assertOpen();
+      input = copyJson(input);
       await initialization;
       if (typeof input.messageId !== "string" || !input.messageId || typeof input.text !== "string")
         throw new EndpointError("Invalid deferred opening line", { status: 400, code: "INVALID_DEFERRED_OPENER", retryable: false });
@@ -9753,9 +9810,16 @@ function createEndpoint(options) {
         opener: { withheld: true, messageId: input.messageId },
         ...input.selection ? { selection: copyJson(input.selection) } : {}
       };
+      const openerFingerprint = await hash3(canonicalEndpointJson([body, input.text]));
       const recordKey = `${openerPrefix()}/${encodeURIComponent(input.messageId)}`;
       await store.transaction(async (tx) => {
         await assertCurrentInstallation(tx);
+        const operation = await tx.get(key(operationId));
+        if (operation) {
+          if (operation.openerFingerprint !== openerFingerprint)
+            throw new EndpointError("Opening line ID was already used for different content", { status: 409, code: "OPERATION_ID_COLLISION", retryable: false, operationId });
+          return;
+        }
         const existing = await tx.get(recordKey);
         if (existing && (existing.text !== input.text || canonicalEndpointJson(existing.start?.body) !== canonicalEndpointJson(body)))
           throw new EndpointError("Opening line ID was already used for different content", { status: 409, code: "OPERATION_ID_COLLISION", retryable: false, operationId });
@@ -9764,6 +9828,7 @@ function createEndpoint(options) {
           messageId: input.messageId,
           text: input.text,
           requestId: null,
+          openerFingerprint,
           operationId: `send-opener-${digest.slice(0, 48)}`,
           start: { operationId, body }
         });
@@ -10096,7 +10161,7 @@ async function acquireAgentEndpoint(input) {
   }
   const requestedMls = input.options.mlsDev;
   const mls = requestedMls ? await (async () => {
-    const crypto2 = await import("./mls-crypto-D5YAGYJ3.js");
+    const crypto2 = await import("./mls-crypto-Y44BOSEM.js");
     const configuration = crypto2.parseMlsDevClientConfiguration(requestedMls.configuration);
     if (configuration.environmentId !== environmentId || baseUrl !== CANON_RUNTIME_ENDPOINT_DEFAULTS[configuration.environmentId]?.apiBaseUrl || configuration.principalIds && !configuration.principalIds.includes(input.principalId) || !Number.isSafeInteger(input.ownershipVersion) || input.ownershipVersion < 0) throw new Error("MLS_DEV_AGENT_CONFIGURATION_BINDING_MISMATCH");
     const custody = requestedMls.custody;
@@ -14097,6 +14162,7 @@ function getCodexImagePath(attachment) {
 __name(getCodexImagePath, "getCodexImagePath");
 
 export {
+  NodeMlsDevCustodyError,
   createNodeMlsDevCustody,
   createPortableNodeMlsDevCustody,
   resolveCanonRuntimeConnection,

package/dist/chunks/{mls-crypto-D5YAGYJ3.js → mls-crypto-Y44BOSEM.js}

@@ -2,7 +2,7 @@ import {
   createMlsDevCredentialVerifier,
   mlsDevDeviceHttpConfiguration,
   parseMlsDevClientConfiguration
-} from "./chunk-5MI6Q3VS.js";
+} from "./chunk-C2WJT3VX.js";
 export {
   createMlsDevCredentialVerifier,
   mlsDevDeviceHttpConfiguration,

package/dist/cli.js

@@ -9,6 +9,7 @@ import {
   codexDriver,
   connectorDriver,
   createRunner,
+  defaultMlsDevice,
   errandJournal,
   errandsDirectory,
   loadClaudeQuery,
@@ -22,7 +23,7 @@ import {
   runnerLockName,
   startRelayChannel,
   writeRelayCredential
-} from "./chunks/chunk-JCBQCO3F.js";
+} from "./chunks/chunk-3KFVBOVI.js";
 import {
   CanonApiError,
   CanonClient,
@@ -33,11 +34,11 @@ import {
   resolveCanonRuntimeConnection,
   runCli,
   verifyCanonRuntimeConnection
-} from "./chunks/chunk-RFNYPZXD.js";
+} from "./chunks/chunk-TFSURFF6.js";
 import {
   __name,
   isCanonClientVersion
-} from "./chunks/chunk-5MI6Q3VS.js";
+} from "./chunks/chunk-C2WJT3VX.js";
 
 // src/cli.ts
 import { realpathSync } from "node:fs";
@@ -66,9 +67,9 @@ Usage:
   canon-agent run --driver codex [--cwd <dir>] [--model <id>] [--sandbox <mode>]
                   [--approval-policy <policy>] [--codex-path <path>] [--profile <name>]
                   [--environment <id>]
-  canon-agent run --driver connector --relay-config <path> --mls-dev-config <path>
+  canon-agent run --driver connector --relay-config <path> [--mls-dev-config <path>]
                   [--profile <name>] [--environment <id>]
-  canon-agent mls --action <action> --mls-dev-config <path> [--room <id>]
+  canon-agent mls --action <action> [--mls-dev-config <path>] [--room <id>]
                   [--relay-config <path>] [--profile <name>] [--environment <id>]
   canon-agent tell --room <id> --text <text> (--agent <id> | --profile <name>)
                   [--environment <id>] [--wait]
@@ -80,10 +81,12 @@ Usage:
   canon-agent errands [--follow] [--cancel <errand id>] (--agent <id> | --profile <name>)
                   [--environment <id>]
 
-Every run command also takes --mls-dev-config <path>, which gives the agent its MLS
-device so it can take part in encrypted rooms. Without it, the agent refuses encrypted
-rooms and logs each one once; where Canon encrypts every new conversation, it does not
-start.
+Encrypted rooms need the agent's MLS device. On macOS (Apple silicon) and Linux
+(x64, arm64) the runner keeps it in $CANON_HOME with the custody helper this package
+ships, and sets it up on the agent's first start: nothing to configure. Every run
+command also takes --mls-dev-config <path>, an operator's own custody instead. With
+neither, the agent refuses encrypted rooms, and where Canon encrypts every new
+conversation it does not start.
 
 Team rooms (an owner's agents working together): claude and codex also take
 [--instructions <file>] [--trust-agent <agentId>]...; every run command takes
@@ -146,20 +149,22 @@ Flags:
                          marks destructive (Claude Code's default-to-no prompts,
                          Codex's risky commands and deletions) for the rest of the
                          session. Off by default: each such action asks.
-  --relay-config <path>  connector (Dev only): run as Canon's class-C relay for one agent
+  --relay-config <path>  connector: run as Canon's class-C relay for one agent
                          connected through Canon's MCP connector. A private JSON file
                          naming the agent, where the channel to Canon's Functions
                          listens, and the path of the channel secret. Canon delivers
                          the relay's own credential over that channel when the owner
                          enables the relay (no API key is used); it is kept in
                          $CANON_HOME/relay. The relay serves only encrypted rooms,
-                         which are then not end-to-end encrypted to that agent. With
-                         "mls", it sets up the relay's device with that credential.
-  --mls-dev-config <p>   The operator's MLS configuration: an absolute path to a private
-                         JSON file with the environment's issuer pins and the custody
-                         helper (no keys or credentials).
-  --action <action>      mls: status (public device state), provision (create the
-                         portable vault, once), enroll, renew, publish (this device's
+                         which are then not end-to-end encrypted to that agent. It sets
+                         up the relay's device with that credential.
+  --mls-dev-config <p>   An operator's own MLS configuration, instead of the device the
+                         runner keeps itself: an absolute path to a private JSON file
+                         with the environment's issuer pins and the custody helper (no
+                         keys or credentials).
+  --action <action>      mls: status (public device state), setup (whatever is left of
+                         provision then enroll), provision (create the portable vault,
+                         once), enroll, renew, publish (this device's
                          KeyPackage for --room) or refresh (catch up --room). It never
                          starts a model, and uses the same home as "run": stop the
                          agent first.
@@ -232,7 +237,6 @@ async function main() {
   }
   if (values.driver === "code" && !values.module) throw new UsageError("--driver code needs --module <path>.");
   if (values.driver === "connector" !== !!values["relay-config"]) throw new UsageError("--relay-config goes with --driver connector, which needs it.");
-  if (values.driver === "connector" && !values["mls-dev-config"]) throw new UsageError("--driver connector needs --mls-dev-config <path>: the relay holds the agent's MLS device.");
   if (!["claude", "codex"].includes(values.driver) && (values.instructions !== void 0 || values["trust-agent"]?.length)) {
     throw new UsageError("--instructions and --trust-agent go with --driver claude or codex.");
   }
@@ -254,7 +258,7 @@ async function main() {
   if (trustedAgents.some((id) => !/^[\w.:-]{1,200}$/.test(id))) throw new UsageError("--trust-agent takes an agent id.");
   const instructions = values.instructions !== void 0 ? await loadInstructions(resolve(values.instructions)) : void 0;
   const { environmentId, home, profile, apiKey } = await settings(values);
-  const mls = values["mls-dev-config"] ? await loadMlsDevConfiguration(values["mls-dev-config"], { environmentId }) : void 0;
+  const mls = await mlsDevice(values, environmentId, home);
   const baseUrl = process.env.CANON_BASE_URL || profile?.baseUrl;
   const streamUrl = process.env.CANON_STREAM_URL || profile?.streamUrl;
   let driver;
@@ -352,7 +356,8 @@ async function runRelay(values, team) {
     channel.serve(void 0);
     await current?.stop();
     current = void 0;
-    const mls = await loadMlsDevConfiguration(values["mls-dev-config"], { environmentId });
+    const mls = await mlsDevice(values, environmentId, relayRunnerHome(home, stored2.installationId));
+    if (!mls) throw new Error(`this host has no MLS custody helper (${process.platform}-${process.arch}): give the relay --mls-dev-config <path>`);
     const driver = connectorDriver();
     const runner = await createRunner({
       apiKey: stored2.credential,
@@ -455,11 +460,15 @@ async function settings(values, { key = true } = {}) {
   return { environmentId, home, profile, apiKey: process.env.CANON_API_KEY || profile?.apiKey || "" };
 }
 __name(settings, "settings");
+async function mlsDevice(values, environmentId, home) {
+  if (values["mls-dev-config"]) return loadMlsDevConfiguration(values["mls-dev-config"], { environmentId });
+  return defaultMlsDevice(home, environmentId);
+}
+__name(mlsDevice, "mlsDevice");
 async function mlsSetup(values) {
   const action = values.action;
   if (!action || !MLS_SETUP_ACTIONS.includes(action)) throw new UsageError(`--action must be one of ${MLS_SETUP_ACTIONS.join(", ")}.`);
   if ((action === "publish" || action === "refresh") !== !!values.room) throw new UsageError("--room is needed for publish and refresh, and only for them.");
-  if (!values["mls-dev-config"]) throw new UsageError("--mls-dev-config <path> is required.");
   const settled = await settings(values, { key: !values["relay-config"] });
   const { environmentId, profile } = settled;
   const relay = values["relay-config"] ? await loadRelayConfiguration(values["relay-config"], { environmentId }) : void 0;
@@ -469,7 +478,8 @@ async function mlsSetup(values) {
   }
   const apiKey = stored ? stored.credential : settled.apiKey;
   const home = stored ? relayRunnerHome(settled.home, stored.installationId) : settled.home;
-  const config = await loadMlsDevConfiguration(values["mls-dev-config"], { environmentId });
+  const config = await mlsDevice(values, environmentId, home);
+  if (!config) throw new Error(`@canonmsg/agent-sdk ships no MLS custody helper for ${process.platform}-${process.arch}: give --mls-dev-config <path>.`);
   let client;
   let lock;
   try {
@@ -489,7 +499,7 @@ async function mlsSetup(values) {
     });
     const me = await client.getAgentMe();
     lock = acquireLock(runnerLockName(environmentId, me.agentId), home);
-    console.log(JSON.stringify(await runMlsDevSetup(await client.getEndpoint(), action, values.room, config.provision)));
+    console.log(JSON.stringify(await runMlsDevSetup(await client.getEndpoint(), action, values.room, config.provision, config.provisioned)));
   } finally {
     try {
       await client?.close();

package/dist/drivers/connector.d.ts

@@ -10,7 +10,7 @@ export interface ConnectorInbox {
     /**
      * The first claim gets `runAllowed` and the turn's input, once Canon confirms the agent may still act on it (its
      * membership and the room's audience, read now, never from a hint); a repeat gets its state, never the input again.
-     * A claim that cannot be confirmed by `deadline` (epoch ms) is refused as busy and the input stays pending.
+     * A claim not confirmed by `deadline` (epoch ms) is busy; retry the same request id to finish that confirmation.
      */
     claim(inputId: string, requestId: string, options?: {
         deadline?: number;
@@ -27,8 +27,9 @@ export interface ConnectorDriver extends RuntimeDriver {
 /**
  * The `connector` driver: the runtime is an assistant its provider runs (ChatGPT, Claude.ai and the like), reached
  * through Canon's remote MCP connector, so a turn waits, as one pending input, for the assistant to claim it and answer
- * through the connector's pickup tools (spec §11.3). It keeps no timer: an assistant that never answers is the runner's
- * no-progress deadline, which a claim restarts. It never calls Canon itself; the relay channel calls its inbox, and the
- * runner confirms each claim with Canon.
+ * through the connector's pickup tools (spec §11.3). Such an assistant acts only when its user prompts it, so an input
+ * waits as long as it takes: the runner submits it, and starts its no-progress deadline, only at the claim. The driver
+ * keeps no timer. It never calls Canon itself; the relay channel calls its inbox, and the runner confirms (and submits)
+ * each claim with Canon.
  */
 export declare function connectorDriver(): ConnectorDriver;

package/dist/index.d.ts

@@ -3,6 +3,8 @@ export type { Runner, RunnerOptions } from './runner/runner.js';
 export { ConnectorRelayError, DriverSessionError } from './runner/types.js';
 export { loadMlsDevConfiguration, MLS_SETUP_ACTIONS, mlsDevRoomPackageId, runMlsDevSetup } from './runner/mls.js';
 export type { MlsSetupAction, RunnerMlsOptions } from './runner/mls.js';
+export { bundledMlsCustodyHelper, MLS_ENVIRONMENT_PINS } from './runner/mls-bundled.js';
+export { managedMlsDevice, type ManagedMlsDevice, type ManagedMlsDeviceOptions } from './runner/mls-managed.js';
 export type { ActivityEvent, AskAnswer, AskRequest, DriverCapabilities, DriverResult, DriverState, DriverTurn, ErrandFacts, RuntimeDriver, ToolDefinition, ToolResult, TurnInput, TurnInputMessage, TurnTools, } from './runner/types.js';
 export { errandJournal, errandsDirectory, queueErrand } from './runner/errands.js';
 export type { ErrandCommand, ErrandInput, ErrandKind, ErrandRecord, ErrandStatus } from './runner/errands.js';

package/dist/index.js

@@ -1,7 +1,9 @@
 import {
   ConnectorRelayError,
   DriverSessionError,
+  MLS_ENVIRONMENT_PINS,
   MLS_SETUP_ACTIONS,
+  bundledMlsCustodyHelper,
   checkCodex,
   claudeDriver,
   codeDriver,
@@ -13,12 +15,13 @@ import {
   loadClaudeQuery,
   loadMlsDevConfiguration,
   loadRelayConfiguration,
+  managedMlsDevice,
   mlsDevRoomPackageId,
   queueErrand,
   runMlsDevSetup,
   runtimeDescriptor,
   startRelayChannel
-} from "./chunks/chunk-JCBQCO3F.js";
+} from "./chunks/chunk-3KFVBOVI.js";
 import {
   CanonApiError,
   DEFAULT_ANTHROPIC_REQUEST_HEADROOM_BYTES,
@@ -43,8 +46,8 @@ import {
   toAnthropicImageBlock,
   toAnthropicImageBlocksWithinBudget,
   uploadMediaFile
-} from "./chunks/chunk-RFNYPZXD.js";
-import "./chunks/chunk-5MI6Q3VS.js";
+} from "./chunks/chunk-TFSURFF6.js";
+import "./chunks/chunk-C2WJT3VX.js";
 export {
   CanonApiError,
   ConnectorRelayError,
@@ -55,7 +58,9 @@ export {
   MAX_ANTHROPIC_IMAGE_RAW_BYTES,
   MAX_ANTHROPIC_REQUEST_BYTES,
   MAX_CANON_MEDIA_BYTES,
+  MLS_ENVIRONMENT_PINS,
   MLS_SETUP_ACTIONS,
+  bundledMlsCustodyHelper,
   checkCodex,
   claudeDriver,
   clearPendingRegistration,
@@ -74,6 +79,7 @@ export {
   loadClaudeQuery,
   loadMlsDevConfiguration,
   loadRelayConfiguration,
+  managedMlsDevice,
   materializeAttachment,
   materializeMessageMedia,
   materializeReplyContextMedia,

package/dist/internal/backend-contracts/connectorRelay.d.ts

@@ -1,3 +1,4 @@
+import type { DirectConversationSelection } from './communication.js';
 /**
  * The class-C relay (docs/design/agent-runner.md §11): a Canon-operated process that relays a connector agent's
  * encrypted rooms, holding an MLS device for the agent and decrypting and re-encrypting messages for the assistant (which
@@ -108,6 +109,14 @@ export type ConnectorRelayRequest = {
         messageId: string;
         text: string;
     };
+} | {
+    op: 'start';
+    args: {
+        targetUserId: string;
+        messageId: string;
+        text: string;
+        selection?: DirectConversationSelection;
+    };
 } | {
     op: 'credential';
     args: ConnectorRelayCredentialDelivery;
@@ -172,6 +181,31 @@ export interface ConnectorRelaySent {
     historyMessageId: string;
     status: 'sent' | 'pending';
 }
+/**
+ * A start (§11.5): the relay's device founds (or finds) the encrypted room and sends the opening line itself, as any
+ * device does with a withheld opener. `messageId` is the start's identity, as for a send; `historyMessageId` is the
+ * opening line's id in the room. `starting`: the outcome is unresolved, including whether local recording completed;
+ * retry with the same `messageId` until a terminal answer. Canon's answers otherwise: `messaged` (the line is going into `conversationId`),
+ * `requested` or `pending` (it goes once the request is approved), `blocked` or `unavailable`.
+ */
+export type ConnectorRelayStarted = {
+    messageId: string;
+    historyMessageId: string;
+} & ({
+    status: 'messaged';
+    conversationId: string;
+    created?: boolean;
+    reused?: boolean;
+} | {
+    status: 'requested' | 'pending';
+    requestId: string;
+    conversationId?: string;
+} | {
+    status: 'starting';
+} | {
+    status: 'blocked' | 'unavailable';
+    reason: string;
+});
 export declare class ConnectorRelayRequestError extends Error {
     name: string;
 }

package/dist/internal/backend-contracts/endpoint.d.ts

@@ -97,7 +97,7 @@ export interface EndpointCapabilities {
     actions: string[];
     queries: string[];
     maintenance: boolean;
-    /** Only for a principal eligible for MLS here: how new rooms are born (functions `rollout.ts`, `CANON_MLS_DEV_ROOMS`). */
+    /** Only while MLS is on here, where every valid principal is eligible: how new rooms are born (functions `devActivation.ts`). */
     mls?: {
         eligible: true;
         roomMode: 'default';

package/dist/internal/backend-contracts/endpointContentPolicy.d.ts

@@ -8,6 +8,11 @@ export type EndpointContentLane = 'operation.request' | 'operation.receipt' | 'q
  * authenticated encrypted protocol before they can operate on a protected room.
  * Their routing fields remain public metadata; classification is not authority. */
 export declare const MLS_DEV_UNSUPPORTED_CONTENT_ACTIONS: readonly ["forward_message"];
+/** Operations that send their private content to a named processor in an encrypted room too, disclosed where the
+ * app offers them, with the fields reviewed for that: an image's description and source photo go through Canon to
+ * Google (image-generation.md). The fields stay classified as private; only the encrypted room's plaintext fence lets
+ * them through, and any other field still keeps the operation out. */
+export declare const MLS_DEV_DISCLOSED_PROCESSING_FIELDS: Readonly<Record<string, readonly string[]>>;
 export declare const ENDPOINT_CONTENT_ACTIONS: readonly ["mls_application", "mls_group_control", "initialize_endpoint", "append_artifact_command", "retain_artifact_asset", "sync_phone_contacts", "update_agent_behavior_policy", "update_conversation_agent_behavior_policy", "send_message", "delete_message", "forward_message", "react", "verb_execute", "send_contextual_message", "create_interaction", "consume_interaction", "start_conversation", "create_conversation", "add_member", "remove_member", "leave_conversation", "update_member_role", "update_conversation", "rename_conversation", "update_topic", "update_group_avatar", "mark_read", "cancel_queued_message", "set_conversation_preferences", "set_block", "save_contact", "remove_contact", "respond_interaction", "session_control", "approve_contact_request", "reject_contact_request", "cancel_direct_request", "update_message_disposition", "create_upload", "finalize_upload", "delete_upload", "retry_video_processing", "stage_media_message", "cancel_media_message", "renew_media_message_upload", "finalize_memo_stream", "abort_memo_stream", "create_voice_session", "join_voice_session", "decline_voice_session", "end_voice_session", "consume_runtime_signal", "consume_runtime_primitive", "generate_image"];
 export declare const ENDPOINT_CONTENT_FUNCTION_QUERIES: readonly ["mls_group_feed", "mls_group_controls", "mls_group_admissions", "mls_interactions", "list_artifacts", "get_artifact_log", "get_artifact_asset", "discover_agents", "get_unread_summary", "peek_runtime_signal", "list_runtime_primitives", "get_agent_behavior_policy", "get_conversation_agent_behavior_policy", "get_ephemeral", "list_voice_sessions", "list_contact_requests", "list_conversations", "list_messages", "get_messages", "admission_fences", "list_contacts", "get_contact", "get_members", "resolve_admission", "resolve_group_admission", "get_runtime_card_state", "conversation", "conversation_changes", "get_upload", "get_media_message", "get_voice_session", "get_image_generation", "get_image_generation_status", "same_owner_agents"];
 export declare const ENDPOINT_CONTENT_QUERIES: readonly ["mls_group_feed", "mls_group_controls", "mls_group_admissions", "mls_interactions", "list_artifacts", "get_artifact_log", "get_artifact_asset", "discover_agents", "get_unread_summary", "peek_runtime_signal", "list_runtime_primitives", "get_agent_behavior_policy", "get_conversation_agent_behavior_policy", "get_ephemeral", "list_voice_sessions", "list_contact_requests", "list_conversations", "list_messages", "get_messages", "admission_fences", "list_contacts", "get_contact", "get_members", "resolve_admission", "resolve_group_admission", "get_runtime_card_state", "conversation", "conversation_changes", "get_upload", "get_media_message", "get_voice_session", "get_image_generation", "get_image_generation_status", "same_owner_agents", "admit_messages"];

package/dist/internal/endpoint/engine.d.ts

@@ -67,6 +67,8 @@ export interface EndpointOperation {
     preparedContent?: PreparedContent;
     /** Authored-input collision check, never recorded for memory-only answers. */
     inputFingerprint?: string;
+    /** Local-only binding of a withheld start's text; retained after the opener is sent or its payload is erased. */
+    openerFingerprint?: string;
     receipt?: EndpointOperationReceipt;
     attempts: number;
     attempted: boolean;
@@ -196,7 +198,9 @@ export interface Endpoint {
         text: string;
         requestId?: string | null;
     }): Promise<void>;
-    /** Persist the opening line before starting a room; recover the start through its durable receipt. */
+    /**
+     * Persist the opening line before starting a room; recover the start through its durable receipt.
+     */
     startWithheldOpener(input: Omit<StartDirectInput, 'opener'> & {
         messageId: string;
         text: string;

package/dist/internal/endpoint/mls-dev-client.d.ts

@@ -17,6 +17,11 @@ export interface MlsDevDeviceClientOptions {
 /** Explicit synthetic Dev operations. No timers, eager enrollment or room authority. */
 export interface MlsDevDeviceClient {
     read(): Promise<MlsDevDeviceView>;
+    /** Read only committed local device state, without discovering or waiting for its remote alias.
+     * Returns undefined when no local device exists. Used to capture the device before logout erases it. */
+    read(options: {
+        localOnly: true;
+    }): Promise<MlsDevDeviceView | undefined>;
     /** Ensure local registration; an existing view is not an online status check. */
     enroll(): Promise<MlsDevDeviceView>;
     renew(): Promise<MlsDevDeviceView>;
@@ -28,6 +33,10 @@ export interface MlsDevDeviceClient {
      * current credential is valid, a failed renewal returns it and is retried
      * after a minute. Never creates an unrequested enrollment. */
     ensureReady(): Promise<MlsDevDeviceView>;
+    /** Retire this registered device at Canon for good (`POST /revoke`): it can no longer authenticate, renew or be offered
+     * to a room, and readiness refuses it. A device Canon never registered has
+     * nothing to revoke; a revoked one is returned as it is. Rooms keep its leaf until Canon can remove devices (step 5c). */
+    revoke(): Promise<MlsDevDeviceView>;
 }
 /** Whether readiness would renew this registered device: it has no credential, or less than half its lifetime remains. */
 export declare function isMlsDevCredentialRenewalDue(view: MlsDevDeviceView, now: number): boolean;

package/dist/media.js

@@ -18,8 +18,8 @@ import {
   toAnthropicImageBlock,
   toAnthropicImageBlocksWithinBudget,
   uploadMediaFile
-} from "./chunks/chunk-RFNYPZXD.js";
-import "./chunks/chunk-5MI6Q3VS.js";
+} from "./chunks/chunk-TFSURFF6.js";
+import "./chunks/chunk-C2WJT3VX.js";
 export {
   DEFAULT_ANTHROPIC_REQUEST_HEADROOM_BYTES,
   DEFAULT_MEDIA_CACHE_DIR,