@yaklabs-ai/plugin-sdk 0.12.4 → 0.13.0

package/dist/kay-agent-testing.d.ts

@@ -531,7 +531,7 @@ declare interface ExtensionPaths {
 export declare function fauxAuthContext(overrides?: Partial<ExtensionAuthContext>): ExtensionAuthContext;
 
 /** The capability handles a `KayAgentPluginApi` always carries — authority is decided per call. */
-export declare type FauxKayAgentCapabilities = Pick<KayAgentPluginApi, "filesystem" | "network" | "webSession" | "process" | "whiteboard" | "interaction" | "interceptToolCall" | "withJev" | "events" | "time">;
+export declare type FauxKayAgentCapabilities = Pick<KayAgentPluginApi, "network" | "webSession" | "process" | "whiteboard" | "interaction" | "interceptToolCall" | "withJev" | "events" | "time" | "userFiles" | "familyFolder">;
 
 export declare function fauxKayAgentCapabilities(): FauxKayAgentCapabilities;
 
@@ -925,52 +925,14 @@ declare interface KayAgentEvents {
     publish(localId: string, payload: unknown): void;
 }
 
-/**
- * Claim-checked filesystem operations. Paths are root-relative; canonical host paths never cross
- * the seam. Writes are atomic: readers see the old file or the new one, never a partial write. A
- * replace keeps the file's mode but makes a new file, so owner and extended attributes are not
- * carried over. On a volume without hard links an exclusive create can briefly show an empty file.
- */
-declare interface KayAgentFilesystem {
-    readText(location: KayAgentFilesystemLocation): Promise<string>;
-    writeText(location: KayAgentFilesystemLocation, content: string, options?: KayAgentFilesystemWriteOptions): Promise<void>;
-    /** The whole file, or the requested window of it. */
-    readBytes(location: KayAgentFilesystemLocation, range?: KayAgentFilesystemByteRange): Promise<Uint8Array>;
-    writeBytes(location: KayAgentFilesystemLocation, bytes: Uint8Array, options?: KayAgentFilesystemWriteOptions): Promise<void>;
-    mkdir(location: KayAgentFilesystemLocation): Promise<void>;
-    readDir(location: KayAgentFilesystemLocation): Promise<readonly KayAgentFilesystemEntry[]>;
-    stat(location: KayAgentFilesystemLocation): Promise<KayAgentFilesystemStat>;
-    rename(from: KayAgentFilesystemLocation, to: KayAgentFilesystemLocation): Promise<void>;
-    /** Returns the canonical path relative to the selected grant root. */
-    realpath(location: KayAgentFilesystemLocation): Promise<string>;
-}
-
-/** A byte window of a file; `maxBytes` is capped by the host. */
-declare interface KayAgentFilesystemByteRange {
-    readonly offset: number;
-    readonly maxBytes: number;
-}
-
-declare interface KayAgentFilesystemEntry {
-    readonly name: string;
-    readonly kind: "file" | "directory" | "symlink" | "other";
-}
-
-declare interface KayAgentFilesystemLocation {
-    /** Exact `root` selector the host bound for this target, plus a path relative to it. */
-    readonly root: string;
-    readonly path: string;
-}
-
-declare interface KayAgentFilesystemStat {
-    readonly kind: "file" | "directory" | "other";
-    readonly size: number;
-    readonly modifiedAtMs: number;
-}
-
-declare interface KayAgentFilesystemWriteOptions {
-    /** Fail with `already_exists` instead of replacing a file already at the location. */
-    readonly exclusive?: boolean;
+/** This plugin's folder in the session family's shared Whiteboard. */
+declare interface KayAgentFamilyFolder {
+    /**
+     * The folder's absolute path, created on first use. The plugin that owns the Whiteboard gets
+     * the whole family folder; every other plugin gets its own `plugins/<plugin-id>/` inside it.
+     * Undefined outside a session.
+     */
+    path(): Promise<string | undefined>;
 }
 
 declare interface KayAgentInteractionSurfaces {
@@ -1112,11 +1074,8 @@ declare interface KayAgentPluginApi {
         /** Register a whole URI module (a scheme handler that owns its address space, e.g. `drive://`). */
         registerModule(module: UriExtensionModule): void;
     };
-    /**
-     * Always present; each call is checked against `filesystem.read {root}` / `filesystem.write
-     * {root}` for the root it touches, and against the host's binding for that root.
-     */
-    readonly filesystem: KayAgentFilesystem;
+    /** This plugin's folder in the session family's shared Whiteboard, created on first use. Undefined outside a session. */
+    readonly familyFolder: KayAgentFamilyFolder;
     /** Absent unless the `knowledgeSearch` grant is requested and effectively granted. */
     readonly knowledgeSearch?: KayAgentKnowledgeSearch;
     /** Absent unless the `knownResources` grant is requested and effectively granted. */
@@ -1167,6 +1126,13 @@ declare interface KayAgentPluginApi {
      * the same zone-of-record port the session stamp uses; see {@link KayAppTime.snapshot}.
      */
     readonly time: KayAppTime;
+    /**
+     * File I/O in user folders, run by the host on its own worker threads under a deadline and
+     * answered as a typed result. Always present and ungated: it takes absolute paths and checks no
+     * grant, because it adds no authority a plugin's `node:fs` does not already have. What it adds is that a slow or unresponsive folder never blocks the daemon. See
+     * {@link KayAppUserFiles}.
+     */
+    readonly userFiles: KayAppUserFiles;
     /**
      * Publish the plugin's declared events, for example so a default notification rule can tell the
      * user what the agent just did. Always present, like {@link withJev}: there is nothing to
@@ -1471,6 +1437,135 @@ declare interface KayAppTimeSnapshot {
     readonly zoneSource: "host" | "utc-fallback";
 }
 
+declare interface KayAppUserFileEntry {
+    readonly name: string;
+    /** From the directory entry itself: a symlink is reported as `symlink`, never followed. */
+    readonly kind: KayAppUserFileKind;
+}
+
+/**
+ * The plugin-facing user-files contract: file I/O in folders the user owns, done by the host on
+ * its own worker threads.
+ *
+ * Ungated and always present, like `app.paths`. It confers no authority: a plugin runs in the
+ * daemon's process and can call `node:fs` itself. What the door adds is where the work runs. A
+ * `node:fs` sync call blocks the daemon's event loop for as long as the path takes to answer,
+ * which under a macOS-protected folder or on a drive that stopped answering can be a very long
+ * time (kay#11575); an async one holds a thread of the pool the whole daemon shares. The host runs
+ * each request on a dedicated worker, gives it a deadline, and answers a typed result instead of
+ * throwing.
+ *
+ * This is a leaf module. It lives beside both target SDKs, like `time.ts`, so the `kay.agent` SDK
+ * exposes the same door without importing the `kay.app` surface.
+ */
+declare type KayAppUserFileKind = "file" | "directory" | "symlink" | "other";
+
+declare interface KayAppUserFileListing {
+    readonly entries: readonly KayAppUserFileEntry[];
+    /** True when the directory had more entries than `maxEntries`; the rest were not read. */
+    readonly entryLimitReached: boolean;
+}
+
+/**
+ * File I/O in user folders, run by the host off the daemon's main thread. Every path is absolute.
+ * No method rejects; each answers a {@link KayAppUserFilesResult}. This is not a sandbox: it does
+ * not limit which paths a plugin may touch. Added in SDK 0.12.5: a plugin that calls it declares
+ * `compatibility.sdk` `^0.12.5`, so an older Bonsai refuses a directory or repository plugin at
+ * load instead of the call failing.
+ */
+declare interface KayAppUserFiles {
+    /** Follows symlinks. */
+    stat(path: string, options?: KayAppUserFilesCallOptions): Promise<KayAppUserFilesResult<KayAppUserFileStat>>;
+    /** UTF-8. */
+    readText(path: string, options?: KayAppUserFilesReadTextOptions): Promise<KayAppUserFilesResult<string>>;
+    list(path: string, options?: KayAppUserFilesListOptions): Promise<KayAppUserFilesResult<KayAppUserFileListing>>;
+    /** Depth-first below `path`; symlinks are reported, never followed. */
+    walk(path: string, options?: KayAppUserFilesWalkOptions): Promise<KayAppUserFilesResult<KayAppUserFileWalk>>;
+    /** The path with every symlink resolved. */
+    realpath(path: string, options?: KayAppUserFilesCallOptions): Promise<KayAppUserFilesResult<string>>;
+    /**
+     * Creates or replaces a UTF-8 file, not atomically. After `timeout` or `aborted` the write may
+     * still happen.
+     */
+    writeText(path: string, content: string, options?: KayAppUserFilesCallOptions): Promise<KayAppUserFilesResult<null>>;
+    /** Creates the directory and any missing parents; succeeds when it already exists. */
+    mkdir(path: string, options?: KayAppUserFilesCallOptions): Promise<KayAppUserFilesResult<null>>;
+    rename(from: string, to: string, options?: KayAppUserFilesCallOptions): Promise<KayAppUserFilesResult<null>>;
+}
+
+declare interface KayAppUserFilesCallOptions {
+    /** Deadline in milliseconds from the call, waiting included. Default 5000, at most 60000. */
+    readonly timeoutMs?: number;
+    readonly signal?: AbortSignal;
+}
+
+declare interface KayAppUserFilesListOptions extends KayAppUserFilesCallOptions {
+    /** Default 5000, at most 50000. */
+    readonly maxEntries?: number;
+}
+
+declare interface KayAppUserFilesReadTextOptions extends KayAppUserFilesCallOptions {
+    /** A larger file answers `error` with code `EFBIG`. Default 8 MiB, at most 64 MiB. */
+    readonly maxBytes?: number;
+}
+
+/**
+ * Every answer. `missing`: nothing exists at the path (ENOENT). `timeout`: no answer from the path
+ * in time. Its `reason` is `deadline` (this request ran out of time), `cooling-down` (a request at
+ * or above this path timed out recently, so the host did not try) or `saturated` (the host's
+ * workers are stuck on other paths, so it did not try). `aborted`: the caller's signal fired.
+ * `error`: anything else, with the Node error `code` when there is one (`EACCES`, `EISDIR`,
+ * `EFBIG` for a file over `maxBytes`, `EINVAL` for a relative path).
+ */
+declare type KayAppUserFilesResult<T> = {
+    readonly kind: "ok";
+    readonly value: T;
+} | {
+    readonly kind: "missing";
+} | {
+    readonly kind: "timeout";
+    readonly reason: "deadline" | "cooling-down" | "saturated";
+    readonly detail: string;
+} | {
+    readonly kind: "aborted";
+} | {
+    readonly kind: "error";
+    readonly code?: string;
+    readonly detail: string;
+};
+
+declare interface KayAppUserFileStat {
+    /** What the path is after following symlinks; never `symlink`. */
+    readonly kind: "file" | "directory" | "other";
+    /** Bytes. */
+    readonly size: number;
+    /** Milliseconds since the Unix epoch. */
+    readonly modifiedAtMs: number;
+}
+
+declare interface KayAppUserFilesWalkOptions extends KayAppUserFilesCallOptions {
+    /** Default 10000, at most 100000. */
+    readonly maxEntries?: number;
+    /** Deepest level reported; the root's children are depth 1. Default 16, at most 64. */
+    readonly maxDepth?: number;
+    /** Report and descend into dot-prefixed entries. Default true. */
+    readonly includeHidden?: boolean;
+}
+
+declare interface KayAppUserFileWalk {
+    readonly entries: readonly KayAppUserFileWalkEntry[];
+    /** True when the walk stopped at `maxEntries`. */
+    readonly entryLimitReached: boolean;
+    /** True when a directory at `maxDepth` was reported but not descended into. */
+    readonly depthLimitReached: boolean;
+}
+
+declare interface KayAppUserFileWalkEntry {
+    /** Path segments below the walk's root. */
+    readonly segments: readonly string[];
+    readonly kind: KayAppUserFileKind;
+}
+
 declare type KnownApi = "openai-completions" | "mistral-conversations" | "openai-responses" | "azure-openai-responses" | "openai-codex-responses" | "anthropic-messages" | "bedrock-converse-stream" | "google-generative-ai" | "google-vertex" | "pi-messages";
 
 declare type KnownProvider = "amazon-bedrock" | "ant-ling" | "anthropic" | "google" | "google-vertex" | "openai" | "azure-openai-responses" | "openai-codex" | "radius" | "typesafe" | "nvidia" | "deepseek" | "github-copilot" | "xai" | "groq" | "cerebras" | "openrouter" | "vercel-ai-gateway" | "zai" | "zai-coding-cn" | "mistral" | "minimax" | "minimax-cn" | "moonshotai" | "moonshotai-cn" | "huggingface" | "fireworks" | "together" | "baseten" | "opencode" | "opencode-go" | "kimi-coding" | "meta" | "cloudflare-workers-ai" | "cloudflare-ai-gateway" | "qwen-token-plan" | "qwen-token-plan-cn" | "qwen-token-plan-individual" | "xiaomi" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-sgp";

package/dist/kay-agent-testing.js

@@ -135,19 +135,18 @@ var UNWIRED_SURFACE = {
   screenshot: NOT_WIRED,
   open: NOT_WIRED
 };
+var USER_FILE_METHODS = [
+  "stat",
+  "readText",
+  "list",
+  "walk",
+  "realpath",
+  "writeText",
+  "mkdir",
+  "rename"
+];
 function fauxKayAgentCapabilities() {
   return {
-    filesystem: {
-      readText: unwired("filesystem.readText"),
-      writeText: unwired("filesystem.writeText"),
-      readBytes: unwired("filesystem.readBytes"),
-      writeBytes: unwired("filesystem.writeBytes"),
-      mkdir: unwired("filesystem.mkdir"),
-      readDir: unwired("filesystem.readDir"),
-      stat: unwired("filesystem.stat"),
-      rename: unwired("filesystem.rename"),
-      realpath: unwired("filesystem.realpath")
-    },
     network: { fetch: unwired("network.fetch") },
     webSession: {
       request: unwired("webSession.request"),
@@ -191,7 +190,19 @@ function fauxKayAgentCapabilities() {
     // zone-of-record path overrides this handle after the spread.
     time: {
       snapshot: () => ({ nowMs: 0, zone: "UTC", zoneSource: "utc-fallback" })
-    }
+    },
+    // Answers every call `error` naming itself, keeping the real contract's promise never to
+    // reject. A test that exercises a plugin's file I/O overrides this handle after the spread.
+    userFiles: Object.fromEntries(USER_FILE_METHODS.map((name) => [
+      name,
+      async () => ({
+        kind: "error",
+        detail: `userFiles.${name} is not wired in this test double`
+      })
+    ])),
+    // A test double runs outside any session, so it has no family folder — the same answer the
+    // real capability gives. A test that exercises one overrides this handle after the spread.
+    familyFolder: { path: async () => void 0 }
   };
 }
 function defaultTestToolContext() {

package/dist/kay-agent.d.ts

@@ -1273,14 +1273,6 @@ declare type JsonValue_3 = string | number | boolean | null | JsonValue_3[] | {
 
 declare const JsonValue_3: z.ZodType<JsonValue_3>;
 
-/**
- * The root selector the host binds to the session family's shared Whiteboard folder. The plugin
- * that owns the Whiteboard gets the whole folder; every other plugin gets its own
- * `plugins/<plugin-id>/` folder inside it. Calls on it are claims on
- * `filesystem.read`/`filesystem.write` with this `root`, decided like any other.
- */
-export declare const KAY_FAMILY_WHITEBOARD_FILESYSTEM_ROOT = "family-whiteboard";
-
 /** A plugin's Kay agent activation — receives only the brokered {@link KayAgentPluginApi}. */
 export declare type KayAgentActivate = (api: KayAgentPluginApi) => void;
 
@@ -1345,9 +1337,8 @@ export declare interface KayAgentAdvertisementAuthApi {
  * `grant-read-failed` means Kay could not read its own consent store and refused rather than
  * assume — the second is not something a grant prompt fixes.
  *
- * Structurally parallel to {@link KayAgentFilesystemError}: broker handles are declaration-gated,
- * so presence does not imply a current grant or concrete binding. This error says which ordered
- * policy layer refused one specific call.
+ * Broker handles are always present, so presence does not imply a current grant or concrete
+ * binding. This error says which ordered policy layer refused one specific call.
  */
 export declare class KayAgentCapabilityError extends Error {
     readonly refusal: PluginCapabilityRefusalV1;
@@ -1371,59 +1362,14 @@ export declare interface KayAgentEvents {
     publish(localId: string, payload: unknown): void;
 }
 
-/**
- * Claim-checked filesystem operations. Paths are root-relative; canonical host paths never cross
- * the seam. Writes are atomic: readers see the old file or the new one, never a partial write. A
- * replace keeps the file's mode but makes a new file, so owner and extended attributes are not
- * carried over. On a volume without hard links an exclusive create can briefly show an empty file.
- */
-export declare interface KayAgentFilesystem {
-    readText(location: KayAgentFilesystemLocation): Promise<string>;
-    writeText(location: KayAgentFilesystemLocation, content: string, options?: KayAgentFilesystemWriteOptions): Promise<void>;
-    /** The whole file, or the requested window of it. */
-    readBytes(location: KayAgentFilesystemLocation, range?: KayAgentFilesystemByteRange): Promise<Uint8Array>;
-    writeBytes(location: KayAgentFilesystemLocation, bytes: Uint8Array, options?: KayAgentFilesystemWriteOptions): Promise<void>;
-    mkdir(location: KayAgentFilesystemLocation): Promise<void>;
-    readDir(location: KayAgentFilesystemLocation): Promise<readonly KayAgentFilesystemEntry[]>;
-    stat(location: KayAgentFilesystemLocation): Promise<KayAgentFilesystemStat>;
-    rename(from: KayAgentFilesystemLocation, to: KayAgentFilesystemLocation): Promise<void>;
-    /** Returns the canonical path relative to the selected grant root. */
-    realpath(location: KayAgentFilesystemLocation): Promise<string>;
-}
-
-/** A byte window of a file; `maxBytes` is capped by the host. */
-export declare interface KayAgentFilesystemByteRange {
-    readonly offset: number;
-    readonly maxBytes: number;
-}
-
-export declare interface KayAgentFilesystemEntry {
-    readonly name: string;
-    readonly kind: "file" | "directory" | "symlink" | "other";
-}
-
-export declare class KayAgentFilesystemError extends Error {
-    readonly code: KayAgentFilesystemErrorCode;
-    constructor(code: KayAgentFilesystemErrorCode, message: string);
-}
-
-export declare type KayAgentFilesystemErrorCode = "denied" | "invalid_path" | "not_found" | "already_exists" | "not_directory" | "is_directory" | "io_error";
-
-export declare interface KayAgentFilesystemLocation {
-    /** Exact `root` selector the host bound for this target, plus a path relative to it. */
-    readonly root: string;
-    readonly path: string;
-}
-
-export declare interface KayAgentFilesystemStat {
-    readonly kind: "file" | "directory" | "other";
-    readonly size: number;
-    readonly modifiedAtMs: number;
-}
-
-export declare interface KayAgentFilesystemWriteOptions {
-    /** Fail with `already_exists` instead of replacing a file already at the location. */
-    readonly exclusive?: boolean;
+/** This plugin's folder in the session family's shared Whiteboard. */
+export declare interface KayAgentFamilyFolder {
+    /**
+     * The folder's absolute path, created on first use. The plugin that owns the Whiteboard gets
+     * the whole family folder; every other plugin gets its own `plugins/<plugin-id>/` inside it.
+     * Undefined outside a session.
+     */
+    path(): Promise<string | undefined>;
 }
 
 /**
@@ -1573,11 +1519,8 @@ export declare interface KayAgentPluginApi {
         /** Register a whole URI module (a scheme handler that owns its address space, e.g. `drive://`). */
         registerModule(module: UriExtensionModule): void;
     };
-    /**
-     * Always present; each call is checked against `filesystem.read {root}` / `filesystem.write
-     * {root}` for the root it touches, and against the host's binding for that root.
-     */
-    readonly filesystem: KayAgentFilesystem;
+    /** This plugin's folder in the session family's shared Whiteboard, created on first use. Undefined outside a session. */
+    readonly familyFolder: KayAgentFamilyFolder;
     /** Absent unless the `knowledgeSearch` grant is requested and effectively granted. */
     readonly knowledgeSearch?: KayAgentKnowledgeSearch;
     /** Absent unless the `knownResources` grant is requested and effectively granted. */
@@ -1628,6 +1571,13 @@ export declare interface KayAgentPluginApi {
      * the same zone-of-record port the session stamp uses; see {@link KayAppTime.snapshot}.
      */
     readonly time: KayAppTime;
+    /**
+     * File I/O in user folders, run by the host on its own worker threads under a deadline and
+     * answered as a typed result. Always present and ungated: it takes absolute paths and checks no
+     * grant, because it adds no authority a plugin's `node:fs` does not already have. What it adds is that a slow or unresponsive folder never blocks the daemon. See
+     * {@link KayAppUserFiles}.
+     */
+    readonly userFiles: KayAppUserFiles;
     /**
      * Publish the plugin's declared events, for example so a default notification rule can tell the
      * user what the agent just did. Always present, like {@link withJev}: there is nothing to
@@ -1946,6 +1896,135 @@ declare interface KayAppTimeSnapshot {
     readonly zoneSource: "host" | "utc-fallback";
 }
 
+export declare interface KayAppUserFileEntry {
+    readonly name: string;
+    /** From the directory entry itself: a symlink is reported as `symlink`, never followed. */
+    readonly kind: KayAppUserFileKind;
+}
+
+/**
+ * The plugin-facing user-files contract: file I/O in folders the user owns, done by the host on
+ * its own worker threads.
+ *
+ * Ungated and always present, like `app.paths`. It confers no authority: a plugin runs in the
+ * daemon's process and can call `node:fs` itself. What the door adds is where the work runs. A
+ * `node:fs` sync call blocks the daemon's event loop for as long as the path takes to answer,
+ * which under a macOS-protected folder or on a drive that stopped answering can be a very long
+ * time (kay#11575); an async one holds a thread of the pool the whole daemon shares. The host runs
+ * each request on a dedicated worker, gives it a deadline, and answers a typed result instead of
+ * throwing.
+ *
+ * This is a leaf module. It lives beside both target SDKs, like `time.ts`, so the `kay.agent` SDK
+ * exposes the same door without importing the `kay.app` surface.
+ */
+export declare type KayAppUserFileKind = "file" | "directory" | "symlink" | "other";
+
+export declare interface KayAppUserFileListing {
+    readonly entries: readonly KayAppUserFileEntry[];
+    /** True when the directory had more entries than `maxEntries`; the rest were not read. */
+    readonly entryLimitReached: boolean;
+}
+
+/**
+ * File I/O in user folders, run by the host off the daemon's main thread. Every path is absolute.
+ * No method rejects; each answers a {@link KayAppUserFilesResult}. This is not a sandbox: it does
+ * not limit which paths a plugin may touch. Added in SDK 0.12.5: a plugin that calls it declares
+ * `compatibility.sdk` `^0.12.5`, so an older Bonsai refuses a directory or repository plugin at
+ * load instead of the call failing.
+ */
+export declare interface KayAppUserFiles {
+    /** Follows symlinks. */
+    stat(path: string, options?: KayAppUserFilesCallOptions): Promise<KayAppUserFilesResult<KayAppUserFileStat>>;
+    /** UTF-8. */
+    readText(path: string, options?: KayAppUserFilesReadTextOptions): Promise<KayAppUserFilesResult<string>>;
+    list(path: string, options?: KayAppUserFilesListOptions): Promise<KayAppUserFilesResult<KayAppUserFileListing>>;
+    /** Depth-first below `path`; symlinks are reported, never followed. */
+    walk(path: string, options?: KayAppUserFilesWalkOptions): Promise<KayAppUserFilesResult<KayAppUserFileWalk>>;
+    /** The path with every symlink resolved. */
+    realpath(path: string, options?: KayAppUserFilesCallOptions): Promise<KayAppUserFilesResult<string>>;
+    /**
+     * Creates or replaces a UTF-8 file, not atomically. After `timeout` or `aborted` the write may
+     * still happen.
+     */
+    writeText(path: string, content: string, options?: KayAppUserFilesCallOptions): Promise<KayAppUserFilesResult<null>>;
+    /** Creates the directory and any missing parents; succeeds when it already exists. */
+    mkdir(path: string, options?: KayAppUserFilesCallOptions): Promise<KayAppUserFilesResult<null>>;
+    rename(from: string, to: string, options?: KayAppUserFilesCallOptions): Promise<KayAppUserFilesResult<null>>;
+}
+
+export declare interface KayAppUserFilesCallOptions {
+    /** Deadline in milliseconds from the call, waiting included. Default 5000, at most 60000. */
+    readonly timeoutMs?: number;
+    readonly signal?: AbortSignal;
+}
+
+export declare interface KayAppUserFilesListOptions extends KayAppUserFilesCallOptions {
+    /** Default 5000, at most 50000. */
+    readonly maxEntries?: number;
+}
+
+export declare interface KayAppUserFilesReadTextOptions extends KayAppUserFilesCallOptions {
+    /** A larger file answers `error` with code `EFBIG`. Default 8 MiB, at most 64 MiB. */
+    readonly maxBytes?: number;
+}
+
+/**
+ * Every answer. `missing`: nothing exists at the path (ENOENT). `timeout`: no answer from the path
+ * in time. Its `reason` is `deadline` (this request ran out of time), `cooling-down` (a request at
+ * or above this path timed out recently, so the host did not try) or `saturated` (the host's
+ * workers are stuck on other paths, so it did not try). `aborted`: the caller's signal fired.
+ * `error`: anything else, with the Node error `code` when there is one (`EACCES`, `EISDIR`,
+ * `EFBIG` for a file over `maxBytes`, `EINVAL` for a relative path).
+ */
+export declare type KayAppUserFilesResult<T> = {
+    readonly kind: "ok";
+    readonly value: T;
+} | {
+    readonly kind: "missing";
+} | {
+    readonly kind: "timeout";
+    readonly reason: "deadline" | "cooling-down" | "saturated";
+    readonly detail: string;
+} | {
+    readonly kind: "aborted";
+} | {
+    readonly kind: "error";
+    readonly code?: string;
+    readonly detail: string;
+};
+
+export declare interface KayAppUserFileStat {
+    /** What the path is after following symlinks; never `symlink`. */
+    readonly kind: "file" | "directory" | "other";
+    /** Bytes. */
+    readonly size: number;
+    /** Milliseconds since the Unix epoch. */
+    readonly modifiedAtMs: number;
+}
+
+export declare interface KayAppUserFilesWalkOptions extends KayAppUserFilesCallOptions {
+    /** Default 10000, at most 100000. */
+    readonly maxEntries?: number;
+    /** Deepest level reported; the root's children are depth 1. Default 16, at most 64. */
+    readonly maxDepth?: number;
+    /** Report and descend into dot-prefixed entries. Default true. */
+    readonly includeHidden?: boolean;
+}
+
+export declare interface KayAppUserFileWalk {
+    readonly entries: readonly KayAppUserFileWalkEntry[];
+    /** True when the walk stopped at `maxEntries`. */
+    readonly entryLimitReached: boolean;
+    /** True when a directory at `maxDepth` was reported but not descended into. */
+    readonly depthLimitReached: boolean;
+}
+
+export declare interface KayAppUserFileWalkEntry {
+    /** Path segments below the walk's root. */
+    readonly segments: readonly string[];
+    readonly kind: KayAppUserFileKind;
+}
+
 declare const KayPluginManifestV1: z.ZodObject<{
     protocol: z.ZodLiteral<"kay.plugin.v1">;
     id: z.ZodString;
@@ -1981,16 +2060,8 @@ declare const KayPluginManifestV1: z.ZodObject<{
                         localId: z.ZodString;
                         schemes: z.ZodArray<z.ZodString>;
                         displayName: z.ZodOptional<z.ZodString>;
-                        filesystemBacking: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                        filesystemBacking: z.ZodOptional<z.ZodObject<{
                             root: z.ZodLiteral<"dataDir">;
-                        }, z.core.$strict>, z.ZodObject<{
-                            root: z.ZodLiteral<"filesystem">;
-                            selector: z.ZodString;
-                        }, z.core.$strict>], "root">>;
-                        verbs: z.ZodOptional<z.ZodObject<{
-                            writable: z.ZodOptional<z.ZodBoolean>;
-                            editable: z.ZodOptional<z.ZodBoolean>;
-                            deletable: z.ZodOptional<z.ZodBoolean>;
                         }, z.core.$strict>>;
                         authService: z.ZodOptional<z.ZodString>;
                         knownResources: z.ZodOptional<z.ZodLiteral<true>>;
@@ -3332,18 +3403,6 @@ declare const PluginCapabilityRefusalV1: z.ZodObject<{
             origin: z.ZodString;
             pathPrefix: z.ZodString;
         }, z.core.$strict>;
-    }, z.core.$strict>, z.ZodObject<{
-        target: z.ZodLiteral<"kay.agent">;
-        slug: z.ZodLiteral<"filesystem.read">;
-        envelope: z.ZodObject<{
-            root: z.ZodString;
-        }, z.core.$strict>;
-    }, z.core.$strict>, z.ZodObject<{
-        target: z.ZodLiteral<"kay.agent">;
-        slug: z.ZodLiteral<"filesystem.write">;
-        envelope: z.ZodObject<{
-            root: z.ZodString;
-        }, z.core.$strict>;
     }, z.core.$strict>, z.ZodObject<{
         target: z.ZodLiteral<"kay.agent">;
         slug: z.ZodLiteral<"process.spawn">;

package/dist/kay-agent.js

@@ -1374,15 +1374,6 @@ var DelegatedRefreshRejectedError = class extends Error {
 function isDelegatedRefreshRejected(error) {
   return typeof error === "object" && error !== null && error[DELEGATED_REFRESH_REJECTED] === true;
 }
-var KayAgentFilesystemError = class extends Error {
-  code;
-  constructor(code, message) {
-    super(message);
-    this.name = "KayAgentFilesystemError";
-    this.code = code;
-  }
-};
-var KAY_FAMILY_WHITEBOARD_FILESYSTEM_ROOT = "family-whiteboard";
 var KayAgentCapabilityError = class extends Error {
   refusal;
   constructor(refusal, message) {
@@ -1405,9 +1396,7 @@ export {
   DelegatedRefreshRejectedError,
   INTERACTION_CREDENTIAL_GUARD,
   JevCallError,
-  KAY_FAMILY_WHITEBOARD_FILESYSTEM_ROOT,
   KayAgentCapabilityError,
-  KayAgentFilesystemError,
   KayAgentWebSessionError,
   OBSERVATION_MIME,
   PluginApiError,