@event4u/agent-config 16.1.0 → 16.3.0

package/src/scripts/_lib/json_pointers.ts

@@ -9,10 +9,15 @@
  *
  * 1. **No array indices.** Pointers MUST target named object keys only.
  *    `/hooks/PostToolUse` is valid; `/hooks/PostToolUse/0` is not.
- * 2. **Arrays carry a `value_hash` discriminator.** A pointer that
- *    targets a parent whose value is a list records the SHA-256 of the
- *    JSON-serialised list contents the install wrote, so uninstall can
- *    identify the owned elements by content rather than position.
+ * 2. **Arrays carry a discriminator, and which one depends on who owns
+ *    the list.** A list this package owns outright records the SHA-256 of
+ *    the contents the install wrote, so uninstall identifies the owned
+ *    elements by content rather than position. A list it merely APPENDS to —
+ *    a host's `hooks.<event>`, shared with every other agent package the
+ *    consumer installed — records an `entry_signature` instead: uninstall
+ *    then filters that list rather than claiming it. Recording a hash there
+ *    was the defect; it made uninstall either delete a neighbour's entries
+ *    or, once a neighbour had appended, refuse and leave ours behind.
  *
  * `value_hash` reproduces Python's canonical
  * `json.dumps(value, sort_keys=True, separators=(",", ":"))` output
@@ -22,6 +27,8 @@
 
 import { createHash } from "node:crypto";
 
+import { HOOK_SIGNATURES, isManagedEntry } from "./host_hook_merge.js";
+
 type JsonValue =
   | null
   | boolean
@@ -172,6 +179,23 @@ export function value_hash(value: unknown): string {
 export interface PointerEntry {
   json_pointer: string;
   value_hash: string | null;
+  /**
+   * Set when the pointer targets a SHARED array this package appends to
+   * rather than owns — a host's `hooks.<event>` list.
+   *
+   * Recording `value_hash` for such an array claims the whole list, and both
+   * outcomes of that claim are wrong at uninstall: an untouched list is
+   * deleted wholesale, taking a neighbour's entries with it, and a list a
+   * neighbour appended to reports `drift` and leaves OUR entries behind. With
+   * a signature, subtraction filters the array instead: entries carrying the
+   * signature go, everything else stays, and the key is removed only once the
+   * list is empty.
+   *
+   * `value_hash` is null whenever this is set — the two are alternatives, and
+   * a hash of a list other packages may legitimately have changed is not a
+   * drift signal, it is a false one.
+   */
+  entry_signature?: string;
 }
 
 export interface MergeEntry extends PointerEntry {
@@ -187,6 +211,12 @@ function _is_plain_object(value: unknown): value is Record<string, unknown> {
 export interface CollectPointersOptions {
   prefix?: string;
   include_arrays?: boolean;
+  /**
+   * Content signature identifying this package's entries inside a shared
+   * array. When set, an array pointer records the signature instead of a
+   * whole-list hash (see `PointerEntry.entry_signature`).
+   */
+  entry_signature?: string;
 }
 
 /**
@@ -208,6 +238,7 @@ export function collect_pointers(
 ): PointerEntry[] {
   const prefix = options.prefix ?? "";
   const include_arrays = options.include_arrays ?? true;
+  const entry_signature = options.entry_signature ?? "";
   const entries: PointerEntry[] = [];
   for (const [key, value] of Object.entries(overlay)) {
     const pointer = `${prefix}/${_escape_segment(String(key))}`;
@@ -219,14 +250,29 @@ export function collect_pointers(
         entries.push({ json_pointer: pointer, value_hash: null });
       } else {
         entries.push(
-          ...collect_pointers(value, { prefix: pointer, include_arrays }),
+          ...collect_pointers(value, {
+            prefix: pointer,
+            include_arrays,
+            entry_signature,
+          }),
         );
       }
     } else if (Array.isArray(value)) {
-      entries.push({
-        json_pointer: pointer,
-        value_hash: include_arrays ? value_hash(value) : null,
-      });
+      // Only the host's shared hook lists are appended to; every other array
+      // in the same overlay — `mcpServers.*.args`, for one — this package
+      // still owns outright and keeps hashing.
+      if (entry_signature !== "" && pointer.startsWith("/hooks/")) {
+        entries.push({
+          json_pointer: pointer,
+          value_hash: null,
+          entry_signature,
+        });
+      } else {
+        entries.push({
+          json_pointer: pointer,
+          value_hash: include_arrays ? value_hash(value) : null,
+        });
+      }
     } else {
       entries.push({ json_pointer: pointer, value_hash: null });
     }
@@ -252,11 +298,16 @@ export function build_merge_entries(
   file_label: string,
   overlay: Record<string, unknown>,
 ): MergeEntry[] {
-  const pointers = collect_pointers(overlay);
+  const pointers = collect_pointers(overlay, {
+    entry_signature: HOOK_SIGNATURES[file_label] ?? "",
+  });
   return pointers.map((entry) => ({
     file: file_label,
     json_pointer: entry.json_pointer,
     value_hash: entry.value_hash,
+    ...(entry.entry_signature === undefined
+      ? {}
+      : { entry_signature: entry.entry_signature }),
   }));
 }
 
@@ -304,6 +355,8 @@ export interface SubtractWarning {
 export interface SubtractEntry {
   json_pointer: string;
   value_hash?: string | null;
+  /** See `PointerEntry.entry_signature` — filters a shared array in place. */
+  entry_signature?: string;
 }
 
 /**
@@ -354,7 +407,36 @@ export function subtract_pointers(
       continue;
     }
     const [parent, leaf] = nav;
-    if (expected !== null) {
+    const signature = entry.entry_signature ?? "";
+    if (signature !== "") {
+      const current = parent[leaf];
+      if (!Array.isArray(current)) {
+        warnings.push({
+          pointer,
+          reason: "missing",
+          expected_hash: null,
+          actual_hash: null,
+        });
+        continue;
+      }
+      // A shared list: drop only the entries carrying our signature, keep a
+      // neighbour's in order and byte-identical, and remove the key only once
+      // nothing of ours is left in it.
+      const kept = current.filter((item) => !isManagedEntry(item, signature));
+      if (kept.length === current.length) {
+        warnings.push({
+          pointer,
+          reason: "missing",
+          expected_hash: null,
+          actual_hash: null,
+        });
+        continue;
+      }
+      if (kept.length > 0) {
+        parent[leaf] = kept;
+        continue;
+      }
+    } else if (expected !== null) {
       const actual = value_hash(parent[leaf]);
       if (actual !== expected) {
         warnings.push({

package/src/scripts/_lib/lean_projection_mode.ts

@@ -1,20 +1,65 @@
 /**
- * `lean_projection.mode` — ONE definition of what the three modes mean.
- *
- * The projector (`condense.ts`) resolves the value with a real YAML parse; the
- * delivery concern (`hooks/rule_inject_hook.ts`) resolves it with an
- * indentation-shaped read, because a hook must never fail a tool call because a
- * parser could not load. Two readers is unavoidable. Two *normalisations* is
- * not, and would be the defect worth preventing: a projector that writes thin
- * files while the concern believes the mode is off delivers pointers and no
- * bodies, which is exactly the 36.2 % arm the delivery mode exists to replace.
- *
- * So each side supplies the raw string from its own reader and this module
- * decides what it means. Anything unrecognised — absent key, typo, `null`,
- * a non-string — is `eager-all`: the parser fallback, which is NOT the value
- * the template ships (see the type below), because a mode nobody can spell
- * must never silently thin the standing corpus.
+ * `lean_projection.mode` — ONE definition of what the three modes mean, and
+ * since step 1.2 of `road-to-a-rule-carrier-that-works-outside-the-repo`, ONE
+ * reader that produces it.
+ *
+ * ── What this module used to be, and why that was not enough ──
+ *
+ * It owned the NORMALISATION and left each caller its own READER: the projector
+ * (`condense.ts`) resolved the value with a real YAML parse over the full
+ * settings cascade; the delivery concern (`hooks/rule_inject_hook.ts`) resolved
+ * it with an indentation-shaped read of `<cwd>/.agent-settings.yml` alone. The
+ * header argued that two readers were unavoidable and that two *normalisations*
+ * were the only thing worth preventing.
+ *
+ * Measured on 2026-10-02, that split was not a stylistic difference — it was a
+ * disagreement about WHICH FILE. The installer writes settings to
+ * `<root>/agents/settings/.agent-settings.yml` (`agent_settings.ts`'s canonical
+ * write target; `install.ts:4108`). The concern read `<root>/.agent-settings.yml`,
+ * the LEGACY location, and nothing else. On a normal install the concern
+ * therefore read a file that does not exist, got `''`, normalised it to
+ * `eager-all`, and closed its own gate — while the projector, reading the
+ * canonical file, had written thin stubs. That is the pointer arm the delivery
+ * mode exists to replace, reached by configuration rather than by choice, and
+ * it is a SECOND independent cause of the silence step 1.1 repaired: a consumer
+ * that fixed the package root alone would still have received nothing.
+ *
+ * The user-global layer was invisible to the concern for the same reason, which
+ * matters more than it sounds: ADR-020 installs are global-only, so for those
+ * consumers the ONLY layer carrying a mode is one the concern never opened.
+ *
+ * ── D3: one resolver, not a parity test between three ──
+ *
+ * The roadmap's D3 records the choice and the reason — a parity test keeps
+ * three readers that can drift again, and this module already existed to be the
+ * one. `resolveLeanProjection` below is that resolver. It reads the layers in
+ * the order `load_agent_settings` defines (template base, user-global,
+ * project), through `project_settings_path`, which prefers the canonical file
+ * and falls back to the legacy one, so a hand-edited root file still works.
+ *
+ * ── Why the template path is passed in rather than resolved ──
+ *
+ * `agent_settings.default_template_path()` derives the package root from
+ * `import.meta.url` three directories up. That is correct for a module at
+ * `<pkg>/src/scripts/_lib/`; inside the composed hook bundle `import.meta.url`
+ * is `<pkg>/dist/hooks/dispatch.js`, so the same arithmetic yields the PARENT
+ * of the package and the template read misses. Verified in the built bundle,
+ * not inferred. With no template the base layer is `{}` and an unconfigured
+ * consumer resolves to `eager-all` — the silence again, one layer lower. So a
+ * caller that knows the real package root (the carrier does: the dispatcher
+ * passes it) hands it over, and the resolver reads the template from there.
+ *
+ * ── What has NOT changed ──
+ *
+ * Anything unrecognised — absent key, typo, `null`, a non-string — is still
+ * `eager-all`: the parser fallback, which is NOT the value the template ships
+ * (see the type below), because a mode nobody can spell must never silently
+ * thin the standing corpus. That fallback now fires only when no layer carried
+ * a value at all, rather than whenever the concern looked in the wrong place.
  */
+import * as path from 'node:path';
+
+import { load_agent_settings } from './agent_settings.js';
 
 /**
  * The three projection shapes, and the two different defaults they answer to.
@@ -180,3 +225,218 @@ export function describeDroppedHosts(res: LeanProjectionHosts): string[] {
 export function thinsHost(mode: LeanProjectionMode, hosts: readonly string[], hostId: string): boolean {
     return writesThinFiles(mode) && hosts.includes(hostId);
 }
+
+export interface ResolvedLeanProjection {
+    readonly mode: LeanProjectionMode;
+    readonly hosts: LeanProjectionHosts;
+    /**
+     * Was `lean_projection.mode` set on a layer the USER controls — user-global,
+     * project, or project-local — rather than inherited from the shipped
+     * template?
+     *
+     * THE DISTINCTION IS NOT A REFINEMENT, IT IS A SAFETY BOUNDARY, and it is
+     * the one `road-to-an-installed-layer-that-is-thinned` names in its Context:
+     * the shipped template already says `mode: delivery`
+     * (`src/config/agent-settings.template.yml:212-214`), so the moment the
+     * INSTALLER resolves the mode through this resolver, the template value
+     * alone would thin every consumer's `~/.claude/rules` — a default flip
+     * arriving as a side effect of wiring a reader, with nobody deciding it.
+     *
+     * Whether that default flips is owner-reserved (that roadmap's blocker
+     * `default-flip-of-the-installed-layer`, decision D4). So the installer must
+     * be able to ask a question `mode` cannot answer: not "what is the mode" but
+     * "did a human ask for this". That is this flag, and it is why it reports
+     * provenance rather than a value.
+     *
+     * `false` whenever no layer the user controls carries the key — including
+     * when `mode` reads `delivery` from the template, which is exactly the case
+     * that must NOT be read as consent.
+     */
+    readonly modeExplicit: boolean;
+}
+
+export interface ResolveOptions {
+    /** Project tree whose settings cascade is read. */
+    readonly projectRoot?: string | null;
+    /** Explicit settings file, overriding `projectRoot`. Tests and `condense` pin this. */
+    readonly settingsPath?: string | null;
+    /** Install root carrying `src/config/agent-settings.template.yml`. */
+    readonly packageRoot?: string | null;
+}
+
+/**
+ * THE resolver. Every surface that asks "which delivery mode" calls this.
+ *
+ * Tolerant like everything else on a hook path: `load_agent_settings` answers
+ * with defaults on an unreadable or malformed file and never throws, and the
+ * normalisers above turn anything unrecognised into the safe value. A caller
+ * on a hot path pays ONE cascade read per prompt; `modeExplicit` is a lazy
+ * getter, so the second, template-isolated read happens only for a caller that
+ * actually reads provenance — which today is the installer and nothing else.
+ */
+export function resolveLeanProjection(opts: ResolveOptions = {}): ResolvedLeanProjection {
+    // The LEGACY root path, deliberately, and not `project_settings_path`'s
+    // either-or pick. `load_agent_settings` expands whatever it is given into
+    // `[the file, <its dir>/agents/settings/.agent-settings.yml, <its dir>/
+    // agents/settings/.agent-settings.local.yml]` and merges them deepest-wins,
+    // so handing it the root path reads BOTH the legacy and the canonical file
+    // — which is strictly more than picking one, and is what a tree carrying
+    // both should resolve to. It also keeps one export out of this module's
+    // import list, which is runtime bytes in the composed hook bundle.
+    const file =
+        opts.settingsPath ?? path.join(opts.projectRoot ?? process.cwd(), '.agent-settings.yml');
+    const tpl =
+        opts.packageRoot == null
+            ? null
+            : path.join(opts.packageRoot, 'src', 'config', 'agent-settings.template.yml');
+    let lean: unknown;
+    try {
+        lean = load_agent_settings(
+            tpl === null ? { project_path: file } : { project_path: file, template_path: tpl },
+        )['lean_projection'];
+    } catch {
+        /* a settings layer nothing can read must never fail a turn */
+    }
+    const obj = typeof lean === 'object' && lean !== null && !Array.isArray(lean) ? lean : {};
+    const o = obj as Record<string, unknown>;
+    return {
+        mode: normalizeLeanProjectionMode(o['mode'] ?? ''),
+        hosts: resolveLeanProjectionHosts(o['hosts']),
+        // LAZY, and the hot path is the reason. Provenance needs a SECOND,
+        // template-isolated cascade, and only the installer reads it — the
+        // delivery concern on `user_prompt_submit` destructures `{ mode, hosts }`
+        // and discards this field, so computing it eagerly doubled the per-prompt
+        // settings read for an answer nobody asked for. A getter keeps the
+        // field's shape (`readonly modeExplicit: boolean`) and charges only the
+        // caller that touches it.
+        get modeExplicit(): boolean {
+            return rawExplicitLeanProjectionMode(opts) !== '';
+        },
+    };
+}
+
+/**
+ * A path no tree contains, so `template_defaults` contributes nothing.
+ *
+ * This is the mechanism `load_agent_settings` documents for the purpose —
+ * "a test or tool that pins every other input can pin the defaults base too,
+ * and point it at a nonexistent file to isolate the cascade" — used here for a
+ * tool rather than a test. It is a reserved device filename on every platform
+ * this package runs on and is never created, so the read fails and the loader's
+ * own tolerance turns it into `{}`.
+ *
+ * The alternative — re-reading the YAML layers by hand — was rejected because
+ * it would be a SECOND reader of the same key, which is the precise defect step
+ * 1.2 of the carrier roadmap existed to remove. Isolating the base keeps one
+ * reader and changes only which layers it is given.
+ */
+const NO_TEMPLATE_LAYER = path.join(path.sep, 'dev', 'null', 'agent-config-absent-template.yml');
+
+/**
+ * The RAW `lean_projection.mode` string from the user-controlled layers only,
+ * or `''` when no such layer carries it.
+ *
+ * Raw and un-normalised on purpose: {@link normalizeLeanProjectionMode} maps
+ * everything unrecognised — `''` included — onto `eager-all`, so a normalised
+ * answer cannot tell "the user chose eager-all" from "the user chose nothing".
+ * Provenance needs exactly that distinction, so it has to be read before the
+ * normaliser runs.
+ */
+export function rawExplicitLeanProjectionMode(opts: ResolveOptions = {}): string {
+    const file =
+        opts.settingsPath ?? path.join(opts.projectRoot ?? process.cwd(), '.agent-settings.yml');
+    let lean: unknown;
+    try {
+        lean = load_agent_settings({ project_path: file, template_path: NO_TEMPLATE_LAYER })[
+            'lean_projection'
+        ];
+    } catch {
+        return ''; // a layer nothing can read states no preference
+    }
+    if (typeof lean !== 'object' || lean === null || Array.isArray(lean)) return '';
+    const m = (lean as Record<string, unknown>)['mode'];
+    return typeof m === 'string' ? m.trim() : '';
+}
+
+/**
+ * Did a human ask for this mode, and is it the one the caller is gated on?
+ *
+ * The question an installer actually has. `modeExplicit` alone is not enough —
+ * a consumer who explicitly set `eager-all` has set the key explicitly and must
+ * NOT be thinned — so the two conditions are folded here rather than left to
+ * every caller to remember to combine.
+ */
+export function leanProjectionModeChosen(
+    mode: LeanProjectionMode,
+    opts: ResolveOptions = {},
+): boolean {
+    const raw = rawExplicitLeanProjectionMode(opts);
+    return raw !== '' && normalizeLeanProjectionMode(raw) === mode;
+}
+
+/**
+ * May the INSTALLER thin this host's rule tree?
+ *
+ * The host-aware sibling of {@link leanProjectionModeChosen}, and the predicate
+ * `road-to-an-installed-layer-that-is-thinned` step 1.1 keys on. It folds the
+ * three conditions that must hold together, once, so no caller has to remember
+ * to combine them:
+ *
+ * 1. **A human asked.** `modeExplicit` — false whenever the only layer carrying
+ *    the key is the shipped template, which already says `delivery`. Reading the
+ *    template as consent would thin every consumer's `~/.claude/rules` as a side
+ *    effect of wiring a reader, which is the owner-reserved default flip (that
+ *    roadmap's blocker, decision D4).
+ * 2. **The chosen mode actually writes stubs.** A consumer who explicitly chose
+ *    `eager-all` has set the key and must NOT be thinned on the strength of
+ *    having an opinion.
+ * 3. **This host is in scope.** The same `hosts:` list the projector honours, so
+ *    installer and projector cannot disagree about which trees are thinned.
+ *
+ * ONE `resolveLeanProjection` call, which is why this is not two
+ * {@link leanProjectionModeChosen} calls: that one answers "is the chosen mode
+ * exactly X" and knows nothing about `hosts`, so a caller combining it with a
+ * host check by hand would re-create the fold this function exists to own.
+ *
+ * That is one CALL and two cascade READS here, because reading `modeExplicit`
+ * triggers its lazy getter and a second, template-isolated load. The installer
+ * runs once per deploy and does not care; the cost is named rather than rounded
+ * down because the same resolver serves the per-prompt delivery concern, which
+ * does NOT read provenance and therefore does not pay it.
+ */
+export function installerThinsHost(hostId: string, opts: ResolveOptions = {}): boolean {
+    const { mode, hosts, modeExplicit } = resolveLeanProjection({
+        ...opts,
+        settingsPath: opts.settingsPath ?? NO_PROJECT_LAYER,
+    });
+    return modeExplicit && thinsHost(mode, hosts.hosts, hostId);
+}
+
+/**
+ * A path no tree contains, so the PROJECT cascade contributes nothing.
+ *
+ * The same device {@link NO_TEMPLATE_LAYER} uses, pointed at the other end of
+ * the cascade, and the reason is scope rather than isolation: the thing
+ * {@link installerThinsHost} gates is a mutation of `~/.claude/rules`, which
+ * belongs to the MACHINE. A per-checkout value must not decide it, in either
+ * direction — a project saying `delivery` would thin the layer every other
+ * project on that machine reads, and a project saying `eager-all` would
+ * suppress an opt-in the user wrote user-globally, because the project cascade
+ * merges last and wins.
+ *
+ * `load_agent_settings` reads `user_global_settings_paths()` regardless of what
+ * `project_path` it is given, so pointing the project layer at nothing leaves
+ * exactly the machine-global layers — which is the scope the installer's
+ * sibling `_resolve_global_rule_scope` already resolves for the same deploy.
+ * A caller may still pass an explicit `settingsPath` (tests pin one). A
+ * `projectRoot` handed to {@link installerThinsHost} is DISCARDED — the `??`
+ * chain terminates at `settingsPath` before `projectRoot` is consulted — which
+ * is the intended behaviour and is stated here because a caller passing it and
+ * expecting it honoured would otherwise get no signal.
+ */
+const NO_PROJECT_LAYER = path.join(
+    path.sep,
+    'dev',
+    'null',
+    'agent-config-absent-project-settings.yml',
+);

package/src/scripts/_lib/llm_proposer_transport.ts

@@ -37,6 +37,7 @@
  */
 
 import { load_anthropic_key } from '../ai_council/clients.js';
+import { sanitize_text } from './retrieval_sanitize.js';
 import type {
     GenerationRequest,
     GenerationResult,
@@ -140,10 +141,19 @@ export function anthropicGenerator(keyPath: string | null = null): TextGenerator
             );
         }
         const data = (await resp.json()) as AnthropicResponse;
-        const text = (data.content ?? [])
-            .filter((b) => b.type === 'text')
-            .map((b) => b.text ?? '')
-            .join('');
+        // Sanitize AT THE TRANSPORT, which is the choke point and one call site.
+        // A flag every caller has to remember is the instruction-only
+        // enforcement this package diagnoses in itself, and a partially
+        // sanitized world — some callers filtered, some not — is worse than
+        // either end state. The floor is a no-op on ordinary text, so what
+        // changes here is only a response that carries a hidden-instruction
+        // vector; see `docs/contracts/retrieval-read-surfaces.md`.
+        const text = sanitize_text(
+            (data.content ?? [])
+                .filter((b) => b.type === 'text')
+                .map((b) => b.text ?? '')
+                .join(''),
+        );
         // An empty body is returned AS an empty body rather than repaired here.
         // The arm's own output contract refuses it and classifies the refusal;
         // repairing it in the transport would move a decision into the layer

package/src/scripts/_lib/machine_wake.ts

@@ -12,9 +12,11 @@
  * a property of the `user_prompt_submit` SLOT, not of any one concern: the host
  * delivers a background task notification on the same slot as a typed prompt,
  * so every concern that consumes or replaces per-turn state has the same defect.
- * Two are known — the git-authorization ledger with its pending-refusal record,
- * and the suggestion-capture latch. A predicate private to one of them would
- * have repaired one and left the other, which is risk 4 of
+ * Three are known — the git-authorization ledger with its pending-refusal
+ * record, the suggestion-capture latch, and `language_mirror_hook`'s reply
+ * pin, which does not consult this predicate at all and so pins a language
+ * from a frame nobody typed. A predicate private to one of them would have
+ * repaired one and left the others, which is risk 4 of
  * `road-to-turn-bound-authorization-integrity`.
  *
  * **The discriminator, quoted from a captured payload rather than from
@@ -26,6 +28,16 @@
  * `<task-id>`, `<tool-use-id>`, `<status>` and `<summary>` children. A typed
  * turn carries none of them.
  *
+ * **The third shape, added 2026-10-03, found the same way.** A subagent
+ * hand-back arrives on this slot as `<agent-message from="…">`, and 12 of the
+ * 153 hook-sourced user records in the capture open with it — every one on
+ * `hook:claude:UserPromptSubmit`. It was found because one landed 13 seconds
+ * after a merge and rewrote the git-authorization ledger to
+ * `prompt_chars: 5599`, the length of the injected frame rather than of any
+ * sentence a human sent. Its prefix stops before the `>` because the element
+ * carries an attribute; that is a shorter literal than the other two, not a
+ * substring match — it is still anchored at position zero.
+ *
  * **Prefix, not substring, and that is the whole care in this file.** A
  * notification is a synthetic turn the host constructs, so the element opens it.
  * Matching anywhere in the text would make the question "why did this
@@ -37,6 +49,7 @@
 export const MACHINE_WAKE_PREFIXES: readonly string[] = [
     '<task-notification>',
     '<system-reminder>',
+    '<agent-message',
 ];
 
 /** @see MACHINE_WAKE_PREFIXES — unknown shapes answer `true`, deliberately. */