@ctliz/agent-intercom-claude 0.12.0-connect.3 → 0.13.0-connect.1

package/claude/runtime.ts

@@ -96,13 +96,28 @@ function shortHash(value: string): string {
   return createHash("sha256").update(value).digest("hex").slice(0, 8);
 }
 
+const GENERIC_SESSION_ID_REGEX = /^[A-Za-z0-9_-]{1,128}$/;
+
 export function buildClaudeRuntimeIdentity(env: NodeJS.ProcessEnv = process.env, cwd = env.PWD || processCwd(), pid = process.pid): ClaudeRuntimeIdentity {
-  const sessionId = env.CLAUDE_INTERCOM_SESSION_ID?.trim()
-    || env.CLAUDE_PEER_ID?.trim()
-    || `claude-${pid}-${shortHash(cwd)}`;
+  let sessionId = env.CLAUDE_INTERCOM_SESSION_ID?.trim()
+    || env.CLAUDE_PEER_ID?.trim();
+  if (!sessionId && env.AGENT_INTERCOM_SESSION_ID !== undefined) {
+    const raw = env.AGENT_INTERCOM_SESSION_ID.trim();
+    if (raw) {
+      if (!GENERIC_SESSION_ID_REGEX.test(raw)) {
+        throw new Error("Invalid AGENT_INTERCOM_SESSION_ID: must match ^[A-Za-z0-9_-]{1,128}$");
+      }
+      sessionId = raw;
+    }
+  }
+  if (!sessionId) {
+    sessionId = `claude-${pid}-${shortHash(cwd)}`;
+  }
+
   const cwdName = basename(cwd) || "workspace";
   const name = env.CLAUDE_INTERCOM_NAME?.trim()
     || env.CLAUDE_PEER_NAME?.trim()
+    || (env.AGENT_INTERCOM_SESSION_NAME !== undefined && env.AGENT_INTERCOM_SESSION_NAME.trim() ? env.AGENT_INTERCOM_SESSION_NAME.trim() : undefined)
     || `claude-${cwdName}-${pid}`;
   return {
     sessionId,

package/claude/team.ts

@@ -1,12 +1,17 @@
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { PARTICIPANT_STATES, TERMINAL_PARTICIPANT_STATES } from "@ctliz/agent-intercom-core/boss";
+import { readTeamManifestAsync, TeamManifestError } from "@ctliz/agent-intercom-core/team-manifest";
 import type { BossSessionMetadata } from "../types.ts";
 import { getAgentDirPath } from "../broker/paths.ts";
 
+export type TeamSource = "orchestrator" | "boss" | "manifest" | "live" | "standalone";
+
 export interface TeamSession {
   id: string;
   name?: string;
+  model?: string;
+  origin?: "local" | "remote";
   /** Already parsed and broker-authenticated by the client session decoder. */
   boss?: Pick<BossSessionMetadata, "binding" | "principal" | "liveWorker">;
 }
@@ -42,6 +47,7 @@ export interface IntercomTeam {
   self: { id: string; workerId?: string; isManager: boolean };
   manager?: { target: string; connected: boolean };
   coworkers: TeamMember[];
+  source: TeamSource;
 }
 
 const LEGACY_LIVE_STATES = new Set(["provisioning", "running", "idle", "needs_attention", "stopping"]);
@@ -212,11 +218,106 @@ function teamMember(worker: StoredWorker, session: TeamSession): TeamMember {
   };
 }
 
-function resolveLegacyTeam(
+async function resolveNonAuthoritativeTeam(
+  input: { selfId: string; sessions: TeamSession[] },
+  env: NodeJS.ProcessEnv,
+): Promise<IntercomTeam> {
+  if (env.AGENT_INTERCOM_TEAM_MANIFEST !== undefined) {
+    const rawPath = env.AGENT_INTERCOM_TEAM_MANIFEST.trim();
+    if (!rawPath) {
+      throw new TeamManifestError("ERR_TEAM_MANIFEST_INVALID");
+    }
+    const manifest = await readTeamManifestAsync(rawPath);
+    if (!manifest) {
+      throw new TeamManifestError("ERR_TEAM_MANIFEST_INVALID");
+    }
+    const selfMember = manifest.members.find((m) => m.sessionId === input.selfId);
+    if (!selfMember) {
+      throw new TeamManifestError("ERR_TEAM_MANIFEST_INVALID");
+    }
+
+    const isManager = input.selfId === manifest.leadId;
+    const managerTarget = manifest.leadId;
+    const managerConnected = connectedTo(input.sessions, managerTarget);
+
+    const coworkers: TeamMember[] = manifest.members
+      .filter((m) => m.sessionId !== input.selfId)
+      .filter((m) => isManager || m.sessionId !== managerTarget)
+      .map((m) => {
+        const live = input.sessions.find((s) => s.id === m.sessionId || s.name === m.sessionId);
+        return {
+          id: m.sessionId,
+          target: m.sessionId,
+          role: m.role,
+          connected: Boolean(live),
+        };
+      });
+
+    return {
+      teamId: manifest.runId,
+      self: { id: input.selfId, isManager },
+      manager: { target: managerTarget, connected: managerConnected },
+      coworkers,
+      source: "manifest",
+    };
+  }
+
+  if (stringValue(env.AGENT_INTERCOM_SCOPE_ID)) {
+    const managerTarget = stringValue(env.AGENT_INTERCOM_MANAGER_TARGET)
+      ?? stringValue(env.AGENT_INTERCOM_MANAGER_SESSION_ID);
+    const role = stringValue(env.AGENT_INTERCOM_ROLE)?.toLowerCase();
+
+    const isManager = role === "manager"
+      || (managerTarget !== undefined && managerTarget === input.selfId)
+      || (managerTarget === undefined && role !== "worker");
+
+    const effectiveManagerTarget = isManager ? input.selfId : managerTarget;
+
+    const coworkers: TeamMember[] = input.sessions
+      .filter((session) => session.id !== input.selfId)
+      .filter((session) => session.model !== "human")
+      .filter((session) => session.id !== effectiveManagerTarget)
+      .map((session): TeamMember => ({
+        id: session.id,
+        target: session.id,
+        ...(session.model ? { harness: session.model } : {}),
+        connected: true,
+      }));
+
+    const manager = effectiveManagerTarget
+      ? {
+          target: effectiveManagerTarget,
+          connected: isManager ? true : connectedTo(input.sessions, effectiveManagerTarget),
+        }
+      : undefined;
+
+    return {
+      teamId: effectiveManagerTarget ?? input.selfId,
+      self: { id: input.selfId, isManager },
+      ...(manager ? { manager } : {}),
+      coworkers,
+      source: "live",
+    };
+  }
+
+  const managerTarget = stringValue(env.AGENT_INTERCOM_MANAGER_TARGET)
+    ?? stringValue(env.AGENT_INTERCOM_MANAGER_SESSION_ID);
+  return {
+    teamId: managerTarget ?? input.selfId,
+    self: { id: input.selfId, isManager: !managerTarget },
+    manager: managerTarget
+      ? { target: managerTarget, connected: connectedTo(input.sessions, managerTarget) }
+      : { target: input.selfId, connected: true },
+    coworkers: [],
+    source: "standalone",
+  };
+}
+
+async function resolveLegacyTeam(
   input: { selfId: string; sessions: TeamSession[] },
   workers: StoredWorker[],
   env: NodeJS.ProcessEnv,
-): IntercomTeam {
+): Promise<IntercomTeam> {
   const workerId = stringValue(env.AGENT_INTERCOM_WORKER_ID);
   const runId = stringValue(env.AGENT_INTERCOM_RUN_ID);
   const current = workerId
@@ -225,37 +326,86 @@ function resolveLegacyTeam(
       && (!runId || stringValue(worker.runId) === runId)
     )
     : undefined;
-  const managerTarget = stringValue(current?.managerSessionId)
-    ?? stringValue(env.AGENT_INTERCOM_MANAGER_TARGET)
-    ?? stringValue(env.AGENT_INTERCOM_MANAGER_SESSION_ID);
-  const teamId = managerTarget ?? input.selfId;
-  const coworkers = workers
-    .filter((worker) => worker.owned === true)
-    .filter((worker) => stringValue(worker.managerSessionId) === teamId)
-    .filter((worker) => LEGACY_LIVE_STATES.has(stringValue(worker.state) ?? ""))
-    .filter((worker) => stringValue(worker.id) !== workerId)
-    .map((worker): TeamMember | undefined => {
-      const id = stringValue(worker.id);
-      if (!id) return undefined;
-      const target = stringValue(worker.intercomTarget) ?? id;
+
+  if (current) {
+    const managerTarget = stringValue(current?.managerSessionId)
+      ?? stringValue(env.AGENT_INTERCOM_MANAGER_TARGET)
+      ?? stringValue(env.AGENT_INTERCOM_MANAGER_SESSION_ID);
+    if (!managerTarget) {
       return {
-        id,
-        target,
-        ...(stringValue(worker.harness) ? { harness: stringValue(worker.harness) } : {}),
-        ...(stringValue(worker.role) ? { role: stringValue(worker.role) } : {}),
-        ...(stringValue(worker.state) ? { state: stringValue(worker.state) } : {}),
-        connected: connectedTo(input.sessions, target),
+        self: { id: input.selfId, ...(workerId ? { workerId } : {}), isManager: false },
+        coworkers: [],
+        source: "orchestrator",
       };
-    })
-    .filter((member): member is TeamMember => Boolean(member));
-  return {
-    teamId,
-    self: { id: input.selfId, ...(workerId ? { workerId } : {}), isManager: !managerTarget },
-    manager: managerTarget
-      ? { target: managerTarget, connected: connectedTo(input.sessions, managerTarget) }
-      : { target: input.selfId, connected: true },
-    coworkers,
-  };
+    }
+    const coworkers = workers
+      .filter((worker) => worker.owned === true)
+      .filter((worker) => {
+        const mgr = stringValue(worker.managerSessionId);
+        return mgr !== undefined && mgr === managerTarget;
+      })
+      .filter((worker) => LEGACY_LIVE_STATES.has(stringValue(worker.state) ?? ""))
+      .filter((worker) => stringValue(worker.id) !== workerId && stringValue(worker.id) !== input.selfId)
+      .map((worker): TeamMember | undefined => {
+        const id = stringValue(worker.id);
+        if (!id) return undefined;
+        const target = stringValue(worker.intercomTarget) ?? id;
+        return {
+          id,
+          target,
+          ...(stringValue(worker.harness) ? { harness: stringValue(worker.harness) } : {}),
+          ...(stringValue(worker.role) ? { role: stringValue(worker.role) } : {}),
+          ...(stringValue(worker.state) ? { state: stringValue(worker.state) } : {}),
+          connected: connectedTo(input.sessions, target),
+        };
+      })
+      .filter((member): member is TeamMember => Boolean(member));
+
+    return {
+      teamId: managerTarget,
+      self: { id: input.selfId, ...(workerId ? { workerId } : {}), isManager: false },
+      manager: { target: managerTarget, connected: connectedTo(input.sessions, managerTarget) },
+      coworkers,
+      source: "orchestrator",
+    };
+  }
+
+  if (workerId === undefined) {
+    const ownedCoworkers = workers
+      .filter((worker) => worker.owned === true)
+      .filter((worker) => {
+        const mgr = stringValue(worker.managerSessionId);
+        return mgr !== undefined && mgr === input.selfId;
+      })
+      .filter((worker) => LEGACY_LIVE_STATES.has(stringValue(worker.state) ?? ""))
+      .filter((worker) => stringValue(worker.id) !== input.selfId)
+      .map((worker): TeamMember | undefined => {
+        const id = stringValue(worker.id);
+        if (!id) return undefined;
+        const target = stringValue(worker.intercomTarget) ?? id;
+        return {
+          id,
+          target,
+          ...(stringValue(worker.harness) ? { harness: stringValue(worker.harness) } : {}),
+          ...(stringValue(worker.role) ? { role: stringValue(worker.role) } : {}),
+          ...(stringValue(worker.state) ? { state: stringValue(worker.state) } : {}),
+          connected: connectedTo(input.sessions, target),
+        };
+      })
+      .filter((member): member is TeamMember => Boolean(member));
+
+    if (ownedCoworkers.length > 0) {
+      return {
+        teamId: input.selfId,
+        self: { id: input.selfId, isManager: true },
+        manager: { target: input.selfId, connected: true },
+        coworkers: ownedCoworkers,
+        source: "orchestrator",
+      };
+    }
+  }
+
+  return resolveNonAuthoritativeTeam(input, env);
 }
 
 export async function resolveIntercomTeam(input: {
@@ -276,6 +426,7 @@ export async function resolveIntercomTeam(input: {
       teamId: selfSession.boss.binding.bossRunId,
       self: { id: input.selfId, ...(workerId ? { workerId } : {}), isManager: false },
       coworkers: [],
+      source: "boss",
     };
   }
 
@@ -301,6 +452,7 @@ export async function resolveIntercomTeam(input: {
       teamId: selfSession.boss.binding.bossRunId,
       self: { id: input.selfId, ...(workerId ? { workerId } : {}), isManager: false },
       coworkers: [],
+      source: "boss",
     };
   }
 
@@ -327,9 +479,36 @@ export async function resolveIntercomTeam(input: {
     self: { id: input.selfId, ...(workerId ? { workerId } : {}), isManager: selfIsManager },
     manager: { target: managerTarget, connected: true },
     coworkers,
+    source: "boss",
   };
 }
 
+/** Authorizes a read-only local inbox lookup using exact orchestrator ownership. */
+export function resolveManagedInboxSession(input: {
+  team: IntercomTeam;
+  sessions: TeamSession[];
+  requestedSession: string;
+}): TeamSession {
+  if (input.team.source !== "orchestrator" && input.team.source !== "boss") {
+    throw new Error("Pending-ask inbox access denied: cross-session inbox inspection is only permitted for Orchestrator/Boss-managed teams");
+  }
+  if (!input.team.self.isManager) {
+    throw new Error("Only a manager may inspect another session's pending-ask inbox");
+  }
+  const member = input.team.coworkers.find((entry) => entry.target === input.requestedSession);
+  if (!member) {
+    throw new Error(`Pending-ask inbox access denied for "${input.requestedSession}"; select an owned coworker target returned by intercom_team`);
+  }
+  const liveSession = input.sessions.find((session) => session.id === input.requestedSession);
+  if (!liveSession) {
+    throw new Error(`Pending-ask inbox access denied for "${input.requestedSession}"; the owned coworker target must equal an exact connected stable session ID`);
+  }
+  if (liveSession.origin === "remote") {
+    throw new Error(`Pending-ask inbox "${input.requestedSession}" is remote and cannot be read from this host`);
+  }
+  return liveSession;
+}
+
 export function formatIntercomTeam(team: IntercomTeam): string {
   const lines = [
     `Manager: ${team.manager ? `${team.manager.target} [${team.manager.connected ? "connected" : "not connected"}]` : "unknown"}`,

package/dist/cci.mjs

@@ -2399,6 +2399,7 @@ function defaultInboxPath(sessionId, intercomDir = getIntercomDirPath()) {
 
 // claude/team.ts
 import { PARTICIPANT_STATES, TERMINAL_PARTICIPANT_STATES } from "@ctliz/agent-intercom-core/boss";
+import { readTeamManifestAsync, TeamManifestError } from "@ctliz/agent-intercom-core/team-manifest";
 var BOSS_NONTERMINAL_STATES = new Set(
   PARTICIPANT_STATES.filter((state) => !TERMINAL_PARTICIPANT_STATES.includes(state))
 );

package/dist/ccim.mjs

@@ -2403,6 +2403,7 @@ function defaultInboxPath(sessionId, intercomDir = getIntercomDirPath()) {
 
 // claude/team.ts
 import { PARTICIPANT_STATES, TERMINAL_PARTICIPANT_STATES } from "@ctliz/agent-intercom-core/boss";
+import { readTeamManifestAsync, TeamManifestError } from "@ctliz/agent-intercom-core/team-manifest";
 var BOSS_NONTERMINAL_STATES = new Set(
   PARTICIPANT_STATES.filter((state) => !TERMINAL_PARTICIPANT_STATES.includes(state))
 );

package/dist/claude-server.mjs

@@ -1870,6 +1870,7 @@ function appendInboxMessage(path, from, message) {
 import { readFile } from "node:fs/promises";
 import { join as join6 } from "node:path";
 import { PARTICIPANT_STATES, TERMINAL_PARTICIPANT_STATES } from "@ctliz/agent-intercom-core/boss";
+import { readTeamManifestAsync, TeamManifestError } from "@ctliz/agent-intercom-core/team-manifest";
 var LEGACY_LIVE_STATES = /* @__PURE__ */ new Set(["provisioning", "running", "idle", "needs_attention", "stopping"]);
 var BOSS_NONTERMINAL_STATES = new Set(
   PARTICIPANT_STATES.filter((state) => !TERMINAL_PARTICIPANT_STATES.includes(state))
@@ -1948,33 +1949,139 @@ function teamMember(worker, session) {
     connected: session.id === id
   };
 }
-function resolveLegacyTeam(input, workers, env) {
+async function resolveNonAuthoritativeTeam(input, env) {
+  if (env.AGENT_INTERCOM_TEAM_MANIFEST !== void 0) {
+    const rawPath = env.AGENT_INTERCOM_TEAM_MANIFEST.trim();
+    if (!rawPath) {
+      throw new TeamManifestError("ERR_TEAM_MANIFEST_INVALID");
+    }
+    const manifest = await readTeamManifestAsync(rawPath);
+    if (!manifest) {
+      throw new TeamManifestError("ERR_TEAM_MANIFEST_INVALID");
+    }
+    const selfMember = manifest.members.find((m) => m.sessionId === input.selfId);
+    if (!selfMember) {
+      throw new TeamManifestError("ERR_TEAM_MANIFEST_INVALID");
+    }
+    const isManager = input.selfId === manifest.leadId;
+    const managerTarget2 = manifest.leadId;
+    const managerConnected = connectedTo(input.sessions, managerTarget2);
+    const coworkers = manifest.members.filter((m) => m.sessionId !== input.selfId).filter((m) => isManager || m.sessionId !== managerTarget2).map((m) => {
+      const live = input.sessions.find((s) => s.id === m.sessionId || s.name === m.sessionId);
+      return {
+        id: m.sessionId,
+        target: m.sessionId,
+        role: m.role,
+        connected: Boolean(live)
+      };
+    });
+    return {
+      teamId: manifest.runId,
+      self: { id: input.selfId, isManager },
+      manager: { target: managerTarget2, connected: managerConnected },
+      coworkers,
+      source: "manifest"
+    };
+  }
+  if (stringValue(env.AGENT_INTERCOM_SCOPE_ID)) {
+    const managerTarget2 = stringValue(env.AGENT_INTERCOM_MANAGER_TARGET) ?? stringValue(env.AGENT_INTERCOM_MANAGER_SESSION_ID);
+    const role = stringValue(env.AGENT_INTERCOM_ROLE)?.toLowerCase();
+    const isManager = role === "manager" || managerTarget2 !== void 0 && managerTarget2 === input.selfId || managerTarget2 === void 0 && role !== "worker";
+    const effectiveManagerTarget = isManager ? input.selfId : managerTarget2;
+    const coworkers = input.sessions.filter((session) => session.id !== input.selfId).filter((session) => session.model !== "human").filter((session) => session.id !== effectiveManagerTarget).map((session) => ({
+      id: session.id,
+      target: session.id,
+      ...session.model ? { harness: session.model } : {},
+      connected: true
+    }));
+    const manager = effectiveManagerTarget ? {
+      target: effectiveManagerTarget,
+      connected: isManager ? true : connectedTo(input.sessions, effectiveManagerTarget)
+    } : void 0;
+    return {
+      teamId: effectiveManagerTarget ?? input.selfId,
+      self: { id: input.selfId, isManager },
+      ...manager ? { manager } : {},
+      coworkers,
+      source: "live"
+    };
+  }
+  const managerTarget = stringValue(env.AGENT_INTERCOM_MANAGER_TARGET) ?? stringValue(env.AGENT_INTERCOM_MANAGER_SESSION_ID);
+  return {
+    teamId: managerTarget ?? input.selfId,
+    self: { id: input.selfId, isManager: !managerTarget },
+    manager: managerTarget ? { target: managerTarget, connected: connectedTo(input.sessions, managerTarget) } : { target: input.selfId, connected: true },
+    coworkers: [],
+    source: "standalone"
+  };
+}
+async function resolveLegacyTeam(input, workers, env) {
   const workerId = stringValue(env.AGENT_INTERCOM_WORKER_ID);
   const runId = stringValue(env.AGENT_INTERCOM_RUN_ID);
   const current = workerId ? workers.find(
     (worker) => stringValue(worker.id) === workerId && (!runId || stringValue(worker.runId) === runId)
   ) : void 0;
-  const managerTarget = stringValue(current?.managerSessionId) ?? stringValue(env.AGENT_INTERCOM_MANAGER_TARGET) ?? stringValue(env.AGENT_INTERCOM_MANAGER_SESSION_ID);
-  const teamId = managerTarget ?? input.selfId;
-  const coworkers = workers.filter((worker) => worker.owned === true).filter((worker) => stringValue(worker.managerSessionId) === teamId).filter((worker) => LEGACY_LIVE_STATES.has(stringValue(worker.state) ?? "")).filter((worker) => stringValue(worker.id) !== workerId).map((worker) => {
-    const id = stringValue(worker.id);
-    if (!id) return void 0;
-    const target = stringValue(worker.intercomTarget) ?? id;
+  if (current) {
+    const managerTarget = stringValue(current?.managerSessionId) ?? stringValue(env.AGENT_INTERCOM_MANAGER_TARGET) ?? stringValue(env.AGENT_INTERCOM_MANAGER_SESSION_ID);
+    if (!managerTarget) {
+      return {
+        self: { id: input.selfId, ...workerId ? { workerId } : {}, isManager: false },
+        coworkers: [],
+        source: "orchestrator"
+      };
+    }
+    const coworkers = workers.filter((worker) => worker.owned === true).filter((worker) => {
+      const mgr = stringValue(worker.managerSessionId);
+      return mgr !== void 0 && mgr === managerTarget;
+    }).filter((worker) => LEGACY_LIVE_STATES.has(stringValue(worker.state) ?? "")).filter((worker) => stringValue(worker.id) !== workerId && stringValue(worker.id) !== input.selfId).map((worker) => {
+      const id = stringValue(worker.id);
+      if (!id) return void 0;
+      const target = stringValue(worker.intercomTarget) ?? id;
+      return {
+        id,
+        target,
+        ...stringValue(worker.harness) ? { harness: stringValue(worker.harness) } : {},
+        ...stringValue(worker.role) ? { role: stringValue(worker.role) } : {},
+        ...stringValue(worker.state) ? { state: stringValue(worker.state) } : {},
+        connected: connectedTo(input.sessions, target)
+      };
+    }).filter((member) => Boolean(member));
     return {
-      id,
-      target,
-      ...stringValue(worker.harness) ? { harness: stringValue(worker.harness) } : {},
-      ...stringValue(worker.role) ? { role: stringValue(worker.role) } : {},
-      ...stringValue(worker.state) ? { state: stringValue(worker.state) } : {},
-      connected: connectedTo(input.sessions, target)
+      teamId: managerTarget,
+      self: { id: input.selfId, ...workerId ? { workerId } : {}, isManager: false },
+      manager: { target: managerTarget, connected: connectedTo(input.sessions, managerTarget) },
+      coworkers,
+      source: "orchestrator"
     };
-  }).filter((member) => Boolean(member));
-  return {
-    teamId,
-    self: { id: input.selfId, ...workerId ? { workerId } : {}, isManager: !managerTarget },
-    manager: managerTarget ? { target: managerTarget, connected: connectedTo(input.sessions, managerTarget) } : { target: input.selfId, connected: true },
-    coworkers
-  };
+  }
+  if (workerId === void 0) {
+    const ownedCoworkers = workers.filter((worker) => worker.owned === true).filter((worker) => {
+      const mgr = stringValue(worker.managerSessionId);
+      return mgr !== void 0 && mgr === input.selfId;
+    }).filter((worker) => LEGACY_LIVE_STATES.has(stringValue(worker.state) ?? "")).filter((worker) => stringValue(worker.id) !== input.selfId).map((worker) => {
+      const id = stringValue(worker.id);
+      if (!id) return void 0;
+      const target = stringValue(worker.intercomTarget) ?? id;
+      return {
+        id,
+        target,
+        ...stringValue(worker.harness) ? { harness: stringValue(worker.harness) } : {},
+        ...stringValue(worker.role) ? { role: stringValue(worker.role) } : {},
+        ...stringValue(worker.state) ? { state: stringValue(worker.state) } : {},
+        connected: connectedTo(input.sessions, target)
+      };
+    }).filter((member) => Boolean(member));
+    if (ownedCoworkers.length > 0) {
+      return {
+        teamId: input.selfId,
+        self: { id: input.selfId, isManager: true },
+        manager: { target: input.selfId, connected: true },
+        coworkers: ownedCoworkers,
+        source: "orchestrator"
+      };
+    }
+  }
+  return resolveNonAuthoritativeTeam(input, env);
 }
 async function resolveIntercomTeam(input) {
   const env = input.env ?? process.env;
@@ -1987,7 +2094,8 @@ async function resolveIntercomTeam(input) {
     return {
       teamId: selfSession.boss.binding.bossRunId,
       self: { id: input.selfId, ...workerId ? { workerId } : {}, isManager: false },
-      coworkers: []
+      coworkers: [],
+      source: "boss"
     };
   }
   const currentRole = selfSession.boss.binding.role;
@@ -2000,7 +2108,8 @@ async function resolveIntercomTeam(input) {
     return {
       teamId: selfSession.boss.binding.bossRunId,
       self: { id: input.selfId, ...workerId ? { workerId } : {}, isManager: false },
-      coworkers: []
+      coworkers: [],
+      source: "boss"
     };
   }
   const coworkers = workers.filter((worker) => exactStringValue(worker.id) !== workerId).filter((worker) => exactStringValue(worker.managerSessionId) === managerTarget).map((worker) => {
@@ -2014,7 +2123,8 @@ async function resolveIntercomTeam(input) {
     teamId: selfSession.boss.binding.bossRunId,
     self: { id: input.selfId, ...workerId ? { workerId } : {}, isManager: selfIsManager },
     manager: { target: managerTarget, connected: true },
-    coworkers
+    coworkers,
+    source: "boss"
   };
 }
 function formatIntercomTeam(team) {
@@ -2082,10 +2192,23 @@ function publicPendingEntry(entry, selector) {
 function shortHash(value) {
   return createHash2("sha256").update(value).digest("hex").slice(0, 8);
 }
+var GENERIC_SESSION_ID_REGEX = /^[A-Za-z0-9_-]{1,128}$/;
 function buildClaudeRuntimeIdentity(env = process.env, cwd = env.PWD || processCwd(), pid = process.pid) {
-  const sessionId = env.CLAUDE_INTERCOM_SESSION_ID?.trim() || env.CLAUDE_PEER_ID?.trim() || `claude-${pid}-${shortHash(cwd)}`;
+  let sessionId = env.CLAUDE_INTERCOM_SESSION_ID?.trim() || env.CLAUDE_PEER_ID?.trim();
+  if (!sessionId && env.AGENT_INTERCOM_SESSION_ID !== void 0) {
+    const raw = env.AGENT_INTERCOM_SESSION_ID.trim();
+    if (raw) {
+      if (!GENERIC_SESSION_ID_REGEX.test(raw)) {
+        throw new Error("Invalid AGENT_INTERCOM_SESSION_ID: must match ^[A-Za-z0-9_-]{1,128}$");
+      }
+      sessionId = raw;
+    }
+  }
+  if (!sessionId) {
+    sessionId = `claude-${pid}-${shortHash(cwd)}`;
+  }
   const cwdName = basename(cwd) || "workspace";
-  const name = env.CLAUDE_INTERCOM_NAME?.trim() || env.CLAUDE_PEER_NAME?.trim() || `claude-${cwdName}-${pid}`;
+  const name = env.CLAUDE_INTERCOM_NAME?.trim() || env.CLAUDE_PEER_NAME?.trim() || (env.AGENT_INTERCOM_SESSION_NAME !== void 0 && env.AGENT_INTERCOM_SESSION_NAME.trim() ? env.AGENT_INTERCOM_SESSION_NAME.trim() : void 0) || `claude-${cwdName}-${pid}`;
   return {
     sessionId,
     name,

package/dist/worker-daemon.mjs

@@ -2381,6 +2381,7 @@ function loadConfig() {
 
 // claude/team.ts
 import { PARTICIPANT_STATES, TERMINAL_PARTICIPANT_STATES } from "@ctliz/agent-intercom-core/boss";
+import { readTeamManifestAsync, TeamManifestError } from "@ctliz/agent-intercom-core/team-manifest";
 var BOSS_NONTERMINAL_STATES = new Set(
   PARTICIPANT_STATES.filter((state) => !TERMINAL_PARTICIPANT_STATES.includes(state))
 );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ctliz/agent-intercom-claude",
-  "version": "0.12.0-connect.3",
+  "version": "0.13.0-connect.1",
   "description": "Claude Code MCP plugin and wakeable worker for direct local messaging with Pi, Codex, and Claude coding-agent sessions.",
   "license": "AGPL-3.0-or-later",
   "type": "module",
@@ -67,10 +67,10 @@
     "codex"
   ],
   "peerDependencies": {
-    "@ctliz/agent-intercom-core": "0.1.0"
+    "@ctliz/agent-intercom-core": "0.2.0"
   },
   "devDependencies": {
-    "@ctliz/agent-intercom-core": "git+https://github.com/ctliz/agent-intercom-core.git#37e074970e2a9de32a16fc325607c3b476b0bd45",
+    "@ctliz/agent-intercom-core": "0.2.0",
     "@types/node": "^24.0.0",
     "esbuild": "^0.28.1",
     "tsx": "^4.20.0",

package/scripts/verify-core-provenance.mjs

@@ -5,25 +5,25 @@ import { spawnSync } from "node:child_process";
 
 export const APPROVED_CORE = Object.freeze({
   name: "@ctliz/agent-intercom-core",
-  version: "0.1.0",
-  commit: "37e074970e2a9de32a16fc325607c3b476b0bd45",
-  integrity: "sha512-b5MXnfKh/RCjKoVor0tsFO+NKAqPROWgkgbHt7jiHxhdVbSh7gWvOdnVUtpSdPwJLYKSQrYXT+TJl7QocdJEPA==",
+  version: "0.2.0",
+  integrity: "sha512-bpifL9cc8cwMm74fpvjgRBarXMwn6BY4cST4ry6HrGtfpRTXyiJOtwfNnhORF6xTKwQNOWakxS1sZALczInvkQ==",
+  resolved: "https://registry.npmjs.org/@ctliz/agent-intercom-core/-/agent-intercom-core-0.2.0.tgz",
 });
 
 const repositoryRoot = join(dirname(fileURLToPath(import.meta.url)), "..");
-const devSpec = `git+https://github.com/ctliz/agent-intercom-core.git#${APPROVED_CORE.commit}`;
+const devSpec = APPROVED_CORE.version;
 
 function readJson(path) {
   return JSON.parse(readFileSync(path, "utf8"));
 }
 
-function requireEqual(actual, expected, field) {
+export function requireEqual(actual, expected, field) {
   if (actual !== expected) {
     throw new Error(`${field} must be ${JSON.stringify(expected)}; received ${JSON.stringify(actual)}`);
   }
 }
 
-function verifyLocalProvenance() {
+export function verifyLocalProvenance() {
   const manifest = readJson(join(repositoryRoot, "package.json"));
   const lock = readJson(join(repositoryRoot, "package-lock.json"));
   const lockRoot = lock.packages?.[""];
@@ -36,28 +36,30 @@ function verifyLocalProvenance() {
   requireEqual(lockRoot?.peerDependencies?.[APPROVED_CORE.name], APPROVED_CORE.version, "locked Core peer dependency");
   requireEqual(lockRoot?.devDependencies?.[APPROVED_CORE.name], devSpec, "locked Core development provenance");
   requireEqual(lockedCore?.version, APPROVED_CORE.version, "supplied Core version");
-  requireEqual(lockedCore?.resolved, devSpec, "supplied Core commit");
+  requireEqual(lockedCore?.resolved, APPROVED_CORE.resolved, "supplied Core resolved URL");
   requireEqual(lockedCore?.integrity, APPROVED_CORE.integrity, "supplied Core artifact integrity");
   requireEqual(lockedCore?.dev, true, "supplied Core dependency class");
 }
 
-function verifyPublishedProvenance() {
-  const result = spawnSync("npm", [
+export function parseAndVerifyPublishedProvenance(jsonString) {
+  const published = typeof jsonString === "string" ? JSON.parse(jsonString) : jsonString;
+  requireEqual(published.version, APPROVED_CORE.version, "published Core version");
+  requireEqual(published["dist.integrity"] ?? published.dist?.integrity, APPROVED_CORE.integrity, "published Core artifact integrity");
+}
+
+export function verifyPublishedProvenance(runner = spawnSync) {
+  const result = runner("npm", [
     "view",
     `${APPROVED_CORE.name}@${APPROVED_CORE.version}`,
     "version",
     "dist.integrity",
-    "gitHead",
     "--json",
   ], { encoding: "utf8" });
   if (result.error) throw result.error;
   if (result.status !== 0) {
     throw new Error(`Unable to inspect published Core ${APPROVED_CORE.version}: ${(result.stderr || result.stdout).trim()}`);
   }
-  const published = JSON.parse(result.stdout);
-  requireEqual(published.version, APPROVED_CORE.version, "published Core version");
-  requireEqual(published["dist.integrity"] ?? published.dist?.integrity, APPROVED_CORE.integrity, "published Core artifact integrity");
-  requireEqual(published.gitHead, APPROVED_CORE.commit, "published Core commit");
+  parseAndVerifyPublishedProvenance(result.stdout);
 }
 
 verifyLocalProvenance();

package/scripts/verify-packed-runtime.mjs

@@ -6,7 +6,7 @@ import { spawnSync } from "node:child_process";
 
 const repositoryRoot = resolve(import.meta.dirname, "..");
 const corePackage = "@ctliz/agent-intercom-core";
-const coreDevSpec = "git+https://github.com/ctliz/agent-intercom-core.git#37e074970e2a9de32a16fc325607c3b476b0bd45";
+const coreDevSpec = "0.2.0";
 const coreConsumers = new Set([
   "broker.mjs",
   "cci.mjs",
@@ -72,10 +72,10 @@ try {
   const manifestEntry = entries.get("package/package.json");
   if (!manifestEntry) throw new Error("Packed adapter is missing package.json");
   const manifest = JSON.parse(manifestEntry.toString("utf8"));
-  if (manifest.peerDependencies?.[corePackage] !== "0.1.0") throw new Error("Packed adapter must require Core peer 0.1.0");
+  if (manifest.peerDependencies?.[corePackage] !== "0.2.0") throw new Error("Packed adapter must require Core peer 0.2.0");
   if (manifest.peerDependenciesMeta?.[corePackage]?.optional === true) throw new Error("Packed Core peer must not be optional");
   if (manifest.dependencies?.[corePackage] !== undefined) throw new Error("Packed adapter must not install a private Core dependency");
-  if (manifest.devDependencies?.[corePackage] !== coreDevSpec) throw new Error("Packed adapter lost the approved Core build commit");
+  if (manifest.devDependencies?.[corePackage] !== coreDevSpec) throw new Error("Packed adapter lost the approved Core dependency");
   if ([...entries.keys()].some((path) => path.includes("node_modules/@ctliz/agent-intercom-core/"))) {
     throw new Error("Packed adapter contains a private Core module tree");
   }
@@ -134,7 +134,7 @@ try {
     }
   }
 
-  console.log(`Verified complete plugin+MCP+monitors+dist chain and ${bundles.length} packed bundles using Core peer 0.1.0`);
+  console.log(`Verified complete plugin+MCP+monitors+dist chain and ${bundles.length} packed bundles using Core peer 0.2.0`);
 } finally {
   if (temp) rmSync(temp, { recursive: true, force: true });
 }