@factory/droid-sdk
The Factory TypeScript SDK lets applications run Droid, continue conversations, stream work, control tools, and connect to a running Droid daemon.
Installation
npm install @factory/droid-sdk
The SDK requires Node.js 18 or later.
Entrypoints
| Import | Runtime | Purpose |
|---|---|---|
@factory/droid-sdk/node | Node | Start Droid subprocesses, run prompts, manage local sessions, and define SDK MCP tools |
@factory/droid-sdk | Browser or Node | Connect to an existing Droid daemon and use browser-safe schemas, types, and REST helpers |
@factory/droid-sdk/api | Browser or Node | Call any Factory REST API operation through a client generated from the public API spec |
By default, Node session APIs start the droid CLI from PATH and read
FACTORY_API_KEY. A custom executable, API key, or transport can be supplied
through session options.
Quick start
import { run } from '@factory/droid-sdk/node';
const result = await run('Summarize this repository.');
if (!result.success) {
throw new Error(result.error?.message ?? 'The run did not complete.');
}
console.log(result.text);
Use createSession() for multi-turn Node conversations. Use
connectToDaemon() from the root entrypoint to manage sessions through an
existing daemon.
Documentation
The TypeScript SDK documentation is the canonical user-facing guide to:
- Node and daemon runtimes
- Runs, sessions, streaming, attachments, and structured output
- Permissions, AskUser, tools, skills, MCP, and hooks
- Session replacement and cleanup behavior
- Browser and daemon integration
- Observability, REST helpers, advanced resources, and the public API
Runnable examples are available under examples/node and
examples/browser.
Custom transport migration
- Breaking agent-client change:
DroidClientOptions.transportand custom session transports now requireDroidClientTransport, which exchangesJsonRpcMessageobjects throughsendandonMessage. No format marker or runtime detection is needed. - Built-in
ProcessTransportowns its stdio JSON codec. Its directsendandonMessagecallers must now pass and receive objects rather than strings. In-process implementations exchange snapshots without codecs. - For an existing custom
StringFramedDroidClientTransport, explicitly passwithJsonRpcCodec(stringTransport)toDroidClientor session options. The adapter and both interfaces are exported from@factory/droid-sdk/node. Do not wrap an already typed transport. - Breaking daemon-client change: replace
DaemonClient.onMessagewithonTransportMessageand removeJSON.parsefrom callbacks. CustomDaemonClientTransport.sendandmessagelisteners now exchangeJsonRpcMessageobjects. Put codecs inside transports that cross a serialized boundary. External wire formats are unchanged.
Shared display messages
filterMessagesForUIno longer copies messages. A message with nothing to hide comes back as the same object, and a stripped message as a projection that later calls return again. Treat the results as read-only: mutating one changes your input or what later calls return. Replace a message instead of editing it.
Open status values (0.11.0)
RemoteSession['status'],MachineTemplateBuildStatus['status'], andMachineTemplateBuildStatus['failureReason']now accept values a newer server adds instead of failing the response. An exhaustiveswitchover one of them needs a branch for an unknown value.- Those fields of
RemoteSessionSchemaandMachineTemplateBuildStatusSchemaare unions now, not enums:.enumon them is gone, and.optionslists the union's member schemas rather than the known values.
Machine template list (0.11.0)
listMachineTemplatesno longer takeslimitorcursor. The API returns every template in one response, withpagination.hasMorealwaysfalseandpagination.nextCursoralwaysnull.ListMachineTemplatesOptionsdropslimitandcursorbut stays an interface overFactoryApiOptions, so declaration merging into it keeps compiling. An options object literal that passes either field fails typecheck; a variable typed with extra properties compiles, and the helper does not send them.
The canonical SDK guide remains the full API reference.
Browser security
The daemon client currently authenticates with a Factory API key. Browser integration is intended for trusted local tools. Do not ship a Factory API key in a public website, commit it to source control, or put it in a URL.
License
Apache 2.0