@essentialai/cogent-bridge 3.5.11 → 3.7.0

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## 3.7.0 — 2026-07-10
+
+### Added
+- **Codex sandbox-failure awareness & handling.** On hosts where the Codex OS sandbox can't
+  initialize (unprivileged Linux user namespaces blocked — Ubuntu 24.04's
+  `kernel.apparmor_restrict_unprivileged_userns=1`, containers, hardened kernels), every
+  `codex exec resume` used to fail its file/test commands (`bwrap: setting up uid map: Permission
+  denied`) and the agent could only report "not finished" — silently, every task. Cogent now:
+  - **Probes the sandbox at startup** (`preflightCodexSandbox`, gated to `COGENT_PLATFORM=codex`,
+    non-`bypass`, Linux) via `unshare -Ur` with a sysctl fallback, and logs a **loud, actionable
+    warning** when the sandbox is blocked.
+  - **`COGENT_CODEX_SANDBOX_FALLBACK`** (opt-in; default OFF) — when set, a blocked sandbox is
+    auto-worked-around by running codex with `--dangerously-bypass-approvals-and-sandbox` so tasks
+    complete. OFF by default because bypass grants full filesystem/network access.
+  - **Surfaces hard failures to Slack** — a `SANDBOX_BLOCKED` exec failure now records an
+    actionable message to the sender (with the remedy) instead of being dropped silently.
+  - **`cogent_health_check`** reports a new `codexSandbox` diagnostic.
+
+### Changed
+- Auto-relay no longer silently drops a Codex exec failure caused by a blocked OS sandbox — it
+  reports it, and skips the futile session-rotation retry (userns is host-wide).
+
+## 3.6.0 — 2026-07-07
+
+### Added
+- **Wake Trace Slice 3 — structured reply capture (Story 8.4).** Claude replies captured from
+  `--output-format json` `.result` (Codex from the `-o` file); a lower-trust fallback is surfaced as a
+  visible `[cogent:needs-manual]` downgrade — never a raw-stdout guess.
+- **Slice 4 — structured A2A anti-noise defaults (Story 8.5).** Agent-origin broadcasts are manual by
+  default (no auto multi-agent debate; human-origin slack/gchat/web broadcasts still auto-relay); peers
+  advertise a role (implementer/reviewer/auditor/coordinator). Opt-in `COGENT_BROADCAST_AUTORELAY`.
+- **Slice 5 — durable identity on the wire (Story 8.6).** Register advertises `workspaceId`
+  (sha256 of cwd) + `threadId`; the relay stores them (coordinated `.strict()` extension, relay-first).
+  cwd becomes a hint, not the key. Preserved across auto-reconnect.
+
+
 ## 3.5.11 — 2026-07-06
 
 ### Added

package/dist/backend/file-backend.d.ts

@@ -8,7 +8,7 @@ import { StorageBackend } from "./storage-backend.js";
  * cc-cli.ts, and health-check.ts. No added logic, logging, or transformation.
  */
 export declare class FileBackend implements StorageBackend {
-    registerPeer(peerId: string, sessionId: string, cwd: string, label: string, clientVersion?: string, mode?: "observer" | "agent", channelSessionId?: string, capabilities?: string[]): Promise<PeerInfo>;
+    registerPeer(peerId: string, sessionId: string, cwd: string, label: string, clientVersion?: string, mode?: "observer" | "agent", channelSessionId?: string, capabilities?: string[], workspaceId?: string, threadId?: string): Promise<PeerInfo>;
     deregisterPeer(peerId: string): Promise<boolean>;
     getPeer(peerId: string): Promise<PeerInfo | undefined>;
     listPeers(): Promise<PeerInfo[]>;

package/dist/backend/file-backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-backend.d.ts","sourceRoot":"","sources":["../../src/backend/file-backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAKtD;;;;;GAKG;AACH,qBAAa,WAAY,YAAW,cAAc;IAGhD,YAAY,CACV,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,aAAa,CAAC,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,EAC3B,gBAAgB,CAAC,EAAE,MAAM,EACzB,YAAY,CAAC,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,QAAQ,CAAC;IAapB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIhD,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;IAItD,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IAIhC,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM7C,aAAa,CACX,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,WAAW,CAAC,GAC9C,OAAO,CAAC,aAAa,CAAC;IAIzB,UAAU,CACR,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,MAAM,EACd,kBAAkB,CAAC,EAAE,OAAO,EAC5B,YAAY,CAAC,EAAE,OAAO,EACtB,oBAAoB,CAAC,EAAE,OAAO,GAC7B,OAAO,CAAC,aAAa,EAAE,CAAC;IAQ3B,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIjE,UAAU,CACR,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC;IAMzB,WAAW,IAAI,OAAO,CAAC,iBAAiB,CAAC;CAG1C"}
+{"version":3,"file":"file-backend.d.ts","sourceRoot":"","sources":["../../src/backend/file-backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAKtD;;;;;GAKG;AACH,qBAAa,WAAY,YAAW,cAAc;IAGhD,YAAY,CACV,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,aAAa,CAAC,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,EAC3B,gBAAgB,CAAC,EAAE,MAAM,EACzB,YAAY,CAAC,EAAE,MAAM,EAAE,EACvB,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,QAAQ,CAAC;IAepB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIhD,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;IAItD,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IAIhC,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM7C,aAAa,CACX,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,WAAW,CAAC,GAC9C,OAAO,CAAC,aAAa,CAAC;IAIzB,UAAU,CACR,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,MAAM,EACd,kBAAkB,CAAC,EAAE,OAAO,EAC5B,YAAY,CAAC,EAAE,OAAO,EACtB,oBAAoB,CAAC,EAAE,OAAO,GAC7B,OAAO,CAAC,aAAa,EAAE,CAAC;IAQ3B,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIjE,UAAU,CACR,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC;IAMzB,WAAW,IAAI,OAAO,CAAC,iBAAiB,CAAC;CAG1C"}

package/dist/backend/file-backend.js

@@ -9,8 +9,8 @@ import * as health from "../services/health-check.js";
  */
 export class FileBackend {
     // --- Peer management ---
-    registerPeer(peerId, sessionId, cwd, label, clientVersion, mode, channelSessionId, capabilities) {
-        return registry.registerPeer(peerId, sessionId, cwd, label, clientVersion, mode, channelSessionId, capabilities);
+    registerPeer(peerId, sessionId, cwd, label, clientVersion, mode, channelSessionId, capabilities, workspaceId, threadId) {
+        return registry.registerPeer(peerId, sessionId, cwd, label, clientVersion, mode, channelSessionId, capabilities, workspaceId, threadId);
     }
     deregisterPeer(peerId) {
         return registry.deregisterPeer(peerId);

package/dist/backend/file-backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"file-backend.js","sourceRoot":"","sources":["../../src/backend/file-backend.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,QAAQ,MAAM,8BAA8B,CAAC;AACzD,OAAO,KAAK,GAAG,MAAM,uBAAuB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,6BAA6B,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,OAAO,WAAW;IACtB,0BAA0B;IAE1B,YAAY,CACV,MAAc,EACd,SAAiB,EACjB,GAAW,EACX,KAAa,EACb,aAAsB,EACtB,IAA2B,EAC3B,gBAAyB,EACzB,YAAuB;QAEvB,OAAO,QAAQ,CAAC,YAAY,CAC1B,MAAM,EACN,SAAS,EACT,GAAG,EACH,KAAK,EACL,aAAa,EACb,IAAI,EACJ,gBAAgB,EAChB,YAAY,CACb,CAAC;IACJ,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,OAAO,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,CAAC,MAAc;QACpB,OAAO,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,SAAS;QACP,OAAO,QAAQ,CAAC,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,OAAO,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,wBAAwB;IAExB,aAAa,CACX,MAA+C;QAE/C,OAAO,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,UAAU,CACR,MAAe,EACf,KAAc,EACd,kBAA4B,EAC5B,YAAsB,EACtB,oBAA8B;QAE9B,qEAAqE;QACrE,iEAAiE;QACjE,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,YAAY,CAAC,CAAC;IAC9E,CAAC;IAED,wBAAwB;IAExB,eAAe,CAAC,SAAiB,EAAE,GAAW;QAC5C,OAAO,GAAG,CAAC,eAAe,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,UAAU,CACR,SAAiB,EACjB,OAAe,EACf,GAAW,EACX,SAAkB;QAElB,OAAO,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IAC5D,CAAC;IAED,iBAAiB;IAEjB,WAAW;QACT,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC;IAC9B,CAAC;CACF"}
+{"version":3,"file":"file-backend.js","sourceRoot":"","sources":["../../src/backend/file-backend.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,QAAQ,MAAM,8BAA8B,CAAC;AACzD,OAAO,KAAK,GAAG,MAAM,uBAAuB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,6BAA6B,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,OAAO,WAAW;IACtB,0BAA0B;IAE1B,YAAY,CACV,MAAc,EACd,SAAiB,EACjB,GAAW,EACX,KAAa,EACb,aAAsB,EACtB,IAA2B,EAC3B,gBAAyB,EACzB,YAAuB,EACvB,WAAoB,EACpB,QAAiB;QAEjB,OAAO,QAAQ,CAAC,YAAY,CAC1B,MAAM,EACN,SAAS,EACT,GAAG,EACH,KAAK,EACL,aAAa,EACb,IAAI,EACJ,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,OAAO,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,CAAC,MAAc;QACpB,OAAO,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,SAAS;QACP,OAAO,QAAQ,CAAC,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,OAAO,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,wBAAwB;IAExB,aAAa,CACX,MAA+C;QAE/C,OAAO,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,UAAU,CACR,MAAe,EACf,KAAc,EACd,kBAA4B,EAC5B,YAAsB,EACtB,oBAA8B;QAE9B,qEAAqE;QACrE,iEAAiE;QACjE,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,YAAY,CAAC,CAAC;IAC9E,CAAC;IAED,wBAAwB;IAExB,eAAe,CAAC,SAAiB,EAAE,GAAW;QAC5C,OAAO,GAAG,CAAC,eAAe,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,UAAU,CACR,SAAiB,EACjB,OAAe,EACf,GAAW,EACX,SAAkB;QAElB,OAAO,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IAC5D,CAAC;IAED,iBAAiB;IAEjB,WAAW;QACT,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC;IAC9B,CAAC;CACF"}

package/dist/backend/http-backend.d.ts

@@ -1,6 +1,6 @@
 import type { StorageBackend } from "./storage-backend.js";
 import type { PeerInfo, MessageRecord, CliExecResult } from "../types.js";
-import type { HealthCheckResult } from "../services/health-check.js";
+import { type HealthCheckResult } from "../services/health-check.js";
 import type { HttpClient } from "../cloud/http-client.js";
 /**
  * Cloud-mode storage backend.
@@ -26,7 +26,7 @@ export declare class HttpBackend implements StorageBackend {
      * The sessionId parameter from StorageBackend is the local CC sessionId;
      * in cloud mode we ignore it and use this.sessionId (the cloud session).
      */
-    registerPeer(peerId: string, _sessionId: string, cwd: string, label: string, clientVersion?: string, mode?: "observer" | "agent", _channelSessionId?: string, _capabilities?: string[]): Promise<PeerInfo>;
+    registerPeer(peerId: string, _sessionId: string, cwd: string, label: string, clientVersion?: string, mode?: "observer" | "agent", _channelSessionId?: string, _capabilities?: string[], workspaceId?: string, threadId?: string): Promise<PeerInfo>;
     /**
      * Deregister a peer from the cloud session.
      * DELETE /api/sessions/:sessionId/peers/:peerId

package/dist/backend/http-backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-backend.d.ts","sourceRoot":"","sources":["../../src/backend/http-backend.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAkB1D;;;;;;;;;;;;GAYG;AACH,qBAAa,WAAY,YAAW,cAAc;IAE9C,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,MAAM;IAGpC;;;;;;OAMG;IACG,YAAY,CAChB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,aAAa,CAAC,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,EAG3B,iBAAiB,CAAC,EAAE,MAAM,EAC1B,aAAa,CAAC,EAAE,MAAM,EAAE,GACvB,OAAO,CAAC,QAAQ,CAAC;IA2BpB;;;;;OAKG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAatD;;;;OAIG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;IAK5D;;;OAGG;IACG,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IAMtC;;;OAGG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKnD;;;;;;;OAOG;IACG,aAAa,CACjB,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,WAAW,CAAC,GAC9C,OAAO,CAAC,aAAa,CAAC;IA2BzB;;;;;OAKG;IACG,UAAU,CACd,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,MAAM,EACd,kBAAkB,CAAC,EAAE,OAAO,EAC5B,YAAY,CAAC,EAAE,OAAO,EACtB,mBAAmB,CAAC,EAAE,OAAO,GAC5B,OAAO,CAAC,aAAa,EAAE,CAAC;IAmC3B;;;;;;OAMG;IACG,qBAAqB,CACzB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,IAAI,CAAC;IAchB;;;;OAIG;IACG,eAAe,CACnB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC;IAInB;;;;;;;OAOG;IACG,UAAU,CACd,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,aAAa,CAAC;IAQzB;;;;;;OAMG;IACG,WAAW,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAyC/C;;;;;;;;;OASG;IACG,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAGhD"}
+{"version":3,"file":"http-backend.d.ts","sourceRoot":"","sources":["../../src/backend/http-backend.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,KAAK,iBAAiB,EAAqB,MAAM,6BAA6B,CAAC;AACxF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAkB1D;;;;;;;;;;;;GAYG;AACH,qBAAa,WAAY,YAAW,cAAc;IAE9C,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,MAAM;IAGpC;;;;;;OAMG;IACG,YAAY,CAChB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,aAAa,CAAC,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,EAG3B,iBAAiB,CAAC,EAAE,MAAM,EAC1B,aAAa,CAAC,EAAE,MAAM,EAAE,EAIxB,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,QAAQ,CAAC;IAoCpB;;;;;OAKG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAatD;;;;OAIG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;IAK5D;;;OAGG;IACG,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IAMtC;;;OAGG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKnD;;;;;;;OAOG;IACG,aAAa,CACjB,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,WAAW,CAAC,GAC9C,OAAO,CAAC,aAAa,CAAC;IA2BzB;;;;;OAKG;IACG,UAAU,CACd,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,MAAM,EACd,kBAAkB,CAAC,EAAE,OAAO,EAC5B,YAAY,CAAC,EAAE,OAAO,EACtB,mBAAmB,CAAC,EAAE,OAAO,GAC5B,OAAO,CAAC,aAAa,EAAE,CAAC;IAmC3B;;;;;;OAMG;IACG,qBAAqB,CACzB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,IAAI,CAAC;IAchB;;;;OAIG;IACG,eAAe,CACnB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC;IAInB;;;;;;;OAOG;IACG,UAAU,CACd,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,aAAa,CAAC;IAQzB;;;;;;OAMG;IACG,WAAW,IAAI,OAAO,CAAC,iBAAiB,CAAC;IA4C/C;;;;;;;;;OASG;IACG,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAGhD"}

package/dist/backend/http-backend.js

@@ -1,3 +1,4 @@
+import { checkCodexSandbox } from "../services/health-check.js";
 import { SERVER_VERSION } from "../constants.js";
 import { getConfig } from "../config.js";
 import { getRelayVersion } from "./relay-version-cache.js";
@@ -43,7 +44,11 @@ export class HttpBackend {
     async registerPeer(peerId, _sessionId, cwd, label, clientVersion, mode, 
     // 3.5.9 durable-identity rails are LOCAL-ONLY: intentionally NOT added to the
     // wire body (the relay register schema is .strict() and would reject them).
-    _channelSessionId, _capabilities) {
+    _channelSessionId, _capabilities, 
+    // Slice 5 / Story 8.6: durable identity that DOES go on the wire (unlike the
+    // local-only rails above) — the relay's .strict() schema was extended in
+    // lockstep (relay-first deploy) to accept these optional fields.
+    workspaceId, threadId) {
         const path = PATHS.peers.replace(":sessionId", this.sessionId);
         // Build body conditionally: omit clientVersion entirely for older clients
         // / undefined inputs so the wire payload stays clean (no JSON null) and
@@ -67,6 +72,15 @@ export class HttpBackend {
         if (mode !== undefined) {
             body.mode = mode;
         }
+        // Slice 5 / Story 8.6: advertise durable identity on the wire (conditional-set,
+        // like the fields above). A relay too old to know these fields would reject
+        // via .strict() — so the relay ships the optional fields FIRST, then the client.
+        if (workspaceId !== undefined) {
+            body.workspaceId = workspaceId;
+        }
+        if (threadId !== undefined) {
+            body.threadId = threadId;
+        }
         return this.http.post(path, body);
     }
     /**
@@ -253,6 +267,9 @@ export class HttpBackend {
                     ok: true,
                     message: "Cloud mode -- no CLI needed",
                 },
+                // The codex CLI DOES run locally even in cloud mode (auto-relay resumes
+                // it to generate the reply), so the sandbox is a real local concern here.
+                codexSandbox: await checkCodexSandbox(),
             },
             timestamp: new Date().toISOString(),
             mode: "cloud",

package/dist/backend/http-backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"http-backend.js","sourceRoot":"","sources":["../../src/backend/http-backend.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE3D;;;GAGG;AACH,MAAM,KAAK,GAAG;IACZ,KAAK,EAAE,gCAAgC;IACvC,IAAI,EAAE,wCAAwC;IAC9C,QAAQ,EAAE,mCAAmC;IAC7C,OAAO,EAAE,8CAA8C;IACvD,SAAS,EAAE,oCAAoC;IAC/C,MAAM,EAAE,aAAa;CACb,CAAC;AAEX;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,WAAW;IAEH;IACA;IAFnB,YACmB,IAAgB,EAChB,SAAiB;QADjB,SAAI,GAAJ,IAAI,CAAY;QAChB,cAAS,GAAT,SAAS,CAAQ;IACjC,CAAC;IAEJ;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAChB,MAAc,EACd,UAAkB,EAClB,GAAW,EACX,KAAa,EACb,aAAsB,EACtB,IAA2B;IAC3B,8EAA8E;IAC9E,4EAA4E;IAC5E,iBAA0B,EAC1B,aAAwB;QAExB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/D,0EAA0E;QAC1E,wEAAwE;QACxE,4DAA4D;QAC5D,MAAM,IAAI,GAA4B;YACpC,MAAM;YACN,GAAG;YACH,KAAK;YACL,QAAQ,EAAE,SAAS,EAAE,CAAC,eAAe;YACrC,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,IAAI;SAChB,CAAC;QACF,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACrC,CAAC;QACD,sEAAsE;QACtE,sEAAsE;QACtE,qEAAqE;QACrE,mEAAmE;QACnE,qDAAqD;QACrD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAW,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI;aACpB,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC;aACrC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,+EAA+E;YAC/E,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAChD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAwB,IAAI,CAAC,CAAC;QAChE,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACnE,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CACjB,MAA+C;QAE/C,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAClE,2EAA2E;QAC3E,uEAAuE;QACvE,gEAAgE;QAChE,wEAAwE;QACxE,MAAM,IAAI,GAA4B;YACpC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC;QACF,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAChC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAC1B,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAI9B,IAAI,EAAE,IAAI,CAAC,CAAC;QAEf,OAAO;YACL,GAAG,MAAM;YACT,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CACd,MAAe,EACf,KAAc,EACd,kBAA4B,EAC5B,YAAsB,EACtB,mBAA6B;QAE7B,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAClE,MAAM,KAAK,GAA2B,EAAE,CAAC;QACzC,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;QACxB,CAAC;QACD,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC;QACnC,sEAAsE;QACtE,kEAAkE;QAClE,qEAAqE;QACrE,8DAA8D;QAC9D,IAAI,kBAAkB,EAAE,CAAC;YACvB,KAAK,CAAC,kBAAkB,GAAG,MAAM,CAAC;QACpC,CAAC;QACD,mEAAmE;QACnE,oEAAoE;QACpE,sEAAsE;QACtE,8BAA8B;QAC9B,IAAI,YAAY,EAAE,CAAC;YACjB,KAAK,CAAC,YAAY,GAAG,MAAM,CAAC;QAC9B,CAAC;QACD,uEAAuE;QACvE,sEAAsE;QACtE,sCAAsC;QACtC,IAAI,mBAAmB,EAAE,CAAC;YACxB,KAAK,CAAC,mBAAmB,GAAG,MAAM,CAAC;QACrC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAG/B,IAAI,EAAE,KAAK,CAAC,CAAC;QAChB,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,qBAAqB,CACzB,SAAiB,EACjB,QAAuB,EACvB,UAAkB,EAClB,OAAiB;QAEjB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO;aACvB,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC;aACrC,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACpC,wEAAwE;QACxE,qEAAqE;QACrE,kEAAkE;QAClE,MAAM,IAAI,GAA4B,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;QAC/D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CACnB,UAAkB,EAClB,IAAY;QAEZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU,CACd,UAAkB,EAClB,QAAgB,EAChB,IAAY,EACZ,UAAmB;QAEnB,OAAO;YACL,MAAM,EAAE,oCAAoC;YAC5C,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAM7B,KAAK,CAAC,MAAM,CAAC,CAAC;QAEjB,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI;YAC7B,uEAAuE;YACvE,gEAAgE;YAChE,mEAAmE;YACnE,0DAA0D;YAC1D,gBAAgB,EAAE,cAAc;YAChC,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC,SAAS;YACpC,UAAU,EAAE,kBAAkB;YAC9B,MAAM,EAAE;gBACN,SAAS,EAAE;oBACT,EAAE,EAAE,IAAI;oBACR,OAAO,EAAE,uCAAuC;iBACjD;gBACD,aAAa,EAAE;oBACb,EAAE,EAAE,IAAI;oBACR,OAAO,EAAE,qCAAqC;iBAC/C;gBACD,SAAS,EAAE;oBACT,EAAE,EAAE,IAAI;oBACR,OAAO,EAAE,6BAA6B;iBACvC;aACF;YACD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,IAAI,EAAE,OAAO;YACb,YAAY,EAAE,IAAI,CAAC,MAAM;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,YAAY,EAAE,IAAI,CAAC,MAAM;SAC1B,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,eAAe;QACnB,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;CACF"}
+{"version":3,"file":"http-backend.js","sourceRoot":"","sources":["../../src/backend/http-backend.ts"],"names":[],"mappings":"AAEA,OAAO,EAA0B,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAExF,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE3D;;;GAGG;AACH,MAAM,KAAK,GAAG;IACZ,KAAK,EAAE,gCAAgC;IACvC,IAAI,EAAE,wCAAwC;IAC9C,QAAQ,EAAE,mCAAmC;IAC7C,OAAO,EAAE,8CAA8C;IACvD,SAAS,EAAE,oCAAoC;IAC/C,MAAM,EAAE,aAAa;CACb,CAAC;AAEX;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,WAAW;IAEH;IACA;IAFnB,YACmB,IAAgB,EAChB,SAAiB;QADjB,SAAI,GAAJ,IAAI,CAAY;QAChB,cAAS,GAAT,SAAS,CAAQ;IACjC,CAAC;IAEJ;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAChB,MAAc,EACd,UAAkB,EAClB,GAAW,EACX,KAAa,EACb,aAAsB,EACtB,IAA2B;IAC3B,8EAA8E;IAC9E,4EAA4E;IAC5E,iBAA0B,EAC1B,aAAwB;IACxB,6EAA6E;IAC7E,yEAAyE;IACzE,iEAAiE;IACjE,WAAoB,EACpB,QAAiB;QAEjB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/D,0EAA0E;QAC1E,wEAAwE;QACxE,4DAA4D;QAC5D,MAAM,IAAI,GAA4B;YACpC,MAAM;YACN,GAAG;YACH,KAAK;YACL,QAAQ,EAAE,SAAS,EAAE,CAAC,eAAe;YACrC,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,IAAI;SAChB,CAAC;QACF,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACrC,CAAC;QACD,sEAAsE;QACtE,sEAAsE;QACtE,qEAAqE;QACrE,mEAAmE;QACnE,qDAAqD;QACrD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,gFAAgF;QAChF,4EAA4E;QAC5E,iFAAiF;QACjF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QACjC,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAW,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI;aACpB,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC;aACrC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,+EAA+E;YAC/E,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAChD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAwB,IAAI,CAAC,CAAC;QAChE,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACnE,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CACjB,MAA+C;QAE/C,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAClE,2EAA2E;QAC3E,uEAAuE;QACvE,gEAAgE;QAChE,wEAAwE;QACxE,MAAM,IAAI,GAA4B;YACpC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC;QACF,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAChC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAC1B,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAI9B,IAAI,EAAE,IAAI,CAAC,CAAC;QAEf,OAAO;YACL,GAAG,MAAM;YACT,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CACd,MAAe,EACf,KAAc,EACd,kBAA4B,EAC5B,YAAsB,EACtB,mBAA6B;QAE7B,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAClE,MAAM,KAAK,GAA2B,EAAE,CAAC;QACzC,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;QACxB,CAAC;QACD,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC;QACnC,sEAAsE;QACtE,kEAAkE;QAClE,qEAAqE;QACrE,8DAA8D;QAC9D,IAAI,kBAAkB,EAAE,CAAC;YACvB,KAAK,CAAC,kBAAkB,GAAG,MAAM,CAAC;QACpC,CAAC;QACD,mEAAmE;QACnE,oEAAoE;QACpE,sEAAsE;QACtE,8BAA8B;QAC9B,IAAI,YAAY,EAAE,CAAC;YACjB,KAAK,CAAC,YAAY,GAAG,MAAM,CAAC;QAC9B,CAAC;QACD,uEAAuE;QACvE,sEAAsE;QACtE,sCAAsC;QACtC,IAAI,mBAAmB,EAAE,CAAC;YACxB,KAAK,CAAC,mBAAmB,GAAG,MAAM,CAAC;QACrC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAG/B,IAAI,EAAE,KAAK,CAAC,CAAC;QAChB,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,qBAAqB,CACzB,SAAiB,EACjB,QAAuB,EACvB,UAAkB,EAClB,OAAiB;QAEjB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO;aACvB,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC;aACrC,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACpC,wEAAwE;QACxE,qEAAqE;QACrE,kEAAkE;QAClE,MAAM,IAAI,GAA4B,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;QAC/D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CACnB,UAAkB,EAClB,IAAY;QAEZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU,CACd,UAAkB,EAClB,QAAgB,EAChB,IAAY,EACZ,UAAmB;QAEnB,OAAO;YACL,MAAM,EAAE,oCAAoC;YAC5C,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAM7B,KAAK,CAAC,MAAM,CAAC,CAAC;QAEjB,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI;YAC7B,uEAAuE;YACvE,gEAAgE;YAChE,mEAAmE;YACnE,0DAA0D;YAC1D,gBAAgB,EAAE,cAAc;YAChC,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC,SAAS;YACpC,UAAU,EAAE,kBAAkB;YAC9B,MAAM,EAAE;gBACN,SAAS,EAAE;oBACT,EAAE,EAAE,IAAI;oBACR,OAAO,EAAE,uCAAuC;iBACjD;gBACD,aAAa,EAAE;oBACb,EAAE,EAAE,IAAI;oBACR,OAAO,EAAE,qCAAqC;iBAC/C;gBACD,SAAS,EAAE;oBACT,EAAE,EAAE,IAAI;oBACR,OAAO,EAAE,6BAA6B;iBACvC;gBACD,wEAAwE;gBACxE,0EAA0E;gBAC1E,YAAY,EAAE,MAAM,iBAAiB,EAAE;aACxC;YACD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,IAAI,EAAE,OAAO;YACb,YAAY,EAAE,IAAI,CAAC,MAAM;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,YAAY,EAAE,IAAI,CAAC,MAAM;SAC1B,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,eAAe;QACnB,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;CACF"}

package/dist/backend/storage-backend.d.ts

@@ -16,7 +16,11 @@ export interface StorageBackend {
     /** Cloud/relay session id, kept distinct from the local sessionId (3.5.9, local-only). */
     channelSessionId?: string, 
     /** Advertised capabilities, e.g. ["auto-resume"] (3.5.9, local-only rail). */
-    capabilities?: string[]): Promise<PeerInfo>;
+    capabilities?: string[], 
+    /** Durable workspace id — on the wire in cloud mode (Slice 5 / Story 8.6). */
+    workspaceId?: string, 
+    /** Durable thread/conversation id — on the wire in cloud mode (Slice 5 / Story 8.6). */
+    threadId?: string): Promise<PeerInfo>;
     deregisterPeer(peerId: string): Promise<boolean>;
     getPeer(peerId: string): Promise<PeerInfo | undefined>;
     listPeers(): Promise<PeerInfo[]>;

package/dist/backend/storage-backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage-backend.d.ts","sourceRoot":"","sources":["../../src/backend/storage-backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAE7B,YAAY,CACV,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM;IACb,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM;IACtB,4FAA4F;IAC5F,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO;IAC3B,0FAA0F;IAC1F,gBAAgB,CAAC,EAAE,MAAM;IACzB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,QAAQ,CAAC,CAAC;IAErB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEjD,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAEvD,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAEjC,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAG9C,aAAa,CACX,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,WAAW,CAAC,GAC9C,OAAO,CAAC,aAAa,CAAC,CAAC;IAE1B;;;;;;;;;;;;;OAaG;IACH,UAAU,CACR,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,MAAM,EACd,kBAAkB,CAAC,EAAE,OAAO,EAC5B,YAAY,CAAC,EAAE,OAAO,EACtB,mBAAmB,CAAC,EAAE,OAAO,GAC5B,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAG5B,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAElE,UAAU,CACR,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC,CAAC;IAG1B;;;;;;;;;OASG;IACH,qBAAqB,CAAC,CACpB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,IAAI,CAAC,CAAC;IAGjB,WAAW,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAE1C;;;;;OAKG;IACH,eAAe,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC5C"}
+{"version":3,"file":"storage-backend.d.ts","sourceRoot":"","sources":["../../src/backend/storage-backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAE7B,YAAY,CACV,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM;IACb,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM;IACtB,4FAA4F;IAC5F,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO;IAC3B,0FAA0F;IAC1F,gBAAgB,CAAC,EAAE,MAAM;IACzB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,EAAE;IACvB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM;IACpB,wFAAwF;IACxF,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,QAAQ,CAAC,CAAC;IAErB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEjD,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAEvD,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAEjC,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAG9C,aAAa,CACX,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,WAAW,CAAC,GAC9C,OAAO,CAAC,aAAa,CAAC,CAAC;IAE1B;;;;;;;;;;;;;OAaG;IACH,UAAU,CACR,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,MAAM,EACd,kBAAkB,CAAC,EAAE,OAAO,EAC5B,YAAY,CAAC,EAAE,OAAO,EACtB,mBAAmB,CAAC,EAAE,OAAO,GAC5B,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAG5B,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAElE,UAAU,CACR,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC,CAAC;IAG1B;;;;;;;;;OASG;IACH,qBAAqB,CAAC,CACpB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,IAAI,CAAC,CAAC;IAGjB,WAAW,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAE1C;;;;;OAKG;IACH,eAAe,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC5C"}

package/dist/config.d.ts

@@ -17,7 +17,9 @@ export declare const configSchema: z.ZodObject<{
     COGENT_PLATFORM: z.ZodDefault<z.ZodEnum<["cc", "codex", "slack", "gchat", "web"]>>;
     COGENT_CODEX_PATH: z.ZodDefault<z.ZodString>;
     COGENT_CODEX_SANDBOX: z.ZodDefault<z.ZodEnum<["full-auto", "read-only", "workspace-write", "danger-full-access", "bypass"]>>;
+    COGENT_CODEX_SANDBOX_FALLBACK: z.ZodEffects<z.ZodOptional<z.ZodString>, boolean, string | undefined>;
     COGENT_RESOLVER_AMBIGUOUS_MARGIN_MS: z.ZodDefault<z.ZodNumber>;
+    COGENT_BROADCAST_AUTORELAY: z.ZodEffects<z.ZodOptional<z.ZodString>, boolean, string | undefined>;
 }, "strip", z.ZodTypeAny, {
     COGENT_STATE_PATH: string;
     COGENT_TEAM_ENDPOINT: string;
@@ -33,7 +35,9 @@ export declare const configSchema: z.ZodObject<{
     COGENT_PLATFORM: "cc" | "codex" | "slack" | "gchat" | "web";
     COGENT_CODEX_PATH: string;
     COGENT_CODEX_SANDBOX: "full-auto" | "read-only" | "workspace-write" | "danger-full-access" | "bypass";
+    COGENT_CODEX_SANDBOX_FALLBACK: boolean;
     COGENT_RESOLVER_AMBIGUOUS_MARGIN_MS: number;
+    COGENT_BROADCAST_AUTORELAY: boolean;
     COGENT_ENDPOINT?: string | undefined;
     COGENT_SESSION_ID?: string | undefined;
     COGENT_SECRET?: string | undefined;
@@ -55,7 +59,9 @@ export declare const configSchema: z.ZodObject<{
     COGENT_PLATFORM?: "cc" | "codex" | "slack" | "gchat" | "web" | undefined;
     COGENT_CODEX_PATH?: string | undefined;
     COGENT_CODEX_SANDBOX?: "full-auto" | "read-only" | "workspace-write" | "danger-full-access" | "bypass" | undefined;
+    COGENT_CODEX_SANDBOX_FALLBACK?: string | undefined;
     COGENT_RESOLVER_AMBIGUOUS_MARGIN_MS?: number | undefined;
+    COGENT_BROADCAST_AUTORELAY?: string | undefined;
 }>;
 export type Config = z.infer<typeof configSchema>;
 export declare function loadConfig(env?: Record<string, string | undefined>): Config;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0CvB,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAIlD,wBAAgB,UAAU,CACxB,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,CAUR;AAED,wBAAgB,SAAS,IAAI,MAAM,CAGlC;AAED,wBAAgB,WAAW,IAAI,IAAI,CAElC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgEvB,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAIlD,wBAAgB,UAAU,CACxB,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,CAUR;AAED,wBAAgB,SAAS,IAAI,MAAM,CAGlC;AAED,wBAAgB,WAAW,IAAI,IAAI,CAElC"}

package/dist/config.js

@@ -35,6 +35,19 @@ export const configSchema = z.object({
     COGENT_CODEX_SANDBOX: z
         .enum(["full-auto", "read-only", "workspace-write", "danger-full-access", "bypass"])
         .default("full-auto"),
+    // Auto-fallback for a blocked Codex sandbox. On a host where the OS sandbox
+    // can't initialize (unprivileged user namespaces blocked — Ubuntu 24.04's
+    // apparmor_restrict_unprivileged_userns, containers, hardened kernels),
+    // `codex exec resume` fails every file/test command and the agent can only
+    // report "not finished". When this is set ("true"/"1"), the startup sandbox
+    // probe (codex-preflight) auto-switches the effective sandbox to `bypass` so
+    // tasks complete. Default (unset) = OFF: Cogent WARNS loudly + surfaces an
+    // actionable message to the sender, but does NOT silently disable the sandbox
+    // (bypass grants full filesystem/network access — opt in per trusted box).
+    COGENT_CODEX_SANDBOX_FALLBACK: z
+        .string()
+        .optional()
+        .transform((v) => v === "true" || v === "1"),
     // Wake-trace resolver: when >1 candidate session share a cwd and none is the
     // pinned session, the newest must lead the runner-up by at least this many ms
     // to be trusted; otherwise the wake is refused (never guess silently). 60s bias
@@ -44,6 +57,15 @@ export const configSchema = z.object({
         .int()
         .min(0)
         .default(60_000),
+    // Slice 4 (Story 8.5): anti-noise A2A default. A BROADCAST (toPeerId "*") must
+    // NOT trigger an automatic subprocess wake, so addressing the whole channel
+    // never starts an automatic multi-agent debate ("no auto debate unless the
+    // human asks"). Directed messages still auto-relay. Opt a peer INTO broadcast
+    // auto-relay by setting this to "true"/"1". Default (unset) = manual broadcast.
+    COGENT_BROADCAST_AUTORELAY: z
+        .string()
+        .optional()
+        .transform((v) => v === "true" || v === "1"),
 });
 let _config = null;
 export function loadConfig(env = process.env) {

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAE5D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACvD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,gFAAgF;IAChF,gFAAgF;IAChF,kFAAkF;IAClF,6CAA6C;IAC7C,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC;IACpE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,uBAAuB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACrE,uEAAuE;IACvE,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,kDAAkD;IAClD,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACrE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,gBAAgB,EAAE,CAAC;SAChB,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;SACxC,OAAO,CAAC,MAAM,CAAC;IAClB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAChD,uBAAuB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1E,4BAA4B,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC5E,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACtE,eAAe,EAAE,CAAC;SACf,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;SAC9C,OAAO,CAAC,IAAI,CAAC;IAChB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9C,oBAAoB,EAAE,CAAC;SACpB,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,QAAQ,CAAC,CAAC;SACnF,OAAO,CAAC,WAAW,CAAC;IACvB,6EAA6E;IAC7E,8EAA8E;IAC9E,gFAAgF;IAChF,+DAA+D;IAC/D,mCAAmC,EAAE,CAAC,CAAC,MAAM;SAC1C,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,OAAO,CAAC,MAAM,CAAC;CACnB,CAAC,CAAC;AAIH,IAAI,OAAO,GAAkB,IAAI,CAAC;AAElC,MAAM,UAAU,UAAU,CACxB,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aACjD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC7E,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,GAAG,IAAI,CAAC;AACjB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAE5D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACvD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,gFAAgF;IAChF,gFAAgF;IAChF,kFAAkF;IAClF,6CAA6C;IAC7C,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC;IACpE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,uBAAuB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACrE,uEAAuE;IACvE,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,kDAAkD;IAClD,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACrE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,gBAAgB,EAAE,CAAC;SAChB,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;SACxC,OAAO,CAAC,MAAM,CAAC;IAClB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAChD,uBAAuB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1E,4BAA4B,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC5E,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACtE,eAAe,EAAE,CAAC;SACf,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;SAC9C,OAAO,CAAC,IAAI,CAAC;IAChB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9C,oBAAoB,EAAE,CAAC;SACpB,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,QAAQ,CAAC,CAAC;SACnF,OAAO,CAAC,WAAW,CAAC;IACvB,4EAA4E;IAC5E,0EAA0E;IAC1E,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E,6BAA6B,EAAE,CAAC;SAC7B,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,CAAC;IAC9C,6EAA6E;IAC7E,8EAA8E;IAC9E,gFAAgF;IAChF,+DAA+D;IAC/D,mCAAmC,EAAE,CAAC,CAAC,MAAM;SAC1C,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,OAAO,CAAC,MAAM,CAAC;IAClB,+EAA+E;IAC/E,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,gFAAgF;IAChF,0BAA0B,EAAE,CAAC;SAC1B,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,CAAC;CAC/C,CAAC,CAAC;AAIH,IAAI,OAAO,GAAkB,IAAI,CAAC;AAElC,MAAM,UAAU,UAAU,CACxB,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aACjD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC7E,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,GAAG,IAAI,CAAC;AACjB,CAAC"}

package/dist/services/auto-relay.d.ts

@@ -198,6 +198,17 @@ export declare class AutoRelayService {
      * Best-effort: a failure here must never break the busy-queue path.
      */
     private _emitStatusNotice;
+    /**
+     * Slice 3 (Story 8.4): relay a captured reply back to the sender, recording
+     * HOW it was captured so a downgrade (structured `event_stream` → raw
+     * `stdout_compat`, or a structured error) is EXPLICIT in the wake trace and
+     * never disguised as a clean auto-capture (AC3). On an unstable capture it
+     * also emits a visible, non-terminal `[cogent:needs-manual]` notice to the
+     * sender — the answer still relays, but the human/agent knows it wasn't a
+     * trusted structured capture. Used by BOTH the primary and rotated-session
+     * retry paths (F-B) so neither can disguise a downgrade.
+     */
+    private _relayCapturedReply;
     /**
      * Internal: process a single message -- calls the local agent CLI via execRemote and relay response.
      */

package/dist/services/auto-relay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auto-relay.d.ts","sourceRoot":"","sources":["../../src/services/auto-relay.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAK/E;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY;;;;;;CAMf,CAAC;AACX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAW3E;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CASR;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAGrE;AAkDD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,cAAc,CAAuB;IAC7C;;;;;OAKG;IACH,OAAO,CAAC,eAAe,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAuB;IACvC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,SAAS,CAAiC;IAClD;;;;;;;OAOG;IACH,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,UAAU,CAAkB;IACpC,OAAO,CAAC,KAAK,CAAuB;IACpC,OAAO,CAAC,qBAAqB,CAA0B;IAOvD,OAAO,CAAC,eAAe,CAIP;IAChB,OAAO,CAAC,kBAAkB,CAGX;IACf,OAAO,CAAC,iBAAiB,CAAoF;IAE7G;;;OAGG;IACH,YAAY,CACV,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,EAC3B,KAAK,CAAC,EAAE,MAAM,EACd,eAAe,CAAC,EAAE,MAAM,GACvB,IAAI;IAYP;;;;OAIG;IACH,OAAO,CAAC,MAAM;IAad;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAI5B;;;OAGG;IACH,YAAY,IAAI;QACd,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC;KAC5B,GAAG,IAAI;IAaR;;;;OAIG;IACG,gBAAgB,IAAI,OAAO,CAAC,iBAAiB,CAAC;IA4BpD;;;OAGG;IACH,kBAAkB,CAAC,EAAE,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI;IAI/F;;;;;OAKG;IACH,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAKxC;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkCvE;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;OAEG;IACH,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAM1C;;;;OAIG;IACH,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAI9C;;OAEG;IACH,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAIjD;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa;IAUrB;;;;OAIG;IACH,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAaxE;;;OAGG;IACH,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAU5C;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAShC;;;;;;;;;;OAUG;IACG,cAAc,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAgIvD;;;;;;;OAOG;YACW,iBAAiB;IAwB/B;;OAEG;YACW,eAAe;IAsJ7B;;;OAGG;YACW,WAAW;IAoCzB;;;OAGG;IACH,cAAc,IAAI;QAChB,UAAU,EAAE,OAAO,CAAC;QACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC;QAC3B,UAAU,EAAE,OAAO,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,qBAAqB,EAAE,MAAM,EAAE,CAAC;QAChC,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,wBAAwB,EAAE,MAAM,EAAE,CAAC;KACpC;IAgBD;;OAEG;IACH,IAAI,IAAI,IAAI;CA8Bb;AAED,0DAA0D;AAC1D,eAAO,MAAM,SAAS,kBAAyB,CAAC"}
+{"version":3,"file":"auto-relay.d.ts","sourceRoot":"","sources":["../../src/services/auto-relay.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAiB,MAAM,aAAa,CAAC;AAE3D,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAK/E;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY;;;;;;CAMf,CAAC;AACX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAW3E;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CAeR;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAGrE;AAkDD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,cAAc,CAAuB;IAC7C;;;;;OAKG;IACH,OAAO,CAAC,eAAe,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAuB;IACvC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,SAAS,CAAiC;IAClD;;;;;;;OAOG;IACH,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,UAAU,CAAkB;IACpC,OAAO,CAAC,KAAK,CAAuB;IACpC,OAAO,CAAC,qBAAqB,CAA0B;IAOvD,OAAO,CAAC,eAAe,CAIP;IAChB,OAAO,CAAC,kBAAkB,CAGX;IACf,OAAO,CAAC,iBAAiB,CAAoF;IAE7G;;;OAGG;IACH,YAAY,CACV,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,EAC3B,KAAK,CAAC,EAAE,MAAM,EACd,eAAe,CAAC,EAAE,MAAM,GACvB,IAAI;IAYP;;;;OAIG;IACH,OAAO,CAAC,MAAM;IAad;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAI5B;;;OAGG;IACH,YAAY,IAAI;QACd,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC;KAC5B,GAAG,IAAI;IAaR;;;;OAIG;IACG,gBAAgB,IAAI,OAAO,CAAC,iBAAiB,CAAC;IA4BpD;;;OAGG;IACH,kBAAkB,CAAC,EAAE,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI;IAI/F;;;;;OAKG;IACH,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAKxC;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkCvE;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;OAEG;IACH,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAM1C;;;;OAIG;IACH,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAI9C;;OAEG;IACH,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAIjD;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa;IAUrB;;;;OAIG;IACH,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAaxE;;;OAGG;IACH,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAU5C;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAShC;;;;;;;;;;OAUG;IACG,cAAc,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IA8JvD;;;;;;;OAOG;YACW,iBAAiB;IAwB/B;;;;;;;;;OASG;YACW,mBAAmB;IA8CjC;;OAEG;YACW,eAAe;IAuI7B;;;OAGG;YACW,WAAW;IAoCzB;;;OAGG;IACH,cAAc,IAAI;QAChB,UAAU,EAAE,OAAO,CAAC;QACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC;QAC3B,UAAU,EAAE,OAAO,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,qBAAqB,EAAE,MAAM,EAAE,CAAC;QAChC,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,wBAAwB,EAAE,MAAM,EAAE,CAAC;KACpC;IAgBD;;OAEG;IACH,IAAI,IAAI,IAAI;CA8Bb;AAED,0DAA0D;AAC1D,eAAO,MAAM,SAAS,kBAAyB,CAAC"}

package/dist/services/auto-relay.js

@@ -40,6 +40,10 @@ export function buildStatusNotice(status, peerId, traceId) {
         return (`[cogent:queued] ⏳ "${peerId}" is busy with another request — your message is ` +
             `queued and will be answered when it is free.${tail}`);
     }
+    if (status === RELAY_STATUS.NEEDS_MANUAL) {
+        return (`[cogent:needs-manual] ⚠️ "${peerId}" replied but Cogent could not capture it from a trusted ` +
+            `structured stream (raw-output fallback) — treat the following reply as unverified.${tail}`);
+    }
     return `[cogent:${status}] "${peerId}"${tail}`;
 }
 /**
@@ -456,6 +460,30 @@ export class AutoRelayService {
             logger.info(`Auto-relay: observer mode — skipping subprocess for message ${msg.id} from ${msg.fromPeerId}`);
             return;
         }
+        // Slice 4 (Story 8.5): an AGENT-origin BROADCAST is manual by default. When
+        // one agent addresses the whole channel (toPeerId "*"), the other agents must
+        // NOT all auto-wake and reply — that is the "address one, all reply" storm /
+        // automatic multi-agent debate this slice prevents. The delivery ack already
+        // fired (the sender knows it arrived); the human drives any broadcast response.
+        //
+        // CRITICAL: a HUMAN-origin broadcast (originPlatform slack/gchat/web — e.g. a
+        // Slack user posting in a mapped channel, which the Slack bridge relays as
+        // toPeerId "*") MUST still auto-relay, or agents would stop answering Slack
+        // users entirely. Only agent-origin (cc/codex, or an absent/unknown origin)
+        // broadcasts are gated. Opt in for agent broadcasts with COGENT_BROADCAST_AUTORELAY.
+        const HUMAN_ORIGINS = new Set(["slack", "gchat", "web"]);
+        const isHumanOriginBroadcast = msg.originPlatform !== undefined && HUMAN_ORIGINS.has(msg.originPlatform);
+        if (msg.toPeerId === "*" &&
+            !isHumanOriginBroadcast &&
+            !getConfig().COGENT_BROADCAST_AUTORELAY) {
+            this._trace(traceId, "broadcast_manual", {
+                fromPeerId: msg.fromPeerId,
+                originPlatform: msg.originPlatform ?? "unknown",
+            });
+            logger.info(`Auto-relay: agent-origin broadcast from ${msg.fromPeerId} — manual by default (no auto-wake). ` +
+                `Set COGENT_BROADCAST_AUTORELAY=true to auto-respond to agent broadcasts.`);
+            return;
+        }
         // Serialize processing: queue if already busy
         if (this.processing) {
             logger.debug(`Auto-relay: queuing message from ${msg.fromPeerId} (busy processing)`);
@@ -515,6 +543,55 @@ export class AutoRelayService {
             logger.error(`Auto-relay: failed to emit '${status}' status notice: ${err}`);
         }
     }
+    /**
+     * Slice 3 (Story 8.4): relay a captured reply back to the sender, recording
+     * HOW it was captured so a downgrade (structured `event_stream` → raw
+     * `stdout_compat`, or a structured error) is EXPLICIT in the wake trace and
+     * never disguised as a clean auto-capture (AC3). On an unstable capture it
+     * also emits a visible, non-terminal `[cogent:needs-manual]` notice to the
+     * sender — the answer still relays, but the human/agent knows it wasn't a
+     * trusted structured capture. Used by BOTH the primary and rotated-session
+     * retry paths (F-B) so neither can disguise a downgrade.
+     */
+    async _relayCapturedReply(msg, result, traceId, durationMs, retried) {
+        this._trace(traceId, "captured", {
+            durationMs,
+            retried,
+            captureContract: result.captureContract ?? "unknown",
+            stable: result.stable ?? null,
+        });
+        // A downgrade is only when the contract is EXPLICITLY known to be lower-trust
+        // (stdout_compat fallback, or a structured capture whose run errored). An
+        // ABSENT contract (legacy/unknown result) is NOT a downgrade — don't emit a
+        // spurious needs-manual notice; preserve the pre-Slice-3 relay behavior.
+        const isDowngrade = result.captureContract !== undefined && result.stable !== true;
+        if (isDowngrade) {
+            this._trace(traceId, "capture_downgrade", {
+                to: result.captureContract,
+                retried,
+            });
+            await this._emitStatusNotice(msg.fromPeerId, RELAY_STATUS.NEEDS_MANUAL, traceId);
+        }
+        try {
+            await getBackend().recordMessage({
+                fromPeerId: this.localPeerId,
+                toPeerId: msg.fromPeerId,
+                message: result.stdout,
+                response: null,
+                durationMs,
+                success: true,
+                error: null,
+                // 260511-o3p: tag the auto-relay echo so server 3.1.6+ filters it from
+                // cogent_get_history by default.
+                isRelayEcho: true,
+                traceId,
+            });
+            logger.info(`Auto-relay: response sent back to ${msg.fromPeerId} (${durationMs}ms${retried ? ", retried" : ""})`);
+        }
+        catch (recordErr) {
+            logger.error(`Auto-relay: failed to record response message: ${recordErr}`);
+        }
+    }
     /**
      * Internal: process a single message -- calls the local agent CLI via execRemote and relay response.
      */
@@ -586,34 +663,34 @@ export class AutoRelayService {
             const result = await execRemote(getConfig().COGENT_PLATFORM, this.localSessionId, formatted, this.localCwd);
             const durationMs = Date.now() - startMs;
             if (result.exitCode === 0 && result.stdout) {
-                this._trace(traceId, "captured", { durationMs, exitCode: result.exitCode });
-                // Send the response back to the original sender as a new cloud message.
-                // This will trigger the server to push it via WebSocket to the sender,
-                // which will trigger their auto-relay in turn.
-                try {
-                    await backend.recordMessage({
-                        fromPeerId: this.localPeerId,
-                        toPeerId: msg.fromPeerId,
-                        message: result.stdout,
-                        response: null,
-                        durationMs,
-                        success: true,
-                        error: null,
-                        // 260511-o3p: tag the auto-relay echo so server 3.1.6+ filters
-                        // it from cogent_get_history by default. Older servers ignore
-                        // the field; older clients see it via the optional field.
-                        isRelayEcho: true,
-                        traceId,
-                    });
-                    logger.info(`Auto-relay: response sent back to ${msg.fromPeerId} (${durationMs}ms)`);
-                }
-                catch (recordErr) {
-                    logger.error(`Auto-relay: failed to record response message: ${recordErr}`);
-                }
+                await this._relayCapturedReply(msg, result, traceId, durationMs, false);
             }
             else {
-                this._trace(traceId, "failed", { exitCode: result.exitCode, durationMs });
+                this._trace(traceId, "failed", { exitCode: result.exitCode, sandboxBlocked: result.sandboxBlocked, durationMs });
                 logger.warn(`Auto-relay: execRemote failed (exit=${result.exitCode}): ${result.stderr}`);
+                // Blocked OS sandbox (unprivileged userns) is HOST-WIDE — a rotated-session
+                // retry can't fix it, and the failure was previously dropped silently (the
+                // sender just saw the task never finish). Surface an actionable message and
+                // stop. Text rides in `message` (the only field that crosses the wire).
+                if (result.sandboxBlocked) {
+                    try {
+                        await backend.recordMessage({
+                            fromPeerId: this.localPeerId,
+                            toPeerId: msg.fromPeerId,
+                            message: `⚠️ Cogent could not run "${this.localPeerId}": the Codex sandbox failed to initialize on the agent host (unprivileged user namespaces blocked), so it can't edit files or run tests. Remedy on the agent host: set COGENT_CODEX_SANDBOX_FALLBACK=1 (auto-bypass) or COGENT_CODEX_SANDBOX=bypass, or enable unprivileged userns (sysctl kernel.apparmor_restrict_unprivileged_userns=0). (trace ${traceId})`,
+                            response: null,
+                            durationMs,
+                            success: false,
+                            error: "SANDBOX_BLOCKED",
+                            isRelayEcho: true,
+                            traceId,
+                        });
+                    }
+                    catch (recordErr) {
+                        logger.error(`Auto-relay: failed to record sandbox-blocked message: ${recordErr}`);
+                    }
+                    return;
+                }
                 // Session may have rotated -- retry once with fresh detection
                 const freshId = await detectCurrentSessionFor(getConfig().COGENT_PLATFORM, this.localCwd);
                 if (freshId && freshId !== this.localSessionId) {
@@ -621,27 +698,10 @@ export class AutoRelayService {
                     this.localSessionId = freshId;
                     const retry = await execRemote(getConfig().COGENT_PLATFORM, this.localSessionId, formatted, this.localCwd);
                     if (retry.exitCode === 0 && retry.stdout) {
-                        // Send retry response back
-                        try {
-                            this._trace(traceId, "captured", { durationMs: Date.now() - startMs, retried: true });
-                            await backend.recordMessage({
-                                fromPeerId: this.localPeerId,
-                                toPeerId: msg.fromPeerId,
-                                message: retry.stdout,
-                                response: null,
-                                durationMs: Date.now() - startMs,
-                                success: true,
-                                error: null,
-                                // 260511-o3p: same tagging as the primary path; both call
-                                // sites are auto-relay echoes and must be filtered alike.
-                                isRelayEcho: true,
-                                traceId,
-                            });
-                            logger.info(`Auto-relay: retry response sent to ${msg.fromPeerId}`);
-                        }
-                        catch (retryRecordErr) {
-                            logger.error(`Auto-relay: failed to record retry response: ${retryRecordErr}`);
-                        }
+                        // Retry path must apply the SAME capture-contract handling as the
+                        // primary (Story 8.4 F-B): a downgrade on the retry is otherwise
+                        // disguised as a clean auto-capture.
+                        await this._relayCapturedReply(msg, retry, traceId, Date.now() - startMs, true);
                     }
                     else {
                         logger.warn(`Auto-relay: retry also failed (exit=${retry.exitCode})`);