@canonmsg/agent-sdk 12.4.1 → 12.6.1

package/dist/chunks/{mls-crypto-LGPCXM3K.js → mls-crypto-4DZT2UFH.js}

@@ -2,7 +2,8 @@ import {
   createMlsDevCredentialVerifier,
   mlsDevDeviceHttpConfiguration,
   parseMlsDevClientConfiguration
-} from "./chunk-GWQF4WFT.js";
+} from "./chunk-QK37HAHC.js";
+import "./chunk-S7BV74DN.js";
 export {
   createMlsDevCredentialVerifier,
   mlsDevDeviceHttpConfiguration,

package/dist/cli.js

@@ -1,30 +1,33 @@
 #!/usr/bin/env node
 import {
   MLS_SETUP_ACTIONS,
-  assertPrivateHome,
+  acpDriver,
   awaitErrand,
-  bundledMlsCustodyHelper,
+  checkAcp,
   checkCodex,
   claudeDriver,
   codeDriver,
   codexDriver,
   connectorDriver,
   createRunner,
+  defaultMlsDevice,
   errandJournal,
   errandsDirectory,
   loadClaudeQuery,
   loadInstructions,
   loadMlsDevConfiguration,
   loadRelayConfiguration,
-  managedMlsDevice,
   queueErrand,
   readRelayCredential,
   relayRunnerHome,
   runMlsDevSetup,
-  runnerLockName,
   startRelayChannel,
   writeRelayCredential
-} from "./chunks/chunk-NXL4C2R6.js";
+} from "./chunks/chunk-DAJ7L7TN.js";
+import {
+  assertPrivateHome,
+  runnerLockName
+} from "./chunks/chunk-HH7KR22P.js";
 import {
   CanonApiError,
   CanonClient,
@@ -35,12 +38,13 @@ import {
   resolveCanonRuntimeConnection,
   runCli,
   verifyCanonRuntimeConnection
-} from "./chunks/chunk-6PKXASSK.js";
+} from "./chunks/chunk-5J4YPLNW.js";
+import "./chunks/chunk-FVYKLH6I.js";
+import "./chunks/chunk-QK37HAHC.js";
 import {
   __name,
-  isCanonClientVersion,
-  isMlsEnvironmentId
-} from "./chunks/chunk-GWQF4WFT.js";
+  isCanonClientVersion
+} from "./chunks/chunk-S7BV74DN.js";
 
 // src/cli.ts
 import { realpathSync } from "node:fs";
@@ -69,6 +73,8 @@ Usage:
   canon-agent run --driver codex [--cwd <dir>] [--model <id>] [--sandbox <mode>]
                   [--approval-policy <policy>] [--codex-path <path>] [--profile <name>]
                   [--environment <id>]
+  canon-agent run --driver acp [--cwd <dir>] [--guest-mode <id> | --unguarded-guests]
+                  [--profile <name>] [--environment <id>] -- <agent command> [args]
   canon-agent run --driver connector --relay-config <path> [--mls-dev-config <path>]
                   [--profile <name>] [--environment <id>]
   canon-agent mls --action <action> [--mls-dev-config <path>] [--room <id>]
@@ -83,17 +89,18 @@ Usage:
   canon-agent errands [--follow] [--cancel <errand id>] (--agent <id> | --profile <name>)
                   [--environment <id>]
 
-Encrypted rooms need the agent's MLS device. On macOS (Apple silicon) and Linux
-(x64, arm64) the runner keeps it in $CANON_HOME with the custody helper this package
-ships, and sets it up on the agent's first start: nothing to configure. Every run
-command also takes --mls-dev-config <path>, an operator's own custody instead. With
-neither, the agent refuses encrypted rooms, and where Canon encrypts every new
-conversation it does not start.
+Encrypted rooms need the agent's MLS device. The runner keeps it in $CANON_HOME and sets
+it up on the agent's first start: nothing to configure. On macOS (Apple silicon) and
+glibc Linux (x64, arm64) it uses the custody helper this package ships; on Windows,
+Intel Macs and musl Linux, this package's WASM core. Every run command also takes
+--mls-dev-config <path>, an operator's own custody instead. With none of these, the
+agent refuses encrypted rooms, and where Canon encrypts every new conversation it does
+not start.
 
-Team rooms (an owner's agents working together): claude and codex also take
+Team rooms (an owner's agents working together): claude, codex and acp also take
 [--instructions <file>] [--trust-agent <agentId>]...; every run command takes
 [--agent-turn-cap <n>] [--mention-alias <name>]..., which apply in encrypted rooms.
-code, claude and codex take [--allow-session-for-destructive] for encrypted cards.
+code, claude, codex and acp take [--allow-session-for-destructive] for encrypted cards.
 
 Errands: tell, post and errand direct a running agent from the machine it runs on:
 whoever can write $CANON_HOME commands it, and the CLI itself uses no network. tell
@@ -107,10 +114,12 @@ local (canon-agent errands). Canon's policies, blocks and rate limits apply as t
 message from the agent.
 
 Flags:
-  --driver <name>        The runtime driver: "code", "claude", "codex" or "connector".
+  --driver <name>        The runtime driver: "code", "claude", "codex", "acp" or
+                         "connector". acp runs any agent that speaks the Agent Client
+                         Protocol over stdio, named after --: -- goose acp.
   --module <path>        code: an ES module whose default export answers a turn.
                          Its directory is one the agent may send files from.
-  --cwd <dir>            claude, codex: the directory the runtime works in (default:
+  --cwd <dir>            claude, codex, acp: the directory the runtime works in (default:
                          the current one). The agent may send files from it.
   --model <id>           claude, codex: the model (default: the runtime's).
   --permission-mode <m>  claude: "default" puts each tool call Claude Code would ask
@@ -126,12 +135,20 @@ Flags:
                          Turns holding anyone else's message are always read-only,
                          approve nothing and get only Canon's tools.
   --codex-path <path>    codex: the Codex CLI (default: codex on the PATH).
-  --instructions <file>  claude, codex: standing instructions from the owner (a role,
-                         say), appended to the runtime's system or developer
-                         instructions. A UTF-8 file of at most 32 KiB, owned by you
+  --guest-mode <id>      acp: the agent's own read-only session mode, for turns holding
+                         anyone else's message, such as chat on Goose. Without this
+                         the agent is not started for such a turn, and the person
+                         is told it takes only its owner's messages.
+  --unguarded-guests     acp: run such turns under the agent's own policy instead. The
+                         driver only refuses permission requests and stops a turn
+                         if the agent reports a machine tool, so an agent that runs
+                         tools unasked runs them on this machine for anyone.
+  --instructions <file>  claude, codex, acp: standing instructions from the owner (a role,
+                         say), added to the runtime's system or developer
+                         instructions, or to a session's first prompt. A UTF-8 file of at most 32 KiB, owned by you
                          and not writable by others, read once at start; never sent
                          to Canon.
-  --trust-agent <id>     claude, codex: an agent of the same owner whose messages count
+  --trust-agent <id>     claude, codex, acp: an agent of the same owner whose messages count
                          as the owner's for tool use (repeat for several), only in a
                          room whose other members are all listed agents that Canon
                          confirms at each turn as active agents of this agent's
@@ -194,15 +211,17 @@ Flags:
 Environment:
   CANON_API_KEY          The agent's key (or use --profile).
   CANON_ENVIRONMENT_ID   Required; a profile from another environment is refused.
-  CANON_HOME             Agent state, default ~/.canon. It must be private (0700).
+  CANON_HOME             Agent state, default ~/.canon. It must be private (0700; on
+                         Windows, only you, SYSTEM and Administrators in its access list).
   ANTHROPIC_API_KEY      claude: use this API key instead of a Claude subscription
                          login. The claude driver needs @anthropic-ai/claude-agent-sdk.
   OPENAI_API_KEY         codex: use this API key instead of Codex's own login, unless
                          Codex is configured for another model provider.
 
 SIGTERM or Ctrl-C stops taking messages, lets running turns finish for 10 seconds,
-then stops them.`;
-var AVAILABLE = ["code", "claude", "codex", "connector"];
+then stops them. Windows has no SIGTERM: use Ctrl-C or Ctrl-Break, which is what a
+service wrapper such as NSSM sends. Closing the console gives far less time.`;
+var AVAILABLE = ["code", "claude", "codex", "acp", "connector"];
 var PERMISSION_MODES = ["default", "acceptEdits", "bypassPermissions"];
 var SANDBOXES = ["workspace-write", "read-only", "danger-full-access"];
 var APPROVAL_POLICIES = ["on-request", "untrusted", "never"];
@@ -227,7 +246,7 @@ async function main() {
     throw new UsageError(error instanceof Error ? error.message : String(error));
   }
   const { values, positionals } = parsed;
-  if (!["run", "mls", "tell", "post", "errand", "errands"].includes(positionals[0] ?? "") || positionals.length > 1) {
+  if (!["run", "mls", "tell", "post", "errand", "errands"].includes(positionals[0] ?? "") || positionals.length > 1 && positionals[0] !== "run") {
     throw new UsageError('Expected the "run", "mls", "tell", "post", "errand" or "errands" command.');
   }
   if (positionals[0] === "mls") return mlsSetup(values);
@@ -239,9 +258,13 @@ async function main() {
   }
   if (values.driver === "code" && !values.module) throw new UsageError("--driver code needs --module <path>.");
   if (values.driver === "connector" !== !!values["relay-config"]) throw new UsageError("--relay-config goes with --driver connector, which needs it.");
-  if (!["claude", "codex"].includes(values.driver) && (values.instructions !== void 0 || values["trust-agent"]?.length)) {
-    throw new UsageError("--instructions and --trust-agent go with --driver claude or codex.");
+  if (!["claude", "codex", "acp"].includes(values.driver) && (values.instructions !== void 0 || values["trust-agent"]?.length)) {
+    throw new UsageError("--instructions and --trust-agent go with --driver claude, codex or acp.");
   }
+  const [agentCommand, ...agentArgs] = positionals.slice(1);
+  if (values.driver === "acp" !== !!agentCommand) throw new UsageError("--driver acp needs its agent's command after --, and only it takes one: canon-agent run --driver acp -- goose acp.");
+  if (values.driver !== "acp" && (values["guest-mode"] !== void 0 || values["unguarded-guests"])) throw new UsageError("--guest-mode and --unguarded-guests go with --driver acp.");
+  if (values["guest-mode"] !== void 0 && values["unguarded-guests"]) throw new UsageError("--guest-mode and --unguarded-guests are alternatives.");
   const team = teamOptions(values);
   if (values.driver === "connector" && values["allow-session-for-destructive"]) throw new UsageError("--allow-session-for-destructive goes with a driver that asks.");
   if (values.driver === "connector") return runRelay(values, team);
@@ -284,6 +307,20 @@ async function main() {
       ...approvalPolicy ? { approvalPolicy } : {},
       ...instructions ? { instructions } : {}
     });
+  } else if (values.driver === "acp") {
+    const cwd = resolve(values.cwd ?? ".");
+    const agent = await checkAcp({ command: agentCommand, args: agentArgs, cwd });
+    console.error(`canon-agent: ${agent.name}${agent.version ? ` ${agent.version}` : ""} speaks the Agent Client Protocol; ${agent.sessionMemory === "native" ? "it keeps each room's session" : "it keeps no session, so prompts carry recent history"}.`);
+    driver = acpDriver({
+      command: agentCommand,
+      args: agentArgs,
+      cwd,
+      sessionMemory: agent.sessionMemory,
+      ...values["guest-mode"] ? { guestMode: values["guest-mode"] } : {},
+      ...values["unguarded-guests"] ? { unguardedGuests: true } : {},
+      ...instructions ? { instructions } : {}
+    });
+    if (!values["guest-mode"] && !values["unguarded-guests"]) console.error("canon-agent: it takes only its owner's messages. To let others reach it, give --guest-mode with a read-only mode of the agent's own.");
   } else {
     const modulePath = realpathSync(resolve(values.module));
     const handler = (await import(pathToFileURL(modulePath).href)).default;
@@ -427,6 +464,8 @@ function parse() {
       sandbox: { type: "string" },
       "approval-policy": { type: "string" },
       "codex-path": { type: "string" },
+      "guest-mode": { type: "string" },
+      "unguarded-guests": { type: "boolean" },
       "mls-dev-config": { type: "string" },
       action: { type: "string" },
       room: { type: "string" },
@@ -464,9 +503,7 @@ async function settings(values, { key = true } = {}) {
 __name(settings, "settings");
 async function mlsDevice(values, environmentId, home) {
   if (values["mls-dev-config"]) return loadMlsDevConfiguration(values["mls-dev-config"], { environmentId });
-  if (!isMlsEnvironmentId(environmentId)) return void 0;
-  const helper = bundledMlsCustodyHelper();
-  return helper ? managedMlsDevice({ home, environmentId, helper }) : void 0;
+  return defaultMlsDevice(home, environmentId);
 }
 __name(mlsDevice, "mlsDevice");
 async function mlsSetup(values) {
@@ -577,6 +614,7 @@ function stopOnSignals(stop) {
   }, "onSignal");
   process.on("SIGTERM", onSignal);
   process.on("SIGINT", onSignal);
+  if (process.platform === "win32") for (const signal of ["SIGBREAK", "SIGHUP"]) process.on(signal, onSignal);
 }
 __name(stopOnSignals, "stopOnSignals");
 runCli(import.meta.url, main, (error) => {

package/dist/drivers/acp.d.ts

@@ -0,0 +1,56 @@
+import { type DriverCapabilities, type RuntimeDriver } from '../runner/types.js';
+export interface AcpDriverOptions {
+    /** The agent's executable, e.g. `goose`, found on the PATH. */
+    command: string;
+    /** Its arguments, e.g. `['acp']`. */
+    args?: string[];
+    /** The directory the agent works in. The agent may also send files from it. */
+    cwd: string;
+    /**
+     * `native` when the agent keeps a session across its processes; `none` (the default) makes every prompt carry the recent
+     * history. `checkAcp` reports which one an agent is.
+     */
+    sessionMemory?: DriverCapabilities['sessionMemory'];
+    /**
+     * What a turn holding a message from anyone but the owner or a confirmed trusted agent of the owner does. By default the
+     * agent is not started and the person is told it takes only its owner's messages, because nothing here can limit what
+     * an arbitrary agent runs. `guestMode` runs it in that session mode instead: a read-only mode of the agent's own, such
+     * as `chat` on Goose. Such a turn fails if the agent refuses the mode.
+     */
+    guestMode?: string;
+    /**
+     * Run such a turn under the agent's own policy, with no mode. The driver then only refuses permission requests and stops
+     * the turn when the agent reports a machine tool running: an agent that does neither runs what the message asks, on
+     * this machine. Only for an agent whose developer has limited it some other way.
+     */
+    unguardedGuests?: boolean;
+    /**
+     * The owner's standing instructions for this agent (its role, say), added to the first prompt of a session after Canon's
+     * own framing, since the protocol has no system prompt. At most 32 KiB; the CLI reads them from `--instructions <file>`.
+     */
+    instructions?: string;
+    /** How long a cancelled agent may take to stop, and an agent with its input closed to exit (default 5 s). */
+    interruptGraceMs?: number;
+}
+/** What `initialize` told the driver about an agent. */
+export interface AcpAgent {
+    name: string;
+    version: string;
+    sessionMemory: DriverCapabilities['sessionMemory'];
+}
+/** Checks the agent starts and speaks the protocol; the CLI calls it at startup so a wrong command fails at once. */
+export declare function checkAcp({ command, args, cwd, timeoutMs }: Pick<AcpDriverOptions, 'command' | 'args' | 'cwd'> & {
+    timeoutMs?: number;
+}): Promise<AcpAgent>;
+/**
+ * Runs an agent that speaks the Agent Client Protocol (v1, JSON-RPC over stdio), which most coding agents do. Each turn is
+ * one process that restores the room's session, whose id the runner keeps in the driver state, and exits after the turn:
+ * Canon's tool URL and token change per turn, and a session takes its MCP servers only when opened. Stop cancels the
+ * native turn and closes a process that does not stop. A room's next turn starts only after the previous process has exited.
+ *
+ * Unlike the claude and codex drivers, this one cannot configure a sandbox: what runs on the machine is the agent's own
+ * policy, which its developer sets. So a turn holding anyone else's message runs only if the owner chose how (`guestMode`
+ * or `unguardedGuests`), approves nothing, and stops when the agent reports a machine tool running or leaves that mode.
+ * Only the mode is a real limit, since the agent enforces it; the rest depends on what the agent reports.
+ */
+export declare function acpDriver(options: AcpDriverOptions): RuntimeDriver;

package/dist/drivers/codex.d.ts

@@ -1,4 +1,5 @@
 import { type DriverTurn, type RuntimeDriver } from '../runner/types.js';
+import { type Json } from './subprocess.js';
 export interface CodexDriverOptions {
     /** The directory Codex works in. The agent may also send files from it. */
     cwd: string;
@@ -22,7 +23,6 @@ export interface CodexDriverOptions {
     /** How long an interrupted Codex may take to stop before its process is closed (default 5 s). */
     interruptGraceMs?: number;
 }
-type Json = Record<string, unknown>;
 /** Checks the Codex CLI runs at all; the CLI calls it at startup so a missing install fails at once. */
 export declare function checkCodex(codexPath?: string): string;
 /**
@@ -43,4 +43,3 @@ export declare function answerCodexRequest(turn: DriverTurn, method: string, par
  * does not stop. A room's next turn starts only after the previous process has exited.
  */
 export declare function codexDriver(options: CodexDriverOptions): RuntimeDriver;
-export {};

package/dist/drivers/connector.d.ts

@@ -10,7 +10,7 @@ export interface ConnectorInbox {
     /**
      * The first claim gets `runAllowed` and the turn's input, once Canon confirms the agent may still act on it (its
      * membership and the room's audience, read now, never from a hint); a repeat gets its state, never the input again.
-     * A claim that cannot be confirmed by `deadline` (epoch ms) is refused as busy and the input stays pending.
+     * A claim not confirmed by `deadline` (epoch ms) is busy; retry the same request id to finish that confirmation.
      */
     claim(inputId: string, requestId: string, options?: {
         deadline?: number;
@@ -27,8 +27,9 @@ export interface ConnectorDriver extends RuntimeDriver {
 /**
  * The `connector` driver: the runtime is an assistant its provider runs (ChatGPT, Claude.ai and the like), reached
  * through Canon's remote MCP connector, so a turn waits, as one pending input, for the assistant to claim it and answer
- * through the connector's pickup tools (spec §11.3). It keeps no timer: an assistant that never answers is the runner's
- * no-progress deadline, which a claim restarts. It never calls Canon itself; the relay channel calls its inbox, and the
- * runner confirms each claim with Canon.
+ * through the connector's pickup tools (spec §11.3). Such an assistant acts only when its user prompts it, so an input
+ * waits as long as it takes: the runner submits it, and starts its no-progress deadline, only at the claim. The driver
+ * keeps no timer. It never calls Canon itself; the relay channel calls its inbox, and the runner confirms (and submits)
+ * each claim with Canon.
  */
 export declare function connectorDriver(): ConnectorDriver;

package/dist/drivers/subprocess.d.ts

@@ -0,0 +1,35 @@
+import type { spawn } from 'node:child_process';
+import type { AskRequest, DriverTurn } from '../runner/types.js';
+/** What the drivers of runtimes that run as a child process share. */
+export type Json = Record<string, unknown>;
+export declare const isRecord: (value: unknown) => value is Json;
+export declare const text: (value: unknown) => string;
+export declare const oneLine: (value: string, max: number) => string;
+export declare const RISKY: RegExp;
+/**
+ * A turn holding a message from anyone but the owner, or an agent the runner confirmed as the owner's trusted teammate,
+ * is someone else's: coalesced follow-ups count too.
+ */
+export declare const guestTurn: (turn: DriverTurn) => boolean;
+/**
+ * RUN-25: one native approval request becomes one `approve` ask. The runner answers a repeated ask id once, so the id also
+ * carries what is asked: two requests on one item never share an answer.
+ */
+export declare function approve(turn: DriverTurn, request: Omit<Extract<AskRequest, {
+    kind: 'approve';
+}>, 'kind'>): Promise<"stopped" | "once" | "session" | "denied">;
+export interface StdioRpcOptions {
+    /** The runtime's name, for a refusal that carries no message. */
+    name: string;
+    /** Sent on every message: `{ jsonrpc: '2.0' }` where the runtime's protocol requires it. */
+    envelope?: Json;
+}
+/** JSON-RPC over a child's stdio: one line per message. A refusal rejects with the runtime's numeric `code`. */
+export declare function stdioRpc(child: ReturnType<typeof spawn>, handlers: {
+    notify(method: string, params: Json): void;
+    request(method: string, params: Json, id: unknown): Promise<unknown>;
+}, { name, envelope }: StdioRpcOptions): {
+    call: (method: string, params: Json) => Promise<Json>;
+    notify: (method: string, params?: Json) => void;
+    fail(error: Error): void;
+};

package/dist/index.d.ts

@@ -3,7 +3,7 @@ export type { Runner, RunnerOptions } from './runner/runner.js';
 export { ConnectorRelayError, DriverSessionError } from './runner/types.js';
 export { loadMlsDevConfiguration, MLS_SETUP_ACTIONS, mlsDevRoomPackageId, runMlsDevSetup } from './runner/mls.js';
 export type { MlsSetupAction, RunnerMlsOptions } from './runner/mls.js';
-export { bundledMlsCustodyHelper, MLS_ENVIRONMENT_PINS } from './runner/mls-bundled.js';
+export { bundledMlsCustodyHelper, bundledMlsWasmCore, MLS_ENVIRONMENT_PINS, type BundledMlsWasmCore } from './runner/mls-bundled.js';
 export { managedMlsDevice, type ManagedMlsDevice, type ManagedMlsDeviceOptions } from './runner/mls-managed.js';
 export type { ActivityEvent, AskAnswer, AskRequest, DriverCapabilities, DriverResult, DriverState, DriverTurn, ErrandFacts, RuntimeDriver, ToolDefinition, ToolResult, TurnInput, TurnInputMessage, TurnTools, } from './runner/types.js';
 export { errandJournal, errandsDirectory, queueErrand } from './runner/errands.js';
@@ -14,6 +14,8 @@ export { claudeDriver, loadClaudeQuery } from './drivers/claude.js';
 export type { ClaudeDriverOptions, ClaudeQuery } from './drivers/claude.js';
 export { checkCodex, codexDriver } from './drivers/codex.js';
 export type { CodexDriverOptions } from './drivers/codex.js';
+export { acpDriver, checkAcp } from './drivers/acp.js';
+export type { AcpAgent, AcpDriverOptions } from './drivers/acp.js';
 export { connectorDriver } from './drivers/connector.js';
 export type { ConnectorDriver, ConnectorInbox } from './drivers/connector.js';
 export { loadRelayConfiguration, startRelayChannel } from './runner/relay.js';

package/dist/index.js

@@ -3,7 +3,10 @@ import {
   DriverSessionError,
   MLS_ENVIRONMENT_PINS,
   MLS_SETUP_ACTIONS,
+  acpDriver,
   bundledMlsCustodyHelper,
+  bundledMlsWasmCore,
+  checkAcp,
   checkCodex,
   claudeDriver,
   codeDriver,
@@ -21,7 +24,8 @@ import {
   runMlsDevSetup,
   runtimeDescriptor,
   startRelayChannel
-} from "./chunks/chunk-NXL4C2R6.js";
+} from "./chunks/chunk-DAJ7L7TN.js";
+import "./chunks/chunk-HH7KR22P.js";
 import {
   CanonApiError,
   DEFAULT_ANTHROPIC_REQUEST_HEADROOM_BYTES,
@@ -46,8 +50,10 @@ import {
   toAnthropicImageBlock,
   toAnthropicImageBlocksWithinBudget,
   uploadMediaFile
-} from "./chunks/chunk-6PKXASSK.js";
-import "./chunks/chunk-GWQF4WFT.js";
+} from "./chunks/chunk-5J4YPLNW.js";
+import "./chunks/chunk-FVYKLH6I.js";
+import "./chunks/chunk-QK37HAHC.js";
+import "./chunks/chunk-S7BV74DN.js";
 export {
   CanonApiError,
   ConnectorRelayError,
@@ -60,7 +66,10 @@ export {
   MAX_CANON_MEDIA_BYTES,
   MLS_ENVIRONMENT_PINS,
   MLS_SETUP_ACTIONS,
+  acpDriver,
   bundledMlsCustodyHelper,
+  bundledMlsWasmCore,
+  checkAcp,
   checkCodex,
   claudeDriver,
   clearPendingRegistration,

package/dist/internal/backend-contracts/connectorRelay.d.ts

@@ -1,3 +1,4 @@
+import type { DirectConversationSelection } from './communication.js';
 /**
  * The class-C relay (docs/design/agent-runner.md §11): a Canon-operated process that relays a connector agent's
  * encrypted rooms, holding an MLS device for the agent and decrypting and re-encrypting messages for the assistant (which
@@ -108,6 +109,14 @@ export type ConnectorRelayRequest = {
         messageId: string;
         text: string;
     };
+} | {
+    op: 'start';
+    args: {
+        targetUserId: string;
+        messageId: string;
+        text: string;
+        selection?: DirectConversationSelection;
+    };
 } | {
     op: 'credential';
     args: ConnectorRelayCredentialDelivery;
@@ -172,6 +181,31 @@ export interface ConnectorRelaySent {
     historyMessageId: string;
     status: 'sent' | 'pending';
 }
+/**
+ * A start (§11.5): the relay's device founds (or finds) the encrypted room and sends the opening line itself, as any
+ * device does with a withheld opener. `messageId` is the start's identity, as for a send; `historyMessageId` is the
+ * opening line's id in the room. `starting`: the outcome is unresolved, including whether local recording completed;
+ * retry with the same `messageId` until a terminal answer. Canon's answers otherwise: `messaged` (the line is going into `conversationId`),
+ * `requested` or `pending` (it goes once the request is approved), `blocked` or `unavailable`.
+ */
+export type ConnectorRelayStarted = {
+    messageId: string;
+    historyMessageId: string;
+} & ({
+    status: 'messaged';
+    conversationId: string;
+    created?: boolean;
+    reused?: boolean;
+} | {
+    status: 'requested' | 'pending';
+    requestId: string;
+    conversationId?: string;
+} | {
+    status: 'starting';
+} | {
+    status: 'blocked' | 'unavailable';
+    reason: string;
+});
 export declare class ConnectorRelayRequestError extends Error {
     name: string;
 }

package/dist/internal/backend-contracts/endpoint.d.ts

@@ -97,7 +97,7 @@ export interface EndpointCapabilities {
     actions: string[];
     queries: string[];
     maintenance: boolean;
-    /** Only for a principal eligible for MLS here: how new rooms are born (functions `rollout.ts`, `CANON_MLS_DEV_ROOMS`). */
+    /** Only while MLS is on here, where every valid principal is eligible: how new rooms are born (functions `devActivation.ts`). */
     mls?: {
         eligible: true;
         roomMode: 'default';

package/dist/internal/backend-contracts/endpointContentPolicy.d.ts

@@ -14,8 +14,8 @@ export declare const MLS_DEV_UNSUPPORTED_CONTENT_ACTIONS: readonly ["forward_mes
  * them through, and any other field still keeps the operation out. */
 export declare const MLS_DEV_DISCLOSED_PROCESSING_FIELDS: Readonly<Record<string, readonly string[]>>;
 export declare const ENDPOINT_CONTENT_ACTIONS: readonly ["mls_application", "mls_group_control", "initialize_endpoint", "append_artifact_command", "retain_artifact_asset", "sync_phone_contacts", "update_agent_behavior_policy", "update_conversation_agent_behavior_policy", "send_message", "delete_message", "forward_message", "react", "verb_execute", "send_contextual_message", "create_interaction", "consume_interaction", "start_conversation", "create_conversation", "add_member", "remove_member", "leave_conversation", "update_member_role", "update_conversation", "rename_conversation", "update_topic", "update_group_avatar", "mark_read", "cancel_queued_message", "set_conversation_preferences", "set_block", "save_contact", "remove_contact", "respond_interaction", "session_control", "approve_contact_request", "reject_contact_request", "cancel_direct_request", "update_message_disposition", "create_upload", "finalize_upload", "delete_upload", "retry_video_processing", "stage_media_message", "cancel_media_message", "renew_media_message_upload", "finalize_memo_stream", "abort_memo_stream", "create_voice_session", "join_voice_session", "decline_voice_session", "end_voice_session", "consume_runtime_signal", "consume_runtime_primitive", "generate_image"];
-export declare const ENDPOINT_CONTENT_FUNCTION_QUERIES: readonly ["mls_group_feed", "mls_group_controls", "mls_group_admissions", "mls_interactions", "list_artifacts", "get_artifact_log", "get_artifact_asset", "discover_agents", "get_unread_summary", "peek_runtime_signal", "list_runtime_primitives", "get_agent_behavior_policy", "get_conversation_agent_behavior_policy", "get_ephemeral", "list_voice_sessions", "list_contact_requests", "list_conversations", "list_messages", "get_messages", "admission_fences", "list_contacts", "get_contact", "get_members", "resolve_admission", "resolve_group_admission", "get_runtime_card_state", "conversation", "conversation_changes", "get_upload", "get_media_message", "get_voice_session", "get_image_generation", "get_image_generation_status", "same_owner_agents"];
-export declare const ENDPOINT_CONTENT_QUERIES: readonly ["mls_group_feed", "mls_group_controls", "mls_group_admissions", "mls_interactions", "list_artifacts", "get_artifact_log", "get_artifact_asset", "discover_agents", "get_unread_summary", "peek_runtime_signal", "list_runtime_primitives", "get_agent_behavior_policy", "get_conversation_agent_behavior_policy", "get_ephemeral", "list_voice_sessions", "list_contact_requests", "list_conversations", "list_messages", "get_messages", "admission_fences", "list_contacts", "get_contact", "get_members", "resolve_admission", "resolve_group_admission", "get_runtime_card_state", "conversation", "conversation_changes", "get_upload", "get_media_message", "get_voice_session", "get_image_generation", "get_image_generation_status", "same_owner_agents", "admit_messages"];
+export declare const ENDPOINT_CONTENT_FUNCTION_QUERIES: readonly ["mls_group_feed", "mls_group_controls", "mls_group_admissions", "mls_interactions", "mls_devices", "list_artifacts", "get_artifact_log", "get_artifact_asset", "discover_agents", "get_unread_summary", "peek_runtime_signal", "list_runtime_primitives", "get_agent_behavior_policy", "get_conversation_agent_behavior_policy", "get_ephemeral", "list_voice_sessions", "list_contact_requests", "list_conversations", "list_messages", "get_messages", "admission_fences", "list_contacts", "get_contact", "get_members", "resolve_admission", "resolve_group_admission", "get_runtime_card_state", "conversation", "conversation_changes", "get_upload", "get_media_message", "get_voice_session", "get_image_generation", "get_image_generation_status", "same_owner_agents"];
+export declare const ENDPOINT_CONTENT_QUERIES: readonly ["mls_group_feed", "mls_group_controls", "mls_group_admissions", "mls_interactions", "mls_devices", "list_artifacts", "get_artifact_log", "get_artifact_asset", "discover_agents", "get_unread_summary", "peek_runtime_signal", "list_runtime_primitives", "get_agent_behavior_policy", "get_conversation_agent_behavior_policy", "get_ephemeral", "list_voice_sessions", "list_contact_requests", "list_conversations", "list_messages", "get_messages", "admission_fences", "list_contacts", "get_contact", "get_members", "resolve_admission", "resolve_group_admission", "get_runtime_card_state", "conversation", "conversation_changes", "get_upload", "get_media_message", "get_voice_session", "get_image_generation", "get_image_generation_status", "same_owner_agents", "admit_messages"];
 export declare const ENDPOINT_CONTENT_EPHEMERALS: readonly ["prewarm_agents", "create_memo_stream", "publish_presence", "publish_typing", "publish_streaming", "publish_turn", "publish_runtime_status", "publish_session_state", "publish_runtime_info", "publish_runtime_activity", "append_memo_chunk"];
 export declare const ENDPOINT_CONTENT_EPHEMERAL_FAMILIES: readonly ["typing", "streaming", "turn-state", "agent-session", "runtime-card-state", "memo-streams", "runtime-info", "runtime-activity", "runtime-suppression", "runtime-silence", "runtime-attention", "call-attention", "agent-runtime", "presence"];
 export declare const ENDPOINT_CONTENT_EVENTS: readonly ["connected", "heartbeat", "agent.context", "replay.expired", "error", "participation.suppressed", "artifact.changed", "message.created", "message.snapshot", "message.updated", "message.deleted", "message.media_terminal", "conversation.updated", "conversation.changed", "conversation.removed", "conversations.changed", "contacts.changed", "contact.added", "contact.updated", "contact.removed", "presence", "typing", "runtime.updated", "runtime.control", "turn.updated", "voice.session.started", "voice.session.ended", ...string[]];

package/dist/internal/backend-contracts/index.d.ts

@@ -41,6 +41,7 @@ export * from './artifacts.js';
 export * from './artifactActions.js';
 export * from './mlsEnvironment.js';
 export * from './mlsDevEnrollment.js';
+export * from './loggedOutSessions.js';
 export * from './mlsDevCredential.js';
 export * from './mlsDevCredentialReconciliation.js';
 export * from './mlsDevDeviceCustody.js';

package/dist/internal/backend-contracts/loggedOutSessions.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Firebase sessions a device log-out ended (web-mls-device.md, decision 10). Firebase can only revoke every session of an
+ * account, so Canon names each ended one by its sign-in time, which a token refresh keeps, and refuses it.
+ */
+export declare const LOGGED_OUT_SESSIONS_DOCUMENT = "sessions";
+export declare const SESSION_LOGGED_OUT = "SESSION_LOGGED_OUT";
+export declare function isLoggedOutSession(record: unknown, authTime: number): boolean;

package/dist/internal/backend-contracts/mlsDevCredential.d.ts

@@ -1,6 +1,9 @@
 import { type MlsDevEnrollmentDevice } from './mlsDevEnrollment.js';
 import { type MlsEnvironmentId, type MlsIssuerId } from './mlsEnvironment.js';
+/** The lifetime the issuer gives every device. */
 export declare const MLS_DEV_CREDENTIAL_TTL_MS = 86400000;
+/** The other lifetime verifiers accept, for a person's device only. Nothing issues it yet (mls-production-cutover.md §6). */
+export declare const MLS_DEV_CREDENTIAL_LONG_TTL_MS: number;
 export declare const MLS_DEV_CREDENTIAL_CHALLENGE_TTL_MS = 300000;
 export declare const MLS_DEV_CREDENTIAL_MAX_BYTES = 8192;
 export interface MlsDevCredentialClaims {

package/dist/internal/endpoint/engine.d.ts

@@ -67,6 +67,8 @@ export interface EndpointOperation {
     preparedContent?: PreparedContent;
     /** Authored-input collision check, never recorded for memory-only answers. */
     inputFingerprint?: string;
+    /** Local-only binding of a withheld start's text; retained after the opener is sent or its payload is erased. */
+    openerFingerprint?: string;
     receipt?: EndpointOperationReceipt;
     attempts: number;
     attempted: boolean;
@@ -130,6 +132,9 @@ export interface EndpointOptions {
     autoDrain?: boolean;
     /** Explicit synthetic Dev device identity operations, using this endpoint's store and lifecycle. */
     mlsDevDevice?: MlsDevDeviceClientOptions;
+    /** A person's inbox rows show each encrypted room's last message from this device's copy. Never set for an agent: an
+     * inbox read can serve a turn from someone outside that room. */
+    localInboxPreviews?: boolean;
 }
 export type EndpointContentMode = 'plaintext' | 'mls-dev-text' | 'mls-required';
 export interface Endpoint {
@@ -196,7 +201,9 @@ export interface Endpoint {
         text: string;
         requestId?: string | null;
     }): Promise<void>;
-    /** Persist the opening line before starting a room; recover the start through its durable receipt. */
+    /**
+     * Persist the opening line before starting a room; recover the start through its durable receipt.
+     */
     startWithheldOpener(input: Omit<StartDirectInput, 'opener'> & {
         messageId: string;
         text: string;

package/dist/internal/endpoint/mls-dev-client.d.ts

@@ -17,6 +17,11 @@ export interface MlsDevDeviceClientOptions {
 /** Explicit synthetic Dev operations. No timers, eager enrollment or room authority. */
 export interface MlsDevDeviceClient {
     read(): Promise<MlsDevDeviceView>;
+    /** Read only committed local device state, without discovering or waiting for its remote alias.
+     * Returns undefined when no local device exists. Used to capture the device before logout erases it. */
+    read(options: {
+        localOnly: true;
+    }): Promise<MlsDevDeviceView | undefined>;
     /** Ensure local registration; an existing view is not an online status check. */
     enroll(): Promise<MlsDevDeviceView>;
     renew(): Promise<MlsDevDeviceView>;
@@ -28,6 +33,12 @@ export interface MlsDevDeviceClient {
      * current credential is valid, a failed renewal returns it and is retried
      * after a minute. Never creates an unrequested enrollment. */
     ensureReady(): Promise<MlsDevDeviceView>;
+    /** Retire this registered device at Canon for good (`POST /revoke`): it can no longer authenticate, renew or be offered
+     * to a room, and readiness refuses it. A device Canon never registered has
+     * nothing to revoke; a revoked one is returned as it is. Rooms keep its leaf until Canon can remove devices (step 5c). */
+    revoke(): Promise<MlsDevDeviceView>;
+    /** Logs out another of this account's devices (its device list); this one leaves through `revoke`. */
+    revokeOther(deviceId: string): Promise<void>;
 }
 /** Whether readiness would renew this registered device: it has no credential, or less than half its lifetime remains. */
 export declare function isMlsDevCredentialRenewalDue(view: MlsDevDeviceView, now: number): boolean;

package/dist/internal/endpoint/mls-dev-text.d.ts

@@ -40,6 +40,9 @@ export declare function putMlsDevTextMessage(tx: EndpointStoreTransaction, value
 /** What a v3 reply quotes from this device's copy of the message it answers, trimmed to the payload's bound: a text, or
  * an item's caption or else what it is. Nothing for a card, a message deleted for everyone, or one not held here. */
 export declare function mlsDevReplyQuote(value: MlsDevLocalTextMessage | undefined, maximum: number): string | undefined;
+/** An inbox page with each last message this device holds in place of Canon's stub. The page is for this person's own
+ * screen: a row then carries a room's plaintext, so it never reaches an HTTP request or an agent's turn. */
+export declare function overlayMlsDevInboxPreviews<T>(tx: EndpointStoreTransaction, page: T): Promise<T>;
 /** `account` opens the stored sender alias to its account (mls-dev-groups.md, erasure privacy). */
 export declare function projectMlsDevTextMessage(value: MlsDevLocalTextMessage, account: MlsDevAccountResolver): Record<string, unknown>;
 /** Opens a stored principal (an alias, with the type its credential gave) to its account. */