@agenticmail/claudecode 0.1.7 → 0.1.9

package/dist/{chunk-YWSO3QOQ.js → chunk-3D5VXS5Y.js}

@@ -121,30 +121,6 @@ function resolveConfig(opts = {}) {
 }
 
 // src/subagent-template.ts
-var ESSENTIAL_TOOL_NAMES = [
-  "whoami",
-  "list_inbox",
-  "read_email",
-  "send_email",
-  "reply_email",
-  "search_emails",
-  "list_agents",
-  "message_agent",
-  // call_agent is the one-shot RPC primitive — sync request, sync answer.
-  // For multi-step coordination use the thread pattern (send_email with
-  // CC + reply_email with replyAll) instead.
-  "call_agent",
-  // wait_for_email is the thread-coordination primitive: block until a
-  // specific reply lands in your inbox (filter by from / subject /
-  // inReplyTo / participants). Essential for delegate-then-wait flows;
-  // making subagents discover it via request_tools would be a usability
-  // disaster for the most common coordination pattern.
-  "wait_for_email",
-  "check_tasks",
-  // Meta-tools — these unlock the other ~50 tools on demand.
-  "request_tools",
-  "invoke"
-];
 var MANAGED_BY_MARKER = "@agenticmail/claudecode";
 function yamlQuote(s) {
   const cleaned = s.replace(/[\r\n]+/g, " ").replace(/\s+/g, " ").trim();
@@ -182,14 +158,15 @@ function renderPersonaBody(input) {
     "",
     "## Operating instructions",
     "",
-    `You start every session with a small **pre-loaded** set of MCP tools (the ones listed in your frontmatter). Everything else AgenticMail offers \u2014 signatures, drafts, templates, SMS, bulk mail ops, folders, scheduling, spam tools, setup wizards, account admin \u2014 is reachable through the two **meta-tools** that are always pre-loaded:`,
+    `You have access to TWO complementary toolsets:`,
     "",
-    `- \`${tool("request_tools")}\` \u2014 Returns a text catalogue of unloaded tools. Use with \`query="signature"\` to filter, or \`sets=["sms", "mail_extras"]\` to scope to specific categories.`,
-    `- \`${tool("invoke")}\` \u2014 Calls any AgenticMail tool by name with structured args. Example: \`${tool("invoke")}({ tool: "manage_signatures", args: { action: "create", name: "default", body: "\u2014\\n${agent.name}" }, _account: "${agent.name}" })\`.`,
+    `1. **AgenticMail MCP tools** (\`${tool("*")}\`) \u2014 your mailbox, contacts, tasks, signatures, drafts, SMS, agent coordination. The full ~62-tool surface; the most common ones (\`${tool("list_inbox")}\`, \`${tool("send_email")}\`, \`${tool("reply_email")}\`, \`${tool("search_emails")}\`, \`${tool("call_agent")}\`, \`${tool("wait_for_email")}\`, \u2026) are pre-loaded. Anything else is reachable via the meta-tools \`${tool("request_tools")}\` (discover) + \`${tool("invoke")}\` (call by name).`,
     "",
-    `**On EVERY tool call you make \u2014 pre-loaded OR via \`invoke\` \u2014 you MUST pass \`_account: "${agent.name}"\`.** This tells the MCP server to authenticate as you, not as the integration's bridge identity. Without it, you'd be reading the bridge's empty inbox instead of your own, sending mail from the wrong address, and bypassing your owner's expectation that the agent named "${agent.name}" did the work.`,
+    `2. **Native Claude Code tools** \u2014 Read, Write, Edit, Bash, Glob, Grep, WebFetch, WebSearch, NotebookEdit, and friends. The same toolset the host session has. Use them when the work actually involves files, code, the shell, or the web \u2014 DO NOT paste source code into an email when you could write the file yourself and tell the team "shipped to ./void_fall.py, runs with python3 void_fall.py". You are a real agent doing real work, not a paste-buffer.`,
     "",
-    `Pre-loaded examples:`,
+    `**On EVERY MCP call you make \u2014 pre-loaded OR via \`invoke\` \u2014 you MUST pass \`_account: "${agent.name}"\`.** This tells the MCP server to authenticate as you, not as the integration's bridge identity. Without it, you'd be reading the bridge's empty inbox instead of your own, sending mail from the wrong address, and bypassing your owner's expectation that the agent named "${agent.name}" did the work. Native tools (Read/Write/Bash/etc.) don't need \`_account\` \u2014 they're not MCP.`,
+    "",
+    `Common MCP examples:`,
     "",
     "```",
     `${tool("list_inbox")}({ _account: "${agent.name}", limit: 10 })`,
@@ -210,7 +187,7 @@ function renderPersonaBody(input) {
     `  1. Read the new message with \`${tool("read_email")}\`.`,
     `  2. Load the rest of the thread with \`${tool("search_emails")}({ subject: "<core subject>", _account: "${agent.name}" })\` and read each prior message. You MUST have full thread context before acting.`,
     `  3. Look at To + CC across the thread \u2014 those are your teammates. They will each be woken on every reply-all just like you were.`,
-    `  4. Decide if it's YOUR turn: are you addressed by name? Is the previous-stage handoff to your role? Is a question pending for you? When in doubt, stay silent \u2014 over-replying creates noise.`,
+    `  4. Decide if it's YOUR turn: are you addressed by name? Is the previous-stage handoff to your role? Is a question pending for you? **If a teammate replied within the last 60 seconds, assume they are handling this turn and stay silent** \u2014 simultaneous replies are noise. When in doubt, stay silent \u2014 over-replying creates noise.`,
     `  5. If yes: \`${tool("reply_email")}({ uid, replyAll: true, text: "...", _account: "${agent.name}" })\`. Sign with your name. If you're handing off, name the next teammate explicitly ("Orion \u2014 over to you, please \u2026"). To bring a new teammate in, just add them to CC.`,
     `  6. If no: \`mark_read\` and return. Silence IS a valid contribution.`,
     "",
@@ -230,14 +207,16 @@ function renderPersonaBody(input) {
     "",
     "## What you can do",
     "",
-    `Anything an AgenticMail account can do. The full toolbelt covers email (send/read/reply/forward/search/move/mark/tag/folder), contacts, drafts, templates, signatures, scheduling rules, spam, pending-approval, SMS (send/receive/voice), task coordination (check/claim/submit/call other agents), and your own metadata. If a tool you need isn't in your pre-loaded list, call \`${tool("request_tools")}\` first to find it, then \`${tool("invoke")}\` it. Never ask for permission to use a tool \u2014 just use it.`,
+    `Anything a real Claude Code agent can do, scoped to your AgenticMail identity. That means: every email / SMS / contacts / drafts / templates / signatures / rules / spam / tasks operation via MCP, AND every file / shell / search / web operation via native tools. If the work involves code \u2014 write the file, run it, debug it, commit it. If the work involves research \u2014 fetch the URLs, read the pages, summarise. Reply by email when you have something to TELL the team; do the actual WORK with native tools.`,
+    "",
+    `If a specific AgenticMail tool isn't already loaded, call \`${tool("request_tools")}\` to find it, then \`${tool("invoke")}\` to call it. Never ask for permission to use a tool \u2014 just use it.`,
     "",
     "## Hard rules",
     "",
-    `- **Always pass \`_account: "${agent.name}"\`** on every \`${tool("*")}\` call.`,
-    `- **Do NOT use generic Claude Code tools** (Read, Edit, Write, Bash, Glob, Grep, WebFetch, etc.). You are operating an email account, not a developer environment. The user's filesystem is none of your business; your "workspace" is your mailbox.`,
+    `- **Always pass \`_account: "${agent.name}"\`** on every \`${tool("*")}\` MCP call. (Native tools \u2014 Read/Write/Bash/etc. \u2014 don't need it.)`,
+    `- **Do real work with the right tool.** If a teammate asks you to implement something, write the file with Write or Edit \u2014 do not paste source code into an email body and call it done. The mail thread is for coordination ("shipped at \`./void_fall.py\`, runs with \`python3 void_fall.py\`, here's a 2-line summary"); the filesystem is for deliverables.`,
     `- **Do not invent email content.** If you didn't read a real message, do not summarise one. If you don't know the answer, check your inbox / contacts / tasks first.`,
-    `- **Do not impersonate other agents.** You are ${agent.name}, and only ${agent.name}. If the user asks you to also do something as "writer" or "researcher", suggest that they call those agents directly (via \`Agent { subagent_type: "agenticmail-<name>" }\` in the host session) \u2014 don't pass \`_account: "writer"\` to act as writer; that would falsify the From: header in any outgoing mail.`,
+    `- **Do not impersonate other agents.** You are ${agent.name}, and only ${agent.name}. If the user asks you to also do something as "writer" or "researcher", suggest that they call those agents directly \u2014 don't pass \`_account: "writer"\` to act as writer; that would falsify the From: header in any outgoing mail.`,
     `- **Respect outbound guard.** If a send is blocked by the AgenticMail outbound guard, tell the user in plain English \u2014 recipient, subject, the specific warnings \u2014 and ask them to approve. Do NOT rewrite the email to evade detection.`,
     "",
     "## Output style",
@@ -247,15 +226,12 @@ function renderPersonaBody(input) {
   ].filter((line) => line !== void 0).join("\n");
 }
 function renderSubagentMarkdown(input) {
-  const { name, agent, mcpServerName } = input;
-  const tool = (n) => `mcp__${mcpServerName}__${n}`;
+  const { name, agent } = input;
   const description = describeAgent(agent);
-  const allowedTools = ESSENTIAL_TOOL_NAMES.map((n) => tool(n)).join(", ");
   const frontmatter = [
     "---",
     `name: ${name}`,
     `description: ${yamlQuote(description)}`,
-    `tools: ${allowedTools}`,
     `model: inherit`,
     `# managed-by: ${MANAGED_BY_MARKER}`,
     `# agenticmail-agent-id: ${agent.id}`,

package/dist/{chunk-WP2ELPRM.js → chunk-52LXPWO7.js}

@@ -9,7 +9,7 @@ import {
   listAccounts,
   renderSubagentMarkdown,
   resolveConfig
-} from "./chunk-YWSO3QOQ.js";
+} from "./chunk-3D5VXS5Y.js";
 
 // src/install.ts
 import { existsSync, mkdirSync, readdirSync, writeFileSync, readFileSync, unlinkSync } from "fs";

package/dist/{chunk-XGBVWZ3M.js → chunk-CQLUFM7N.js}

@@ -7,7 +7,7 @@ import {
   deleteAccount,
   getAccountByName,
   resolveConfig
-} from "./chunk-YWSO3QOQ.js";
+} from "./chunk-3D5VXS5Y.js";
 
 // src/uninstall.ts
 import { existsSync, readdirSync, readFileSync, unlinkSync } from "fs";

package/dist/{chunk-3ZBSRXAK.js → chunk-FBO6F4IC.js}

@@ -2,7 +2,7 @@ import {
   listAccounts,
   renderPersonaBody,
   resolveConfig
-} from "./chunk-YWSO3QOQ.js";
+} from "./chunk-3D5VXS5Y.js";
 
 // src/persona-loader.ts
 import { existsSync, readFileSync } from "fs";
@@ -72,6 +72,18 @@ function isTaskNotificationSubject(subject) {
   }
   return false;
 }
+function threadIdFromSubject(subject) {
+  if (!subject) return "";
+  let s = subject.trim();
+  while (true) {
+    const next = s.replace(/^(re|fwd?|fw)(\[\d+\])?:\s*/i, "");
+    if (next === s) break;
+    s = next;
+  }
+  return s.toLowerCase().trim();
+}
+var DEFAULT_MAX_WAKES_PER_THREAD = 10;
+var DEFAULT_WAKE_WINDOW_MS = 24 * 60 * 60 * 1e3;
 async function runWorker(query, persona, userPrompt, agent, mcpServerName, mcpCommand, mcpArgs, mcpEnv, log, abortSignal) {
   const opts = {
     systemPrompt: persona,
@@ -82,25 +94,25 @@ async function runWorker(query, persona, userPrompt, agent, mcpServerName, mcpCo
         env: mcpEnv
       }
     },
-    // Restrict to MCP tools only — workers should never reach for
-    // Bash / Read / Edit / etc. Listing them avoids accidental leakage.
-    allowedTools: [
-      `mcp__${mcpServerName}__whoami`,
-      `mcp__${mcpServerName}__list_inbox`,
-      `mcp__${mcpServerName}__read_email`,
-      `mcp__${mcpServerName}__send_email`,
-      `mcp__${mcpServerName}__reply_email`,
-      `mcp__${mcpServerName}__search_emails`,
-      `mcp__${mcpServerName}__list_agents`,
-      `mcp__${mcpServerName}__message_agent`,
-      `mcp__${mcpServerName}__call_agent`,
-      `mcp__${mcpServerName}__wait_for_email`,
-      `mcp__${mcpServerName}__check_tasks`,
-      `mcp__${mcpServerName}__claim_task`,
-      `mcp__${mcpServerName}__submit_result`,
-      `mcp__${mcpServerName}__request_tools`,
-      `mcp__${mcpServerName}__invoke`
-    ],
+    // No `allowedTools` restriction.
+    //
+    // Earlier versions of the dispatcher locked workers to MCP-only tools
+    // ("you operate an email account, not a developer environment"). That
+    // was the wrong design: AgenticMail agents are real Claude Code
+    // subagents running under the host's OAuth, and the work humans
+    // delegate to them (write code, run tests, do research, edit files)
+    // demands the full native toolset (Read, Write, Edit, Bash, Glob,
+    // Grep, WebFetch, WebSearch, NotebookEdit, …). Restricting them
+    // turned "Zephyr implements the game" into "Zephyr emails source
+    // code as plaintext and the human has to copy-paste it" — which
+    // defeats the point of having agents in the first place.
+    //
+    // Omitting allowedTools lets the SDK fall through to its defaults
+    // (all built-in tools + every tool exposed by the MCP servers we
+    // declare above). Outbound mail is still guarded by AgenticMail's
+    // own outbound guard (HIGH-severity sends held for owner approval)
+    // and the worker is sandboxed by Claude Code's permission system
+    // just like any other subagent.
     permissionMode: "bypassPermissions",
     abortController: abortSignal ? wrapSignal(abortSignal) : void 0
   };
@@ -168,12 +180,22 @@ function newMailPrompt(agent, event) {
     `     - You were directly asked a question and nobody has answered yet.`,
     `   No if:`,
     `     - The current ask is targeted at a teammate (their turn, not yours).`,
+    `     - **A teammate replied within the last 60 seconds.** They are likely`,
+    `       already handling this turn; jumping in creates simultaneous replies`,
+    `       and confusion. Assume good faith and stay silent unless their reply`,
+    `       was clearly off-target.`,
     `     - You have nothing substantive to add right now.`,
     `   When in doubt, stay silent \u2014 over-replying creates noise. Better to let`,
     `   the right teammate take the turn than to step on theirs.`,
     ``,
-    `5. **If it's your turn \u2014 reply-all so the whole thread sees it.**`,
-    `   reply_email({ uid: ${uid ?? "<uid>"}, replyAll: true, text: "...", _account: "${agent.name}" })`,
+    `5. **If it's your turn \u2014 do the actual work, THEN reply-all about it.**`,
+    `   You have full native tools: Read, Write, Edit, Bash, Glob, Grep, WebFetch,`,
+    `   WebSearch, NotebookEdit, etc. If the task is "implement X", write the file`,
+    `   with Write or Edit and verify with Bash \u2014 do NOT paste source code into an`,
+    `   email body and call it shipped. The thread is for COORDINATION ("done,`,
+    `   see ./foo.py, runs with \`python3 foo.py\`"); the filesystem is for`,
+    `   DELIVERABLES. Then:`,
+    `     reply_email({ uid: ${uid ?? "<uid>"}, replyAll: true, text: "...", _account: "${agent.name}" })`,
     `   Sign with your name. Be substantive but concise. If you are handing off`,
     `   to the next teammate, name them explicitly in your reply ("Orion \u2014 over to you, please \u2026").`,
     ``,
@@ -233,6 +255,15 @@ var Dispatcher = class {
   running = 0;
   waiters = [];
   stopped = false;
+  /**
+   * Wake-budget store, keyed by `${accountId}::${threadId}`. See the
+   * comment block on WakeBudgetEntry for the failure modes this guards.
+   * Pruned opportunistically on each lookup — no separate timer.
+   */
+  wakeBudget = /* @__PURE__ */ new Map();
+  maxWakesPerThread;
+  wakeWindowMs;
+  now;
   constructor(opts = {}) {
     this.cfg = resolveConfig(opts);
     this.maxConcurrent = opts.maxConcurrentWorkers ?? DEFAULT_MAX_CONCURRENT;
@@ -242,10 +273,63 @@ var Dispatcher = class {
     this.query = opts.querySdk ?? defaultQuery();
     this.fetchImpl = opts.fetchImpl ?? globalThis.fetch;
     this.log = opts.log ?? defaultLog;
+    this.maxWakesPerThread = opts.maxWakesPerThread ?? DEFAULT_MAX_WAKES_PER_THREAD;
+    this.wakeWindowMs = opts.wakeWindowMs ?? DEFAULT_WAKE_WINDOW_MS;
+    this.now = opts.nowMs ?? Date.now;
     if (!this.cfg.masterKey) {
       throw new Error("Dispatcher requires AgenticMail master key. Run `agenticmail setup` first.");
     }
   }
+  /**
+   * Charge one wake against the (agent, thread) budget. Returns true
+   * if the wake should proceed, false if the circuit breaker is open.
+   *
+   * Empty threadId means "no thread context" (a fresh standalone email
+   * with no Subject — rare); we always allow those since there is no
+   * thread to runaway on.
+   */
+  chargeWake(accountId, threadId) {
+    if (!threadId) return { ok: true };
+    const key = `${accountId}::${threadId}`;
+    const now = this.now();
+    let entry = this.wakeBudget.get(key);
+    if (entry && now - entry.firstWakeAtMs >= this.wakeWindowMs) {
+      entry = void 0;
+      this.wakeBudget.delete(key);
+    }
+    if (!entry) {
+      entry = { count: 1, firstWakeAtMs: now };
+      this.wakeBudget.set(key, entry);
+      this.maybePruneWakeBudget(now);
+      return { ok: true, count: 1 };
+    }
+    if (entry.count >= this.maxWakesPerThread) {
+      return {
+        ok: false,
+        count: entry.count,
+        mutedUntilMs: entry.firstWakeAtMs + this.wakeWindowMs
+      };
+    }
+    entry.count++;
+    return { ok: true, count: entry.count };
+  }
+  /**
+   * Drop wake-budget entries that have aged out of their window.
+   *
+   * Called inline from chargeWake, but at most once per ~1024 inserts so
+   * the cost stays bounded. We don't need a separate timer because the
+   * Map only grows on real wakes (capped by maxWakesPerThread per pair),
+   * and the prune is O(n) over the current entries — cheap enough.
+   */
+  wakeBudgetInsertsSinceLastPrune = 0;
+  maybePruneWakeBudget(now) {
+    this.wakeBudgetInsertsSinceLastPrune++;
+    if (this.wakeBudgetInsertsSinceLastPrune < 1024) return;
+    this.wakeBudgetInsertsSinceLastPrune = 0;
+    for (const [k, v] of this.wakeBudget) {
+      if (now - v.firstWakeAtMs >= this.wakeWindowMs) this.wakeBudget.delete(k);
+    }
+  }
   async start() {
     this.log("info", `[dispatcher] starting (maxConcurrent=${this.maxConcurrent}, syncEvery=${this.syncIntervalMs}ms)`);
     await this.syncAccounts();
@@ -285,6 +369,13 @@ var Dispatcher = class {
         return;
       }
       if (ch) rememberBounded(ch.seenUids, event.uid);
+      const threadId = threadIdFromSubject(subject);
+      const verdict = this.chargeWake(account.id, threadId);
+      if (!verdict.ok) {
+        const minutesUntil = verdict.mutedUntilMs ? Math.max(0, Math.round((verdict.mutedUntilMs - this.now()) / 6e4)) : 0;
+        this.log("warn", `[dispatcher] wake-budget exhausted for "${account.name}" on thread "${threadId}" (count=${verdict.count}, cap=${this.maxWakesPerThread}); muted for ~${minutesUntil}min. uid=${event.uid}, subject="${subject ?? ""}"`);
+        return;
+      }
       await this.spawnWorker(account, newMailPrompt(account, event), { kind: "new-mail", uid: event.uid });
       return;
     }

package/dist/{chunk-UC63VEBP.js → chunk-V3QMDNTR.js}

@@ -7,7 +7,7 @@ import {
   MANAGED_BY_MARKER,
   getAccountByName,
   resolveConfig
-} from "./chunk-YWSO3QOQ.js";
+} from "./chunk-3D5VXS5Y.js";
 
 // src/status.ts
 import { existsSync, readFileSync, readdirSync } from "fs";

package/dist/{chunk-N43A7EQB.js → chunk-WAUWKOHA.js}

@@ -1,15 +1,15 @@
 import {
   install
-} from "./chunk-WP2ELPRM.js";
+} from "./chunk-52LXPWO7.js";
 import {
   status
-} from "./chunk-UC63VEBP.js";
+} from "./chunk-V3QMDNTR.js";
 import {
   uninstall
-} from "./chunk-XGBVWZ3M.js";
+} from "./chunk-CQLUFM7N.js";
 import {
   AgenticMailApiError
-} from "./chunk-YWSO3QOQ.js";
+} from "./chunk-3D5VXS5Y.js";
 
 // src/http-routes.ts
 import { Router } from "express";

package/dist/cli.js

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 import {
   install
-} from "./chunk-WP2ELPRM.js";
+} from "./chunk-52LXPWO7.js";
 import {
   status
-} from "./chunk-UC63VEBP.js";
+} from "./chunk-V3QMDNTR.js";
 import {
   uninstall
-} from "./chunk-XGBVWZ3M.js";
+} from "./chunk-CQLUFM7N.js";
 import "./chunk-US5FT2UB.js";
 import {
   AgenticMailApiError
-} from "./chunk-YWSO3QOQ.js";
+} from "./chunk-3D5VXS5Y.js";
 
 // src/cli.ts
 var GREEN = (s) => `\x1B[32m${s}\x1B[0m`;

package/dist/dispatcher-bin.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   Dispatcher
-} from "./chunk-3ZBSRXAK.js";
-import "./chunk-YWSO3QOQ.js";
+} from "./chunk-FBO6F4IC.js";
+import "./chunk-3D5VXS5Y.js";
 
 // src/dispatcher-bin.ts
 async function main() {

package/dist/dispatcher.d.ts

@@ -73,6 +73,20 @@ interface DispatcherOptions extends ResolveConfigOptions {
     sseReconnectBaseMs?: number;
     /** Max backoff between SSE reconnect attempts. Default 60s. */
     sseReconnectMaxMs?: number;
+    /**
+     * Max times a single agent is woken on the same thread before the
+     * circuit breaker trips. Default 10. Protects against reply loops,
+     * storms when many agents share a thread, and stuck agents that
+     * keep replying without making progress. Per-(agent, thread).
+     */
+    maxWakesPerThread?: number;
+    /**
+     * Window (ms) for the per-thread wake counter. Default 24h. The
+     * counter resets after this period elapses since the FIRST wake in
+     * the window — wall-clock-relative, not sliding, so a runaway
+     * thread stays muted for the full period (which is what we want).
+     */
+    wakeWindowMs?: number;
     /** Override the Claude Agent SDK `query` function. Used by tests. */
     querySdk?: QueryFn;
     /** Override the global `fetch`. Used by tests. */
@@ -80,6 +94,8 @@ interface DispatcherOptions extends ResolveConfigOptions {
     /** Override the global EventSource. Optional — we don't use EventSource
      *  by default (fetch + reader is simpler). */
     log?: (level: 'info' | 'warn' | 'error', msg: string) => void;
+    /** Override Date.now() — tests use this to advance the budget clock. */
+    nowMs?: () => number;
 }
 /** Minimal Claude Agent SDK query signature we use. */
 interface QueryFn {
@@ -107,7 +123,35 @@ declare class Dispatcher {
     private running;
     private waiters;
     private stopped;
+    /**
+     * Wake-budget store, keyed by `${accountId}::${threadId}`. See the
+     * comment block on WakeBudgetEntry for the failure modes this guards.
+     * Pruned opportunistically on each lookup — no separate timer.
+     */
+    private wakeBudget;
+    private maxWakesPerThread;
+    private wakeWindowMs;
+    private now;
     constructor(opts?: DispatcherOptions);
+    /**
+     * Charge one wake against the (agent, thread) budget. Returns true
+     * if the wake should proceed, false if the circuit breaker is open.
+     *
+     * Empty threadId means "no thread context" (a fresh standalone email
+     * with no Subject — rare); we always allow those since there is no
+     * thread to runaway on.
+     */
+    private chargeWake;
+    /**
+     * Drop wake-budget entries that have aged out of their window.
+     *
+     * Called inline from chargeWake, but at most once per ~1024 inserts so
+     * the cost stays bounded. We don't need a separate timer because the
+     * Map only grows on real wakes (capped by maxWakesPerThread per pair),
+     * and the prune is O(n) over the current entries — cheap enough.
+     */
+    private wakeBudgetInsertsSinceLastPrune;
+    private maybePruneWakeBudget;
     start(): Promise<void>;
     stop(): Promise<void>;
     /** Public for tests — directly hand an event to the routing path. */

package/dist/dispatcher.js

@@ -1,7 +1,7 @@
 import {
   Dispatcher
-} from "./chunk-3ZBSRXAK.js";
-import "./chunk-YWSO3QOQ.js";
+} from "./chunk-FBO6F4IC.js";
+import "./chunk-3D5VXS5Y.js";
 export {
   Dispatcher
 };

package/dist/http-routes.js

@@ -1,11 +1,11 @@
 import {
   createIntegrationRoutes
-} from "./chunk-N43A7EQB.js";
-import "./chunk-WP2ELPRM.js";
-import "./chunk-UC63VEBP.js";
-import "./chunk-XGBVWZ3M.js";
+} from "./chunk-WAUWKOHA.js";
+import "./chunk-52LXPWO7.js";
+import "./chunk-V3QMDNTR.js";
+import "./chunk-CQLUFM7N.js";
 import "./chunk-US5FT2UB.js";
-import "./chunk-YWSO3QOQ.js";
+import "./chunk-3D5VXS5Y.js";
 export {
   createIntegrationRoutes
 };

package/dist/index.js

@@ -1,19 +1,19 @@
 import {
   Dispatcher,
   loadPersonaForAgent
-} from "./chunk-3ZBSRXAK.js";
+} from "./chunk-FBO6F4IC.js";
 import {
   createIntegrationRoutes
-} from "./chunk-N43A7EQB.js";
+} from "./chunk-WAUWKOHA.js";
 import {
   install
-} from "./chunk-WP2ELPRM.js";
+} from "./chunk-52LXPWO7.js";
 import {
   status
-} from "./chunk-UC63VEBP.js";
+} from "./chunk-V3QMDNTR.js";
 import {
   uninstall
-} from "./chunk-XGBVWZ3M.js";
+} from "./chunk-CQLUFM7N.js";
 import "./chunk-US5FT2UB.js";
 import {
   AgenticMailApiError,
@@ -26,7 +26,7 @@ import {
   renderPersonaBody,
   renderSubagentMarkdown,
   resolveConfig
-} from "./chunk-YWSO3QOQ.js";
+} from "./chunk-3D5VXS5Y.js";
 export {
   AgenticMailApiError,
   Dispatcher,

package/dist/install.js

@@ -1,9 +1,9 @@
 import {
   install,
   selectExposableAgents
-} from "./chunk-WP2ELPRM.js";
+} from "./chunk-52LXPWO7.js";
 import "./chunk-US5FT2UB.js";
-import "./chunk-YWSO3QOQ.js";
+import "./chunk-3D5VXS5Y.js";
 export {
   install,
   selectExposableAgents

package/dist/status.js

@@ -1,8 +1,8 @@
 import {
   status
-} from "./chunk-UC63VEBP.js";
+} from "./chunk-V3QMDNTR.js";
 import "./chunk-US5FT2UB.js";
-import "./chunk-YWSO3QOQ.js";
+import "./chunk-3D5VXS5Y.js";
 export {
   status
 };

package/dist/uninstall.js

@@ -1,8 +1,8 @@
 import {
   uninstall
-} from "./chunk-XGBVWZ3M.js";
+} from "./chunk-CQLUFM7N.js";
 import "./chunk-US5FT2UB.js";
-import "./chunk-YWSO3QOQ.js";
+import "./chunk-3D5VXS5Y.js";
 export {
   uninstall
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticmail/claudecode",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Claude Code integration for AgenticMail — surfaces every AgenticMail agent as a native Claude Code subagent so any Claude Code session can delegate to them with the Agent tool",
   "type": "module",
   "main": "dist/index.js",