@agentproto/runtime 5.11.0 → 5.12.0

package/dist/index.mjs

@@ -10389,6 +10389,20 @@ function buildDaemonSelfMountEntry(daemonMcpUrl, opts) {
   ref += `${ref.includes("?") ? "&" : "?"}callerSessionId=${encodeURIComponent(opts.callerSessionId)}`;
   return { name: "agentproto", transport: "http", ref };
 }
+function stampDaemonCallerSessionId(mcpServers, opts) {
+  if (!mcpServers) return void 0;
+  const daemonQ = `${opts.daemonMcpUrl}?`;
+  return mcpServers.map((entry) => {
+    if (entry.transport !== "http" || typeof entry.ref !== "string") return entry;
+    const targetsDaemon = entry.ref === opts.daemonMcpUrl || entry.ref.startsWith(daemonQ);
+    if (!targetsDaemon || entry.ref.includes("callerSessionId=")) return entry;
+    const sep7 = entry.ref.includes("?") ? "&" : "?";
+    return {
+      ...entry,
+      ref: `${entry.ref}${sep7}callerSessionId=${encodeURIComponent(opts.callerSessionId)}`
+    };
+  });
+}
 function slugifyMcpImportName(alias, fallbackId) {
   const slug = alias.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
   return slug || fallbackId;
@@ -10935,16 +10949,9 @@ async function spawnAgentSession(deps2, input) {
     }
   }
   if (daemonMcpUrl && mcpServers) {
-    const daemonQ = `${daemonMcpUrl}?`;
-    mcpServers = mcpServers.map((entry) => {
-      if (entry.transport !== "http" || typeof entry.ref !== "string") return entry;
-      const targetsDaemon = entry.ref === daemonMcpUrl || entry.ref.startsWith(daemonQ);
-      if (!targetsDaemon || entry.ref.includes("callerSessionId=")) return entry;
-      const sep7 = entry.ref.includes("?") ? "&" : "?";
-      return {
-        ...entry,
-        ref: `${entry.ref}${sep7}callerSessionId=${encodeURIComponent(mintedSessionId)}`
-      };
+    mcpServers = stampDaemonCallerSessionId(mcpServers, {
+      daemonMcpUrl,
+      callerSessionId: mintedSessionId
     });
   }
   if (mcpServers === void 0 && parentSessionId && buildOrchestratorMcp && input.orchestrator !== false && input.sandbox === void 0) {
@@ -17288,8 +17295,16 @@ var init_session_end_reason = __esm({
       // `registry.closeWithOutcome`, never a plain `kill()`.
       "steward-completed",
       // verdict:"done" — the steward closed it as finished work.
-      "steward-abandoned"
+      "steward-abandoned",
       // verdict other than "done" — the steward closed it as not completed.
+      // `restartAgentSession` (session-restart-core.ts) minted a fresh-id
+      // continuation while this row was still alive (running/starting) — the
+      // OLD row is superseded (see its `continuedTo`) and closed cleanly here,
+      // never left running alongside its replacement. Deliberate, not a crash:
+      // never eligible for `restart-scheduler.ts`'s crash-restart (status is
+      // "killed", not "error") and never triggers `notifyParentOnCrash`
+      // (`supervisor-notify.ts` gates on `status:"error"`/`reason:"crashed"`).
+      "restarted"
     ];
     PROVIDER_LIMIT_ERROR_RE = /\bhit your (?:session|usage) limit\b/i;
   }
@@ -26383,7 +26398,11 @@ var DELIBERATE_END_REASONS = /* @__PURE__ */ new Set([
   "operator-completed",
   "operator-stopped",
   "steward-completed",
-  "steward-abandoned"
+  "steward-abandoned",
+  // Superseded by a fresh-id restart continuation (session-restart-core.ts)
+  // while still alive — never auto-revive the OLD row, it already has a
+  // living replacement (`continuedTo`).
+  "restarted"
 ]);
 var POLLABLE_STATUSES = /* @__PURE__ */ new Set(["active", "orphaned"]);
 function agentprotoHome3() {
@@ -26601,8 +26620,16 @@ function createSentinelRuntime(opts) {
     try {
       await opts.registry.sendMessage(msg, { source: "sentinel", origin: sentinel.id });
     } catch (err) {
-      if (!(err instanceof SessionNotAliveError)) throw err;
-      await handleDeadSession(sentinel, event, msg);
+      if (err instanceof SessionNotAliveError) {
+        await handleDeadSession(sentinel, event, msg);
+        return;
+      }
+      if (opts.sessionInfo && !opts.isSessionAlive(target.sessionId) && !opts.sessionInfo(target.sessionId)) {
+        parkEvent(sentinel, event, `target session ${target.sessionId} no longer exists`);
+        markOrphaned(sentinel);
+        return;
+      }
+      throw err;
     }
   }
   function checkSubjectTerminalExpiry(sentinel, event) {
@@ -26820,6 +26847,8 @@ function createSentinelRuntime(opts) {
 // src/session-restart-core.ts
 init_resume_strategies();
 init_spawn_defaults();
+init_session_spawn();
+init_session_continue_fresh();
 init_launch_config();
 init_resume_context_digest();
 init_eligibility_manifest();
@@ -27123,9 +27152,25 @@ async function restartAgentSession(registry, resolveAgentAdapter, prev, opts = {
     authSpec = resumeAuth.authSpec;
     authEcho = resumeAuth.authEcho;
   }
+  const buildRestartMcpServers = (newSessionId) => {
+    if (!opts.daemonMcpUrl) {
+      if (prev.mcpServers && prev.mcpServers.length > 0) {
+        console.warn(
+          `[restartAgentSession] no daemonMcpUrl wired for restart of ${prev.id} \u2014 carrying mcpServers forward WITHOUT re-stamping callerSessionId (the restarted session ${newSessionId} will keep speaking to the daemon under the OLD session's identity).`
+        );
+      }
+      return prev.mcpServers;
+    }
+    const stripped = stripOwnCallerStamp(prev.mcpServers, prev.id);
+    return stampDaemonCallerSessionId(stripped, {
+      daemonMcpUrl: opts.daemonMcpUrl,
+      callerSessionId: newSessionId
+    });
+  };
   const spawnWithResume = async (resumeSessionId) => {
     let liveSessionId;
     const restartedSessionId = mintSessionId();
+    const restartMcpServers = buildRestartMcpServers(restartedSessionId);
     if (sandboxId !== void 0) {
       return spawnInSandbox(sandboxId, restartedSessionId);
     }
@@ -27168,7 +27213,7 @@ async function restartAgentSession(registry, resolveAgentAdapter, prev, opts = {
       // Legacy AIP-45 mode: prefer an explicit override; otherwise carry the
       // prior descriptor's mode forward so a plain restart preserves it.
       ...effMode ? { mode: effMode } : {},
-      ...prev.mcpServers ? { mcpServers: prev.mcpServers } : {},
+      ...restartMcpServers ? { mcpServers: restartMcpServers } : {},
       ...authSpec ? { auth: authSpec } : {},
       ...launchConfig.options ? { options: launchConfig.options } : {},
       // Spawn-time guarantees survive a restart: the adapter runs under the
@@ -27202,7 +27247,7 @@ async function restartAgentSession(registry, resolveAgentAdapter, prev, opts = {
       ...resolved.authDescriptor?.provider !== void 0 ? { adapterProvider: resolved.authDescriptor.provider } : {},
       ...resolved.authDescriptor?.modelDerivedApiKey !== void 0 ? { modelDerivedApiKey: resolved.authDescriptor.modelDerivedApiKey } : {},
       ...prev.label ? { label: prev.label } : {},
-      ...prev.mcpServers ? { mcpServers: prev.mcpServers } : {},
+      ...restartMcpServers ? { mcpServers: restartMcpServers } : {},
       ...prevBoundary ? { meta: boundaryMeta(prevBoundary) } : {},
       ...effModel ? { model: effModel } : {},
       // Decomposed config-axis echoes (SPEC §3.7) — carried forward from `prev`
@@ -27228,6 +27273,16 @@ async function restartAgentSession(registry, resolveAgentAdapter, prev, opts = {
       ...prev.origin ? { origin: prev.origin } : {},
       ...prev.parentSessionId ? { parentSessionId: prev.parentSessionId } : {},
       ...prev.depth !== void 0 ? { depth: prev.depth } : {},
+      // Immutable spawn-time flags survive a restart exactly like
+      // `continueAgentSessionFresh` carries `keepAlive`/`notifyParentOnCrash`
+      // forward (session-continue-fresh.ts) — these are never axes a restart
+      // overrides, only inherited, so dropping them here is what let a
+      // persistent supervisor's restart silently become idle-reapable and
+      // lose its crash-detect opt-ins.
+      ...prev.keepAlive ? { keepAlive: true } : {},
+      ...prev.notifyParentOnCrash ? { notifyParentOnCrash: true } : {},
+      ...prev.sentinelAutoWatch === false ? { sentinelAutoWatch: false } : {},
+      ...prev.restartPolicy ? { restartPolicy: prev.restartPolicy } : {},
       // Verifiability echo (never the credential) — see the auth
       // resolution block above. Absent when no credential resolved,
       // same as session-spawn.ts.
@@ -27264,6 +27319,7 @@ async function restartAgentSession(registry, resolveAgentAdapter, prev, opts = {
         `restartAgentSession: sandbox provider "${providerSlug}" not found \u2014 cannot re-attach sandbox "${boxSandboxId}".`
       );
     }
+    const sandboxMcpServers = buildRestartMcpServers(restartedSessionId);
     const spec = { provider: providerSlug, config: {} };
     const lifecyclePolicy = resolveLifecyclePolicy(spec, true);
     let host;
@@ -27293,7 +27349,7 @@ async function restartAgentSession(registry, resolveAgentAdapter, prev, opts = {
         } : {},
         ...effEffort ? { effort: effEffort } : {},
         ...prev.label ? { label: prev.label } : {},
-        ...prev.mcpServers ? { mcpServers: toBoxMcpServerMounts(prev.mcpServers) } : {},
+        ...sandboxMcpServers ? { mcpServers: toBoxMcpServerMounts(sandboxMcpServers) } : {},
         ...authSpec ? { auth: sandboxAuthForBox(authSpec) } : {}
       });
       remoteSessionId = remoteDesc.id;
@@ -27322,7 +27378,7 @@ async function restartAgentSession(registry, resolveAgentAdapter, prev, opts = {
       ...resolved?.authDescriptor?.provider !== void 0 ? { adapterProvider: resolved.authDescriptor.provider } : {},
       ...resolved?.authDescriptor?.modelDerivedApiKey !== void 0 ? { modelDerivedApiKey: resolved.authDescriptor.modelDerivedApiKey } : {},
       ...prev.label ? { label: prev.label } : {},
-      ...prev.mcpServers ? { mcpServers: prev.mcpServers } : {},
+      ...sandboxMcpServers ? { mcpServers: sandboxMcpServers } : {},
       ...effModel ? { model: effModel } : {},
       ...effEffort ? { effort: effEffort } : {},
       ...effPosture !== void 0 ? { posture: effPosture } : {},
@@ -27333,6 +27389,10 @@ async function restartAgentSession(registry, resolveAgentAdapter, prev, opts = {
       ...prev.origin ? { origin: prev.origin } : {},
       ...prev.parentSessionId ? { parentSessionId: prev.parentSessionId } : {},
       ...prev.depth !== void 0 ? { depth: prev.depth } : {},
+      ...prev.keepAlive ? { keepAlive: true } : {},
+      ...prev.notifyParentOnCrash ? { notifyParentOnCrash: true } : {},
+      ...prev.sentinelAutoWatch === false ? { sentinelAutoWatch: false } : {},
+      ...prev.restartPolicy ? { restartPolicy: prev.restartPolicy } : {},
       ...authEcho?.fingerprint ? {
         auth: {
           mode: authEcho.authMode,
@@ -27374,6 +27434,9 @@ async function restartAgentSession(registry, resolveAgentAdapter, prev, opts = {
       digestRecovered = result.hasContent;
     }
   }
+  if (sandboxId === void 0) {
+    registry.kill(prev.id, "SIGTERM", "restarted");
+  }
   const ts = (/* @__PURE__ */ new Date()).toISOString();
   const emit = (axis, value) => {
     registry.emitConfigChanged({
@@ -27959,7 +28022,8 @@ function createMcpObservationStore(opts = {}) {
     const obs = touch(sessionId);
     const at = obs.lastSeenAt;
     const result = message.result && typeof message.result === "object" ? message.result : void 0;
-    const error = message.error ? `${String(message.error.code ?? "error")}: ${String(message.error.message ?? "")}` : void 0;
+    const isExpectedDiscoverMiss = method === "server/discover" && message.error?.code === -32601;
+    const error = message.error && !isExpectedDiscoverMiss ? `${String(message.error.code ?? "error")}: ${String(message.error.message ?? "")}` : void 0;
     const answeredVersion = typeof result?.["protocolVersion"] === "string" ? result["protocolVersion"] : void 0;
     const protocolVersion = method === "initialize" ? answeredVersion : clientProtocolVersion;
     const base = {
@@ -28149,7 +28213,7 @@ function buildSessionCapabilities(desc, pendingPermissions, mcpObservation) {
 function daemonMountFields(obs, turnsCompleted) {
   const status = daemonMountStatus(obs, turnsCompleted);
   const tl = obs?.toolsList;
-  const failing = tl && !tl.ok ? tl : [obs?.initialize, obs?.discover].find((c) => c && !c.ok);
+  const failing = tl ? tl.ok ? void 0 : tl : [obs?.initialize, obs?.discover].find((c) => c && !c.ok);
   const error = failing?.error ?? (obs?.httpError ? `HTTP ${obs.httpError.status}` : void 0);
   const protocolVersion = tl?.protocolVersion ?? obs?.initialize?.protocolVersion ?? obs?.discover?.protocolVersion;
   return {
@@ -32561,7 +32625,8 @@ function registerSessionTools(rawServer, opts) {
             forceAgentResume: true,
             overrides,
             ...listCatalogModels ? { listCatalogModels } : {},
-            ...opts.resolveSandboxProvider ? { resolveSandboxProvider: opts.resolveSandboxProvider } : {}
+            ...opts.resolveSandboxProvider ? { resolveSandboxProvider: opts.resolveSandboxProvider } : {},
+            ...opts.daemonMcpUrl ? { daemonMcpUrl: opts.daemonMcpUrl } : {}
           });
           return {
             content: [
@@ -32771,7 +32836,8 @@ function registerSessionTools(rawServer, opts) {
           }
         }
         const restarted = await restartAgentSession(registry, resolveAgentAdapter, prev, {
-          ...opts.resolveSandboxProvider ? { resolveSandboxProvider: opts.resolveSandboxProvider } : {}
+          ...opts.resolveSandboxProvider ? { resolveSandboxProvider: opts.resolveSandboxProvider } : {},
+          ...opts.daemonMcpUrl ? { daemonMcpUrl: opts.daemonMcpUrl } : {}
         });
         return {
           content: [
@@ -39189,10 +39255,273 @@ async function handleSentinelInbound(hookKey, req, deps2) {
 
 // src/sentinel-tools.ts
 init_session_message();
-function resolveUntil(input, prSugar) {
+var SESSION_SLUG = "session";
+var SESSION_DEFAULT_TYPES = [
+  "session.turn.ended",
+  "session.awaiting_input",
+  "session.exited"
+];
+var SESSION_SUBJECT_RE = /^session:(.+)$/;
+function parseSessionSubject(subject) {
+  return SESSION_SUBJECT_RE.exec(subject)?.[1];
+}
+var RING_CAP = 2e3;
+var ringsByBus = /* @__PURE__ */ new WeakMap();
+function appendEvent(ring, event) {
+  const seq = ring.nextSeq++;
+  ring.entries.push({ seq, event });
+  if (ring.entries.length > RING_CAP) ring.entries.splice(0, ring.entries.length - RING_CAP);
+  return seq;
+}
+function parseCursor(cursor) {
+  if (!cursor) return void 0;
+  const i = cursor.lastIndexOf(":");
+  if (i < 0) return void 0;
+  const seq = Number(cursor.slice(i + 1));
+  return Number.isFinite(seq) ? { epoch: cursor.slice(0, i), seq } : void 0;
+}
+function formatCursor(ring, seq) {
+  return `${ring.epoch}:${seq}`;
+}
+function mintEventId(parts) {
+  return `evt_${createHash("sha256").update(parts.join("|")).digest("hex").slice(0, 24)}`;
+}
+function truncate3(text13, max = 200) {
+  const flat = text13.replace(/\s+/g, " ").trim();
+  return flat.length <= max ? flat : `${flat.slice(0, max - 1)}\u2026`;
+}
+function makeEvent2(input) {
+  return {
+    specversion: "1.0",
+    id: mintEventId(input.idParts),
+    source: `//agentproto.local/sentinel/${SESSION_SLUG}`,
+    type: input.type,
+    subject: input.subject,
+    time: input.time,
+    datacontenttype: "application/json",
+    data: input.data,
+    summary: input.summary,
+    subjects: [input.subject],
+    terminal: input.terminal
+  };
+}
+function eventsForSessionEvent(ev) {
+  switch (ev.type) {
+    case "session:turn-end": {
+      const subject = `session:${ev.sessionId}`;
+      const who = ev.label ? `${ev.label} (${ev.sessionId})` : ev.sessionId;
+      if (ev.awaitingInput) {
+        const question = ev.question?.text;
+        return [
+          makeEvent2({
+            idParts: [ev.sessionId, "awaiting_input", ev.ts],
+            type: "session.awaiting_input",
+            subject,
+            time: ev.ts,
+            terminal: false,
+            data: { sessionId: ev.sessionId, ...question ? { question } : {} },
+            summary: `${who} is awaiting input${question ? `: ${truncate3(question)}` : ""}`
+          })
+        ];
+      }
+      const detail = ev.error ?? (ev.reason && ev.reason !== "completed" ? ev.reason : void 0);
+      return [
+        makeEvent2({
+          idParts: [ev.sessionId, "turn-end", ev.ts],
+          type: "session.turn.ended",
+          subject,
+          time: ev.ts,
+          terminal: false,
+          data: {
+            sessionId: ev.sessionId,
+            ...ev.reason ? { reason: ev.reason } : {},
+            ...ev.error ? { error: ev.error } : {}
+          },
+          summary: `${who} ended a turn${detail ? `: ${truncate3(detail)}` : ""}`
+        })
+      ];
+    }
+    case "session:awaiting-input": {
+      const subject = `session:${ev.sessionId}`;
+      const who = ev.label ? `${ev.label} (${ev.sessionId})` : ev.sessionId;
+      const question = ev.question?.text;
+      return [
+        makeEvent2({
+          idParts: [ev.sessionId, "awaiting_input", ev.ts],
+          type: "session.awaiting_input",
+          subject,
+          time: ev.ts,
+          terminal: false,
+          data: { sessionId: ev.sessionId, ...question ? { question } : {} },
+          summary: `${who} is awaiting input${question ? `: ${truncate3(question)}` : ""}`
+        })
+      ];
+    }
+    case "session:exited": {
+      const subject = `session:${ev.sessionId}`;
+      const who = ev.label ? `${ev.label} (${ev.sessionId})` : ev.sessionId;
+      return [
+        makeEvent2({
+          idParts: [ev.sessionId, "exited", ev.ts],
+          type: "session.exited",
+          subject,
+          time: ev.ts,
+          terminal: true,
+          data: {
+            sessionId: ev.sessionId,
+            status: ev.status,
+            ...ev.exitCode !== void 0 ? { exitCode: ev.exitCode } : {},
+            ...ev.reason ? { reason: ev.reason } : {}
+          },
+          summary: `${who} exited (${ev.reason ?? ev.status})`
+        })
+      ];
+    }
+    default:
+      return [];
+  }
+}
+function getRing(bus) {
+  const existing = ringsByBus.get(bus);
+  if (existing) return existing;
+  const ring = { epoch: randomUUID(), entries: [], nextSeq: 0 };
+  ringsByBus.set(bus, ring);
+  bus.onAny((ev) => {
+    for (const event of eventsForSessionEvent(ev)) appendEvent(ring, event);
+  });
+  return ring;
+}
+function identityOf(handle) {
+  const state = handle.state;
+  return typeof state?.sessionId === "string" ? state.sessionId : handle.remoteId;
+}
+function synthesizeExitEvent(ring, subject, sessionId, tag, info, goneReason) {
+  const data = info ? {
+    sessionId,
+    status: info.status ?? "exited",
+    ...info.exitCode !== void 0 ? { exitCode: info.exitCode } : {},
+    ...info.endedReason ? { reason: info.endedReason } : {}
+  } : { sessionId, status: "exited", ...goneReason ? { reason: goneReason } : {} };
+  const summary = info ? `${info.label ?? sessionId} had already exited${info.endedReason ? ` (${info.endedReason})` : ""}` : `${sessionId} no longer exists${goneReason ? ` (${goneReason})` : ""}`;
+  appendEvent(
+    ring,
+    makeEvent2({
+      idParts: [sessionId, "exited", tag],
+      type: "session.exited",
+      subject,
+      time: (/* @__PURE__ */ new Date()).toISOString(),
+      terminal: true,
+      data,
+      summary
+    })
+  );
+}
+function resyncIfStale(ring, handle, sessionId, subject, getSession, tag, goneTag) {
+  const parsed = parseCursor(handle.cursor);
+  if (parsed && parsed.epoch === ring.epoch) return parsed.seq;
+  const lastSeq = ring.nextSeq - 1;
+  const info = getSession(sessionId);
+  if (!info) {
+    synthesizeExitEvent(ring, subject, sessionId, goneTag, void 0, "session no longer exists");
+  } else if (!info.alive) {
+    synthesizeExitEvent(ring, subject, sessionId, tag, info);
+  }
+  return lastSeq;
+}
+function sessionSentinelProvider(deps2) {
+  return {
+    slug: SESSION_SLUG,
+    name: "Session Lifecycle",
+    version: "0.1.0",
+    description: "In-process sentinel over this daemon's own session lifecycle \u2014 turn-end, awaiting-input, exit. No credentials, no external system: the subject IS another session (`session:<id>`).",
+    requiresSetup: false,
+    capabilities: {
+      subjects: [SESSION_SLUG],
+      push: false,
+      poll: true,
+      durable: false,
+      needsPublicUrl: false,
+      requiresAuth: false,
+      typicalLatencyMs: 15e3
+    },
+    async check() {
+      return true;
+    },
+    async create(spec, _delivery) {
+      if (spec.match.length !== 1) {
+        throw new Error(`${SESSION_SLUG}: exactly one match clause is supported (one sentinel per session)`);
+      }
+      const subject = spec.match[0].subject;
+      const sessionId = parseSessionSubject(subject);
+      if (!sessionId) {
+        throw new Error(`${SESSION_SLUG}: subject "${subject}" is not a "session:<id>" subject`);
+      }
+      const info = deps2.getSession(sessionId);
+      if (!info) {
+        throw new Error(`${SESSION_SLUG}: no session "${sessionId}"`);
+      }
+      const ring = getRing(deps2.sessionEvents);
+      const lastSeq = ring.nextSeq - 1;
+      if (!info.alive) {
+        synthesizeExitEvent(ring, subject, sessionId, "already-ended-at-create", info);
+      }
+      return { provider: SESSION_SLUG, remoteId: sessionId, cursor: formatCursor(ring, lastSeq), state: { sessionId } };
+    },
+    async attach(handle, _delivery) {
+      const sessionId = identityOf(handle);
+      if (!sessionId) return { ...handle };
+      const subject = `session:${sessionId}`;
+      const ring = getRing(deps2.sessionEvents);
+      const lastSeq = resyncIfStale(
+        ring,
+        handle,
+        sessionId,
+        subject,
+        deps2.getSession,
+        "already-ended-at-attach",
+        "gone-at-attach"
+      );
+      return { ...handle, cursor: formatCursor(ring, lastSeq) };
+    },
+    async cancel(_handle) {
+    },
+    async status(handle) {
+      const sessionId = identityOf(handle);
+      if (!sessionId) return { ok: false, detail: "no session identity on handle" };
+      const info = deps2.getSession(sessionId);
+      if (!info) return { ok: false, detail: `session "${sessionId}" no longer exists` };
+      return { ok: true };
+    },
+    async poll(handle, limit) {
+      const sessionId = identityOf(handle);
+      if (!sessionId) return { events: [], cursor: handle.cursor ?? "" };
+      const ring = getRing(deps2.sessionEvents);
+      const subject = `session:${sessionId}`;
+      const lastSeq = resyncIfStale(
+        ring,
+        handle,
+        sessionId,
+        subject,
+        deps2.getSession,
+        "already-ended-at-poll",
+        "gone-at-poll"
+      );
+      const matching = ring.entries.filter((e) => e.seq > lastSeq && e.event.subject === subject);
+      const slice = matching.slice(0, limit);
+      const cursor = slice.length > 0 ? formatCursor(ring, slice[slice.length - 1].seq) : formatCursor(ring, lastSeq);
+      return { events: slice.map((e) => e.event), cursor };
+    },
+    defaultTypes(subject) {
+      return parseSessionSubject(subject) ? [...SESSION_DEFAULT_TYPES] : [];
+    }
+  };
+}
+
+// src/sentinel-tools.ts
+function resolveUntil(input, defaultsToTerminal) {
   if (input === "never") return { kind: "never" };
   if (input === "subject_terminal") return { kind: "subject_terminal" };
-  return prSugar ? { kind: "subject_terminal" } : { kind: "never" };
+  return defaultsToTerminal ? { kind: "subject_terminal" } : { kind: "never" };
 }
 async function createSentinelWatch(deps2, input) {
   if (!input.subject && !input.prUrl) {
@@ -39214,7 +39543,8 @@ async function createSentinelWatch(deps2, input) {
   } else {
     subject = input.subject;
   }
-  const until = resolveUntil(input.until, prSugar);
+  const sessionSubject = !prSugar && parseSessionSubject(subject) !== void 0;
+  const until = resolveUntil(input.until, prSugar || sessionSubject);
   const sessionId = input.sessionId ?? deps2.defaultSessionId;
   if (!sessionId) {
     return {
@@ -39226,10 +39556,10 @@ async function createSentinelWatch(deps2, input) {
   if (!deps2.isSessionAlive(sessionId)) {
     return { ok: false, error: "session_not_alive", message: `session "${sessionId}" is not alive` };
   }
-  const providerSlug = input.provider ?? await autoSelectProviderSlug({
+  const providerSlug = input.provider ?? (sessionSubject ? SESSION_SLUG : await autoSelectProviderSlug({
     resolveProvider: deps2.resolveProvider,
     ...deps2.publicUrl ? { publicUrl: deps2.publicUrl } : {}
-  });
+  }));
   const provider = await deps2.resolveProvider(providerSlug);
   if (!provider) {
     return { ok: false, error: "unknown_provider", message: `provider "${providerSlug}" is not available` };
@@ -39302,15 +39632,15 @@ function registerSentinelTools(server, opts) {
   const { store, runtime, resolveProvider, isSessionAlive, callerSessionId, activeIntervalMs } = opts;
   server.tool(
     "sentinel_watch",
-    "Watch a GitHub subject (a PR, by default) and deliver matching events as a `system`/`notice` message into a session's AIP-46 inbox. Provide either `prUrl` (sugar: `https://github.com/o/r/pull/N` -> subject `github:o/r#N`, the default PR type set, and `until: subject_terminal`) or a raw `subject` (e.g. `github:o/r#N`, `github:o/r`). `sessionId` defaults to the calling session. `provider` picks the backend: `local-gh` (poll every ~15-60s over the host's authenticated `gh` CLI, zero infra), `webhook` (near-real-time push via a GitHub repo hook; needs a public daemon URL \u2014 a named tunnel or AGENTPROTO_PUBLIC_URL \u2014 and a `gh` token with admin:repo_hook) or `agentpush` (hosted, durable subscription: events queue server-side across daemon downtime; needs an agentpush API key; one subject per sentinel); see `list_sentinel_adapters` for readiness. Omitted, it defaults to `agentpush` when set up, else `webhook` when a stable public URL exists and webhook is ready, else `local-gh`.",
+    "Watch a subject \u2014 a GitHub PR/repo (default) or ANOTHER SESSION's own lifecycle \u2014 and deliver matching events as a `system`/`notice` message into a session's AIP-46 inbox. Provide either `prUrl` (sugar: `https://github.com/o/r/pull/N` -> subject `github:o/r#N`, the default PR type set, and `until: subject_terminal`) or a raw `subject`: a GitHub one (`github:o/r#N`, `github:o/r`), or `session:<id>` to watch another session \u2014 woken on its turn-end, awaiting-input, or exit, even if it never calls `message_parent`, with the watch self-expiring once it exits (`until` defaults to `subject_terminal` for this scheme too). Prefer this over `session_follow` for a single, known target that should auto-expire on exit; prefer `session_follow` for a broad selector (`all`/`cwdPrefix`) with coalesced digests across many sessions. `sessionId` (the DELIVERY target) defaults to the calling session \u2014 distinct from the `<id>` inside a `session:<id>` subject (the WATCHED session). `provider` picks the backend: `local-gh` (poll every ~15-60s over the host's authenticated `gh` CLI, zero infra), `webhook` (near-real-time push via a GitHub repo hook; needs a public daemon URL \u2014 a named tunnel or AGENTPROTO_PUBLIC_URL \u2014 and a `gh` token with admin:repo_hook), `agentpush` (hosted, durable subscription: events queue server-side across daemon downtime; needs an agentpush API key; one subject per sentinel) or `session` (in-process, zero infra, no credentials \u2014 the only backend that understands a `session:<id>` subject, and picked automatically for one); see `list_sentinel_adapters` for readiness. Omitted for a GitHub subject, it defaults to `agentpush` when set up, else `webhook` when a stable public URL exists and webhook is ready, else `local-gh`.",
     {
-      subject: z.string().optional().describe('Raw subject, e.g. "github:owner/repo#42". Mutually exclusive with prUrl.'),
+      subject: z.string().optional().describe('Raw subject, e.g. "github:owner/repo#42" or "session:sess_abc123". Mutually exclusive with prUrl.'),
       prUrl: z.string().optional().describe("https://github.com/owner/repo/pull/N \u2014 sugar for subject+types+until."),
-      sessionId: z.string().optional().describe("Target session. Defaults to the calling session."),
+      sessionId: z.string().optional().describe("Delivery target session. Defaults to the calling session."),
       types: z.array(z.string()).optional().describe("Type globs. Defaults to the provider's defaultTypes(subject)."),
       urgency: urgencyField2.optional().describe('Inbox delivery urgency. Default "next-turn".'),
-      until: untilField.optional().describe('Lifetime. Default "subject_terminal" for prUrl, "never" for a raw subject.'),
-      provider: z.string().optional().describe('Provider slug: "local-gh", "webhook" or "agentpush". Default: "agentpush" when set up, else "webhook" when a stable public URL is configured and webhook is ready, else "local-gh".')
+      until: untilField.optional().describe('Lifetime. Default "subject_terminal" for prUrl and for a "session:<id>" subject, "never" for any other raw subject.'),
+      provider: z.string().optional().describe('Provider slug: "local-gh", "webhook", "agentpush" or "session". Default for a GitHub subject: "agentpush" when set up, else "webhook" when a stable public URL is configured and webhook is ready, else "local-gh". A "session:<id>" subject always defaults to "session".')
     },
     async (input) => {
       const result = await createSentinelWatch(
@@ -39592,7 +39922,7 @@ function registerSessionFollowTools(server, opts) {
   const { store, hasSession, callerSessionId } = opts;
   server.tool(
     "session_follow",
-    "Wake a session (the follower, default: you) when OTHER sessions end a turn, await input, exit/crash, or get a PR opened/merged \u2014 no polling. `selector` picks sessions: `sessionIds`, `all: true` (evaluated at event time, so sessions spawned later are covered; root sessions only unless `rootOnly: false`), or `cwdPrefix`. `exclude` removes ids/labels. Events are coalesced within `batchMs` into one automatic digest message that never interrupts a busy follower. Your own events and your children's are never delivered to you. Upserts by `key` when given. Survives daemon restarts.",
+    "Wake a session (the follower, default: you) when OTHER sessions end a turn, await input, exit/crash, or get a PR opened/merged \u2014 no polling. `selector` picks sessions: `sessionIds`, `all: true` (evaluated at event time, so sessions spawned later are covered; root sessions only unless `rootOnly: false`), or `cwdPrefix`. `exclude` removes ids/labels. Events are coalesced within `batchMs` into one automatic digest message that never interrupts a busy follower. Your own events are never delivered to you; your descendants' only with `excludeFollowerChildren: false`. Upserts by `key` when given. Survives daemon restarts.",
     {
       follower: z.string().optional().describe("Session to wake. Defaults to the calling session."),
       key: z.string().optional().describe("Stable key: re-posting the same key updates that follow in place."),
@@ -39601,7 +39931,9 @@ function registerSessionFollowTools(server, opts) {
       events: z.array(z.enum(FOLLOW_EVENTS)).optional().describe("Event kinds to deliver. Default: all of turn-end, awaiting-input, exited, crashed, pr-opened, pr-merged."),
       batchMs: z.number().int().optional().describe("Coalescing window in ms. Default 15000."),
       skipEmptyTurns: z.boolean().optional().describe("Drop silent no-op turns. Default true."),
-      excludeFollowerChildren: z.boolean().optional().describe("Ignore the follower's own descendants. Default true.")
+      excludeFollowerChildren: z.boolean().optional().describe(
+        "Ignore the follower's own descendants. Default true. `false` delivers them (any depth, even under `rootOnly`) \u2014 what a supervisor wants for its own children."
+      )
     },
     async (input) => {
       const result = upsertSessionFollow(
@@ -43677,7 +44009,7 @@ function nextFireDate(cronInstance) {
   return cronInstance.nextRun() ?? null;
 }
 function createCronScheduler(opts) {
-  const { sessionEvents, registry, resolveAgentAdapter, dispatchTool, workspace } = opts;
+  const { sessionEvents, registry, resolveAgentAdapter, daemonMcpUrl, dispatchTool, workspace } = opts;
   const observeTurn = opts.observeTurn;
   const observeTimeoutMs = opts.observeTimeoutMs ?? DEFAULT_OBSERVE_TIMEOUT_MS;
   const persistPath = opts.persistPath ?? DEFAULT_PERSIST_PATH3();
@@ -43780,7 +44112,10 @@ function createCronScheduler(opts) {
           // result, which only an agent-cli session has — never let
           // decideRestartStrategy hand back a PTY-native resume (e.g.
           // claude-code's `claude --resume`) here.
-          { forceAgentResume: true }
+          {
+            forceAgentResume: true,
+            ...daemonMcpUrl ? { daemonMcpUrl } : {}
+          }
         );
         action.sessionId = restarted.desc.id;
         await registry.sendPrompt(restarted.desc.id, action.prompt);
@@ -50568,16 +50903,7 @@ function projectSessionForHttp(session, fields) {
 var DEFAULT_ALLOWED_ORIGINS = [
   "http://localhost:*",
   "http://127.0.0.1:*",
-  "https://localhost:*",
-  // The canonical hosted agentproto panel (github.com/agentproto/cli-site,
-  // deployed at cli.agentproto.sh). It drives the user's OWN local daemon
-  // from the browser: read-only GETs (session list, SSE stream) are ungated
-  // and already work, but the /sessions/:id/pty WebSocket upgrade IS gated —
-  // so a PTY terminal in the panel 401s unless this first-party origin is
-  // trusted like localhost. A malicious page can't forge this Origin (the
-  // browser sets it), so the trust is scoped to agentproto's own panel,
-  // matching how guilde.work is trusted. Drop it via `strictOrigins`.
-  "https://cli.agentproto.sh"
+  "https://localhost:*"
 ];
 var DEFAULT_FRAME_ANCESTORS = ["vscode-webview:", "vscode-file:"];
 var EVENTS_KEEPALIVE_MS = 25e3;
@@ -54588,7 +54914,8 @@ async function handleSessions(req, res, path, registry, resolveAgentAdapter, pty
       const restarted = await restartAgentSession(registry, resolveAgentAdapter, prev, {
         forceAgentResume: true,
         overrides,
-        ...listCatalogModels ? { listCatalogModels } : {}
+        ...listCatalogModels ? { listCatalogModels } : {},
+        ...daemonMcpUrl ? { daemonMcpUrl } : {}
       });
       json3(200, {
         ...sessionDescriptorForHttp(restarted.desc),
@@ -57876,7 +58203,10 @@ var BUILTIN_SENTINEL_PROVIDERS = {
   [WEBHOOK_SLUG]: () => webhookSentinelProvider(),
   [AGENTPUSH_SLUG]: (creds) => agentpushSentinelProvider({ creds })
 };
-var BUILTIN_SENTINEL_SLUGS = [LOCAL_GH_SLUG, WEBHOOK_SLUG, AGENTPUSH_SLUG];
+var BUILTIN_SENTINEL_SLUGS = [LOCAL_GH_SLUG, WEBHOOK_SLUG, AGENTPUSH_SLUG, SESSION_SLUG];
+function configureSessionSentinelProvider(deps2) {
+  BUILTIN_SENTINEL_PROVIDERS[SESSION_SLUG] = () => sessionSentinelProvider(deps2);
+}
 var slugToCamel3 = (slug) => slug.replace(/-([a-z0-9])/g, (_, c) => c.toUpperCase());
 function isSentinelProvider(x) {
   if (!x || typeof x !== "object") return false;
@@ -58681,11 +59011,11 @@ function followCoversSession(follow, sessionId, desc, registry, eventLabel) {
   if (follow.exclude?.sessionIds?.includes(sessionId)) return false;
   const label = desc?.label ?? eventLabel;
   if (label && follow.exclude?.labels?.includes(label)) return false;
-  if (follow.excludeFollowerChildren && descendsFrom(registry, desc, follow.follower)) {
-    return false;
-  }
+  const ownDescendant = descendsFrom(registry, desc, follow.follower);
+  if (ownDescendant && follow.excludeFollowerChildren) return false;
   const sel = follow.selector;
   if (sel.sessionIds?.includes(sessionId)) return true;
+  if (ownDescendant && (sel.all === true || sel.cwdPrefix !== void 0 && sel.cwdPrefix !== "")) return true;
   const broad = sel.all === true || sel.cwdPrefix !== void 0 && sel.cwdPrefix !== "";
   if (!broad) return false;
   if (sel.cwdPrefix && !cwdUnder(desc?.cwd, sel.cwdPrefix)) return false;
@@ -64356,7 +64686,9 @@ var RemoteController = class {
       result.bearerToken = bearerToken;
       result.mcpEndpoint = mcpEndpoint;
       result.mcpConfigSnippet = buildMcpConfigSnippet2(mcpEndpoint, bearerToken);
-      result.phoneUrl = this.opts.isSessionChatInstalled?.() ? `${started.publicUrl}/apps/${SESSION_CHAT_APP_ID}/ui#token=${bearerToken}` : `https://cli.agentproto.sh/panel#daemon=${encodeURIComponent(started.publicUrl)}&token=${bearerToken}`;
+      if (this.opts.isSessionChatInstalled?.()) {
+        result.phoneUrl = `${started.publicUrl}/apps/${SESSION_CHAT_APP_ID}/ui#token=${bearerToken}`;
+      }
     } else {
       const warning = `\u26A0 ${started.publicUrl} forwards to ${target.host}:${target.port} with NO authentication from the daemon \u2014 anyone with the URL can reach it. Ensure the upstream service enforces its own auth, and run remote_disable when done.`;
       result.warning = warning;
@@ -64450,7 +64782,7 @@ function registerRemoteTools(server, opts) {
   const { controller } = opts;
   server.tool(
     "remote_enable",
-    "Publish a local port to the internet via Cloudflare. By default exposes this gateway and gates it with a bearer token (returned ONCE in the response \u2014 store it; only its hash is persisted). Pass `targetPort` to tunnel a different local service (Supabase, dev server, \u2026); in that mode the daemon does not gate the proxied traffic \u2014 the upstream service handles its own auth. Returns the public URL plus a paste-ready `.mcp.json` snippet and a `phoneUrl` \u2014 a single link to open on a phone, with the token in a URL fragment (gateway mode only). Re-running while a tunnel is already up errors; call `remote_disable` first to rotate.",
+    "Publish a local port to the internet via Cloudflare. By default exposes this gateway and gates it with a bearer token (returned ONCE in the response \u2014 store it; only its hash is persisted). Pass `targetPort` to tunnel a different local service (Supabase, dev server, \u2026); in that mode the daemon does not gate the proxied traffic \u2014 the upstream service handles its own auth. Returns the public URL plus a paste-ready `.mcp.json` snippet and a `phoneUrl` \u2014 a single link to open on a phone, with the token in a URL fragment (gateway mode, and only when the @agentik/session-chat app is installed). Re-running while a tunnel is already up errors; call `remote_disable` first to rotate.",
     {
       provider: z.enum(["quick"]).optional().describe(
         "Tunnel backend. `quick` = Cloudflare Quick Tunnel (no API key, ephemeral *.trycloudflare.com URL). Defaults to `quick`. Named-CF / Tailscale providers TBD."
@@ -66457,6 +66789,13 @@ var SENTINEL_CATALOG = [
     description: "Hosted event subscriptions over agentpush \u2014 GitHub App installs, Telegram, generic hooks. Events queue server-side and survive daemon downtime; delivered by poll (default, no public URL) or push. Needs an agentpush workspace API key (`setup_sentinel_provider`, or an imported `agentpush` MCP alias).",
     packageName: "@agentproto/runtime",
     hint: "any source \xB7 durable \xB7 needs API key"
+  },
+  {
+    slug: SESSION_SLUG,
+    name: "Session Lifecycle",
+    description: 'In-process watcher over this daemon\'s own session lifecycle (turn-end, awaiting-input, exit) for a "session:<id>" subject. No credentials, no external system \u2014 wired up by the daemon itself, not configurable via `setup_sentinel_provider`.',
+    packageName: "@agentproto/runtime",
+    hint: "session \xB7 zero-infra \xB7 in-process"
   }
 ];
 function toSentinelInfo(handle) {
@@ -67108,7 +67447,8 @@ function makeRestartForRouting(deps2, config) {
     }
     const restarted = await restartPreferInPlace(deps2.sessions, deps2.resolveAgentAdapter, desc, {
       forceAgentResume: true,
-      allowDeliberateEnd: config.allowDeliberateEnd
+      allowDeliberateEnd: config.allowDeliberateEnd,
+      ...deps2.daemonMcpUrl ? { daemonMcpUrl: deps2.daemonMcpUrl } : {}
     });
     return restarted.desc.id;
   };
@@ -67399,6 +67739,20 @@ async function createGateway(opts) {
       }
     } : {}
   });
+  configureSessionSentinelProvider({
+    sessionEvents,
+    getSession: (sessionId) => {
+      const desc = sessions.get(sessionId);
+      if (!desc) return void 0;
+      return {
+        alive: desc.alive === true,
+        status: desc.status,
+        ...desc.label ? { label: desc.label } : {},
+        ...desc.endedReason ? { endedReason: desc.endedReason } : {},
+        ...desc.exitCode !== void 0 ? { exitCode: desc.exitCode } : {}
+      };
+    }
+  });
   const restartScheduler = createRestartScheduler({ registry: sessions, sessionEvents });
   const supervisor = createCompletionPolicySupervisor({
     registry: sessions,
@@ -67440,6 +67794,7 @@ async function createGateway(opts) {
   const cronScheduler = createCronScheduler({
     sessionEvents,
     registry: sessions,
+    daemonMcpUrl,
     ...opts.resolveAgentAdapter ? { resolveAgentAdapter: opts.resolveAgentAdapter } : {},
     ...opts.listAgentAdapters ? { listAgentAdapters: opts.listAgentAdapters } : {},
     getAuthProfile: getAuthProfile,
@@ -67615,11 +67970,11 @@ async function createGateway(opts) {
     return desc.processAlive !== false;
   };
   const restartSentinelSession = makeRestartForRouting(
-    { sessions, resolveAgentAdapter: opts.resolveAgentAdapter },
+    { sessions, resolveAgentAdapter: opts.resolveAgentAdapter, daemonMcpUrl },
     { name: "restartSentinelSession", allowDeliberateEnd: false }
   );
   const restartInboundSession = makeRestartForRouting(
-    { sessions, resolveAgentAdapter: opts.resolveAgentAdapter },
+    { sessions, resolveAgentAdapter: opts.resolveAgentAdapter, daemonMcpUrl },
     { name: "restartInboundSession", allowDeliberateEnd: true }
   );
   const sentinelRuntime = createSentinelRuntime({