@animalabs/agent-framework 0.29.0 → 0.31.0

package/src/admission/admit.ts

@@ -0,0 +1,113 @@
+/**
+ * The admission stage (Dendrite §D; issue #232 §3.5).
+ *
+ * One decision per inbound event, taken before any side effect. Everything
+ * downstream — storage, the recipient's view, the wake, the speech locus,
+ * the gate's batching — consumes this decision instead of rediscovering the
+ * policy at its own stage. The function is pure over the policy inputs it is
+ * handed; the framework supplies them and applies the result.
+ *
+ * What is decided, in the proposal's words:
+ *   1. captured   — always; an admitted event is stored where it arrived
+ *   2. recipients — who is eligible (explicit targets, else the untargeted set)
+ *   3. delivery   — a body in the recipients' view, or a hold
+ *   4. wake       — may it start a turn
+ *   5. locus      — may it count as "the latest delivered inbound" (never
+ *                   under a hold); the channel registry records it under
+ *                   either `speech.locus` setting, and makes it the fallback
+ *                   locus only under `'latest-inbound'`
+ *
+ * A hold is a policy epoch over a channel (today: tune-out). Residents share
+ * one message slot, so a hold applies to the slot: every resident recipient
+ * gets the same disposition. A reader of the slot (the subconscious, or a
+ * reader fork) sees held traffic through its own view; that is not a
+ * delivery decision of this stage.
+ */
+
+export interface InboundEnvelope {
+  /** Which MCPL lane carried it. */
+  lane: 'channel' | 'push';
+  serverId: string;
+  /** Endpoint-qualified channel id when the event has one (a push event
+   *  without channel provenance — heartbeat, timer — has none). */
+  channelId?: string;
+  /** Platform message id, or the push event id. */
+  messageId: string;
+  authorId?: string;
+  tags?: string[];
+  /** `chat:addressed` (mention / reply / DM) or the server's equivalent. */
+  addressed: boolean;
+  /**
+   * The server-side veto: a per-server `shouldTriggerInference` said no, or
+   * the event is a materialized coalesced delivery whose wake already
+   * happened (`triggerInference: false`). A vetoed event wakes nobody and is
+   * not shown to the gate as a fresh event.
+   */
+  vetoed: boolean;
+  /** Explicit recipients named by the event, if any. */
+  targetAgents?: string[];
+  /** What the gate sees: the text and the metadata shape it has always matched on. */
+  gateContent: string;
+  gateMetadata: Record<string, unknown>;
+}
+
+export interface HoldRecord {
+  kind: 'tune-out';
+  epochId: string;
+  serverId: string;
+  channelId: string;
+}
+
+export interface AdmissionPolicy {
+  /** The recipients an untargeted event reaches. */
+  untargetedRecipients(): string[];
+  /** The hold in force over this channel, if any. */
+  holdFor(serverId: string, channelId: string): HoldRecord | null;
+  /**
+   * The wake gate. `evaluate` may have side effects (debounce batching,
+   * counters, traces) and is called only for an event that may reach the
+   * recipients; `probe` is side-effect-free and answers "would the gate have
+   * woken them" for a held event, which the hold's own policy needs.
+   */
+  gate?: {
+    evaluate(env: InboundEnvelope): boolean;
+    probe(env: InboundEnvelope): boolean;
+  };
+}
+
+export interface AdmissionDecision {
+  recipients: string[];
+  /** Null = delivered into the recipients' view; otherwise held, with the record to stamp. */
+  held: HoldRecord | null;
+  /** Whether the recipients may be woken by this event. */
+  wake: boolean;
+  /**
+   * The gate's verdict as a precondition for whatever reads the hold: true
+   * when the gate would (or did) wake the recipients. For a held event this
+   * comes from the side-effect-free probe; for a vetoed event it is false.
+   */
+  gatePass: boolean;
+  /** Whether this arrival may count as the latest delivered inbound message. */
+  locus: boolean;
+}
+
+export function admit(env: InboundEnvelope, policy: AdmissionPolicy): AdmissionDecision {
+  const recipients = env.targetAgents ?? policy.untargetedRecipients();
+  const held = env.channelId ? policy.holdFor(env.serverId, env.channelId) : null;
+
+  if (held) {
+    // Held: nothing downstream may act for the recipients. The gate is only
+    // asked what it would have done — no batch forms, no counter moves.
+    const gatePass = env.vetoed ? false : (policy.gate ? policy.gate.probe(env) : true);
+    return { recipients, held, wake: false, gatePass, locus: false };
+  }
+
+  if (env.vetoed) {
+    return { recipients, held: null, wake: false, gatePass: false, locus: true };
+  }
+
+  // Deliverable: now the gate may take its side effects (a debounce batch
+  // is the gate's own deferred wake and is consumed later by the same rule).
+  const gatePass = policy.gate ? policy.gate.evaluate(env) : true;
+  return { recipients, held: null, wake: gatePass, gatePass, locus: true };
+}

package/src/agent.ts

@@ -2,6 +2,7 @@ import { NOTICE_TAG } from './notice-tags.js';
 import { heartbeatToolAlias } from './heartbeat/heartbeat.js';
 import type { Membrane, NormalizedMessage, NormalizedRequest, ContentBlock, ThinkingBindingEntry, YieldingStream } from '@animalabs/membrane';
 import { isAbortedResponse } from '@animalabs/membrane';
+import { streamBounds, type InferenceBounds } from './inference-bounds.js';
 import type { CacheWireReceipt, KvUnifiedRequestHooks } from './kv-unified-wire.js';
 import { ToolResultGuard } from './tool-result-guard.js';
 import { withoutTokenEstimates } from './thinking-token-stamp.js';
@@ -50,6 +51,9 @@ export interface ActivationRequestOptions {
    *  pass it (its errorPolicy is their retry layer); a direct caller of
    *  startStream keeps membrane's retries. */
   membraneRetries?: boolean;
+  /** The framework's inferenceBounds, resolved: the stream gets their phase
+   *  bounds and flat bound. None when left out. */
+  inferenceBounds?: InferenceBounds | null;
 }
 
 /** A compile's render stats, as context-manager's `getRenderStats()` types
@@ -162,6 +166,24 @@ function wireDigest(value: unknown): string {
 const DEFAULT_CONTEXT_BUDGET_TOKENS = 100_000;
 const DEFAULT_TRANSITION_PACE_TOKENS = 16_000;
 const DEFAULT_SAME_ROUND_THINK_TEXT_POLICY: SameRoundThinkTextPolicy = 'public';
+const TURN_INPUTS_PIN = 'agent-framework:turn-inputs';
+
+export function assertThinkingBinding(setting: string, value: AgentConfig['thinkingBinding']): void {
+  if (holdsSettings(setting, value, '{ binds: true, dropBlock: true }')) {
+    assertBooleanSetting(
+      `${setting}.dropBlock`,
+      value.dropBlock,
+      'true asks the provider to drop a signed thinking block whose earlier conversation changed rather than refuse the request, ' +
+        'and false or leaving it out sends nothing, so the account\'s default applies',
+    );
+    assertBooleanSetting(
+      `${setting}.binds`,
+      value.binds,
+      'true says the model binds its signed thinking to the conversation before it, so each compile tells the context manager so, ' +
+        'and false or leaving it out compiles as before',
+    );
+  }
+}
 
 /**
  * Refuse an agent config whose `promptCaching`, `toolResultGuard`,
@@ -190,20 +212,7 @@ export function assertAgentSwitches(config: AgentConfig): void {
       'true asks the provider for extended thinking, and false or leaving it out doesn\'t',
     );
   }
-  if (holdsSettings(`${agent} thinkingBinding`, config.thinkingBinding, '{ binds: true, dropBlock: true }')) {
-    assertBooleanSetting(
-      `${agent} thinkingBinding.dropBlock`,
-      config.thinkingBinding.dropBlock,
-      'true asks the provider to drop a signed thinking block whose earlier conversation changed rather than refuse the request, ' +
-        'and false or leaving it out sends nothing, so the account\'s default applies',
-    );
-    assertBooleanSetting(
-      `${agent} thinkingBinding.binds`,
-      config.thinkingBinding.binds,
-      'true says the model binds its signed thinking to the conversation before it, so each compile tells the context manager so, ' +
-        'and false or leaving it out compiles as before',
-    );
-  }
+  assertThinkingBinding(`${agent} thinkingBinding`, config.thinkingBinding);
   if (holdsSettings(`${agent} refusalHandling`, config.refusalHandling, '{ autoRewind: true }')) {
     assertBooleanSetting(
       `${agent} refusalHandling.autoRewind`,
@@ -321,6 +330,11 @@ export class Agent {
   /** Provider-specific request parameters forwarded unchanged by Membrane. */
   readonly providerParams?: Record<string, unknown>;
   readonly sameRoundThinkTextPolicy: AgentConfig['sameRoundThinkTextPolicy'];
+  /** The participant name this agent's turns are presented under (see AgentConfig.presentAs). */
+  readonly presentAs: string;
+  /** Stored participants presented as this agent's own turns: its name plus AgentConfig.selfParticipants. */
+  private readonly ownParticipants: ReadonlySet<string>;
+  private readonly deniedAtDispatch: ReadonlySet<string>;
 
   private _state: AgentState = { status: 'idle' };
   private _inferenceStartedAt = 0;
@@ -450,6 +464,9 @@ export class Agent {
     this.prefillUserMessage = config.prefillUserMessage;
     this.providerParams = config.providerParams;
     this.sameRoundThinkTextPolicy = config.sameRoundThinkTextPolicy;
+    this.presentAs = config.presentAs ?? config.name;
+    this.ownParticipants = new Set([config.name, ...(config.selfParticipants ?? [])]);
+    this.deniedAtDispatch = new Set(config.denyToolsAtDispatch ?? []);
     this.maxStreamTokens = config.maxStreamTokens ?? 150_000;
     // The window size converted as the projection's comparison (`projected > window`) converts it, so a string such
     // as "200000" from a JSON or YAML config is its number, for every rule that reads it. A value whose number isn't
@@ -509,6 +526,36 @@ export class Agent {
     return alias !== undefined && this.allowedTools.includes(alias);
   }
 
+  /**
+   * Whether a call to an advertised tool is refused at dispatch
+   * (see AgentConfig.denyToolsAtDispatch).
+   */
+  deniesAtDispatch(toolName: string): boolean {
+    return this.deniedAtDispatch.has(toolName);
+  }
+
+  /** Whether a stored participant is this agent's own voice. */
+  isOwnParticipant(participant: string): boolean {
+    return this.ownParticipants.has(participant);
+  }
+
+  /**
+   * Role assignment for a request: every participant that is this agent's
+   * own voice — its name, and for a derived agent the agent it inherited
+   * from — is presented under one name, which the formatter maps to the
+   * assistant role. Stored authorship is untouched; this shapes the request
+   * only. For a plain agent (no selfParticipants, presentAs = name) the
+   * input is returned as is.
+   */
+  private presentOwnTurns(messages: NormalizedMessage[]): NormalizedMessage[] {
+    if (this.ownParticipants.size === 1 && this.presentAs === this.name) return messages;
+    return messages.map((m) =>
+      this.ownParticipants.has(m.participant) && m.participant !== this.presentAs
+        ? { ...m, participant: this.presentAs }
+        : m,
+    );
+  }
+
   /**
    * Check if a source can trigger inference for this agent.
    */
@@ -1098,11 +1145,7 @@ export class Agent {
    * A message above it may still be replaced or withdrawn in place by its
    * sender, though it may already have been in one of the agent's requests.
    * A live stream carries each round's own content and results, which it
-   * stores at its tool boundaries, into its next request. It can also carry
-   * the messages injected at a boundary whose stream didn't say whether it
-   * carries injections, as no membrane 0.5.x stream does: its native path
-   * carries them and its XML path drops them, and either way they stay
-   * above it.
+   * stores at its tool boundaries, into its next request.
    */
   private consumedWatermark: { branch: string; sequence: number } | null = null;
   /** Counts marks (markContextConsumed's and applyCompileWatermark's), so a
@@ -1112,8 +1155,7 @@ export class Agent {
    * The newest stored message a compile or a tool boundary may have put in
    * front of the agent, per branch. It moves where the consumed watermark
    * does, and sooner: when a committing compile takes its value, before it
-   * awaits, and at every tool boundary that injects, whether or not the
-   * stream says it carries injected messages. A message above it may still
+   * awaits, and at every tool boundary that injects into its stream. A message above it may still
    * have been shown, though: for one, a live stream carries each round's own
    * content and results, stored at a boundary that injected nothing, into its
    * next request. A compile that throws assembled nothing, and gives its move
@@ -1152,6 +1194,63 @@ export class Agent {
     if (watermark) this.answeredWatermark = watermark;
   }
 
+  /**
+   * Keep the stored rows from `first` through `last` raw for the turn now
+   * opening, with a raw pin under one name per agent. Any pin of that name
+   * already held is removed first, one a crash left included. Under a
+   * strategy without pins nothing is pinned. A committing compile that
+   * refuses as over budget while a pin of that name is held removes it and
+   * compiles once more, and `unpinTurnInputs` removes it. Returns the pin's
+   * id, or undefined when nothing was pinned.
+   *
+   * @internal For the framework's turn starts; not a host API.
+   */
+  pinTurnInputs(first: MessageId, last: MessageId): string | undefined {
+    if (!this.unpinTurnInputs()) return undefined;
+    const cm = this.contextManager;
+    if (typeof (cm.getStrategy() as { pinRange?: unknown }).pinRange !== 'function') return undefined;
+    try {
+      return cm.pinRange(first, last, { name: TURN_INPUTS_PIN });
+    } catch (error) {
+      console.error(`[turn-inputs] ${this.name}: could not pin the turn's inputs (${first}..${last}), so they may be compressed:`, error);
+      return undefined;
+    }
+  }
+
+  /** Remove the turn's input pin `pinId`, or without one every pin of its
+   *  name. False when a removal threw.
+   *  @internal For the framework's turn starts and ends; not a host API. */
+  unpinTurnInputs(pinId?: string): boolean {
+    try {
+      for (const pin of this.contextManager.listPins()) {
+        if (pin.name === TURN_INPUTS_PIN && (pinId === undefined || pin.id === pinId)) this.contextManager.unpin(pin.id);
+      }
+      return true;
+    } catch (error) {
+      console.error(`[turn-inputs] ${this.name}: could not remove the turn's input pin:`, error);
+      return false;
+    }
+  }
+
+  private async compileUnpinningOnRefusal(compile: () => Promise<CompileResult>): Promise<CompileResult> {
+    const pinned = this.holdsTurnInputsPin();
+    try {
+      return await compile();
+    } catch (error) {
+      if ((error as { name?: unknown } | null)?.name !== 'OverBudgetError' || !pinned || !this.unpinTurnInputs()) throw error;
+      console.error(`[turn-inputs] ${this.name}: the compile refused with the turn's inputs pinned, so they are unpinned and it compiles again`);
+      return compile();
+    }
+  }
+
+  private holdsTurnInputsPin(): boolean {
+    try {
+      return this.contextManager.listPins().some((pin) => pin.name === TURN_INPUTS_PIN);
+    } catch {
+      return false;
+    }
+  }
+
   /**
    * Per destination (a server's channel, by its key), the newest consumed
    * watermark the agent had read when it published there by a route the
@@ -1198,7 +1297,7 @@ export class Agent {
   }
 
   /** Mark everything currently stored as possibly shown (a tool boundary
-   *  that injected messages, whatever its stream says it carries). Without
+   *  that injected messages into its stream). Without
    *  a watermark the coalescer counts a message as shown, as it counts one
    *  read without a consumed watermark. */
   markContextShown(): void {
@@ -1281,7 +1380,9 @@ export class Agent {
    * run. It isn't told the agent's thinking binding (`thinkingBinding.binds`),
    * so a context manager that keeps a thinking-binding record neither reads
    * nor writes the record here, and what it returns keeps thinking whose
-   * earlier conversation changed. */
+   * earlier conversation changed. Called while a turn's input pin is held
+   * (pinTurnInputs), a refusal as over budget removes the pin and compiles
+   * once more, as the turn's own compiles do. */
   async compileContext(budget?: TokenBudget): Promise<CompileResult> {
     // RFC-006 §3.3: consumption is determined at assembly — a compile that
     // fails assembled nothing, so the watermark moves only on success.
@@ -1289,7 +1390,7 @@ export class Agent {
     const marksBefore = this.watermarkMarks;
     const shownBefore = this.shownWatermark;
     if (watermark) this.shownWatermark = watermark;
-    const compile = () => this.contextManager.compile(this.compileBudget(budget));
+    const compile = () => this.compileUnpinningOnRefusal(() => this.contextManager.compile(this.compileBudget(budget)));
     let result: CompileResult;
     try {
       result = budget ? await compile() : await this.compileAtLiveBudget(compile);
@@ -1545,7 +1646,8 @@ export class Agent {
     // agent before the consumed watermark moves, once it returns.
     const shownBefore = this.shownWatermark;
     if (watermark) this.shownWatermark = watermark;
-    const compile = () => this.contextManager.compile(this.compileBudget(budget), injections, opts as never);
+    const select = () => this.contextManager.compile(this.compileBudget(budget), injections, opts as never);
+    const compile = opts?.dryRun ? select : () => this.compileUnpinningOnRefusal(select);
     let result: CompileResult;
     try {
       result = budget || opts?.dryRun ? await compile() : await this.compileAtLiveBudget(compile);
@@ -1643,8 +1745,9 @@ export class Agent {
       // What it holds of the stored injections is what the agent last saw.
       this.noteRenderedInjections(compiled);
       const { systemInjections } = compiled;
-      // The framework's own pricing stamp never goes out (thinking-token-stamp.ts).
-      const messages = withoutTokenEstimates(compiled.messages);
+      // The framework's own pricing stamp never goes out (thinking-token-stamp.ts);
+      // the agent's own turns are then presented under its name (presentOwnTurns).
+      const messages = this.presentOwnTurns(withoutTokenEstimates(compiled.messages));
       // Read once, after the first compile, since results may have become
       // ready while it ran; the refusal retry, assembled while the agent is
       // inferring, sends the same ones.
@@ -1656,6 +1759,7 @@ export class Agent {
         system: this.buildSystemPrompt(systemInjections),
         tools: tools.length > 0 ? tools : undefined,
         ...this.requestSettings(),
+        assistantParticipant: this.presentAs,
       };
     };
     const request = await assemble();
@@ -1891,6 +1995,8 @@ export class Agent {
     // The framework's own pricing stamp never goes out (thinking-token-stamp.ts).
     messages = withoutTokenEstimates(messages);
 
+    messages = this.presentOwnTurns(messages);
+
     // Silent heartbeat ticks and replies to a [Continue] turn store no
     // prompt row. Render each request-only turn before its response's first
     // surviving row, so the wire formatter cannot merge the response into the
@@ -1901,7 +2007,7 @@ export class Agent {
     // renders. "First" is per agent: a broadcast tick shares its eventId with
     // every resident.
     const index = this.indexRequestOnlyRows();
-    const rendered = renderRequestOnlyRows(messages, index, this.name);
+    const rendered = renderRequestOnlyRows(messages, index, this.presentAs);
     messages = rendered.messages;
     // A tick opens wherever its separator isn't already rendered: on its first
     // request, and on a restart whose compile left none of the tick's rows,
@@ -1920,7 +2026,7 @@ export class Agent {
     let continuePrompt: RequestOnlyPrompt | undefined;
     if (openingTick) {
       messages = [...messages, silentHeartbeatSeparatorTurn()];
-    } else if (endsOnOwnMessage(messages, this.name, injectionTail)) {
+    } else if (endsOnOwnMessage(messages, this.presentAs, injectionTail)) {
       // Safety: ensure messages don't end with an assistant message.
       // Some models reject trailing assistant messages ("prefill not supported"),
       // and after context compression a stale assistant turn can end up last.
@@ -1970,7 +2076,7 @@ export class Agent {
       cacheTtl: this.cacheTtl,
       ...(this.prefillUserMessage && { prefillUserMessage: this.prefillUserMessage }),
       ...(this.providerParams && { providerParams: this.providerParams }),
-      assistantParticipant: this.name,
+      assistantParticipant: this.presentAs,
     };
   }
 
@@ -2063,7 +2169,7 @@ export class Agent {
     try {
       const stored = cm.getAllMessages() as unknown as readonly StoredRowLike[];
       if (this.requestOnlyIndex?.source === stored) return this.requestOnlyIndex.index;
-      const index = indexRequestOnlyRows(stored, this.name);
+      const index = indexRequestOnlyRows(stored, this.ownParticipants);
       this.requestOnlyIndex = { source: stored, index };
       return index;
     } catch (error) {
@@ -2169,6 +2275,7 @@ export class Agent {
       // since membrane 0.7 its own schedules, ten minutes at a 529, would
       // otherwise run inside each of the caller's attempts, out of its sight.
       ...(options.membraneRetries === false ? { retry: false } : {}),
+      ...streamBounds(options.inferenceBounds ?? null, request.config.maxTokens),
       // Retry a content-policy refusal at the provider seam rather than at
       // the framework level: membrane replays the SAME request immediately
       // (cache-warm), where a framework-level requeue would recompile and

package/src/api/mcp-server-core.ts

@@ -86,9 +86,16 @@ export class McpServer {
     // Connect to WebSocket API
     await this.connectWs();
 
-    readLines(process.stdin, (line) => this.handleInput(line), () => {
-      this.close();
-      process.exit(0);
+    readLines(process.stdin, {
+      line: (line) => this.handleInput(line),
+      end: () => {
+        this.close();
+        process.exit(0);
+      },
+      tooLong: (maxChars) => {
+        this.close();
+        process.stderr.write(`MCP server stopped: a line on stdin was longer than ${maxChars.toLocaleString('en-US')} UTF-16 code units\n`, () => process.exit(1));
+      },
     });
 
     // Handle SIGINT gracefully

package/src/author-presentation.ts

@@ -0,0 +1,81 @@
+/**
+ * The author of a channel message, presented to the model.
+ *
+ * MCPL `channels/incoming` carries the author as a field, `author: {id,
+ * name}`, and the body alone as content (SPEC §14); the framework stores
+ * the message under the anonymous participant `user` with the author in
+ * `metadata.author`. The wire formatter writes the participant, so without
+ * this step the model reads `user: <text>` and who spoke is lost. Servers
+ * that pre-render `Name: body` into the text themselves (portal-mcpl) are
+ * left as they are: the rule is idempotent, so the name appears once
+ * whichever shape a server sends.
+ *
+ * Applied where the framework stores a `channels/incoming` message — the
+ * compiled view carries no metadata, so the name has to be in the stored
+ * text to reach the wire — and to a tune-out backlog line, which reads the
+ * metadata and must not name an author twice. The author stays in
+ * `metadata.author` as the structured record.
+ */
+import type { ContentBlock, MessageMetadata } from '@animalabs/membrane';
+import { suppliedValue } from './supplied-text.js';
+
+/** The participant the framework stores channel traffic under: a role, not a name. */
+export const ANONYMOUS_PARTICIPANT = 'user';
+
+type TextBlock = Extract<ContentBlock, { type: 'text' }>;
+
+/** The author a stored message names, when it names one. */
+export function authorNamed(metadata: Record<string, unknown> | MessageMetadata | undefined): string | undefined {
+  const name = (metadata?.author as { name?: unknown } | undefined)?.name;
+  return typeof name === 'string' && name.length > 0 ? name : undefined;
+}
+
+/** Whether `text` already begins with the author's own line: `Name:` then a space or the end. */
+export function beginsWithAuthor(author: string, text: string): boolean {
+  if (!text.startsWith(author) || text.charAt(author.length) !== ':') return false;
+  const after = text.charAt(author.length + 1);
+  return after === '' || after === ' ' || after === '\n';
+}
+
+/**
+ * The author's name as a line of the framework's writes it: a value someone
+ * supplied, kept to one line with its notice openings marked (main's #852,
+ * suppliedValue), so a name can't open a line that reads as the framework's
+ * own notice.
+ */
+export function authorShown(author: string): string {
+  return suppliedValue(author);
+}
+
+/** Whether `text` begins with the author's line, as the author wrote their
+ *  name or as the framework shows it (authorShown). */
+export function beginsWithAuthorLine(author: string, text: string): boolean {
+  return beginsWithAuthor(author, text) || beginsWithAuthor(authorShown(author), text);
+}
+
+/** `author: text`, unless `text` begins that way already. */
+export function authorLine(author: string, text: string): string {
+  return beginsWithAuthorLine(author, text) ? text : `${authorShown(author)}: ${text}`;
+}
+
+/**
+ * A message stored under the anonymous participant that names an author is
+ * presented with the author before its first text block — or, with no text
+ * block, as a leading `Name:` line before its media. Any other message, and
+ * one whose text already begins with the author's line, is returned as is.
+ * Never mutates its input.
+ */
+export function presentAuthor<M extends { participant: string; content: ContentBlock[]; metadata?: MessageMetadata | Record<string, unknown> }>(message: M): M {
+  if (message.participant !== ANONYMOUS_PARTICIPANT) return message;
+  const author = authorNamed(message.metadata);
+  if (author === undefined) return message;
+  const index = message.content.findIndex((b) => b.type === 'text');
+  if (index === -1) {
+    return { ...message, content: [{ type: 'text', text: `${authorShown(author)}:` } as TextBlock, ...message.content] };
+  }
+  const block = message.content[index] as TextBlock;
+  if (typeof block.text !== 'string' || beginsWithAuthorLine(author, block.text)) return message;
+  const content = [...message.content];
+  content[index] = { ...block, text: `${authorShown(author)}: ${block.text}` };
+  return { ...message, content };
+}

package/src/code-execution/isolate/render.ts

@@ -9,6 +9,7 @@ import { fresh, toolRef, type CallSummary, type NamedCall } from './calls.js';
 import type { Ending } from './runner.js';
 import type { ScriptListing, ScriptReturn } from './scripts.js';
 import { renderOutput } from './output.js';
+import { quotedValue, suppliedValue } from '../../supplied-text.js';
 
 /**
  * The most of a script's return value, or of a failure's message or stack,
@@ -67,18 +68,18 @@ function endingLine(id: string, ending: Ending, lifetimeMs: number): string {
       return `Script ${id} finished.`;
     case 'failed':
       // The run keeps the message cut to VALUE_CHARS, with room for the cut's marker.
-      return `Script ${id} failed: ${ending.error.name ? `${ending.error.name}: ` : ''}${ending.error.message}`;
+      return `Script ${id} failed: ${ending.error.name ? `${suppliedValue(ending.error.name)}: ` : ''}${suppliedValue(ending.error.message)}`;
     case 'stopped': {
       const why = ending.reason === 'agent'
         ? `Script ${id} was stopped, as you asked.`
         : ending.why
-          ? `Script ${id} was stopped: ${ending.why}.`
+          ? `Script ${id} was stopped: ${suppliedValue(glimpse(ending.why, 300))}.`
           : `Script ${id} was stopped at its limit of ${formatMs(lifetimeMs)}.`;
       return ending.short ? `${why} Its process didn't stop by itself and was ended, so its output may be short.` : why;
     }
     case 'crashed':
       // The detail is the host's account; what it means for the agent follows.
-      return `Script ${id} crashed: ${ending.detail}. A crash is the script's process failing, not an error its code threw: a fault in the host or its runtime, or something the script's own data asked of the runtime that it couldn't do, such as reading values nested thousands deep, or code nested hundreds deep. Running it again may work; if the same script crashes again, change what it does with its data or its code.`;
+      return `Script ${id} crashed: ${suppliedValue(ending.detail)}. A crash is the script's process failing, not an error its code threw: a fault in the host or its runtime, or something the script's own data asked of the runtime that it couldn't do, such as reading values nested thousands deep, or code nested hundreds deep. Running it again may work; if the same script crashes again, change what it does with its data or its code.`;
   }
 }
 
@@ -107,7 +108,7 @@ function namedLine(call: NamedCall): string {
     case 'timed-out':
       return `- timed out in the script, and still running when the script ended, so it may still take effect: ${namedRef(call)}`;
     case 'timed-out-answered':
-      return `- timed out in the script, and its answer came later: ${namedRef(call)}, answer ${JSON.stringify(call.answer ?? '')}`;
+      return `- timed out in the script, and its answer came later: ${namedRef(call)}, answer ${quotedValue(call.answer ?? '')}`;
     case 'too-large':
       return `- answered with a result the script couldn't receive, too large for its memory or nested too deep, so it got an error instead: ${namedRef(call)}`;
     case 'unseen':
@@ -208,11 +209,11 @@ function listingState(s: ScriptListing, now: number): string {
     case 'finished':
       return `finished${when}`;
     case 'failed':
-      return `failed${when}: ${e.error.name ? `${e.error.name}: ` : ''}${glimpse(e.error.message, 300)}`;
+      return `failed${when}: ${e.error.name ? `${suppliedValue(e.error.name)}: ` : ''}${suppliedValue(glimpse(e.error.message, 300))}`;
     case 'crashed':
       return `crashed${when}`;
     case 'stopped':
-      return e.reason === 'agent' ? `stopped by you${when}` : e.why ? `stopped${when}: ${e.why}` : `stopped at its limit${when}`;
+      return e.reason === 'agent' ? `stopped by you${when}` : e.why ? `stopped${when}: ${suppliedValue(glimpse(e.why, 300))}` : `stopped at its limit${when}`;
     default:
       return 'ended';
   }

package/src/code-execution/isolate/scripts.ts

@@ -32,6 +32,7 @@ import type { CallSummary } from './calls.js';
 import type { OutputBounds, OutputWindow } from './output.js';
 import type { PreludeTool } from './prelude.js';
 import { glimpse } from './render.js';
+import { quotedJson, suppliedValue } from '../../supplied-text.js';
 
 /** The run or wait call watching a script: its turn, which the script's calls carry, and whether one of them ended that turn. */
 export interface ScriptWatch {
@@ -473,16 +474,16 @@ export class AgentScripts {
 
 function leftEndingText(scriptId: string, ending: Ending): string {
   const how = ending.how === 'failed'
-    ? `failed: ${ending.error.name ? `${ending.error.name}: ` : ''}${glimpse(ending.error.message, 300)}`
+    ? `failed: ${ending.error.name ? `${suppliedValue(ending.error.name)}: ` : ''}${suppliedValue(glimpse(ending.error.message, 300))}`
     : ending.how === 'crashed'
-      ? `crashed: ${ending.detail}`
+      ? `crashed: ${suppliedValue(ending.detail)}`
       : ending.how === 'stopped'
-        ? ending.why ? `was stopped: ${ending.why}` : 'was stopped at its limit'
+        ? ending.why ? `was stopped: ${suppliedValue(glimpse(ending.why, 300))}` : 'was stopped at its limit'
         : 'ended';
   return `[${NOTICE_TAG.script} ${scriptId}] Your script ${how}. {"action": "wait", "script_id": "${scriptId}"} gives its result.`;
 }
 
 function wakeText(scriptId: string, payloadJson: string, n: number, max: number, ageMs: number): string {
   const minutes = Math.round(ageMs / 60_000);
-  return `[${NOTICE_TAG.script} ${scriptId}] Woke you with wake_agent(), ${minutes} min after it started (wake ${n} of ${max}): ${payloadJson}`;
+  return `[${NOTICE_TAG.script} ${scriptId}] Woke you with wake_agent(), ${minutes} min after it started (wake ${n} of ${max}): ${quotedJson(payloadJson)}`;
 }

package/src/dendrite/index.ts

@@ -0,0 +1,32 @@
+export { AgentRegistry, AgentSpecError } from './registry.js';
+export type { AgentRegistryOptions, RestoreOutcome, ReconcileOutcome } from './registry.js';
+export {
+  residentSpec,
+  subconsciousSpec,
+  conversationForkSpec,
+  workerSpec,
+  taskForkSpec,
+  DEFAULT_TASK_IDLE_TIMEOUT_MS,
+} from './presets.js';
+export type { BoundedJobOptions } from './presets.js';
+export type {
+  AgentName,
+  AgentKind,
+  AgentRoles,
+  AgentLifetime,
+  ActivationBounds,
+  ParentEndPolicy,
+  ResultRoute,
+  ObserveEdge,
+  AgentRelationships,
+  ContextInheritance,
+  AgentSpec,
+  AgentEndReason,
+  AgentRef,
+  ActivationRecord,
+  AgentRecord,
+  HeldMail,
+  RegistrySnapshot,
+  EndOutcome,
+  PolicyEpoch,
+} from './types.js';