@cello-protocol/daemon 0.0.34 → 0.0.36

package/dist/daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EASrB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAQ/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAsB7G,OAAO,KAAK,EAAE,kBAAkB,EAA+C,MAAM,yBAAyB,CAAC;AAO/G,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AA0InF,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,IAAI,SAAS,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;CACtC;AA2CD,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CA01K7E"}
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAQrB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAQ/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAsB7G,OAAO,KAAK,EAAE,kBAAkB,EAA+C,MAAM,yBAAyB,CAAC;AAO/G,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AA0InF,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,IAAI,SAAS,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;CACtC;AA2CD,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAi9K7E"}

package/dist/daemon.js

@@ -463,8 +463,6 @@ export async function startDaemon(config) {
             assignment: carry,
         };
     };
-    // Stub: all connections marked as 'unverified' until connection validation is wired
-    const connections = [];
     // M7-SIGNAL-001: Instantiate SignalingManager — owns directory signaling stream lifecycle.
     const defaultConnect = async () => {
         throw new Error("directory_signaling_not_configured");
@@ -818,10 +816,12 @@ export async function startDaemon(config) {
         const record = sessionNodeManager.getSessionRecord(agentName, sessionId);
         if (!record || record.status !== "active")
             return;
-        // M8C-CONTACT-1: this check MUST run synchronously (before any await below) — the caller of
-        // sendAwayResponse for a fresh inbound request fires this THEN calls addContact right after
-        // (D6: "accepting X's request adds X"), relying on this line executing first so a stranger's
-        // VERY FIRST contact is correctly judged unknown, not already-added.
+        // M8C-CONTACT-1 / CC-1: select the ack wording by whether the sender is a known contact —
+        // STRANGER_TEXT ("Dispatched.") for unknown, AWAY_TEXT[kind] for known. Post-CC-1 the inbound
+        // accept path no longer auto-adds the sender, so an unattended stranger STAYS unknown across
+        // every inbound interaction (promotion now requires operator engagement — an outbound initiate,
+        // a cello_send reply, or an explicit contact add). No subsequent add is coupled to this line's
+        // ordering anymore; it is a plain read of current contact state.
         const isKnown = sessionNodeManager.isContact(agentName, record.counterparty_pubkey);
         awayAckSent.add(dedupKey); // guard BEFORE the async send — concurrent arrivals must not double-ack
         try {
@@ -1555,11 +1555,52 @@ export async function startDaemon(config) {
             interruptedAt: row.interrupted_at ?? new Date(row.updated_at).toISOString(),
         }));
     }
+    // CC-5/F21: reap dead half-open sessions on READ (compute-on-read, like reapExpiredInboundSessions —
+    // no background timer). A session the standing receiver opened from an inbound offer the initiator
+    // ABANDONED stays "active" forever (the counterparty never joins), clutters the open/active lists, and
+    // its normal close fires an unsealable bilateral seal. Mark such a session terminal ("abandoned") once
+    // it is PROVABLY dead: counterparty never established (liveness != "alive" AND 0 RECEIVED messages —
+    // message_count alone counts our own auto-"Dispatched." ack, so it is NOT the signal) + age past the
+    // grace TTL (a genuinely fresh session still setting up must survive).
+    // CC-10 (live 2026-07-08 Phase-2 block): scan 'interrupted' too, not just 'active'. A daemon restart
+    // flips dead half-opens to 'interrupted'; those classify as "failed" (invisible in every list) yet
+    // still count toward the unknown-sender acceptance bound (D18 deliberately counts 'interrupted') — so
+    // a stranger whose first handshakes died was silently locked out FOREVER. Reaping only 0-RECEIVED
+    // ghosts keeps D18 intact: the disconnect-evasion attacker's sessions always carry received content.
+    const HALF_OPEN_TTL_MS = Number(process.env["CELLO_HALF_OPEN_TTL_MS"]) || 5 * 60 * 1000;
+    function reapDeadHalfOpenSessions(agentName) {
+        const now = Date.now();
+        const candidates = [...sessionNodeManager.getSessionsByStatus("active"), ...sessionNodeManager.getSessionsByStatus("interrupted")];
+        for (const row of candidates) {
+            if (agentName !== undefined && row.agent_name !== agentName)
+                continue;
+            if (now - row.created_at <= HALF_OPEN_TTL_MS)
+                continue; // too young — may just be setting up
+            if (sessionNodeManager.getSessionLiveness(row.agent_name, row.session_id) === "alive")
+                continue; // live
+            if (sessionNodeManager.countReceivedMessages(row.agent_name, row.session_id) > 0)
+                continue; // counterparty spoke
+            // Non-awaited: abandonSession flips the DB status synchronously (before its first await), so THIS
+            // read reflects it; the async node teardown finishes in the background. CC-10 reviewer LOW: only
+            // log "reaped" if the status flip actually wrote — a swallowed write failure already logs
+            // session.status.write.failed, and reporting success over it would hide a still-counting ghost.
+            void sessionNodeManager.abandonSession(row.agent_name, row.session_id)
+                .then((flipped) => {
+                if (flipped) {
+                    logger.info("session.half_open.reaped", { agentName: row.agent_name, sessionId: row.session_id, priorStatus: row.status, ageMs: now - row.created_at });
+                }
+            })
+                .catch((err) => {
+                logger.warn("session.half_open.reap.failed", { agentName: row.agent_name, sessionId: row.session_id, reason: err instanceof Error ? err.message : String(err) });
+            });
+        }
+    }
     // M8B F16: per-session liveness for ACTIVE sessions, shared by both status surfaces
     // ("status" for the CLI, "cello_status" for MCP). The signal (session.liveness.changed,
     // tracked in the node manager) existed but nothing consumed it — a dead counterparty
     // was invisible to the operator.
     function buildActiveSessions() {
+        reapDeadHalfOpenSessions(); // CC-5/F21: drop provably-dead half-open sessions before surfacing active ones
         return sessionNodeManager.getSessionsByStatus("active").map((row) => ({
             sessionId: row.session_id,
             agentName: row.agent_name,
@@ -1577,11 +1618,22 @@ export async function startDaemon(config) {
             // M8B F14 (fix 5): per-agent standing-receiver readiness, so a deaf agent (online but
             // no armed receiver) is visible in cello_status instead of hiding behind the ANY-agent
             // aggregate below (kept for backward compatibility).
-            agents: agents.map((a) => ({
-                ...a,
-                standing_receiver_ready: sessionNodeManager.getStandingReceiverReady(a.name),
-            })),
-            connections,
+            // CC-8 (F5 parity): the CLI `cello status` surface must show online vs registered like the MCP
+            // cello_status does. The stored `a.state` is stale — it stays "registered" even when the agent is
+            // online, because startAgentInternal only adds to onlineAgents and never mutates the record — so
+            // derive readiness from onlineAgents here, exactly as getAgentsForConnection (F5) already does for
+            // the MCP surface. A load_failed agent keeps its state so a broken agent stays visible as broken.
+            // (No `selected` here: this is the daemon-wide surface; selection is a per-connection concept and
+            // the CLI opens an ephemeral connection that never runs cello_use_agent — see M8C-DECISIONS D24.)
+            agents: agents.map((a) => {
+                const online = onlineAgents.has(a.name);
+                const state = a.state === "load_failed" ? "load_failed" : online ? "online" : "registered";
+                return {
+                    ...a,
+                    state,
+                    standing_receiver_ready: sessionNodeManager.getStandingReceiverReady(a.name),
+                };
+            }),
             standing_receiver_ready: sessionNodeManager.getStandingReceiverReady(),
             retryQueueDepth: retryQueue.getTotalDepth(),
             interrupted_sessions,
@@ -2127,6 +2179,23 @@ export async function startDaemon(config) {
                 // committed at this point (RegistrationManager awaits the persist before returning success).
                 // SI-001: never log a secret — only the agent name + PUBLIC key.
                 logger.info("persist.identity.persisted", { agentName: name, agentPubkey: agentPubkeyHex });
+                // CC-2 (2026-07-07): registration succeeded — arm this agent's standing receiver NOW so a
+                // brand-new agent can receive inbound immediately. Without this the agent reports
+                // standing_receiver_ready:false and cannot receive until the operator restarts (logout/login),
+                // so a fresh registration looks broken. Uses the SAME idempotent path login and cello_use_agent
+                // arm through (startAgentInternal → onlineAgents + directory signaling + ensureStandingReceiver +
+                // agent_state_changed). A start failure must NOT fail the (already durably persisted)
+                // registration — surface it as a warning and let the operator recover via login.
+                const armResult = startAgentInternal(name);
+                if (!armResult.ok) {
+                    logger.warn("registration.standing_receiver.arm_failed", { agentName: name, reason: armResult.reason });
+                }
+                else {
+                    // arm_INITIATED, not armed: startAgentInternal returns ok once the agent is online + signaling
+                    // is up, but ensureStandingReceiverForAgent runs fire-and-forget (its own failure emits
+                    // session.standing_receiver.ensure.failed) — so this event marks the start, not readiness.
+                    logger.info("registration.standing_receiver.arm_initiated", { agentName: name });
+                }
                 // Capture-now-or-lose-it: persist the agent→user link (using it is future
                 // trust-layer work). L1: the agent is already registered at this point —
                 // a link-write failure must NOT be reported as a registration failure.
@@ -2690,7 +2759,6 @@ export async function startDaemon(config) {
             daemon: "running",
             directory_signaling: directorySignalingStatus(),
             agents: getAgentsForConnection(connectionId),
-            connections,
             // M-1 PULL: live MCP clients must see interrupted sessions too, exactly as
             // the daemon-wide getStatus() surfaces them.
             interrupted_sessions: buildInterruptedSessions(),
@@ -2739,10 +2807,13 @@ export async function startDaemon(config) {
     //      to the MCP response.
     handlers.set("cello_initiate_session", async (params, connectionId) => {
         const connState = perConnectionState.get(connectionId);
-        if (!connState || !connState.currentAgent) {
+        // CC-3 / M8C-AUTOSTART-1 F18: resolve the target agent — explicit { name } wins, else this
+        // connection's current agent, else the sole online agent (removes the no_current_agent papercut
+        // after a /mcp reconnect when exactly one agent is online). 2+ online with none selected → null.
+        const agentName = resolveCurrentAgent(connState, params?.name);
+        if (!agentName) {
             return NO_CURRENT_AGENT_RESPONSE;
         }
-        const agentName = connState.currentAgent;
         const correlationId = randomUUID();
         // AC-004/AC-019: the advertised address is chosen from the standing receiver's
         // current dialability. Not dialable (or AutoNAT unavailable) → relay circuit.
@@ -2861,7 +2932,9 @@ export async function startDaemon(config) {
     // SI-001: no auto-seal on session_interrupted receipt; operator must call explicitly
     handlers.set("cello_close_session", async (params, connectionId) => {
         const connState = perConnectionState.get(connectionId);
-        if (!connState || !connState.currentAgent) {
+        // CC-3 / M8C-AUTOSTART-1 F18: explicit { name } > this connection's current > sole online agent.
+        const agentName = resolveCurrentAgent(connState, params?.name);
+        if (!agentName) {
             return NO_CURRENT_AGENT_RESPONSE;
         }
         // round-2 BLOCKING: the public IPC contract field is snake_case `session_id`
@@ -2881,7 +2954,7 @@ export async function startDaemon(config) {
         // the ownership scope. A session_id owned only by a DIFFERENT agent does not exist in this
         // agent's namespace (returns null → session_not_found), which is correct for loopback (two
         // agents can hold the same session_id on one daemon).
-        const record = sessionNodeManager.getSessionRecord(connState.currentAgent, sessionId);
+        const record = sessionNodeManager.getSessionRecord(agentName, sessionId);
         if (!record) {
             return {
                 ok: false,
@@ -2891,7 +2964,7 @@ export async function startDaemon(config) {
         }
         // Ownership: redundant now that the lookup is agent-scoped (record.agent_name === currentAgent),
         // kept as a defensive invariant.
-        if (record.agent_name !== connState.currentAgent) {
+        if (record.agent_name !== agentName) {
             return {
                 ok: false,
                 reason: "session_not_owned",
@@ -2906,6 +2979,26 @@ export async function startDaemon(config) {
                 guidance: "This session is already sealed. No further action is needed — check cello_list_sessions to view its sealed record and the FROST notarization.",
             };
         }
+        // CC-5/F21 terminal-escape: force-abandon a session that can never be bilaterally sealed — a
+        // half-open handshake the counterparty never joined, whose normal close fires a seal the absent/
+        // rejecting counterparty can't complete (seal_interrupted_rejected_by_counterparty / timeout). Marks
+        // it locally-terminal ("abandoned") with NO seal, so it leaves the open list. Additive: placed BEFORE
+        // the seal branches, it never touches the seal flow. Owner-scoped (the lookup above is agent-scoped)
+        // and idempotent. NOT for a healthy session — a normal close (no force) still seals so both parties
+        // get a notarized receipt; force is the escape hatch for a provably unsealable ghost.
+        if (params?.force === true) {
+            if (record.status === "abandoned") {
+                return { ok: true, status: "abandoned", reason: "already_abandoned", guidance: "This session was already force-abandoned." };
+            }
+            await sessionNodeManager.abandonSession(record.agent_name, sessionId);
+            logger.info("session.force_abandoned", { agentName: record.agent_name, sessionId, priorStatus: record.status });
+            return {
+                ok: true,
+                status: "abandoned",
+                reason: "force_abandoned",
+                guidance: `Session ${sessionId} was force-abandoned — marked terminal locally with no bilateral seal. Use force only for a half-open session that cannot be sealed; a normal close (no force) still attempts the seal so both parties get a notarized receipt.`,
+            };
+        }
         // AC-011: seal-interrupted already in progress
         if (sealInterruptedInProgress.has(sealKey(record.agent_name, sessionId))) {
             return {
@@ -3174,10 +3267,13 @@ export async function startDaemon(config) {
         }
         // DOD-LOOP-1: the certificate is keyed by (agent, session_id) — read the current agent's.
         const connState = perConnectionState.get(connectionId);
-        if (!connState || !connState.currentAgent) {
+        // CC-3 / M8C-AUTOSTART-1 F18: resolve the target agent — explicit { name } wins, else this
+        // connection's current agent, else the sole online agent (removes the no_current_agent papercut
+        // after a /mcp reconnect when exactly one agent is online). 2+ online with none selected → null.
+        const agentName = resolveCurrentAgent(connState, params?.name);
+        if (!agentName) {
             return NO_CURRENT_AGENT_RESPONSE;
         }
-        const agentName = connState.currentAgent;
         const cert = sessionNodeManager.getSealCertificate(agentName, sessionId);
         if (cert) {
             return { ok: true, session_id: sessionId, sealed_root: cert.sealed_root, legibility: cert.legibility };
@@ -3229,10 +3325,12 @@ export async function startDaemon(config) {
             return { ok: false, reason: "missing_session_id", guidance: "Provide the session_id (hex) whose transcript to read. See cello_list_sessions." };
         }
         const connState = perConnectionState.get(connectionId);
-        if (!connState || !connState.currentAgent) {
+        // CC-3 / M8C-AUTOSTART-1 F18: explicit { name } > this connection's current > sole online agent.
+        const agentName = resolveCurrentAgent(connState, params?.name);
+        if (!agentName) {
             return NO_CURRENT_AGENT_RESPONSE;
         }
-        const { messages, undecryptable } = sessionNodeManager.readTranscript(connState.currentAgent, sessionId);
+        const { messages, undecryptable } = sessionNodeManager.readTranscript(agentName, sessionId);
         // undecryptable > 0 means some rows failed GCM auth (tamper / wrong key) — surfaced, not hidden,
         // so the reader can tell a real gap from an empty transcript.
         // M8C-CURSOR-1: this is the ONLY reader that covers BOTH directions (sent + received), so it's
@@ -3293,10 +3391,13 @@ export async function startDaemon(config) {
     // the live ones. Read from persisted SQLite, so it survives a daemon restart / fresh connection.
     handlers.set("cello_list_sessions", async (params, connectionId) => {
         const connState = perConnectionState.get(connectionId);
-        if (!connState || !connState.currentAgent) {
+        // CC-3 / M8C-AUTOSTART-1 F18: explicit { name } > this connection's current > sole online agent.
+        const agentName = resolveCurrentAgent(connState, params?.name);
+        if (!agentName) {
             return NO_CURRENT_AGENT_RESPONSE;
         }
-        return selectSessions(sessionNodeManager.getSessionsForAgent(connState.currentAgent), params);
+        reapDeadHalfOpenSessions(agentName); // CC-5/F21: drop provably-dead half-open sessions before listing
+        return selectSessions(sessionNodeManager.getSessionsForAgent(agentName), params);
     });
     // list_sessions (daemon-wide, for the `cello sessions` CLI which has no current agent): same
     // filter/limit semantics, across ALL agents.
@@ -3956,6 +4057,11 @@ export async function startDaemon(config) {
             // senders — a per-sender cap (many sessions from ONE stranger) and a global cap (many
             // sessions across ALL strangers combined). Known contacts are exempt ("bounded only by
             // disk" — DoD). Checked FIRST, before any standing-receiver work, so a refusal is cheap.
+            // CC-10: reap provably-dead ghosts for THIS agent before counting — otherwise invisible
+            // interrupted 0-received sessions (post-restart shape) consume the sender's budget forever
+            // and lock the stranger out with no list read ever clearing them. Safe here: abandonSession
+            // flips the DB status synchronously, so the bound query below sees the reaped state.
+            reapDeadHalfOpenSessions(agentName);
             const bound = sessionNodeManager.checkUnknownSenderAcceptanceBound(agentName, parsed.participantAPubkeyHex);
             if (!bound.ok) {
                 logger.warn("session.inbound.accept.failed", {
@@ -4039,12 +4145,15 @@ export async function startDaemon(config) {
             void sendTelegramDoorbell(agentName, parsed.sessionIdHex, "session_request", "New session request");
             // M8C-AWAY-1: an unattended agent auto-acks a fresh inbound session request. Fire-and-forget
             // (sendAwayResponse never throws) — best-effort, must not delay/block acceptance completion.
-            // ORDER MATTERS: sendAwayResponse's isContact check runs synchronously (before any await) as
-            // soon as it's invoked, so calling addContact on the NEXT line still lets a stranger's very
-            // first contact be judged correctly unknown (M8C-CONTACT-1 D6: "accepting X's request adds X"
-            // — they become known immediately after, for every subsequent interaction).
             void sendAwayResponse(agentName, parsed.sessionIdHex, "request");
-            sessionNodeManager.addContact(agentName, parsed.participantAPubkeyHex);
+            // CC-1 (2026-07-07): do NOT auto-add the requester here. Accepting the *connection* must not
+            // grant *trust*. The old auto-add promoted any stranger who knocked once to "known" (Level-4
+            // fast-track), which defeated BOTH the screening layer AND the ABUSE-1 acceptance caps
+            // (checkUnknownSenderAcceptanceBound exempts contacts, so sessions 2+ bypassed the per-sender
+            // cap — confirmed live 2026-07-07). Promotion to "known" now requires operator engagement only:
+            // an outbound cello_initiate_session (below, ~3137), the operator replying INTO the session via
+            // cello_send, or an explicit cello_contact_add. An unattended stranger is never auto-whitelisted.
+            // See docs/planning/.../2026-07-07_1700_four-level-screening-policy.md (D21).
         }
         finally {
             inboundInFlight.delete(parsed.sessionIdHex);
@@ -4233,10 +4342,13 @@ export async function startDaemon(config) {
     // contract (core/adapter-claude-code/src/server.ts) so the E2E fixture migration is drop-in.
     handlers.set("cello_await_session", async (params, connectionId) => {
         const connState = perConnectionState.get(connectionId);
-        if (!connState || !connState.currentAgent) {
+        // CC-3 / M8C-AUTOSTART-1 F18: resolve the target agent — explicit { name } wins, else this
+        // connection's current agent, else the sole online agent (removes the no_current_agent papercut
+        // after a /mcp reconnect when exactly one agent is online). 2+ online with none selected → null.
+        const agentName = resolveCurrentAgent(connState, params?.name);
+        if (!agentName) {
             return NO_CURRENT_AGENT_RESPONSE;
         }
-        const agentName = connState.currentAgent;
         const timeoutMs = typeof params?.["timeout_ms"] === "number" ? params["timeout_ms"] : 30_000;
         const toResponse = (e) => ({
             type: "new_session",
@@ -4670,7 +4782,9 @@ export async function startDaemon(config) {
     // ─── CELLO-M7-DAEMON-004: cello_send (live send + daemon-owned tree append) ──
     handlers.set("cello_send", async (params, connectionId) => {
         const connState = perConnectionState.get(connectionId);
-        if (!connState || !connState.currentAgent)
+        // CC-3 / M8C-AUTOSTART-1 F18: explicit { name } > current > sole online agent.
+        const agentName = resolveCurrentAgent(connState, params?.name);
+        if (!agentName)
             return NO_CURRENT_AGENT_RESPONSE;
         // round-2 BLOCKING: read the snake_case public field cello-mcp.ts actually sends.
         const sessionId = params?.session_id;
@@ -4679,11 +4793,11 @@ export async function startDaemon(config) {
             return { ok: false, reason: "missing_params", guidance: "Provide 'session_id' (hex) and 'content' (string) parameters." };
         }
         // DOD-LOOP-1: the (agent, session_id) lookup is itself the ownership scope.
-        const record = sessionNodeManager.getSessionRecord(connState.currentAgent, sessionId);
+        const record = sessionNodeManager.getSessionRecord(agentName, sessionId);
         if (!record) {
             return { ok: false, reason: "session_not_found", guidance: "No session found with this ID. Check cello_list_sessions for active sessions." };
         }
-        if (record.agent_name !== connState.currentAgent) {
+        if (record.agent_name !== agentName) {
             return { ok: false, reason: "session_not_owned", guidance: "This session belongs to a different agent. Call cello_use_agent to switch to the agent that owns it, then retry." };
         }
         if (record.status !== "active") {
@@ -4849,6 +4963,14 @@ export async function startDaemon(config) {
         // blocked by session_not_current on its own just-sent message.
         advanceConnectionCursor(connectionId, sessionId, leafIndex);
         void newRootHex;
+        // CC-1 (2026-07-07): operator engagement promotes the counterparty to a known contact. A
+        // committed reply — past the read-before-write gate, content now on the wire AND in the tree —
+        // IS the operator choosing to trust this sender; the inbound-accept path deliberately no longer
+        // auto-adds (that defeated screening + anti-spam). For an OUTBOUND session the counterparty is
+        // already a contact (cello_initiate_session added it), so this is an idempotent no-op there; it
+        // matters for inbound-originated sessions, where the reply is the trust signal. addContact is
+        // INSERT OR IGNORE — it never refreshes added_at.
+        sessionNodeManager.addContact(record.agent_name, recipientPubkey);
         if (modified) {
             logger.info("security.verdict.returned", { disposition: "redact", sessionId, sequenceNumber: leafIndex, correlationId });
         }
@@ -4900,9 +5022,10 @@ export async function startDaemon(config) {
     const RECEIVE_DEFAULT_TIMEOUT_MS = 30000; // matches the cello-mcp shim's documented default
     const handleReceive = async (params, connectionId) => {
         const connState = perConnectionState.get(connectionId);
-        if (!connState || !connState.currentAgent)
+        // CC-3 / M8C-AUTOSTART-1 F18: explicit { name } > current > sole online agent.
+        const agentName = resolveCurrentAgent(connState, params?.name);
+        if (!agentName)
             return NO_CURRENT_AGENT_RESPONSE;
-        const agentName = connState.currentAgent;
         // Read the snake_case public field cello-mcp.ts actually sends.
         const sessionId = params?.session_id;
         if (!sessionId) {